{"id":"CVE-2025-39948","aliases":["AZL-75296","BELL-CVE-2025-39948","DEBIAN-CVE-2025-39948","EUVD-2025-32395","GHSA-7v58-mp27-j7rx","OESA-2026-1566","OESA-2026-1567","OESA-2026-1570","ROOT-OS-UBUNTU-2404-CVE-2025-39948","SUSE-SU-2025:21040-1","SUSE-SU-2025:21052-1","SUSE-SU-2025:21056-1","SUSE-SU-2025:21064-1","SUSE-SU-2025:21080-1","SUSE-SU-2025:21147-1","SUSE-SU-2025:21180-1","SUSE-SU-2025:4057-1","SUSE-SU-2025:4128-1","SUSE-SU-2025:4132-1","SUSE-SU-2025:4140-1","SUSE-SU-2025:4141-1","SUSE-SU-2025:4301-1","SUSE-SU-2026:20561-1","UBUNTU-CVE-2025-39948","USN-8095-1","USN-8095-2","USN-8095-3","USN-8095-4","USN-8095-5","USN-8100-1","USN-8125-1","USN-8126-1","USN-8165-1","USN-8261-1","openSUSE-SU-2025:20091-1"],"status":"published","title":"ice: fix Rx page leak on multi-buffer frames","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix Rx page leak on multi-buffer frames\n\nThe ice_put_rx_mbuf() function handles calling ice_put_rx_buf() for each\nbuffer in the current frame. This function was introduced as part of\nhandling multi-buffer XDP support in the ice driver.\n\nIt works by iterating over the buffers from first_desc up to 1 plus the\ntotal number of fragments in the frame, cached from before the XDP program\nwas executed.\n\nIf the hardware posts a descriptor with a size of 0, the logic used in\nice_put_rx_mbuf() breaks. Such descriptors get skipped and don't get added\nas fragments in ice_add_xdp_frag. Since the buffer isn't counted as a\nfragment, we do not iterate over it in ice_put_rx_mbuf(), and thus we don't\ncall ice_put_rx_buf().\n\nBecause we don't call ice_put_rx_buf(), we don't attempt to re-use the\npage or free it. This leaves a stale page in the ring, as we don't\nincrement next_to_alloc.\n\nThe ice_reuse_rx_page() assumes that the next_to_alloc has been incremented\nproperly, and that it always points to a buffer with a NULL page. Since\nthis function doesn't check, it will happily recycle a page over the top\nof the next_to_alloc buffer, losing track of the old page.\n\nNote that this leak only occurs for multi-buffer frames. The\nice_put_rx_mbuf() function always handles at least one buffer, so a\nsingle-buffer frame will always get handled correctly. It is not clear\nprecisely why the hardware hands us descriptors with a size of 0 sometimes,\nbut it happens somewhat regularly with \"jumbo frames\" used by 9K MTU.\n\nTo fix ice_put_rx_mbuf(), we need to make sure to call ice_put_rx_buf() on\nall buffers between first_desc and next_to_clean. Borrow the logic of a\nsimilar function in i40e used for this same purpose. Use the same logic\nalso in ice_get_pgcnts().\n\nInstead of iterating over just the number of fragments, use a loop which\niterates until the current index reaches to the next_to_clean element just\npast the current frame. Unlike i40e, the ice_put_rx_mbuf() function does\ncall ice_put_rx_buf() on the last buffer of the frame indicating the end of\npacket.\n\nFor non-linear (multi-buffer) frames, we need to take care when adjusting\nthe pagecnt_bias. An XDP program might release fragments from the tail of\nthe frame, in which case that fragment page is already released. Only\nupdate the pagecnt_bias for the first descriptor and fragments still\nremaining post-XDP program. Take care to only access the shared info for\nfragmented buffers, as this avoids a significant cache miss.\n\nThe xdp_xmit value only needs to be updated if an XDP program is run, and\nonly once per packet. Drop the xdp_xmit pointer argument from\nice_put_rx_mbuf(). Instead, set xdp_xmit in the ice_clean_rx_irq() function\ndirectly. This avoids needing to pass the argument and avoids an extra\nbit-wise OR for each buffer in the frame.\n\nMove the increment of the ntc local variable to ensure its updated *before*\nall calls to ice_get_pgcnts() or ice_put_rx_mbuf(), as the loop logic\nrequires the index of the element just after the current frame.\n\nNow that we use an index pointer in the ring to identify the packet, we no\nlonger need to track or cache the number of fragments in the rx_ring.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00399,"percentile":0.34528,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-401"],"published":"2025-10-04T07:31:09Z","modified":"2026-11-11T09:39:07Z","fixes":[{"ecosystem":"Alpaquita:25","package":"linux-lts","fixed_in":["6.12.51-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"linux-lts","fixed_in":["6.18.35-r1"],"sources":["osv"]},{"ecosystem":"Linux","package":"Kernel","fixed_in":["6.6.160","6.12.49","6.16.9"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["6.12.57-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["6.16.9-1"],"sources":["osv"]},{"ecosystem":"Root:Ubuntu:24.04","package":"linux","fixed_in":["6.8.0-149.149.aikido.91"],"sources":["osv"]},{"ecosystem":"Root:Ubuntu:24.04","package":"rootio-linux","fixed_in":["6.8.0-149.149.aikido.91"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.8","fixed_in":["6.8.0-1050.53~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.8","fixed_in":["6.8.0-1051.57~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-6.8","fixed_in":["6.8.0-1058.65~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.8","fixed_in":["6.8.0-1052.55~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.8","fixed_in":["6.8.0-106.106~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-ibm-6.8","fixed_in":["6.8.0-1049.49~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.8","fixed_in":["6.8.0-106.106.1~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.8","fixed_in":["6.8.0-1049.52~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.8","fixed_in":["6.8.0-1047.48~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-6.8","fixed_in":["6.8.0-106.106~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:Realtime:22.04:LTS","package":"linux-realtime-6.8","fixed_in":["6.8.1-1045.46~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux","fixed_in":["6.8.0-106.106"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws","fixed_in":["6.8.0-1050.53"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure","fixed_in":["6.8.0-1051.57"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-fde","fixed_in":["6.8.0-1058.65"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-nvidia","fixed_in":["6.8.0-1039.42"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp","fixed_in":["6.8.0-1052.55"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-gke","fixed_in":["6.8.0-1048.53"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-gkeop","fixed_in":["6.8.0-1035.38"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-ibm","fixed_in":["6.8.0-1049.49"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency","fixed_in":["6.8.0-106.106.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia","fixed_in":["6.8.0-1049.52"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-lowlatency","fixed_in":["6.8.0-1049.52.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-tegra","fixed_in":["6.8.0-1020.20"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle","fixed_in":["6.8.0-1047.48"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi","fixed_in":["6.8.0-1050.54"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-xilinx","fixed_in":["6.8.0-1028.29"],"sources":["osv"]},{"ecosystem":"Ubuntu:Nvidia-BlueField:24.04:LTS","package":"linux-bluefield","fixed_in":["6.8.0-1017.21"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-raspi-realtime","fixed_in":["6.8.0-2040.41"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime","fixed_in":["6.8.1-1045.46"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-aws-fips","fixed_in":["6.8.0-1050.53+fips1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-azure-fips","fixed_in":["6.8.0-1052.58+fips1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-fips","fixed_in":["6.8.0-106.106+fips1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-gcp-fips","fixed_in":["6.8.0-1052.55+fips1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.161.1-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"linux-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.12.44-r0"},{"fixed":"6.12.51-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"linux-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.12.92-r1"},{"fixed":"6.18.35-r1"}]}]},{"source":"osv","ecosystem":"Linux","package":"Kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.160"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.49"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.16.9"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.57-1"}]}],"versions":["6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.57-1~bpo12+1"]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.16.9-1"}]}],"versions":["6.12.100-1","6.12.101-1","6.12.105-1","6.12.107-1","6.12.111-1","6.12.113-1","6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.57-1","6.12.57-1~bpo12+1","6.12.63-1","6.12.63-1~bpo12+1","6.12.69-1","6.12.69-1~bpo12+1","6.12.73-1","6.12.73-1~bpo12+1","6.12.74-1","6.12.74-2","6.12.74-2~bpo12+1","6.12.85-1","6.12.85-1~bpo12+1","6.12.86-1","6.12.86-1~bpo12+1","6.12.88-1","6.12.88-1~bpo12+1","6.12.90-1","6.12.90-1~bpo12+1","6.12.90-2","6.12.90-2~bpo12+1","6.12.94-1","6.12.94-1~bpo12+1","6.12.95-1","6.12.95-1~bpo12+1","6.12.96-1","6.13.10-1~exp1","6.13.11-1~exp1","6.13.2-1~exp1","6.13.3-1~exp1","6.13.4-1~exp1","6.13.5-1~exp1","6.13.6-1~exp1","6.13.7-1~exp1","6.13.8-1~exp1","6.13.9-1~exp1","6.13~rc6-1~exp1","6.13~rc7-1~exp1","6.14.3-1~exp1","6.14.5-1~exp1","6.14.6-1~exp1","6.15-1~exp1","6.15.1-1~exp1","6.15.2-1~exp1","6.15.3-1~exp1","6.15.4-1~exp1","6.15.5-1~exp1","6.15.6-1~exp1","6.15~rc7-1~exp1","6.16-1~exp1","6.16.1-1~exp1","6.16.3-1","6.16.3-1~bpo13+1","6.16.5-1","6.16.6-1","6.16.7-1","6.16.8-1","6.16~rc7-1~exp1"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.0-142.0.0.136.oe2403sp1"}]}],"bundled":73},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.0-142.0.0.137.oe2403sp2"}]}],"bundled":73},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.0-142.0.0.124.oe2403"}]}],"bundled":73},{"source":"osv","ecosystem":"Root:Ubuntu:24.04","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-149.149.aikido.91"}]}]},{"source":"osv","ecosystem":"Root:Ubuntu:24.04","package":"rootio-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-149.149.aikido.91"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-36.1"}]}],"bundled":191},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-36.1.21.13"}]}],"bundled":191},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-36.1"}]}],"bundled":191},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-36.1"}]}],"bundled":191},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-38.1"}]}],"bundled":191},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-38.1"}]}],"bundled":191},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-36.1"}]}],"bundled":191},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-36.1.21.13"}]}],"bundled":191},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-36.1"}]}],"bundled":191},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-36.1"}]}],"bundled":191},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-38.1"}]}],"bundled":191},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-38.1"}]}],"bundled":191},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.7.1"}]}],"bundled":83},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.7.1"}]}],"bundled":83},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.6.1.160000.2.4"}]}],"bundled":83},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.7.1"}]}],"bundled":83},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.7.1"}]}],"bundled":83},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.7.1"}]}],"bundled":83},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.7.1"}]}],"bundled":83},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.6.1.160000.2.4"}]}],"bundled":83},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.7.1"}]}],"bundled":83},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.7.1"}]}],"bundled":83},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.7.1"}]}],"bundled":83},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.7.1"}]}],"bundled":83},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.7.1"}]}],"bundled":83},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.7.1"}]}],"bundled":83},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.7.1"}]}],"bundled":83},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.7.1"}]}],"bundled":83},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.6.1.160000.2.4"}]}],"bundled":83},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.7.1"}]}],"bundled":83},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.7.1"}]}],"bundled":83},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.7.1"}]}],"bundled":83},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.7.1"}]}],"bundled":83},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.7.1"}]}],"bundled":83},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.7.1"}]}],"bundled":83},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.7.1"}]}],"bundled":83},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.22.1"}]}],"bundled":462},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.22.1"}]}],"bundled":462},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.22.1.150700.17.15.1"}]}],"bundled":462},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.22.1"}]}],"bundled":462},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.22.1"}]}],"bundled":462},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.22.1"}]}],"bundled":462},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.22.1"}]}],"bundled":462},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.22.1"}]}],"bundled":462},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.22.1"}]}],"bundled":462},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.22.1"}]}],"bundled":462},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.22.1"}]}],"bundled":462},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"kernel-livepatch-SLE15-SP7_Update_6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150700.15.3.1"}]}],"bundled":462},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.22.1"}]}],"bundled":462},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.22.1"}]}],"bundled":462},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.8.55.1"}]}],"bundled":189},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"kernel-source-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.8.55.1"}]}],"bundled":189},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"kernel-syms-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.8.55.1"}]}],"bundled":189},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.8.55.1"}]}],"bundled":189},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-source-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.8.55.1"}]}],"bundled":189},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-syms-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.8.55.1"}]}],"bundled":189},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.20.18.1"}]}],"bundled":462},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"kernel-source-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.20.18.1"}]}],"bundled":462},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"kernel-syms-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.20.18.1"}]}],"bundled":462},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.78.1"}]}],"bundled":190},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.78.1"}]}],"bundled":190},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.78.1.150600.12.34.2"}]}],"bundled":190},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.78.1"}]}],"bundled":190},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.78.1"}]}],"bundled":190},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.78.1"}]}],"bundled":190},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.78.1"}]}],"bundled":190},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.78.1"}]}],"bundled":190},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.78.1"}]}],"bundled":190},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP6","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.78.1"}]}],"bundled":190},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.78.1"}]}],"bundled":190},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6","package":"kernel-livepatch-SLE15-SP6_Update_17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150600.13.5.1"}]}],"bundled":190},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP6","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.78.1"}]}],"bundled":190},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP6","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.78.1"}]}],"bundled":190},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"dtb-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.78.1"}]}],"bundled":190},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.78.1"}]}],"bundled":190},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.78.1"}]}],"bundled":190},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.78.1"}]}],"bundled":190},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.78.1.150600.12.34.2"}]}],"bundled":190},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.78.1"}]}],"bundled":190},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.78.1"}]}],"bundled":190},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.78.1"}]}],"bundled":190},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.78.1"}]}],"bundled":190},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.78.1"}]}],"bundled":190},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.78.1"}]}],"bundled":190},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.78.1"}]}],"bundled":190},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"kernel-livepatch-SLE15-SP7-RT_Update_6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150700.1.3.1"}]}],"bundled":461},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP7","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.7.22.1"}]}],"bundled":461},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP7","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.7.22.1"}]}],"bundled":461},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP7","package":"kernel-syms-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.7.22.1"}]}],"bundled":461},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6","package":"kernel-livepatch-SLE15-SP6-RT_Update_17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150600.1.3.1"}]}],"bundled":190},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP6","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.10.58.1"}]}],"bundled":190},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP6","package":"kernel-rt_debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.10.58.1"}]}],"bundled":190},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP6","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.10.58.1"}]}],"bundled":190},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP6","package":"kernel-syms-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.10.58.1"}]}],"bundled":190},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.10.58.1"}]}],"bundled":190},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-rt_debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.10.58.1"}]}],"bundled":190},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.10.58.1"}]}],"bundled":190},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kernel-syms-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.10.58.1"}]}],"bundled":190},{"source":"osv","ecosystem":"SUSE:Linux Micro Extras 6.2","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.7.1"}]}],"bundled":83},{"source":"osv","ecosystem":"SUSE:Linux Micro Extras 6.2","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.7.1"}]}],"bundled":83},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.0-28.30~16.04.1","4.8.0-30.32~16.04.1","4.8.0-32.34~16.04.1","4.8.0-34.36~16.04.1","4.10.0-14.16~16.04.1","4.10.0-19.21~16.04.1","4.10.0-20.22~16.04.1","4.10.0-21.23~16.04.1","4.10.0-22.24~16.04.1","4.10.0-24.28~16.04.1","4.10.0-26.30~16.04.1","4.11.0-13.19~16.04.1","4.11.0-14.20~16.04.1","4.13.0-16.19~16.04.3","4.13.0-17.20~16.04.1","4.13.0-19.22~16.04.1","4.13.0-21.24~16.04.1","4.13.0-25.29~16.04.2","4.15.0-13.14~16.04.1","4.15.0-15.16~16.04.1","4.15.0-20.21~16.04.1","4.15.0-22.24~16.04.1","4.15.0-23.25~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1021.24~18.04.1","5.0.0-1022.25~18.04.1","5.0.0-1023.26~18.04.1","5.0.0-1024.27~18.04.1","5.0.0-1025.28","5.0.0-1027.30"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1019.21~18.04.1","5.3.0-1023.25~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.2","5.3.0-1033.35","5.3.0-1034.36","5.3.0-1035.37"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.2","4.15.0-1003.3","4.15.0-1004.4","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1012.12","4.15.0-1013.13","4.15.0-1014.14","4.15.0-1018.18","4.15.0-1019.19","4.15.0-1021.21","4.15.0-1022.23","4.15.0-1023.24","4.15.0-1025.26","4.15.0-1028.29","4.15.0-1030.31","4.15.0-1031.32","4.15.0-1032.33","4.15.0-1035.36","4.15.0-1036.38","4.15.0-1037.39","4.18.0-1011.11~18.04.1","4.18.0-1013.13~18.04.1","4.18.0-1014.14~18.04.1","4.18.0-1018.18~18.04.1","4.18.0-1019.19~18.04.1","4.18.0-1020.20~18.04.1","4.18.0-1023.24~18.04.1","4.18.0-1024.25~18.04.1","4.18.0-1025.27~18.04.1","5.0.0-1014.14~18.04.1","5.0.0-1016.17~18.04.1","5.0.0-1018.19~18.04.1","5.0.0-1020.21~18.04.1","5.0.0-1022.23~18.04.1","5.0.0-1023.24~18.04.1","5.0.0-1025.27~18.04.1","5.0.0-1027.29~18.04.1","5.0.0-1028.30~18.04.1","5.0.0-1029.31~18.04.1","5.0.0-1031.33","5.0.0-1032.34","5.0.0-1035.37","5.0.0-1036.38"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8~18.04.1","5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1019.20~18.04.1","5.3.0-1020.21~18.04.1","5.3.0-1022.23~18.04.1","5.3.0-1028.29~18.04.1","5.3.0-1031.32~18.04.1","5.3.0-1032.33~18.04.1","5.3.0-1034.35~18.04.1","5.3.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-1006.6~18.04.1","4.18.0-1007.7~18.04.1","4.18.0-1008.8~18.04.1","5.0.0-1012.12~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1001.1","4.15.0-1003.3","4.15.0-1005.5","4.15.0-1006.6","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1010.10","4.15.0-1014.14","4.15.0-1015.15","4.15.0-1017.18","4.15.0-1018.19","4.15.0-1019.20","4.15.0-1021.22","4.15.0-1023.24","4.15.0-1024.25","4.15.0-1025.26","4.15.0-1026.27","4.15.0-1027.28","4.15.0-1028.29","4.15.0-1029.31","4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1042.45","4.15.0-1044.70","5.0.0-1020.20~18.04.1","5.0.0-1021.21~18.04.1","5.0.0-1025.26~18.04.1","5.0.0-1026.27~18.04.1","5.0.0-1028.29~18.04.1","5.0.0-1029.30~18.04.1","5.0.0-1031.32","5.0.0-1033.34","5.0.0-1034.35"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1020.22~18.04.1","5.3.0-1026.28~18.04.1","5.3.0-1029.31~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-4.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1041.43","4.15.0-1042.44","4.15.0-1044.46","4.15.0-1045.48","4.15.0-1046.49","4.15.0-1048.51","4.15.0-1049.52","4.15.0-1050.53","4.15.0-1052.55","4.15.0-1055.58","4.15.0-1057.60","4.15.0-1058.61","4.15.0-1059.62","4.15.0-1063.66","4.15.0-1064.67","4.15.0-1066.69","4.15.0-1067.70","4.15.0-1069.72","4.15.0-1070.73","4.15.0-1072.76","4.15.0-1073.78","4.15.0-1074.79","4.15.0-1076.81","4.15.0-1077.82","4.15.0-1078.83","4.15.0-1079.84"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1025.25~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.31~18.04.1","5.4.0-1030.32~18.04.1","5.4.0-1032.34~18.04.1","5.4.0-1033.35~18.04.1","5.4.0-1035.37~18.04.1","5.4.0-1036.38~18.04.1","5.4.0-1037.39~18.04.1","5.4.0-1039.41~18.04.1","5.4.0-1040.42~18.04.1","5.4.0-1042.44~18.04.1","5.4.0-1043.45~18.04.1","5.4.0-1044.46~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1","5.4.0-1052.55~18.04.1","5.4.0-1053.56~18.04.1","5.4.0-1054.57~18.04.1","5.4.0-1055.58~18.04.1","5.4.0-1056.59~18.04.1","5.4.0-1057.60~18.04.1","5.4.0-1059.62~18.04.1","5.4.0-1061.64~18.04.1","5.4.0-1062.65~18.04.1","5.4.0-1063.66~18.04.1","5.4.0-1065.68~18.04.1","5.4.0-1066.69~18.04.1","5.4.0-1067.70~18.04.1","5.4.0-1068.71~18.04.1","5.4.0-1071.76~18.04.3","5.4.0-1072.77~18.04.1","5.4.0-1074.79~18.04.1","5.4.0-1076.82~18.04.1","5.4.0-1078.84~18.04.1","5.4.0-1080.86~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gkeop-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1001.1","5.4.0-1003.3","5.4.0-1004.5","5.4.0-1005.6","5.4.0-1007.8~18.04.1","5.4.0-1008.9~18.04.1","5.4.0-1009.10~18.04.1","5.4.0-1010.11~18.04.1","5.4.0-1011.12~18.04.2","5.4.0-1012.13~18.04.1","5.4.0-1013.14~18.04.1","5.4.0-1014.15~18.04.1","5.4.0-1015.16~18.04.1","5.4.0-1016.17~18.04.1","5.4.0-1018.19~18.04.1","5.4.0-1021.22~18.04.1","5.4.0-1022.23~18.04.1","5.4.0-1023.24~18.04.1","5.4.0-1024.25~18.04.1","5.4.0-1025.26~18.04.1","5.4.0-1026.27~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.30~18.04.2","5.4.0-1031.32~18.04.1","5.4.0-1032.33~18.04.1","5.4.0-1033.34~18.04.1","5.4.0-1034.35~18.04.1","5.4.0-1036.37~18.04.1","5.4.0-1037.38~18.04.1","5.4.0-1038.39~18.04.1","5.4.0-1039.40~18.04.1","5.4.0-1040.41~18.04.1","5.4.0-1043.44~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1048.51~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-13.14~18.04.1","4.18.0-14.15~18.04.1","4.18.0-15.16~18.04.1","4.18.0-16.17~18.04.1","4.18.0-17.18~18.04.1","4.18.0-18.19~18.04.1","4.18.0-20.21~18.04.1","4.18.0-21.22~18.04.1","4.18.0-22.23~18.04.1","4.18.0-24.25~18.04.1","4.18.0-25.26~18.04.1","5.0.0-23.24~18.04.1","5.0.0-25.26~18.04.1","5.0.0-27.28~18.04.1","5.0.0-29.31~18.04.1","5.0.0-31.33~18.04.1","5.0.0-32.34~18.04.2","5.0.0-35.38~18.04.1","5.0.0-36.39~18.04.1","5.0.0-37.40~18.04.1","5.3.0-26.28~18.04.1","5.3.0-28.30~18.04.1","5.3.0-40.32~18.04.1","5.3.0-42.34~18.04.1","5.3.0-45.37~18.04.1","5.3.0-46.38~18.04.1","5.3.0-51.44~18.04.2","5.3.0-53.47~18.04.1","5.3.0-59.53~18.04.1","5.3.0-61.55~18.04.1","5.3.0-62.56~18.04.1","5.3.0-64.58~18.04.1","5.3.0-65.59","5.3.0-66.60","5.3.0-67.61","5.3.0-68.63","5.3.0-69.65","5.3.0-70.66","5.3.0-72.68","5.3.0-73.69","5.3.0-74.70","5.3.0-75.71","5.3.0-76.72"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-15.16~18.04.1","5.0.0-16.17~18.04.1","5.0.0-17.18~18.04.1","5.0.0-19.20~18.04.1","5.0.0-20.21~18.04.1","5.3.0-19.20~18.04.2","5.3.0-22.24~18.04.1","5.3.0-23.25~18.04.1","5.3.0-23.25~18.04.2","5.3.0-24.26~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.3","4.15.0-1004.5","4.15.0-1006.9","4.15.0-1008.11","4.15.0-1009.12","4.15.0-1012.15","4.15.0-1013.16","4.15.0-1015.18","4.15.0-1017.20","4.15.0-1018.21","4.15.0-1021.24","4.15.0-1024.29","4.15.0-1026.31","4.15.0-1028.33","4.15.0-1030.35","4.15.0-1033.38","4.15.0-1034.39","4.15.0-1035.40","4.15.0-1036.41","4.15.0-1038.43","4.15.0-1039.44","4.15.0-1043.48","4.15.0-1045.50","4.15.0-1050.57","4.15.0-1056.65","4.15.0-1057.66","4.15.0-1059.68","4.15.0-1063.72","4.15.0-1064.73","4.15.0-1065.75","4.15.0-1066.76","4.15.0-1067.77","4.15.0-1069.79","4.15.0-1073.83","4.15.0-1076.86","4.15.0-1079.89","4.15.0-1080.90","4.15.0-1081.91","4.15.0-1087.97","4.15.0-1090.100","4.15.0-1091.101","4.15.0-1093.103","4.15.0-1094.104","4.15.0-1096.106","4.15.0-1097.107","4.15.0-1099.109","4.15.0-1100.110","4.15.0-1101.112","4.15.0-1102.113","4.15.0-1103.114"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1007.12~18.04.1","5.0.0-1008.13~18.04.1","5.0.0-1009.14~18.04.1","5.0.0-1010.15~18.04.1","5.0.0-1011.16","5.0.0-1013.18","5.0.0-1014.19"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1011.12~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.18~18.04.1","5.3.0-1018.20~18.04.1","5.3.0-1024.26~18.04.1","5.3.0-1027.29~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.9~20.04.2","5.11.0-1014.15~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.2","5.11.0-1021.22~20.04.2","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.2","5.13.0-1011.12~20.04.1","5.13.0-1012.13~20.04.1","5.13.0-1014.15~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1019.21~20.04.1","5.13.0-1021.23~20.04.2","5.13.0-1022.24~20.04.1","5.13.0-1023.25~20.04.1","5.13.0-1025.27~20.04.1","5.13.0-1028.31~20.04.1","5.13.0-1029.32~20.04.1","5.13.0-1031.35~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1041.43~20.04.1","5.8.0-1042.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1007.7~20.04.2","5.11.0-1012.13~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10~20.04.2","5.13.0-1012.14~20.04.1","5.13.0-1013.15~20.04.1","5.13.0-1014.16~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1021.24~20.04.1","5.13.0-1022.26~20.04.1","5.13.0-1023.27~20.04.1","5.13.0-1025.29~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1029.34~20.04.1","5.13.0-1031.37~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1033.35~20.04.1","5.8.0-1036.38~20.04.1","5.8.0-1039.42~20.04.1","5.8.0-1040.43~20.04.1","5.8.0-1041.44~20.04.1","5.8.0-1042.45~20.04.1","5.8.0-1043.46~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1063.66+cvm2.2","5.4.0-1063.66+cvm3.2","5.4.0-1064.67+cvm1.1","5.4.0-1065.68+cvm2.1","5.4.0-1067.70+cvm1.1","5.4.0-1068.71+cvm1.1","5.4.0-1069.72+cvm1.1","5.4.0-1070.73+cvm1.1","5.4.0-1072.75+cvm1.1","5.4.0-1073.76+cvm1.1","5.4.0-1074.77+cvm1.1","5.4.0-1076.79+cvm1.1","5.4.0-1078.81+cvm1.1","5.4.0-1080.83+cvm1.1","5.4.0-1083.87+cvm1.1","5.4.0-1085.90+cvm1.1","5.4.0-1085.90+cvm2.1","5.4.0-1086.91+cvm1.1","5.4.0-1089.94+cvm1.2","5.4.0-1090.95+cvm1.1","5.4.0-1091.96+cvm1.1","5.4.0-1092.97+cvm1.1","5.4.0-1095.101+cvm1.1","5.4.0-1098.104+cvm1.1","5.4.0-1100.106+cvm1.1","5.4.0-1103.109+cvm1.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.10~20.04.1","5.11.0-1014.16~20.04.1","5.11.0-1017.19~20.04.1","5.11.0-1018.20~20.04.2","5.11.0-1020.22~20.04.1","5.11.0-1021.23~20.04.1","5.11.0-1022.24~20.04.1","5.11.0-1023.25~20.04.1","5.11.0-1024.26~20.04.1","5.11.0-1026.29~20.04.1","5.11.0-1028.32~20.04.1","5.11.0-1029.33~20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.3","5.13.0-1012.15~20.04.1","5.13.0-1013.16~20.04.1","5.13.0-1015.18~20.04.1","5.13.0-1019.23~20.04.1","5.13.0-1021.25~20.04.1","5.13.0-1023.28~20.04.1","5.13.0-1024.29~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1030.36~20.04.1","5.13.0-1031.37~20.04.1","5.13.0-1033.40~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1032.34~20.04.1","5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1039.41"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1033.35","5.4.0-1035.37","5.4.0-1036.38","5.4.0-1037.39","5.4.0-1039.41","5.4.0-1041.43","5.4.0-1042.44","5.4.0-1043.45","5.4.0-1044.46","5.4.0-1046.48","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1055.58","5.4.0-1056.59","5.4.0-1057.60","5.4.0-1059.62","5.4.0-1061.64","5.4.0-1062.65","5.4.0-1063.66","5.4.0-1065.68","5.4.0-1066.69","5.4.0-1067.70","5.4.0-1068.71","5.4.0-1071.76","5.4.0-1072.77","5.4.0-1074.79","5.4.0-1076.82","5.4.0-1078.84","5.4.0-1080.86","5.4.0-1081.87","5.4.0-1083.89","5.4.0-1084.90","5.4.0-1086.93","5.4.0-1087.94","5.4.0-1090.97","5.4.0-1091.98","5.4.0-1094.101","5.4.0-1095.102","5.4.0-1096.103","5.4.0-1097.104","5.4.0-1098.105","5.4.0-1099.106","5.4.0-1100.107","5.4.0-1101.108","5.4.0-1102.109","5.4.0-1103.110","5.4.0-1104.111","5.4.0-1105.112"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1011.14~20.04.1","5.15.0-1014.17~20.04.1","5.15.0-1015.18~20.04.1","5.15.0-1016.19~20.04.1","5.15.0-1019.23~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1023.28~20.04.2","5.15.0-1027.32~20.04.1","5.15.0-1028.33~20.04.1","5.15.0-1029.34~20.04.1","5.15.0-1031.36~20.04.1","5.15.0-1032.37~20.04.1","5.15.0-1033.38~20.04.1","5.15.0-1034.39~20.04.1","5.15.0-1036.41~20.04.1","5.15.0-1037.42~20.04.1","5.15.0-1038.43~20.04.1","5.15.0-1039.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1008.9","5.4.0-1009.10","5.4.0-1010.11","5.4.0-1011.12","5.4.0-1012.13","5.4.0-1013.14","5.4.0-1014.15","5.4.0-1015.16","5.4.0-1016.17","5.4.0-1018.19","5.4.0-1021.22","5.4.0-1022.23","5.4.0-1023.24","5.4.0-1024.25","5.4.0-1025.26","5.4.0-1026.27","5.4.0-1027.28","5.4.0-1029.30","5.4.0-1031.32","5.4.0-1032.33","5.4.0-1033.34","5.4.0-1034.35","5.4.0-1036.37","5.4.0-1037.38","5.4.0-1038.39","5.4.0-1039.40","5.4.0-1040.41","5.4.0-1043.44","5.4.0-1046.48","5.4.0-1048.51","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1056.60","5.4.0-1057.61","5.4.0-1060.64","5.4.0-1061.65","5.4.0-1062.66","5.4.0-1064.68","5.4.0-1065.69","5.4.0-1066.70","5.4.0-1067.71","5.4.0-1068.72","5.4.0-1069.73","5.4.0-1070.74","5.4.0-1071.75","5.4.0-1072.76","5.4.0-1073.77","5.4.0-1074.78","5.4.0-1075.79","5.4.0-1076.80","5.4.0-1077.81","5.4.0-1078.82","5.4.0-1079.83","5.4.0-1080.84","5.4.0-1081.85","5.4.0-1083.87","5.4.0-1084.88","5.4.0-1085.89","5.4.0-1086.90","5.4.0-1087.91","5.4.0-1088.92","5.4.0-1089.93","5.4.0-1090.94","5.4.0-1091.95","5.4.0-1092.96","5.4.0-1093.97","5.4.0-1094.98","5.4.0-1095.99","5.4.0-1096.100","5.4.0-1097.101","5.4.0-1098.102","5.4.0-1099.103","5.4.0-1100.104","5.4.0-1101.105","5.4.0-1102.106"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gkeop-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1003.5~20.04.2","5.15.0-1005.7~20.04.1","5.15.0-1007.10~20.04.1","5.15.0-1008.12~20.04.1","5.15.0-1011.15~20.04.2","5.15.0-1012.16~20.04.1","5.15.0-1013.17~20.04.1","5.15.0-1015.19~20.04.1","5.15.0-1016.21~20.04.1","5.15.0-1017.22~20.04.1","5.15.0-1018.23~20.04.1","5.15.0-1019.24~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1021.26~20.04.1","5.15.0-1022.27~20.04.1","5.15.0-1023.28~20.04.1","5.15.0-1024.29~20.04.1","5.15.0-1025.30~20.04.1","5.15.0-1026.31~20.04.1","5.15.0-1027.32~20.04.1","5.15.0-1028.33~20.04.1","5.15.0-1030.35~20.04.1","5.15.0-1031.37~20.04.1","5.15.0-1032.38~20.04.1","5.15.0-1033.39~20.04.1","5.15.0-1034.40~20.04.1","5.15.0-1035.41~20.04.1","5.15.0-1036.42~20.04.1","5.15.0-1037.43~20.04.1","5.15.0-1038.44~20.04.1","5.15.0-1039.45~20.04.1","5.15.0-1040.46~20.04.1","5.15.0-1043.50~20.04.1","5.15.0-1044.51~20.04.1","5.15.0-1045.52~20.04.1","5.15.0-1046.53~20.04.1","5.15.0-1047.54~20.04.1","5.15.0-1048.55~20.04.1","5.15.0-1049.56~20.04.1","5.15.0-1050.57~20.04.1","5.15.0-1051.58~20.04.1","5.15.0-1052.59~20.04.1","5.15.0-1053.60~20.04.1","5.15.0-1054.61~20.04.1","5.15.0-1055.62~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-22.23~20.04.1","5.11.0-25.27~20.04.1","5.11.0-27.29~20.04.1","5.11.0-34.36~20.04.1","5.11.0-36.40~20.04.1","5.11.0-37.41~20.04.2","5.11.0-38.42~20.04.1","5.11.0-40.44~20.04.2","5.11.0-41.45~20.04.1","5.11.0-43.47~20.04.2","5.11.0-44.48~20.04.2","5.11.0-46.51~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-21.21~20.04.1","5.13.0-22.22~20.04.1","5.13.0-23.23~20.04.2","5.13.0-25.26~20.04.1","5.13.0-27.29~20.04.1","5.13.0-28.31~20.04.1","5.13.0-30.33~20.04.1","5.13.0-35.40~20.04.1","5.13.0-37.42~20.04.1","5.13.0-39.44~20.04.1","5.13.0-40.45~20.04.1","5.13.0-41.46~20.04.1","5.13.0-44.49~20.04.1","5.13.0-48.54~20.04.1","5.13.0-51.58~20.04.1","5.13.0-52.59~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-23.24~20.04.1","5.8.0-25.26~20.04.1","5.8.0-28.30~20.04.1","5.8.0-29.31~20.04.1","5.8.0-31.33~20.04.1","5.8.0-33.36~20.04.1","5.8.0-34.37~20.04.2","5.8.0-36.40~20.04.1","5.8.0-38.43~20.04.1","5.8.0-40.45~20.04.1","5.8.0-41.46~20.04.1","5.8.0-43.49~20.04.1","5.8.0-44.50~20.04.1","5.8.0-45.51~20.04.1","5.8.0-48.54~20.04.1","5.8.0-49.55~20.04.1","5.8.0-50.56~20.04.1","5.8.0-53.60~20.04.1","5.8.0-55.62~20.04.1","5.8.0-59.66~20.04.1","5.8.0-63.71~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-intel-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1007.7","5.13.0-1008.8","5.13.0-1009.9","5.13.0-1010.10","5.13.0-1011.11","5.13.0-1014.15","5.13.0-1017.19"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.10.0-1008.9","5.10.0-1011.12","5.10.0-1013.14","5.10.0-1014.15","5.10.0-1016.17","5.10.0-1017.18","5.10.0-1019.20","5.10.0-1021.22","5.10.0-1022.23","5.10.0-1023.24","5.10.0-1025.26","5.10.0-1026.27","5.10.0-1029.30","5.10.0-1032.33","5.10.0-1033.34","5.10.0-1034.35","5.10.0-1038.40","5.10.0-1044.46","5.10.0-1045.47","5.10.0-1049.51","5.10.0-1050.52","5.10.0-1051.53","5.10.0-1052.54","5.10.0-1053.55","5.10.0-1055.58","5.10.0-1057.61"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10","5.13.0-1010.11","5.13.0-1012.16","5.13.0-1014.18","5.13.0-1017.21","5.13.0-1019.23","5.13.0-1020.24","5.13.0-1021.25","5.13.0-1022.26","5.13.0-1026.32","5.13.0-1028.35","5.13.0-1029.36"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.14.0-1004.4","5.14.0-1005.5","5.14.0-1007.7","5.14.0-1008.8","5.14.0-1010.10","5.14.0-1011.11","5.14.0-1013.13","5.14.0-1018.19","5.14.0-1020.22","5.14.0-1022.24","5.14.0-1024.26","5.14.0-1027.30","5.14.0-1029.32","5.14.0-1031.34","5.14.0-1032.35","5.14.0-1033.36","5.14.0-1034.37","5.14.0-1036.40","5.14.0-1038.42","5.14.0-1042.47","5.14.0-1044.49","5.14.0-1045.51","5.14.0-1046.53","5.14.0-1047.54","5.14.0-1048.55","5.14.0-1049.56","5.14.0-1050.57","5.14.0-1051.58","5.14.0-1052.59","5.14.0-1054.61","5.14.0-1055.62","5.14.0-1056.63","5.14.0-1057.64","5.14.0-1058.66","5.14.0-1059.67"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.6.0-1007.7","5.6.0-1008.8","5.6.0-1010.10","5.6.0-1011.11","5.6.0-1013.13","5.6.0-1017.17","5.6.0-1018.18","5.6.0-1020.20","5.6.0-1021.21","5.6.0-1023.23","5.6.0-1026.26","5.6.0-1027.27","5.6.0-1028.28","5.6.0-1031.32","5.6.0-1032.33","5.6.0-1033.35","5.6.0-1034.36","5.6.0-1035.37","5.6.0-1036.39","5.6.0-1039.43","5.6.0-1042.46","5.6.0-1047.51","5.6.0-1048.52","5.6.0-1050.54","5.6.0-1052.56","5.6.0-1053.57","5.6.0-1054.58","5.6.0-1055.59","5.6.0-1056.60"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1008.8~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1011.13~20.04.2","5.13.0-1015.19~20.04.1","5.13.0-1016.20~20.04.1","5.13.0-1018.22~20.04.1","5.13.0-1021.26~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1030.35~20.04.1","5.13.0-1033.39~20.04.1","5.13.0-1034.40~20.04.1","5.13.0-1036.43~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1031.32~20.04.2","5.8.0-1033.34~20.04.1","5.8.0-1034.35~20.04.2","5.8.0-1037.38~20.04.1","5.8.0-1038.39~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8","5.3.0-1014.16","5.3.0-1015.17","5.3.0-1017.19","5.4.0-1004.4","5.4.0-1006.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-24.28","5.4.0-26.30","5.4.0-27.31","5.4.0-28.32","5.4.0-30.34","5.4.0-31.35","5.4.0-33.37","5.4.0-34.38","5.4.0-36.41","5.4.0-37.42","5.4.0-39.44","5.4.0-40.45"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1018.19~20.04.2","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1024.25~20.04.1","5.11.0-1026.28~20.04.1","5.11.0-1028.31~20.04.1","5.11.0-1029.32~20.04.1","5.11.0-1030.34","5.11.0-1031.35"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-14.16~20.04.1","5.8.0-14.16~20.04.3","5.8.0-16.18~20.04.1","5.8.0-17.19~20.04.1","5.8.0-18.20~20.04.1","5.8.0-20.22~20.04.1","5.8.0-22.24~20.04.1","5.8.0-25.27~20.04.1","5.8.0-26.28~20.04.1","5.8.0-29.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-allwinner-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1007.7~22.04.1","5.19.0-1009.9~22.04.1","5.19.0-1010.10~22.04.1","5.19.0-1011.11~22.04.1","5.19.0-1012.12~22.04.1","5.19.0-1013.13~22.04.1","5.19.0-1014.14~22.04.1","5.19.0-1015.15~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1019.20~22.04.1","5.19.0-1020.21~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1026.27~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1029.30~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1008.8~22.04.1","6.5.0-1010.10~22.04.1","6.5.0-1011.11~22.04.1","6.5.0-1012.12~22.04.1","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.2","6.5.0-1018.18~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1021.21~22.04.1","6.5.0-1022.22~22.04.1","6.5.0-1023.23~22.04.1","6.5.0-1024.24~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1050.53~22.04.1"}]}],"versions":["6.8.0-1009.9~22.04.2","6.8.0-1010.10~22.04.2","6.8.0-1011.12~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.15~22.04.1","6.8.0-1015.16~22.04.1","6.8.0-1016.17~22.04.2","6.8.0-1017.18~22.04.1","6.8.0-1018.19~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1023.25~22.04.1","6.8.0-1024.26~22.04.1","6.8.0-1027.29~22.04.1","6.8.0-1028.30~22.04.1","6.8.0-1029.31~22.04.1","6.8.0-1030.32~22.04.1","6.8.0-1031.33~22.04.1","6.8.0-1032.34~22.04.1","6.8.0-1033.35~22.04.1","6.8.0-1035.37~22.04.1","6.8.0-1036.38~22.04.1","6.8.0-1039.41~22.04.1","6.8.0-1040.42~22.04.1","6.8.0-1041.43~22.04.1","6.8.0-1042.44~22.04.1","6.8.0-1043.45~22.04.1","6.8.0-1044.46~22.04.1","6.8.0-1045.47~22.04.1","6.8.0-1046.49~22.04.1","6.8.0-1047.50~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.21~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1025.28~22.04.1","5.19.0-1026.29~22.04.1","5.19.0-1027.30~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1","6.2.0-1019.19~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.7~22.04.1","6.5.0-1009.9~22.04.1","6.5.0-1010.10~22.04.1","6.5.0-1011.11~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.1","6.5.0-1018.19~22.04.2","6.5.0-1019.20~22.04.1","6.5.0-1021.22~22.04.1","6.5.0-1022.23~22.04.1","6.5.0-1023.24~22.04.1","6.5.0-1024.25~22.04.1","6.5.0-1025.26~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1051.57~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1009.9~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1012.14~22.04.1","6.8.0-1013.15~22.04.1","6.8.0-1014.16~22.04.1","6.8.0-1015.17~22.04.2","6.8.0-1017.20~22.04.1","6.8.0-1018.21~22.04.1","6.8.0-1020.23~22.04.1","6.8.0-1021.25~22.04.1","6.8.0-1025.30~22.04.1","6.8.0-1026.31~22.04.1","6.8.0-1027.32~22.04.1","6.8.0-1028.33~22.04.1","6.8.0-1029.34~22.04.1","6.8.0-1030.35~22.04.1","6.8.0-1031.36~22.04.1","6.8.0-1034.39~22.04.1","6.8.0-1036.42~22.04.1","6.8.0-1040.46~22.04.1","6.8.0-1041.47~22.04.1","6.8.0-1044.50~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1025.28~22.04.1.1","5.19.0-1026.29~22.04.1.1","5.19.0-1027.30~22.04.2.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1.1","6.2.0-1009.9~22.04.3.1","6.2.0-1011.11~22.04.1.1","6.2.0-1012.12~22.04.1.1","6.2.0-1014.14~22.04.1.1","6.2.0-1015.15~22.04.1.1","6.2.0-1016.16~22.04.1.1","6.2.0-1017.17~22.04.1.1","6.2.0-1018.18~22.04.1.1","6.2.0-1019.19~22.04.1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1058.65~22.04.1"}]}],"versions":["6.8.0-1041.48~22.04.1","6.8.0-1042.49~22.04.1","6.8.0-1044.51~22.04.1","6.8.0-1046.53~22.04.1","6.8.0-1053.60~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.22~22.04.2","5.19.0-1021.23~22.04.1","5.19.0-1022.24~22.04.1","5.19.0-1024.26~22.04.1","5.19.0-1025.27~22.04.1","5.19.0-1026.28~22.04.1","5.19.0-1027.29~22.04.1","5.19.0-1030.32~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1011.11~22.04.3","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1016.18~22.04.1","6.2.0-1017.19~22.04.1","6.2.0-1018.20~22.04.1","6.2.0-1019.21~22.04.1","6.2.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1010.10~22.04.3","6.5.0-1011.11~22.04.1","6.5.0-1013.13~22.04.1","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.1","6.5.0-1018.18~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1022.24~22.04.1","6.5.0-1023.25~22.04.1","6.5.0-1024.26~22.04.1","6.5.0-1025.27~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1052.55~22.04.1"}]}],"versions":["6.8.0-1010.11~22.04.1","6.8.0-1011.12~22.04.1","6.8.0-1012.13~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.16~22.04.1","6.8.0-1015.17~22.04.1","6.8.0-1016.18~22.04.1","6.8.0-1017.19~22.04.1","6.8.0-1018.20~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1024.26~22.04.1","6.8.0-1025.27~22.04.1","6.8.0-1026.28~22.04.1","6.8.0-1027.29~22.04.1","6.8.0-1028.30~22.04.1","6.8.0-1029.31~22.04.1","6.8.0-1030.32~22.04.1","6.8.0-1031.33~22.04.1","6.8.0-1032.34~22.04.1","6.8.0-1033.35~22.04.1","6.8.0-1034.36~22.04.2","6.8.0-1036.38~22.04.1","6.8.0-1037.39~22.04.1","6.8.0-1040.42~22.04.1","6.8.0-1041.43~22.04.1","6.8.0-1042.45~22.04.1","6.8.0-1043.46~22.04.1","6.8.0-1044.47~22.04.1","6.8.0-1045.48~22.04.1","6.8.0-1046.49~22.04.1","6.8.0-1047.50~22.04.2","6.8.0-1048.51~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-28.29~22.04.1","5.19.0-32.33~22.04.1","5.19.0-35.36~22.04.1","5.19.0-38.39~22.04.1","5.19.0-40.41~22.04.1","5.19.0-41.42~22.04.1","5.19.0-42.43~22.04.1","5.19.0-43.44~22.04.1","5.19.0-45.46~22.04.1","5.19.0-46.47~22.04.1","5.19.0-50.50"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-25.25~22.04.2","6.2.0-26.26~22.04.1","6.2.0-31.31~22.04.1","6.2.0-32.32~22.04.1","6.2.0-33.33~22.04.1","6.2.0-34.34~22.04.1","6.2.0-35.35~22.04.1","6.2.0-36.37~22.04.1","6.2.0-37.38~22.04.1","6.2.0-39.40~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-14.14~22.04.1","6.5.0-15.15~22.04.1","6.5.0-17.17~22.04.1","6.5.0-18.18~22.04.1","6.5.0-21.21~22.04.1","6.5.0-25.25~22.04.1","6.5.0-26.26~22.04.1","6.5.0-27.28~22.04.1","6.5.0-28.29~22.04.1","6.5.0-35.35~22.04.1","6.5.0-41.41~22.04.2","6.5.0-44.44~22.04.1","6.5.0-45.45~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-106.106~22.04.1"}]}],"versions":["6.8.0-38.38~22.04.1","6.8.0-39.39~22.04.1","6.8.0-40.40~22.04.3","6.8.0-45.45~22.04.1","6.8.0-47.47~22.04.1","6.8.0-48.48~22.04.1","6.8.0-49.49~22.04.1","6.8.0-50.51~22.04.1","6.8.0-51.52~22.04.1","6.8.0-52.53~22.04.1","6.8.0-57.59~22.04.1","6.8.0-58.60~22.04.1","6.8.0-59.61~22.04.1","6.8.0-60.63~22.04.1","6.8.0-64.67~22.04.1","6.8.0-65.68~22.04.1","6.8.0-78.78~22.04.1","6.8.0-79.79~22.04.1","6.8.0-83.83~22.04.1","6.8.0-84.84~22.04.1","6.8.0-85.85~22.04.1","6.8.0-86.87~22.04.1","6.8.0-87.88~22.04.1","6.8.0-88.89~22.04.2","6.8.0-90.91~22.04.1","6.8.0-94.96~22.04.1","6.8.0-100.100~22.04.1","6.8.0-101.101~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-ibm-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1049.49~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.13~22.04.1","6.8.0-1014.14~22.04.1","6.8.0-1015.15~22.04.1","6.8.0-1016.16~22.04.1","6.8.0-1017.17~22.04.1","6.8.0-1018.18~22.04.1","6.8.0-1019.19~22.04.1","6.8.0-1023.23~22.04.1","6.8.0-1024.24~22.04.1","6.8.0-1025.25~22.04.1","6.8.0-1026.26~22.04.1","6.8.0-1027.27~22.04.1","6.8.0-1028.28~22.04.1","6.8.0-1029.29~22.04.1","6.8.0-1030.30~22.04.1","6.8.0-1033.33~22.04.1","6.8.0-1036.36~22.04.1","6.8.0-1037.37~22.04.1","6.8.0-1038.38~22.04.1","6.8.0-1039.39~22.04.1","6.8.0-1040.40~22.04.1","6.8.0-1041.41~22.04.1","6.8.0-1042.42~22.04.1","6.8.0-1043.43~22.04.1","6.8.0-1044.44~22.04.1","6.8.0-1045.45~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-intel-iot-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1073.75"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1030.30"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-14.14.1~22.04.1","6.5.0-15.15.1.1~22.04.1","6.5.0-17.17.1.1.1~22.04.1","6.5.0-21.21.1~22.04.1","6.5.0-25.25.1~22.04.1","6.5.0-26.26.1~22.04.1","6.5.0-27.28.1~22.04.1","6.5.0-28.29.1~22.04.1","6.5.0-35.35.1~22.04.1","6.5.0-41.41.1~22.04.1","6.5.0-42.42.1~22.04.1","6.5.0-44.44.1~22.04.1","6.5.0-45.45.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-106.106.1~22.04.1"}]}],"versions":["6.8.0-38.38.1~22.04.2","6.8.0-40.40.1~22.04.1","6.8.0-44.44.1~22.04.1","6.8.0-45.45.1~22.04.1","6.8.0-47.47.1~22.04.1","6.8.0-48.48.3~22.04.1","6.8.0-49.49.1~22.04.1","6.8.0-50.51.1~22.04.1","6.8.0-51.52.1~22.04.1","6.8.0-52.53.1~22.04.1","6.8.0-54.56.1~22.04.1","6.8.0-55.57.1~22.04.1","6.8.0-56.58.1~22.04.1","6.8.0-57.59.1~22.04.1","6.8.0-58.60.1~22.04.1","6.8.0-59.61.1~22.04.1","6.8.0-60.63.1~22.04.1","6.8.0-62.65.1~22.04.1","6.8.0-63.66.1~22.04.1","6.8.0-64.67.1~22.04.1","6.8.0-65.68.1~22.04.1","6.8.0-78.78.1~22.04.1","6.8.0-79.79.1~22.04.1","6.8.0-83.83.1~22.04.1","6.8.0-84.84.1~22.04.1","6.8.0-85.85.1~22.04.1","6.8.0-86.87.1~22.04.1","6.8.0-87.88.1~22.04.1","6.8.0-88.89.1~22.04.1","6.8.0-90.91.1~22.04.1","6.8.0-94.96.1~22.04.1","6.8.0-100.100.1~22.04.1","6.8.0-101.101.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1003.3~22.04.1","6.2.0-1009.9","6.2.0-1010.10","6.2.0-1011.11","6.2.0-1012.12","6.2.0-1013.13","6.2.0-1015.15"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1004.4","6.5.0-1007.7","6.5.0-1013.13","6.5.0-1014.14","6.5.0-1015.15","6.5.0-1018.18","6.5.0-1019.19","6.5.0-1021.22","6.5.0-1022.23","6.5.0-1023.24","6.5.0-1024.25"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1049.52~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1009.9~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.15~22.04.1","6.8.0-1015.16~22.04.1","6.8.0-1017.19~22.04.1","6.8.0-1018.20~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1022.25~22.04.2","6.8.0-1023.26~22.04.1","6.8.0-1024.27~22.04.1","6.8.0-1025.28~22.04.1","6.8.0-1026.29~22.04.1","6.8.0-1027.30~22.04.1","6.8.0-1028.31~22.04.1","6.8.0-1029.32~22.04.1","6.8.0-1030.33~22.04.1","6.8.0-1031.34~22.04.1","6.8.0-1032.35~22.04.1","6.8.0-1035.38~22.04.1","6.8.0-1036.39~22.04.1","6.8.0-1038.41~22.04.1","6.8.0-1039.42~22.04.1","6.8.0-1040.43~22.04.1","6.8.0-1041.44~22.04.2","6.8.0-1042.45~22.04.1","6.8.0-1043.46~22.04.1","6.8.0-1044.47~22.04.1","6.8.0-1045.48~22.04.1","6.8.0-1046.49~22.04.1","6.8.0-1047.50~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-5.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.17.0-1003.3","5.17.0-1004.4","5.17.0-1006.6","5.17.0-1011.12","5.17.0-1012.13","5.17.0-1013.14","5.17.0-1014.15","5.17.0-1015.16","5.17.0-1016.17","5.17.0-1017.18","5.17.0-1018.19","5.17.0-1019.20","5.17.0-1020.21","5.17.0-1021.22","5.17.0-1024.25","5.17.0-1025.26","5.17.0-1026.27","5.17.0-1027.28","5.17.0-1028.29","5.17.0-1029.30","5.17.0-1030.31","5.17.0-1031.32","5.17.0-1032.33","5.17.0-1033.34","5.17.0-1034.35","5.17.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.0-1006.6","6.0.0-1007.7","6.0.0-1008.8","6.0.0-1009.9","6.0.0-1010.10","6.0.0-1011.11","6.0.0-1012.12","6.0.0-1013.13","6.0.0-1014.14","6.0.0-1015.15","6.0.0-1016.16","6.0.0-1017.17","6.0.0-1018.18","6.0.0-1019.19","6.0.0-1020.20","6.0.0-1021.21"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.0-1004.4","6.1.0-1006.6","6.1.0-1007.7","6.1.0-1008.8","6.1.0-1009.9","6.1.0-1010.10","6.1.0-1012.12","6.1.0-1013.13","6.1.0-1014.14","6.1.0-1015.15","6.1.0-1016.16","6.1.0-1017.17","6.1.0-1019.19","6.1.0-1020.20","6.1.0-1021.21","6.1.0-1022.22","6.1.0-1023.23","6.1.0-1024.24","6.1.0-1025.25","6.1.0-1026.26","6.1.0-1027.27","6.1.0-1028.28","6.1.0-1029.29","6.1.0-1033.33","6.1.0-1034.34","6.1.0-1035.35","6.1.0-1036.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1003.3","6.5.0-1004.4","6.5.0-1006.6","6.5.0-1007.7","6.5.0-1008.8","6.5.0-1009.10","6.5.0-1011.12","6.5.0-1013.14","6.5.0-1014.15","6.5.0-1015.16","6.5.0-1016.17","6.5.0-1018.19","6.5.0-1019.20","6.5.0-1020.21","6.5.0-1022.23","6.5.0-1023.24","6.5.0-1024.25","6.5.0-1025.26","6.5.0-1027.28"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1013.13~22.04.4","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1018.18~22.04.1","6.5.0-1019.19~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1021.21~22.04.1","6.5.0-1023.23~22.04.1","6.5.0-1024.24~22.04.1","6.5.0-1025.25~22.04.1","6.5.0-1026.26~22.04.1","6.5.0-1027.27~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1047.48~22.04.1"}]}],"versions":["6.8.0-1006.6~22.04.3","6.8.0-1008.8~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.13~22.04.1","6.8.0-1014.14~22.04.1","6.8.0-1015.15~22.04.1","6.8.0-1016.17~22.04.1","6.8.0-1017.18~22.04.1","6.8.0-1018.19~22.04.1","6.8.0-1019.20~22.04.1","6.8.0-1020.21~22.04.1","6.8.0-1021.22~22.04.1","6.8.0-1022.23~22.04.1","6.8.0-1023.24~22.04.1","6.8.0-1024.25~22.04.1","6.8.0-1025.26~22.04.1","6.8.0-1026.27~22.04.1","6.8.0-1027.28~22.04.1","6.8.0-1028.29~22.04.1","6.8.0-1029.30~22.04.1","6.8.0-1030.31~22.04.1","6.8.0-1032.33~22.04.1","6.8.0-1033.34~22.04.1","6.8.0-1035.36~22.04.1","6.8.0-1037.38~22.04.1","6.8.0-1038.39~22.04.1","6.8.0-1039.40~22.04.1","6.8.0-1040.41~22.04.1","6.8.0-1041.42~22.04.1","6.8.0-1042.43~22.04.1","6.8.0-1043.44~22.04.1","6.8.0-1044.45~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1032.35"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1004.4","5.13.0-1006.6+22.04.1","5.13.0-1007.7+22.04.1","5.13.0-1010.11+22.04.1","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1006.6","5.15.0-1007.7","5.15.0-1008.8","5.15.0-1011.12","5.15.0-1012.13","5.15.0-1014.16","5.15.0-1015.17","5.15.0-1016.18","5.15.0-1017.19","5.15.0-1018.21","5.15.0-1019.22","5.15.0-1020.23","5.15.0-1022.26","5.15.0-1023.27","5.15.0-1026.30","5.15.0-1027.31","5.15.0-1028.32"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1012.13~22.04.1","5.19.0-1015.16~22.04.1","5.19.0-1016.17~22.04.1","5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1","5.19.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-17.17.1.1~22.04.1","6.5.0-21.21.1~22.04.1","6.5.0-25.25.1~22.04.1","6.5.0-26.26.1~22.04.1","6.5.0-27.28.1~22.04.1","6.5.0-28.29.1~22.04.1","6.5.0-35.35.1~22.04.1","6.5.0-40.40.1~22.04.1","6.5.0-42.42.1~22.04.1","6.5.0-45.45.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-106.106~22.04.1"}]}],"versions":["6.8.0-38.38.1~22.04.1","6.8.0-39.39.1~22.04.1","6.8.0-40.40.1~22.04.1","6.8.0-41.41.1~22.04.1","6.8.0-44.44.1~22.04.1","6.8.0-47.47.1~22.04.1","6.8.0-48.48.1~22.04.2","6.8.0-49.49.1~22.04.1","6.8.0-50.51.1~22.04.1","6.8.0-51.52.1~22.04.1","6.8.0-52.53.1~22.04.1","6.8.0-53.55.1~22.04.1","6.8.0-55.57.1~22.04.1","6.8.0-56.58.1~22.04.1","6.8.0-57.59.1~22.04.1","6.8.0-58.60.1~22.04.1","6.8.0-59.61.1~22.04.1","6.8.0-62.65~22.04.1","6.8.0-63.66~22.04.1","6.8.0-64.67~22.04.1","6.8.0-71.71~22.04.1","6.8.0-78.78~22.04.1","6.8.0-79.79~22.04.1","6.8.0-83.83~22.04.1","6.8.0-84.84~22.04.1","6.8.0-86.87~22.04.1","6.8.0-87.88~22.04.1","6.8.0-88.89~22.04.1","6.8.0-90.91~22.04.1","6.8.0-94.96~22.04.1","6.8.0-100.100~22.04.1","6.8.0-101.101~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1014.16~22.04.1","5.19.0-1015.17~22.04.1","5.19.0-1016.18~22.04.1","5.19.0-1017.19~22.04.1","5.19.0-1018.20~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1006.7~22.04.1","6.2.0-1007.8~22.04.1","6.2.0-1009.10~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.8~22.04.1","6.5.0-1008.9~22.04.1","6.5.0-1009.10~22.04.1","6.5.0-1010.11~22.04.1","6.5.0-1011.12~22.04.1","6.5.0-1012.13~22.04.1","6.5.0-1014.15~22.04.1","6.5.0-1015.16~22.04.1","6.5.0-1016.17~22.04.1","6.5.0-1017.18~22.04.1","6.5.0-1018.19~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:22.04:LTS","package":"linux-realtime-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.1-1045.46~22.04.1"}]}],"versions":["6.8.1-1004.4~22.04.1","6.8.1-1005.5~22.04.2","6.8.1-1006.6~22.04.1","6.8.1-1007.7~22.04.1","6.8.1-1008.8~22.04.1","6.8.1-1009.9~22.04.1","6.8.1-1010.10~22.04.1","6.8.1-1011.11~22.04.1","6.8.1-1012.12~22.04.1","6.8.1-1013.14~22.04.1","6.8.1-1014.15~22.04.1","6.8.1-1015.16~22.04.1","6.8.1-1016.17~22.04.1","6.8.1-1017.18~22.04.1","6.8.1-1018.19~22.04.1","6.8.1-1019.20~22.04.1","6.8.1-1020.21~22.04.1","6.8.1-1021.22~22.04.1","6.8.1-1022.23~22.04.1","6.8.1-1023.24~22.04.1","6.8.1-1024.25~22.04.1","6.8.1-1025.26~22.04.1","6.8.1-1026.27~22.04.1","6.8.1-1030.31~22.04.1","6.8.1-1031.32~22.04.1","6.8.1-1034.35~22.04.1","6.8.1-1035.36~22.04.1","6.8.1-1036.37~22.04.1","6.8.1-1037.38~22.04.1","6.8.1-1038.39~22.04.1","6.8.1-1039.40~22.04.1","6.8.1-1040.41~22.04.1","6.8.1-1041.42~22.04.1","6.8.1-1042.43~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-106.106"}]}],"versions":["6.5.0-9.9","6.6.0-14.14","6.8.0-11.11","6.8.0-20.20","6.8.0-22.22","6.8.0-28.28","6.8.0-31.31","6.8.0-35.35","6.8.0-36.36","6.8.0-38.38","6.8.0-39.39","6.8.0-40.40","6.8.0-41.41","6.8.0-44.44","6.8.0-45.45","6.8.0-47.47","6.8.0-48.48","6.8.0-49.49","6.8.0-50.51","6.8.0-51.52","6.8.0-52.53","6.8.0-53.55","6.8.0-54.56","6.8.0-55.57","6.8.0-56.58","6.8.0-57.59","6.8.0-58.60","6.8.0-59.61","6.8.0-60.63","6.8.0-62.65","6.8.0-63.66","6.8.0-64.67","6.8.0-71.71","6.8.0-78.78","6.8.0-79.79","6.8.0-83.83","6.8.0-84.84","6.8.0-85.85","6.8.0-86.87","6.8.0-87.88","6.8.0-88.89","6.8.0-90.91","6.8.0-94.96","6.8.0-100.100","6.8.0-101.101"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1050.53"}]}],"versions":["6.5.0-1008.8","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1006.6","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1016.17","6.8.0-1017.18","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1023.25","6.8.0-1024.26","6.8.0-1025.27","6.8.0-1026.28","6.8.0-1027.29","6.8.0-1028.30","6.8.0-1029.31","6.8.0-1030.32","6.8.0-1031.33","6.8.0-1032.34","6.8.0-1033.35","6.8.0-1035.37","6.8.0-1036.38","6.8.0-1038.40","6.8.0-1039.41","6.8.0-1040.42","6.8.0-1041.43","6.8.0-1042.44","6.8.0-1043.45","6.8.0-1044.46","6.8.0-1045.47","6.8.0-1046.49","6.8.0-1047.50"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1009.9~24.04.1","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1016.16~24.04.1","6.14.0-1017.17~24.04.1","6.14.0-1018.18~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1051.57"}]}],"versions":["6.5.0-1007.7","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1012.14","6.8.0-1013.15","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.20","6.8.0-1018.21","6.8.0-1020.23","6.8.0-1021.25","6.8.0-1025.30","6.8.0-1026.31","6.8.0-1027.32","6.8.0-1028.33","6.8.0-1029.34","6.8.0-1030.35","6.8.0-1031.36","6.8.0-1034.39","6.8.0-1038.44","6.8.0-1040.46","6.8.0-1041.47","6.8.0-1042.48","6.8.0-1044.50","6.8.0-1046.52"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1008.8~24.04.1","6.11.0-1012.12~24.04.1","6.11.0-1013.13~24.04.1","6.11.0-1014.14~24.04.1","6.11.0-1015.15~24.04.1","6.11.0-1017.17~24.04.1","6.11.0-1018.18~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1010.10~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1058.65"}]}],"versions":["6.8.0-1041.48","6.8.0-1044.51","6.8.0-1046.53","6.8.0-1053.60"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-fde-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-nvidia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1039.42"}]}],"versions":["6.8.0-1013.14","6.8.0-1014.15","6.8.0-1016.17","6.8.0-1018.19","6.8.0-1019.20","6.8.0-1022.23","6.8.0-1025.27","6.8.0-1027.30","6.8.0-1029.32"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-nvidia-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1003.3","6.14.0-1006.6","6.14.0-1007.7"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1052.55"}]}],"versions":["6.5.0-1007.7","6.6.0-1001.1","6.8.0-1002.2","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.9","6.8.0-1009.10","6.8.0-1010.11","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1024.26","6.8.0-1025.27","6.8.0-1026.28","6.8.0-1027.29","6.8.0-1028.30","6.8.0-1029.31","6.8.0-1030.32","6.8.0-1031.33","6.8.0-1032.34","6.8.0-1033.35","6.8.0-1034.36","6.8.0-1036.38","6.8.0-1037.39","6.8.0-1039.41","6.8.0-1040.42","6.8.0-1041.43","6.8.0-1042.45","6.8.0-1043.46","6.8.0-1044.47","6.8.0-1045.48","6.8.0-1046.49","6.8.0-1047.50","6.8.0-1048.51"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1006.6~24.04.2","6.11.0-1011.11~24.04.1","6.11.0-1013.13~24.04.1","6.11.0-1014.14~24.04.1","6.11.0-1015.15~24.04.1","6.11.0-1016.16~24.04.1","6.11.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1014.15~24.04.1","6.14.0-1015.16~24.04.1","6.14.0-1016.17~24.04.1","6.14.0-1017.18~24.04.1","6.14.0-1018.19~24.04.1","6.14.0-1019.20~24.04.1","6.14.0-1020.21~24.04.1","6.14.0-1021.22~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1048.53"}]}],"versions":["6.8.0-1003.5","6.8.0-1004.7","6.8.0-1005.8","6.8.0-1006.9","6.8.0-1007.10","6.8.0-1008.11","6.8.0-1009.12","6.8.0-1010.13","6.8.0-1011.14","6.8.0-1012.15","6.8.0-1013.17","6.8.0-1014.18","6.8.0-1015.19","6.8.0-1016.20","6.8.0-1017.21","6.8.0-1019.23","6.8.0-1020.24","6.8.0-1021.25","6.8.0-1022.26","6.8.0-1023.27","6.8.0-1024.28","6.8.0-1025.29","6.8.0-1026.30","6.8.0-1027.31","6.8.0-1028.32","6.8.0-1029.33","6.8.0-1032.36","6.8.0-1033.37","6.8.0-1035.39","6.8.0-1036.40","6.8.0-1037.41","6.8.0-1038.43","6.8.0-1039.44","6.8.0-1040.45","6.8.0-1041.46","6.8.0-1042.47","6.8.0-1043.48","6.8.0-1044.49"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1035.38"}]}],"versions":["6.8.0-1001.3","6.8.0-1002.4","6.8.0-1003.5","6.8.0-1004.6","6.8.0-1006.8","6.8.0-1007.9","6.8.0-1008.10","6.8.0-1009.11","6.8.0-1010.12","6.8.0-1011.13","6.8.0-1012.14","6.8.0-1013.15","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1022.24","6.8.0-1023.25","6.8.0-1024.26","6.8.0-1025.28","6.8.0-1026.29","6.8.0-1027.30","6.8.0-1028.31","6.8.0-1029.32","6.8.0-1030.33","6.8.0-1031.34"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-hwe-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-17.17~24.04.2","6.11.0-19.19~24.04.1","6.11.0-21.21~24.04.1","6.11.0-24.24~24.04.1","6.11.0-25.25~24.04.1","6.11.0-26.26~24.04.1","6.11.0-28.28~24.04.1","6.11.0-29.29~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-hwe-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-24.24~24.04.3","6.14.0-27.27~24.04.1","6.14.0-28.28~24.04.1","6.14.0-29.29~24.04.1","6.14.0-32.32~24.04.1","6.14.0-33.33~24.04.1","6.14.0-34.34~24.04.1","6.14.0-35.35~24.04.1","6.14.0-36.36~24.04.1","6.14.0-37.37~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1049.49"}]}],"versions":["6.5.0-1009.9","6.8.0-1001.1","6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1015.15","6.8.0-1016.16","6.8.0-1017.17","6.8.0-1018.18","6.8.0-1019.19","6.8.0-1022.22","6.8.0-1023.23","6.8.0-1024.24","6.8.0-1025.25","6.8.0-1026.26","6.8.0-1027.27","6.8.0-1028.28","6.8.0-1029.29","6.8.0-1030.30","6.8.0-1033.33","6.8.0-1036.36","6.8.0-1037.37","6.8.0-1038.38","6.8.0-1039.39","6.8.0-1040.40","6.8.0-1041.41","6.8.0-1042.42","6.8.0-1043.43","6.8.0-1044.44","6.8.0-1045.45"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-intel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1005.12","6.8.0-1006.13","6.8.0-1007.14"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-106.106.1"}]}],"versions":["6.5.0-9.9.1","6.6.0-14.14.1","6.8.0-7.7.1","6.8.0-25.25.3","6.8.0-28.28.1","6.8.0-31.31.1","6.8.0-35.35.1","6.8.0-36.36.1","6.8.0-38.38.1","6.8.0-39.39.1","6.8.0-40.40.1","6.8.0-41.41.1","6.8.0-44.44.1","6.8.0-45.45.1","6.8.0-47.47.1","6.8.0-48.48.3","6.8.0-49.49.1","6.8.0-50.51.1","6.8.0-51.52.1","6.8.0-52.53.1","6.8.0-53.55.2","6.8.0-54.56.1","6.8.0-55.57.1","6.8.0-56.58.1","6.8.0-57.59.1","6.8.0-58.60.1","6.8.0-59.61.1","6.8.0-60.63.1","6.8.0-62.65.1","6.8.0-63.66.1","6.8.0-64.67.1","6.8.0-65.68.1","6.8.0-78.78.1","6.8.0-79.79.1","6.8.0-83.83.1","6.8.0-84.84.1","6.8.0-85.85.1","6.8.0-86.87.1","6.8.0-87.88.1","6.8.0-88.89.1","6.8.0-90.91.1","6.8.0-94.96.1","6.8.0-100.100.1","6.8.0-101.101.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency-hwe-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1009.10~24.04.1","6.11.0-1011.12~24.04.1","6.11.0-1012.13~24.04.1","6.11.0-1013.14~24.04.1","6.11.0-1014.15~24.04.1","6.11.0-1015.16~24.04.2","6.11.0-1016.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1049.52"}]}],"versions":["6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1022.25","6.8.0-1023.26","6.8.0-1024.27","6.8.0-1025.28","6.8.0-1026.29","6.8.0-1027.30","6.8.0-1028.31","6.8.0-1029.32","6.8.0-1030.33","6.8.0-1031.34","6.8.0-1032.35","6.8.0-1035.38","6.8.0-1036.39","6.8.0-1038.41","6.8.0-1039.42","6.8.0-1040.43","6.8.0-1041.44","6.8.0-1042.45","6.8.0-1043.46","6.8.0-1044.47","6.8.0-1045.48","6.8.0-1046.49","6.8.0-1047.50"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1002.2","6.11.0-1003.3","6.11.0-1007.7","6.11.0-1010.10","6.11.0-1011.11","6.11.0-1012.12","6.11.0-1013.13","6.11.0-1016.16"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1049.52.1"}]}],"versions":["6.8.0-1009.9.1","6.8.0-1011.11.1","6.8.0-1012.12.1","6.8.0-1013.14.1","6.8.0-1014.15.1","6.8.0-1015.16.1","6.8.0-1017.19.1","6.8.0-1018.20.1","6.8.0-1019.21.1","6.8.0-1020.22.1","6.8.0-1021.23.1","6.8.0-1022.25.2","6.8.0-1023.26.1","6.8.0-1024.27.1","6.8.0-1025.28.1","6.8.0-1026.29.1","6.8.0-1027.30.1","6.8.0-1028.31.1","6.8.0-1029.32.1","6.8.0-1030.33.1","6.8.0-1031.34.1","6.8.0-1032.35.1","6.8.0-1035.38.1","6.8.0-1036.39.1","6.8.0-1038.41.1","6.8.0-1039.42.1","6.8.0-1040.43.1","6.8.0-1041.44.1","6.8.0-1042.45.1","6.8.0-1043.46.1","6.8.0-1044.47.1","6.8.0-1045.48.1","6.8.0-1046.49.1","6.8.0-1047.50.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-tegra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1020.20"}]}],"versions":["6.8.0-1003.3","6.8.0-1004.4","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1016.16","6.8.0-1019.19"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1007.7","6.11.0-1008.8","6.11.0-1009.9","6.11.0-1010.10","6.11.0-1011.11","6.11.0-1012.12","6.11.0-1013.13","6.11.0-1015.15","6.11.0-1016.16","6.11.0-1017.17","6.11.0-1018.18","6.11.0-1020.20","6.11.0-1021.21","6.11.0-1022.22","6.11.0-1023.23","6.11.0-1024.24","6.11.0-1025.25","6.11.0-1027.27"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1004.4","6.14.0-1005.5","6.14.0-1006.6","6.14.0-1007.7","6.14.0-1008.8","6.14.0-1010.10","6.14.0-1011.11","6.14.0-1012.12","6.14.0-1013.13","6.14.0-1014.14","6.14.0-1015.15","6.14.0-1016.16","6.14.0-1017.17","6.14.0-1018.18","6.14.0-1019.19","6.14.0-1020.20"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1016.16","6.8.0-1017.17","6.8.0-1018.18","6.8.0-1019.19","6.8.0-1020.20","6.8.0-1024.24","6.8.0-1025.25","6.8.0-1026.26","6.8.0-1027.27","6.8.0-1028.28","6.8.0-1029.29","6.8.0-1030.30","6.8.0-1031.31","6.8.0-1032.32"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1047.48"}]}],"versions":["6.5.0-1010.10","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1008.8","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1015.16","6.8.0-1016.17","6.8.0-1017.18","6.8.0-1018.19","6.8.0-1019.20","6.8.0-1020.21","6.8.0-1021.22","6.8.0-1022.23","6.8.0-1023.24","6.8.0-1024.25","6.8.0-1025.26","6.8.0-1026.27","6.8.0-1027.28","6.8.0-1028.29","6.8.0-1029.30","6.8.0-1030.31","6.8.0-1032.33","6.8.0-1033.34","6.8.0-1035.36","6.8.0-1037.38","6.8.0-1038.39","6.8.0-1039.40","6.8.0-1040.41","6.8.0-1041.42","6.8.0-1042.43","6.8.0-1043.44","6.8.0-1044.45"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1009.9~24.04.1","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1016.16~24.04.1","6.14.0-1017.17~24.04.1","6.14.0-1018.18~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1050.54"}]}],"versions":["6.5.0-1005.7","6.7.0-1001.1","6.8.0-1001.1","6.8.0-1002.2","6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.10","6.8.0-1010.11","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.23","6.8.0-1020.24","6.8.0-1024.28","6.8.0-1028.32","6.8.0-1029.33","6.8.0-1030.34","6.8.0-1031.35","6.8.0-1032.36","6.8.0-1035.39","6.8.0-1036.40","6.8.0-1038.42","6.8.0-1039.43","6.8.0-1040.44","6.8.0-1041.45","6.8.0-1042.46","6.8.0-1043.47","6.8.0-1044.48","6.8.0-1045.49","6.8.0-1047.51","6.8.0-1048.52"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-2019.20"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.1-1015.16"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-9.9.1","6.8.0-20.20.1","6.8.0-28.28.1","6.8.0-31.31.1","6.8.0-35.35.1","6.8.0-36.36.1","6.8.0-38.38.1","6.8.0-39.39.1","6.8.0-40.40.1","6.8.0-41.41.1","6.8.0-44.44.1","6.8.0-47.47.1","6.8.0-48.48.1","6.8.0-49.49.1","6.8.0-50.51.1","6.8.0-51.52.1","6.8.0-52.53.1","6.8.0-53.55.1","6.8.0-55.57.1","6.8.0-56.58.1","6.8.0-57.59.1","6.8.0-58.60.1","6.8.0-59.61.1","6.8.0-60.63.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-22.22.1~24.04.1","6.14.0-23.23.1~24.04.1","6.14.0-24.24.1~24.04.1","6.14.0-27.27.1~24.04.1","6.14.0-28.28.1~24.04.1","6.14.0-29.29.1~24.04.1","6.14.0-32.32.1~24.04.1","6.14.0-33.33.1~24.04.1","6.14.0-34.34.1~24.04.1","6.14.0-35.35.1~24.04.1","6.14.0-36.36.1~24.04.1","6.14.0-37.37.1~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-xilinx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1028.29"}]}],"versions":["6.8.0-1008.9","6.8.0-1009.10","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1017.18","6.8.0-1018.19","6.8.0-1019.20","6.8.0-1020.21","6.8.0-1021.22","6.8.0-1022.23","6.8.0-1023.24","6.8.0-1024.25"]},{"source":"osv","ecosystem":"Ubuntu:Nvidia-BlueField:24.04:LTS","package":"linux-bluefield","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1017.21"}]}],"versions":["6.8.0-1011.15","6.8.0-1012.16","6.8.0-1013.17","6.8.0-1014.18","6.8.0-1016.20"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-raspi-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-2040.41"}]}],"versions":["6.7.0-2001.1","6.8.0-2001.1","6.8.0-2002.2","6.8.0-2004.4","6.8.0-2005.5","6.8.0-2006.6","6.8.0-2007.7","6.8.0-2008.8","6.8.0-2009.9","6.8.0-2010.10","6.8.0-2011.11","6.8.0-2012.12","6.8.0-2013.14","6.8.0-2014.15","6.8.0-2015.16","6.8.0-2016.17","6.8.0-2017.18","6.8.0-2018.19","6.8.0-2019.20","6.8.0-2022.23","6.8.0-2023.24","6.8.0-2024.25","6.8.0-2025.26","6.8.0-2026.27","6.8.0-2028.29","6.8.0-2029.30","6.8.0-2030.31","6.8.0-2031.32","6.8.0-2032.33","6.8.0-2033.34","6.8.0-2034.35","6.8.0-2035.36","6.8.0-2036.37","6.8.0-2037.38","6.8.0-2038.39"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.1-1045.46"}]}],"versions":["6.8.0-1008.19","6.8.1-1001.1","6.8.1-1002.2","6.8.1-1003.3","6.8.1-1004.4","6.8.1-1005.5","6.8.1-1006.6","6.8.1-1007.7","6.8.1-1008.8","6.8.1-1009.9","6.8.1-1010.10","6.8.1-1011.11","6.8.1-1012.12","6.8.1-1013.14","6.8.1-1014.15","6.8.1-1015.16","6.8.1-1016.17","6.8.1-1017.18","6.8.1-1018.19","6.8.1-1019.20","6.8.1-1020.21","6.8.1-1021.22","6.8.1-1022.23","6.8.1-1023.24","6.8.1-1024.25","6.8.1-1025.26","6.8.1-1026.27","6.8.1-1030.31","6.8.1-1031.32","6.8.1-1033.34","6.8.1-1034.35","6.8.1-1035.36","6.8.1-1036.37","6.8.1-1037.38","6.8.1-1038.39","6.8.1-1039.40","6.8.1-1040.41","6.8.1-1041.42","6.8.1-1042.43"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1003.3~24.04.3","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1016.16~24.04.1","6.14.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-aws-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1050.53+fips1"}]}],"versions":["6.8.0-1035.37+fips1","6.8.0-1036.38+fips1","6.8.0-1038.40+fips1","6.8.0-1039.41+fips1","6.8.0-1040.42+fips1","6.8.0-1041.43+fips1","6.8.0-1042.44+fips1","6.8.0-1043.45+fips1","6.8.0-1044.46+fips1","6.8.0-1045.47+fips1","6.8.0-1046.49+fips1","6.8.0-1047.50+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-azure-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1052.58+fips1"}]}],"versions":["6.8.0-1034.39+fips1","6.8.0-1040.46+fips1","6.8.0-1044.50+fips1","6.8.0-1046.52+fips1","6.8.0-1047.53+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-106.106+fips1"}]}],"versions":["6.8.0-38.38+fips4","6.8.0-78.78+fips1","6.8.0-79.79+fips1","6.8.0-83.83+fips1","6.8.0-84.84+fips1","6.8.0-85.85+fips1","6.8.0-86.87+fips1","6.8.0-87.88+fips1","6.8.0-88.89+fips1","6.8.0-90.91+fips1","6.8.0-94.96+fips1","6.8.0-100.100+fips1","6.8.0-101.101+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-gcp-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1052.55+fips1"}]}],"versions":["6.8.0-1036.38+fips1","6.8.0-1037.39+fips1","6.8.0-1039.41+fips1","6.8.0-1040.42+fips1","6.8.0-1041.43+fips1","6.8.0-1042.45+fips1","6.8.0-1043.46+fips1","6.8.0-1044.47+fips1","6.8.0-1045.48+fips1","6.8.0-1046.49+fips1","6.8.0-1047.50+fips1","6.8.0-1048.51+fips1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1003.3","6.17.0-1004.4","6.17.0-1005.5","6.17.0-1007.7","6.17.0-1008.8","6.17.0-1010.10","6.17.0-1012.12","6.17.0-1014.14","6.17.0-1015.15","6.17.0-1017.17"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"linux-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.0-1006.6"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1052.55~22.04.1"}]}],"versions":["6.8.0-1010.11~22.04.1","6.8.0-1011.12~22.04.1","6.8.0-1012.13~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.16~22.04.1","6.8.0-1015.17~22.04.1","6.8.0-1016.18~22.04.1","6.8.0-1017.19~22.04.1","6.8.0-1018.20~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1024.26~22.04.1","6.8.0-1025.27~22.04.1","6.8.0-1026.28~22.04.1","6.8.0-1027.29~22.04.1","6.8.0-1028.30~22.04.1","6.8.0-1029.31~22.04.1","6.8.0-1030.32~22.04.1","6.8.0-1031.33~22.04.1","6.8.0-1032.34~22.04.1","6.8.0-1033.35~22.04.1","6.8.0-1034.36~22.04.2","6.8.0-1036.38~22.04.1","6.8.0-1037.39~22.04.1","6.8.0-1040.42~22.04.1","6.8.0-1041.43~22.04.1","6.8.0-1042.45~22.04.1","6.8.0-1043.46~22.04.1","6.8.0-1044.47~22.04.1","6.8.0-1045.48~22.04.1","6.8.0-1046.49~22.04.1","6.8.0-1047.50~22.04.2","6.8.0-1048.51~22.04.1"],"bundled":423},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-106.106~22.04.1"}]}],"versions":["6.8.0-38.38~22.04.1","6.8.0-39.39~22.04.1","6.8.0-40.40~22.04.3","6.8.0-45.45~22.04.1","6.8.0-47.47~22.04.1","6.8.0-48.48~22.04.1","6.8.0-49.49~22.04.1","6.8.0-50.51~22.04.1","6.8.0-51.52~22.04.1","6.8.0-52.53~22.04.1","6.8.0-57.59~22.04.1","6.8.0-58.60~22.04.1","6.8.0-59.61~22.04.1","6.8.0-60.63~22.04.1","6.8.0-64.67~22.04.1","6.8.0-65.68~22.04.1","6.8.0-78.78~22.04.1","6.8.0-79.79~22.04.1","6.8.0-83.83~22.04.1","6.8.0-84.84~22.04.1","6.8.0-85.85~22.04.1","6.8.0-86.87~22.04.1","6.8.0-87.88~22.04.1","6.8.0-88.89~22.04.2","6.8.0-90.91~22.04.1","6.8.0-94.96~22.04.1","6.8.0-100.100~22.04.1","6.8.0-101.101~22.04.1"],"bundled":423},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-ibm-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1049.49~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.13~22.04.1","6.8.0-1014.14~22.04.1","6.8.0-1015.15~22.04.1","6.8.0-1016.16~22.04.1","6.8.0-1017.17~22.04.1","6.8.0-1018.18~22.04.1","6.8.0-1019.19~22.04.1","6.8.0-1023.23~22.04.1","6.8.0-1024.24~22.04.1","6.8.0-1025.25~22.04.1","6.8.0-1026.26~22.04.1","6.8.0-1027.27~22.04.1","6.8.0-1028.28~22.04.1","6.8.0-1029.29~22.04.1","6.8.0-1030.30~22.04.1","6.8.0-1033.33~22.04.1","6.8.0-1036.36~22.04.1","6.8.0-1037.37~22.04.1","6.8.0-1038.38~22.04.1","6.8.0-1039.39~22.04.1","6.8.0-1040.40~22.04.1","6.8.0-1041.41~22.04.1","6.8.0-1042.42~22.04.1","6.8.0-1043.43~22.04.1","6.8.0-1044.44~22.04.1","6.8.0-1045.45~22.04.1"],"bundled":423},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-106.106.1~22.04.1"}]}],"versions":["6.8.0-38.38.1~22.04.2","6.8.0-40.40.1~22.04.1","6.8.0-44.44.1~22.04.1","6.8.0-45.45.1~22.04.1","6.8.0-47.47.1~22.04.1","6.8.0-48.48.3~22.04.1","6.8.0-49.49.1~22.04.1","6.8.0-50.51.1~22.04.1","6.8.0-51.52.1~22.04.1","6.8.0-52.53.1~22.04.1","6.8.0-54.56.1~22.04.1","6.8.0-55.57.1~22.04.1","6.8.0-56.58.1~22.04.1","6.8.0-57.59.1~22.04.1","6.8.0-58.60.1~22.04.1","6.8.0-59.61.1~22.04.1","6.8.0-60.63.1~22.04.1","6.8.0-62.65.1~22.04.1","6.8.0-63.66.1~22.04.1","6.8.0-64.67.1~22.04.1","6.8.0-65.68.1~22.04.1","6.8.0-78.78.1~22.04.1","6.8.0-79.79.1~22.04.1","6.8.0-83.83.1~22.04.1","6.8.0-84.84.1~22.04.1","6.8.0-85.85.1~22.04.1","6.8.0-86.87.1~22.04.1","6.8.0-87.88.1~22.04.1","6.8.0-88.89.1~22.04.1","6.8.0-90.91.1~22.04.1","6.8.0-94.96.1~22.04.1","6.8.0-100.100.1~22.04.1","6.8.0-101.101.1~22.04.1"],"bundled":423},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1047.48~22.04.1"}]}],"versions":["6.8.0-1006.6~22.04.3","6.8.0-1008.8~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.13~22.04.1","6.8.0-1014.14~22.04.1","6.8.0-1015.15~22.04.1","6.8.0-1016.17~22.04.1","6.8.0-1017.18~22.04.1","6.8.0-1018.19~22.04.1","6.8.0-1019.20~22.04.1","6.8.0-1020.21~22.04.1","6.8.0-1021.22~22.04.1","6.8.0-1022.23~22.04.1","6.8.0-1023.24~22.04.1","6.8.0-1024.25~22.04.1","6.8.0-1025.26~22.04.1","6.8.0-1026.27~22.04.1","6.8.0-1027.28~22.04.1","6.8.0-1028.29~22.04.1","6.8.0-1029.30~22.04.1","6.8.0-1030.31~22.04.1","6.8.0-1032.33~22.04.1","6.8.0-1033.34~22.04.1","6.8.0-1035.36~22.04.1","6.8.0-1037.38~22.04.1","6.8.0-1038.39~22.04.1","6.8.0-1039.40~22.04.1","6.8.0-1040.41~22.04.1","6.8.0-1041.42~22.04.1","6.8.0-1042.43~22.04.1","6.8.0-1043.44~22.04.1","6.8.0-1044.45~22.04.1"],"bundled":423},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-106.106"}]}],"versions":["6.5.0-9.9","6.6.0-14.14","6.8.0-11.11","6.8.0-20.20","6.8.0-22.22","6.8.0-28.28","6.8.0-31.31","6.8.0-35.35","6.8.0-36.36","6.8.0-38.38","6.8.0-39.39","6.8.0-40.40","6.8.0-41.41","6.8.0-44.44","6.8.0-45.45","6.8.0-47.47","6.8.0-48.48","6.8.0-49.49","6.8.0-50.51","6.8.0-51.52","6.8.0-52.53","6.8.0-53.55","6.8.0-54.56","6.8.0-55.57","6.8.0-56.58","6.8.0-57.59","6.8.0-58.60","6.8.0-59.61","6.8.0-60.63","6.8.0-62.65","6.8.0-63.66","6.8.0-64.67","6.8.0-71.71","6.8.0-78.78","6.8.0-79.79","6.8.0-83.83","6.8.0-84.84","6.8.0-85.85","6.8.0-86.87","6.8.0-87.88","6.8.0-88.89","6.8.0-90.91","6.8.0-94.96","6.8.0-100.100","6.8.0-101.101"],"bundled":423},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1050.53"}]}],"versions":["6.5.0-1008.8","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1006.6","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1016.17","6.8.0-1017.18","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1023.25","6.8.0-1024.26","6.8.0-1025.27","6.8.0-1026.28","6.8.0-1027.29","6.8.0-1028.30","6.8.0-1029.31","6.8.0-1030.32","6.8.0-1031.33","6.8.0-1032.34","6.8.0-1033.35","6.8.0-1035.37","6.8.0-1036.38","6.8.0-1038.40","6.8.0-1039.41","6.8.0-1040.42","6.8.0-1041.43","6.8.0-1042.44","6.8.0-1043.45","6.8.0-1044.46","6.8.0-1045.47","6.8.0-1046.49","6.8.0-1047.50"],"bundled":423},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1052.55"}]}],"versions":["6.5.0-1007.7","6.6.0-1001.1","6.8.0-1002.2","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.9","6.8.0-1009.10","6.8.0-1010.11","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1024.26","6.8.0-1025.27","6.8.0-1026.28","6.8.0-1027.29","6.8.0-1028.30","6.8.0-1029.31","6.8.0-1030.32","6.8.0-1031.33","6.8.0-1032.34","6.8.0-1033.35","6.8.0-1034.36","6.8.0-1036.38","6.8.0-1037.39","6.8.0-1039.41","6.8.0-1040.42","6.8.0-1041.43","6.8.0-1042.45","6.8.0-1043.46","6.8.0-1044.47","6.8.0-1045.48","6.8.0-1046.49","6.8.0-1047.50","6.8.0-1048.51"],"bundled":423},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1048.53"}]}],"versions":["6.8.0-1003.5","6.8.0-1004.7","6.8.0-1005.8","6.8.0-1006.9","6.8.0-1007.10","6.8.0-1008.11","6.8.0-1009.12","6.8.0-1010.13","6.8.0-1011.14","6.8.0-1012.15","6.8.0-1013.17","6.8.0-1014.18","6.8.0-1015.19","6.8.0-1016.20","6.8.0-1017.21","6.8.0-1019.23","6.8.0-1020.24","6.8.0-1021.25","6.8.0-1022.26","6.8.0-1023.27","6.8.0-1024.28","6.8.0-1025.29","6.8.0-1026.30","6.8.0-1027.31","6.8.0-1028.32","6.8.0-1029.33","6.8.0-1032.36","6.8.0-1033.37","6.8.0-1035.39","6.8.0-1036.40","6.8.0-1037.41","6.8.0-1038.43","6.8.0-1039.44","6.8.0-1040.45","6.8.0-1041.46","6.8.0-1042.47","6.8.0-1043.48","6.8.0-1044.49"],"bundled":423},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1035.38"}]}],"versions":["6.8.0-1001.3","6.8.0-1002.4","6.8.0-1003.5","6.8.0-1004.6","6.8.0-1006.8","6.8.0-1007.9","6.8.0-1008.10","6.8.0-1009.11","6.8.0-1010.12","6.8.0-1011.13","6.8.0-1012.14","6.8.0-1013.15","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1022.24","6.8.0-1023.25","6.8.0-1024.26","6.8.0-1025.28","6.8.0-1026.29","6.8.0-1027.30","6.8.0-1028.31","6.8.0-1029.32","6.8.0-1030.33","6.8.0-1031.34"],"bundled":423},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1049.49"}]}],"versions":["6.5.0-1009.9","6.8.0-1001.1","6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1015.15","6.8.0-1016.16","6.8.0-1017.17","6.8.0-1018.18","6.8.0-1019.19","6.8.0-1022.22","6.8.0-1023.23","6.8.0-1024.24","6.8.0-1025.25","6.8.0-1026.26","6.8.0-1027.27","6.8.0-1028.28","6.8.0-1029.29","6.8.0-1030.30","6.8.0-1033.33","6.8.0-1036.36","6.8.0-1037.37","6.8.0-1038.38","6.8.0-1039.39","6.8.0-1040.40","6.8.0-1041.41","6.8.0-1042.42","6.8.0-1043.43","6.8.0-1044.44","6.8.0-1045.45"],"bundled":423},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-106.106.1"}]}],"versions":["6.5.0-9.9.1","6.6.0-14.14.1","6.8.0-7.7.1","6.8.0-25.25.3","6.8.0-28.28.1","6.8.0-31.31.1","6.8.0-35.35.1","6.8.0-36.36.1","6.8.0-38.38.1","6.8.0-39.39.1","6.8.0-40.40.1","6.8.0-41.41.1","6.8.0-44.44.1","6.8.0-45.45.1","6.8.0-47.47.1","6.8.0-48.48.3","6.8.0-49.49.1","6.8.0-50.51.1","6.8.0-51.52.1","6.8.0-52.53.1","6.8.0-53.55.2","6.8.0-54.56.1","6.8.0-55.57.1","6.8.0-56.58.1","6.8.0-57.59.1","6.8.0-58.60.1","6.8.0-59.61.1","6.8.0-60.63.1","6.8.0-62.65.1","6.8.0-63.66.1","6.8.0-64.67.1","6.8.0-65.68.1","6.8.0-78.78.1","6.8.0-79.79.1","6.8.0-83.83.1","6.8.0-84.84.1","6.8.0-85.85.1","6.8.0-86.87.1","6.8.0-87.88.1","6.8.0-88.89.1","6.8.0-90.91.1","6.8.0-94.96.1","6.8.0-100.100.1","6.8.0-101.101.1"],"bundled":423},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1047.48"}]}],"versions":["6.5.0-1010.10","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1008.8","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1015.16","6.8.0-1016.17","6.8.0-1017.18","6.8.0-1018.19","6.8.0-1019.20","6.8.0-1020.21","6.8.0-1021.22","6.8.0-1022.23","6.8.0-1023.24","6.8.0-1024.25","6.8.0-1025.26","6.8.0-1026.27","6.8.0-1027.28","6.8.0-1028.29","6.8.0-1029.30","6.8.0-1030.31","6.8.0-1032.33","6.8.0-1033.34","6.8.0-1035.36","6.8.0-1037.38","6.8.0-1038.39","6.8.0-1039.40","6.8.0-1040.41","6.8.0-1041.42","6.8.0-1042.43","6.8.0-1043.44","6.8.0-1044.45"],"bundled":423},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-aws-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1050.53+fips1"}]}],"versions":["6.8.0-1035.37+fips1","6.8.0-1036.38+fips1","6.8.0-1038.40+fips1","6.8.0-1039.41+fips1","6.8.0-1040.42+fips1","6.8.0-1041.43+fips1","6.8.0-1042.44+fips1","6.8.0-1043.45+fips1","6.8.0-1044.46+fips1","6.8.0-1045.47+fips1","6.8.0-1046.49+fips1","6.8.0-1047.50+fips1"],"bundled":423},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-106.106+fips1"}]}],"versions":["6.8.0-38.38+fips4","6.8.0-78.78+fips1","6.8.0-79.79+fips1","6.8.0-83.83+fips1","6.8.0-84.84+fips1","6.8.0-85.85+fips1","6.8.0-86.87+fips1","6.8.0-87.88+fips1","6.8.0-88.89+fips1","6.8.0-90.91+fips1","6.8.0-94.96+fips1","6.8.0-100.100+fips1","6.8.0-101.101+fips1"],"bundled":423},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-gcp-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1052.55+fips1"}]}],"versions":["6.8.0-1036.38+fips1","6.8.0-1037.39+fips1","6.8.0-1039.41+fips1","6.8.0-1040.42+fips1","6.8.0-1041.43+fips1","6.8.0-1042.45+fips1","6.8.0-1043.46+fips1","6.8.0-1044.47+fips1","6.8.0-1045.48+fips1","6.8.0-1046.49+fips1","6.8.0-1047.50+fips1","6.8.0-1048.51+fips1"],"bundled":423},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:22.04:LTS","package":"linux-realtime-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.1-1045.46~22.04.1"}]}],"versions":["6.8.1-1004.4~22.04.1","6.8.1-1005.5~22.04.2","6.8.1-1006.6~22.04.1","6.8.1-1007.7~22.04.1","6.8.1-1008.8~22.04.1","6.8.1-1009.9~22.04.1","6.8.1-1010.10~22.04.1","6.8.1-1011.11~22.04.1","6.8.1-1012.12~22.04.1","6.8.1-1013.14~22.04.1","6.8.1-1014.15~22.04.1","6.8.1-1015.16~22.04.1","6.8.1-1016.17~22.04.1","6.8.1-1017.18~22.04.1","6.8.1-1018.19~22.04.1","6.8.1-1019.20~22.04.1","6.8.1-1020.21~22.04.1","6.8.1-1021.22~22.04.1","6.8.1-1022.23~22.04.1","6.8.1-1023.24~22.04.1","6.8.1-1024.25~22.04.1","6.8.1-1025.26~22.04.1","6.8.1-1026.27~22.04.1","6.8.1-1030.31~22.04.1","6.8.1-1031.32~22.04.1","6.8.1-1034.35~22.04.1","6.8.1-1035.36~22.04.1","6.8.1-1036.37~22.04.1","6.8.1-1037.38~22.04.1","6.8.1-1038.39~22.04.1","6.8.1-1039.40~22.04.1","6.8.1-1040.41~22.04.1","6.8.1-1041.42~22.04.1","6.8.1-1042.43~22.04.1"],"bundled":423},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.1-1045.46"}]}],"versions":["6.8.0-1008.19","6.8.1-1001.1","6.8.1-1002.2","6.8.1-1003.3","6.8.1-1004.4","6.8.1-1005.5","6.8.1-1006.6","6.8.1-1007.7","6.8.1-1008.8","6.8.1-1009.9","6.8.1-1010.10","6.8.1-1011.11","6.8.1-1012.12","6.8.1-1013.14","6.8.1-1014.15","6.8.1-1015.16","6.8.1-1016.17","6.8.1-1017.18","6.8.1-1018.19","6.8.1-1019.20","6.8.1-1020.21","6.8.1-1021.22","6.8.1-1022.23","6.8.1-1023.24","6.8.1-1024.25","6.8.1-1025.26","6.8.1-1026.27","6.8.1-1030.31","6.8.1-1031.32","6.8.1-1033.34","6.8.1-1034.35","6.8.1-1035.36","6.8.1-1036.37","6.8.1-1037.38","6.8.1-1038.39","6.8.1-1039.40","6.8.1-1040.41","6.8.1-1041.42","6.8.1-1042.43"],"bundled":423},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1050.53~22.04.1"}]}],"versions":["6.8.0-1009.9~22.04.2","6.8.0-1010.10~22.04.2","6.8.0-1011.12~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.15~22.04.1","6.8.0-1015.16~22.04.1","6.8.0-1016.17~22.04.2","6.8.0-1017.18~22.04.1","6.8.0-1018.19~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1023.25~22.04.1","6.8.0-1024.26~22.04.1","6.8.0-1027.29~22.04.1","6.8.0-1028.30~22.04.1","6.8.0-1029.31~22.04.1","6.8.0-1030.32~22.04.1","6.8.0-1031.33~22.04.1","6.8.0-1032.34~22.04.1","6.8.0-1033.35~22.04.1","6.8.0-1035.37~22.04.1","6.8.0-1036.38~22.04.1","6.8.0-1039.41~22.04.1","6.8.0-1040.42~22.04.1","6.8.0-1041.43~22.04.1","6.8.0-1042.44~22.04.1","6.8.0-1043.45~22.04.1","6.8.0-1044.46~22.04.1","6.8.0-1045.47~22.04.1","6.8.0-1046.49~22.04.1","6.8.0-1047.50~22.04.1"],"bundled":423},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1050.54"}]}],"versions":["6.5.0-1005.7","6.7.0-1001.1","6.8.0-1001.1","6.8.0-1002.2","6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.10","6.8.0-1010.11","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.23","6.8.0-1020.24","6.8.0-1024.28","6.8.0-1028.32","6.8.0-1029.33","6.8.0-1030.34","6.8.0-1031.35","6.8.0-1032.36","6.8.0-1035.39","6.8.0-1036.40","6.8.0-1038.42","6.8.0-1039.43","6.8.0-1040.44","6.8.0-1041.45","6.8.0-1042.46","6.8.0-1043.47","6.8.0-1044.48","6.8.0-1045.49","6.8.0-1047.51","6.8.0-1048.52"],"bundled":423},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-raspi-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-2040.41"}]}],"versions":["6.7.0-2001.1","6.8.0-2001.1","6.8.0-2002.2","6.8.0-2004.4","6.8.0-2005.5","6.8.0-2006.6","6.8.0-2007.7","6.8.0-2008.8","6.8.0-2009.9","6.8.0-2010.10","6.8.0-2011.11","6.8.0-2012.12","6.8.0-2013.14","6.8.0-2014.15","6.8.0-2015.16","6.8.0-2016.17","6.8.0-2017.18","6.8.0-2018.19","6.8.0-2019.20","6.8.0-2022.23","6.8.0-2023.24","6.8.0-2024.25","6.8.0-2025.26","6.8.0-2026.27","6.8.0-2028.29","6.8.0-2029.30","6.8.0-2030.31","6.8.0-2031.32","6.8.0-2032.33","6.8.0-2033.34","6.8.0-2034.35","6.8.0-2035.36","6.8.0-2036.37","6.8.0-2037.38","6.8.0-2038.39"],"bundled":423},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1049.52~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1009.9~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.15~22.04.1","6.8.0-1015.16~22.04.1","6.8.0-1017.19~22.04.1","6.8.0-1018.20~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1022.25~22.04.2","6.8.0-1023.26~22.04.1","6.8.0-1024.27~22.04.1","6.8.0-1025.28~22.04.1","6.8.0-1026.29~22.04.1","6.8.0-1027.30~22.04.1","6.8.0-1028.31~22.04.1","6.8.0-1029.32~22.04.1","6.8.0-1030.33~22.04.1","6.8.0-1031.34~22.04.1","6.8.0-1032.35~22.04.1","6.8.0-1035.38~22.04.1","6.8.0-1036.39~22.04.1","6.8.0-1038.41~22.04.1","6.8.0-1039.42~22.04.1","6.8.0-1040.43~22.04.1","6.8.0-1041.44~22.04.2","6.8.0-1042.45~22.04.1","6.8.0-1043.46~22.04.1","6.8.0-1044.47~22.04.1","6.8.0-1045.48~22.04.1","6.8.0-1046.49~22.04.1","6.8.0-1047.50~22.04.1"],"bundled":425},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1049.52"}]}],"versions":["6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1022.25","6.8.0-1023.26","6.8.0-1024.27","6.8.0-1025.28","6.8.0-1026.29","6.8.0-1027.30","6.8.0-1028.31","6.8.0-1029.32","6.8.0-1030.33","6.8.0-1031.34","6.8.0-1032.35","6.8.0-1035.38","6.8.0-1036.39","6.8.0-1038.41","6.8.0-1039.42","6.8.0-1040.43","6.8.0-1041.44","6.8.0-1042.45","6.8.0-1043.46","6.8.0-1044.47","6.8.0-1045.48","6.8.0-1046.49","6.8.0-1047.50"],"bundled":425},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1049.52.1"}]}],"versions":["6.8.0-1009.9.1","6.8.0-1011.11.1","6.8.0-1012.12.1","6.8.0-1013.14.1","6.8.0-1014.15.1","6.8.0-1015.16.1","6.8.0-1017.19.1","6.8.0-1018.20.1","6.8.0-1019.21.1","6.8.0-1020.22.1","6.8.0-1021.23.1","6.8.0-1022.25.2","6.8.0-1023.26.1","6.8.0-1024.27.1","6.8.0-1025.28.1","6.8.0-1026.29.1","6.8.0-1027.30.1","6.8.0-1028.31.1","6.8.0-1029.32.1","6.8.0-1030.33.1","6.8.0-1031.34.1","6.8.0-1032.35.1","6.8.0-1035.38.1","6.8.0-1036.39.1","6.8.0-1038.41.1","6.8.0-1039.42.1","6.8.0-1040.43.1","6.8.0-1041.44.1","6.8.0-1042.45.1","6.8.0-1043.46.1","6.8.0-1044.47.1","6.8.0-1045.48.1","6.8.0-1046.49.1","6.8.0-1047.50.1"],"bundled":425},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1051.57"}]}],"versions":["6.5.0-1007.7","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1012.14","6.8.0-1013.15","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.20","6.8.0-1018.21","6.8.0-1020.23","6.8.0-1021.25","6.8.0-1025.30","6.8.0-1026.31","6.8.0-1027.32","6.8.0-1028.33","6.8.0-1029.34","6.8.0-1030.35","6.8.0-1031.36","6.8.0-1034.39","6.8.0-1038.44","6.8.0-1040.46","6.8.0-1041.47","6.8.0-1042.48","6.8.0-1044.50","6.8.0-1046.52"],"bundled":426},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1051.57~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1009.9~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1012.14~22.04.1","6.8.0-1013.15~22.04.1","6.8.0-1014.16~22.04.1","6.8.0-1015.17~22.04.2","6.8.0-1017.20~22.04.1","6.8.0-1018.21~22.04.1","6.8.0-1020.23~22.04.1","6.8.0-1021.25~22.04.1","6.8.0-1025.30~22.04.1","6.8.0-1026.31~22.04.1","6.8.0-1027.32~22.04.1","6.8.0-1028.33~22.04.1","6.8.0-1029.34~22.04.1","6.8.0-1030.35~22.04.1","6.8.0-1031.36~22.04.1","6.8.0-1034.39~22.04.1","6.8.0-1036.42~22.04.1","6.8.0-1040.46~22.04.1","6.8.0-1041.47~22.04.1","6.8.0-1044.50~22.04.1"],"bundled":1179},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-azure-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1052.58+fips1"}]}],"versions":["6.8.0-1034.39+fips1","6.8.0-1040.46+fips1","6.8.0-1044.50+fips1","6.8.0-1046.52+fips1","6.8.0-1047.53+fips1"],"bundled":438},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-xilinx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1029.30"}]}],"versions":["6.8.0-1008.9","6.8.0-1009.10","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1017.18","6.8.0-1018.19","6.8.0-1019.20","6.8.0-1020.21","6.8.0-1021.22","6.8.0-1022.23","6.8.0-1023.24","6.8.0-1024.25","6.8.0-1028.29"],"bundled":609},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"dtb-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.7.1"}]}],"bundled":83},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.7.1"}]}],"bundled":83},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.7.1"}]}],"bundled":83},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.6.1.160000.2.4"}]}],"bundled":83},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.7.1"}]}],"bundled":83},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.7.1"}]}],"bundled":83},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.7.1"}]}],"bundled":83},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.7.1"}]}],"bundled":83},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.7.1"}]}],"bundled":83},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.7.1"}]}],"bundled":83},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.7.1"}]}],"bundled":83},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.7.1"}]}],"bundled":83}],"products":[{"vendor":"linux","product":"linux"},{"vendor":"linux","product":"linux_kernel"}],"references":[{"url":"https://git.kernel.org/stable/c/8729dc4eeb502145418db5f2ca2192fd26f3efda","tags":["web"]},{"url":"https://git.kernel.org/stable/c/80555adb5c892f0e21d243ae96ed997ee520aea9","tags":["Patch","web","report"]},{"url":"https://git.kernel.org/stable/c/fcb5718ebfe7fd64144e3399280440cce361a3ae","tags":["Patch","web","report"]},{"url":"https://git.kernel.org/stable/c/84bf1ac85af84d354c7a2fdbdc0d4efc8aaec34b","tags":["Patch","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39948","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-7v58-mp27-j7rx"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-39948","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39948.json","tags":["advisory"]},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-39948","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1566","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57974","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22090","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38491","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38627","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38660","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39764","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39902","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40323","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40329","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68192","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68194","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68204","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68209","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68211","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68231","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68237","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68282","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68293","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68313","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68768","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68785","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68819","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68822","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71065","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71068","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71083","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71084","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71091","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71096","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71097","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71118","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71120","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71129","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71141","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71186","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71220","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71221","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71223","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71225","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71232","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71235","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71236","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22977","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22979","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22984","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22991","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22999","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23003","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23010","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23011","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23021","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23025","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23032","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23038","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23047","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23050","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23054","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23059","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23084","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23085","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23094","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23097","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23110","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23112","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23163","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23179","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23190","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23193","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23205","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23216","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23220","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23228","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1567","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1570","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202521040-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1012628","tags":["report"]},{"url":"https://bugzilla.suse.com/1214954","tags":["report"]},{"url":"https://bugzilla.suse.com/1215143","tags":["report"]},{"url":"https://bugzilla.suse.com/1215199","tags":["report"]},{"url":"https://bugzilla.suse.com/1216396","tags":["report"]},{"url":"https://bugzilla.suse.com/1220419","tags":["report"]},{"url":"https://bugzilla.suse.com/1236743","tags":["report"]},{"url":"https://bugzilla.suse.com/1239206","tags":["report"]},{"url":"https://bugzilla.suse.com/1244939","tags":["report"]},{"url":"https://bugzilla.suse.com/1248211","tags":["report"]},{"url":"https://bugzilla.suse.com/1248230","tags":["report"]},{"url":"https://bugzilla.suse.com/1248517","tags":["report"]},{"url":"https://bugzilla.suse.com/1248630","tags":["report"]},{"url":"https://bugzilla.suse.com/1248754","tags":["report"]},{"url":"https://bugzilla.suse.com/1248886","tags":["report"]},{"url":"https://bugzilla.suse.com/1249161","tags":["report"]},{"url":"https://bugzilla.suse.com/1249182","tags":["report"]},{"url":"https://bugzilla.suse.com/1249224","tags":["report"]},{"url":"https://bugzilla.suse.com/1249286","tags":["report"]},{"url":"https://bugzilla.suse.com/1249302","tags":["report"]},{"url":"https://bugzilla.suse.com/1249317","tags":["report"]},{"url":"https://bugzilla.suse.com/1249319","tags":["report"]},{"url":"https://bugzilla.suse.com/1249320","tags":["report"]},{"url":"https://bugzilla.suse.com/1249512","tags":["report"]},{"url":"https://bugzilla.suse.com/1249595","tags":["report"]},{"url":"https://bugzilla.suse.com/1249608","tags":["report"]},{"url":"https://bugzilla.suse.com/1250032","tags":["report"]},{"url":"https://bugzilla.suse.com/1250119","tags":["report"]},{"url":"https://bugzilla.suse.com/1250202","tags":["report"]},{"url":"https://bugzilla.suse.com/1250205","tags":["report"]},{"url":"https://bugzilla.suse.com/1250237","tags":["report"]},{"url":"https://bugzilla.suse.com/1250274","tags":["report"]},{"url":"https://bugzilla.suse.com/1250296","tags":["report"]},{"url":"https://bugzilla.suse.com/1250379","tags":["report"]},{"url":"https://bugzilla.suse.com/1250400","tags":["report"]},{"url":"https://bugzilla.suse.com/1250455","tags":["report"]},{"url":"https://bugzilla.suse.com/1250491","tags":["report"]},{"url":"https://bugzilla.suse.com/1250519","tags":["report"]},{"url":"https://bugzilla.suse.com/1250650","tags":["report"]},{"url":"https://bugzilla.suse.com/1250702","tags":["report"]},{"url":"https://bugzilla.suse.com/1250704","tags":["report"]},{"url":"https://bugzilla.suse.com/1250721","tags":["report"]},{"url":"https://bugzilla.suse.com/1250742","tags":["report"]},{"url":"https://bugzilla.suse.com/1250946","tags":["report"]},{"url":"https://bugzilla.suse.com/1251024","tags":["report"]},{"url":"https://bugzilla.suse.com/1251027","tags":["report"]},{"url":"https://bugzilla.suse.com/1251028","tags":["report"]},{"url":"https://bugzilla.suse.com/1251031","tags":["report"]},{"url":"https://bugzilla.suse.com/1251035","tags":["report"]},{"url":"https://bugzilla.suse.com/1251038","tags":["report"]},{"url":"https://bugzilla.suse.com/1251043","tags":["report"]},{"url":"https://bugzilla.suse.com/1251045","tags":["report"]},{"url":"https://bugzilla.suse.com/1251052","tags":["report"]},{"url":"https://bugzilla.suse.com/1251053","tags":["report"]},{"url":"https://bugzilla.suse.com/1251054","tags":["report"]},{"url":"https://bugzilla.suse.com/1251056","tags":["report"]},{"url":"https://bugzilla.suse.com/1251057","tags":["report"]},{"url":"https://bugzilla.suse.com/1251059","tags":["report"]},{"url":"https://bugzilla.suse.com/1251060","tags":["report"]},{"url":"https://bugzilla.suse.com/1251065","tags":["report"]},{"url":"https://bugzilla.suse.com/1251066","tags":["report"]},{"url":"https://bugzilla.suse.com/1251067","tags":["report"]},{"url":"https://bugzilla.suse.com/1251068","tags":["report"]},{"url":"https://bugzilla.suse.com/1251071","tags":["report"]},{"url":"https://bugzilla.suse.com/1251076","tags":["report"]},{"url":"https://bugzilla.suse.com/1251079","tags":["report"]},{"url":"https://bugzilla.suse.com/1251081","tags":["report"]},{"url":"https://bugzilla.suse.com/1251083","tags":["report"]},{"url":"https://bugzilla.suse.com/1251084","tags":["report"]},{"url":"https://bugzilla.suse.com/1251100","tags":["report"]},{"url":"https://bugzilla.suse.com/1251105","tags":["report"]},{"url":"https://bugzilla.suse.com/1251106","tags":["report"]},{"url":"https://bugzilla.suse.com/1251108","tags":["report"]},{"url":"https://bugzilla.suse.com/1251113","tags":["report"]},{"url":"https://bugzilla.suse.com/1251114","tags":["report"]},{"url":"https://bugzilla.suse.com/1251119","tags":["report"]},{"url":"https://bugzilla.suse.com/1251123","tags":["report"]},{"url":"https://bugzilla.suse.com/1251126","tags":["report"]},{"url":"https://bugzilla.suse.com/1251132","tags":["report"]},{"url":"https://bugzilla.suse.com/1251134","tags":["report"]},{"url":"https://bugzilla.suse.com/1251143","tags":["report"]},{"url":"https://bugzilla.suse.com/1251146","tags":["report"]},{"url":"https://bugzilla.suse.com/1251150","tags":["report"]},{"url":"https://bugzilla.suse.com/1251152","tags":["report"]},{"url":"https://bugzilla.suse.com/1251153","tags":["report"]},{"url":"https://bugzilla.suse.com/1251159","tags":["report"]},{"url":"https://bugzilla.suse.com/1251161","tags":["report"]},{"url":"https://bugzilla.suse.com/1251170","tags":["report"]},{"url":"https://bugzilla.suse.com/1251177","tags":["report"]},{"url":"https://bugzilla.suse.com/1251180","tags":["report"]},{"url":"https://bugzilla.suse.com/1251206","tags":["report"]},{"url":"https://bugzilla.suse.com/1251215","tags":["report"]},{"url":"https://bugzilla.suse.com/1251216","tags":["report"]},{"url":"https://bugzilla.suse.com/1251222","tags":["report"]},{"url":"https://bugzilla.suse.com/1251230","tags":["report"]},{"url":"https://bugzilla.suse.com/1251232","tags":["report"]},{"url":"https://bugzilla.suse.com/1251233","tags":["report"]},{"url":"https://bugzilla.suse.com/1251247","tags":["report"]},{"url":"https://bugzilla.suse.com/1251268","tags":["report"]},{"url":"https://bugzilla.suse.com/1251269","tags":["report"]},{"url":"https://bugzilla.suse.com/1251270","tags":["report"]},{"url":"https://bugzilla.suse.com/1251282","tags":["report"]},{"url":"https://bugzilla.suse.com/1251283","tags":["report"]},{"url":"https://bugzilla.suse.com/1251286","tags":["report"]},{"url":"https://bugzilla.suse.com/1251290","tags":["report"]},{"url":"https://bugzilla.suse.com/1251319","tags":["report"]},{"url":"https://bugzilla.suse.com/1251321","tags":["report"]},{"url":"https://bugzilla.suse.com/1251323","tags":["report"]},{"url":"https://bugzilla.suse.com/1251328","tags":["report"]},{"url":"https://bugzilla.suse.com/1251529","tags":["report"]},{"url":"https://bugzilla.suse.com/1251721","tags":["report"]},{"url":"https://bugzilla.suse.com/1251732","tags":["report"]},{"url":"https://bugzilla.suse.com/1251742","tags":["report"]},{"url":"https://bugzilla.suse.com/1251743","tags":["report"]},{"url":"https://bugzilla.suse.com/1251746","tags":["report"]},{"url":"https://bugzilla.suse.com/1251748","tags":["report"]},{"url":"https://bugzilla.suse.com/1251749","tags":["report"]},{"url":"https://bugzilla.suse.com/1251750","tags":["report"]},{"url":"https://bugzilla.suse.com/1251754","tags":["report"]},{"url":"https://bugzilla.suse.com/1251755","tags":["report"]},{"url":"https://bugzilla.suse.com/1251756","tags":["report"]},{"url":"https://bugzilla.suse.com/1251758","tags":["report"]},{"url":"https://bugzilla.suse.com/1251759","tags":["report"]},{"url":"https://bugzilla.suse.com/1251760","tags":["report"]},{"url":"https://bugzilla.suse.com/1251762","tags":["report"]},{"url":"https://bugzilla.suse.com/1251763","tags":["report"]},{"url":"https://bugzilla.suse.com/1251764","tags":["report"]},{"url":"https://bugzilla.suse.com/1251769","tags":["report"]},{"url":"https://bugzilla.suse.com/1251771","tags":["report"]},{"url":"https://bugzilla.suse.com/1251772","tags":["report"]},{"url":"https://bugzilla.suse.com/1251777","tags":["report"]},{"url":"https://bugzilla.suse.com/1251780","tags":["report"]},{"url":"https://bugzilla.suse.com/1251804","tags":["report"]},{"url":"https://bugzilla.suse.com/1251810","tags":["report"]},{"url":"https://bugzilla.suse.com/1251930","tags":["report"]},{"url":"https://bugzilla.suse.com/1251967","tags":["report"]},{"url":"https://bugzilla.suse.com/1252033","tags":["report"]},{"url":"https://bugzilla.suse.com/1252035","tags":["report"]},{"url":"https://bugzilla.suse.com/1252039","tags":["report"]},{"url":"https://bugzilla.suse.com/1252044","tags":["report"]},{"url":"https://bugzilla.suse.com/1252047","tags":["report"]},{"url":"https://bugzilla.suse.com/1252051","tags":["report"]},{"url":"https://bugzilla.suse.com/1252052","tags":["report"]},{"url":"https://bugzilla.suse.com/1252056","tags":["report"]},{"url":"https://bugzilla.suse.com/1252060","tags":["report"]},{"url":"https://bugzilla.suse.com/1252062","tags":["report"]},{"url":"https://bugzilla.suse.com/1252064","tags":["report"]},{"url":"https://bugzilla.suse.com/1252065","tags":["report"]},{"url":"https://bugzilla.suse.com/1252069","tags":["report"]},{"url":"https://bugzilla.suse.com/1252070","tags":["report"]},{"url":"https://bugzilla.suse.com/1252072","tags":["report"]},{"url":"https://bugzilla.suse.com/1252074","tags":["report"]},{"url":"https://bugzilla.suse.com/1252075","tags":["report"]},{"url":"https://bugzilla.suse.com/1252078","tags":["report"]},{"url":"https://bugzilla.suse.com/1252079","tags":["report"]},{"url":"https://bugzilla.suse.com/1252082","tags":["report"]},{"url":"https://bugzilla.suse.com/1252083","tags":["report"]},{"url":"https://bugzilla.suse.com/1252265","tags":["report"]},{"url":"https://bugzilla.suse.com/1252269","tags":["report"]},{"url":"https://bugzilla.suse.com/1252332","tags":["report"]},{"url":"https://bugzilla.suse.com/1252336","tags":["report"]},{"url":"https://bugzilla.suse.com/1252346","tags":["report"]},{"url":"https://bugzilla.suse.com/1252348","tags":["report"]},{"url":"https://bugzilla.suse.com/1252349","tags":["report"]},{"url":"https://bugzilla.suse.com/1252364","tags":["report"]},{"url":"https://bugzilla.suse.com/1252479","tags":["report"]},{"url":"https://bugzilla.suse.com/1252481","tags":["report"]},{"url":"https://bugzilla.suse.com/1252489","tags":["report"]},{"url":"https://bugzilla.suse.com/1252490","tags":["report"]},{"url":"https://bugzilla.suse.com/1252492","tags":["report"]},{"url":"https://bugzilla.suse.com/1252495","tags":["report"]},{"url":"https://bugzilla.suse.com/1252496","tags":["report"]},{"url":"https://bugzilla.suse.com/1252499","tags":["report"]},{"url":"https://bugzilla.suse.com/1252534","tags":["report"]},{"url":"https://bugzilla.suse.com/1252536","tags":["report"]},{"url":"https://bugzilla.suse.com/1252537","tags":["report"]},{"url":"https://bugzilla.suse.com/1252550","tags":["report"]},{"url":"https://bugzilla.suse.com/1252553","tags":["report"]},{"url":"https://bugzilla.suse.com/1252559","tags":["report"]},{"url":"https://bugzilla.suse.com/1252561","tags":["report"]},{"url":"https://bugzilla.suse.com/1252564","tags":["report"]},{"url":"https://bugzilla.suse.com/1252565","tags":["report"]},{"url":"https://bugzilla.suse.com/1252566","tags":["report"]},{"url":"https://bugzilla.suse.com/1252632","tags":["report"]},{"url":"https://bugzilla.suse.com/1252668","tags":["report"]},{"url":"https://bugzilla.suse.com/1252678","tags":["report"]},{"url":"https://bugzilla.suse.com/1252679","tags":["report"]},{"url":"https://bugzilla.suse.com/1252685","tags":["report"]},{"url":"https://bugzilla.suse.com/1252688","tags":["report"]},{"url":"https://bugzilla.suse.com/1252772","tags":["report"]},{"url":"https://bugzilla.suse.com/1252774","tags":["report"]},{"url":"https://bugzilla.suse.com/1252775","tags":["report"]},{"url":"https://bugzilla.suse.com/1252785","tags":["report"]},{"url":"https://bugzilla.suse.com/1252787","tags":["report"]},{"url":"https://bugzilla.suse.com/1252789","tags":["report"]},{"url":"https://bugzilla.suse.com/1252797","tags":["report"]},{"url":"https://bugzilla.suse.com/1252822","tags":["report"]},{"url":"https://bugzilla.suse.com/1252826","tags":["report"]},{"url":"https://bugzilla.suse.com/1252841","tags":["report"]},{"url":"https://bugzilla.suse.com/1252848","tags":["report"]},{"url":"https://bugzilla.suse.com/1252849","tags":["report"]},{"url":"https://bugzilla.suse.com/1252850","tags":["report"]},{"url":"https://bugzilla.suse.com/1252851","tags":["report"]},{"url":"https://bugzilla.suse.com/1252854","tags":["report"]},{"url":"https://bugzilla.suse.com/1252858","tags":["report"]},{"url":"https://bugzilla.suse.com/1252865","tags":["report"]},{"url":"https://bugzilla.suse.com/1252866","tags":["report"]},{"url":"https://bugzilla.suse.com/1252873","tags":["report"]},{"url":"https://bugzilla.suse.com/1252902","tags":["report"]},{"url":"https://bugzilla.suse.com/1252904","tags":["report"]},{"url":"https://bugzilla.suse.com/1252909","tags":["report"]},{"url":"https://bugzilla.suse.com/1252918","tags":["report"]},{"url":"https://bugzilla.suse.com/1252939","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53540","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53541","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53543","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53546","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53548","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53552","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53554","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53559","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53560","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53568","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53570","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53574","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53575","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53577","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53579","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53581","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53583","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53585","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53588","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53593","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53596","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53599","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53611","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53631","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53633","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53638","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53645","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53646","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53647","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53648","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53649","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53652","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53653","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53654","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53656","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53657","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53658","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53659","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53666","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53668","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53670","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53672","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53687","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53693","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53697","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53698","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53707","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53711","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53726","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53730","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53731","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38008","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38552","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38653","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38700","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39676","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39683","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39697","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39756","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39797","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39841","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39876","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39881","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39949","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39967","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39968","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39971","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39985","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39993","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39994","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40010","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40035","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40060","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40062","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40071","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40078","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40082","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40087","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40096","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40100","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202521052-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1246244","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202521056-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202521064-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202521080-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1218644","tags":["report"]},{"url":"https://bugzilla.suse.com/1238472","tags":["report"]},{"url":"https://bugzilla.suse.com/1241166","tags":["report"]},{"url":"https://bugzilla.suse.com/1241637","tags":["report"]},{"url":"https://bugzilla.suse.com/1247222","tags":["report"]},{"url":"https://bugzilla.suse.com/1249226","tags":["report"]},{"url":"https://bugzilla.suse.com/1249397","tags":["report"]},{"url":"https://bugzilla.suse.com/1249398","tags":["report"]},{"url":"https://bugzilla.suse.com/1249495","tags":["report"]},{"url":"https://bugzilla.suse.com/1249735","tags":["report"]},{"url":"https://bugzilla.suse.com/1250749","tags":["report"]},{"url":"https://bugzilla.suse.com/1251176","tags":["report"]},{"url":"https://bugzilla.suse.com/1251809","tags":["report"]},{"url":"https://bugzilla.suse.com/1251819","tags":["report"]},{"url":"https://bugzilla.suse.com/1252067","tags":["report"]},{"url":"https://bugzilla.suse.com/1252076","tags":["report"]},{"url":"https://bugzilla.suse.com/1252081","tags":["report"]},{"url":"https://bugzilla.suse.com/1252253","tags":["report"]},{"url":"https://bugzilla.suse.com/1252267","tags":["report"]},{"url":"https://bugzilla.suse.com/1252270","tags":["report"]},{"url":"https://bugzilla.suse.com/1252330","tags":["report"]},{"url":"https://bugzilla.suse.com/1252333","tags":["report"]},{"url":"https://bugzilla.suse.com/1252725","tags":["report"]},{"url":"https://bugzilla.suse.com/1252734","tags":["report"]},{"url":"https://bugzilla.suse.com/1252780","tags":["report"]},{"url":"https://bugzilla.suse.com/1252819","tags":["report"]},{"url":"https://bugzilla.suse.com/1252862","tags":["report"]},{"url":"https://bugzilla.suse.com/1252915","tags":["report"]},{"url":"https://bugzilla.suse.com/1252921","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39979","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39992","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40009","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40012","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40048","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40364","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202521147-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202521180-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20254057-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1194869","tags":["report"]},{"url":"https://bugzilla.suse.com/1213061","tags":["report"]},{"url":"https://bugzilla.suse.com/1213666","tags":["report"]},{"url":"https://bugzilla.suse.com/1214073","tags":["report"]},{"url":"https://bugzilla.suse.com/1214928","tags":["report"]},{"url":"https://bugzilla.suse.com/1214953","tags":["report"]},{"url":"https://bugzilla.suse.com/1215150","tags":["report"]},{"url":"https://bugzilla.suse.com/1215696","tags":["report"]},{"url":"https://bugzilla.suse.com/1216436","tags":["report"]},{"url":"https://bugzilla.suse.com/1216976","tags":["report"]},{"url":"https://bugzilla.suse.com/1220186","tags":["report"]},{"url":"https://bugzilla.suse.com/1229165","tags":["report"]},{"url":"https://bugzilla.suse.com/1243100","tags":["report"]},{"url":"https://bugzilla.suse.com/1243112","tags":["report"]},{"url":"https://bugzilla.suse.com/1245193","tags":["report"]},{"url":"https://bugzilla.suse.com/1245260","tags":["report"]},{"url":"https://bugzilla.suse.com/1246125","tags":["report"]},{"url":"https://bugzilla.suse.com/1247118","tags":["report"]},{"url":"https://bugzilla.suse.com/1247500","tags":["report"]},{"url":"https://bugzilla.suse.com/1247683","tags":["report"]},{"url":"https://bugzilla.suse.com/1248111","tags":["report"]},{"url":"https://bugzilla.suse.com/1248735","tags":["report"]},{"url":"https://bugzilla.suse.com/1248847","tags":["report"]},{"url":"https://bugzilla.suse.com/1249123","tags":["report"]},{"url":"https://bugzilla.suse.com/1249159","tags":["report"]},{"url":"https://bugzilla.suse.com/1249164","tags":["report"]},{"url":"https://bugzilla.suse.com/1249166","tags":["report"]},{"url":"https://bugzilla.suse.com/1249169","tags":["report"]},{"url":"https://bugzilla.suse.com/1249170","tags":["report"]},{"url":"https://bugzilla.suse.com/1249177","tags":["report"]},{"url":"https://bugzilla.suse.com/1249190","tags":["report"]},{"url":"https://bugzilla.suse.com/1249194","tags":["report"]},{"url":"https://bugzilla.suse.com/1249195","tags":["report"]},{"url":"https://bugzilla.suse.com/1249196","tags":["report"]},{"url":"https://bugzilla.suse.com/1249200","tags":["report"]},{"url":"https://bugzilla.suse.com/1249203","tags":["report"]},{"url":"https://bugzilla.suse.com/1249204","tags":["report"]},{"url":"https://bugzilla.suse.com/1249215","tags":["report"]},{"url":"https://bugzilla.suse.com/1249220","tags":["report"]},{"url":"https://bugzilla.suse.com/1249221","tags":["report"]},{"url":"https://bugzilla.suse.com/1249254","tags":["report"]},{"url":"https://bugzilla.suse.com/1249255","tags":["report"]},{"url":"https://bugzilla.suse.com/1249257","tags":["report"]},{"url":"https://bugzilla.suse.com/1249260","tags":["report"]},{"url":"https://bugzilla.suse.com/1249263","tags":["report"]},{"url":"https://bugzilla.suse.com/1249265","tags":["report"]},{"url":"https://bugzilla.suse.com/1249266","tags":["report"]},{"url":"https://bugzilla.suse.com/1249271","tags":["report"]},{"url":"https://bugzilla.suse.com/1249272","tags":["report"]},{"url":"https://bugzilla.suse.com/1249273","tags":["report"]},{"url":"https://bugzilla.suse.com/1249278","tags":["report"]},{"url":"https://bugzilla.suse.com/1249279","tags":["report"]},{"url":"https://bugzilla.suse.com/1249281","tags":["report"]},{"url":"https://bugzilla.suse.com/1249282","tags":["report"]},{"url":"https://bugzilla.suse.com/1249285","tags":["report"]},{"url":"https://bugzilla.suse.com/1249288","tags":["report"]},{"url":"https://bugzilla.suse.com/1249292","tags":["report"]},{"url":"https://bugzilla.suse.com/1249296","tags":["report"]},{"url":"https://bugzilla.suse.com/1249299","tags":["report"]},{"url":"https://bugzilla.suse.com/1249304","tags":["report"]},{"url":"https://bugzilla.suse.com/1249308","tags":["report"]},{"url":"https://bugzilla.suse.com/1249312","tags":["report"]},{"url":"https://bugzilla.suse.com/1249318","tags":["report"]},{"url":"https://bugzilla.suse.com/1249321","tags":["report"]},{"url":"https://bugzilla.suse.com/1249323","tags":["report"]},{"url":"https://bugzilla.suse.com/1249324","tags":["report"]},{"url":"https://bugzilla.suse.com/1249338","tags":["report"]},{"url":"https://bugzilla.suse.com/1249413","tags":["report"]},{"url":"https://bugzilla.suse.com/1249479","tags":["report"]},{"url":"https://bugzilla.suse.com/1249486","tags":["report"]},{"url":"https://bugzilla.suse.com/1249489","tags":["report"]},{"url":"https://bugzilla.suse.com/1249490","tags":["report"]},{"url":"https://bugzilla.suse.com/1249506","tags":["report"]},{"url":"https://bugzilla.suse.com/1249515","tags":["report"]},{"url":"https://bugzilla.suse.com/1249522","tags":["report"]},{"url":"https://bugzilla.suse.com/1249523","tags":["report"]},{"url":"https://bugzilla.suse.com/1249538","tags":["report"]},{"url":"https://bugzilla.suse.com/1249542","tags":["report"]},{"url":"https://bugzilla.suse.com/1249548","tags":["report"]},{"url":"https://bugzilla.suse.com/1249554","tags":["report"]},{"url":"https://bugzilla.suse.com/1249598","tags":["report"]},{"url":"https://bugzilla.suse.com/1249615","tags":["report"]},{"url":"https://bugzilla.suse.com/1249640","tags":["report"]},{"url":"https://bugzilla.suse.com/1249641","tags":["report"]},{"url":"https://bugzilla.suse.com/1249642","tags":["report"]},{"url":"https://bugzilla.suse.com/1249658","tags":["report"]},{"url":"https://bugzilla.suse.com/1249662","tags":["report"]},{"url":"https://bugzilla.suse.com/1249672","tags":["report"]},{"url":"https://bugzilla.suse.com/1249673","tags":["report"]},{"url":"https://bugzilla.suse.com/1249677","tags":["report"]},{"url":"https://bugzilla.suse.com/1249678","tags":["report"]},{"url":"https://bugzilla.suse.com/1249679","tags":["report"]},{"url":"https://bugzilla.suse.com/1249682","tags":["report"]},{"url":"https://bugzilla.suse.com/1249687","tags":["report"]},{"url":"https://bugzilla.suse.com/1249698","tags":["report"]},{"url":"https://bugzilla.suse.com/1249707","tags":["report"]},{"url":"https://bugzilla.suse.com/1249712","tags":["report"]},{"url":"https://bugzilla.suse.com/1249730","tags":["report"]},{"url":"https://bugzilla.suse.com/1249756","tags":["report"]},{"url":"https://bugzilla.suse.com/1249758","tags":["report"]},{"url":"https://bugzilla.suse.com/1249761","tags":["report"]},{"url":"https://bugzilla.suse.com/1249762","tags":["report"]},{"url":"https://bugzilla.suse.com/1249768","tags":["report"]},{"url":"https://bugzilla.suse.com/1249774","tags":["report"]},{"url":"https://bugzilla.suse.com/1249779","tags":["report"]},{"url":"https://bugzilla.suse.com/1249780","tags":["report"]},{"url":"https://bugzilla.suse.com/1249785","tags":["report"]},{"url":"https://bugzilla.suse.com/1249787","tags":["report"]},{"url":"https://bugzilla.suse.com/1249795","tags":["report"]},{"url":"https://bugzilla.suse.com/1249815","tags":["report"]},{"url":"https://bugzilla.suse.com/1249820","tags":["report"]},{"url":"https://bugzilla.suse.com/1249823","tags":["report"]},{"url":"https://bugzilla.suse.com/1249824","tags":["report"]},{"url":"https://bugzilla.suse.com/1249825","tags":["report"]},{"url":"https://bugzilla.suse.com/1249826","tags":["report"]},{"url":"https://bugzilla.suse.com/1249833","tags":["report"]},{"url":"https://bugzilla.suse.com/1249842","tags":["report"]},{"url":"https://bugzilla.suse.com/1249845","tags":["report"]},{"url":"https://bugzilla.suse.com/1249849","tags":["report"]},{"url":"https://bugzilla.suse.com/1249850","tags":["report"]},{"url":"https://bugzilla.suse.com/1249853","tags":["report"]},{"url":"https://bugzilla.suse.com/1249856","tags":["report"]},{"url":"https://bugzilla.suse.com/1249861","tags":["report"]},{"url":"https://bugzilla.suse.com/1249863","tags":["report"]},{"url":"https://bugzilla.suse.com/1249864","tags":["report"]},{"url":"https://bugzilla.suse.com/1249865","tags":["report"]},{"url":"https://bugzilla.suse.com/1249866","tags":["report"]},{"url":"https://bugzilla.suse.com/1249869","tags":["report"]},{"url":"https://bugzilla.suse.com/1249870","tags":["report"]},{"url":"https://bugzilla.suse.com/1249880","tags":["report"]},{"url":"https://bugzilla.suse.com/1249883","tags":["report"]},{"url":"https://bugzilla.suse.com/1249888","tags":["report"]},{"url":"https://bugzilla.suse.com/1249894","tags":["report"]},{"url":"https://bugzilla.suse.com/1249896","tags":["report"]},{"url":"https://bugzilla.suse.com/1249897","tags":["report"]},{"url":"https://bugzilla.suse.com/1249901","tags":["report"]},{"url":"https://bugzilla.suse.com/1249911","tags":["report"]},{"url":"https://bugzilla.suse.com/1249917","tags":["report"]},{"url":"https://bugzilla.suse.com/1249919","tags":["report"]},{"url":"https://bugzilla.suse.com/1249923","tags":["report"]},{"url":"https://bugzilla.suse.com/1249926","tags":["report"]},{"url":"https://bugzilla.suse.com/1249938","tags":["report"]},{"url":"https://bugzilla.suse.com/1249949","tags":["report"]},{"url":"https://bugzilla.suse.com/1249950","tags":["report"]},{"url":"https://bugzilla.suse.com/1249952","tags":["report"]},{"url":"https://bugzilla.suse.com/1249975","tags":["report"]},{"url":"https://bugzilla.suse.com/1249979","tags":["report"]},{"url":"https://bugzilla.suse.com/1249984","tags":["report"]},{"url":"https://bugzilla.suse.com/1249988","tags":["report"]},{"url":"https://bugzilla.suse.com/1249990","tags":["report"]},{"url":"https://bugzilla.suse.com/1249993","tags":["report"]},{"url":"https://bugzilla.suse.com/1249994","tags":["report"]},{"url":"https://bugzilla.suse.com/1249997","tags":["report"]},{"url":"https://bugzilla.suse.com/1250004","tags":["report"]},{"url":"https://bugzilla.suse.com/1250006","tags":["report"]},{"url":"https://bugzilla.suse.com/1250007","tags":["report"]},{"url":"https://bugzilla.suse.com/1250012","tags":["report"]},{"url":"https://bugzilla.suse.com/1250022","tags":["report"]},{"url":"https://bugzilla.suse.com/1250024","tags":["report"]},{"url":"https://bugzilla.suse.com/1250028","tags":["report"]},{"url":"https://bugzilla.suse.com/1250029","tags":["report"]},{"url":"https://bugzilla.suse.com/1250035","tags":["report"]},{"url":"https://bugzilla.suse.com/1250049","tags":["report"]},{"url":"https://bugzilla.suse.com/1250055","tags":["report"]},{"url":"https://bugzilla.suse.com/1250058","tags":["report"]},{"url":"https://bugzilla.suse.com/1250062","tags":["report"]},{"url":"https://bugzilla.suse.com/1250063","tags":["report"]},{"url":"https://bugzilla.suse.com/1250065","tags":["report"]},{"url":"https://bugzilla.suse.com/1250066","tags":["report"]},{"url":"https://bugzilla.suse.com/1250067","tags":["report"]},{"url":"https://bugzilla.suse.com/1250069","tags":["report"]},{"url":"https://bugzilla.suse.com/1250070","tags":["report"]},{"url":"https://bugzilla.suse.com/1250073","tags":["report"]},{"url":"https://bugzilla.suse.com/1250074","tags":["report"]},{"url":"https://bugzilla.suse.com/1250088","tags":["report"]},{"url":"https://bugzilla.suse.com/1250089","tags":["report"]},{"url":"https://bugzilla.suse.com/1250106","tags":["report"]},{"url":"https://bugzilla.suse.com/1250112","tags":["report"]},{"url":"https://bugzilla.suse.com/1250117","tags":["report"]},{"url":"https://bugzilla.suse.com/1250120","tags":["report"]},{"url":"https://bugzilla.suse.com/1250125","tags":["report"]},{"url":"https://bugzilla.suse.com/1250127","tags":["report"]},{"url":"https://bugzilla.suse.com/1250128","tags":["report"]},{"url":"https://bugzilla.suse.com/1250145","tags":["report"]},{"url":"https://bugzilla.suse.com/1250150","tags":["report"]},{"url":"https://bugzilla.suse.com/1250156","tags":["report"]},{"url":"https://bugzilla.suse.com/1250157","tags":["report"]},{"url":"https://bugzilla.suse.com/1250161","tags":["report"]},{"url":"https://bugzilla.suse.com/1250163","tags":["report"]},{"url":"https://bugzilla.suse.com/1250166","tags":["report"]},{"url":"https://bugzilla.suse.com/1250167","tags":["report"]},{"url":"https://bugzilla.suse.com/1250169","tags":["report"]},{"url":"https://bugzilla.suse.com/1250171","tags":["report"]},{"url":"https://bugzilla.suse.com/1250177","tags":["report"]},{"url":"https://bugzilla.suse.com/1250180","tags":["report"]},{"url":"https://bugzilla.suse.com/1250186","tags":["report"]},{"url":"https://bugzilla.suse.com/1250196","tags":["report"]},{"url":"https://bugzilla.suse.com/1250198","tags":["report"]},{"url":"https://bugzilla.suse.com/1250199","tags":["report"]},{"url":"https://bugzilla.suse.com/1250201","tags":["report"]},{"url":"https://bugzilla.suse.com/1250203","tags":["report"]},{"url":"https://bugzilla.suse.com/1250204","tags":["report"]},{"url":"https://bugzilla.suse.com/1250206","tags":["report"]},{"url":"https://bugzilla.suse.com/1250208","tags":["report"]},{"url":"https://bugzilla.suse.com/1250241","tags":["report"]},{"url":"https://bugzilla.suse.com/1250242","tags":["report"]},{"url":"https://bugzilla.suse.com/1250243","tags":["report"]},{"url":"https://bugzilla.suse.com/1250247","tags":["report"]},{"url":"https://bugzilla.suse.com/1250249","tags":["report"]},{"url":"https://bugzilla.suse.com/1250262","tags":["report"]},{"url":"https://bugzilla.suse.com/1250263","tags":["report"]},{"url":"https://bugzilla.suse.com/1250266","tags":["report"]},{"url":"https://bugzilla.suse.com/1250268","tags":["report"]},{"url":"https://bugzilla.suse.com/1250275","tags":["report"]},{"url":"https://bugzilla.suse.com/1250276","tags":["report"]},{"url":"https://bugzilla.suse.com/1250281","tags":["report"]},{"url":"https://bugzilla.suse.com/1250290","tags":["report"]},{"url":"https://bugzilla.suse.com/1250291","tags":["report"]},{"url":"https://bugzilla.suse.com/1250292","tags":["report"]},{"url":"https://bugzilla.suse.com/1250297","tags":["report"]},{"url":"https://bugzilla.suse.com/1250298","tags":["report"]},{"url":"https://bugzilla.suse.com/1250313","tags":["report"]},{"url":"https://bugzilla.suse.com/1250319","tags":["report"]},{"url":"https://bugzilla.suse.com/1250323","tags":["report"]},{"url":"https://bugzilla.suse.com/1250325","tags":["report"]},{"url":"https://bugzilla.suse.com/1250329","tags":["report"]},{"url":"https://bugzilla.suse.com/1250337","tags":["report"]},{"url":"https://bugzilla.suse.com/1250358","tags":["report"]},{"url":"https://bugzilla.suse.com/1250371","tags":["report"]},{"url":"https://bugzilla.suse.com/1250377","tags":["report"]},{"url":"https://bugzilla.suse.com/1250384","tags":["report"]},{"url":"https://bugzilla.suse.com/1250389","tags":["report"]},{"url":"https://bugzilla.suse.com/1250395","tags":["report"]},{"url":"https://bugzilla.suse.com/1250397","tags":["report"]},{"url":"https://bugzilla.suse.com/1250402","tags":["report"]},{"url":"https://bugzilla.suse.com/1250406","tags":["report"]},{"url":"https://bugzilla.suse.com/1250426","tags":["report"]},{"url":"https://bugzilla.suse.com/1250450","tags":["report"]},{"url":"https://bugzilla.suse.com/1250459","tags":["report"]},{"url":"https://bugzilla.suse.com/1250712","tags":["report"]},{"url":"https://bugzilla.suse.com/1250713","tags":["report"]},{"url":"https://bugzilla.suse.com/1250732","tags":["report"]},{"url":"https://bugzilla.suse.com/1250736","tags":["report"]},{"url":"https://bugzilla.suse.com/1250741","tags":["report"]},{"url":"https://bugzilla.suse.com/1250758","tags":["report"]},{"url":"https://bugzilla.suse.com/1250759","tags":["report"]},{"url":"https://bugzilla.suse.com/1250763","tags":["report"]},{"url":"https://bugzilla.suse.com/1250765","tags":["report"]},{"url":"https://bugzilla.suse.com/1250807","tags":["report"]},{"url":"https://bugzilla.suse.com/1250808","tags":["report"]},{"url":"https://bugzilla.suse.com/1250809","tags":["report"]},{"url":"https://bugzilla.suse.com/1250812","tags":["report"]},{"url":"https://bugzilla.suse.com/1250813","tags":["report"]},{"url":"https://bugzilla.suse.com/1250815","tags":["report"]},{"url":"https://bugzilla.suse.com/1250816","tags":["report"]},{"url":"https://bugzilla.suse.com/1250820","tags":["report"]},{"url":"https://bugzilla.suse.com/1250823","tags":["report"]},{"url":"https://bugzilla.suse.com/1250825","tags":["report"]},{"url":"https://bugzilla.suse.com/1250827","tags":["report"]},{"url":"https://bugzilla.suse.com/1250830","tags":["report"]},{"url":"https://bugzilla.suse.com/1250831","tags":["report"]},{"url":"https://bugzilla.suse.com/1250837","tags":["report"]},{"url":"https://bugzilla.suse.com/1250841","tags":["report"]},{"url":"https://bugzilla.suse.com/1250861","tags":["report"]},{"url":"https://bugzilla.suse.com/1250863","tags":["report"]},{"url":"https://bugzilla.suse.com/1250867","tags":["report"]},{"url":"https://bugzilla.suse.com/1250872","tags":["report"]},{"url":"https://bugzilla.suse.com/1250873","tags":["report"]},{"url":"https://bugzilla.suse.com/1250878","tags":["report"]},{"url":"https://bugzilla.suse.com/1250905","tags":["report"]},{"url":"https://bugzilla.suse.com/1250907","tags":["report"]},{"url":"https://bugzilla.suse.com/1250917","tags":["report"]},{"url":"https://bugzilla.suse.com/1250918","tags":["report"]},{"url":"https://bugzilla.suse.com/1250923","tags":["report"]},{"url":"https://bugzilla.suse.com/1250926","tags":["report"]},{"url":"https://bugzilla.suse.com/1250928","tags":["report"]},{"url":"https://bugzilla.suse.com/1250929","tags":["report"]},{"url":"https://bugzilla.suse.com/1250930","tags":["report"]},{"url":"https://bugzilla.suse.com/1250931","tags":["report"]},{"url":"https://bugzilla.suse.com/1250941","tags":["report"]},{"url":"https://bugzilla.suse.com/1250942","tags":["report"]},{"url":"https://bugzilla.suse.com/1250949","tags":["report"]},{"url":"https://bugzilla.suse.com/1250957","tags":["report"]},{"url":"https://bugzilla.suse.com/1250964","tags":["report"]},{"url":"https://bugzilla.suse.com/1252236","tags":["report"]},{"url":"https://bugzilla.suse.com/1252469","tags":["report"]},{"url":"https://bugzilla.suse.com/1252735","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-31248","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-3772","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-42753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53147","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53152","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53165","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53170","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53175","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53192","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53201","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53208","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53215","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53220","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53226","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53230","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53235","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53248","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53249","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53251","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53255","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53258","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53260","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53272","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53274","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53275","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53280","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53305","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53309","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53311","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53314","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53319","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53321","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53322","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53324","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53331","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53333","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53342","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53343","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53352","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53364","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53365","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53367","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53368","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53369","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53370","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53371","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53394","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53395","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53397","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53420","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53424","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53428","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53438","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53442","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53444","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53451","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53457","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53461","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53462","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53463","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53472","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53480","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53485","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53488","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53490","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53491","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53492","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53493","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53501","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53504","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53510","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53515","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53516","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53519","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53520","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53528","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53530","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53531","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26584","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-58240","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38683","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38685","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38687","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38691","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38692","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38693","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38694","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38695","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38697","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38698","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38724","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38734","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38735","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39675","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39684","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39685","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39693","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39694","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39709","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39724","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39726","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39730","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39742","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39757","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39758","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39759","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39760","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39772","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39790","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39801","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39808","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39810","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39826","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39827","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39844","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39849","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39850","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39920","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39923","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39925","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20254128-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20254132-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20254140-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20254141-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20254301-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620561-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-39948","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-39948","tags":["report"]},{"url":"https://git.kernel.org/linus/84bf1ac85af84d354c7a2fdbdc0d4efc8aaec34b","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8095-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8100-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8095-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8095-3","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8095-4","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8125-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8126-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8095-5","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8165-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8261-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-21833","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22103","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22105","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22106","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22107","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22113","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22121","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22124","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22125","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23129","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23130","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23133","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23143","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37860","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38105","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38502","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38556","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38627","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38643","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38709","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39678","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39697","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39805","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39806","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39807","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39808","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39810","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39811","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39812","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39813","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39815","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39817","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39819","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39823","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39824","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39825","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39826","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39827","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39828","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39829","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39832","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39835","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39836","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39838","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39839","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39841","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39842","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39843","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39844","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39845","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39846","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39847","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39848","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39849","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39850","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39851","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39852","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39853","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39854","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39857","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39860","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39861","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39863","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39864","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39865","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39866","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39869","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39870","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39871","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39873","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39876","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39877","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39880","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39881","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39883","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39885","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39886","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39891","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39894","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39895","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39897","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39899","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39901","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39902","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39907","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39909","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39911","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39913","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39914","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39916","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39920","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39923","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39927","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39929","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39931","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39932","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39934","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39937","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39938","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39940","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39942","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39943","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39944","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39945","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39947","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39949","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39950","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39951","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39952","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39953","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39955","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39957","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39961","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39965","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39967","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39968","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39969","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39970","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39971","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39972","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39973","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39977","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39978","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39980","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39981","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39982","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39985","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39986","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39987","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39988","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39991","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39992","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39994","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39995","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39996","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39998","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40000","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40001","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40006","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40008","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40009","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40010","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40011","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40013","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40016","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40020","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40021","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40024","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40026","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40027","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40029","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40030","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40031","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40032","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40033","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40035","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40036","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40037","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40038","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40042","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40043","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40044","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40047","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40048","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40049","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40051","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40052","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40053","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40055","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40056","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40057","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40058","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40059","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40060","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40061","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40062","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40067","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40068","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40070","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40071","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40077","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40078","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40079","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40080","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40081","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40083","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40084","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40085","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40087","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40088","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40092","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40093","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40094","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40095","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40096","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40099","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40100","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40101","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40103","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40104","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40105","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40106","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40107","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40109","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40110","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40111","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40112","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40115","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40116","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40118","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40120","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40121","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40123","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40124","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40125","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40126","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40127","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40129","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40134","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40137","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40140","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40141","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40153","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40154","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40155","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40156","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40159","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40160","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40165","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40166","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40167","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40169","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40171","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40172","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40173","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40176","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40178","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40179","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40180","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40183","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40187","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40188","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40192","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40193","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40194","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40196","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40198","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40200","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40201","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40204","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40205","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40206","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40207","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40211","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40218","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40219","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40220","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40221","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40223","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40226","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40231","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40233","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40235","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40237","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40238","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40240","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40242","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40243","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40244","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40245","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40248","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40250","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40251","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40252","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40253","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40254","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40257","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40258","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40259","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40261","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40262","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40263","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40264","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40266","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40268","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40269","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40271","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40272","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40273","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40275","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40277","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40278","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40279","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40280","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40281","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40282","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40283","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40284","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40285","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40286","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40287","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40288","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40289","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40292","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40293","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40294","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40301","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40303","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40304","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40305","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40306","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40307","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40308","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40309","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40310","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40311","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40312","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40313","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40314","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40315","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40317","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40318","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40319","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40320","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40321","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40322","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40323","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40324","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40328","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40329","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40331","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40333","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40337","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40339","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40341","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40342","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40343","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40345","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40346","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40347","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40349","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40350","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40351","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40353","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40358","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40360","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40363","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68168","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68171","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68172","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68173","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68176","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68177","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68178","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68179","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68180","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68183","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68184","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68185","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68190","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68191","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68192","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68194","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68198","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68200","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68201","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68204","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68208","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68213","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68214","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68217","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68218","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68219","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68220","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68222","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68223","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68227","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68229","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68231","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68233","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68235","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68237","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68238","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68241","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68244","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68245","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68246","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68249","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68282","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68283","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68284","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68285","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68286","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68287","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68288","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68289","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68290","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68295","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68297","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68301","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68302","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68303","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68305","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68307","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68308","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68310","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68311","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68312","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68313","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68315","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68320","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68321","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68322","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68327","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68328","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68330","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68331","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68339","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68340","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68342","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68343","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68734","tags":["report"]},{"url":"https://launchpad.net/bugs/2143853","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23202","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23207","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22037","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37899","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40202","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-36331","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-36350","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-36357","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21884","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21931","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22026","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22101","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22102","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22115","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22120","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22126","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22128","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23140","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23141","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23142","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23144","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23145","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23146","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23147","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23148","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23149","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23150","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23151","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23155","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23156","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23157","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23158","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23159","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23160","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23161","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23163","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37738","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37739","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37740","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37741","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37742","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37744","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37745","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37748","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37749","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37754","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37755","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37757","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37758","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37759","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37761","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37763","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37764","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37765","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37766","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37767","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37768","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37769","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37770","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37771","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37772","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37773","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37775","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37777","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37778","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37780","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37781","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37784","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37786","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37787","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37788","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37789","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37790","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37792","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37793","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37794","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37796","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37799","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37800","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37801","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37803","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37805","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37808","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37809","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37810","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37811","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37812","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37813","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37815","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37816","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37817","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37819","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37820","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37822","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37823","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37824","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37826","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37827","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37828","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37829","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37830","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37831","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37836","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37839","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37840","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37841","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37842","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37844","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37846","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37849","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37850","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37851","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37852","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37853","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37854","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37856","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37857","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37858","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37859","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37861","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37862","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37863","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37864","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37865","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37867","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37869","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37871","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37872","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37873","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37874","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37875","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37878","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37879","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37881","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37883","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37884","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37885","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37886","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37887","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37891","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37892","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37897","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37900","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37901","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37903","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37905","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37909","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37911","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37912","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37913","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37914","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37915","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37916","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37917","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37918","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37920","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37921","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37922","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37923","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37924","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37925","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37927","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37928","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37930","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37931","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37933","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37935","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37936","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37938","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37940","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37943","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37944","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37945","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37947","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37948","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37949","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37951","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37952","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37956","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37957","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37959","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37960","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37961","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37962","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37963","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37967","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37968","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37969","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37970","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37972","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37973","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37975","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37977","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37978","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37979","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37980","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37982","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37983","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37984","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37985","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37986","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37987","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37988","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37989","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37990","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37991","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37992","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37994","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37995","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37998","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38003","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38004","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38005","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38006","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38007","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38008","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38009","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38010","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38011","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38013","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38014","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38015","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38018","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38019","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38020","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38023","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38024","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38027","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38031","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38034","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38035","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38037","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38039","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38040","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38043","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38044","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38045","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38048","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38051","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38052","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38053","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38055","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38057","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38058","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38059","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38060","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38061","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38062","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38063","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38065","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38066","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38067","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38068","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38071","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38072","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38074","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38075","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38077","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38078","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38079","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38080","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38081","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38084","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38085","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38086","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38087","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38088","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38089","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38090","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38094","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38095","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38097","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38098","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38099","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38100","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38101","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38102","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38103","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38104","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38107","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38108","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38109","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38110","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38111","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38112","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38113","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38115","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38117","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38119","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38120","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38122","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38123","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38124","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38125","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38126","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38127","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38129","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38131","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38135","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38136","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38138","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38142","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38143","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38145","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38146","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38147","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38148","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38149","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38153","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38154","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38155","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38156","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38157","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38158","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38159","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38160","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38161","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38162","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38163","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38164","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38165","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38166","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38167","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38169","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38170","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38173","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38174","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38180","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38181","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38182","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38183","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38184","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38185","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38190","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38191","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38192","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38193","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38194","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38197","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38198","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38200","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38202","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38208","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38210","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38211","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38212","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38214","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38215","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38217","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38218","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38219","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38220","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38222","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38225","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38226","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38229","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38230","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38231","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38232","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38236","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38239","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38245","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38246","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38248","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38249","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38250","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38251","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38253","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38255","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38257","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38258","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38259","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38260","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38262","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38263","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38264","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38265","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38269","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38274","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38275","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38277","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38278","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38279","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38280","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38282","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38283","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38285","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38286","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38289","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38290","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38292","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38293","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38295","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38298","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38299","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38300","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38303","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38304","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38305","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38307","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38310","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38312","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38313","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38319","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38320","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38321","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38322","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38323","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38324","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38326","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38328","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38331","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38332","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38333","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38334","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38335","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38336","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38337","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38338","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38342","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38343","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38344","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38345","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38346","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38347","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38348","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38349","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38351","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38354","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38361","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38362","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38363","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38364","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38365","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38368","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38369","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38371","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38373","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38374","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38375","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38376","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38377","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38382","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38384","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38385","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38386","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38387","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38388","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38389","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38390","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38391","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38392","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38393","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38395","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38396","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38399","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38400","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38401","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38402","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38403","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38405","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38406","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38407","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38408","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38409","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38410","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38412","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38414","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38415","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38416","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38418","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38419","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38420","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38422","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38424","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38425","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38427","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38428","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38429","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38430","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38436","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38437","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38439","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38441","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38443","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38444","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38445","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38448","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38449","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38455","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38456","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38457","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38458","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38459","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38460","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38461","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38462","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38463","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38464","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38465","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38466","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38467","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38468","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38469","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38470","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38471","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38472","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38473","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38474","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38476","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38478","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38480","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38481","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38482","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38483","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38485","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38487","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38488","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38489","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38490","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38491","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38493","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38494","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38495","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38496","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38497","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38499","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38501","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38503","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38506","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38507","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38510","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38511","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38512","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38513","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38514","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38515","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38516","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38520","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38521","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38524","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38526","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38527","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38528","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38529","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38530","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38531","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38532","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38533","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38535","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38537","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38538","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38539","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38540","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38542","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38543","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38544","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38546","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38548","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38549","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38550","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38551","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38552","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38553","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38555","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38560","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38561","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38562","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38566","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38568","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38569","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38571","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38572","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38574","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38576","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38577","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38578","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38579","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38581","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38582","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38583","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38584","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38585","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38587","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38588","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38590","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38593","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38595","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38601","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38602","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38604","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38608","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38609","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38610","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38612","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38614","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38615","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38619","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38622","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38623","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38624","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38625","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38626","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38630","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38632","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38634","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38635","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38639","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38640","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38644","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38645","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38646","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38648","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38650","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38652","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38653","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38659","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38660","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38663","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38664","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38665","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38668","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38670","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38671","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38675","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38676","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38677","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38679","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38680","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38681","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38684","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38685","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38686","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38687","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38688","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38691","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38692","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38693","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38694","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38695","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38696","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38697","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38698","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38699","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38700","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38701","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38702","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38703","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38704","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38705","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38706","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38707","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38708","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38710","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38711","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38712","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38713","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38714","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38715","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38716","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38718","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38721","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38722","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38724","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38725","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38728","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38729","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38730","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38732","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38734","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38735","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39673","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39675","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39676","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39679","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39681","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39683","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39684","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39685","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39686","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39687","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39689","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39691","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39692","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39693","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39694","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39698","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39701","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39702","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39703","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39705","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39706","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39707","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39709","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39710","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39711","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39712","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39713","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39714","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39715","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39716","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39718","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39719","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39720","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39721","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39724","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39726","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39730","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39731","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39732","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39734","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39736","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39737","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39738","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39739","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39742","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39743","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39744","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39746","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39747","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39748","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39749","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39750","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39752","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39753","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39756","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39757","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39758","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39759","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39760","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39761","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39763","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39766","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39770","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39772","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39773","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39776","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39779","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39781","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39782","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39783","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39787","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39788","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39790","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39794","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39795","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39797","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39798","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39800","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39801","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39889","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39890","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39946","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39989","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40019","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40215","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40297","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68750","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23060","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23074","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23111","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23268","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23269","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23403","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23404","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23405","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23406","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23407","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23408","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23409","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23410","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23411","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-36347","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57795","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22022","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22111","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38022","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38234","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40164","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40325","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68206","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68254","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68255","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68256","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68257","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68258","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68259","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68261","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68263","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68264","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68265","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68266","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68325","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68332","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68335","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68336","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68337","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68344","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68345","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68346","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68347","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68349","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68354","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68362","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68363","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68364","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68366","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68367","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68371","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68372","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68374","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68378","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68379","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68380","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68724","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68727","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68728","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68732","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68733","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68740","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68741","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68742","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68744","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68746","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68753","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68755","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68756","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68757","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68758","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68759","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68763","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68764","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68765","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68766","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68767","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68769","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68770","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68771","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68772","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68773","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68774","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68775","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68776","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68777","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68778","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68780","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68782","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68783","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68785","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68786","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68787","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68788","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68794","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68795","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68796","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68797","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68798","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68799","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68800","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68801","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68804","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68806","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68808","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68809","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68810","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68811","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68813","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68814","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68815","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68816","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68817","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68818","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68819","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68820","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71064","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71065","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71066","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71067","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71068","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71069","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71071","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71072","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71075","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71077","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71078","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71079","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71081","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71082","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71083","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71084","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71085","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71086","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71087","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71088","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71089","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71091","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71093","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71094","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71095","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71096","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71097","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71098","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71101","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71102","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71104","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71105","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71107","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71108","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71109","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71111","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71112","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71113","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71114","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71116","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71118","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71119","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71120","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71121","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71122","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71125","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71126","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71127","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71130","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71131","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71132","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71133","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71135","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71136","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71137","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71138","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71140","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71141","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71143","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71147","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71148","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71149","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71150","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71151","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71153","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71154","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23112","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23209","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23231","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23273","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-39948","title":"ice: fix Rx page leak on multi-buffer frames","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix Rx page leak on multi-buffer frames\n\nThe ice_put_rx_mbuf() function handles calling ice_put_rx_buf() for each\nbuffer in the current frame. This function was introduced as part of\nhandling multi-buffer XDP support in the ice driver.\n\nIt works by iterating over the buffers from first_desc up to 1 plus the\ntotal number of fragments in the frame, cached from before the XDP program\nwas executed.\n\nIf the hardware posts a descriptor with a size of 0, the logic used in\nice_put_rx_mbuf() breaks. Such descriptors get skipped and don't get added\nas fragments in ice_add_xdp_frag. Since the buffer isn't counted as a\nfragment, we do not iterate over it in ice_put_rx_mbuf(), and thus we don't\ncall ice_put_rx_buf().\n\nBecause we don't call ice_put_rx_buf(), we don't attempt to re-use the\npage or free it. This leaves a stale page in the ring, as we don't\nincrement next_to_alloc.\n\nThe ice_reuse_rx_page() assumes that the next_to_alloc has been incremented\nproperly, and that it always points to a buffer with a NULL page. Since\nthis function doesn't check, it will happily recycle a page over the top\nof the next_to_alloc buffer, losing track of the old page.\n\nNote that this leak only occurs for multi-buffer frames. The\nice_put_rx_mbuf() function always handles at least one buffer, so a\nsingle-buffer frame will always get handled correctly. It is not clear\nprecisely why the hardware hands us descriptors with a size of 0 sometimes,\nbut it happens somewhat regularly with \"jumbo frames\" used by 9K MTU.\n\nTo fix ice_put_rx_mbuf(), we need to make sure to call ice_put_rx_buf() on\nall buffers between first_desc and next_to_clean. Borrow the logic of a\nsimilar function in i40e used for this same purpose. Use the same logic\nalso in ice_get_pgcnts().\n\nInstead of iterating over just the number of fragments, use a loop which\niterates until the current index reaches to the next_to_clean element just\npast the current frame. Unlike i40e, the ice_put_rx_mbuf() function does\ncall ice_put_rx_buf() on the last buffer of the frame indicating the end of\npacket.\n\nFor non-linear (multi-buffer) frames, we need to take care when adjusting\nthe pagecnt_bias. An XDP program might release fragments from the tail of\nthe frame, in which case that fragment page is already released. Only\nupdate the pagecnt_bias for the first descriptor and fragments still\nremaining post-XDP program. Take care to only access the shared info for\nfragmented buffers, as this avoids a significant cache miss.\n\nThe xdp_xmit value only needs to be updated if an XDP program is run, and\nonly once per packet. Drop the xdp_xmit pointer argument from\nice_put_rx_mbuf(). Instead, set xdp_xmit in the ice_clean_rx_irq() function\ndirectly. This avoids needing to pass the argument and avoids an extra\nbit-wise OR for each buffer in the frame.\n\nMove the increment of the ntc local variable to ensure its updated *before*\nall calls to ice_get_pgcnts() or ice_put_rx_mbuf(), as the loop logic\nrequires the index of the element just after the current frame.\n\nNow that we use an index pointer in the ring to identify the packet, we no\nlonger need to track or cache the number of fragments in the rx_ring.","status":"published","published":"2025-10-04T07:31:09.403Z","modified":"2026-10-21T12:37:38.94Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"updated_at":"2026-11-02T14:32:50.176138Z"}],"euvd":[{"id":"EUVD-2025-32395","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix Rx page leak on multi-buffer frames\n\nThe ice_put_rx_mbuf() function handles calling ice_put_rx_buf() for each\nbuffer in the current frame. This function was introduced as part of\nhandling multi-buffer XDP support in the ice driver.\n\nIt works by iterating over the buffers from first_desc up to 1 plus the\ntotal number of fragments in the frame, cached from before the XDP program\nwas executed.\n\nIf the hardware posts a descriptor with a size of 0, the logic used in\nice_put_rx_mbuf() breaks. Such descriptors get skipped and don't get added\nas fragments in ice_add_xdp_frag. Since the buffer isn't counted as a\nfragment, we do not iterate over it in ice_put_rx_mbuf(), and thus we don't\ncall ice_put_rx_buf().\n\nBecause we don't call ice_put_rx_buf(), we don't attempt to re-use the\npage or free it. This leaves a stale page in the ring, as we don't\nincrement next_to_alloc.\n\nThe ice_reuse_rx_page() assumes that the next_to_alloc has been incremented\nproperly, and that it always points to a buffer with a NULL page. Since\nthis function doesn't check, it will happily recycle a page over the top\nof the next_to_alloc buffer, losing track of the old page.\n\nNote that this leak only occurs for multi-buffer frames. The\nice_put_rx_mbuf() function always handles at least one buffer, so a\nsingle-buffer frame will always get handled correctly. It is not clear\nprecisely why the hardware hands us descriptors with a size of 0 sometimes,\nbut it happens somewhat regularly with \"jumbo frames\" used by 9K MTU.\n\nTo fix ice_put_rx_mbuf(), we need to make sure to call ice_put_rx_buf() on\nall buffers between first_desc and next_to_clean. Borrow the logic of a\nsimilar function in i40e used for this same purpose. Use the same logic\nalso in ice_get_pgcnts().\n\nInstead of iterating over just the number of fragments, use a loop which\niterates until the current index reaches to the next_to_clean element just\npast the current frame. Unlike i40e, the ice_put_rx_mbuf() function does\ncall ice_put_rx_buf() on the last buffer of the frame indicating the end of\npacket.\n\nFor non-linear (multi-buffer) frames, we need to take care when adjusting\nthe pagecnt_bias. An XDP program might release fragments from the tail of\nthe frame, in which case that fragment page is already released. Only\nupdate the pagecnt_bias for the first descriptor and fragments still\nremaining post-XDP program. Take care to only access the shared info for\nfragmented buffers, as this avoids a significant cache miss.\n\nThe xdp_xmit value only needs to be updated if an XDP program is run, and\nonly once per packet. Drop the xdp_xmit pointer argument from\nice_put_rx_mbuf(). Instead, set xdp_xmit in the ice_clean_rx_irq() function\ndirectly. This avoids needing to pass the argument and avoids an extra\nbit-wise OR for each buffer in the frame.\n\nMove the increment of the ntc local variable to ensure its updated *before*\nall calls to ice_get_pgcnts() or ice_put_rx_mbuf(), as the loop logic\nrequires the index of the element just after the current frame.\n\nNow that we use an index pointer in the ring to identify the packet, we no\nlonger need to track or cache the number of fragments in the rx_ring.","status":"published","published":"2025-10-04T07:31:09Z","modified":"2026-10-21T12:37:38Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:59:39.351007Z"}],"ghsa":[{"id":"GHSA-7v58-mp27-j7rx","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix Rx page leak on...","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix Rx page leak on multi-buffer frames\n\nThe ice_put_rx_mbuf() function handles calling ice_put_rx_buf() for each\nbuffer in the current frame. This function was introduced as part of\nhandling multi-buffer XDP support in the ice driver.\n\nIt works by iterating over the buffers from first_desc up to 1 plus the\ntotal number of fragments in the frame, cached from before the XDP program\nwas executed.\n\nIf the hardware posts a descriptor with a size of 0, the logic used in\nice_put_rx_mbuf() breaks. Such descriptors get skipped and don't get added\nas fragments in ice_add_xdp_frag. Since the buffer isn't counted as a\nfragment, we do not iterate over it in ice_put_rx_mbuf(), and thus we don't\ncall ice_put_rx_buf().\n\nBecause we don't call ice_put_rx_buf(), we don't attempt to re-use the\npage or free it. This leaves a stale page in the ring, as we don't\nincrement next_to_alloc.\n\nThe ice_reuse_rx_page() assumes that the next_to_alloc has been incremented\nproperly, and that it always points to a buffer with a NULL page. Since\nthis function doesn't check, it will happily recycle a page over the top\nof the next_to_alloc buffer, losing track of the old page.\n\nNote that this leak only occurs for multi-buffer frames. The\nice_put_rx_mbuf() function always handles at least one buffer, so a\nsingle-buffer frame will always get handled correctly. It is not clear\nprecisely why the hardware hands us descriptors with a size of 0 sometimes,\nbut it happens somewhat regularly with \"jumbo frames\" used by 9K MTU.\n\nTo fix ice_put_rx_mbuf(), we need to make sure to call ice_put_rx_buf() on\nall buffers between first_desc and next_to_clean. Borrow the logic of a\nsimilar function in i40e used for this same purpose. Use the same logic\nalso in ice_get_pgcnts().\n\nInstead of iterating over just the number of fragments, use a loop which\niterates until the current index reaches to the next_to_clean element just\npast the current frame. Unlike i40e, the ice_put_rx_mbuf() function does\ncall ice_put_rx_buf() on the last buffer of the frame indicating the end of\npacket.\n\nFor non-linear (multi-buffer) frames, we need to take care when adjusting\nthe pagecnt_bias. An XDP program might release fragments from the tail of\nthe frame, in which case that fragment page is already released. Only\nupdate the pagecnt_bias for the first descriptor and fragments still\nremaining post-XDP program. Take care to only access the shared info for\nfragmented buffers, as this avoids a significant cache miss.\n\nThe xdp_xmit value only needs to be updated if an XDP program is run, and\nonly once per packet. Drop the xdp_xmit pointer argument from\nice_put_rx_mbuf(). Instead, set xdp_xmit in the ice_clean_rx_irq() function\ndirectly. This avoids needing to pass the argument and avoids an extra\nbit-wise OR for each buffer in the frame.\n\nMove the increment of the ntc local variable to ensure its updated *before*\nall calls to ice_get_pgcnts() or ice_put_rx_mbuf(), as the loop logic\nrequires the index of the element just after the current frame.\n\nNow that we use an index pointer in the ring to identify the packet, we no\nlonger need to track or cache the number of fragments in the rx_ring.","status":"published","published":"2025-10-04T09:30:21Z","modified":"2026-10-21T15:41:57Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T15:14:10.747028Z"}],"nvd":[{"id":"CVE-2025-39948","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix Rx page leak on multi-buffer frames\n\nThe ice_put_rx_mbuf() function handles calling ice_put_rx_buf() for each\nbuffer in the current frame. This function was introduced as part of\nhandling multi-buffer XDP support in the ice driver.\n\nIt works by iterating over the buffers from first_desc up to 1 plus the\ntotal number of fragments in the frame, cached from before the XDP program\nwas executed.\n\nIf the hardware posts a descriptor with a size of 0, the logic used in\nice_put_rx_mbuf() breaks. Such descriptors get skipped and don't get added\nas fragments in ice_add_xdp_frag. Since the buffer isn't counted as a\nfragment, we do not iterate over it in ice_put_rx_mbuf(), and thus we don't\ncall ice_put_rx_buf().\n\nBecause we don't call ice_put_rx_buf(), we don't attempt to re-use the\npage or free it. This leaves a stale page in the ring, as we don't\nincrement next_to_alloc.\n\nThe ice_reuse_rx_page() assumes that the next_to_alloc has been incremented\nproperly, and that it always points to a buffer with a NULL page. Since\nthis function doesn't check, it will happily recycle a page over the top\nof the next_to_alloc buffer, losing track of the old page.\n\nNote that this leak only occurs for multi-buffer frames. The\nice_put_rx_mbuf() function always handles at least one buffer, so a\nsingle-buffer frame will always get handled correctly. It is not clear\nprecisely why the hardware hands us descriptors with a size of 0 sometimes,\nbut it happens somewhat regularly with \"jumbo frames\" used by 9K MTU.\n\nTo fix ice_put_rx_mbuf(), we need to make sure to call ice_put_rx_buf() on\nall buffers between first_desc and next_to_clean. Borrow the logic of a\nsimilar function in i40e used for this same purpose. Use the same logic\nalso in ice_get_pgcnts().\n\nInstead of iterating over just the number of fragments, use a loop which\niterates until the current index reaches to the next_to_clean element just\npast the current frame. Unlike i40e, the ice_put_rx_mbuf() function does\ncall ice_put_rx_buf() on the last buffer of the frame indicating the end of\npacket.\n\nFor non-linear (multi-buffer) frames, we need to take care when adjusting\nthe pagecnt_bias. An XDP program might release fragments from the tail of\nthe frame, in which case that fragment page is already released. Only\nupdate the pagecnt_bias for the first descriptor and fragments still\nremaining post-XDP program. Take care to only access the shared info for\nfragmented buffers, as this avoids a significant cache miss.\n\nThe xdp_xmit value only needs to be updated if an XDP program is run, and\nonly once per packet. Drop the xdp_xmit pointer argument from\nice_put_rx_mbuf(). Instead, set xdp_xmit in the ice_clean_rx_irq() function\ndirectly. This avoids needing to pass the argument and avoids an extra\nbit-wise OR for each buffer in the frame.\n\nMove the increment of the ntc local variable to ensure its updated *before*\nall calls to ice_get_pgcnts() or ice_put_rx_mbuf(), as the loop logic\nrequires the index of the element just after the current frame.\n\nNow that we use an index pointer in the ring to identify the packet, we no\nlonger need to track or cache the number of fragments in the rx_ring.","status":"published","published":"2025-10-04T08:15:47.99Z","modified":"2026-10-21T13:18:17.63Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T14:11:35.93863Z"}],"osv":[{"id":"BELL-CVE-2025-39948","status":"published","published":"2025-10-07T06:06:48.179581Z","modified":"2026-06-25T07:15:36.276913405Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:22.246535Z"},{"id":"CVE-2025-39948","title":"ice: fix Rx page leak on multi-buffer frames","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix Rx page leak on multi-buffer frames\n\nThe ice_put_rx_mbuf() function handles calling ice_put_rx_buf() for each\nbuffer in the current frame. This function was introduced as part of\nhandling multi-buffer XDP support in the ice driver.\n\nIt works by iterating over the buffers from first_desc up to 1 plus the\ntotal number of fragments in the frame, cached from before the XDP program\nwas executed.\n\nIf the hardware posts a descriptor with a size of 0, the logic used in\nice_put_rx_mbuf() breaks. Such descriptors get skipped and don't get added\nas fragments in ice_add_xdp_frag. Since the buffer isn't counted as a\nfragment, we do not iterate over it in ice_put_rx_mbuf(), and thus we don't\ncall ice_put_rx_buf().\n\nBecause we don't call ice_put_rx_buf(), we don't attempt to re-use the\npage or free it. This leaves a stale page in the ring, as we don't\nincrement next_to_alloc.\n\nThe ice_reuse_rx_page() assumes that the next_to_alloc has been incremented\nproperly, and that it always points to a buffer with a NULL page. Since\nthis function doesn't check, it will happily recycle a page over the top\nof the next_to_alloc buffer, losing track of the old page.\n\nNote that this leak only occurs for multi-buffer frames. The\nice_put_rx_mbuf() function always handles at least one buffer, so a\nsingle-buffer frame will always get handled correctly. It is not clear\nprecisely why the hardware hands us descriptors with a size of 0 sometimes,\nbut it happens somewhat regularly with \"jumbo frames\" used by 9K MTU.\n\nTo fix ice_put_rx_mbuf(), we need to make sure to call ice_put_rx_buf() on\nall buffers between first_desc and next_to_clean. Borrow the logic of a\nsimilar function in i40e used for this same purpose. Use the same logic\nalso in ice_get_pgcnts().\n\nInstead of iterating over just the number of fragments, use a loop which\niterates until the current index reaches to the next_to_clean element just\npast the current frame. Unlike i40e, the ice_put_rx_mbuf() function does\ncall ice_put_rx_buf() on the last buffer of the frame indicating the end of\npacket.\n\nFor non-linear (multi-buffer) frames, we need to take care when adjusting\nthe pagecnt_bias. An XDP program might release fragments from the tail of\nthe frame, in which case that fragment page is already released. Only\nupdate the pagecnt_bias for the first descriptor and fragments still\nremaining post-XDP program. Take care to only access the shared info for\nfragmented buffers, as this avoids a significant cache miss.\n\nThe xdp_xmit value only needs to be updated if an XDP program is run, and\nonly once per packet. Drop the xdp_xmit pointer argument from\nice_put_rx_mbuf(). Instead, set xdp_xmit in the ice_clean_rx_irq() function\ndirectly. This avoids needing to pass the argument and avoids an extra\nbit-wise OR for each buffer in the frame.\n\nMove the increment of the ntc local variable to ensure its updated *before*\nall calls to ice_get_pgcnts() or ice_put_rx_mbuf(), as the loop logic\nrequires the index of the element just after the current frame.\n\nNow that we use an index pointer in the ring to identify the packet, we no\nlonger need to track or cache the number of fragments in the rx_ring.","status":"published","published":"2025-10-04T07:31:09.403Z","modified":"2026-10-28T02:30:53.880682321Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:49.052395Z"},{"id":"DEBIAN-CVE-2025-39948","description":"In the Linux kernel, the following vulnerability has been resolved:  ice: fix Rx page leak on multi-buffer frames  The ice_put_rx_mbuf() function handles calling ice_put_rx_buf() for each buffer in the current frame. This function was introduced as part of handling multi-buffer XDP support in the ice driver.  It works by iterating over the buffers from first_desc up to 1 plus the total number of fragments in the frame, cached from before the XDP program was executed.  If the hardware posts a descriptor with a size of 0, the logic used in ice_put_rx_mbuf() breaks. Such descriptors get skipped and don't get added as fragments in ice_add_xdp_frag. Since the buffer isn't counted as a fragment, we do not iterate over it in ice_put_rx_mbuf(), and thus we don't call ice_put_rx_buf().  Because we don't call ice_put_rx_buf(), we don't attempt to re-use the page or free it. This leaves a stale page in the ring, as we don't increment next_to_alloc.  The ice_reuse_rx_page() assumes that the next_to_alloc has been incremented properly, and that it always points to a buffer with a NULL page. Since this function doesn't check, it will happily recycle a page over the top of the next_to_alloc buffer, losing track of the old page.  Note that this leak only occurs for multi-buffer frames. The ice_put_rx_mbuf() function always handles at least one buffer, so a single-buffer frame will always get handled correctly. It is not clear precisely why the hardware hands us descriptors with a size of 0 sometimes, but it happens somewhat regularly with \"jumbo frames\" used by 9K MTU.  To fix ice_put_rx_mbuf(), we need to make sure to call ice_put_rx_buf() on all buffers between first_desc and next_to_clean. Borrow the logic of a similar function in i40e used for this same purpose. Use the same logic also in ice_get_pgcnts().  Instead of iterating over just the number of fragments, use a loop which iterates until the current index reaches to the next_to_clean element just past the current frame. Unlike i40e, the ice_put_rx_mbuf() function does call ice_put_rx_buf() on the last buffer of the frame indicating the end of packet.  For non-linear (multi-buffer) frames, we need to take care when adjusting the pagecnt_bias. An XDP program might release fragments from the tail of the frame, in which case that fragment page is already released. Only update the pagecnt_bias for the first descriptor and fragments still remaining post-XDP program. Take care to only access the shared info for fragmented buffers, as this avoids a significant cache miss.  The xdp_xmit value only needs to be updated if an XDP program is run, and only once per packet. Drop the xdp_xmit pointer argument from ice_put_rx_mbuf(). Instead, set xdp_xmit in the ice_clean_rx_irq() function directly. This avoids needing to pass the argument and avoids an extra bit-wise OR for each buffer in the frame.  Move the increment of the ntc local variable to ensure its updated *before* all calls to ice_get_pgcnts() or ice_put_rx_mbuf(), as the loop logic requires the index of the element just after the current frame.  Now that we use an index pointer in the ring to identify the packet, we no longer need to track or cache the number of fragments in the rx_ring.","status":"published","published":"2025-10-04T08:15:47.99Z","modified":"2026-10-23T18:04:35.100259398Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:46.998514Z"},{"id":"OESA-2026-1566","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nudp: Deal with race between UDP socket address change and rehash\n\nIf a UDP socket changes its local address while it\u0026apos;s receiving\ndatagrams, as a result of connect(), there is a period during which\na lookup operation might fail to find it, after the address is changed\nbut before the secondary hash (port and address) and the four-tuple\nhash (local and remote ports and addresses) are updated.\n\nSecondary hash chains were introduced by commit 30fff9231fad (\u0026quot;udp:\nbind() optimisation\u0026quot;) and, as a result, a rehash operation became\nneeded to make a bound socket reachable again after a connect().\n\nThis operation was introduced by commit 719f835853a9 (\u0026quot;udp: add\nrehash on connect()\u0026quot;) which isn\u0026apos;t however a complete fix: the\nsocket will be found once the rehashing completes, but not while\nit\u0026apos;s pending.\n\nThis is noticeable with a socat(1) server in UDP4-LISTEN mode, and a\nclient sending datagrams to it. After the server receives the first\ndatagram (cf. _xioopen_ipdgram_listen()), it issues a connect() to\nthe address of the sender, in order to set up a directed flow.\n\nNow, if the client, running on a different CPU thread, happens to\nsend a (subsequent) datagram while the server\u0026apos;s socket changes its\naddress, but is not rehashed yet, this will result in a failed\nlookup and a port unreachable error delivered to the client, as\napparent from the following reproducer:\n\n  LEN=$(($(cat /proc/sys/net/core/wmem_default) / 4))\n  dd if=/dev/urandom bs=1 count=${LEN} of=tmp.in\n\n  while :; do\n  \ttaskset -c 1 socat UDP4-LISTEN:1337,null-eof OPEN:tmp.out,create,trunc \u0026amp;\n  \tsleep 0.1 || sleep 1\n  \ttaskset -c 2 socat OPEN:tmp.in UDP4:localhost:1337,shut-null\n  \twait\n  done\n\nwhere the client will eventually get ECONNREFUSED on a write()\n(typically the second or third one of a given iteration):\n\n  2024/11/13 21:28:23 socat[46901] E write(6, 0x556db2e3c000, 8192): Connection refused\n\nThis issue was first observed as a seldom failure in Podman\u0026apos;s tests\nchecking UDP functionality while using pasta(1) to connect the\ncontainer\u0026apos;s network namespace, which leads us to a reproducer with\nthe lookup error resulting in an ICMP packet on a tap device:\n\n  LOCAL_ADDR=\u0026quot;$(ip -j -4 addr show|jq -rM \u0026apos;.[] | .addr_info[0] | select(.scope == \u0026quot;global\u0026quot;).local\u0026apos;)\u0026quot;\n\n  while :; do\n  \t./pasta --config-net -p pasta.pcap -u 1337 socat UDP4-LISTEN:1337,null-eof OPEN:tmp.out,create,trunc \u0026amp;\n  \tsleep 0.2 || sleep 1\n  \tsocat OPEN:tmp.in UDP4:${LOCAL_ADDR}:1337,shut-null\n  \twait\n  \tcmp tmp.in tmp.out\n  done\n\nOnce this fails:\n\n  tmp.in tmp.out differ: char 8193, line 29\n\nwe can finally have a look at what\u0026apos;s going on:\n\n  $ tshark -r pasta.pcap\n      1   0.000000           :: ? ff02::16     ICMPv6 110 Multicast Listener Report Message v2\n      2   0.168690 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192\n      3   0.168767 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192\n      4   0.168806 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192\n      5   0.168827 c6:47:05:8d:dc:04 ? Broadcast    ARP 42 Who has 88.198.0.161? Tell 88.198.0.164\n      6   0.168851 9a:55:9a:55:9a:55 ? c6:47:05:8d:dc:04 ARP 42 88.198.0.161 is at 9a:55:9a:55:9a:55\n      7   0.168875 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192\n      8   0.168896 88.198.0.164 ? 88.198.0.161 ICMP 590 Destination unreachable (Port unreachable)\n      9   0.168926 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192\n     10   0.168959 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192\n     11   0.168989 88.198.0.161 ? 88.198.0.164 UDP 4138 60260 ? 1337 Len=4096\n     12   0.169010 88.198.0.161 ? 88.198.0.164 UDP 42 60260 ? 1337 Len=0\n\nOn the third datagram received, the network namespace of the container\ninitiates an ARP lookup to deliver the ICMP message.\n\nIn another variant of this reproducer, starting the client with:\n\n  strace -f pasta --config-net -u 1337 socat UDP4-LISTEN:1337,null-eof OPEN:tmp.out,create,tru\n---truncated---(CVE-2024-57974)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range()\n\nIf track_pfn_copy() fails, we already added the dst VMA to the maple\ntree. As fork() fails, we\u0026apos;ll cleanup the maple tree, and stumble over\nthe dst VMA for which we neither performed any reservation nor copied\nany page tables.\n\nConsequently untrack_pfn() will see VM_PAT and try obtaining the\nPAT information from the page table -- which fails because the page\ntable was not copied.\n\nThe easiest fix would be to simply clear the VM_PAT flag of the dst VMA\nif track_pfn_copy() fails. However, the whole thing is about \u0026quot;simply\u0026quot;\nclearing the VM_PAT flag is shaky as well: if we passed track_pfn_copy()\nand performed a reservation, but copying the page tables fails, we\u0026apos;ll\nsimply clear the VM_PAT flag, not properly undoing the reservation ...\nwhich is also wrong.\n\nSo let\u0026apos;s fix it properly: set the VM_PAT flag only if the reservation\nsucceeded (leaving it clear initially), and undo the reservation if\nanything goes wrong while copying the page tables: clearing the VM_PAT\nflag after undoing the reservation.\n\nNote that any copied page table entries will get zapped when the VMA will\nget removed later, after copy_page_range() succeeded; as VM_PAT is not set\nthen, we won\u0026apos;t try cleaning VM_PAT up once more and untrack_pfn() will be\nhappy. Note that leaving these page tables in place without a reservation\nis not a problem, as we are aborting fork(); this process will never run.\n\nA reproducer can trigger this usually at the first try:\n\n  https://gitlab.com/davidhildenbrand/scratchspace/-/raw/main/reproducers/pat_fork.c\n\n  WARNING: CPU: 26 PID: 11650 at arch/x86/mm/pat/memtype.c:983 get_pat_info+0xf6/0x110\n  Modules linked in: ...\n  CPU: 26 UID: 0 PID: 11650 Comm: repro3 Not tainted 6.12.0-rc5+ #92\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014\n  RIP: 0010:get_pat_info+0xf6/0x110\n  ...\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   ...\n   untrack_pfn+0x52/0x110\n   unmap_single_vma+0xa6/0xe0\n   unmap_vmas+0x105/0x1f0\n   exit_mmap+0xf6/0x460\n   __mmput+0x4b/0x120\n   copy_process+0x1bf6/0x2aa0\n   kernel_clone+0xab/0x440\n   __do_sys_clone+0x66/0x90\n   do_syscall_64+0x95/0x180\n\nLikely this case was missed in:\n\n  d155df53f310 (\u0026quot;x86/mm/pat: clear VM_PAT if copy_p4d_range failed\u0026quot;)\n\n... and instead of undoing the reservation we simply cleared the VM_PAT flag.\n\nKeep the documentation of these functions in include/linux/pgtable.h,\none place is more than sufficient -- we should clean that up for the other\nfunctions like track_pfn_remap/untrack_pfn separately.(CVE-2025-22090)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: make fallback action and fallback decision atomic\n\nSyzkaller reported the following splat:\n\n  WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 __mptcp_do_fallback net/mptcp/protocol.h:1223 [inline]\n  WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 mptcp_do_fallback net/mptcp/protocol.h:1244 [inline]\n  WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 check_fully_established net/mptcp/options.c:982 [inline]\n  WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 mptcp_incoming_options+0x21a8/0x2510 net/mptcp/options.c:1153\n  Modules linked in:\n  CPU: 1 UID: 0 PID: 7704 Comm: syz.3.1419 Not tainted 6.16.0-rc3-gbd5ce2324dba #20 PREEMPT(voluntary)\n  Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n  RIP: 0010:__mptcp_do_fallback net/mptcp/protocol.h:1223 [inline]\n  RIP: 0010:mptcp_do_fallback net/mptcp/protocol.h:1244 [inline]\n  RIP: 0010:check_fully_established net/mptcp/options.c:982 [inline]\n  RIP: 0010:mptcp_incoming_options+0x21a8/0x2510 net/mptcp/options.c:1153\n  Code: 24 18 e8 bb 2a 00 fd e9 1b df ff ff e8 b1 21 0f 00 e8 ec 5f c4 fc 44 0f b7 ac 24 b0 00 00 00 e9 54 f1 ff ff e8 d9 5f c4 fc 90 \u0026lt;0f\u0026gt; 0b 90 e9 b8 f4 ff ff e8 8b 2a 00 fd e9 8d e6 ff ff e8 81 2a 00\n  RSP: 0018:ffff8880a3f08448 EFLAGS: 00010246\n  RAX: 0000000000000000 RBX: ffff8880180a8000 RCX: ffffffff84afcf45\n  RDX: ffff888090223700 RSI: ffffffff84afdaa7 RDI: 0000000000000001\n  RBP: ffff888017955780 R08: 0000000000000001 R09: 0000000000000000\n  R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000\n  R13: ffff8880180a8910 R14: ffff8880a3e9d058 R15: 0000000000000000\n  FS:  00005555791b8500(0000) GS:ffff88811c495000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 000000110c2800b7 CR3: 0000000058e44000 CR4: 0000000000350ef0\n  Call Trace:\n   \u0026lt;IRQ\u0026gt;\n   tcp_reset+0x26f/0x2b0 net/ipv4/tcp_input.c:4432\n   tcp_validate_incoming+0x1057/0x1b60 net/ipv4/tcp_input.c:5975\n   tcp_rcv_established+0x5b5/0x21f0 net/ipv4/tcp_input.c:6166\n   tcp_v4_do_rcv+0x5dc/0xa70 net/ipv4/tcp_ipv4.c:1925\n   tcp_v4_rcv+0x3473/0x44a0 net/ipv4/tcp_ipv4.c:2363\n   ip_protocol_deliver_rcu+0xba/0x480 net/ipv4/ip_input.c:205\n   ip_local_deliver_finish+0x2f1/0x500 net/ipv4/ip_input.c:233\n   NF_HOOK include/linux/netfilter.h:317 [inline]\n   NF_HOOK include/linux/netfilter.h:311 [inline]\n   ip_local_deliver+0x1be/0x560 net/ipv4/ip_input.c:254\n   dst_input include/net/dst.h:469 [inline]\n   ip_rcv_finish net/ipv4/ip_input.c:447 [inline]\n   NF_HOOK include/linux/netfilter.h:317 [inline]\n   NF_HOOK include/linux/netfilter.h:311 [inline]\n   ip_rcv+0x514/0x810 net/ipv4/ip_input.c:567\n   __netif_receive_skb_one_core+0x197/0x1e0 net/core/dev.c:5975\n   __netif_receive_skb+0x1f/0x120 net/core/dev.c:6088\n   process_backlog+0x301/0x1360 net/core/dev.c:6440\n   __napi_poll.constprop.0+0xba/0x550 net/core/dev.c:7453\n   napi_poll net/core/dev.c:7517 [inline]\n   net_rx_action+0xb44/0x1010 net/core/dev.c:7644\n   handle_softirqs+0x1d0/0x770 kernel/softirq.c:579\n   do_softirq+0x3f/0x90 kernel/softirq.c:480\n   \u0026lt;/IRQ\u0026gt;\n   \u0026lt;TASK\u0026gt;\n   __local_bh_enable_ip+0xed/0x110 kernel/softirq.c:407\n   local_bh_enable include/linux/bottom_half.h:33 [inline]\n   inet_csk_listen_stop+0x2c5/0x1070 net/ipv4/inet_connection_sock.c:1524\n   mptcp_check_listen_stop.part.0+0x1cc/0x220 net/mptcp/protocol.c:2985\n   mptcp_check_listen_stop net/mptcp/mib.h:118 [inline]\n   __mptcp_close+0x9b9/0xbd0 net/mptcp/protocol.c:3000\n   mptcp_close+0x2f/0x140 net/mptcp/protocol.c:3066\n   inet_release+0xed/0x200 net/ipv4/af_inet.c:435\n   inet6_release+0x4f/0x70 net/ipv6/af_inet6.c:487\n   __sock_release+0xb3/0x270 net/socket.c:649\n   sock_close+0x1c/0x30 net/socket.c:1439\n   __fput+0x402/0xb70 fs/file_table.c:465\n   task_work_run+0x150/0x240 kernel/task_work.c:227\n   resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]\n   exit_to_user_mode_loop+0xd4\n---truncated---(CVE-2025-38491)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic\n\nThe decompress_io_ctx may be released asynchronously after\nI/O completion. If this file is deleted immediately after read,\nand the kworker of processing post_read_wq has not been executed yet\ndue to high workloads, It is possible that the inode(f2fs_inode_info)\nis evicted and freed before it is used f2fs_free_dic.\n\n    The UAF case as below:\n    Thread A                                      Thread B\n    - f2fs_decompress_end_io\n     - f2fs_put_dic\n      - queue_work\n        add free_dic work to post_read_wq\n                                                   - do_unlink\n                                                    - iput\n                                                     - evict\n                                                      - call_rcu\n    This file is deleted after read.\n\n    Thread C                                 kworker to process post_read_wq\n    - rcu_do_batch\n     - f2fs_free_inode\n      - kmem_cache_free\n     inode is freed by rcu\n                                             - process_scheduled_works\n                                              - f2fs_late_free_dic\n                                               - f2fs_free_dic\n                                                - f2fs_release_decomp_mem\n                                      read (dic-\u0026gt;inode)-\u0026gt;i_compress_algorithm\n\nThis patch store compress_algorithm and sbi in dic to avoid inode UAF.\n\nIn addition, the previous solution is deprecated in [1] may cause system hang.\n[1] https://lore.kernel.org/all/(CVE-2025-38627)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\n[ceph] parse_longname(): strrchr() expects NUL-terminated string\n\n... and parse_longname() is not guaranteed that.  That\u0026apos;s the reason\nwhy it uses kmemdup_nul() to build the argument for kstrtou64();\nthe problem is, kstrtou64() is not the only thing that need it.\n\nJust get a NUL-terminated copy of the entire thing and be done\nwith that...(CVE-2025-38660)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ctnetlink: remove refcounting in expectation dumpers\n\nSame pattern as previous patch: do not keep the expectation object\nalive via refcount, only store a cookie value and then use that\nas the skip hint for dump resumption.\n\nAFAICS this has the same issue as the one resolved in the conntrack\ndumper, when we do\n  if (!refcount_inc_not_zero(\u0026amp;exp-\u0026gt;use))\n\nto increment the refcount, there is a chance that exp == last, which\ncauses a double-increment of the refcount and subsequent memory leak.(CVE-2025-39764)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/slub: avoid accessing metadata when pointer is invalid in object_err()\n\nobject_err() reports details of an object for further debugging, such as\nthe freelist pointer, redzone, etc. However, if the pointer is invalid,\nattempting to access object metadata can lead to a crash since it does\nnot point to a valid object.\n\nOne known path to the crash is when alloc_consistency_checks()\ndetermines the pointer to the allocated object is invalid because of a\nfreelist corruption, and calls object_err() to report it. The debug code\nshould report and handle the corruption gracefully and not crash in the\nprocess.\n\nIn case the pointer is NULL or check_valid_pointer() returns false for\nthe pointer, only print the pointer value and skip accessing metadata.(CVE-2025-39902)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nice: fix Rx page leak on multi-buffer frames\n\nThe ice_put_rx_mbuf() function handles calling ice_put_rx_buf() for each\nbuffer in the current frame. This function was introduced as part of\nhandling multi-buffer XDP support in the ice driver.\n\nIt works by iterating over the buffers from first_desc up to 1 plus the\ntotal number of fragments in the frame, cached from before the XDP program\nwas executed.\n\nIf the hardware posts a descriptor with a size of 0, the logic used in\nice_put_rx_mbuf() breaks. Such descriptors get skipped and don\u0026apos;t get added\nas fragments in ice_add_xdp_frag. Since the buffer isn\u0026apos;t counted as a\nfragment, we do not iterate over it in ice_put_rx_mbuf(), and thus we don\u0026apos;t\ncall ice_put_rx_buf().\n\nBecause we don\u0026apos;t call ice_put_rx_buf(), we don\u0026apos;t attempt to re-use the\npage or free it. This leaves a stale page in the ring, as we don\u0026apos;t\nincrement next_to_alloc.\n\nThe ice_reuse_rx_page() assumes that the next_to_alloc has been incremented\nproperly, and that it always points to a buffer with a NULL page. Since\nthis function doesn\u0026apos;t check, it will happily recycle a page over the top\nof the next_to_alloc buffer, losing track of the old page.\n\nNote that this leak only occurs for multi-buffer frames. The\nice_put_rx_mbuf() function always handles at least one buffer, so a\nsingle-buffer frame will always get handled correctly. It is not clear\nprecisely why the hardware hands us descriptors with a size of 0 sometimes,\nbut it happens somewhat regularly with \u0026quot;jumbo frames\u0026quot; used by 9K MTU.\n\nTo fix ice_put_rx_mbuf(), we need to make sure to call ice_put_rx_buf() on\nall buffers between first_desc and next_to_clean. Borrow the logic of a\nsimilar function in i40e used for this same purpose. Use the same logic\nalso in ice_get_pgcnts().\n\nInstead of iterating over just the number of fragments, use a loop which\niterates until the current index reaches to the next_to_clean element just\npast the current frame. Unlike i40e, the ice_put_rx_mbuf() function does\ncall ice_put_rx_buf() on the last buffer of the frame indicating the end of\npacket.\n\nFor non-linear (multi-buffer) frames, we need to take care when adjusting\nthe pagecnt_bias. An XDP program might release fragments from the tail of\nthe frame, in which case that fragment page is already released. Only\nupdate the pagecnt_bias for the first descriptor and fragments still\nremaining post-XDP program. Take care to only access the shared info for\nfragmented buffers, as this avoids a significant cache miss.\n\nThe xdp_xmit value only needs to be updated if an XDP program is run, and\nonly once per packet. Drop the xdp_xmit pointer argument from\nice_put_rx_mbuf(). Instead, set xdp_xmit in the ice_clean_rx_irq() function\ndirectly. This avoids needing to pass the argument and avoids an extra\nbit-wise OR for each buffer in the frame.\n\nMove the increment of the ntc local variable to ensure its updated *before*\nall calls to ice_get_pgcnts() or ice_put_rx_mbuf(), as the loop logic\nrequires the index of the element just after the current frame.\n\nNow that we use an index pointer in the ring to identify the packet, we no\nlonger need to track or cache the number of fragments in the rx_ring.(CVE-2025-39948)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfbcon: Set fb_display[i]-\u0026gt;mode to NULL when the mode is released\n\nRecently, we discovered the following issue through syzkaller:\n\nBUG: KASAN: slab-use-after-free in fb_mode_is_equal+0x285/0x2f0\nRead of size 4 at addr ff11000001b3c69c by task syz.xxx\n...\nCall Trace:\n \u0026lt;TASK\u0026gt;\n dump_stack_lvl+0xab/0xe0\n print_address_description.constprop.0+0x2c/0x390\n print_report+0xb9/0x280\n kasan_report+0xb8/0xf0\n fb_mode_is_equal+0x285/0x2f0\n fbcon_mode_deleted+0x129/0x180\n fb_set_var+0xe7f/0x11d0\n do_fb_ioctl+0x6a0/0x750\n fb_ioctl+0xe0/0x140\n __x64_sys_ioctl+0x193/0x210\n do_syscall_64+0x5f/0x9c0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nBased on experimentation and analysis, during framebuffer unregistration,\nonly the memory of fb_info-\u0026gt;modelist is freed, without setting the\ncorresponding fb_display[i]-\u0026gt;mode to NULL for the freed modes. This leads\nto UAF issues during subsequent accesses. Here\u0026apos;s an example of reproduction\nsteps:\n1. With /dev/fb0 already registered in the system, load a kernel module\n   to register a new device /dev/fb1;\n2. Set fb1\u0026apos;s mode to the global fb_display[] array (via FBIOPUT_CON2FBMAP);\n3. Switch console from fb to VGA (to allow normal rmmod of the ko);\n4. Unload the kernel module, at this point fb1\u0026apos;s modelist is freed, leaving\n   a wild pointer in fb_display[];\n5. Trigger the bug via system calls through fb0 attempting to delete a mode\n   from fb0.\n\nAdd a check in do_unregister_framebuffer(): if the mode to be freed exists\nin fb_display[], set the corresponding mode pointer to NULL.(CVE-2025-40323)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb\n\nThe Mesa issue referenced below pointed out a possible deadlock:\n\n[ 1231.611031]  Possible interrupt unsafe locking scenario:\n\n[ 1231.611033]        CPU0                    CPU1\n[ 1231.611034]        ----                    ----\n[ 1231.611035]   lock(\u0026amp;xa-\u0026gt;xa_lock#17);\n[ 1231.611038]                                local_irq_disable();\n[ 1231.611039]                                lock(\u0026amp;fence-\u0026gt;lock);\n[ 1231.611041]                                lock(\u0026amp;xa-\u0026gt;xa_lock#17);\n[ 1231.611044]   \u0026lt;Interrupt\u0026gt;\n[ 1231.611045]     lock(\u0026amp;fence-\u0026gt;lock);\n[ 1231.611047]\n                *** DEADLOCK ***\n\nIn this example, CPU0 would be any function accessing job-\u0026gt;dependencies\nthrough the xa_* functions that don\u0026apos;t disable interrupts (eg:\ndrm_sched_job_add_dependency(), drm_sched_entity_kill_jobs_cb()).\n\nCPU1 is executing drm_sched_entity_kill_jobs_cb() as a fence signalling\ncallback so in an interrupt context. It will deadlock when trying to\ngrab the xa_lock which is already held by CPU0.\n\nReplacing all xa_* usage by their xa_*_irq counterparts would fix\nthis issue, but Christian pointed out another issue: dma_fence_signal\ntakes fence.lock and so does dma_fence_add_callback.\n\n  dma_fence_signal() // locks f1.lock\n  -\u0026gt; drm_sched_entity_kill_jobs_cb()\n  -\u0026gt; foreach dependencies\n     -\u0026gt; dma_fence_add_callback() // locks f2.lock\n\nThis will deadlock if f1 and f2 share the same spinlock.\n\nTo fix both issues, the code iterating on dependencies and re-arming them\nis moved out to drm_sched_entity_kill_jobs_work().\n\n[phasta: commit message nits](CVE-2025-40329)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup\n\nRaw IP packets have no MAC header, leaving skb-\u0026gt;mac_header uninitialized.\nThis can trigger kernel panics on ARM64 when xfrm or other subsystems\naccess the offset due to strict alignment checks.\n\nInitialize the MAC header to prevent such crashes.\n\nThis can trigger kernel panics on ARM when running IPsec over the\nqmimux0 interface.\n\nExample trace:\n\n    Internal error: Oops: 000000009600004f [#1] SMP\n    CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.34-gbe78e49cb433 #1\n    Hardware name: LS1028A RDB Board (DT)\n    pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n    pc : xfrm_input+0xde8/0x1318\n    lr : xfrm_input+0x61c/0x1318\n    sp : ffff800080003b20\n    Call trace:\n     xfrm_input+0xde8/0x1318\n     xfrm6_rcv+0x38/0x44\n     xfrm6_esp_rcv+0x48/0xa8\n     ip6_protocol_deliver_rcu+0x94/0x4b0\n     ip6_input_finish+0x44/0x70\n     ip6_input+0x44/0xc0\n     ipv6_rcv+0x6c/0x114\n     __netif_receive_skb_one_core+0x5c/0x8c\n     __netif_receive_skb+0x18/0x60\n     process_backlog+0x78/0x17c\n     __napi_poll+0x38/0x180\n     net_rx_action+0x168/0x2f0(CVE-2025-68192)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmedia: imon: make send_packet() more robust\n\nsyzbot is reporting that imon has three problems which result in\nhung tasks due to forever holding device lock [1].\n\nFirst problem is that when usb_rx_callback_intf0() once got -EPROTO error\nafter ictx-\u0026gt;dev_present_intf0 became true, usb_rx_callback_intf0()\nresubmits urb after printk(), and resubmitted urb causes\nusb_rx_callback_intf0() to again get -EPROTO error. This results in\nprintk() flooding (RCU stalls).\n\nAlan Stern commented [2] that\n\n  In theory it\u0026apos;s okay to resubmit _if_ the driver has a robust\n  error-recovery scheme (such as giving up after some fixed limit on the\n  number of errors or after some fixed time has elapsed, perhaps with a\n  time delay to prevent a flood of errors).  Most drivers don\u0026apos;t bother to\n  do this; they simply give up right away.  This makes them more\n  vulnerable to short-term noise interference during USB transfers, but in\n  reality such interference is quite rare.  There\u0026apos;s nothing really wrong\n  with giving up right away.\n\nbut imon has a poor error-recovery scheme which just retries forever;\nthis behavior should be fixed.\n\nSince I\u0026apos;m not sure whether it is safe for imon users to give up upon any\nerror code, this patch takes care of only union of error codes chosen from\nmodules in drivers/media/rc/ directory which handle -EPROTO error (i.e.\nir_toy, mceusb and igorplugusb).\n\nSecond problem is that when usb_rx_callback_intf0() once got -EPROTO error\nbefore ictx-\u0026gt;dev_present_intf0 becomes true, usb_rx_callback_intf0() always\nresubmits urb due to commit 8791d63af0cf (\u0026quot;[media] imon: don\u0026apos;t wedge\nhardware after early callbacks\u0026quot;). Move the ictx-\u0026gt;dev_present_intf0 test\nintroduced by commit 6f6b90c9231a (\u0026quot;[media] imon: don\u0026apos;t parse scancodes\nuntil intf configured\u0026quot;) to immediately before imon_incoming_packet(), or\nthe first problem explained above happens without printk() flooding (i.e.\nhung task).\n\nThird problem is that when usb_rx_callback_intf0() is not called for some\nreason (e.g. flaky hardware; the reproducer for this problem sometimes\nprevents usb_rx_callback_intf0() from being called),\nwait_for_completion_interruptible() in send_packet() never returns (i.e.\nhung task). As a workaround for such situation, change send_packet() to\nwait for completion with timeout of 10 seconds.(CVE-2025-68194)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\npmdomain: arm: scmi: Fix genpd leak on provider registration failure\n\nIf of_genpd_add_provider_onecell() fails during probe, the previously\ncreated generic power domains are not removed, leading to a memory leak\nand potential kernel crash later in genpd_debug_add().\n\nAdd proper error handling to unwind the initialized domains before\nreturning from probe to ensure all resources are correctly released on\nfailure.\n\nExample crash trace observed without this fix:\n\n  | Unable to handle kernel paging request at virtual address fffffffffffffc70\n  | CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.18.0-rc1 #405 PREEMPT\n  | Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform\n  | pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n  | pc : genpd_debug_add+0x2c/0x160\n  | lr : genpd_debug_init+0x74/0x98\n  | Call trace:\n  |  genpd_debug_add+0x2c/0x160 (P)\n  |  genpd_debug_init+0x74/0x98\n  |  do_one_initcall+0xd0/0x2d8\n  |  do_initcall_level+0xa0/0x140\n  |  do_initcalls+0x60/0xa8\n  |  do_basic_setup+0x28/0x40\n  |  kernel_init_freeable+0xe8/0x170\n  |  kernel_init+0x2c/0x140\n  |  ret_from_fork+0x10/0x20(CVE-2025-68204)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmlx5: Fix default values in create CQ\n\nCurrently, CQs without a completion function are assigned the\nmlx5_add_cq_to_tasklet function by default. This is problematic since\nonly user CQs created through the mlx5_ib driver are intended to use\nthis function.\n\nAdditionally, all CQs that will use doorbells instead of polling for\ncompletions must call mlx5_cq_arm. However, the default CQ creation flow\nleaves a valid value in the CQ\u0026apos;s arm_db field, allowing FW to send\ninterrupts to polling-only CQs in certain corner cases.\n\nThese two factors would allow a polling-only kernel CQ to be triggered\nby an EQ interrupt and call a completion function intended only for user\nCQs, causing a null pointer exception.\n\nSome areas in the driver have prevented this issue with one-off fixes\nbut did not address the root cause.\n\nThis patch fixes the described issue by adding defaults to the create CQ\nflow. It adds a default dummy completion function to protect against\nnull pointer exceptions, and it sets an invalid command sequence number\nby default in kernel CQs to prevent the FW from sending an interrupt to\nthe CQ until it is armed. User CQs are responsible for their own\ninitialization values.\n\nCallers of mlx5_core_create_cq are responsible for changing the\ncompletion function and arming the CQ per their needs.(CVE-2025-68209)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nksm: use range-walk function to jump over holes in scan_get_next_rmap_item\n\nCurrently, scan_get_next_rmap_item() walks every page address in a VMA to\nlocate mergeable pages.  This becomes highly inefficient when scanning\nlarge virtual memory areas that contain mostly unmapped regions, causing\nksmd to use large amount of cpu without deduplicating much pages.\n\nThis patch replaces the per-address lookup with a range walk using\nwalk_page_range().  The range walker allows KSM to skip over entire\nunmapped holes in a VMA, avoiding unnecessary lookups.  This problem was\npreviously discussed in [1].\n\nConsider the following test program which creates a 32 TiB mapping in the\nvirtual address space but only populates a single page:\n\n#include \u0026lt;unistd.h\u0026gt;\n#include \u0026lt;stdio.h\u0026gt;\n#include \u0026lt;sys/mman.h\u0026gt;\n\n/* 32 TiB */\nconst size_t size = 32ul * 1024 * 1024 * 1024 * 1024;\n\nint main() {\n        char *area = mmap(NULL, size, PROT_READ | PROT_WRITE,\n                          MAP_NORESERVE | MAP_PRIVATE | MAP_ANON, -1, 0);\n\n        if (area == MAP_FAILED) {\n                perror(\u0026quot;mmap() failed\\n\u0026quot;);\n                return -1;\n        }\n\n        /* Populate a single page such that we get an anon_vma. */\n        *area = 0;\n\n        /* Enable KSM. */\n        madvise(area, size, MADV_MERGEABLE);\n        pause();\n        return 0;\n}\n\n$ ./ksm-sparse  \u0026amp;\n$ echo 1 \u0026gt; /sys/kernel/mm/ksm/run \n\nWithout this patch ksmd uses 100% of the cpu for a long time (more then 1\nhour in my test machine) scanning all the 32 TiB virtual address space\nthat contain only one mapped page.  This makes ksmd essentially deadlocked\nnot able to deduplicate anything of value.  With this patch ksmd walks\nonly the one mapped page and skips the rest of the 32 TiB virtual address\nspace, making the scan fast using little cpu.(CVE-2025-68211)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/mempool: fix poisoning order\u0026gt;0 pages with HIGHMEM\n\nThe kernel test has reported:\n\n  BUG: unable to handle page fault for address: fffba000\n  #PF: supervisor write access in kernel mode\n  #PF: error_code(0x0002) - not-present page\n  *pde = 03171067 *pte = 00000000\n  Oops: Oops: 0002 [#1]\n  CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Tainted: G                T   6.18.0-rc2-00031-gec7f31b2a2d3 #1 NONE  a1d066dfe789f54bc7645c7989957d2bdee593ca\n  Tainted: [T]=RANDSTRUCT\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n  EIP: memset (arch/x86/include/asm/string_32.h:168 arch/x86/lib/memcpy_32.c:17)\n  Code: a5 8b 4d f4 83 e1 03 74 02 f3 a4 83 c4 04 5e 5f 5d 2e e9 73 41 01 00 90 90 90 3e 8d 74 26 00 55 89 e5 57 56 89 c6 89 d0 89 f7 \u0026lt;f3\u0026gt; aa 89 f0 5e 5f 5d 2e e9 53 41 01 00 cc cc cc 55 89 e5 53 57 56\n  EAX: 0000006b EBX: 00000015 ECX: 001fefff EDX: 0000006b\n  ESI: fffb9000 EDI: fffba000 EBP: c611fbf0 ESP: c611fbe8\n  DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 EFLAGS: 00010287\n  CR0: 80050033 CR2: fffba000 CR3: 0316e000 CR4: 00040690\n  Call Trace:\n   poison_element (mm/mempool.c:83 mm/mempool.c:102)\n   mempool_init_node (mm/mempool.c:142 mm/mempool.c:226)\n   mempool_init_noprof (mm/mempool.c:250 (discriminator 1))\n   ? mempool_alloc_pages (mm/mempool.c:640)\n   bio_integrity_initfn (block/bio-integrity.c:483 (discriminator 8))\n   ? mempool_alloc_pages (mm/mempool.c:640)\n   do_one_initcall (init/main.c:1283)\n\nChristoph found out this is due to the poisoning code not dealing\nproperly with CONFIG_HIGHMEM because only the first page is mapped but\nthen the whole potentially high-order page is accessed.\n\nWe could give up on HIGHMEM here, but it\u0026apos;s straightforward to fix this\nwith a loop that\u0026apos;s mapping, poisoning or checking and unmapping\nindividual pages.(CVE-2025-68231)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmtdchar: fix integer overflow in read/write ioctls\n\nThe \u0026quot;req.start\u0026quot; and \u0026quot;req.len\u0026quot; variables are u64 values that come from the\nuser at the start of the function.  We mask away the high 32 bits of\n\u0026quot;req.len\u0026quot; so that\u0026apos;s capped at U32_MAX but the \u0026quot;req.start\u0026quot; variable can go\nup to U64_MAX which means that the addition can still integer overflow.\n\nUse check_add_overflow() to fix this bug.(CVE-2025-68237)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: udc: fix use-after-free in usb_gadget_state_work\n\nA race condition during gadget teardown can lead to a use-after-free\nin usb_gadget_state_work(), as reported by KASAN:\n\n  BUG: KASAN: invalid-access in sysfs_notify+0x2c/0xd0\n  Workqueue: events usb_gadget_state_work\n\nThe fundamental race occurs because a concurrent event (e.g., an\ninterrupt) can call usb_gadget_set_state() and schedule gadget-\u0026gt;work\nat any time during the cleanup process in usb_del_gadget().\n\nCommit 399a45e5237c (\u0026quot;usb: gadget: core: flush gadget workqueue after\ndevice removal\u0026quot;) attempted to fix this by moving flush_work() to after\ndevice_del(). However, this does not fully solve the race, as a new\nwork item can still be scheduled *after* flush_work() completes but\nbefore the gadget\u0026apos;s memory is freed, leading to the same use-after-free.\n\nThis patch fixes the race condition robustly by introducing a \u0026apos;teardown\u0026apos;\nflag and a \u0026apos;state_lock\u0026apos; spinlock to the usb_gadget struct. The flag is\nset during cleanup in usb_del_gadget() *before* calling flush_work() to\nprevent any new work from being scheduled once cleanup has commenced.\nThe scheduling site, usb_gadget_set_state(), now checks this flag under\nthe lock before queueing the work, thus safely closing the race window.(CVE-2025-68282)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/huge_memory: fix NULL pointer deference when splitting folio\n\nCommit c010d47f107f (\u0026quot;mm: thp: split huge page to any lower order pages\u0026quot;)\nintroduced an early check on the folio\u0026apos;s order via mapping-\u0026gt;flags before\nproceeding with the split work.\n\nThis check introduced a bug: for shmem folios in the swap cache and\ntruncated folios, the mapping pointer can be NULL.  Accessing\nmapping-\u0026gt;flags in this state leads directly to a NULL pointer dereference.\n\nThis commit fixes the issue by moving the check for mapping != NULL before\nany attempt to access mapping-\u0026gt;flags.(CVE-2025-68293)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nx86/CPU/AMD: Add RDSEED fix for Zen5\n\nThere\u0026apos;s an issue with RDSEED\u0026apos;s 16-bit and 32-bit register output\nvariants on Zen5 which return a random value of 0 \u0026quot;at a rate inconsistent\nwith randomness while incorrectly signaling success (CF=1)\u0026quot;. Search the\nweb for AMD-SB-7055 for more detail.\n\nAdd a fix glue which checks microcode revisions.\n\n  [ bp: Add microcode revisions checking, rewrite. ](CVE-2025-68313)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ninet: frags: flush pending skbs in fqdir_pre_exit()\n\nWe have been seeing occasional deadlocks on pernet_ops_rwsem since\nSeptember in NIPA. The stuck task was usually modprobe (often loading\na driver like ipvlan), trying to take the lock as a Writer.\nlockdep does not track readers for rwsems so the read wasn\u0026apos;t obvious\nfrom the reports.\n\nOn closer inspection the Reader holding the lock was conntrack looping\nforever in nf_conntrack_cleanup_net_list(). Based on past experience\nwith occasional NIPA crashes I looked thru the tests which run before\nthe crash and noticed that the crash follows ip_defrag.sh. An immediate\nred flag. Scouring thru (de)fragmentation queues reveals skbs sitting\naround, holding conntrack references.\n\nThe problem is that since conntrack depends on nf_defrag_ipv6,\nnf_defrag_ipv6 will load first. Since nf_defrag_ipv6 loads first its\nnetns exit hooks run _after_ conntrack\u0026apos;s netns exit hook.\n\nFlush all fragment queue SKBs during fqdir_pre_exit() to release\nconntrack references before conntrack cleanup runs. Also flush\nthe queues in timer expiry handlers when they discover fqdir-\u0026gt;dead\nis set, in case packet sneaks in while we\u0026apos;re running the pre_exit\nflush.\n\nThe commit under Fixes is not exactly the culprit, but I think\npreviously the timer firing would eventually unblock the spinning\nconntrack.(CVE-2025-68768)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: fix middle attribute validation in push_nsh() action\n\nThe push_nsh() action structure looks like this:\n\n OVS_ACTION_ATTR_PUSH_NSH(OVS_KEY_ATTR_NSH(OVS_NSH_KEY_ATTR_BASE,...))\n\nThe outermost OVS_ACTION_ATTR_PUSH_NSH attribute is OK\u0026apos;ed by the\nnla_for_each_nested() inside __ovs_nla_copy_actions().  The innermost\nOVS_NSH_KEY_ATTR_BASE/MD1/MD2 are OK\u0026apos;ed by the nla_for_each_nested()\ninside nsh_key_put_from_nlattr().  But nothing checks if the attribute\nin the middle is OK.  We don\u0026apos;t even check that this attribute is the\nOVS_KEY_ATTR_NSH.  We just do a double unwrap with a pair of nla_data()\ncalls - first time directly while calling validate_push_nsh() and the\nsecond time as part of the nla_for_each_nested() macro, which isn\u0026apos;t\nsafe, potentially causing invalid memory access if the size of this\nattribute is incorrect.  The failure may not be noticed during\nvalidation due to larger netlink buffer, but cause trouble later during\naction execution where the buffer is allocated exactly to the size:\n\n BUG: KASAN: slab-out-of-bounds in nsh_hdr_from_nlattr+0x1dd/0x6a0 [openvswitch]\n Read of size 184 at addr ffff88816459a634 by task a.out/22624\n\n CPU: 8 UID: 0 PID: 22624 6.18.0-rc7+ #115 PREEMPT(voluntary)\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  dump_stack_lvl+0x51/0x70\n  print_address_description.constprop.0+0x2c/0x390\n  kasan_report+0xdd/0x110\n  kasan_check_range+0x35/0x1b0\n  __asan_memcpy+0x20/0x60\n  nsh_hdr_from_nlattr+0x1dd/0x6a0 [openvswitch]\n  push_nsh+0x82/0x120 [openvswitch]\n  do_execute_actions+0x1405/0x2840 [openvswitch]\n  ovs_execute_actions+0xd5/0x3b0 [openvswitch]\n  ovs_packet_cmd_execute+0x949/0xdb0 [openvswitch]\n  genl_family_rcv_msg_doit+0x1d6/0x2b0\n  genl_family_rcv_msg+0x336/0x580\n  genl_rcv_msg+0x9f/0x130\n  netlink_rcv_skb+0x11f/0x370\n  genl_rcv+0x24/0x40\n  netlink_unicast+0x73e/0xaa0\n  netlink_sendmsg+0x744/0xbf0\n  __sys_sendto+0x3d6/0x450\n  do_syscall_64+0x79/0x2c0\n  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n  \u0026lt;/TASK\u0026gt;\n\nLet\u0026apos;s add some checks that the attribute is properly sized and it\u0026apos;s\nthe only one attribute inside the action.  Technically, there is no\nreal reason for OVS_KEY_ATTR_NSH to be there, as we know that we\u0026apos;re\npushing an NSH header already, it just creates extra nesting, but\nthat\u0026apos;s how uAPI works today.  So, keeping as it is.(CVE-2025-68785)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmedia: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg()\n\nrlen value is a user-controlled value, but dtv5100_i2c_msg() does not\ncheck the size of the rlen value. Therefore, if it is set to a value\nlarger than sizeof(st-\u0026gt;data), an out-of-bounds vuln occurs for st-\u0026gt;data.\n\nTherefore, we need to add proper range checking to prevent this vuln.(CVE-2025-68819)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nInput: alps - fix use-after-free bugs caused by dev3_register_work\n\nThe dev3_register_work delayed work item is initialized within\nalps_reconnect() and scheduled upon receipt of the first bare\nPS/2 packet from an external PS/2 device connected to the ALPS\ntouchpad. During device detachment, the original implementation\ncalls flush_workqueue() in psmouse_disconnect() to ensure\ncompletion of dev3_register_work. However, the flush_workqueue()\nin psmouse_disconnect() only blocks and waits for work items that\nwere already queued to the workqueue prior to its invocation. Any\nwork items submitted after flush_workqueue() is called are not\nincluded in the set of tasks that the flush operation awaits.\nThis means that after flush_workqueue() has finished executing,\nthe dev3_register_work could still be scheduled. Although the\npsmouse state is set to PSMOUSE_CMD_MODE in psmouse_disconnect(),\nthe scheduling of dev3_register_work remains unaffected.\n\nThe race condition can occur as follows:\n\nCPU 0 (cleanup path)     | CPU 1 (delayed work)\npsmouse_disconnect()     |\n  psmouse_set_state()    |\n  flush_workqueue()      | alps_report_bare_ps2_packet()\n  alps_disconnect()      |   psmouse_queue_work()\n    kfree(priv); // FREE | alps_register_bare_ps2_mouse()\n                         |   priv = container_of(work...); // USE\n                         |   priv-\u0026gt;dev3 // USE\n\nAdd disable_delayed_work_sync() in alps_disconnect() to ensure\nthat dev3_register_work is properly canceled and prevented from\nexecuting after the alps_data structure has been deallocated.\n\nThis bug is identified by static analysis.(CVE-2025-68822)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid potential deadlock\n\nAs Jiaming Zhang and syzbot reported, there is potential deadlock in\nf2fs as below:\n\nChain exists of:\n  \u0026amp;sbi-\u0026gt;cp_rwsem --\u0026gt; fs_reclaim --\u0026gt; sb_internal#2\n\n Possible unsafe locking scenario:\n\n       CPU0                    CPU1\n       ----                    ----\n  rlock(sb_internal#2);\n                               lock(fs_reclaim);\n                               lock(sb_internal#2);\n  rlock(\u0026amp;sbi-\u0026gt;cp_rwsem);\n\n *** DEADLOCK ***\n\n3 locks held by kswapd0/73:\n #0: ffffffff8e247a40 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat mm/vmscan.c:7015 [inline]\n #0: ffffffff8e247a40 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0x951/0x2800 mm/vmscan.c:7389\n #1: ffff8880118400e0 (\u0026amp;type-\u0026gt;s_umount_key#50){.+.+}-{4:4}, at: super_trylock_shared fs/super.c:562 [inline]\n #1: ffff8880118400e0 (\u0026amp;type-\u0026gt;s_umount_key#50){.+.+}-{4:4}, at: super_cache_scan+0x91/0x4b0 fs/super.c:197\n #2: ffff888011840610 (sb_internal#2){.+.+}-{0:0}, at: f2fs_evict_inode+0x8d9/0x1b60 fs/f2fs/inode.c:890\n\nstack backtrace:\nCPU: 0 UID: 0 PID: 73 Comm: kswapd0 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\nCall Trace:\n \u0026lt;TASK\u0026gt;\n dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120\n print_circular_bug+0x2ee/0x310 kernel/locking/lockdep.c:2043\n check_noncircular+0x134/0x160 kernel/locking/lockdep.c:2175\n check_prev_add kernel/locking/lockdep.c:3165 [inline]\n check_prevs_add kernel/locking/lockdep.c:3284 [inline]\n validate_chain+0xb9b/0x2140 kernel/locking/lockdep.c:3908\n __lock_acquire+0xab9/0xd20 kernel/locking/lockdep.c:5237\n lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5868\n down_read+0x46/0x2e0 kernel/locking/rwsem.c:1537\n f2fs_down_read fs/f2fs/f2fs.h:2278 [inline]\n f2fs_lock_op fs/f2fs/f2fs.h:2357 [inline]\n f2fs_do_truncate_blocks+0x21c/0x10c0 fs/f2fs/file.c:791\n f2fs_truncate_blocks+0x10a/0x300 fs/f2fs/file.c:867\n f2fs_truncate+0x489/0x7c0 fs/f2fs/file.c:925\n f2fs_evict_inode+0x9f2/0x1b60 fs/f2fs/inode.c:897\n evict+0x504/0x9c0 fs/inode.c:810\n f2fs_evict_inode+0x1dc/0x1b60 fs/f2fs/inode.c:853\n evict+0x504/0x9c0 fs/inode.c:810\n dispose_list fs/inode.c:852 [inline]\n prune_icache_sb+0x21b/0x2c0 fs/inode.c:1000\n super_cache_scan+0x39b/0x4b0 fs/super.c:224\n do_shrink_slab+0x6ef/0x1110 mm/shrinker.c:437\n shrink_slab_memcg mm/shrinker.c:550 [inline]\n shrink_slab+0x7ef/0x10d0 mm/shrinker.c:628\n shrink_one+0x28a/0x7c0 mm/vmscan.c:4955\n shrink_many mm/vmscan.c:5016 [inline]\n lru_gen_shrink_node mm/vmscan.c:5094 [inline]\n shrink_node+0x315d/0x3780 mm/vmscan.c:6081\n kswapd_shrink_node mm/vmscan.c:6941 [inline]\n balance_pgdat mm/vmscan.c:7124 [inline]\n kswapd+0x147c/0x2800 mm/vmscan.c:7389\n kthread+0x70e/0x8a0 kernel/kthread.c:463\n ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n \u0026lt;/TASK\u0026gt;\n\nThe root cause is deadlock among four locks as below:\n\nkswapd\n- fs_reclaim\t\t\t\t--- Lock A\n - shrink_one\n  - evict\n   - f2fs_evict_inode\n    - sb_start_intwrite\t\t\t--- Lock B\n\n- iput\n - evict\n  - f2fs_evict_inode\n   - sb_start_intwrite\t\t\t--- Lock B\n   - f2fs_truncate\n    - f2fs_truncate_blocks\n     - f2fs_do_truncate_blocks\n      - f2fs_lock_op\t\t\t--- Lock C\n\nioctl\n- f2fs_ioc_commit_atomic_write\n - f2fs_lock_op\t\t\t\t--- Lock C\n  - __f2fs_commit_atomic_write\n   - __replace_atomic_write_block\n    - f2fs_get_dnode_of_data\n     - __get_node_folio\n      - f2fs_check_nid_range\n       - f2fs_handle_error\n        - f2fs_record_errors\n         - f2fs_down_write\t\t--- Lock D\n\nopen\n- do_open\n - do_truncate\n  - security_inode_need_killpriv\n   - f2fs_getxattr\n    - lookup_all_xattrs\n     - f2fs_handle_error\n      - f2fs_record_errors\n       - f2fs_down_write\t\t--- Lock D\n        - f2fs_commit_super\n         - read_mapping_folio\n          - filemap_alloc_folio_noprof\n           - prepare_alloc_pages\n            - fs_reclaim_acquire\t--- Lock A\n\nIn order to a\n---truncated---(CVE-2025-71065)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: bound check rq_pages index in inline path\n\nsvc_rdma_copy_inline_range indexed rqstp-\u0026gt;rq_pages[rc_curpage] without\nverifying rc_curpage stays within the allocated page array. Add guards\nbefore the first use and after advancing to a new page.(CVE-2025-71068)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/ttm: Avoid NULL pointer deref for evicted BOs\n\nIt is possible for a BO to exist that is not currently associated with a\nresource, e.g. because it has been evicted.\n\nWhen devcoredump tries to read the contents of all BOs for dumping, we need\nto expect this as well -- in this case, ENODATA is recorded instead of the\nbuffer contents.(CVE-2025-71083)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/cm: Fix leaking the multicast GID table reference\n\nIf the CM ID is destroyed while the CM event for multicast creating is\nstill queued the cancel_work_sync() will prevent the work from running\nwhich also prevents destroying the ah_attr. This leaks a refcount and\ntriggers a WARN:\n\n   GID entry ref leak for dev syz1 index 2 ref=573\n   WARNING: CPU: 1 PID: 655 at drivers/infiniband/core/cache.c:809 release_gid_table drivers/infiniband/core/cache.c:806 [inline]\n   WARNING: CPU: 1 PID: 655 at drivers/infiniband/core/cache.c:809 gid_table_release_one+0x284/0x3cc drivers/infiniband/core/cache.c:886\n\nDestroy the ah_attr after canceling the work, it is safe to call this\ntwice.(CVE-2025-71084)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nteam: fix check for port enabled in team_queue_override_port_prio_changed()\n\nThere has been a syzkaller bug reported recently with the following\ntrace:\n\nlist_del corruption, ffff888058bea080-\u0026gt;prev is LIST_POISON2 (dead000000000122)\n------------[ cut here ]------------\nkernel BUG at lib/list_debug.c:59!\nOops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\nCPU: 3 UID: 0 PID: 21246 Comm: syz.0.2928 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\nRIP: 0010:__list_del_entry_valid_or_report+0x13e/0x200 lib/list_debug.c:59\nCode: 48 c7 c7 e0 71 f0 8b e8 30 08 ef fc 90 0f 0b 48 89 ef e8 a5 02 55 fd 48 89 ea 48 89 de 48 c7 c7 40 72 f0 8b e8 13 08 ef fc 90 \u0026lt;0f\u0026gt; 0b 48 89 ef e8 88 02 55 fd 48 89 ea 48 b8 00 00 00 00 00 fc ff\nRSP: 0018:ffffc9000d49f370 EFLAGS: 00010286\nRAX: 000000000000004e RBX: ffff888058bea080 RCX: ffffc9002817d000\nRDX: 0000000000000000 RSI: ffffffff819becc6 RDI: 0000000000000005\nRBP: dead000000000122 R08: 0000000000000005 R09: 0000000000000000\nR10: 0000000080000000 R11: 0000000000000001 R12: ffff888039e9c230\nR13: ffff888058bea088 R14: ffff888058bea080 R15: ffff888055461480\nFS:  00007fbbcfe6f6c0(0000) GS:ffff8880d6d0a000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000000110c3afcb0 CR3: 00000000382c7000 CR4: 0000000000352ef0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n __list_del_entry_valid include/linux/list.h:132 [inline]\n __list_del_entry include/linux/list.h:223 [inline]\n list_del_rcu include/linux/rculist.h:178 [inline]\n __team_queue_override_port_del drivers/net/team/team_core.c:826 [inline]\n __team_queue_override_port_del drivers/net/team/team_core.c:821 [inline]\n team_queue_override_port_prio_changed drivers/net/team/team_core.c:883 [inline]\n team_priority_option_set+0x171/0x2f0 drivers/net/team/team_core.c:1534\n team_option_set drivers/net/team/team_core.c:376 [inline]\n team_nl_options_set_doit+0x8ae/0xe60 drivers/net/team/team_core.c:2653\n genl_family_rcv_msg_doit+0x209/0x2f0 net/netlink/genetlink.c:1115\n genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]\n genl_rcv_msg+0x55c/0x800 net/netlink/genetlink.c:1210\n netlink_rcv_skb+0x158/0x420 net/netlink/af_netlink.c:2552\n genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219\n netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]\n netlink_unicast+0x5aa/0x870 net/netlink/af_netlink.c:1346\n netlink_sendmsg+0x8c8/0xdd0 net/netlink/af_netlink.c:1896\n sock_sendmsg_nosec net/socket.c:727 [inline]\n __sock_sendmsg net/socket.c:742 [inline]\n ____sys_sendmsg+0xa98/0xc70 net/socket.c:2630\n ___sys_sendmsg+0x134/0x1d0 net/socket.c:2684\n __sys_sendmsg+0x16d/0x220 net/socket.c:2716\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xcd/0xfa0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nThe problem is in this flow:\n1) Port is enabled, queue_id != 0, in qom_list\n2) Port gets disabled\n        -\u0026gt; team_port_disable()\n        -\u0026gt; team_queue_override_port_del()\n        -\u0026gt; del (removed from list)\n3) Port is disabled, queue_id != 0, not in any list\n4) Priority changes\n        -\u0026gt; team_queue_override_port_prio_changed()\n        -\u0026gt; checks: port disabled \u0026amp;\u0026amp; queue_id != 0\n        -\u0026gt; calls del - hits the BUG as it is removed already\n\nTo fix this, change the check in team_queue_override_port_prio_changed()\nso it returns early if port is not enabled.(CVE-2025-71091)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly\n\nThe netlink response for RDMA_NL_LS_OP_IP_RESOLVE should always have a\nLS_NLA_TYPE_DGID attribute, it is invalid if it does not.\n\nUse the nl parsing logic properly and call nla_parse_deprecated() to fill\nthe nlattrs array and then directly index that array to get the data for\nthe DGID. Just fail if it is NULL.\n\nRemove the for loop searching for the nla, and squash the validation and\nparsing into one function.\n\nFixes an uninitialized read from the stack triggered by userspace if it\ndoes not provide the DGID to a kernel initiated RDMA_NL_LS_OP_IP_RESOLVE\nquery.\n\n    BUG: KMSAN: uninit-value in hex_byte_pack include/linux/hex.h:13 [inline]\n    BUG: KMSAN: uninit-value in ip6_string+0xef4/0x13a0 lib/vsprintf.c:1490\n     hex_byte_pack include/linux/hex.h:13 [inline]\n     ip6_string+0xef4/0x13a0 lib/vsprintf.c:1490\n     ip6_addr_string+0x18a/0x3e0 lib/vsprintf.c:1509\n     ip_addr_string+0x245/0xee0 lib/vsprintf.c:1633\n     pointer+0xc09/0x1bd0 lib/vsprintf.c:2542\n     vsnprintf+0xf8a/0x1bd0 lib/vsprintf.c:2930\n     vprintk_store+0x3ae/0x1530 kernel/printk/printk.c:2279\n     vprintk_emit+0x307/0xcd0 kernel/printk/printk.c:2426\n     vprintk_default+0x3f/0x50 kernel/printk/printk.c:2465\n     vprintk+0x36/0x50 kernel/printk/printk_safe.c:82\n     _printk+0x17e/0x1b0 kernel/printk/printk.c:2475\n     ib_nl_process_good_ip_rsep drivers/infiniband/core/addr.c:128 [inline]\n     ib_nl_handle_ip_res_resp+0x963/0x9d0 drivers/infiniband/core/addr.c:141\n     rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:-1 [inline]\n     rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline]\n     rdma_nl_rcv+0xefa/0x11c0 drivers/infiniband/core/netlink.c:259\n     netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]\n     netlink_unicast+0xf04/0x12b0 net/netlink/af_netlink.c:1346\n     netlink_sendmsg+0x10b3/0x1250 net/netlink/af_netlink.c:1896\n     sock_sendmsg_nosec net/socket.c:714 [inline]\n     __sock_sendmsg+0x333/0x3d0 net/socket.c:729\n     ____sys_sendmsg+0x7e0/0xd80 net/socket.c:2617\n     ___sys_sendmsg+0x271/0x3b0 net/socket.c:2671\n     __sys_sendmsg+0x1aa/0x300 net/socket.c:2703\n     __compat_sys_sendmsg net/compat.c:346 [inline]\n     __do_compat_sys_sendmsg net/compat.c:353 [inline]\n     __se_compat_sys_sendmsg net/compat.c:350 [inline]\n     __ia32_compat_sys_sendmsg+0xa4/0x100 net/compat.c:350\n     ia32_sys_call+0x3f6c/0x4310 arch/x86/include/generated/asm/syscalls_32.h:371\n     do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]\n     __do_fast_syscall_32+0xb0/0x150 arch/x86/entry/syscall_32.c:306\n     do_fast_syscall_32+0x38/0x80 arch/x86/entry/syscall_32.c:331\n     do_SYSENTER_32+0x1f/0x30 arch/x86/entry/syscall_32.c:3(CVE-2025-71096)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv4: Fix reference count leak when using error routes with nexthop objects\n\nWhen a nexthop object is deleted, it is marked as dead and then\nfib_table_flush() is called to flush all the routes that are using the\ndead nexthop.\n\nThe current logic in fib_table_flush() is to only flush error routes\n(e.g., blackhole) when it is called as part of network namespace\ndismantle (i.e., with flush_all=true). Therefore, error routes are not\nflushed when their nexthop object is deleted:\n\n # ip link add name dummy1 up type dummy\n # ip nexthop add id 1 dev dummy1\n # ip route add 198.51.100.1/32 nhid 1\n # ip route add blackhole 198.51.100.2/32 nhid 1\n # ip nexthop del id 1\n # ip route show\n blackhole 198.51.100.2 nhid 1 dev dummy1\n\nAs such, they keep holding a reference on the nexthop object which in\nturn holds a reference on the nexthop device, resulting in a reference\ncount leak:\n\n # ip link del dev dummy1\n [   70.516258] unregister_netdevice: waiting for dummy1 to become free. Usage count = 2\n\nFix by flushing error routes when their nexthop is marked as dead.\n\nIPv6 does not suffer from this problem.(CVE-2025-71097)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Avoid walking the Namespace if start_node is NULL\n\nAlthough commit 0c9992315e73 (\u0026quot;ACPICA: Avoid walking the ACPI Namespace\nif it is not there\u0026quot;) fixed the situation when both start_node and\nacpi_gbl_root_node are NULL, the Linux kernel mainline now still crashed\non Honor Magicbook 14 Pro [1].\n\nThat happens due to the access to the member of parent_node in\nacpi_ns_get_next_node().  The NULL pointer dereference will always\nhappen, no matter whether or not the start_node is equal to\nACPI_ROOT_OBJECT, so move the check of start_node being NULL\nout of the if block.\n\nUnfortunately, all the attempts to contact Honor have failed, they\nrefused to provide any technical support for Linux.\n\nThe bad DSDT table\u0026apos;s dump could be found on GitHub [2].\n\nDMI: HONOR FMB-P/FMB-P-PCB, BIOS 1.13 05/08/2025\n\n[ rjw: Subject adjustment, changelog edits ](CVE-2025-71118)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf\n\nA zero length gss_token results in pages == 0 and in_token-\u0026gt;pages[0]\nis NULL. The code unconditionally evaluates\npage_address(in_token-\u0026gt;pages[0]) for the initial memcpy, which can\ndereference NULL even when the copy length is 0. Guard the first\nmemcpy so it only runs when length \u0026gt; 0.(CVE-2025-71120)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: BPF: Sign extend kfunc call arguments\n\nThe kfunc calls are native calls so they should follow LoongArch calling\nconventions. Sign extend its arguments properly to avoid kernel panic.\nThis is done by adding a new emit_abi_ext() helper. The emit_abi_ext()\nhelper performs extension in place meaning a value already store in the\ntarget register (Note: this is different from the existing sign_extend()\nhelper and thus we can\u0026apos;t reuse it).(CVE-2025-71129)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/tilcdc: Fix removal actions in case of failed probe\n\nThe drm_kms_helper_poll_fini() and drm_atomic_helper_shutdown() helpers\nshould only be called when the device has been successfully registered.\nCurrently, these functions are called unconditionally in tilcdc_fini(),\nwhich causes warnings during probe deferral scenarios.\n\n[    7.972317] WARNING: CPU: 0 PID: 23 at drivers/gpu/drm/drm_atomic_state_helper.c:175 drm_atomic_helper_crtc_duplicate_state+0x60/0x68\n...\n[    8.005820]  drm_atomic_helper_crtc_duplicate_state from drm_atomic_get_crtc_state+0x68/0x108\n[    8.005858]  drm_atomic_get_crtc_state from drm_atomic_helper_disable_all+0x90/0x1c8\n[    8.005885]  drm_atomic_helper_disable_all from drm_atomic_helper_shutdown+0x90/0x144\n[    8.005911]  drm_atomic_helper_shutdown from tilcdc_fini+0x68/0xf8 [tilcdc]\n[    8.005957]  tilcdc_fini [tilcdc] from tilcdc_pdev_probe+0xb0/0x6d4 [tilcdc]\n\nFix this by rewriting the failed probe cleanup path using the standard\ngoto error handling pattern, which ensures that cleanup functions are\nonly called on successfully initialized resources. Additionally, remove\nthe now-unnecessary is_registered flag.(CVE-2025-71141)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: stm32: dmamux: fix device leak on route allocation\n\nMake sure to drop the reference taken when looking up the DMA mux\nplatform device during route allocation.\n\nNote that holding a reference to a device does not prevent its driver\ndata from going away so there is no point in keeping the reference.(CVE-2025-71186)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe()\n\nWhen ksmbd_iov_pin_rsp() fails, we should call ksmbd_session_rpc_close().(CVE-2025-71220)\n\nIn the Linux kernel, a race condition vulnerability exists in the mmp_pdma driver. The vulnerability occurs in the mmp_pdma_residue() function which lacks proper locking mechanisms, potentially leading to use-after-free issues when accessing descriptor lists and descriptor contents.\n\nThe race condition occurs when multiple threads call tx_status() while the tasklet on another CPU is freeing completed descriptors. This issue can be reproduced when running dmatest on the same channel with multiple threads (threads_per_chan \u0026gt; 1).\n\nThe fix involves protecting the chain_running list iteration and descriptor access with the chan-\u0026gt;desc_lock spinlock.(CVE-2025-71221)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb/server: fix refcount leak in smb2_open()\n\nWhen ksmbd_vfs_getattr() fails, the reference count of ksmbd_file\nmust be released.(CVE-2025-71223)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmd: suspend array while updating raid_disks via sysfs\n\nIn raid1_reshape(), freeze_array() is called before modifying the r1bio\nmemory pool (conf-\u0026gt;r1bio_pool) and conf-\u0026gt;raid_disks, and\nunfreeze_array() is called after the update is completed.\n\nHowever, freeze_array() only waits until nr_sync_pending and\n(nr_pending - nr_queued) of all buckets reaches zero. When an I/O error\noccurs, nr_queued is increased and the corresponding r1bio is queued to\neither retry_list or bio_end_io_list. As a result, freeze_array() may\nunblock before these r1bios are released.\n\nThis can lead to a situation where conf-\u0026gt;raid_disks and the mempool have\nalready been updated while queued r1bios, allocated with the old\nraid_disks value, are later released. Consequently, free_r1bio() may\naccess memory out of bounds in put_all_bios() and release r1bios of the\nwrong size to the new mempool, potentially causing issues with the\nmempool as well.\n\nSince only normal I/O might increase nr_queued while an I/O error occurs,\nsuspending the array avoids this issue.\n\nNote: Updating raid_disks via ioctl SET_ARRAY_INFO already suspends\nthe array. Therefore, we suspend the array when updating raid_disks\nvia sysfs to avoid this issue too.(CVE-2025-71225)\n\nIn the Linux kernel, the following vulnerability has been resolved:  scsi: qla2xxx: Free sp in error path to fix system crash  System crash seen during load/unload test in a loop,  [61110.449331] qla2xxx [0000:27:00.0]-0042:0: Disabled MSI-X. [61110.467494](CVE-2025-71232)\n\nIn the Linux kernel, there is a race condition vulnerability in the SCSI qla2xxx driver. System crash was observed during load/unload loop testing. The root cause was a memory free operation occurring in interrupt context. When device discovery/fabric scan was in progress and module unload was issued setting the UNLOADING flag, work queue items could not be allocated and mapped memory had to be freed in interrupt context, leading to system crash.(CVE-2025-71235)\n\nA NULL pointer dereference vulnerability exists in the SCSI qla2xxx driver subsystem of the Linux kernel. When the system attempts to free associated memory in the qla_fab_async_scan function, it fails to validate whether the sp pointer is NULL, leading to kernel NULL pointer dereference and system crashes. This vulnerability can be exploited by attackers to cause denial of service.(CVE-2025-71236)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: sock: fix hardened usercopy panic in sock_recv_errqueue\n\nskbuff_fclone_cache was created without defining a usercopy region,\n[1] unlike skbuff_head_cache which properly whitelists the cb[] field.\n[2] This causes a usercopy BUG() when CONFIG_HARDENED_USERCOPY is\nenabled and the kernel attempts to copy sk_buff.cb data to userspace\nvia sock_recv_errqueue() -\u0026gt; put_cmsg().\n\nThe crash occurs when: 1. TCP allocates an skb using alloc_skb_fclone()\n   (from skbuff_fclone_cache) [1]\n2. The skb is cloned via skb_clone() using the pre-allocated fclone\n[3] 3. The cloned skb is queued to sk_error_queue for timestamp\nreporting 4. Userspace reads the error queue via recvmsg(MSG_ERRQUEUE)\n5. sock_recv_errqueue() calls put_cmsg() to copy serr-\u0026gt;ee from skb-\u0026gt;cb\n[4] 6. __check_heap_object() fails because skbuff_fclone_cache has no\n   usercopy whitelist [5]\n\nWhen cloned skbs allocated from skbuff_fclone_cache are used in the\nsocket error queue, accessing the sock_exterr_skb structure in skb-\u0026gt;cb\nvia put_cmsg() triggers a usercopy hardening violation:\n\n[    5.379589] usercopy: Kernel memory exposure attempt detected from SLUB object \u0026apos;skbuff_fclone_cache\u0026apos; (offset 296, size 16)!\n[    5.382796] kernel BUG at mm/usercopy.c:102!\n[    5.383923] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\n[    5.384903] CPU: 1 UID: 0 PID: 138 Comm: poc_put_cmsg Not tainted 6.12.57 #7\n[    5.384903] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\n[    5.384903] RIP: 0010:usercopy_abort+0x6c/0x80\n[    5.384903] Code: 1a 86 51 48 c7 c2 40 15 1a 86 41 52 48 c7 c7 c0 15 1a 86 48 0f 45 d6 48 c7 c6 80 15 1a 86 48 89 c1 49 0f 45 f3 e8 84 27 88 ff \u0026lt;0f\u0026gt; 0b 490\n[    5.384903] RSP: 0018:ffffc900006f77a8 EFLAGS: 00010246\n[    5.384903] RAX: 000000000000006f RBX: ffff88800f0ad2a8 RCX: 1ffffffff0f72e74\n[    5.384903] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff87b973a0\n[    5.384903] RBP: 0000000000000010 R08: 0000000000000000 R09: fffffbfff0f72e74\n[    5.384903] R10: 0000000000000003 R11: 79706f6372657375 R12: 0000000000000001\n[    5.384903] R13: ffff88800f0ad2b8 R14: ffffea00003c2b40 R15: ffffea00003c2b00\n[    5.384903] FS:  0000000011bc4380(0000) GS:ffff8880bf100000(0000) knlGS:0000000000000000\n[    5.384903] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[    5.384903] CR2: 000056aa3b8e5fe4 CR3: 000000000ea26004 CR4: 0000000000770ef0\n[    5.384903] PKRU: 55555554\n[    5.384903] Call Trace:\n[    5.384903]  \u0026lt;TASK\u0026gt;\n[    5.384903]  __check_heap_object+0x9a/0xd0\n[    5.384903]  __check_object_size+0x46c/0x690\n[    5.384903]  put_cmsg+0x129/0x5e0\n[    5.384903]  sock_recv_errqueue+0x22f/0x380\n[    5.384903]  tls_sw_recvmsg+0x7ed/0x1960\n[    5.384903]  ? srso_alias_return_thunk+0x5/0xfbef5\n[    5.384903]  ? schedule+0x6d/0x270\n[    5.384903]  ? srso_alias_return_thunk+0x5/0xfbef5\n[    5.384903]  ? mutex_unlock+0x81/0xd0\n[    5.384903]  ? __pfx_mutex_unlock+0x10/0x10\n[    5.384903]  ? __pfx_tls_sw_recvmsg+0x10/0x10\n[    5.384903]  ? _raw_spin_lock_irqsave+0x8f/0xf0\n[    5.384903]  ? _raw_read_unlock_irqrestore+0x20/0x40\n[    5.384903]  ? srso_alias_return_thunk+0x5/0xfbef5\n\nThe crash offset 296 corresponds to skb2-\u0026gt;cb within skbuff_fclones:\n  - sizeof(struct sk_buff) = 232 - offsetof(struct sk_buff, cb) = 40 -\n  offset of skb2.cb in fclones = 232 + 40 = 272 - crash offset 296 =\n  272 + 24 (inside sock_exterr_skb.ee)\n\nThis patch uses a local stack variable as a bounce buffer to avoid the hardened usercopy check failure.\n\n[1] https://elixir.bootlin.com/linux/v6.12.62/source/net/ipv4/tcp.c#L885\n[2] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5104\n[3] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5566\n[4] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5491\n[5] https://elixir.bootlin.com/linux/v6.12.62/source/mm/slub.c#L5719(CVE-2026-22977)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix memory leak in skb_segment_list for GRO packets\n\nWhen skb_segment_list() is called during packet forwarding, it handles\npackets that were aggregated by the GRO engine.\n\nHistorically, the segmentation logic in skb_segment_list assumes that\nindividual segments are split from a parent SKB and may need to carry\ntheir own socket memory accounting. Accordingly, the code transfers\ntruesize from the parent to the newly created segments.\n\nPrior to commit ed4cccef64c1 (\u0026quot;gro: fix ownership transfer\u0026quot;), this\ntruesize subtraction in skb_segment_list() was valid because fragments\nstill carry a reference to the original socket.\n\nHowever, commit ed4cccef64c1 (\u0026quot;gro: fix ownership transfer\u0026quot;) changed\nthis behavior by ensuring that fraglist entries are explicitly\norphaned (skb-\u0026gt;sk = NULL) to prevent illegal orphaning later in the\nstack. This change meant that the entire socket memory charge remained\nwith the head SKB, but the corresponding accounting logic in\nskb_segment_list() was never updated.\n\nAs a result, the current code unconditionally adds each fragment\u0026apos;s\ntruesize to delta_truesize and subtracts it from the parent SKB. Since\nthe fragments are no longer charged to the socket, this subtraction\nresults in an effective under-count of memory when the head is freed.\nThis causes sk_wmem_alloc to remain non-zero, preventing socket\ndestruction and leading to a persistent memory leak.\n\nThe leak can be observed via KMEMLEAK when tearing down the networking\nenvironment:\n\nunreferenced object 0xffff8881e6eb9100 (size 2048):\n  comm \u0026quot;ping\u0026quot;, pid 6720, jiffies 4295492526\n  backtrace:\n    kmem_cache_alloc_noprof+0x5c6/0x800\n    sk_prot_alloc+0x5b/0x220\n    sk_alloc+0x35/0xa00\n    inet6_create.part.0+0x303/0x10d0\n    __sock_create+0x248/0x640\n    __sys_socket+0x11b/0x1d0\n\nSince skb_segment_list() is exclusively used for SKB_GSO_FRAGLIST\npackets constructed by GRO, the truesize adjustment is removed.\n\nThe call to skb_release_head_state() must be preserved. As documented in\ncommit cf673ed0e057 (\u0026quot;net: fix fraglist segmentation reference count\nleak\u0026quot;), it is still required to correctly drop references to SKB\nextensions that may be overwritten during __copy_skb_header().(CVE-2026-22979)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: prevent potential out-of-bounds reads in handle_auth_done()\n\nPerform an explicit bounds check on payload_len to avoid a possible\nout-of-bounds access in the callout.\n\n[ idryomov: changelog ](CVE-2026-22984)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: make free_choose_arg_map() resilient to partial allocation\n\nfree_choose_arg_map() may dereference a NULL pointer if its caller fails\nafter a partial allocation.\n\nFor example, in decode_choose_args(), if allocation of arg_map-\u0026gt;args\nfails, execution jumps to the fail label and free_choose_arg_map() is\ncalled. Since arg_map-\u0026gt;size is updated to a non-zero value before memory\nallocation, free_choose_arg_map() will iterate over arg_map-\u0026gt;args and\ndereference a NULL pointer.\n\nTo prevent this potential NULL pointer dereference and make\nfree_choose_arg_map() more resilient, add checks for pointers before\niterating.(CVE-2026-22991)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_qfq: do not free existing class in qfq_change_class()\n\nFixes qfq_change_class() error case.\n\ncl-\u0026gt;qdisc and cl should only be freed if a new class and qdisc\nwere allocated, or we risk various UAF.(CVE-2026-22999)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()\n\nBlamed commit did not take care of VLAN encapsulations\nas spotted by syzbot [1].\n\nUse skb_vlan_inet_prepare() instead of pskb_inet_may_pull().\n\n[1]\n BUG: KMSAN: uninit-value in __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline]\n BUG: KMSAN: uninit-value in INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline]\n BUG: KMSAN: uninit-value in IP6_ECN_decapsulate+0x7a8/0x1fa0 include/net/inet_ecn.h:321\n  __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline]\n  INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline]\n  IP6_ECN_decapsulate+0x7a8/0x1fa0 include/net/inet_ecn.h:321\n  ip6ip6_dscp_ecn_decapsulate+0x16f/0x1b0 net/ipv6/ip6_tunnel.c:729\n  __ip6_tnl_rcv+0xed9/0x1b50 net/ipv6/ip6_tunnel.c:860\n  ip6_tnl_rcv+0xc3/0x100 net/ipv6/ip6_tunnel.c:903\n gre_rcv+0x1529/0x1b90 net/ipv6/ip6_gre.c:-1\n  ip6_protocol_deliver_rcu+0x1c89/0x2c60 net/ipv6/ip6_input.c:438\n  ip6_input_finish+0x1f4/0x4a0 net/ipv6/ip6_input.c:489\n  NF_HOOK include/linux/netfilter.h:318 [inline]\n  ip6_input+0x9c/0x330 net/ipv6/ip6_input.c:500\n  ip6_mc_input+0x7ca/0xc10 net/ipv6/ip6_input.c:590\n  dst_input include/net/dst.h:474 [inline]\n  ip6_rcv_finish+0x958/0x990 net/ipv6/ip6_input.c:79\n  NF_HOOK include/linux/netfilter.h:318 [inline]\n  ipv6_rcv+0xf1/0x3c0 net/ipv6/ip6_input.c:311\n  __netif_receive_skb_one_core net/core/dev.c:6139 [inline]\n  __netif_receive_skb+0x1df/0xac0 net/core/dev.c:6252\n  netif_receive_skb_internal net/core/dev.c:6338 [inline]\n  netif_receive_skb+0x57/0x630 net/core/dev.c:6397\n  tun_rx_batched+0x1df/0x980 drivers/net/tun.c:1485\n  tun_get_user+0x5c0e/0x6c60 drivers/net/tun.c:1953\n  tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1999\n  new_sync_write fs/read_write.c:593 [inline]\n  vfs_write+0xbe2/0x15d0 fs/read_write.c:686\n  ksys_write fs/read_write.c:738 [inline]\n  __do_sys_write fs/read_write.c:749 [inline]\n  __se_sys_write fs/read_write.c:746 [inline]\n  __x64_sys_write+0x1fb/0x4d0 fs/read_write.c:746\n  x64_sys_call+0x30ab/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:2\n  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n  do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nUninit was created at:\n  slab_post_alloc_hook mm/slub.c:4960 [inline]\n  slab_alloc_node mm/slub.c:5263 [inline]\n  kmem_cache_alloc_node_noprof+0x9e7/0x17a0 mm/slub.c:5315\n  kmalloc_reserve+0x13c/0x4b0 net/core/skbuff.c:586\n  __alloc_skb+0x805/0x1040 net/core/skbuff.c:690\n  alloc_skb include/linux/skbuff.h:1383 [inline]\n  alloc_skb_with_frags+0xc5/0xa60 net/core/skbuff.c:6712\n  sock_alloc_send_pskb+0xacc/0xc60 net/core/sock.c:2995\n  tun_alloc_skb drivers/net/tun.c:1461 [inline]\n  tun_get_user+0x1142/0x6c60 drivers/net/tun.c:1794\n  tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1999\n  new_sync_write fs/read_write.c:593 [inline]\n  vfs_write+0xbe2/0x15d0 fs/read_write.c:686\n  ksys_write fs/read_write.c:738 [inline]\n  __do_sys_write fs/read_write.c:749 [inline]\n  __se_sys_write fs/read_write.c:746 [inline]\n  __x64_sys_write+0x1fb/0x4d0 fs/read_write.c:746\n  x64_sys_call+0x30ab/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:2\n  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n  do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nCPU: 0 UID: 0 PID: 6465 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(none)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025(CVE-2026-23003)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv6: Fix use-after-free in inet6_addr_del().\n\nsyzbot reported use-after-free of inet6_ifaddr in\ninet6_addr_del(). [0]\n\nThe cited commit accidentally moved ipv6_del_addr() for\nmngtmpaddr before reading its ifp-\u0026gt;flags for temporary\naddresses in inet6_addr_del().\n\nLet\u0026apos;s move ipv6_del_addr() down to fix the UAF.\n\n[0]:\nBUG: KASAN: slab-use-after-free in inet6_addr_del.constprop.0+0x67a/0x6b0 net/ipv6/addrconf.c:3117\nRead of size 4 at addr ffff88807b89c86c by task syz.3.1618/9593\n\nCPU: 0 UID: 0 PID: 9593 Comm: syz.3.1618 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025\nCall Trace:\n \u0026lt;TASK\u0026gt;\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xcd/0x630 mm/kasan/report.c:482\n kasan_report+0xe0/0x110 mm/kasan/report.c:595\n inet6_addr_del.constprop.0+0x67a/0x6b0 net/ipv6/addrconf.c:3117\n addrconf_del_ifaddr+0x11e/0x190 net/ipv6/addrconf.c:3181\n inet6_ioctl+0x1e5/0x2b0 net/ipv6/af_inet6.c:582\n sock_do_ioctl+0x118/0x280 net/socket.c:1254\n sock_ioctl+0x227/0x6b0 net/socket.c:1375\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:597 [inline]\n __se_sys_ioctl fs/ioctl.c:583 [inline]\n __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f164cf8f749\nCode: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f164de64038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\nRAX: ffffffffffffffda RBX: 00007f164d1e5fa0 RCX: 00007f164cf8f749\nRDX: 0000200000000000 RSI: 0000000000008936 RDI: 0000000000000003\nRBP: 00007f164d013f91 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 00007f164d1e6038 R14: 00007f164d1e5fa0 R15: 00007ffde15c8288\n \u0026lt;/TASK\u0026gt;\n\nAllocated by task 9593:\n kasan_save_stack+0x33/0x60 mm/kasan/common.c:56\n kasan_save_track+0x14/0x30 mm/kasan/common.c:77\n poison_kmalloc_redzone mm/kasan/common.c:397 [inline]\n __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:414\n kmalloc_noprof include/linux/slab.h:957 [inline]\n kzalloc_noprof include/linux/slab.h:1094 [inline]\n ipv6_add_addr+0x4e3/0x2010 net/ipv6/addrconf.c:1120\n inet6_addr_add+0x256/0x9b0 net/ipv6/addrconf.c:3050\n addrconf_add_ifaddr+0x1fc/0x450 net/ipv6/addrconf.c:3160\n inet6_ioctl+0x103/0x2b0 net/ipv6/af_inet6.c:580\n sock_do_ioctl+0x118/0x280 net/socket.c:1254\n sock_ioctl+0x227/0x6b0 net/socket.c:1375\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:597 [inline]\n __se_sys_ioctl fs/ioctl.c:583 [inline]\n __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFreed by task 6099:\n kasan_save_stack+0x33/0x60 mm/kasan/common.c:56\n kasan_save_track+0x14/0x30 mm/kasan/common.c:77\n kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:584\n poison_slab_object mm/kasan/common.c:252 [inline]\n __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:284\n kasan_slab_free include/linux/kasan.h:234 [inline]\n slab_free_hook mm/slub.c:2540 [inline]\n slab_free_freelist_hook mm/slub.c:2569 [inline]\n slab_free_bulk mm/slub.c:6696 [inline]\n kmem_cache_free_bulk mm/slub.c:7383 [inline]\n kmem_cache_free_bulk+0x2bf/0x680 mm/slub.c:7362\n kfree_bulk include/linux/slab.h:830 [inline]\n kvfree_rcu_bulk+0x1b7/0x1e0 mm/slab_common.c:1523\n kvfree_rcu_drain_ready mm/slab_common.c:1728 [inline]\n kfree_rcu_monitor+0x1d0/0x2f0 mm/slab_common.c:1801\n process_one_work+0x9ba/0x1b20 kernel/workqueue.c:3257\n process_scheduled_works kernel/workqu\n---truncated---(CVE-2026-23010)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv4: ip_gre: make ipgre_header() robust\n\nAnalog to commit db5b4e39c4e6 (\u0026quot;ip6_gre: make ip6gre_header() robust\u0026quot;)\n\nOver the years, syzbot found many ways to crash the kernel\nin ipgre_header() [1].\n\nThis involves team or bonding drivers ability to dynamically\nchange their dev-\u0026gt;needed_headroom and/or dev-\u0026gt;hard_header_len\n\nIn this particular crash mld_newpack() allocated an skb\nwith a too small reserve/headroom, and by the time mld_sendpack()\nwas called, syzbot managed to attach an ipgre device.\n\n[1]\nskbuff: skb_under_panic: text:ffffffff89ea3cb7 len:2030915468 put:2030915372 head:ffff888058b43000 data:ffff887fdfa6e194 tail:0x120 end:0x6c0 dev:team0\n kernel BUG at net/core/skbuff.c:213 !\nOops: invalid opcode: 0000 [#1] SMP KASAN PTI\nCPU: 1 UID: 0 PID: 1322 Comm: kworker/1:9 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025\nWorkqueue: mld mld_ifc_work\n RIP: 0010:skb_panic+0x157/0x160 net/core/skbuff.c:213\nCall Trace:\n \u0026lt;TASK\u0026gt;\n  skb_under_panic net/core/skbuff.c:223 [inline]\n  skb_push+0xc3/0xe0 net/core/skbuff.c:2641\n  ipgre_header+0x67/0x290 net/ipv4/ip_gre.c:897\n  dev_hard_header include/linux/netdevice.h:3436 [inline]\n  neigh_connected_output+0x286/0x460 net/core/neighbour.c:1618\n  NF_HOOK_COND include/linux/netfilter.h:307 [inline]\n  ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247\n  NF_HOOK+0x9e/0x380 include/linux/netfilter.h:318\n  mld_sendpack+0x8d4/0xe60 net/ipv6/mcast.c:1855\n  mld_send_cr net/ipv6/mcast.c:2154 [inline]\n  mld_ifc_work+0x83e/0xd60 net/ipv6/mcast.c:2693\n  process_one_work kernel/workqueue.c:3257 [inline]\n  process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340\n  worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421\n  kthread+0x711/0x8a0 kernel/kthread.c:463\n  ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158\n  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246(CVE-2026-23011)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: pegasus: fix memory leak in update_eth_regs_async()\n\nWhen asynchronously writing to the device registers and if usb_submit_urb()\nfail, the code fail to release allocated to this point resources.(CVE-2026-23021)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/page_alloc: prevent pcp corruption with SMP=n\n\nThe kernel test robot has reported:\n\n BUG: spinlock trylock failure on UP on CPU#0, kcompactd0/28\n  lock: 0xffff888807e35ef0, .magic: dead4ead, .owner: kcompactd0/28, .owner_cpu: 0\n CPU: 0 UID: 0 PID: 28 Comm: kcompactd0 Not tainted 6.18.0-rc5-00127-ga06157804399 #1 PREEMPT  8cc09ef94dcec767faa911515ce9e609c45db470\n Call Trace:\n  \u0026lt;IRQ\u0026gt;\n  __dump_stack (lib/dump_stack.c:95)\n  dump_stack_lvl (lib/dump_stack.c:123)\n  dump_stack (lib/dump_stack.c:130)\n  spin_dump (kernel/locking/spinlock_debug.c:71)\n  do_raw_spin_trylock (kernel/locking/spinlock_debug.c:?)\n  _raw_spin_trylock (include/linux/spinlock_api_smp.h:89 kernel/locking/spinlock.c:138)\n  __free_frozen_pages (mm/page_alloc.c:2973)\n  ___free_pages (mm/page_alloc.c:5295)\n  __free_pages (mm/page_alloc.c:5334)\n  tlb_remove_table_rcu (include/linux/mm.h:? include/linux/mm.h:3122 include/asm-generic/tlb.h:220 mm/mmu_gather.c:227 mm/mmu_gather.c:290)\n  ? __cfi_tlb_remove_table_rcu (mm/mmu_gather.c:289)\n  ? rcu_core (kernel/rcu/tree.c:?)\n  rcu_core (include/linux/rcupdate.h:341 kernel/rcu/tree.c:2607 kernel/rcu/tree.c:2861)\n  rcu_core_si (kernel/rcu/tree.c:2879)\n  handle_softirqs (arch/x86/include/asm/jump_label.h:36 include/trace/events/irq.h:142 kernel/softirq.c:623)\n  __irq_exit_rcu (arch/x86/include/asm/jump_label.h:36 kernel/softirq.c:725)\n  irq_exit_rcu (kernel/softirq.c:741)\n  sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1052)\n  \u0026lt;/IRQ\u0026gt;\n  \u0026lt;TASK\u0026gt;\n RIP: 0010:_raw_spin_unlock_irqrestore (arch/x86/include/asm/preempt.h:95 include/linux/spinlock_api_smp.h:152 kernel/locking/spinlock.c:194)\n  free_pcppages_bulk (mm/page_alloc.c:1494)\n  drain_pages_zone (include/linux/spinlock.h:391 mm/page_alloc.c:2632)\n  __drain_all_pages (mm/page_alloc.c:2731)\n  drain_all_pages (mm/page_alloc.c:2747)\n  kcompactd (mm/compaction.c:3115)\n  kthread (kernel/kthread.c:465)\n  ? __cfi_kcompactd (mm/compaction.c:3166)\n  ? __cfi_kthread (kernel/kthread.c:412)\n  ret_from_fork (arch/x86/kernel/process.c:164)\n  ? __cfi_kthread (kernel/kthread.c:412)\n  ret_from_fork_asm (arch/x86/entry/entry_64.S:255)\n  \u0026lt;/TASK\u0026gt;\n\nMatthew has analyzed the report and identified that in drain_page_zone()\nwe are in a section protected by spin_lock(\u0026amp;pcp-\u0026gt;lock) and then get an\ninterrupt that attempts spin_trylock() on the same lock.  The code is\ndesigned to work this way without disabling IRQs and occasionally fail the\ntrylock with a fallback.  However, the SMP=n spinlock implementation\nassumes spin_trylock() will always succeed, and thus it\u0026apos;s normally a\nno-op.  Here the enabled lock debugging catches the problem, but otherwise\nit could cause a corruption of the pcp structure.\n\nThe problem has been introduced by commit 574907741599 (\u0026quot;mm/page_alloc:\nleave IRQs enabled for per-cpu page allocations\u0026quot;).  The pcp locking scheme\nrecognizes the need for disabling IRQs to prevent nesting spin_trylock()\nsections on SMP=n, but the need to prevent the nesting in spin_lock() has\nnot been recognized.  Fix it by introducing local wrappers that change the\nspin_lock() to spin_lock_iqsave() with SMP=n and use them in all places\nthat do spin_lock(\u0026amp;pcp-\u0026gt;lock).\n\n[(CVE-2026-23025)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnull_blk: fix kmemleak by releasing references to fault configfs items\n\nWhen CONFIG_BLK_DEV_NULL_BLK_FAULT_INJECTION is enabled, the null-blk\ndriver sets up fault injection support by creating the timeout_inject,\nrequeue_inject, and init_hctx_fault_inject configfs items as children\nof the top-level nullbX configfs group.\n\nHowever, when the nullbX device is removed, the references taken to\nthese fault-config configfs items are not released. As a result,\nkmemleak reports a memory leak, for example:\n\nunreferenced object 0xc00000021ff25c40 (size 32):\n  comm \u0026quot;mkdir\u0026quot;, pid 10665, jiffies 4322121578\n  hex dump (first 32 bytes):\n    69 6e 69 74 5f 68 63 74 78 5f 66 61 75 6c 74 5f  init_hctx_fault_\n    69 6e 6a 65 63 74 00 88 00 00 00 00 00 00 00 00  inject..........\n  backtrace (crc 1a018c86):\n    __kmalloc_node_track_caller_noprof+0x494/0xbd8\n    kvasprintf+0x74/0xf4\n    config_item_set_name+0xf0/0x104\n    config_group_init_type_name+0x48/0xfc\n    fault_config_init+0x48/0xf0\n    0xc0080000180559e4\n    configfs_mkdir+0x304/0x814\n    vfs_mkdir+0x49c/0x604\n    do_mkdirat+0x314/0x3d0\n    sys_mkdir+0xa0/0xd8\n    system_call_exception+0x1b0/0x4f0\n    system_call_vectored_common+0x15c/0x2ec\n\nFix this by explicitly releasing the references to the fault-config\nconfigfs items when dropping the reference to the top-level nullbX\nconfigfs group.(CVE-2026-23032)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\npnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()\n\nIn nfs4_ff_alloc_deviceid_node(), if the allocation for ds_versions fails,\nthe function jumps to the out_scratch label without freeing the already\nallocated dsaddrs list, leading to a memory leak.\n\nFix this by jumping to the out_err_drain_dsaddrs label, which properly\nfrees the dsaddrs list before cleaning up other resources.(CVE-2026-23038)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: make calc_target() set t-\u0026gt;paused, not just clear it\n\nCurrently calc_target() clears t-\u0026gt;paused if the request shouldn\u0026apos;t be\npaused anymore, but doesn\u0026apos;t ever set t-\u0026gt;paused even though it\u0026apos;s able to\ndetermine when the request should be paused.  Setting t-\u0026gt;paused is left\nto __submit_request() which is fine for regular requests but doesn\u0026apos;t\nwork for linger requests -- since __submit_request() doesn\u0026apos;t operate\non linger requests, there is nowhere for lreq-\u0026gt;t.paused to be set.\nOne consequence of this is that watches don\u0026apos;t get reestablished on\npaused -\u0026gt; unpaused transitions in cases where requests have been paused\nlong enough for the (paused) unwatch request to time out and for the\nsubsequent (re)watch request to enter the paused state.  On top of the\nwatch not getting reestablished, rbd_reregister_watch() gets stuck with\nrbd_dev-\u0026gt;watch_mutex held:\n\n  rbd_register_watch\n    __rbd_register_watch\n      ceph_osdc_watch\n        linger_reg_commit_wait\n\nIt\u0026apos;s waiting for lreq-\u0026gt;reg_commit_wait to be completed, but for that to\nhappen the respective request needs to end up on need_resend_linger list\nand be kicked when requests are unpaused.  There is no chance for that\nif the request in question is never marked paused in the first place.\n\nThe fact that rbd_dev-\u0026gt;watch_mutex remains taken out forever then\nprevents the image from getting unmapped -- \u0026quot;rbd unmap\u0026quot; would inevitably\nhang in D state on an attempt to grab the mutex.(CVE-2026-23047)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\npNFS: Fix a deadlock when returning a delegation during open()\n\nBen Coddington reports seeing a hang in the following stack trace:\n  0 [ffffd0b50e1774e0] __schedule at ffffffff9ca05415\n  1 [ffffd0b50e177548] schedule at ffffffff9ca05717\n  2 [ffffd0b50e177558] bit_wait at ffffffff9ca061e1\n  3 [ffffd0b50e177568] __wait_on_bit at ffffffff9ca05cfb\n  4 [ffffd0b50e1775c8] out_of_line_wait_on_bit at ffffffff9ca05ea5\n  5 [ffffd0b50e177618] pnfs_roc at ffffffffc154207b [nfsv4]\n  6 [ffffd0b50e1776b8] _nfs4_proc_delegreturn at ffffffffc1506586 [nfsv4]\n  7 [ffffd0b50e177788] nfs4_proc_delegreturn at ffffffffc1507480 [nfsv4]\n  8 [ffffd0b50e1777f8] nfs_do_return_delegation at ffffffffc1523e41 [nfsv4]\n  9 [ffffd0b50e177838] nfs_inode_set_delegation at ffffffffc1524a75 [nfsv4]\n 10 [ffffd0b50e177888] nfs4_process_delegation at ffffffffc14f41dd [nfsv4]\n 11 [ffffd0b50e1778a0] _nfs4_opendata_to_nfs4_state at ffffffffc1503edf [nfsv4]\n 12 [ffffd0b50e1778c0] _nfs4_open_and_get_state at ffffffffc1504e56 [nfsv4]\n 13 [ffffd0b50e177978] _nfs4_do_open at ffffffffc15051b8 [nfsv4]\n 14 [ffffd0b50e1779f8] nfs4_do_open at ffffffffc150559c [nfsv4]\n 15 [ffffd0b50e177a80] nfs4_atomic_open at ffffffffc15057fb [nfsv4]\n 16 [ffffd0b50e177ad0] nfs4_file_open at ffffffffc15219be [nfsv4]\n 17 [ffffd0b50e177b78] do_dentry_open at ffffffff9c09e6ea\n 18 [ffffd0b50e177ba8] vfs_open at ffffffff9c0a082e\n 19 [ffffd0b50e177bd0] dentry_open at ffffffff9c0a0935\n\nThe issue is that the delegreturn is being asked to wait for a layout\nreturn that cannot complete because a state recovery was initiated. The\nstate recovery cannot complete until the open() finishes processing the\ndelegations it was given.\n\nThe solution is to propagate the existing flags that indicate a\nnon-blocking call to the function pnfs_roc(), so that it knows not to\nwait in this situation.(CVE-2026-23050)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: hv_netvsc: reject RSS hash key programming without RX indirection table\n\nRSS configuration requires a valid RX indirection table. When the device\nreports a single receive queue, rndis_filter_device_add() does not\nallocate an indirection table, accepting RSS hash key updates in this\nstate leads to a hang.\n\nFix this by gating netvsc_set_rxfh() on ndc-\u0026gt;rx_table_sz and return\n-EOPNOTSUPP when the table is absent. This aligns set_rxfh with the device\ncapabilities and prevents incorrect behavior.(CVE-2026-23054)\n\nA buffer overflow vulnerability exists in the QLogic Fibre Channel driver (qla2xxx) of the Linux kernel. In the functions `qla27xx_copy_fpin_pkt()` and `qla27xx_copy_multiple_pkt()`, the code uses the firmware-reported `frame_size` to calculate the copy length into `item-\u0026gt;iocb`. However, the `iocb` member is defined as a fixed-size 64-byte array within `struct purex_item`. If the reported `frame_size` exceeds 64 bytes, subsequent `memcpy` calls will overflow the boundary of the `iocb` member. This cross-member write is unsafe and can lead to memory corruption, potentially exploitable to compromise the confidentiality, integrity, and availability of the kernel.(CVE-2026-23059)\n\nA NULL pointer dereference vulnerability exists in the be2net network driver within the Linux kernel, specifically in the be_cmd_get_mac_from_list() function. According to the function\u0026apos;s contract, when the parameter pmac_id_valid is set to false, the driver may request a PMAC_ID from the network card\u0026apos;s firmware and store it at the provided address pmac_id. However, there is a location within the driver where both conditions pmac_id_valid == false and pmac_id == NULL are passed simultaneously. This results in an attempt to dereference a NULL pointer, potentially leading to a kernel crash or system instability.(CVE-2026-23084)\n\nA memory address truncation vulnerability exists in the irqchip/gic-v3-its driver of the Linux kernel. On 32-bit ARM machines with CONFIG_ARM_LPAE enabled, when using larger VMSPLIT configurations, lowmem allocations may be backed by physical memory addresses above the 32-bit address limit. The GICv3 driver allocates the \u0026apos;itt\u0026apos; object using GFP_KERNEL. Since all memory below the 4GB physical address limit is in ZONE_DMA in this configuration, kmalloc() defaults to higher addresses in ZONE_NORMAL. However, the driver stores these physical addresses in 32-bit \u0026apos;unsigned long\u0026apos; variables, causing the high addresses to be truncated, which leads to system crashes.(CVE-2026-23085)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nuacce: fix isolate sysfs check condition\n\nuacce supports the device isolation feature. If the driver\nimplements the isolate_err_threshold_read and\nisolate_err_threshold_write callback functions, uacce will create\nsysfs files now. Users can read and configure the isolation policy\nthrough sysfs. Currently, sysfs files are created as long as either\nisolate_err_threshold_read or isolate_err_threshold_write callback\nfunctions are present.\n\nHowever, accessing a non-existent callback function may cause the\nsystem to crash. Therefore, intercept the creation of sysfs if\nneither read nor write exists; create sysfs if either is supported,\nbut intercept unsupported operations at the call site.(CVE-2026-23094)\n\nA deadlock vulnerability exists in the Linux kernel due to incorrect lock acquisition ordering. This vulnerability affects the migration functionality for hugetlb (huge page) file folios. The specific scenario is: when two kernel tasks (Tasks) attempt to acquire the `folio_lock` and `i_mmap_rwsem` locks in opposite orders, a circular wait is formed, leading to a system deadlock. For example, Task A holds `folio_lock` and then tries to acquire the `i_mmap_rwsem` read lock, while Task B holds the `i_mmap_rwsem` write lock and then tries to acquire `folio_lock`. This lock ordering violates the rules defined in mm/rmap.c. This vulnerability can render parts of the affected system unavailable, impacting system availability.(CVE-2026-23097)\n\nIn the Linux kernel SCSI core layer, there is a fragile ordering logic between marking commands as completed or failed, designed to ensure the error handler only wakes when the last running command completes or times out. This logic contains race conditions. These race conditions can cause the SCSI layer to fail to wake the error handler, leaving I/O through the SCSI host stuck as the error state cannot advance. Specifically, there are two issues: 1. A memory ordering issue within the `scsi_dec_host_busy()` function. The write operation that clears the `SCMD_STATE_INFLIGHT` flag may be reordered with read counting operations in `scsi_host_busy()`. This can cause other CPUs to see inconsistent busy counts, preventing the correct triggering of the error handler wake-up. 2. A general ordering issue with the `scsi_eh_inc_host_failed()` function. It counts busy commands before incrementing the `host_failed` count, which can race with the processing of a final command in `scsi_dec_host_busy()`, resulting in neither side waking the error handler task.(CVE-2026-23110)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec\n\nnvmet_tcp_build_pdu_iovec() could walk past cmd-\u0026gt;req.sg when a PDU\nlength or offset exceeds sg_cnt and then use bogus sg-\u0026gt;length/offset\nvalues, leading to _copy_to_iter() GPF/KASAN. Guard sg_idx, remaining\nentries, and sg-\u0026gt;length/offset before building the bvec.(CVE-2026-23112)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove\n\nOn APUs such as Raven and Renoir (GC 9.1.0, 9.2.2, 9.3.0), the ih1 and\nih2 interrupt ring buffers are not initialized. This is by design, as\nthese secondary IH rings are only available on discrete GPUs. See\nvega10_ih_sw_init() which explicitly skips ih1/ih2 initialization when\nAMD_IS_APU is set.\n\nHowever, amdgpu_gmc_filter_faults_remove() unconditionally uses ih1 to\nget the timestamp of the last interrupt entry. When retry faults are\nenabled on APUs (noretry=0), this function is called from the SVM page\nfault recovery path, resulting in a NULL pointer dereference when\namdgpu_ih_decode_iv_ts_helper() attempts to access ih-\u0026gt;ring[].\n\nThe crash manifests as:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000004\n  RIP: 0010:amdgpu_ih_decode_iv_ts_helper+0x22/0x40 [amdgpu]\n  Call Trace:\n   amdgpu_gmc_filter_faults_remove+0x60/0x130 [amdgpu]\n   svm_range_restore_pages+0xae5/0x11c0 [amdgpu]\n   amdgpu_vm_handle_fault+0xc8/0x340 [amdgpu]\n   gmc_v9_0_process_interrupt+0x191/0x220 [amdgpu]\n   amdgpu_irq_dispatch+0xed/0x2c0 [amdgpu]\n   amdgpu_ih_process+0x84/0x100 [amdgpu]\n\nThis issue was exposed by commit 1446226d32a4 (\u0026quot;drm/amdgpu: Remove GC HW\nIP 9.3.0 from noretry=1\u0026quot;) which changed the default for Renoir APU from\nnoretry=1 to noretry=0, enabling retry fault handling and thus\nexercising the buggy code path.\n\nFix this by adding a check for ih1.ring_size before attempting to use\nit. Also restore the soft_ih support from commit dd299441654f (\u0026quot;drm/amdgpu:\nRework retry fault removal\u0026quot;).  This is needed if the hardware doesn\u0026apos;t\nsupport secondary HW IH rings.\n\nv2: additional updates (Alex)\n\n(cherry picked from commit 6ce8d536c80aa1f059e82184f0d1994436b1d526)(CVE-2026-23163)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready()\n\nWhen the socket is closed while in TCP_LISTEN a callback is run to\nflush all outstanding packets, which in turns calls\nnvmet_tcp_listen_data_ready() with the sk_callback_lock held.\nSo we need to check if we are in TCP_LISTEN before attempting\nto get the sk_callback_lock() to avoid a deadlock.(CVE-2026-23179)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nASoC: amd: fix memory leak in acp3x pdm dma ops(CVE-2026-23190)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()\n\nIn iscsit_dec_session_usage_count(), the function calls complete() while\nholding the sess-\u0026gt;session_usage_lock. Similar to the connection usage count\nlogic, the waiter signaled by complete() (e.g., in the session release\npath) may wake up and free the iscsit_session structure immediately.\n\nThis creates a race condition where the current thread may attempt to\nexecute spin_unlock_bh() on a session structure that has already been\ndeallocated, resulting in a KASAN slab-use-after-free.\n\nTo resolve this, release the session_usage_lock before calling complete()\nto ensure all dereferences of the sess pointer are finished before the\nwaiter is allowed to proceed with deallocation.(CVE-2026-23193)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb/client: fix memory leak in smb2_open_file()\n\nReproducer:\n\n  1. server: directories are exported read-only\n  2. client: mount -t cifs //${server_ip}/export /mnt\n  3. client: dd if=/dev/zero of=/mnt/file bs=512 count=1000 oflag=direct\n  4. client: umount /mnt\n  5. client: sleep 1\n  6. client: modprobe -r cifs\n\nThe error message is as follows:\n\n  =============================================================================\n  BUG cifs_small_rq (Not tainted): Objects remaining on __kmem_cache_shutdown()\n  -----------------------------------------------------------------------------\n\n  Object 0x00000000d47521be @offset=14336\n  ...\n  WARNING: mm/slub.c:1251 at __kmem_cache_shutdown+0x34e/0x440, CPU#0: modprobe/1577\n  ...\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   kmem_cache_destroy+0x94/0x190\n   cifs_destroy_request_bufs+0x3e/0x50 [cifs]\n   cleanup_module+0x4e/0x540 [cifs]\n   __se_sys_delete_module+0x278/0x400\n   __x64_sys_delete_module+0x5f/0x70\n   x64_sys_call+0x2299/0x2ff0\n   do_syscall_64+0x89/0x350\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n  ...\n  kmem_cache_destroy cifs_small_rq: Slab cache still has objects when called from cifs_destroy_request_bufs+0x3e/0x50 [cifs]\n  WARNING: mm/slab_common.c:532 at kmem_cache_destroy+0x16b/0x190, CPU#0: modprobe/1577(CVE-2026-23205)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()\n\nIn iscsit_dec_conn_usage_count(), the function calls complete() while\nholding the conn-\u0026gt;conn_usage_lock. As soon as complete() is invoked, the\nwaiter (such as iscsit_close_connection()) may wake up and proceed to free\nthe iscsit_conn structure.\n\nIf the waiter frees the memory before the current thread reaches\nspin_unlock_bh(), it results in a KASAN slab-use-after-free as the function\nattempts to release a lock within the already-freed connection structure.\n\nFix this by releasing the spinlock before calling complete().(CVE-2026-23216)\n\nIn the Linux kernel, the ksmbd component contains an infinite loop vulnerability. The problem occurs when a signed request fails smb2 signature verification check. In __process_request(), if check_sign_req() returns an error, set_smb2_rsp_status(work, STATUS_ACCESS_DENIED) is called. set_smb2_rsp_status() sets work-\u0026gt;next_smb2_rcv_hdr_off to zero. By resetting next_smb2_rcv_hdr_off to zero, the pointer to the next command in the chain is lost. Consequently, is_chained_smb2_message() continues to point to the same request header instead of advancing. If the header\u0026apos;s NextCommand field is non-zero, the function returns true, causing __handle_ksmbd_work() to repeatedly process the same failed request in an infinite loop. This results in the kernel log being flooded with \u0026quot;bad smb2 signature\u0026quot; messages and high CPU usage.(CVE-2026-23220)\n\nIn the Linux kernel, the following vulnerability has been resolved:  smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection()  On kthread_run() failure in ksmbd_tcp_new_connection(), the transport is freed via free_transport(), which does not decrement active_num_conn, leaking this counter.  Replace free_transport() with ksmbd_tcp_disconnect().  The Linux kernel CVE team has assigned CVE-2026-23228 to this issue.(CVE-2026-23228)","status":"published","published":"2026-03-15T11:10:34Z","modified":"2026-08-18T01:19:37.727225213Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1567","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nudp: Deal with race between UDP socket address change and rehash\n\nIf a UDP socket changes its local address while it\u0026apos;s receiving\ndatagrams, as a result of connect(), there is a period during which\na lookup operation might fail to find it, after the address is changed\nbut before the secondary hash (port and address) and the four-tuple\nhash (local and remote ports and addresses) are updated.\n\nSecondary hash chains were introduced by commit 30fff9231fad (\u0026quot;udp:\nbind() optimisation\u0026quot;) and, as a result, a rehash operation became\nneeded to make a bound socket reachable again after a connect().\n\nThis operation was introduced by commit 719f835853a9 (\u0026quot;udp: add\nrehash on connect()\u0026quot;) which isn\u0026apos;t however a complete fix: the\nsocket will be found once the rehashing completes, but not while\nit\u0026apos;s pending.\n\nThis is noticeable with a socat(1) server in UDP4-LISTEN mode, and a\nclient sending datagrams to it. After the server receives the first\ndatagram (cf. _xioopen_ipdgram_listen()), it issues a connect() to\nthe address of the sender, in order to set up a directed flow.\n\nNow, if the client, running on a different CPU thread, happens to\nsend a (subsequent) datagram while the server\u0026apos;s socket changes its\naddress, but is not rehashed yet, this will result in a failed\nlookup and a port unreachable error delivered to the client, as\napparent from the following reproducer:\n\n  LEN=$(($(cat /proc/sys/net/core/wmem_default) / 4))\n  dd if=/dev/urandom bs=1 count=${LEN} of=tmp.in\n\n  while :; do\n  \ttaskset -c 1 socat UDP4-LISTEN:1337,null-eof OPEN:tmp.out,create,trunc \u0026amp;\n  \tsleep 0.1 || sleep 1\n  \ttaskset -c 2 socat OPEN:tmp.in UDP4:localhost:1337,shut-null\n  \twait\n  done\n\nwhere the client will eventually get ECONNREFUSED on a write()\n(typically the second or third one of a given iteration):\n\n  2024/11/13 21:28:23 socat[46901] E write(6, 0x556db2e3c000, 8192): Connection refused\n\nThis issue was first observed as a seldom failure in Podman\u0026apos;s tests\nchecking UDP functionality while using pasta(1) to connect the\ncontainer\u0026apos;s network namespace, which leads us to a reproducer with\nthe lookup error resulting in an ICMP packet on a tap device:\n\n  LOCAL_ADDR=\u0026quot;$(ip -j -4 addr show|jq -rM \u0026apos;.[] | .addr_info[0] | select(.scope == \u0026quot;global\u0026quot;).local\u0026apos;)\u0026quot;\n\n  while :; do\n  \t./pasta --config-net -p pasta.pcap -u 1337 socat UDP4-LISTEN:1337,null-eof OPEN:tmp.out,create,trunc \u0026amp;\n  \tsleep 0.2 || sleep 1\n  \tsocat OPEN:tmp.in UDP4:${LOCAL_ADDR}:1337,shut-null\n  \twait\n  \tcmp tmp.in tmp.out\n  done\n\nOnce this fails:\n\n  tmp.in tmp.out differ: char 8193, line 29\n\nwe can finally have a look at what\u0026apos;s going on:\n\n  $ tshark -r pasta.pcap\n      1   0.000000           :: ? ff02::16     ICMPv6 110 Multicast Listener Report Message v2\n      2   0.168690 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192\n      3   0.168767 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192\n      4   0.168806 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192\n      5   0.168827 c6:47:05:8d:dc:04 ? Broadcast    ARP 42 Who has 88.198.0.161? Tell 88.198.0.164\n      6   0.168851 9a:55:9a:55:9a:55 ? c6:47:05:8d:dc:04 ARP 42 88.198.0.161 is at 9a:55:9a:55:9a:55\n      7   0.168875 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192\n      8   0.168896 88.198.0.164 ? 88.198.0.161 ICMP 590 Destination unreachable (Port unreachable)\n      9   0.168926 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192\n     10   0.168959 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192\n     11   0.168989 88.198.0.161 ? 88.198.0.164 UDP 4138 60260 ? 1337 Len=4096\n     12   0.169010 88.198.0.161 ? 88.198.0.164 UDP 42 60260 ? 1337 Len=0\n\nOn the third datagram received, the network namespace of the container\ninitiates an ARP lookup to deliver the ICMP message.\n\nIn another variant of this reproducer, starting the client with:\n\n  strace -f pasta --config-net -u 1337 socat UDP4-LISTEN:1337,null-eof OPEN:tmp.out,create,tru\n---truncated---(CVE-2024-57974)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range()\n\nIf track_pfn_copy() fails, we already added the dst VMA to the maple\ntree. As fork() fails, we\u0026apos;ll cleanup the maple tree, and stumble over\nthe dst VMA for which we neither performed any reservation nor copied\nany page tables.\n\nConsequently untrack_pfn() will see VM_PAT and try obtaining the\nPAT information from the page table -- which fails because the page\ntable was not copied.\n\nThe easiest fix would be to simply clear the VM_PAT flag of the dst VMA\nif track_pfn_copy() fails. However, the whole thing is about \u0026quot;simply\u0026quot;\nclearing the VM_PAT flag is shaky as well: if we passed track_pfn_copy()\nand performed a reservation, but copying the page tables fails, we\u0026apos;ll\nsimply clear the VM_PAT flag, not properly undoing the reservation ...\nwhich is also wrong.\n\nSo let\u0026apos;s fix it properly: set the VM_PAT flag only if the reservation\nsucceeded (leaving it clear initially), and undo the reservation if\nanything goes wrong while copying the page tables: clearing the VM_PAT\nflag after undoing the reservation.\n\nNote that any copied page table entries will get zapped when the VMA will\nget removed later, after copy_page_range() succeeded; as VM_PAT is not set\nthen, we won\u0026apos;t try cleaning VM_PAT up once more and untrack_pfn() will be\nhappy. Note that leaving these page tables in place without a reservation\nis not a problem, as we are aborting fork(); this process will never run.\n\nA reproducer can trigger this usually at the first try:\n\n  https://gitlab.com/davidhildenbrand/scratchspace/-/raw/main/reproducers/pat_fork.c\n\n  WARNING: CPU: 26 PID: 11650 at arch/x86/mm/pat/memtype.c:983 get_pat_info+0xf6/0x110\n  Modules linked in: ...\n  CPU: 26 UID: 0 PID: 11650 Comm: repro3 Not tainted 6.12.0-rc5+ #92\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014\n  RIP: 0010:get_pat_info+0xf6/0x110\n  ...\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   ...\n   untrack_pfn+0x52/0x110\n   unmap_single_vma+0xa6/0xe0\n   unmap_vmas+0x105/0x1f0\n   exit_mmap+0xf6/0x460\n   __mmput+0x4b/0x120\n   copy_process+0x1bf6/0x2aa0\n   kernel_clone+0xab/0x440\n   __do_sys_clone+0x66/0x90\n   do_syscall_64+0x95/0x180\n\nLikely this case was missed in:\n\n  d155df53f310 (\u0026quot;x86/mm/pat: clear VM_PAT if copy_p4d_range failed\u0026quot;)\n\n... and instead of undoing the reservation we simply cleared the VM_PAT flag.\n\nKeep the documentation of these functions in include/linux/pgtable.h,\none place is more than sufficient -- we should clean that up for the other\nfunctions like track_pfn_remap/untrack_pfn separately.(CVE-2025-22090)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: make fallback action and fallback decision atomic\n\nSyzkaller reported the following splat:\n\n  WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 __mptcp_do_fallback net/mptcp/protocol.h:1223 [inline]\n  WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 mptcp_do_fallback net/mptcp/protocol.h:1244 [inline]\n  WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 check_fully_established net/mptcp/options.c:982 [inline]\n  WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 mptcp_incoming_options+0x21a8/0x2510 net/mptcp/options.c:1153\n  Modules linked in:\n  CPU: 1 UID: 0 PID: 7704 Comm: syz.3.1419 Not tainted 6.16.0-rc3-gbd5ce2324dba #20 PREEMPT(voluntary)\n  Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n  RIP: 0010:__mptcp_do_fallback net/mptcp/protocol.h:1223 [inline]\n  RIP: 0010:mptcp_do_fallback net/mptcp/protocol.h:1244 [inline]\n  RIP: 0010:check_fully_established net/mptcp/options.c:982 [inline]\n  RIP: 0010:mptcp_incoming_options+0x21a8/0x2510 net/mptcp/options.c:1153\n  Code: 24 18 e8 bb 2a 00 fd e9 1b df ff ff e8 b1 21 0f 00 e8 ec 5f c4 fc 44 0f b7 ac 24 b0 00 00 00 e9 54 f1 ff ff e8 d9 5f c4 fc 90 \u0026lt;0f\u0026gt; 0b 90 e9 b8 f4 ff ff e8 8b 2a 00 fd e9 8d e6 ff ff e8 81 2a 00\n  RSP: 0018:ffff8880a3f08448 EFLAGS: 00010246\n  RAX: 0000000000000000 RBX: ffff8880180a8000 RCX: ffffffff84afcf45\n  RDX: ffff888090223700 RSI: ffffffff84afdaa7 RDI: 0000000000000001\n  RBP: ffff888017955780 R08: 0000000000000001 R09: 0000000000000000\n  R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000\n  R13: ffff8880180a8910 R14: ffff8880a3e9d058 R15: 0000000000000000\n  FS:  00005555791b8500(0000) GS:ffff88811c495000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 000000110c2800b7 CR3: 0000000058e44000 CR4: 0000000000350ef0\n  Call Trace:\n   \u0026lt;IRQ\u0026gt;\n   tcp_reset+0x26f/0x2b0 net/ipv4/tcp_input.c:4432\n   tcp_validate_incoming+0x1057/0x1b60 net/ipv4/tcp_input.c:5975\n   tcp_rcv_established+0x5b5/0x21f0 net/ipv4/tcp_input.c:6166\n   tcp_v4_do_rcv+0x5dc/0xa70 net/ipv4/tcp_ipv4.c:1925\n   tcp_v4_rcv+0x3473/0x44a0 net/ipv4/tcp_ipv4.c:2363\n   ip_protocol_deliver_rcu+0xba/0x480 net/ipv4/ip_input.c:205\n   ip_local_deliver_finish+0x2f1/0x500 net/ipv4/ip_input.c:233\n   NF_HOOK include/linux/netfilter.h:317 [inline]\n   NF_HOOK include/linux/netfilter.h:311 [inline]\n   ip_local_deliver+0x1be/0x560 net/ipv4/ip_input.c:254\n   dst_input include/net/dst.h:469 [inline]\n   ip_rcv_finish net/ipv4/ip_input.c:447 [inline]\n   NF_HOOK include/linux/netfilter.h:317 [inline]\n   NF_HOOK include/linux/netfilter.h:311 [inline]\n   ip_rcv+0x514/0x810 net/ipv4/ip_input.c:567\n   __netif_receive_skb_one_core+0x197/0x1e0 net/core/dev.c:5975\n   __netif_receive_skb+0x1f/0x120 net/core/dev.c:6088\n   process_backlog+0x301/0x1360 net/core/dev.c:6440\n   __napi_poll.constprop.0+0xba/0x550 net/core/dev.c:7453\n   napi_poll net/core/dev.c:7517 [inline]\n   net_rx_action+0xb44/0x1010 net/core/dev.c:7644\n   handle_softirqs+0x1d0/0x770 kernel/softirq.c:579\n   do_softirq+0x3f/0x90 kernel/softirq.c:480\n   \u0026lt;/IRQ\u0026gt;\n   \u0026lt;TASK\u0026gt;\n   __local_bh_enable_ip+0xed/0x110 kernel/softirq.c:407\n   local_bh_enable include/linux/bottom_half.h:33 [inline]\n   inet_csk_listen_stop+0x2c5/0x1070 net/ipv4/inet_connection_sock.c:1524\n   mptcp_check_listen_stop.part.0+0x1cc/0x220 net/mptcp/protocol.c:2985\n   mptcp_check_listen_stop net/mptcp/mib.h:118 [inline]\n   __mptcp_close+0x9b9/0xbd0 net/mptcp/protocol.c:3000\n   mptcp_close+0x2f/0x140 net/mptcp/protocol.c:3066\n   inet_release+0xed/0x200 net/ipv4/af_inet.c:435\n   inet6_release+0x4f/0x70 net/ipv6/af_inet6.c:487\n   __sock_release+0xb3/0x270 net/socket.c:649\n   sock_close+0x1c/0x30 net/socket.c:1439\n   __fput+0x402/0xb70 fs/file_table.c:465\n   task_work_run+0x150/0x240 kernel/task_work.c:227\n   resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]\n   exit_to_user_mode_loop+0xd4\n---truncated---(CVE-2025-38491)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic\n\nThe decompress_io_ctx may be released asynchronously after\nI/O completion. If this file is deleted immediately after read,\nand the kworker of processing post_read_wq has not been executed yet\ndue to high workloads, It is possible that the inode(f2fs_inode_info)\nis evicted and freed before it is used f2fs_free_dic.\n\n    The UAF case as below:\n    Thread A                                      Thread B\n    - f2fs_decompress_end_io\n     - f2fs_put_dic\n      - queue_work\n        add free_dic work to post_read_wq\n                                                   - do_unlink\n                                                    - iput\n                                                     - evict\n                                                      - call_rcu\n    This file is deleted after read.\n\n    Thread C                                 kworker to process post_read_wq\n    - rcu_do_batch\n     - f2fs_free_inode\n      - kmem_cache_free\n     inode is freed by rcu\n                                             - process_scheduled_works\n                                              - f2fs_late_free_dic\n                                               - f2fs_free_dic\n                                                - f2fs_release_decomp_mem\n                                      read (dic-\u0026gt;inode)-\u0026gt;i_compress_algorithm\n\nThis patch store compress_algorithm and sbi in dic to avoid inode UAF.\n\nIn addition, the previous solution is deprecated in [1] may cause system hang.\n[1] https://lore.kernel.org/all/(CVE-2025-38627)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\n[ceph] parse_longname(): strrchr() expects NUL-terminated string\n\n... and parse_longname() is not guaranteed that.  That\u0026apos;s the reason\nwhy it uses kmemdup_nul() to build the argument for kstrtou64();\nthe problem is, kstrtou64() is not the only thing that need it.\n\nJust get a NUL-terminated copy of the entire thing and be done\nwith that...(CVE-2025-38660)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ctnetlink: remove refcounting in expectation dumpers\n\nSame pattern as previous patch: do not keep the expectation object\nalive via refcount, only store a cookie value and then use that\nas the skip hint for dump resumption.\n\nAFAICS this has the same issue as the one resolved in the conntrack\ndumper, when we do\n  if (!refcount_inc_not_zero(\u0026amp;exp-\u0026gt;use))\n\nto increment the refcount, there is a chance that exp == last, which\ncauses a double-increment of the refcount and subsequent memory leak.(CVE-2025-39764)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/slub: avoid accessing metadata when pointer is invalid in object_err()\n\nobject_err() reports details of an object for further debugging, such as\nthe freelist pointer, redzone, etc. However, if the pointer is invalid,\nattempting to access object metadata can lead to a crash since it does\nnot point to a valid object.\n\nOne known path to the crash is when alloc_consistency_checks()\ndetermines the pointer to the allocated object is invalid because of a\nfreelist corruption, and calls object_err() to report it. The debug code\nshould report and handle the corruption gracefully and not crash in the\nprocess.\n\nIn case the pointer is NULL or check_valid_pointer() returns false for\nthe pointer, only print the pointer value and skip accessing metadata.(CVE-2025-39902)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nice: fix Rx page leak on multi-buffer frames\n\nThe ice_put_rx_mbuf() function handles calling ice_put_rx_buf() for each\nbuffer in the current frame. This function was introduced as part of\nhandling multi-buffer XDP support in the ice driver.\n\nIt works by iterating over the buffers from first_desc up to 1 plus the\ntotal number of fragments in the frame, cached from before the XDP program\nwas executed.\n\nIf the hardware posts a descriptor with a size of 0, the logic used in\nice_put_rx_mbuf() breaks. Such descriptors get skipped and don\u0026apos;t get added\nas fragments in ice_add_xdp_frag. Since the buffer isn\u0026apos;t counted as a\nfragment, we do not iterate over it in ice_put_rx_mbuf(), and thus we don\u0026apos;t\ncall ice_put_rx_buf().\n\nBecause we don\u0026apos;t call ice_put_rx_buf(), we don\u0026apos;t attempt to re-use the\npage or free it. This leaves a stale page in the ring, as we don\u0026apos;t\nincrement next_to_alloc.\n\nThe ice_reuse_rx_page() assumes that the next_to_alloc has been incremented\nproperly, and that it always points to a buffer with a NULL page. Since\nthis function doesn\u0026apos;t check, it will happily recycle a page over the top\nof the next_to_alloc buffer, losing track of the old page.\n\nNote that this leak only occurs for multi-buffer frames. The\nice_put_rx_mbuf() function always handles at least one buffer, so a\nsingle-buffer frame will always get handled correctly. It is not clear\nprecisely why the hardware hands us descriptors with a size of 0 sometimes,\nbut it happens somewhat regularly with \u0026quot;jumbo frames\u0026quot; used by 9K MTU.\n\nTo fix ice_put_rx_mbuf(), we need to make sure to call ice_put_rx_buf() on\nall buffers between first_desc and next_to_clean. Borrow the logic of a\nsimilar function in i40e used for this same purpose. Use the same logic\nalso in ice_get_pgcnts().\n\nInstead of iterating over just the number of fragments, use a loop which\niterates until the current index reaches to the next_to_clean element just\npast the current frame. Unlike i40e, the ice_put_rx_mbuf() function does\ncall ice_put_rx_buf() on the last buffer of the frame indicating the end of\npacket.\n\nFor non-linear (multi-buffer) frames, we need to take care when adjusting\nthe pagecnt_bias. An XDP program might release fragments from the tail of\nthe frame, in which case that fragment page is already released. Only\nupdate the pagecnt_bias for the first descriptor and fragments still\nremaining post-XDP program. Take care to only access the shared info for\nfragmented buffers, as this avoids a significant cache miss.\n\nThe xdp_xmit value only needs to be updated if an XDP program is run, and\nonly once per packet. Drop the xdp_xmit pointer argument from\nice_put_rx_mbuf(). Instead, set xdp_xmit in the ice_clean_rx_irq() function\ndirectly. This avoids needing to pass the argument and avoids an extra\nbit-wise OR for each buffer in the frame.\n\nMove the increment of the ntc local variable to ensure its updated *before*\nall calls to ice_get_pgcnts() or ice_put_rx_mbuf(), as the loop logic\nrequires the index of the element just after the current frame.\n\nNow that we use an index pointer in the ring to identify the packet, we no\nlonger need to track or cache the number of fragments in the rx_ring.(CVE-2025-39948)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfbcon: Set fb_display[i]-\u0026gt;mode to NULL when the mode is released\n\nRecently, we discovered the following issue through syzkaller:\n\nBUG: KASAN: slab-use-after-free in fb_mode_is_equal+0x285/0x2f0\nRead of size 4 at addr ff11000001b3c69c by task syz.xxx\n...\nCall Trace:\n \u0026lt;TASK\u0026gt;\n dump_stack_lvl+0xab/0xe0\n print_address_description.constprop.0+0x2c/0x390\n print_report+0xb9/0x280\n kasan_report+0xb8/0xf0\n fb_mode_is_equal+0x285/0x2f0\n fbcon_mode_deleted+0x129/0x180\n fb_set_var+0xe7f/0x11d0\n do_fb_ioctl+0x6a0/0x750\n fb_ioctl+0xe0/0x140\n __x64_sys_ioctl+0x193/0x210\n do_syscall_64+0x5f/0x9c0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nBased on experimentation and analysis, during framebuffer unregistration,\nonly the memory of fb_info-\u0026gt;modelist is freed, without setting the\ncorresponding fb_display[i]-\u0026gt;mode to NULL for the freed modes. This leads\nto UAF issues during subsequent accesses. Here\u0026apos;s an example of reproduction\nsteps:\n1. With /dev/fb0 already registered in the system, load a kernel module\n   to register a new device /dev/fb1;\n2. Set fb1\u0026apos;s mode to the global fb_display[] array (via FBIOPUT_CON2FBMAP);\n3. Switch console from fb to VGA (to allow normal rmmod of the ko);\n4. Unload the kernel module, at this point fb1\u0026apos;s modelist is freed, leaving\n   a wild pointer in fb_display[];\n5. Trigger the bug via system calls through fb0 attempting to delete a mode\n   from fb0.\n\nAdd a check in do_unregister_framebuffer(): if the mode to be freed exists\nin fb_display[], set the corresponding mode pointer to NULL.(CVE-2025-40323)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb\n\nThe Mesa issue referenced below pointed out a possible deadlock:\n\n[ 1231.611031]  Possible interrupt unsafe locking scenario:\n\n[ 1231.611033]        CPU0                    CPU1\n[ 1231.611034]        ----                    ----\n[ 1231.611035]   lock(\u0026amp;xa-\u0026gt;xa_lock#17);\n[ 1231.611038]                                local_irq_disable();\n[ 1231.611039]                                lock(\u0026amp;fence-\u0026gt;lock);\n[ 1231.611041]                                lock(\u0026amp;xa-\u0026gt;xa_lock#17);\n[ 1231.611044]   \u0026lt;Interrupt\u0026gt;\n[ 1231.611045]     lock(\u0026amp;fence-\u0026gt;lock);\n[ 1231.611047]\n                *** DEADLOCK ***\n\nIn this example, CPU0 would be any function accessing job-\u0026gt;dependencies\nthrough the xa_* functions that don\u0026apos;t disable interrupts (eg:\ndrm_sched_job_add_dependency(), drm_sched_entity_kill_jobs_cb()).\n\nCPU1 is executing drm_sched_entity_kill_jobs_cb() as a fence signalling\ncallback so in an interrupt context. It will deadlock when trying to\ngrab the xa_lock which is already held by CPU0.\n\nReplacing all xa_* usage by their xa_*_irq counterparts would fix\nthis issue, but Christian pointed out another issue: dma_fence_signal\ntakes fence.lock and so does dma_fence_add_callback.\n\n  dma_fence_signal() // locks f1.lock\n  -\u0026gt; drm_sched_entity_kill_jobs_cb()\n  -\u0026gt; foreach dependencies\n     -\u0026gt; dma_fence_add_callback() // locks f2.lock\n\nThis will deadlock if f1 and f2 share the same spinlock.\n\nTo fix both issues, the code iterating on dependencies and re-arming them\nis moved out to drm_sched_entity_kill_jobs_work().\n\n[phasta: commit message nits](CVE-2025-40329)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup\n\nRaw IP packets have no MAC header, leaving skb-\u0026gt;mac_header uninitialized.\nThis can trigger kernel panics on ARM64 when xfrm or other subsystems\naccess the offset due to strict alignment checks.\n\nInitialize the MAC header to prevent such crashes.\n\nThis can trigger kernel panics on ARM when running IPsec over the\nqmimux0 interface.\n\nExample trace:\n\n    Internal error: Oops: 000000009600004f [#1] SMP\n    CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.34-gbe78e49cb433 #1\n    Hardware name: LS1028A RDB Board (DT)\n    pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n    pc : xfrm_input+0xde8/0x1318\n    lr : xfrm_input+0x61c/0x1318\n    sp : ffff800080003b20\n    Call trace:\n     xfrm_input+0xde8/0x1318\n     xfrm6_rcv+0x38/0x44\n     xfrm6_esp_rcv+0x48/0xa8\n     ip6_protocol_deliver_rcu+0x94/0x4b0\n     ip6_input_finish+0x44/0x70\n     ip6_input+0x44/0xc0\n     ipv6_rcv+0x6c/0x114\n     __netif_receive_skb_one_core+0x5c/0x8c\n     __netif_receive_skb+0x18/0x60\n     process_backlog+0x78/0x17c\n     __napi_poll+0x38/0x180\n     net_rx_action+0x168/0x2f0(CVE-2025-68192)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmedia: imon: make send_packet() more robust\n\nsyzbot is reporting that imon has three problems which result in\nhung tasks due to forever holding device lock [1].\n\nFirst problem is that when usb_rx_callback_intf0() once got -EPROTO error\nafter ictx-\u0026gt;dev_present_intf0 became true, usb_rx_callback_intf0()\nresubmits urb after printk(), and resubmitted urb causes\nusb_rx_callback_intf0() to again get -EPROTO error. This results in\nprintk() flooding (RCU stalls).\n\nAlan Stern commented [2] that\n\n  In theory it\u0026apos;s okay to resubmit _if_ the driver has a robust\n  error-recovery scheme (such as giving up after some fixed limit on the\n  number of errors or after some fixed time has elapsed, perhaps with a\n  time delay to prevent a flood of errors).  Most drivers don\u0026apos;t bother to\n  do this; they simply give up right away.  This makes them more\n  vulnerable to short-term noise interference during USB transfers, but in\n  reality such interference is quite rare.  There\u0026apos;s nothing really wrong\n  with giving up right away.\n\nbut imon has a poor error-recovery scheme which just retries forever;\nthis behavior should be fixed.\n\nSince I\u0026apos;m not sure whether it is safe for imon users to give up upon any\nerror code, this patch takes care of only union of error codes chosen from\nmodules in drivers/media/rc/ directory which handle -EPROTO error (i.e.\nir_toy, mceusb and igorplugusb).\n\nSecond problem is that when usb_rx_callback_intf0() once got -EPROTO error\nbefore ictx-\u0026gt;dev_present_intf0 becomes true, usb_rx_callback_intf0() always\nresubmits urb due to commit 8791d63af0cf (\u0026quot;[media] imon: don\u0026apos;t wedge\nhardware after early callbacks\u0026quot;). Move the ictx-\u0026gt;dev_present_intf0 test\nintroduced by commit 6f6b90c9231a (\u0026quot;[media] imon: don\u0026apos;t parse scancodes\nuntil intf configured\u0026quot;) to immediately before imon_incoming_packet(), or\nthe first problem explained above happens without printk() flooding (i.e.\nhung task).\n\nThird problem is that when usb_rx_callback_intf0() is not called for some\nreason (e.g. flaky hardware; the reproducer for this problem sometimes\nprevents usb_rx_callback_intf0() from being called),\nwait_for_completion_interruptible() in send_packet() never returns (i.e.\nhung task). As a workaround for such situation, change send_packet() to\nwait for completion with timeout of 10 seconds.(CVE-2025-68194)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\npmdomain: arm: scmi: Fix genpd leak on provider registration failure\n\nIf of_genpd_add_provider_onecell() fails during probe, the previously\ncreated generic power domains are not removed, leading to a memory leak\nand potential kernel crash later in genpd_debug_add().\n\nAdd proper error handling to unwind the initialized domains before\nreturning from probe to ensure all resources are correctly released on\nfailure.\n\nExample crash trace observed without this fix:\n\n  | Unable to handle kernel paging request at virtual address fffffffffffffc70\n  | CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.18.0-rc1 #405 PREEMPT\n  | Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform\n  | pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n  | pc : genpd_debug_add+0x2c/0x160\n  | lr : genpd_debug_init+0x74/0x98\n  | Call trace:\n  |  genpd_debug_add+0x2c/0x160 (P)\n  |  genpd_debug_init+0x74/0x98\n  |  do_one_initcall+0xd0/0x2d8\n  |  do_initcall_level+0xa0/0x140\n  |  do_initcalls+0x60/0xa8\n  |  do_basic_setup+0x28/0x40\n  |  kernel_init_freeable+0xe8/0x170\n  |  kernel_init+0x2c/0x140\n  |  ret_from_fork+0x10/0x20(CVE-2025-68204)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmlx5: Fix default values in create CQ\n\nCurrently, CQs without a completion function are assigned the\nmlx5_add_cq_to_tasklet function by default. This is problematic since\nonly user CQs created through the mlx5_ib driver are intended to use\nthis function.\n\nAdditionally, all CQs that will use doorbells instead of polling for\ncompletions must call mlx5_cq_arm. However, the default CQ creation flow\nleaves a valid value in the CQ\u0026apos;s arm_db field, allowing FW to send\ninterrupts to polling-only CQs in certain corner cases.\n\nThese two factors would allow a polling-only kernel CQ to be triggered\nby an EQ interrupt and call a completion function intended only for user\nCQs, causing a null pointer exception.\n\nSome areas in the driver have prevented this issue with one-off fixes\nbut did not address the root cause.\n\nThis patch fixes the described issue by adding defaults to the create CQ\nflow. It adds a default dummy completion function to protect against\nnull pointer exceptions, and it sets an invalid command sequence number\nby default in kernel CQs to prevent the FW from sending an interrupt to\nthe CQ until it is armed. User CQs are responsible for their own\ninitialization values.\n\nCallers of mlx5_core_create_cq are responsible for changing the\ncompletion function and arming the CQ per their needs.(CVE-2025-68209)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nksm: use range-walk function to jump over holes in scan_get_next_rmap_item\n\nCurrently, scan_get_next_rmap_item() walks every page address in a VMA to\nlocate mergeable pages.  This becomes highly inefficient when scanning\nlarge virtual memory areas that contain mostly unmapped regions, causing\nksmd to use large amount of cpu without deduplicating much pages.\n\nThis patch replaces the per-address lookup with a range walk using\nwalk_page_range().  The range walker allows KSM to skip over entire\nunmapped holes in a VMA, avoiding unnecessary lookups.  This problem was\npreviously discussed in [1].\n\nConsider the following test program which creates a 32 TiB mapping in the\nvirtual address space but only populates a single page:\n\n#include \u0026lt;unistd.h\u0026gt;\n#include \u0026lt;stdio.h\u0026gt;\n#include \u0026lt;sys/mman.h\u0026gt;\n\n/* 32 TiB */\nconst size_t size = 32ul * 1024 * 1024 * 1024 * 1024;\n\nint main() {\n        char *area = mmap(NULL, size, PROT_READ | PROT_WRITE,\n                          MAP_NORESERVE | MAP_PRIVATE | MAP_ANON, -1, 0);\n\n        if (area == MAP_FAILED) {\n                perror(\u0026quot;mmap() failed\\n\u0026quot;);\n                return -1;\n        }\n\n        /* Populate a single page such that we get an anon_vma. */\n        *area = 0;\n\n        /* Enable KSM. */\n        madvise(area, size, MADV_MERGEABLE);\n        pause();\n        return 0;\n}\n\n$ ./ksm-sparse  \u0026amp;\n$ echo 1 \u0026gt; /sys/kernel/mm/ksm/run \n\nWithout this patch ksmd uses 100% of the cpu for a long time (more then 1\nhour in my test machine) scanning all the 32 TiB virtual address space\nthat contain only one mapped page.  This makes ksmd essentially deadlocked\nnot able to deduplicate anything of value.  With this patch ksmd walks\nonly the one mapped page and skips the rest of the 32 TiB virtual address\nspace, making the scan fast using little cpu.(CVE-2025-68211)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/mempool: fix poisoning order\u0026gt;0 pages with HIGHMEM\n\nThe kernel test has reported:\n\n  BUG: unable to handle page fault for address: fffba000\n  #PF: supervisor write access in kernel mode\n  #PF: error_code(0x0002) - not-present page\n  *pde = 03171067 *pte = 00000000\n  Oops: Oops: 0002 [#1]\n  CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Tainted: G                T   6.18.0-rc2-00031-gec7f31b2a2d3 #1 NONE  a1d066dfe789f54bc7645c7989957d2bdee593ca\n  Tainted: [T]=RANDSTRUCT\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n  EIP: memset (arch/x86/include/asm/string_32.h:168 arch/x86/lib/memcpy_32.c:17)\n  Code: a5 8b 4d f4 83 e1 03 74 02 f3 a4 83 c4 04 5e 5f 5d 2e e9 73 41 01 00 90 90 90 3e 8d 74 26 00 55 89 e5 57 56 89 c6 89 d0 89 f7 \u0026lt;f3\u0026gt; aa 89 f0 5e 5f 5d 2e e9 53 41 01 00 cc cc cc 55 89 e5 53 57 56\n  EAX: 0000006b EBX: 00000015 ECX: 001fefff EDX: 0000006b\n  ESI: fffb9000 EDI: fffba000 EBP: c611fbf0 ESP: c611fbe8\n  DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 EFLAGS: 00010287\n  CR0: 80050033 CR2: fffba000 CR3: 0316e000 CR4: 00040690\n  Call Trace:\n   poison_element (mm/mempool.c:83 mm/mempool.c:102)\n   mempool_init_node (mm/mempool.c:142 mm/mempool.c:226)\n   mempool_init_noprof (mm/mempool.c:250 (discriminator 1))\n   ? mempool_alloc_pages (mm/mempool.c:640)\n   bio_integrity_initfn (block/bio-integrity.c:483 (discriminator 8))\n   ? mempool_alloc_pages (mm/mempool.c:640)\n   do_one_initcall (init/main.c:1283)\n\nChristoph found out this is due to the poisoning code not dealing\nproperly with CONFIG_HIGHMEM because only the first page is mapped but\nthen the whole potentially high-order page is accessed.\n\nWe could give up on HIGHMEM here, but it\u0026apos;s straightforward to fix this\nwith a loop that\u0026apos;s mapping, poisoning or checking and unmapping\nindividual pages.(CVE-2025-68231)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmtdchar: fix integer overflow in read/write ioctls\n\nThe \u0026quot;req.start\u0026quot; and \u0026quot;req.len\u0026quot; variables are u64 values that come from the\nuser at the start of the function.  We mask away the high 32 bits of\n\u0026quot;req.len\u0026quot; so that\u0026apos;s capped at U32_MAX but the \u0026quot;req.start\u0026quot; variable can go\nup to U64_MAX which means that the addition can still integer overflow.\n\nUse check_add_overflow() to fix this bug.(CVE-2025-68237)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: udc: fix use-after-free in usb_gadget_state_work\n\nA race condition during gadget teardown can lead to a use-after-free\nin usb_gadget_state_work(), as reported by KASAN:\n\n  BUG: KASAN: invalid-access in sysfs_notify+0x2c/0xd0\n  Workqueue: events usb_gadget_state_work\n\nThe fundamental race occurs because a concurrent event (e.g., an\ninterrupt) can call usb_gadget_set_state() and schedule gadget-\u0026gt;work\nat any time during the cleanup process in usb_del_gadget().\n\nCommit 399a45e5237c (\u0026quot;usb: gadget: core: flush gadget workqueue after\ndevice removal\u0026quot;) attempted to fix this by moving flush_work() to after\ndevice_del(). However, this does not fully solve the race, as a new\nwork item can still be scheduled *after* flush_work() completes but\nbefore the gadget\u0026apos;s memory is freed, leading to the same use-after-free.\n\nThis patch fixes the race condition robustly by introducing a \u0026apos;teardown\u0026apos;\nflag and a \u0026apos;state_lock\u0026apos; spinlock to the usb_gadget struct. The flag is\nset during cleanup in usb_del_gadget() *before* calling flush_work() to\nprevent any new work from being scheduled once cleanup has commenced.\nThe scheduling site, usb_gadget_set_state(), now checks this flag under\nthe lock before queueing the work, thus safely closing the race window.(CVE-2025-68282)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/huge_memory: fix NULL pointer deference when splitting folio\n\nCommit c010d47f107f (\u0026quot;mm: thp: split huge page to any lower order pages\u0026quot;)\nintroduced an early check on the folio\u0026apos;s order via mapping-\u0026gt;flags before\nproceeding with the split work.\n\nThis check introduced a bug: for shmem folios in the swap cache and\ntruncated folios, the mapping pointer can be NULL.  Accessing\nmapping-\u0026gt;flags in this state leads directly to a NULL pointer dereference.\n\nThis commit fixes the issue by moving the check for mapping != NULL before\nany attempt to access mapping-\u0026gt;flags.(CVE-2025-68293)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nx86/CPU/AMD: Add RDSEED fix for Zen5\n\nThere\u0026apos;s an issue with RDSEED\u0026apos;s 16-bit and 32-bit register output\nvariants on Zen5 which return a random value of 0 \u0026quot;at a rate inconsistent\nwith randomness while incorrectly signaling success (CF=1)\u0026quot;. Search the\nweb for AMD-SB-7055 for more detail.\n\nAdd a fix glue which checks microcode revisions.\n\n  [ bp: Add microcode revisions checking, rewrite. ](CVE-2025-68313)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ninet: frags: flush pending skbs in fqdir_pre_exit()\n\nWe have been seeing occasional deadlocks on pernet_ops_rwsem since\nSeptember in NIPA. The stuck task was usually modprobe (often loading\na driver like ipvlan), trying to take the lock as a Writer.\nlockdep does not track readers for rwsems so the read wasn\u0026apos;t obvious\nfrom the reports.\n\nOn closer inspection the Reader holding the lock was conntrack looping\nforever in nf_conntrack_cleanup_net_list(). Based on past experience\nwith occasional NIPA crashes I looked thru the tests which run before\nthe crash and noticed that the crash follows ip_defrag.sh. An immediate\nred flag. Scouring thru (de)fragmentation queues reveals skbs sitting\naround, holding conntrack references.\n\nThe problem is that since conntrack depends on nf_defrag_ipv6,\nnf_defrag_ipv6 will load first. Since nf_defrag_ipv6 loads first its\nnetns exit hooks run _after_ conntrack\u0026apos;s netns exit hook.\n\nFlush all fragment queue SKBs during fqdir_pre_exit() to release\nconntrack references before conntrack cleanup runs. Also flush\nthe queues in timer expiry handlers when they discover fqdir-\u0026gt;dead\nis set, in case packet sneaks in while we\u0026apos;re running the pre_exit\nflush.\n\nThe commit under Fixes is not exactly the culprit, but I think\npreviously the timer firing would eventually unblock the spinning\nconntrack.(CVE-2025-68768)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: fix middle attribute validation in push_nsh() action\n\nThe push_nsh() action structure looks like this:\n\n OVS_ACTION_ATTR_PUSH_NSH(OVS_KEY_ATTR_NSH(OVS_NSH_KEY_ATTR_BASE,...))\n\nThe outermost OVS_ACTION_ATTR_PUSH_NSH attribute is OK\u0026apos;ed by the\nnla_for_each_nested() inside __ovs_nla_copy_actions().  The innermost\nOVS_NSH_KEY_ATTR_BASE/MD1/MD2 are OK\u0026apos;ed by the nla_for_each_nested()\ninside nsh_key_put_from_nlattr().  But nothing checks if the attribute\nin the middle is OK.  We don\u0026apos;t even check that this attribute is the\nOVS_KEY_ATTR_NSH.  We just do a double unwrap with a pair of nla_data()\ncalls - first time directly while calling validate_push_nsh() and the\nsecond time as part of the nla_for_each_nested() macro, which isn\u0026apos;t\nsafe, potentially causing invalid memory access if the size of this\nattribute is incorrect.  The failure may not be noticed during\nvalidation due to larger netlink buffer, but cause trouble later during\naction execution where the buffer is allocated exactly to the size:\n\n BUG: KASAN: slab-out-of-bounds in nsh_hdr_from_nlattr+0x1dd/0x6a0 [openvswitch]\n Read of size 184 at addr ffff88816459a634 by task a.out/22624\n\n CPU: 8 UID: 0 PID: 22624 6.18.0-rc7+ #115 PREEMPT(voluntary)\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  dump_stack_lvl+0x51/0x70\n  print_address_description.constprop.0+0x2c/0x390\n  kasan_report+0xdd/0x110\n  kasan_check_range+0x35/0x1b0\n  __asan_memcpy+0x20/0x60\n  nsh_hdr_from_nlattr+0x1dd/0x6a0 [openvswitch]\n  push_nsh+0x82/0x120 [openvswitch]\n  do_execute_actions+0x1405/0x2840 [openvswitch]\n  ovs_execute_actions+0xd5/0x3b0 [openvswitch]\n  ovs_packet_cmd_execute+0x949/0xdb0 [openvswitch]\n  genl_family_rcv_msg_doit+0x1d6/0x2b0\n  genl_family_rcv_msg+0x336/0x580\n  genl_rcv_msg+0x9f/0x130\n  netlink_rcv_skb+0x11f/0x370\n  genl_rcv+0x24/0x40\n  netlink_unicast+0x73e/0xaa0\n  netlink_sendmsg+0x744/0xbf0\n  __sys_sendto+0x3d6/0x450\n  do_syscall_64+0x79/0x2c0\n  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n  \u0026lt;/TASK\u0026gt;\n\nLet\u0026apos;s add some checks that the attribute is properly sized and it\u0026apos;s\nthe only one attribute inside the action.  Technically, there is no\nreal reason for OVS_KEY_ATTR_NSH to be there, as we know that we\u0026apos;re\npushing an NSH header already, it just creates extra nesting, but\nthat\u0026apos;s how uAPI works today.  So, keeping as it is.(CVE-2025-68785)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmedia: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg()\n\nrlen value is a user-controlled value, but dtv5100_i2c_msg() does not\ncheck the size of the rlen value. Therefore, if it is set to a value\nlarger than sizeof(st-\u0026gt;data), an out-of-bounds vuln occurs for st-\u0026gt;data.\n\nTherefore, we need to add proper range checking to prevent this vuln.(CVE-2025-68819)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nInput: alps - fix use-after-free bugs caused by dev3_register_work\n\nThe dev3_register_work delayed work item is initialized within\nalps_reconnect() and scheduled upon receipt of the first bare\nPS/2 packet from an external PS/2 device connected to the ALPS\ntouchpad. During device detachment, the original implementation\ncalls flush_workqueue() in psmouse_disconnect() to ensure\ncompletion of dev3_register_work. However, the flush_workqueue()\nin psmouse_disconnect() only blocks and waits for work items that\nwere already queued to the workqueue prior to its invocation. Any\nwork items submitted after flush_workqueue() is called are not\nincluded in the set of tasks that the flush operation awaits.\nThis means that after flush_workqueue() has finished executing,\nthe dev3_register_work could still be scheduled. Although the\npsmouse state is set to PSMOUSE_CMD_MODE in psmouse_disconnect(),\nthe scheduling of dev3_register_work remains unaffected.\n\nThe race condition can occur as follows:\n\nCPU 0 (cleanup path)     | CPU 1 (delayed work)\npsmouse_disconnect()     |\n  psmouse_set_state()    |\n  flush_workqueue()      | alps_report_bare_ps2_packet()\n  alps_disconnect()      |   psmouse_queue_work()\n    kfree(priv); // FREE | alps_register_bare_ps2_mouse()\n                         |   priv = container_of(work...); // USE\n                         |   priv-\u0026gt;dev3 // USE\n\nAdd disable_delayed_work_sync() in alps_disconnect() to ensure\nthat dev3_register_work is properly canceled and prevented from\nexecuting after the alps_data structure has been deallocated.\n\nThis bug is identified by static analysis.(CVE-2025-68822)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid potential deadlock\n\nAs Jiaming Zhang and syzbot reported, there is potential deadlock in\nf2fs as below:\n\nChain exists of:\n  \u0026amp;sbi-\u0026gt;cp_rwsem --\u0026gt; fs_reclaim --\u0026gt; sb_internal#2\n\n Possible unsafe locking scenario:\n\n       CPU0                    CPU1\n       ----                    ----\n  rlock(sb_internal#2);\n                               lock(fs_reclaim);\n                               lock(sb_internal#2);\n  rlock(\u0026amp;sbi-\u0026gt;cp_rwsem);\n\n *** DEADLOCK ***\n\n3 locks held by kswapd0/73:\n #0: ffffffff8e247a40 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat mm/vmscan.c:7015 [inline]\n #0: ffffffff8e247a40 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0x951/0x2800 mm/vmscan.c:7389\n #1: ffff8880118400e0 (\u0026amp;type-\u0026gt;s_umount_key#50){.+.+}-{4:4}, at: super_trylock_shared fs/super.c:562 [inline]\n #1: ffff8880118400e0 (\u0026amp;type-\u0026gt;s_umount_key#50){.+.+}-{4:4}, at: super_cache_scan+0x91/0x4b0 fs/super.c:197\n #2: ffff888011840610 (sb_internal#2){.+.+}-{0:0}, at: f2fs_evict_inode+0x8d9/0x1b60 fs/f2fs/inode.c:890\n\nstack backtrace:\nCPU: 0 UID: 0 PID: 73 Comm: kswapd0 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\nCall Trace:\n \u0026lt;TASK\u0026gt;\n dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120\n print_circular_bug+0x2ee/0x310 kernel/locking/lockdep.c:2043\n check_noncircular+0x134/0x160 kernel/locking/lockdep.c:2175\n check_prev_add kernel/locking/lockdep.c:3165 [inline]\n check_prevs_add kernel/locking/lockdep.c:3284 [inline]\n validate_chain+0xb9b/0x2140 kernel/locking/lockdep.c:3908\n __lock_acquire+0xab9/0xd20 kernel/locking/lockdep.c:5237\n lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5868\n down_read+0x46/0x2e0 kernel/locking/rwsem.c:1537\n f2fs_down_read fs/f2fs/f2fs.h:2278 [inline]\n f2fs_lock_op fs/f2fs/f2fs.h:2357 [inline]\n f2fs_do_truncate_blocks+0x21c/0x10c0 fs/f2fs/file.c:791\n f2fs_truncate_blocks+0x10a/0x300 fs/f2fs/file.c:867\n f2fs_truncate+0x489/0x7c0 fs/f2fs/file.c:925\n f2fs_evict_inode+0x9f2/0x1b60 fs/f2fs/inode.c:897\n evict+0x504/0x9c0 fs/inode.c:810\n f2fs_evict_inode+0x1dc/0x1b60 fs/f2fs/inode.c:853\n evict+0x504/0x9c0 fs/inode.c:810\n dispose_list fs/inode.c:852 [inline]\n prune_icache_sb+0x21b/0x2c0 fs/inode.c:1000\n super_cache_scan+0x39b/0x4b0 fs/super.c:224\n do_shrink_slab+0x6ef/0x1110 mm/shrinker.c:437\n shrink_slab_memcg mm/shrinker.c:550 [inline]\n shrink_slab+0x7ef/0x10d0 mm/shrinker.c:628\n shrink_one+0x28a/0x7c0 mm/vmscan.c:4955\n shrink_many mm/vmscan.c:5016 [inline]\n lru_gen_shrink_node mm/vmscan.c:5094 [inline]\n shrink_node+0x315d/0x3780 mm/vmscan.c:6081\n kswapd_shrink_node mm/vmscan.c:6941 [inline]\n balance_pgdat mm/vmscan.c:7124 [inline]\n kswapd+0x147c/0x2800 mm/vmscan.c:7389\n kthread+0x70e/0x8a0 kernel/kthread.c:463\n ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n \u0026lt;/TASK\u0026gt;\n\nThe root cause is deadlock among four locks as below:\n\nkswapd\n- fs_reclaim\t\t\t\t--- Lock A\n - shrink_one\n  - evict\n   - f2fs_evict_inode\n    - sb_start_intwrite\t\t\t--- Lock B\n\n- iput\n - evict\n  - f2fs_evict_inode\n   - sb_start_intwrite\t\t\t--- Lock B\n   - f2fs_truncate\n    - f2fs_truncate_blocks\n     - f2fs_do_truncate_blocks\n      - f2fs_lock_op\t\t\t--- Lock C\n\nioctl\n- f2fs_ioc_commit_atomic_write\n - f2fs_lock_op\t\t\t\t--- Lock C\n  - __f2fs_commit_atomic_write\n   - __replace_atomic_write_block\n    - f2fs_get_dnode_of_data\n     - __get_node_folio\n      - f2fs_check_nid_range\n       - f2fs_handle_error\n        - f2fs_record_errors\n         - f2fs_down_write\t\t--- Lock D\n\nopen\n- do_open\n - do_truncate\n  - security_inode_need_killpriv\n   - f2fs_getxattr\n    - lookup_all_xattrs\n     - f2fs_handle_error\n      - f2fs_record_errors\n       - f2fs_down_write\t\t--- Lock D\n        - f2fs_commit_super\n         - read_mapping_folio\n          - filemap_alloc_folio_noprof\n           - prepare_alloc_pages\n            - fs_reclaim_acquire\t--- Lock A\n\nIn order to a\n---truncated---(CVE-2025-71065)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: bound check rq_pages index in inline path\n\nsvc_rdma_copy_inline_range indexed rqstp-\u0026gt;rq_pages[rc_curpage] without\nverifying rc_curpage stays within the allocated page array. Add guards\nbefore the first use and after advancing to a new page.(CVE-2025-71068)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/ttm: Avoid NULL pointer deref for evicted BOs\n\nIt is possible for a BO to exist that is not currently associated with a\nresource, e.g. because it has been evicted.\n\nWhen devcoredump tries to read the contents of all BOs for dumping, we need\nto expect this as well -- in this case, ENODATA is recorded instead of the\nbuffer contents.(CVE-2025-71083)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/cm: Fix leaking the multicast GID table reference\n\nIf the CM ID is destroyed while the CM event for multicast creating is\nstill queued the cancel_work_sync() will prevent the work from running\nwhich also prevents destroying the ah_attr. This leaks a refcount and\ntriggers a WARN:\n\n   GID entry ref leak for dev syz1 index 2 ref=573\n   WARNING: CPU: 1 PID: 655 at drivers/infiniband/core/cache.c:809 release_gid_table drivers/infiniband/core/cache.c:806 [inline]\n   WARNING: CPU: 1 PID: 655 at drivers/infiniband/core/cache.c:809 gid_table_release_one+0x284/0x3cc drivers/infiniband/core/cache.c:886\n\nDestroy the ah_attr after canceling the work, it is safe to call this\ntwice.(CVE-2025-71084)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nteam: fix check for port enabled in team_queue_override_port_prio_changed()\n\nThere has been a syzkaller bug reported recently with the following\ntrace:\n\nlist_del corruption, ffff888058bea080-\u0026gt;prev is LIST_POISON2 (dead000000000122)\n------------[ cut here ]------------\nkernel BUG at lib/list_debug.c:59!\nOops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\nCPU: 3 UID: 0 PID: 21246 Comm: syz.0.2928 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\nRIP: 0010:__list_del_entry_valid_or_report+0x13e/0x200 lib/list_debug.c:59\nCode: 48 c7 c7 e0 71 f0 8b e8 30 08 ef fc 90 0f 0b 48 89 ef e8 a5 02 55 fd 48 89 ea 48 89 de 48 c7 c7 40 72 f0 8b e8 13 08 ef fc 90 \u0026lt;0f\u0026gt; 0b 48 89 ef e8 88 02 55 fd 48 89 ea 48 b8 00 00 00 00 00 fc ff\nRSP: 0018:ffffc9000d49f370 EFLAGS: 00010286\nRAX: 000000000000004e RBX: ffff888058bea080 RCX: ffffc9002817d000\nRDX: 0000000000000000 RSI: ffffffff819becc6 RDI: 0000000000000005\nRBP: dead000000000122 R08: 0000000000000005 R09: 0000000000000000\nR10: 0000000080000000 R11: 0000000000000001 R12: ffff888039e9c230\nR13: ffff888058bea088 R14: ffff888058bea080 R15: ffff888055461480\nFS:  00007fbbcfe6f6c0(0000) GS:ffff8880d6d0a000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000000110c3afcb0 CR3: 00000000382c7000 CR4: 0000000000352ef0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n __list_del_entry_valid include/linux/list.h:132 [inline]\n __list_del_entry include/linux/list.h:223 [inline]\n list_del_rcu include/linux/rculist.h:178 [inline]\n __team_queue_override_port_del drivers/net/team/team_core.c:826 [inline]\n __team_queue_override_port_del drivers/net/team/team_core.c:821 [inline]\n team_queue_override_port_prio_changed drivers/net/team/team_core.c:883 [inline]\n team_priority_option_set+0x171/0x2f0 drivers/net/team/team_core.c:1534\n team_option_set drivers/net/team/team_core.c:376 [inline]\n team_nl_options_set_doit+0x8ae/0xe60 drivers/net/team/team_core.c:2653\n genl_family_rcv_msg_doit+0x209/0x2f0 net/netlink/genetlink.c:1115\n genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]\n genl_rcv_msg+0x55c/0x800 net/netlink/genetlink.c:1210\n netlink_rcv_skb+0x158/0x420 net/netlink/af_netlink.c:2552\n genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219\n netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]\n netlink_unicast+0x5aa/0x870 net/netlink/af_netlink.c:1346\n netlink_sendmsg+0x8c8/0xdd0 net/netlink/af_netlink.c:1896\n sock_sendmsg_nosec net/socket.c:727 [inline]\n __sock_sendmsg net/socket.c:742 [inline]\n ____sys_sendmsg+0xa98/0xc70 net/socket.c:2630\n ___sys_sendmsg+0x134/0x1d0 net/socket.c:2684\n __sys_sendmsg+0x16d/0x220 net/socket.c:2716\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xcd/0xfa0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nThe problem is in this flow:\n1) Port is enabled, queue_id != 0, in qom_list\n2) Port gets disabled\n        -\u0026gt; team_port_disable()\n        -\u0026gt; team_queue_override_port_del()\n        -\u0026gt; del (removed from list)\n3) Port is disabled, queue_id != 0, not in any list\n4) Priority changes\n        -\u0026gt; team_queue_override_port_prio_changed()\n        -\u0026gt; checks: port disabled \u0026amp;\u0026amp; queue_id != 0\n        -\u0026gt; calls del - hits the BUG as it is removed already\n\nTo fix this, change the check in team_queue_override_port_prio_changed()\nso it returns early if port is not enabled.(CVE-2025-71091)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly\n\nThe netlink response for RDMA_NL_LS_OP_IP_RESOLVE should always have a\nLS_NLA_TYPE_DGID attribute, it is invalid if it does not.\n\nUse the nl parsing logic properly and call nla_parse_deprecated() to fill\nthe nlattrs array and then directly index that array to get the data for\nthe DGID. Just fail if it is NULL.\n\nRemove the for loop searching for the nla, and squash the validation and\nparsing into one function.\n\nFixes an uninitialized read from the stack triggered by userspace if it\ndoes not provide the DGID to a kernel initiated RDMA_NL_LS_OP_IP_RESOLVE\nquery.\n\n    BUG: KMSAN: uninit-value in hex_byte_pack include/linux/hex.h:13 [inline]\n    BUG: KMSAN: uninit-value in ip6_string+0xef4/0x13a0 lib/vsprintf.c:1490\n     hex_byte_pack include/linux/hex.h:13 [inline]\n     ip6_string+0xef4/0x13a0 lib/vsprintf.c:1490\n     ip6_addr_string+0x18a/0x3e0 lib/vsprintf.c:1509\n     ip_addr_string+0x245/0xee0 lib/vsprintf.c:1633\n     pointer+0xc09/0x1bd0 lib/vsprintf.c:2542\n     vsnprintf+0xf8a/0x1bd0 lib/vsprintf.c:2930\n     vprintk_store+0x3ae/0x1530 kernel/printk/printk.c:2279\n     vprintk_emit+0x307/0xcd0 kernel/printk/printk.c:2426\n     vprintk_default+0x3f/0x50 kernel/printk/printk.c:2465\n     vprintk+0x36/0x50 kernel/printk/printk_safe.c:82\n     _printk+0x17e/0x1b0 kernel/printk/printk.c:2475\n     ib_nl_process_good_ip_rsep drivers/infiniband/core/addr.c:128 [inline]\n     ib_nl_handle_ip_res_resp+0x963/0x9d0 drivers/infiniband/core/addr.c:141\n     rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:-1 [inline]\n     rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline]\n     rdma_nl_rcv+0xefa/0x11c0 drivers/infiniband/core/netlink.c:259\n     netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]\n     netlink_unicast+0xf04/0x12b0 net/netlink/af_netlink.c:1346\n     netlink_sendmsg+0x10b3/0x1250 net/netlink/af_netlink.c:1896\n     sock_sendmsg_nosec net/socket.c:714 [inline]\n     __sock_sendmsg+0x333/0x3d0 net/socket.c:729\n     ____sys_sendmsg+0x7e0/0xd80 net/socket.c:2617\n     ___sys_sendmsg+0x271/0x3b0 net/socket.c:2671\n     __sys_sendmsg+0x1aa/0x300 net/socket.c:2703\n     __compat_sys_sendmsg net/compat.c:346 [inline]\n     __do_compat_sys_sendmsg net/compat.c:353 [inline]\n     __se_compat_sys_sendmsg net/compat.c:350 [inline]\n     __ia32_compat_sys_sendmsg+0xa4/0x100 net/compat.c:350\n     ia32_sys_call+0x3f6c/0x4310 arch/x86/include/generated/asm/syscalls_32.h:371\n     do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]\n     __do_fast_syscall_32+0xb0/0x150 arch/x86/entry/syscall_32.c:306\n     do_fast_syscall_32+0x38/0x80 arch/x86/entry/syscall_32.c:331\n     do_SYSENTER_32+0x1f/0x30 arch/x86/entry/syscall_32.c:3(CVE-2025-71096)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv4: Fix reference count leak when using error routes with nexthop objects\n\nWhen a nexthop object is deleted, it is marked as dead and then\nfib_table_flush() is called to flush all the routes that are using the\ndead nexthop.\n\nThe current logic in fib_table_flush() is to only flush error routes\n(e.g., blackhole) when it is called as part of network namespace\ndismantle (i.e., with flush_all=true). Therefore, error routes are not\nflushed when their nexthop object is deleted:\n\n # ip link add name dummy1 up type dummy\n # ip nexthop add id 1 dev dummy1\n # ip route add 198.51.100.1/32 nhid 1\n # ip route add blackhole 198.51.100.2/32 nhid 1\n # ip nexthop del id 1\n # ip route show\n blackhole 198.51.100.2 nhid 1 dev dummy1\n\nAs such, they keep holding a reference on the nexthop object which in\nturn holds a reference on the nexthop device, resulting in a reference\ncount leak:\n\n # ip link del dev dummy1\n [   70.516258] unregister_netdevice: waiting for dummy1 to become free. Usage count = 2\n\nFix by flushing error routes when their nexthop is marked as dead.\n\nIPv6 does not suffer from this problem.(CVE-2025-71097)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Avoid walking the Namespace if start_node is NULL\n\nAlthough commit 0c9992315e73 (\u0026quot;ACPICA: Avoid walking the ACPI Namespace\nif it is not there\u0026quot;) fixed the situation when both start_node and\nacpi_gbl_root_node are NULL, the Linux kernel mainline now still crashed\non Honor Magicbook 14 Pro [1].\n\nThat happens due to the access to the member of parent_node in\nacpi_ns_get_next_node().  The NULL pointer dereference will always\nhappen, no matter whether or not the start_node is equal to\nACPI_ROOT_OBJECT, so move the check of start_node being NULL\nout of the if block.\n\nUnfortunately, all the attempts to contact Honor have failed, they\nrefused to provide any technical support for Linux.\n\nThe bad DSDT table\u0026apos;s dump could be found on GitHub [2].\n\nDMI: HONOR FMB-P/FMB-P-PCB, BIOS 1.13 05/08/2025\n\n[ rjw: Subject adjustment, changelog edits ](CVE-2025-71118)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf\n\nA zero length gss_token results in pages == 0 and in_token-\u0026gt;pages[0]\nis NULL. The code unconditionally evaluates\npage_address(in_token-\u0026gt;pages[0]) for the initial memcpy, which can\ndereference NULL even when the copy length is 0. Guard the first\nmemcpy so it only runs when length \u0026gt; 0.(CVE-2025-71120)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: BPF: Sign extend kfunc call arguments\n\nThe kfunc calls are native calls so they should follow LoongArch calling\nconventions. Sign extend its arguments properly to avoid kernel panic.\nThis is done by adding a new emit_abi_ext() helper. The emit_abi_ext()\nhelper performs extension in place meaning a value already store in the\ntarget register (Note: this is different from the existing sign_extend()\nhelper and thus we can\u0026apos;t reuse it).(CVE-2025-71129)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/tilcdc: Fix removal actions in case of failed probe\n\nThe drm_kms_helper_poll_fini() and drm_atomic_helper_shutdown() helpers\nshould only be called when the device has been successfully registered.\nCurrently, these functions are called unconditionally in tilcdc_fini(),\nwhich causes warnings during probe deferral scenarios.\n\n[    7.972317] WARNING: CPU: 0 PID: 23 at drivers/gpu/drm/drm_atomic_state_helper.c:175 drm_atomic_helper_crtc_duplicate_state+0x60/0x68\n...\n[    8.005820]  drm_atomic_helper_crtc_duplicate_state from drm_atomic_get_crtc_state+0x68/0x108\n[    8.005858]  drm_atomic_get_crtc_state from drm_atomic_helper_disable_all+0x90/0x1c8\n[    8.005885]  drm_atomic_helper_disable_all from drm_atomic_helper_shutdown+0x90/0x144\n[    8.005911]  drm_atomic_helper_shutdown from tilcdc_fini+0x68/0xf8 [tilcdc]\n[    8.005957]  tilcdc_fini [tilcdc] from tilcdc_pdev_probe+0xb0/0x6d4 [tilcdc]\n\nFix this by rewriting the failed probe cleanup path using the standard\ngoto error handling pattern, which ensures that cleanup functions are\nonly called on successfully initialized resources. Additionally, remove\nthe now-unnecessary is_registered flag.(CVE-2025-71141)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: stm32: dmamux: fix device leak on route allocation\n\nMake sure to drop the reference taken when looking up the DMA mux\nplatform device during route allocation.\n\nNote that holding a reference to a device does not prevent its driver\ndata from going away so there is no point in keeping the reference.(CVE-2025-71186)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe()\n\nWhen ksmbd_iov_pin_rsp() fails, we should call ksmbd_session_rpc_close().(CVE-2025-71220)\n\nIn the Linux kernel, a race condition vulnerability exists in the mmp_pdma driver. The vulnerability occurs in the mmp_pdma_residue() function which lacks proper locking mechanisms, potentially leading to use-after-free issues when accessing descriptor lists and descriptor contents.\n\nThe race condition occurs when multiple threads call tx_status() while the tasklet on another CPU is freeing completed descriptors. This issue can be reproduced when running dmatest on the same channel with multiple threads (threads_per_chan \u0026gt; 1).\n\nThe fix involves protecting the chain_running list iteration and descriptor access with the chan-\u0026gt;desc_lock spinlock.(CVE-2025-71221)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb/server: fix refcount leak in smb2_open()\n\nWhen ksmbd_vfs_getattr() fails, the reference count of ksmbd_file\nmust be released.(CVE-2025-71223)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmd: suspend array while updating raid_disks via sysfs\n\nIn raid1_reshape(), freeze_array() is called before modifying the r1bio\nmemory pool (conf-\u0026gt;r1bio_pool) and conf-\u0026gt;raid_disks, and\nunfreeze_array() is called after the update is completed.\n\nHowever, freeze_array() only waits until nr_sync_pending and\n(nr_pending - nr_queued) of all buckets reaches zero. When an I/O error\noccurs, nr_queued is increased and the corresponding r1bio is queued to\neither retry_list or bio_end_io_list. As a result, freeze_array() may\nunblock before these r1bios are released.\n\nThis can lead to a situation where conf-\u0026gt;raid_disks and the mempool have\nalready been updated while queued r1bios, allocated with the old\nraid_disks value, are later released. Consequently, free_r1bio() may\naccess memory out of bounds in put_all_bios() and release r1bios of the\nwrong size to the new mempool, potentially causing issues with the\nmempool as well.\n\nSince only normal I/O might increase nr_queued while an I/O error occurs,\nsuspending the array avoids this issue.\n\nNote: Updating raid_disks via ioctl SET_ARRAY_INFO already suspends\nthe array. Therefore, we suspend the array when updating raid_disks\nvia sysfs to avoid this issue too.(CVE-2025-71225)\n\nIn the Linux kernel, the following vulnerability has been resolved:  scsi: qla2xxx: Free sp in error path to fix system crash  System crash seen during load/unload test in a loop,  [61110.449331] qla2xxx [0000:27:00.0]-0042:0: Disabled MSI-X. [61110.467494](CVE-2025-71232)\n\nIn the Linux kernel, there is a race condition vulnerability in the SCSI qla2xxx driver. System crash was observed during load/unload loop testing. The root cause was a memory free operation occurring in interrupt context. When device discovery/fabric scan was in progress and module unload was issued setting the UNLOADING flag, work queue items could not be allocated and mapped memory had to be freed in interrupt context, leading to system crash.(CVE-2025-71235)\n\nA NULL pointer dereference vulnerability exists in the SCSI qla2xxx driver subsystem of the Linux kernel. When the system attempts to free associated memory in the qla_fab_async_scan function, it fails to validate whether the sp pointer is NULL, leading to kernel NULL pointer dereference and system crashes. This vulnerability can be exploited by attackers to cause denial of service.(CVE-2025-71236)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: sock: fix hardened usercopy panic in sock_recv_errqueue\n\nskbuff_fclone_cache was created without defining a usercopy region,\n[1] unlike skbuff_head_cache which properly whitelists the cb[] field.\n[2] This causes a usercopy BUG() when CONFIG_HARDENED_USERCOPY is\nenabled and the kernel attempts to copy sk_buff.cb data to userspace\nvia sock_recv_errqueue() -\u0026gt; put_cmsg().\n\nThe crash occurs when: 1. TCP allocates an skb using alloc_skb_fclone()\n   (from skbuff_fclone_cache) [1]\n2. The skb is cloned via skb_clone() using the pre-allocated fclone\n[3] 3. The cloned skb is queued to sk_error_queue for timestamp\nreporting 4. Userspace reads the error queue via recvmsg(MSG_ERRQUEUE)\n5. sock_recv_errqueue() calls put_cmsg() to copy serr-\u0026gt;ee from skb-\u0026gt;cb\n[4] 6. __check_heap_object() fails because skbuff_fclone_cache has no\n   usercopy whitelist [5]\n\nWhen cloned skbs allocated from skbuff_fclone_cache are used in the\nsocket error queue, accessing the sock_exterr_skb structure in skb-\u0026gt;cb\nvia put_cmsg() triggers a usercopy hardening violation:\n\n[    5.379589] usercopy: Kernel memory exposure attempt detected from SLUB object \u0026apos;skbuff_fclone_cache\u0026apos; (offset 296, size 16)!\n[    5.382796] kernel BUG at mm/usercopy.c:102!\n[    5.383923] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\n[    5.384903] CPU: 1 UID: 0 PID: 138 Comm: poc_put_cmsg Not tainted 6.12.57 #7\n[    5.384903] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\n[    5.384903] RIP: 0010:usercopy_abort+0x6c/0x80\n[    5.384903] Code: 1a 86 51 48 c7 c2 40 15 1a 86 41 52 48 c7 c7 c0 15 1a 86 48 0f 45 d6 48 c7 c6 80 15 1a 86 48 89 c1 49 0f 45 f3 e8 84 27 88 ff \u0026lt;0f\u0026gt; 0b 490\n[    5.384903] RSP: 0018:ffffc900006f77a8 EFLAGS: 00010246\n[    5.384903] RAX: 000000000000006f RBX: ffff88800f0ad2a8 RCX: 1ffffffff0f72e74\n[    5.384903] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff87b973a0\n[    5.384903] RBP: 0000000000000010 R08: 0000000000000000 R09: fffffbfff0f72e74\n[    5.384903] R10: 0000000000000003 R11: 79706f6372657375 R12: 0000000000000001\n[    5.384903] R13: ffff88800f0ad2b8 R14: ffffea00003c2b40 R15: ffffea00003c2b00\n[    5.384903] FS:  0000000011bc4380(0000) GS:ffff8880bf100000(0000) knlGS:0000000000000000\n[    5.384903] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[    5.384903] CR2: 000056aa3b8e5fe4 CR3: 000000000ea26004 CR4: 0000000000770ef0\n[    5.384903] PKRU: 55555554\n[    5.384903] Call Trace:\n[    5.384903]  \u0026lt;TASK\u0026gt;\n[    5.384903]  __check_heap_object+0x9a/0xd0\n[    5.384903]  __check_object_size+0x46c/0x690\n[    5.384903]  put_cmsg+0x129/0x5e0\n[    5.384903]  sock_recv_errqueue+0x22f/0x380\n[    5.384903]  tls_sw_recvmsg+0x7ed/0x1960\n[    5.384903]  ? srso_alias_return_thunk+0x5/0xfbef5\n[    5.384903]  ? schedule+0x6d/0x270\n[    5.384903]  ? srso_alias_return_thunk+0x5/0xfbef5\n[    5.384903]  ? mutex_unlock+0x81/0xd0\n[    5.384903]  ? __pfx_mutex_unlock+0x10/0x10\n[    5.384903]  ? __pfx_tls_sw_recvmsg+0x10/0x10\n[    5.384903]  ? _raw_spin_lock_irqsave+0x8f/0xf0\n[    5.384903]  ? _raw_read_unlock_irqrestore+0x20/0x40\n[    5.384903]  ? srso_alias_return_thunk+0x5/0xfbef5\n\nThe crash offset 296 corresponds to skb2-\u0026gt;cb within skbuff_fclones:\n  - sizeof(struct sk_buff) = 232 - offsetof(struct sk_buff, cb) = 40 -\n  offset of skb2.cb in fclones = 232 + 40 = 272 - crash offset 296 =\n  272 + 24 (inside sock_exterr_skb.ee)\n\nThis patch uses a local stack variable as a bounce buffer to avoid the hardened usercopy check failure.\n\n[1] https://elixir.bootlin.com/linux/v6.12.62/source/net/ipv4/tcp.c#L885\n[2] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5104\n[3] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5566\n[4] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5491\n[5] https://elixir.bootlin.com/linux/v6.12.62/source/mm/slub.c#L5719(CVE-2026-22977)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix memory leak in skb_segment_list for GRO packets\n\nWhen skb_segment_list() is called during packet forwarding, it handles\npackets that were aggregated by the GRO engine.\n\nHistorically, the segmentation logic in skb_segment_list assumes that\nindividual segments are split from a parent SKB and may need to carry\ntheir own socket memory accounting. Accordingly, the code transfers\ntruesize from the parent to the newly created segments.\n\nPrior to commit ed4cccef64c1 (\u0026quot;gro: fix ownership transfer\u0026quot;), this\ntruesize subtraction in skb_segment_list() was valid because fragments\nstill carry a reference to the original socket.\n\nHowever, commit ed4cccef64c1 (\u0026quot;gro: fix ownership transfer\u0026quot;) changed\nthis behavior by ensuring that fraglist entries are explicitly\norphaned (skb-\u0026gt;sk = NULL) to prevent illegal orphaning later in the\nstack. This change meant that the entire socket memory charge remained\nwith the head SKB, but the corresponding accounting logic in\nskb_segment_list() was never updated.\n\nAs a result, the current code unconditionally adds each fragment\u0026apos;s\ntruesize to delta_truesize and subtracts it from the parent SKB. Since\nthe fragments are no longer charged to the socket, this subtraction\nresults in an effective under-count of memory when the head is freed.\nThis causes sk_wmem_alloc to remain non-zero, preventing socket\ndestruction and leading to a persistent memory leak.\n\nThe leak can be observed via KMEMLEAK when tearing down the networking\nenvironment:\n\nunreferenced object 0xffff8881e6eb9100 (size 2048):\n  comm \u0026quot;ping\u0026quot;, pid 6720, jiffies 4295492526\n  backtrace:\n    kmem_cache_alloc_noprof+0x5c6/0x800\n    sk_prot_alloc+0x5b/0x220\n    sk_alloc+0x35/0xa00\n    inet6_create.part.0+0x303/0x10d0\n    __sock_create+0x248/0x640\n    __sys_socket+0x11b/0x1d0\n\nSince skb_segment_list() is exclusively used for SKB_GSO_FRAGLIST\npackets constructed by GRO, the truesize adjustment is removed.\n\nThe call to skb_release_head_state() must be preserved. As documented in\ncommit cf673ed0e057 (\u0026quot;net: fix fraglist segmentation reference count\nleak\u0026quot;), it is still required to correctly drop references to SKB\nextensions that may be overwritten during __copy_skb_header().(CVE-2026-22979)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: prevent potential out-of-bounds reads in handle_auth_done()\n\nPerform an explicit bounds check on payload_len to avoid a possible\nout-of-bounds access in the callout.\n\n[ idryomov: changelog ](CVE-2026-22984)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: make free_choose_arg_map() resilient to partial allocation\n\nfree_choose_arg_map() may dereference a NULL pointer if its caller fails\nafter a partial allocation.\n\nFor example, in decode_choose_args(), if allocation of arg_map-\u0026gt;args\nfails, execution jumps to the fail label and free_choose_arg_map() is\ncalled. Since arg_map-\u0026gt;size is updated to a non-zero value before memory\nallocation, free_choose_arg_map() will iterate over arg_map-\u0026gt;args and\ndereference a NULL pointer.\n\nTo prevent this potential NULL pointer dereference and make\nfree_choose_arg_map() more resilient, add checks for pointers before\niterating.(CVE-2026-22991)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_qfq: do not free existing class in qfq_change_class()\n\nFixes qfq_change_class() error case.\n\ncl-\u0026gt;qdisc and cl should only be freed if a new class and qdisc\nwere allocated, or we risk various UAF.(CVE-2026-22999)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()\n\nBlamed commit did not take care of VLAN encapsulations\nas spotted by syzbot [1].\n\nUse skb_vlan_inet_prepare() instead of pskb_inet_may_pull().\n\n[1]\n BUG: KMSAN: uninit-value in __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline]\n BUG: KMSAN: uninit-value in INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline]\n BUG: KMSAN: uninit-value in IP6_ECN_decapsulate+0x7a8/0x1fa0 include/net/inet_ecn.h:321\n  __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline]\n  INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline]\n  IP6_ECN_decapsulate+0x7a8/0x1fa0 include/net/inet_ecn.h:321\n  ip6ip6_dscp_ecn_decapsulate+0x16f/0x1b0 net/ipv6/ip6_tunnel.c:729\n  __ip6_tnl_rcv+0xed9/0x1b50 net/ipv6/ip6_tunnel.c:860\n  ip6_tnl_rcv+0xc3/0x100 net/ipv6/ip6_tunnel.c:903\n gre_rcv+0x1529/0x1b90 net/ipv6/ip6_gre.c:-1\n  ip6_protocol_deliver_rcu+0x1c89/0x2c60 net/ipv6/ip6_input.c:438\n  ip6_input_finish+0x1f4/0x4a0 net/ipv6/ip6_input.c:489\n  NF_HOOK include/linux/netfilter.h:318 [inline]\n  ip6_input+0x9c/0x330 net/ipv6/ip6_input.c:500\n  ip6_mc_input+0x7ca/0xc10 net/ipv6/ip6_input.c:590\n  dst_input include/net/dst.h:474 [inline]\n  ip6_rcv_finish+0x958/0x990 net/ipv6/ip6_input.c:79\n  NF_HOOK include/linux/netfilter.h:318 [inline]\n  ipv6_rcv+0xf1/0x3c0 net/ipv6/ip6_input.c:311\n  __netif_receive_skb_one_core net/core/dev.c:6139 [inline]\n  __netif_receive_skb+0x1df/0xac0 net/core/dev.c:6252\n  netif_receive_skb_internal net/core/dev.c:6338 [inline]\n  netif_receive_skb+0x57/0x630 net/core/dev.c:6397\n  tun_rx_batched+0x1df/0x980 drivers/net/tun.c:1485\n  tun_get_user+0x5c0e/0x6c60 drivers/net/tun.c:1953\n  tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1999\n  new_sync_write fs/read_write.c:593 [inline]\n  vfs_write+0xbe2/0x15d0 fs/read_write.c:686\n  ksys_write fs/read_write.c:738 [inline]\n  __do_sys_write fs/read_write.c:749 [inline]\n  __se_sys_write fs/read_write.c:746 [inline]\n  __x64_sys_write+0x1fb/0x4d0 fs/read_write.c:746\n  x64_sys_call+0x30ab/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:2\n  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n  do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nUninit was created at:\n  slab_post_alloc_hook mm/slub.c:4960 [inline]\n  slab_alloc_node mm/slub.c:5263 [inline]\n  kmem_cache_alloc_node_noprof+0x9e7/0x17a0 mm/slub.c:5315\n  kmalloc_reserve+0x13c/0x4b0 net/core/skbuff.c:586\n  __alloc_skb+0x805/0x1040 net/core/skbuff.c:690\n  alloc_skb include/linux/skbuff.h:1383 [inline]\n  alloc_skb_with_frags+0xc5/0xa60 net/core/skbuff.c:6712\n  sock_alloc_send_pskb+0xacc/0xc60 net/core/sock.c:2995\n  tun_alloc_skb drivers/net/tun.c:1461 [inline]\n  tun_get_user+0x1142/0x6c60 drivers/net/tun.c:1794\n  tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1999\n  new_sync_write fs/read_write.c:593 [inline]\n  vfs_write+0xbe2/0x15d0 fs/read_write.c:686\n  ksys_write fs/read_write.c:738 [inline]\n  __do_sys_write fs/read_write.c:749 [inline]\n  __se_sys_write fs/read_write.c:746 [inline]\n  __x64_sys_write+0x1fb/0x4d0 fs/read_write.c:746\n  x64_sys_call+0x30ab/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:2\n  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n  do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nCPU: 0 UID: 0 PID: 6465 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(none)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025(CVE-2026-23003)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv6: Fix use-after-free in inet6_addr_del().\n\nsyzbot reported use-after-free of inet6_ifaddr in\ninet6_addr_del(). [0]\n\nThe cited commit accidentally moved ipv6_del_addr() for\nmngtmpaddr before reading its ifp-\u0026gt;flags for temporary\naddresses in inet6_addr_del().\n\nLet\u0026apos;s move ipv6_del_addr() down to fix the UAF.\n\n[0]:\nBUG: KASAN: slab-use-after-free in inet6_addr_del.constprop.0+0x67a/0x6b0 net/ipv6/addrconf.c:3117\nRead of size 4 at addr ffff88807b89c86c by task syz.3.1618/9593\n\nCPU: 0 UID: 0 PID: 9593 Comm: syz.3.1618 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025\nCall Trace:\n \u0026lt;TASK\u0026gt;\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xcd/0x630 mm/kasan/report.c:482\n kasan_report+0xe0/0x110 mm/kasan/report.c:595\n inet6_addr_del.constprop.0+0x67a/0x6b0 net/ipv6/addrconf.c:3117\n addrconf_del_ifaddr+0x11e/0x190 net/ipv6/addrconf.c:3181\n inet6_ioctl+0x1e5/0x2b0 net/ipv6/af_inet6.c:582\n sock_do_ioctl+0x118/0x280 net/socket.c:1254\n sock_ioctl+0x227/0x6b0 net/socket.c:1375\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:597 [inline]\n __se_sys_ioctl fs/ioctl.c:583 [inline]\n __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f164cf8f749\nCode: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f164de64038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\nRAX: ffffffffffffffda RBX: 00007f164d1e5fa0 RCX: 00007f164cf8f749\nRDX: 0000200000000000 RSI: 0000000000008936 RDI: 0000000000000003\nRBP: 00007f164d013f91 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 00007f164d1e6038 R14: 00007f164d1e5fa0 R15: 00007ffde15c8288\n \u0026lt;/TASK\u0026gt;\n\nAllocated by task 9593:\n kasan_save_stack+0x33/0x60 mm/kasan/common.c:56\n kasan_save_track+0x14/0x30 mm/kasan/common.c:77\n poison_kmalloc_redzone mm/kasan/common.c:397 [inline]\n __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:414\n kmalloc_noprof include/linux/slab.h:957 [inline]\n kzalloc_noprof include/linux/slab.h:1094 [inline]\n ipv6_add_addr+0x4e3/0x2010 net/ipv6/addrconf.c:1120\n inet6_addr_add+0x256/0x9b0 net/ipv6/addrconf.c:3050\n addrconf_add_ifaddr+0x1fc/0x450 net/ipv6/addrconf.c:3160\n inet6_ioctl+0x103/0x2b0 net/ipv6/af_inet6.c:580\n sock_do_ioctl+0x118/0x280 net/socket.c:1254\n sock_ioctl+0x227/0x6b0 net/socket.c:1375\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:597 [inline]\n __se_sys_ioctl fs/ioctl.c:583 [inline]\n __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFreed by task 6099:\n kasan_save_stack+0x33/0x60 mm/kasan/common.c:56\n kasan_save_track+0x14/0x30 mm/kasan/common.c:77\n kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:584\n poison_slab_object mm/kasan/common.c:252 [inline]\n __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:284\n kasan_slab_free include/linux/kasan.h:234 [inline]\n slab_free_hook mm/slub.c:2540 [inline]\n slab_free_freelist_hook mm/slub.c:2569 [inline]\n slab_free_bulk mm/slub.c:6696 [inline]\n kmem_cache_free_bulk mm/slub.c:7383 [inline]\n kmem_cache_free_bulk+0x2bf/0x680 mm/slub.c:7362\n kfree_bulk include/linux/slab.h:830 [inline]\n kvfree_rcu_bulk+0x1b7/0x1e0 mm/slab_common.c:1523\n kvfree_rcu_drain_ready mm/slab_common.c:1728 [inline]\n kfree_rcu_monitor+0x1d0/0x2f0 mm/slab_common.c:1801\n process_one_work+0x9ba/0x1b20 kernel/workqueue.c:3257\n process_scheduled_works kernel/workqu\n---truncated---(CVE-2026-23010)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv4: ip_gre: make ipgre_header() robust\n\nAnalog to commit db5b4e39c4e6 (\u0026quot;ip6_gre: make ip6gre_header() robust\u0026quot;)\n\nOver the years, syzbot found many ways to crash the kernel\nin ipgre_header() [1].\n\nThis involves team or bonding drivers ability to dynamically\nchange their dev-\u0026gt;needed_headroom and/or dev-\u0026gt;hard_header_len\n\nIn this particular crash mld_newpack() allocated an skb\nwith a too small reserve/headroom, and by the time mld_sendpack()\nwas called, syzbot managed to attach an ipgre device.\n\n[1]\nskbuff: skb_under_panic: text:ffffffff89ea3cb7 len:2030915468 put:2030915372 head:ffff888058b43000 data:ffff887fdfa6e194 tail:0x120 end:0x6c0 dev:team0\n kernel BUG at net/core/skbuff.c:213 !\nOops: invalid opcode: 0000 [#1] SMP KASAN PTI\nCPU: 1 UID: 0 PID: 1322 Comm: kworker/1:9 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025\nWorkqueue: mld mld_ifc_work\n RIP: 0010:skb_panic+0x157/0x160 net/core/skbuff.c:213\nCall Trace:\n \u0026lt;TASK\u0026gt;\n  skb_under_panic net/core/skbuff.c:223 [inline]\n  skb_push+0xc3/0xe0 net/core/skbuff.c:2641\n  ipgre_header+0x67/0x290 net/ipv4/ip_gre.c:897\n  dev_hard_header include/linux/netdevice.h:3436 [inline]\n  neigh_connected_output+0x286/0x460 net/core/neighbour.c:1618\n  NF_HOOK_COND include/linux/netfilter.h:307 [inline]\n  ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247\n  NF_HOOK+0x9e/0x380 include/linux/netfilter.h:318\n  mld_sendpack+0x8d4/0xe60 net/ipv6/mcast.c:1855\n  mld_send_cr net/ipv6/mcast.c:2154 [inline]\n  mld_ifc_work+0x83e/0xd60 net/ipv6/mcast.c:2693\n  process_one_work kernel/workqueue.c:3257 [inline]\n  process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340\n  worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421\n  kthread+0x711/0x8a0 kernel/kthread.c:463\n  ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158\n  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246(CVE-2026-23011)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: pegasus: fix memory leak in update_eth_regs_async()\n\nWhen asynchronously writing to the device registers and if usb_submit_urb()\nfail, the code fail to release allocated to this point resources.(CVE-2026-23021)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/page_alloc: prevent pcp corruption with SMP=n\n\nThe kernel test robot has reported:\n\n BUG: spinlock trylock failure on UP on CPU#0, kcompactd0/28\n  lock: 0xffff888807e35ef0, .magic: dead4ead, .owner: kcompactd0/28, .owner_cpu: 0\n CPU: 0 UID: 0 PID: 28 Comm: kcompactd0 Not tainted 6.18.0-rc5-00127-ga06157804399 #1 PREEMPT  8cc09ef94dcec767faa911515ce9e609c45db470\n Call Trace:\n  \u0026lt;IRQ\u0026gt;\n  __dump_stack (lib/dump_stack.c:95)\n  dump_stack_lvl (lib/dump_stack.c:123)\n  dump_stack (lib/dump_stack.c:130)\n  spin_dump (kernel/locking/spinlock_debug.c:71)\n  do_raw_spin_trylock (kernel/locking/spinlock_debug.c:?)\n  _raw_spin_trylock (include/linux/spinlock_api_smp.h:89 kernel/locking/spinlock.c:138)\n  __free_frozen_pages (mm/page_alloc.c:2973)\n  ___free_pages (mm/page_alloc.c:5295)\n  __free_pages (mm/page_alloc.c:5334)\n  tlb_remove_table_rcu (include/linux/mm.h:? include/linux/mm.h:3122 include/asm-generic/tlb.h:220 mm/mmu_gather.c:227 mm/mmu_gather.c:290)\n  ? __cfi_tlb_remove_table_rcu (mm/mmu_gather.c:289)\n  ? rcu_core (kernel/rcu/tree.c:?)\n  rcu_core (include/linux/rcupdate.h:341 kernel/rcu/tree.c:2607 kernel/rcu/tree.c:2861)\n  rcu_core_si (kernel/rcu/tree.c:2879)\n  handle_softirqs (arch/x86/include/asm/jump_label.h:36 include/trace/events/irq.h:142 kernel/softirq.c:623)\n  __irq_exit_rcu (arch/x86/include/asm/jump_label.h:36 kernel/softirq.c:725)\n  irq_exit_rcu (kernel/softirq.c:741)\n  sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1052)\n  \u0026lt;/IRQ\u0026gt;\n  \u0026lt;TASK\u0026gt;\n RIP: 0010:_raw_spin_unlock_irqrestore (arch/x86/include/asm/preempt.h:95 include/linux/spinlock_api_smp.h:152 kernel/locking/spinlock.c:194)\n  free_pcppages_bulk (mm/page_alloc.c:1494)\n  drain_pages_zone (include/linux/spinlock.h:391 mm/page_alloc.c:2632)\n  __drain_all_pages (mm/page_alloc.c:2731)\n  drain_all_pages (mm/page_alloc.c:2747)\n  kcompactd (mm/compaction.c:3115)\n  kthread (kernel/kthread.c:465)\n  ? __cfi_kcompactd (mm/compaction.c:3166)\n  ? __cfi_kthread (kernel/kthread.c:412)\n  ret_from_fork (arch/x86/kernel/process.c:164)\n  ? __cfi_kthread (kernel/kthread.c:412)\n  ret_from_fork_asm (arch/x86/entry/entry_64.S:255)\n  \u0026lt;/TASK\u0026gt;\n\nMatthew has analyzed the report and identified that in drain_page_zone()\nwe are in a section protected by spin_lock(\u0026amp;pcp-\u0026gt;lock) and then get an\ninterrupt that attempts spin_trylock() on the same lock.  The code is\ndesigned to work this way without disabling IRQs and occasionally fail the\ntrylock with a fallback.  However, the SMP=n spinlock implementation\nassumes spin_trylock() will always succeed, and thus it\u0026apos;s normally a\nno-op.  Here the enabled lock debugging catches the problem, but otherwise\nit could cause a corruption of the pcp structure.\n\nThe problem has been introduced by commit 574907741599 (\u0026quot;mm/page_alloc:\nleave IRQs enabled for per-cpu page allocations\u0026quot;).  The pcp locking scheme\nrecognizes the need for disabling IRQs to prevent nesting spin_trylock()\nsections on SMP=n, but the need to prevent the nesting in spin_lock() has\nnot been recognized.  Fix it by introducing local wrappers that change the\nspin_lock() to spin_lock_iqsave() with SMP=n and use them in all places\nthat do spin_lock(\u0026amp;pcp-\u0026gt;lock).\n\n[(CVE-2026-23025)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnull_blk: fix kmemleak by releasing references to fault configfs items\n\nWhen CONFIG_BLK_DEV_NULL_BLK_FAULT_INJECTION is enabled, the null-blk\ndriver sets up fault injection support by creating the timeout_inject,\nrequeue_inject, and init_hctx_fault_inject configfs items as children\nof the top-level nullbX configfs group.\n\nHowever, when the nullbX device is removed, the references taken to\nthese fault-config configfs items are not released. As a result,\nkmemleak reports a memory leak, for example:\n\nunreferenced object 0xc00000021ff25c40 (size 32):\n  comm \u0026quot;mkdir\u0026quot;, pid 10665, jiffies 4322121578\n  hex dump (first 32 bytes):\n    69 6e 69 74 5f 68 63 74 78 5f 66 61 75 6c 74 5f  init_hctx_fault_\n    69 6e 6a 65 63 74 00 88 00 00 00 00 00 00 00 00  inject..........\n  backtrace (crc 1a018c86):\n    __kmalloc_node_track_caller_noprof+0x494/0xbd8\n    kvasprintf+0x74/0xf4\n    config_item_set_name+0xf0/0x104\n    config_group_init_type_name+0x48/0xfc\n    fault_config_init+0x48/0xf0\n    0xc0080000180559e4\n    configfs_mkdir+0x304/0x814\n    vfs_mkdir+0x49c/0x604\n    do_mkdirat+0x314/0x3d0\n    sys_mkdir+0xa0/0xd8\n    system_call_exception+0x1b0/0x4f0\n    system_call_vectored_common+0x15c/0x2ec\n\nFix this by explicitly releasing the references to the fault-config\nconfigfs items when dropping the reference to the top-level nullbX\nconfigfs group.(CVE-2026-23032)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\npnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()\n\nIn nfs4_ff_alloc_deviceid_node(), if the allocation for ds_versions fails,\nthe function jumps to the out_scratch label without freeing the already\nallocated dsaddrs list, leading to a memory leak.\n\nFix this by jumping to the out_err_drain_dsaddrs label, which properly\nfrees the dsaddrs list before cleaning up other resources.(CVE-2026-23038)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: make calc_target() set t-\u0026gt;paused, not just clear it\n\nCurrently calc_target() clears t-\u0026gt;paused if the request shouldn\u0026apos;t be\npaused anymore, but doesn\u0026apos;t ever set t-\u0026gt;paused even though it\u0026apos;s able to\ndetermine when the request should be paused.  Setting t-\u0026gt;paused is left\nto __submit_request() which is fine for regular requests but doesn\u0026apos;t\nwork for linger requests -- since __submit_request() doesn\u0026apos;t operate\non linger requests, there is nowhere for lreq-\u0026gt;t.paused to be set.\nOne consequence of this is that watches don\u0026apos;t get reestablished on\npaused -\u0026gt; unpaused transitions in cases where requests have been paused\nlong enough for the (paused) unwatch request to time out and for the\nsubsequent (re)watch request to enter the paused state.  On top of the\nwatch not getting reestablished, rbd_reregister_watch() gets stuck with\nrbd_dev-\u0026gt;watch_mutex held:\n\n  rbd_register_watch\n    __rbd_register_watch\n      ceph_osdc_watch\n        linger_reg_commit_wait\n\nIt\u0026apos;s waiting for lreq-\u0026gt;reg_commit_wait to be completed, but for that to\nhappen the respective request needs to end up on need_resend_linger list\nand be kicked when requests are unpaused.  There is no chance for that\nif the request in question is never marked paused in the first place.\n\nThe fact that rbd_dev-\u0026gt;watch_mutex remains taken out forever then\nprevents the image from getting unmapped -- \u0026quot;rbd unmap\u0026quot; would inevitably\nhang in D state on an attempt to grab the mutex.(CVE-2026-23047)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\npNFS: Fix a deadlock when returning a delegation during open()\n\nBen Coddington reports seeing a hang in the following stack trace:\n  0 [ffffd0b50e1774e0] __schedule at ffffffff9ca05415\n  1 [ffffd0b50e177548] schedule at ffffffff9ca05717\n  2 [ffffd0b50e177558] bit_wait at ffffffff9ca061e1\n  3 [ffffd0b50e177568] __wait_on_bit at ffffffff9ca05cfb\n  4 [ffffd0b50e1775c8] out_of_line_wait_on_bit at ffffffff9ca05ea5\n  5 [ffffd0b50e177618] pnfs_roc at ffffffffc154207b [nfsv4]\n  6 [ffffd0b50e1776b8] _nfs4_proc_delegreturn at ffffffffc1506586 [nfsv4]\n  7 [ffffd0b50e177788] nfs4_proc_delegreturn at ffffffffc1507480 [nfsv4]\n  8 [ffffd0b50e1777f8] nfs_do_return_delegation at ffffffffc1523e41 [nfsv4]\n  9 [ffffd0b50e177838] nfs_inode_set_delegation at ffffffffc1524a75 [nfsv4]\n 10 [ffffd0b50e177888] nfs4_process_delegation at ffffffffc14f41dd [nfsv4]\n 11 [ffffd0b50e1778a0] _nfs4_opendata_to_nfs4_state at ffffffffc1503edf [nfsv4]\n 12 [ffffd0b50e1778c0] _nfs4_open_and_get_state at ffffffffc1504e56 [nfsv4]\n 13 [ffffd0b50e177978] _nfs4_do_open at ffffffffc15051b8 [nfsv4]\n 14 [ffffd0b50e1779f8] nfs4_do_open at ffffffffc150559c [nfsv4]\n 15 [ffffd0b50e177a80] nfs4_atomic_open at ffffffffc15057fb [nfsv4]\n 16 [ffffd0b50e177ad0] nfs4_file_open at ffffffffc15219be [nfsv4]\n 17 [ffffd0b50e177b78] do_dentry_open at ffffffff9c09e6ea\n 18 [ffffd0b50e177ba8] vfs_open at ffffffff9c0a082e\n 19 [ffffd0b50e177bd0] dentry_open at ffffffff9c0a0935\n\nThe issue is that the delegreturn is being asked to wait for a layout\nreturn that cannot complete because a state recovery was initiated. The\nstate recovery cannot complete until the open() finishes processing the\ndelegations it was given.\n\nThe solution is to propagate the existing flags that indicate a\nnon-blocking call to the function pnfs_roc(), so that it knows not to\nwait in this situation.(CVE-2026-23050)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: hv_netvsc: reject RSS hash key programming without RX indirection table\n\nRSS configuration requires a valid RX indirection table. When the device\nreports a single receive queue, rndis_filter_device_add() does not\nallocate an indirection table, accepting RSS hash key updates in this\nstate leads to a hang.\n\nFix this by gating netvsc_set_rxfh() on ndc-\u0026gt;rx_table_sz and return\n-EOPNOTSUPP when the table is absent. This aligns set_rxfh with the device\ncapabilities and prevents incorrect behavior.(CVE-2026-23054)\n\nA buffer overflow vulnerability exists in the QLogic Fibre Channel driver (qla2xxx) of the Linux kernel. In the functions `qla27xx_copy_fpin_pkt()` and `qla27xx_copy_multiple_pkt()`, the code uses the firmware-reported `frame_size` to calculate the copy length into `item-\u0026gt;iocb`. However, the `iocb` member is defined as a fixed-size 64-byte array within `struct purex_item`. If the reported `frame_size` exceeds 64 bytes, subsequent `memcpy` calls will overflow the boundary of the `iocb` member. This cross-member write is unsafe and can lead to memory corruption, potentially exploitable to compromise the confidentiality, integrity, and availability of the kernel.(CVE-2026-23059)\n\nA NULL pointer dereference vulnerability exists in the be2net network driver within the Linux kernel, specifically in the be_cmd_get_mac_from_list() function. According to the function\u0026apos;s contract, when the parameter pmac_id_valid is set to false, the driver may request a PMAC_ID from the network card\u0026apos;s firmware and store it at the provided address pmac_id. However, there is a location within the driver where both conditions pmac_id_valid == false and pmac_id == NULL are passed simultaneously. This results in an attempt to dereference a NULL pointer, potentially leading to a kernel crash or system instability.(CVE-2026-23084)\n\nA memory address truncation vulnerability exists in the irqchip/gic-v3-its driver of the Linux kernel. On 32-bit ARM machines with CONFIG_ARM_LPAE enabled, when using larger VMSPLIT configurations, lowmem allocations may be backed by physical memory addresses above the 32-bit address limit. The GICv3 driver allocates the \u0026apos;itt\u0026apos; object using GFP_KERNEL. Since all memory below the 4GB physical address limit is in ZONE_DMA in this configuration, kmalloc() defaults to higher addresses in ZONE_NORMAL. However, the driver stores these physical addresses in 32-bit \u0026apos;unsigned long\u0026apos; variables, causing the high addresses to be truncated, which leads to system crashes.(CVE-2026-23085)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nuacce: fix isolate sysfs check condition\n\nuacce supports the device isolation feature. If the driver\nimplements the isolate_err_threshold_read and\nisolate_err_threshold_write callback functions, uacce will create\nsysfs files now. Users can read and configure the isolation policy\nthrough sysfs. Currently, sysfs files are created as long as either\nisolate_err_threshold_read or isolate_err_threshold_write callback\nfunctions are present.\n\nHowever, accessing a non-existent callback function may cause the\nsystem to crash. Therefore, intercept the creation of sysfs if\nneither read nor write exists; create sysfs if either is supported,\nbut intercept unsupported operations at the call site.(CVE-2026-23094)\n\nA deadlock vulnerability exists in the Linux kernel due to incorrect lock acquisition ordering. This vulnerability affects the migration functionality for hugetlb (huge page) file folios. The specific scenario is: when two kernel tasks (Tasks) attempt to acquire the `folio_lock` and `i_mmap_rwsem` locks in opposite orders, a circular wait is formed, leading to a system deadlock. For example, Task A holds `folio_lock` and then tries to acquire the `i_mmap_rwsem` read lock, while Task B holds the `i_mmap_rwsem` write lock and then tries to acquire `folio_lock`. This lock ordering violates the rules defined in mm/rmap.c. This vulnerability can render parts of the affected system unavailable, impacting system availability.(CVE-2026-23097)\n\nIn the Linux kernel SCSI core layer, there is a fragile ordering logic between marking commands as completed or failed, designed to ensure the error handler only wakes when the last running command completes or times out. This logic contains race conditions. These race conditions can cause the SCSI layer to fail to wake the error handler, leaving I/O through the SCSI host stuck as the error state cannot advance. Specifically, there are two issues: 1. A memory ordering issue within the `scsi_dec_host_busy()` function. The write operation that clears the `SCMD_STATE_INFLIGHT` flag may be reordered with read counting operations in `scsi_host_busy()`. This can cause other CPUs to see inconsistent busy counts, preventing the correct triggering of the error handler wake-up. 2. A general ordering issue with the `scsi_eh_inc_host_failed()` function. It counts busy commands before incrementing the `host_failed` count, which can race with the processing of a final command in `scsi_dec_host_busy()`, resulting in neither side waking the error handler task.(CVE-2026-23110)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec\n\nnvmet_tcp_build_pdu_iovec() could walk past cmd-\u0026gt;req.sg when a PDU\nlength or offset exceeds sg_cnt and then use bogus sg-\u0026gt;length/offset\nvalues, leading to _copy_to_iter() GPF/KASAN. Guard sg_idx, remaining\nentries, and sg-\u0026gt;length/offset before building the bvec.(CVE-2026-23112)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove\n\nOn APUs such as Raven and Renoir (GC 9.1.0, 9.2.2, 9.3.0), the ih1 and\nih2 interrupt ring buffers are not initialized. This is by design, as\nthese secondary IH rings are only available on discrete GPUs. See\nvega10_ih_sw_init() which explicitly skips ih1/ih2 initialization when\nAMD_IS_APU is set.\n\nHowever, amdgpu_gmc_filter_faults_remove() unconditionally uses ih1 to\nget the timestamp of the last interrupt entry. When retry faults are\nenabled on APUs (noretry=0), this function is called from the SVM page\nfault recovery path, resulting in a NULL pointer dereference when\namdgpu_ih_decode_iv_ts_helper() attempts to access ih-\u0026gt;ring[].\n\nThe crash manifests as:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000004\n  RIP: 0010:amdgpu_ih_decode_iv_ts_helper+0x22/0x40 [amdgpu]\n  Call Trace:\n   amdgpu_gmc_filter_faults_remove+0x60/0x130 [amdgpu]\n   svm_range_restore_pages+0xae5/0x11c0 [amdgpu]\n   amdgpu_vm_handle_fault+0xc8/0x340 [amdgpu]\n   gmc_v9_0_process_interrupt+0x191/0x220 [amdgpu]\n   amdgpu_irq_dispatch+0xed/0x2c0 [amdgpu]\n   amdgpu_ih_process+0x84/0x100 [amdgpu]\n\nThis issue was exposed by commit 1446226d32a4 (\u0026quot;drm/amdgpu: Remove GC HW\nIP 9.3.0 from noretry=1\u0026quot;) which changed the default for Renoir APU from\nnoretry=1 to noretry=0, enabling retry fault handling and thus\nexercising the buggy code path.\n\nFix this by adding a check for ih1.ring_size before attempting to use\nit. Also restore the soft_ih support from commit dd299441654f (\u0026quot;drm/amdgpu:\nRework retry fault removal\u0026quot;).  This is needed if the hardware doesn\u0026apos;t\nsupport secondary HW IH rings.\n\nv2: additional updates (Alex)\n\n(cherry picked from commit 6ce8d536c80aa1f059e82184f0d1994436b1d526)(CVE-2026-23163)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready()\n\nWhen the socket is closed while in TCP_LISTEN a callback is run to\nflush all outstanding packets, which in turns calls\nnvmet_tcp_listen_data_ready() with the sk_callback_lock held.\nSo we need to check if we are in TCP_LISTEN before attempting\nto get the sk_callback_lock() to avoid a deadlock.(CVE-2026-23179)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nASoC: amd: fix memory leak in acp3x pdm dma ops(CVE-2026-23190)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()\n\nIn iscsit_dec_session_usage_count(), the function calls complete() while\nholding the sess-\u0026gt;session_usage_lock. Similar to the connection usage count\nlogic, the waiter signaled by complete() (e.g., in the session release\npath) may wake up and free the iscsit_session structure immediately.\n\nThis creates a race condition where the current thread may attempt to\nexecute spin_unlock_bh() on a session structure that has already been\ndeallocated, resulting in a KASAN slab-use-after-free.\n\nTo resolve this, release the session_usage_lock before calling complete()\nto ensure all dereferences of the sess pointer are finished before the\nwaiter is allowed to proceed with deallocation.(CVE-2026-23193)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb/client: fix memory leak in smb2_open_file()\n\nReproducer:\n\n  1. server: directories are exported read-only\n  2. client: mount -t cifs //${server_ip}/export /mnt\n  3. client: dd if=/dev/zero of=/mnt/file bs=512 count=1000 oflag=direct\n  4. client: umount /mnt\n  5. client: sleep 1\n  6. client: modprobe -r cifs\n\nThe error message is as follows:\n\n  =============================================================================\n  BUG cifs_small_rq (Not tainted): Objects remaining on __kmem_cache_shutdown()\n  -----------------------------------------------------------------------------\n\n  Object 0x00000000d47521be @offset=14336\n  ...\n  WARNING: mm/slub.c:1251 at __kmem_cache_shutdown+0x34e/0x440, CPU#0: modprobe/1577\n  ...\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   kmem_cache_destroy+0x94/0x190\n   cifs_destroy_request_bufs+0x3e/0x50 [cifs]\n   cleanup_module+0x4e/0x540 [cifs]\n   __se_sys_delete_module+0x278/0x400\n   __x64_sys_delete_module+0x5f/0x70\n   x64_sys_call+0x2299/0x2ff0\n   do_syscall_64+0x89/0x350\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n  ...\n  kmem_cache_destroy cifs_small_rq: Slab cache still has objects when called from cifs_destroy_request_bufs+0x3e/0x50 [cifs]\n  WARNING: mm/slab_common.c:532 at kmem_cache_destroy+0x16b/0x190, CPU#0: modprobe/1577(CVE-2026-23205)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()\n\nIn iscsit_dec_conn_usage_count(), the function calls complete() while\nholding the conn-\u0026gt;conn_usage_lock. As soon as complete() is invoked, the\nwaiter (such as iscsit_close_connection()) may wake up and proceed to free\nthe iscsit_conn structure.\n\nIf the waiter frees the memory before the current thread reaches\nspin_unlock_bh(), it results in a KASAN slab-use-after-free as the function\nattempts to release a lock within the already-freed connection structure.\n\nFix this by releasing the spinlock before calling complete().(CVE-2026-23216)\n\nIn the Linux kernel, the ksmbd component contains an infinite loop vulnerability. The problem occurs when a signed request fails smb2 signature verification check. In __process_request(), if check_sign_req() returns an error, set_smb2_rsp_status(work, STATUS_ACCESS_DENIED) is called. set_smb2_rsp_status() sets work-\u0026gt;next_smb2_rcv_hdr_off to zero. By resetting next_smb2_rcv_hdr_off to zero, the pointer to the next command in the chain is lost. Consequently, is_chained_smb2_message() continues to point to the same request header instead of advancing. If the header\u0026apos;s NextCommand field is non-zero, the function returns true, causing __handle_ksmbd_work() to repeatedly process the same failed request in an infinite loop. This results in the kernel log being flooded with \u0026quot;bad smb2 signature\u0026quot; messages and high CPU usage.(CVE-2026-23220)\n\nIn the Linux kernel, the following vulnerability has been resolved:  smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection()  On kthread_run() failure in ksmbd_tcp_new_connection(), the transport is freed via free_transport(), which does not decrement active_num_conn, leaking this counter.  Replace free_transport() with ksmbd_tcp_disconnect().  The Linux kernel CVE team has assigned CVE-2026-23228 to this issue.(CVE-2026-23228)","status":"published","published":"2026-03-15T11:10:34Z","modified":"2026-08-18T01:19:37.776858405Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1570","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nudp: Deal with race between UDP socket address change and rehash\n\nIf a UDP socket changes its local address while it\u0026apos;s receiving\ndatagrams, as a result of connect(), there is a period during which\na lookup operation might fail to find it, after the address is changed\nbut before the secondary hash (port and address) and the four-tuple\nhash (local and remote ports and addresses) are updated.\n\nSecondary hash chains were introduced by commit 30fff9231fad (\u0026quot;udp:\nbind() optimisation\u0026quot;) and, as a result, a rehash operation became\nneeded to make a bound socket reachable again after a connect().\n\nThis operation was introduced by commit 719f835853a9 (\u0026quot;udp: add\nrehash on connect()\u0026quot;) which isn\u0026apos;t however a complete fix: the\nsocket will be found once the rehashing completes, but not while\nit\u0026apos;s pending.\n\nThis is noticeable with a socat(1) server in UDP4-LISTEN mode, and a\nclient sending datagrams to it. After the server receives the first\ndatagram (cf. _xioopen_ipdgram_listen()), it issues a connect() to\nthe address of the sender, in order to set up a directed flow.\n\nNow, if the client, running on a different CPU thread, happens to\nsend a (subsequent) datagram while the server\u0026apos;s socket changes its\naddress, but is not rehashed yet, this will result in a failed\nlookup and a port unreachable error delivered to the client, as\napparent from the following reproducer:\n\n  LEN=$(($(cat /proc/sys/net/core/wmem_default) / 4))\n  dd if=/dev/urandom bs=1 count=${LEN} of=tmp.in\n\n  while :; do\n  \ttaskset -c 1 socat UDP4-LISTEN:1337,null-eof OPEN:tmp.out,create,trunc \u0026amp;\n  \tsleep 0.1 || sleep 1\n  \ttaskset -c 2 socat OPEN:tmp.in UDP4:localhost:1337,shut-null\n  \twait\n  done\n\nwhere the client will eventually get ECONNREFUSED on a write()\n(typically the second or third one of a given iteration):\n\n  2024/11/13 21:28:23 socat[46901] E write(6, 0x556db2e3c000, 8192): Connection refused\n\nThis issue was first observed as a seldom failure in Podman\u0026apos;s tests\nchecking UDP functionality while using pasta(1) to connect the\ncontainer\u0026apos;s network namespace, which leads us to a reproducer with\nthe lookup error resulting in an ICMP packet on a tap device:\n\n  LOCAL_ADDR=\u0026quot;$(ip -j -4 addr show|jq -rM \u0026apos;.[] | .addr_info[0] | select(.scope == \u0026quot;global\u0026quot;).local\u0026apos;)\u0026quot;\n\n  while :; do\n  \t./pasta --config-net -p pasta.pcap -u 1337 socat UDP4-LISTEN:1337,null-eof OPEN:tmp.out,create,trunc \u0026amp;\n  \tsleep 0.2 || sleep 1\n  \tsocat OPEN:tmp.in UDP4:${LOCAL_ADDR}:1337,shut-null\n  \twait\n  \tcmp tmp.in tmp.out\n  done\n\nOnce this fails:\n\n  tmp.in tmp.out differ: char 8193, line 29\n\nwe can finally have a look at what\u0026apos;s going on:\n\n  $ tshark -r pasta.pcap\n      1   0.000000           :: ? ff02::16     ICMPv6 110 Multicast Listener Report Message v2\n      2   0.168690 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192\n      3   0.168767 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192\n      4   0.168806 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192\n      5   0.168827 c6:47:05:8d:dc:04 ? Broadcast    ARP 42 Who has 88.198.0.161? Tell 88.198.0.164\n      6   0.168851 9a:55:9a:55:9a:55 ? c6:47:05:8d:dc:04 ARP 42 88.198.0.161 is at 9a:55:9a:55:9a:55\n      7   0.168875 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192\n      8   0.168896 88.198.0.164 ? 88.198.0.161 ICMP 590 Destination unreachable (Port unreachable)\n      9   0.168926 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192\n     10   0.168959 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192\n     11   0.168989 88.198.0.161 ? 88.198.0.164 UDP 4138 60260 ? 1337 Len=4096\n     12   0.169010 88.198.0.161 ? 88.198.0.164 UDP 42 60260 ? 1337 Len=0\n\nOn the third datagram received, the network namespace of the container\ninitiates an ARP lookup to deliver the ICMP message.\n\nIn another variant of this reproducer, starting the client with:\n\n  strace -f pasta --config-net -u 1337 socat UDP4-LISTEN:1337,null-eof OPEN:tmp.out,create,tru\n---truncated---(CVE-2024-57974)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range()\n\nIf track_pfn_copy() fails, we already added the dst VMA to the maple\ntree. As fork() fails, we\u0026apos;ll cleanup the maple tree, and stumble over\nthe dst VMA for which we neither performed any reservation nor copied\nany page tables.\n\nConsequently untrack_pfn() will see VM_PAT and try obtaining the\nPAT information from the page table -- which fails because the page\ntable was not copied.\n\nThe easiest fix would be to simply clear the VM_PAT flag of the dst VMA\nif track_pfn_copy() fails. However, the whole thing is about \u0026quot;simply\u0026quot;\nclearing the VM_PAT flag is shaky as well: if we passed track_pfn_copy()\nand performed a reservation, but copying the page tables fails, we\u0026apos;ll\nsimply clear the VM_PAT flag, not properly undoing the reservation ...\nwhich is also wrong.\n\nSo let\u0026apos;s fix it properly: set the VM_PAT flag only if the reservation\nsucceeded (leaving it clear initially), and undo the reservation if\nanything goes wrong while copying the page tables: clearing the VM_PAT\nflag after undoing the reservation.\n\nNote that any copied page table entries will get zapped when the VMA will\nget removed later, after copy_page_range() succeeded; as VM_PAT is not set\nthen, we won\u0026apos;t try cleaning VM_PAT up once more and untrack_pfn() will be\nhappy. Note that leaving these page tables in place without a reservation\nis not a problem, as we are aborting fork(); this process will never run.\n\nA reproducer can trigger this usually at the first try:\n\n  https://gitlab.com/davidhildenbrand/scratchspace/-/raw/main/reproducers/pat_fork.c\n\n  WARNING: CPU: 26 PID: 11650 at arch/x86/mm/pat/memtype.c:983 get_pat_info+0xf6/0x110\n  Modules linked in: ...\n  CPU: 26 UID: 0 PID: 11650 Comm: repro3 Not tainted 6.12.0-rc5+ #92\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014\n  RIP: 0010:get_pat_info+0xf6/0x110\n  ...\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   ...\n   untrack_pfn+0x52/0x110\n   unmap_single_vma+0xa6/0xe0\n   unmap_vmas+0x105/0x1f0\n   exit_mmap+0xf6/0x460\n   __mmput+0x4b/0x120\n   copy_process+0x1bf6/0x2aa0\n   kernel_clone+0xab/0x440\n   __do_sys_clone+0x66/0x90\n   do_syscall_64+0x95/0x180\n\nLikely this case was missed in:\n\n  d155df53f310 (\u0026quot;x86/mm/pat: clear VM_PAT if copy_p4d_range failed\u0026quot;)\n\n... and instead of undoing the reservation we simply cleared the VM_PAT flag.\n\nKeep the documentation of these functions in include/linux/pgtable.h,\none place is more than sufficient -- we should clean that up for the other\nfunctions like track_pfn_remap/untrack_pfn separately.(CVE-2025-22090)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: make fallback action and fallback decision atomic\n\nSyzkaller reported the following splat:\n\n  WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 __mptcp_do_fallback net/mptcp/protocol.h:1223 [inline]\n  WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 mptcp_do_fallback net/mptcp/protocol.h:1244 [inline]\n  WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 check_fully_established net/mptcp/options.c:982 [inline]\n  WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 mptcp_incoming_options+0x21a8/0x2510 net/mptcp/options.c:1153\n  Modules linked in:\n  CPU: 1 UID: 0 PID: 7704 Comm: syz.3.1419 Not tainted 6.16.0-rc3-gbd5ce2324dba #20 PREEMPT(voluntary)\n  Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n  RIP: 0010:__mptcp_do_fallback net/mptcp/protocol.h:1223 [inline]\n  RIP: 0010:mptcp_do_fallback net/mptcp/protocol.h:1244 [inline]\n  RIP: 0010:check_fully_established net/mptcp/options.c:982 [inline]\n  RIP: 0010:mptcp_incoming_options+0x21a8/0x2510 net/mptcp/options.c:1153\n  Code: 24 18 e8 bb 2a 00 fd e9 1b df ff ff e8 b1 21 0f 00 e8 ec 5f c4 fc 44 0f b7 ac 24 b0 00 00 00 e9 54 f1 ff ff e8 d9 5f c4 fc 90 \u0026lt;0f\u0026gt; 0b 90 e9 b8 f4 ff ff e8 8b 2a 00 fd e9 8d e6 ff ff e8 81 2a 00\n  RSP: 0018:ffff8880a3f08448 EFLAGS: 00010246\n  RAX: 0000000000000000 RBX: ffff8880180a8000 RCX: ffffffff84afcf45\n  RDX: ffff888090223700 RSI: ffffffff84afdaa7 RDI: 0000000000000001\n  RBP: ffff888017955780 R08: 0000000000000001 R09: 0000000000000000\n  R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000\n  R13: ffff8880180a8910 R14: ffff8880a3e9d058 R15: 0000000000000000\n  FS:  00005555791b8500(0000) GS:ffff88811c495000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 000000110c2800b7 CR3: 0000000058e44000 CR4: 0000000000350ef0\n  Call Trace:\n   \u0026lt;IRQ\u0026gt;\n   tcp_reset+0x26f/0x2b0 net/ipv4/tcp_input.c:4432\n   tcp_validate_incoming+0x1057/0x1b60 net/ipv4/tcp_input.c:5975\n   tcp_rcv_established+0x5b5/0x21f0 net/ipv4/tcp_input.c:6166\n   tcp_v4_do_rcv+0x5dc/0xa70 net/ipv4/tcp_ipv4.c:1925\n   tcp_v4_rcv+0x3473/0x44a0 net/ipv4/tcp_ipv4.c:2363\n   ip_protocol_deliver_rcu+0xba/0x480 net/ipv4/ip_input.c:205\n   ip_local_deliver_finish+0x2f1/0x500 net/ipv4/ip_input.c:233\n   NF_HOOK include/linux/netfilter.h:317 [inline]\n   NF_HOOK include/linux/netfilter.h:311 [inline]\n   ip_local_deliver+0x1be/0x560 net/ipv4/ip_input.c:254\n   dst_input include/net/dst.h:469 [inline]\n   ip_rcv_finish net/ipv4/ip_input.c:447 [inline]\n   NF_HOOK include/linux/netfilter.h:317 [inline]\n   NF_HOOK include/linux/netfilter.h:311 [inline]\n   ip_rcv+0x514/0x810 net/ipv4/ip_input.c:567\n   __netif_receive_skb_one_core+0x197/0x1e0 net/core/dev.c:5975\n   __netif_receive_skb+0x1f/0x120 net/core/dev.c:6088\n   process_backlog+0x301/0x1360 net/core/dev.c:6440\n   __napi_poll.constprop.0+0xba/0x550 net/core/dev.c:7453\n   napi_poll net/core/dev.c:7517 [inline]\n   net_rx_action+0xb44/0x1010 net/core/dev.c:7644\n   handle_softirqs+0x1d0/0x770 kernel/softirq.c:579\n   do_softirq+0x3f/0x90 kernel/softirq.c:480\n   \u0026lt;/IRQ\u0026gt;\n   \u0026lt;TASK\u0026gt;\n   __local_bh_enable_ip+0xed/0x110 kernel/softirq.c:407\n   local_bh_enable include/linux/bottom_half.h:33 [inline]\n   inet_csk_listen_stop+0x2c5/0x1070 net/ipv4/inet_connection_sock.c:1524\n   mptcp_check_listen_stop.part.0+0x1cc/0x220 net/mptcp/protocol.c:2985\n   mptcp_check_listen_stop net/mptcp/mib.h:118 [inline]\n   __mptcp_close+0x9b9/0xbd0 net/mptcp/protocol.c:3000\n   mptcp_close+0x2f/0x140 net/mptcp/protocol.c:3066\n   inet_release+0xed/0x200 net/ipv4/af_inet.c:435\n   inet6_release+0x4f/0x70 net/ipv6/af_inet6.c:487\n   __sock_release+0xb3/0x270 net/socket.c:649\n   sock_close+0x1c/0x30 net/socket.c:1439\n   __fput+0x402/0xb70 fs/file_table.c:465\n   task_work_run+0x150/0x240 kernel/task_work.c:227\n   resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]\n   exit_to_user_mode_loop+0xd4\n---truncated---(CVE-2025-38491)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic\n\nThe decompress_io_ctx may be released asynchronously after\nI/O completion. If this file is deleted immediately after read,\nand the kworker of processing post_read_wq has not been executed yet\ndue to high workloads, It is possible that the inode(f2fs_inode_info)\nis evicted and freed before it is used f2fs_free_dic.\n\n    The UAF case as below:\n    Thread A                                      Thread B\n    - f2fs_decompress_end_io\n     - f2fs_put_dic\n      - queue_work\n        add free_dic work to post_read_wq\n                                                   - do_unlink\n                                                    - iput\n                                                     - evict\n                                                      - call_rcu\n    This file is deleted after read.\n\n    Thread C                                 kworker to process post_read_wq\n    - rcu_do_batch\n     - f2fs_free_inode\n      - kmem_cache_free\n     inode is freed by rcu\n                                             - process_scheduled_works\n                                              - f2fs_late_free_dic\n                                               - f2fs_free_dic\n                                                - f2fs_release_decomp_mem\n                                      read (dic-\u0026gt;inode)-\u0026gt;i_compress_algorithm\n\nThis patch store compress_algorithm and sbi in dic to avoid inode UAF.\n\nIn addition, the previous solution is deprecated in [1] may cause system hang.\n[1] https://lore.kernel.org/all/(CVE-2025-38627)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\n[ceph] parse_longname(): strrchr() expects NUL-terminated string\n\n... and parse_longname() is not guaranteed that.  That\u0026apos;s the reason\nwhy it uses kmemdup_nul() to build the argument for kstrtou64();\nthe problem is, kstrtou64() is not the only thing that need it.\n\nJust get a NUL-terminated copy of the entire thing and be done\nwith that...(CVE-2025-38660)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ctnetlink: remove refcounting in expectation dumpers\n\nSame pattern as previous patch: do not keep the expectation object\nalive via refcount, only store a cookie value and then use that\nas the skip hint for dump resumption.\n\nAFAICS this has the same issue as the one resolved in the conntrack\ndumper, when we do\n  if (!refcount_inc_not_zero(\u0026amp;exp-\u0026gt;use))\n\nto increment the refcount, there is a chance that exp == last, which\ncauses a double-increment of the refcount and subsequent memory leak.(CVE-2025-39764)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/slub: avoid accessing metadata when pointer is invalid in object_err()\n\nobject_err() reports details of an object for further debugging, such as\nthe freelist pointer, redzone, etc. However, if the pointer is invalid,\nattempting to access object metadata can lead to a crash since it does\nnot point to a valid object.\n\nOne known path to the crash is when alloc_consistency_checks()\ndetermines the pointer to the allocated object is invalid because of a\nfreelist corruption, and calls object_err() to report it. The debug code\nshould report and handle the corruption gracefully and not crash in the\nprocess.\n\nIn case the pointer is NULL or check_valid_pointer() returns false for\nthe pointer, only print the pointer value and skip accessing metadata.(CVE-2025-39902)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nice: fix Rx page leak on multi-buffer frames\n\nThe ice_put_rx_mbuf() function handles calling ice_put_rx_buf() for each\nbuffer in the current frame. This function was introduced as part of\nhandling multi-buffer XDP support in the ice driver.\n\nIt works by iterating over the buffers from first_desc up to 1 plus the\ntotal number of fragments in the frame, cached from before the XDP program\nwas executed.\n\nIf the hardware posts a descriptor with a size of 0, the logic used in\nice_put_rx_mbuf() breaks. Such descriptors get skipped and don\u0026apos;t get added\nas fragments in ice_add_xdp_frag. Since the buffer isn\u0026apos;t counted as a\nfragment, we do not iterate over it in ice_put_rx_mbuf(), and thus we don\u0026apos;t\ncall ice_put_rx_buf().\n\nBecause we don\u0026apos;t call ice_put_rx_buf(), we don\u0026apos;t attempt to re-use the\npage or free it. This leaves a stale page in the ring, as we don\u0026apos;t\nincrement next_to_alloc.\n\nThe ice_reuse_rx_page() assumes that the next_to_alloc has been incremented\nproperly, and that it always points to a buffer with a NULL page. Since\nthis function doesn\u0026apos;t check, it will happily recycle a page over the top\nof the next_to_alloc buffer, losing track of the old page.\n\nNote that this leak only occurs for multi-buffer frames. The\nice_put_rx_mbuf() function always handles at least one buffer, so a\nsingle-buffer frame will always get handled correctly. It is not clear\nprecisely why the hardware hands us descriptors with a size of 0 sometimes,\nbut it happens somewhat regularly with \u0026quot;jumbo frames\u0026quot; used by 9K MTU.\n\nTo fix ice_put_rx_mbuf(), we need to make sure to call ice_put_rx_buf() on\nall buffers between first_desc and next_to_clean. Borrow the logic of a\nsimilar function in i40e used for this same purpose. Use the same logic\nalso in ice_get_pgcnts().\n\nInstead of iterating over just the number of fragments, use a loop which\niterates until the current index reaches to the next_to_clean element just\npast the current frame. Unlike i40e, the ice_put_rx_mbuf() function does\ncall ice_put_rx_buf() on the last buffer of the frame indicating the end of\npacket.\n\nFor non-linear (multi-buffer) frames, we need to take care when adjusting\nthe pagecnt_bias. An XDP program might release fragments from the tail of\nthe frame, in which case that fragment page is already released. Only\nupdate the pagecnt_bias for the first descriptor and fragments still\nremaining post-XDP program. Take care to only access the shared info for\nfragmented buffers, as this avoids a significant cache miss.\n\nThe xdp_xmit value only needs to be updated if an XDP program is run, and\nonly once per packet. Drop the xdp_xmit pointer argument from\nice_put_rx_mbuf(). Instead, set xdp_xmit in the ice_clean_rx_irq() function\ndirectly. This avoids needing to pass the argument and avoids an extra\nbit-wise OR for each buffer in the frame.\n\nMove the increment of the ntc local variable to ensure its updated *before*\nall calls to ice_get_pgcnts() or ice_put_rx_mbuf(), as the loop logic\nrequires the index of the element just after the current frame.\n\nNow that we use an index pointer in the ring to identify the packet, we no\nlonger need to track or cache the number of fragments in the rx_ring.(CVE-2025-39948)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfbcon: Set fb_display[i]-\u0026gt;mode to NULL when the mode is released\n\nRecently, we discovered the following issue through syzkaller:\n\nBUG: KASAN: slab-use-after-free in fb_mode_is_equal+0x285/0x2f0\nRead of size 4 at addr ff11000001b3c69c by task syz.xxx\n...\nCall Trace:\n \u0026lt;TASK\u0026gt;\n dump_stack_lvl+0xab/0xe0\n print_address_description.constprop.0+0x2c/0x390\n print_report+0xb9/0x280\n kasan_report+0xb8/0xf0\n fb_mode_is_equal+0x285/0x2f0\n fbcon_mode_deleted+0x129/0x180\n fb_set_var+0xe7f/0x11d0\n do_fb_ioctl+0x6a0/0x750\n fb_ioctl+0xe0/0x140\n __x64_sys_ioctl+0x193/0x210\n do_syscall_64+0x5f/0x9c0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nBased on experimentation and analysis, during framebuffer unregistration,\nonly the memory of fb_info-\u0026gt;modelist is freed, without setting the\ncorresponding fb_display[i]-\u0026gt;mode to NULL for the freed modes. This leads\nto UAF issues during subsequent accesses. Here\u0026apos;s an example of reproduction\nsteps:\n1. With /dev/fb0 already registered in the system, load a kernel module\n   to register a new device /dev/fb1;\n2. Set fb1\u0026apos;s mode to the global fb_display[] array (via FBIOPUT_CON2FBMAP);\n3. Switch console from fb to VGA (to allow normal rmmod of the ko);\n4. Unload the kernel module, at this point fb1\u0026apos;s modelist is freed, leaving\n   a wild pointer in fb_display[];\n5. Trigger the bug via system calls through fb0 attempting to delete a mode\n   from fb0.\n\nAdd a check in do_unregister_framebuffer(): if the mode to be freed exists\nin fb_display[], set the corresponding mode pointer to NULL.(CVE-2025-40323)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb\n\nThe Mesa issue referenced below pointed out a possible deadlock:\n\n[ 1231.611031]  Possible interrupt unsafe locking scenario:\n\n[ 1231.611033]        CPU0                    CPU1\n[ 1231.611034]        ----                    ----\n[ 1231.611035]   lock(\u0026amp;xa-\u0026gt;xa_lock#17);\n[ 1231.611038]                                local_irq_disable();\n[ 1231.611039]                                lock(\u0026amp;fence-\u0026gt;lock);\n[ 1231.611041]                                lock(\u0026amp;xa-\u0026gt;xa_lock#17);\n[ 1231.611044]   \u0026lt;Interrupt\u0026gt;\n[ 1231.611045]     lock(\u0026amp;fence-\u0026gt;lock);\n[ 1231.611047]\n                *** DEADLOCK ***\n\nIn this example, CPU0 would be any function accessing job-\u0026gt;dependencies\nthrough the xa_* functions that don\u0026apos;t disable interrupts (eg:\ndrm_sched_job_add_dependency(), drm_sched_entity_kill_jobs_cb()).\n\nCPU1 is executing drm_sched_entity_kill_jobs_cb() as a fence signalling\ncallback so in an interrupt context. It will deadlock when trying to\ngrab the xa_lock which is already held by CPU0.\n\nReplacing all xa_* usage by their xa_*_irq counterparts would fix\nthis issue, but Christian pointed out another issue: dma_fence_signal\ntakes fence.lock and so does dma_fence_add_callback.\n\n  dma_fence_signal() // locks f1.lock\n  -\u0026gt; drm_sched_entity_kill_jobs_cb()\n  -\u0026gt; foreach dependencies\n     -\u0026gt; dma_fence_add_callback() // locks f2.lock\n\nThis will deadlock if f1 and f2 share the same spinlock.\n\nTo fix both issues, the code iterating on dependencies and re-arming them\nis moved out to drm_sched_entity_kill_jobs_work().\n\n[phasta: commit message nits](CVE-2025-40329)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup\n\nRaw IP packets have no MAC header, leaving skb-\u0026gt;mac_header uninitialized.\nThis can trigger kernel panics on ARM64 when xfrm or other subsystems\naccess the offset due to strict alignment checks.\n\nInitialize the MAC header to prevent such crashes.\n\nThis can trigger kernel panics on ARM when running IPsec over the\nqmimux0 interface.\n\nExample trace:\n\n    Internal error: Oops: 000000009600004f [#1] SMP\n    CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.34-gbe78e49cb433 #1\n    Hardware name: LS1028A RDB Board (DT)\n    pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n    pc : xfrm_input+0xde8/0x1318\n    lr : xfrm_input+0x61c/0x1318\n    sp : ffff800080003b20\n    Call trace:\n     xfrm_input+0xde8/0x1318\n     xfrm6_rcv+0x38/0x44\n     xfrm6_esp_rcv+0x48/0xa8\n     ip6_protocol_deliver_rcu+0x94/0x4b0\n     ip6_input_finish+0x44/0x70\n     ip6_input+0x44/0xc0\n     ipv6_rcv+0x6c/0x114\n     __netif_receive_skb_one_core+0x5c/0x8c\n     __netif_receive_skb+0x18/0x60\n     process_backlog+0x78/0x17c\n     __napi_poll+0x38/0x180\n     net_rx_action+0x168/0x2f0(CVE-2025-68192)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmedia: imon: make send_packet() more robust\n\nsyzbot is reporting that imon has three problems which result in\nhung tasks due to forever holding device lock [1].\n\nFirst problem is that when usb_rx_callback_intf0() once got -EPROTO error\nafter ictx-\u0026gt;dev_present_intf0 became true, usb_rx_callback_intf0()\nresubmits urb after printk(), and resubmitted urb causes\nusb_rx_callback_intf0() to again get -EPROTO error. This results in\nprintk() flooding (RCU stalls).\n\nAlan Stern commented [2] that\n\n  In theory it\u0026apos;s okay to resubmit _if_ the driver has a robust\n  error-recovery scheme (such as giving up after some fixed limit on the\n  number of errors or after some fixed time has elapsed, perhaps with a\n  time delay to prevent a flood of errors).  Most drivers don\u0026apos;t bother to\n  do this; they simply give up right away.  This makes them more\n  vulnerable to short-term noise interference during USB transfers, but in\n  reality such interference is quite rare.  There\u0026apos;s nothing really wrong\n  with giving up right away.\n\nbut imon has a poor error-recovery scheme which just retries forever;\nthis behavior should be fixed.\n\nSince I\u0026apos;m not sure whether it is safe for imon users to give up upon any\nerror code, this patch takes care of only union of error codes chosen from\nmodules in drivers/media/rc/ directory which handle -EPROTO error (i.e.\nir_toy, mceusb and igorplugusb).\n\nSecond problem is that when usb_rx_callback_intf0() once got -EPROTO error\nbefore ictx-\u0026gt;dev_present_intf0 becomes true, usb_rx_callback_intf0() always\nresubmits urb due to commit 8791d63af0cf (\u0026quot;[media] imon: don\u0026apos;t wedge\nhardware after early callbacks\u0026quot;). Move the ictx-\u0026gt;dev_present_intf0 test\nintroduced by commit 6f6b90c9231a (\u0026quot;[media] imon: don\u0026apos;t parse scancodes\nuntil intf configured\u0026quot;) to immediately before imon_incoming_packet(), or\nthe first problem explained above happens without printk() flooding (i.e.\nhung task).\n\nThird problem is that when usb_rx_callback_intf0() is not called for some\nreason (e.g. flaky hardware; the reproducer for this problem sometimes\nprevents usb_rx_callback_intf0() from being called),\nwait_for_completion_interruptible() in send_packet() never returns (i.e.\nhung task). As a workaround for such situation, change send_packet() to\nwait for completion with timeout of 10 seconds.(CVE-2025-68194)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\npmdomain: arm: scmi: Fix genpd leak on provider registration failure\n\nIf of_genpd_add_provider_onecell() fails during probe, the previously\ncreated generic power domains are not removed, leading to a memory leak\nand potential kernel crash later in genpd_debug_add().\n\nAdd proper error handling to unwind the initialized domains before\nreturning from probe to ensure all resources are correctly released on\nfailure.\n\nExample crash trace observed without this fix:\n\n  | Unable to handle kernel paging request at virtual address fffffffffffffc70\n  | CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.18.0-rc1 #405 PREEMPT\n  | Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform\n  | pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n  | pc : genpd_debug_add+0x2c/0x160\n  | lr : genpd_debug_init+0x74/0x98\n  | Call trace:\n  |  genpd_debug_add+0x2c/0x160 (P)\n  |  genpd_debug_init+0x74/0x98\n  |  do_one_initcall+0xd0/0x2d8\n  |  do_initcall_level+0xa0/0x140\n  |  do_initcalls+0x60/0xa8\n  |  do_basic_setup+0x28/0x40\n  |  kernel_init_freeable+0xe8/0x170\n  |  kernel_init+0x2c/0x140\n  |  ret_from_fork+0x10/0x20(CVE-2025-68204)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmlx5: Fix default values in create CQ\n\nCurrently, CQs without a completion function are assigned the\nmlx5_add_cq_to_tasklet function by default. This is problematic since\nonly user CQs created through the mlx5_ib driver are intended to use\nthis function.\n\nAdditionally, all CQs that will use doorbells instead of polling for\ncompletions must call mlx5_cq_arm. However, the default CQ creation flow\nleaves a valid value in the CQ\u0026apos;s arm_db field, allowing FW to send\ninterrupts to polling-only CQs in certain corner cases.\n\nThese two factors would allow a polling-only kernel CQ to be triggered\nby an EQ interrupt and call a completion function intended only for user\nCQs, causing a null pointer exception.\n\nSome areas in the driver have prevented this issue with one-off fixes\nbut did not address the root cause.\n\nThis patch fixes the described issue by adding defaults to the create CQ\nflow. It adds a default dummy completion function to protect against\nnull pointer exceptions, and it sets an invalid command sequence number\nby default in kernel CQs to prevent the FW from sending an interrupt to\nthe CQ until it is armed. User CQs are responsible for their own\ninitialization values.\n\nCallers of mlx5_core_create_cq are responsible for changing the\ncompletion function and arming the CQ per their needs.(CVE-2025-68209)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nksm: use range-walk function to jump over holes in scan_get_next_rmap_item\n\nCurrently, scan_get_next_rmap_item() walks every page address in a VMA to\nlocate mergeable pages.  This becomes highly inefficient when scanning\nlarge virtual memory areas that contain mostly unmapped regions, causing\nksmd to use large amount of cpu without deduplicating much pages.\n\nThis patch replaces the per-address lookup with a range walk using\nwalk_page_range().  The range walker allows KSM to skip over entire\nunmapped holes in a VMA, avoiding unnecessary lookups.  This problem was\npreviously discussed in [1].\n\nConsider the following test program which creates a 32 TiB mapping in the\nvirtual address space but only populates a single page:\n\n#include \u0026lt;unistd.h\u0026gt;\n#include \u0026lt;stdio.h\u0026gt;\n#include \u0026lt;sys/mman.h\u0026gt;\n\n/* 32 TiB */\nconst size_t size = 32ul * 1024 * 1024 * 1024 * 1024;\n\nint main() {\n        char *area = mmap(NULL, size, PROT_READ | PROT_WRITE,\n                          MAP_NORESERVE | MAP_PRIVATE | MAP_ANON, -1, 0);\n\n        if (area == MAP_FAILED) {\n                perror(\u0026quot;mmap() failed\\n\u0026quot;);\n                return -1;\n        }\n\n        /* Populate a single page such that we get an anon_vma. */\n        *area = 0;\n\n        /* Enable KSM. */\n        madvise(area, size, MADV_MERGEABLE);\n        pause();\n        return 0;\n}\n\n$ ./ksm-sparse  \u0026amp;\n$ echo 1 \u0026gt; /sys/kernel/mm/ksm/run \n\nWithout this patch ksmd uses 100% of the cpu for a long time (more then 1\nhour in my test machine) scanning all the 32 TiB virtual address space\nthat contain only one mapped page.  This makes ksmd essentially deadlocked\nnot able to deduplicate anything of value.  With this patch ksmd walks\nonly the one mapped page and skips the rest of the 32 TiB virtual address\nspace, making the scan fast using little cpu.(CVE-2025-68211)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/mempool: fix poisoning order\u0026gt;0 pages with HIGHMEM\n\nThe kernel test has reported:\n\n  BUG: unable to handle page fault for address: fffba000\n  #PF: supervisor write access in kernel mode\n  #PF: error_code(0x0002) - not-present page\n  *pde = 03171067 *pte = 00000000\n  Oops: Oops: 0002 [#1]\n  CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Tainted: G                T   6.18.0-rc2-00031-gec7f31b2a2d3 #1 NONE  a1d066dfe789f54bc7645c7989957d2bdee593ca\n  Tainted: [T]=RANDSTRUCT\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n  EIP: memset (arch/x86/include/asm/string_32.h:168 arch/x86/lib/memcpy_32.c:17)\n  Code: a5 8b 4d f4 83 e1 03 74 02 f3 a4 83 c4 04 5e 5f 5d 2e e9 73 41 01 00 90 90 90 3e 8d 74 26 00 55 89 e5 57 56 89 c6 89 d0 89 f7 \u0026lt;f3\u0026gt; aa 89 f0 5e 5f 5d 2e e9 53 41 01 00 cc cc cc 55 89 e5 53 57 56\n  EAX: 0000006b EBX: 00000015 ECX: 001fefff EDX: 0000006b\n  ESI: fffb9000 EDI: fffba000 EBP: c611fbf0 ESP: c611fbe8\n  DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 EFLAGS: 00010287\n  CR0: 80050033 CR2: fffba000 CR3: 0316e000 CR4: 00040690\n  Call Trace:\n   poison_element (mm/mempool.c:83 mm/mempool.c:102)\n   mempool_init_node (mm/mempool.c:142 mm/mempool.c:226)\n   mempool_init_noprof (mm/mempool.c:250 (discriminator 1))\n   ? mempool_alloc_pages (mm/mempool.c:640)\n   bio_integrity_initfn (block/bio-integrity.c:483 (discriminator 8))\n   ? mempool_alloc_pages (mm/mempool.c:640)\n   do_one_initcall (init/main.c:1283)\n\nChristoph found out this is due to the poisoning code not dealing\nproperly with CONFIG_HIGHMEM because only the first page is mapped but\nthen the whole potentially high-order page is accessed.\n\nWe could give up on HIGHMEM here, but it\u0026apos;s straightforward to fix this\nwith a loop that\u0026apos;s mapping, poisoning or checking and unmapping\nindividual pages.(CVE-2025-68231)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmtdchar: fix integer overflow in read/write ioctls\n\nThe \u0026quot;req.start\u0026quot; and \u0026quot;req.len\u0026quot; variables are u64 values that come from the\nuser at the start of the function.  We mask away the high 32 bits of\n\u0026quot;req.len\u0026quot; so that\u0026apos;s capped at U32_MAX but the \u0026quot;req.start\u0026quot; variable can go\nup to U64_MAX which means that the addition can still integer overflow.\n\nUse check_add_overflow() to fix this bug.(CVE-2025-68237)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: udc: fix use-after-free in usb_gadget_state_work\n\nA race condition during gadget teardown can lead to a use-after-free\nin usb_gadget_state_work(), as reported by KASAN:\n\n  BUG: KASAN: invalid-access in sysfs_notify+0x2c/0xd0\n  Workqueue: events usb_gadget_state_work\n\nThe fundamental race occurs because a concurrent event (e.g., an\ninterrupt) can call usb_gadget_set_state() and schedule gadget-\u0026gt;work\nat any time during the cleanup process in usb_del_gadget().\n\nCommit 399a45e5237c (\u0026quot;usb: gadget: core: flush gadget workqueue after\ndevice removal\u0026quot;) attempted to fix this by moving flush_work() to after\ndevice_del(). However, this does not fully solve the race, as a new\nwork item can still be scheduled *after* flush_work() completes but\nbefore the gadget\u0026apos;s memory is freed, leading to the same use-after-free.\n\nThis patch fixes the race condition robustly by introducing a \u0026apos;teardown\u0026apos;\nflag and a \u0026apos;state_lock\u0026apos; spinlock to the usb_gadget struct. The flag is\nset during cleanup in usb_del_gadget() *before* calling flush_work() to\nprevent any new work from being scheduled once cleanup has commenced.\nThe scheduling site, usb_gadget_set_state(), now checks this flag under\nthe lock before queueing the work, thus safely closing the race window.(CVE-2025-68282)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/huge_memory: fix NULL pointer deference when splitting folio\n\nCommit c010d47f107f (\u0026quot;mm: thp: split huge page to any lower order pages\u0026quot;)\nintroduced an early check on the folio\u0026apos;s order via mapping-\u0026gt;flags before\nproceeding with the split work.\n\nThis check introduced a bug: for shmem folios in the swap cache and\ntruncated folios, the mapping pointer can be NULL.  Accessing\nmapping-\u0026gt;flags in this state leads directly to a NULL pointer dereference.\n\nThis commit fixes the issue by moving the check for mapping != NULL before\nany attempt to access mapping-\u0026gt;flags.(CVE-2025-68293)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nx86/CPU/AMD: Add RDSEED fix for Zen5\n\nThere\u0026apos;s an issue with RDSEED\u0026apos;s 16-bit and 32-bit register output\nvariants on Zen5 which return a random value of 0 \u0026quot;at a rate inconsistent\nwith randomness while incorrectly signaling success (CF=1)\u0026quot;. Search the\nweb for AMD-SB-7055 for more detail.\n\nAdd a fix glue which checks microcode revisions.\n\n  [ bp: Add microcode revisions checking, rewrite. ](CVE-2025-68313)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ninet: frags: flush pending skbs in fqdir_pre_exit()\n\nWe have been seeing occasional deadlocks on pernet_ops_rwsem since\nSeptember in NIPA. The stuck task was usually modprobe (often loading\na driver like ipvlan), trying to take the lock as a Writer.\nlockdep does not track readers for rwsems so the read wasn\u0026apos;t obvious\nfrom the reports.\n\nOn closer inspection the Reader holding the lock was conntrack looping\nforever in nf_conntrack_cleanup_net_list(). Based on past experience\nwith occasional NIPA crashes I looked thru the tests which run before\nthe crash and noticed that the crash follows ip_defrag.sh. An immediate\nred flag. Scouring thru (de)fragmentation queues reveals skbs sitting\naround, holding conntrack references.\n\nThe problem is that since conntrack depends on nf_defrag_ipv6,\nnf_defrag_ipv6 will load first. Since nf_defrag_ipv6 loads first its\nnetns exit hooks run _after_ conntrack\u0026apos;s netns exit hook.\n\nFlush all fragment queue SKBs during fqdir_pre_exit() to release\nconntrack references before conntrack cleanup runs. Also flush\nthe queues in timer expiry handlers when they discover fqdir-\u0026gt;dead\nis set, in case packet sneaks in while we\u0026apos;re running the pre_exit\nflush.\n\nThe commit under Fixes is not exactly the culprit, but I think\npreviously the timer firing would eventually unblock the spinning\nconntrack.(CVE-2025-68768)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: fix middle attribute validation in push_nsh() action\n\nThe push_nsh() action structure looks like this:\n\n OVS_ACTION_ATTR_PUSH_NSH(OVS_KEY_ATTR_NSH(OVS_NSH_KEY_ATTR_BASE,...))\n\nThe outermost OVS_ACTION_ATTR_PUSH_NSH attribute is OK\u0026apos;ed by the\nnla_for_each_nested() inside __ovs_nla_copy_actions().  The innermost\nOVS_NSH_KEY_ATTR_BASE/MD1/MD2 are OK\u0026apos;ed by the nla_for_each_nested()\ninside nsh_key_put_from_nlattr().  But nothing checks if the attribute\nin the middle is OK.  We don\u0026apos;t even check that this attribute is the\nOVS_KEY_ATTR_NSH.  We just do a double unwrap with a pair of nla_data()\ncalls - first time directly while calling validate_push_nsh() and the\nsecond time as part of the nla_for_each_nested() macro, which isn\u0026apos;t\nsafe, potentially causing invalid memory access if the size of this\nattribute is incorrect.  The failure may not be noticed during\nvalidation due to larger netlink buffer, but cause trouble later during\naction execution where the buffer is allocated exactly to the size:\n\n BUG: KASAN: slab-out-of-bounds in nsh_hdr_from_nlattr+0x1dd/0x6a0 [openvswitch]\n Read of size 184 at addr ffff88816459a634 by task a.out/22624\n\n CPU: 8 UID: 0 PID: 22624 6.18.0-rc7+ #115 PREEMPT(voluntary)\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  dump_stack_lvl+0x51/0x70\n  print_address_description.constprop.0+0x2c/0x390\n  kasan_report+0xdd/0x110\n  kasan_check_range+0x35/0x1b0\n  __asan_memcpy+0x20/0x60\n  nsh_hdr_from_nlattr+0x1dd/0x6a0 [openvswitch]\n  push_nsh+0x82/0x120 [openvswitch]\n  do_execute_actions+0x1405/0x2840 [openvswitch]\n  ovs_execute_actions+0xd5/0x3b0 [openvswitch]\n  ovs_packet_cmd_execute+0x949/0xdb0 [openvswitch]\n  genl_family_rcv_msg_doit+0x1d6/0x2b0\n  genl_family_rcv_msg+0x336/0x580\n  genl_rcv_msg+0x9f/0x130\n  netlink_rcv_skb+0x11f/0x370\n  genl_rcv+0x24/0x40\n  netlink_unicast+0x73e/0xaa0\n  netlink_sendmsg+0x744/0xbf0\n  __sys_sendto+0x3d6/0x450\n  do_syscall_64+0x79/0x2c0\n  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n  \u0026lt;/TASK\u0026gt;\n\nLet\u0026apos;s add some checks that the attribute is properly sized and it\u0026apos;s\nthe only one attribute inside the action.  Technically, there is no\nreal reason for OVS_KEY_ATTR_NSH to be there, as we know that we\u0026apos;re\npushing an NSH header already, it just creates extra nesting, but\nthat\u0026apos;s how uAPI works today.  So, keeping as it is.(CVE-2025-68785)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmedia: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg()\n\nrlen value is a user-controlled value, but dtv5100_i2c_msg() does not\ncheck the size of the rlen value. Therefore, if it is set to a value\nlarger than sizeof(st-\u0026gt;data), an out-of-bounds vuln occurs for st-\u0026gt;data.\n\nTherefore, we need to add proper range checking to prevent this vuln.(CVE-2025-68819)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nInput: alps - fix use-after-free bugs caused by dev3_register_work\n\nThe dev3_register_work delayed work item is initialized within\nalps_reconnect() and scheduled upon receipt of the first bare\nPS/2 packet from an external PS/2 device connected to the ALPS\ntouchpad. During device detachment, the original implementation\ncalls flush_workqueue() in psmouse_disconnect() to ensure\ncompletion of dev3_register_work. However, the flush_workqueue()\nin psmouse_disconnect() only blocks and waits for work items that\nwere already queued to the workqueue prior to its invocation. Any\nwork items submitted after flush_workqueue() is called are not\nincluded in the set of tasks that the flush operation awaits.\nThis means that after flush_workqueue() has finished executing,\nthe dev3_register_work could still be scheduled. Although the\npsmouse state is set to PSMOUSE_CMD_MODE in psmouse_disconnect(),\nthe scheduling of dev3_register_work remains unaffected.\n\nThe race condition can occur as follows:\n\nCPU 0 (cleanup path)     | CPU 1 (delayed work)\npsmouse_disconnect()     |\n  psmouse_set_state()    |\n  flush_workqueue()      | alps_report_bare_ps2_packet()\n  alps_disconnect()      |   psmouse_queue_work()\n    kfree(priv); // FREE | alps_register_bare_ps2_mouse()\n                         |   priv = container_of(work...); // USE\n                         |   priv-\u0026gt;dev3 // USE\n\nAdd disable_delayed_work_sync() in alps_disconnect() to ensure\nthat dev3_register_work is properly canceled and prevented from\nexecuting after the alps_data structure has been deallocated.\n\nThis bug is identified by static analysis.(CVE-2025-68822)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid potential deadlock\n\nAs Jiaming Zhang and syzbot reported, there is potential deadlock in\nf2fs as below:\n\nChain exists of:\n  \u0026amp;sbi-\u0026gt;cp_rwsem --\u0026gt; fs_reclaim --\u0026gt; sb_internal#2\n\n Possible unsafe locking scenario:\n\n       CPU0                    CPU1\n       ----                    ----\n  rlock(sb_internal#2);\n                               lock(fs_reclaim);\n                               lock(sb_internal#2);\n  rlock(\u0026amp;sbi-\u0026gt;cp_rwsem);\n\n *** DEADLOCK ***\n\n3 locks held by kswapd0/73:\n #0: ffffffff8e247a40 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat mm/vmscan.c:7015 [inline]\n #0: ffffffff8e247a40 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0x951/0x2800 mm/vmscan.c:7389\n #1: ffff8880118400e0 (\u0026amp;type-\u0026gt;s_umount_key#50){.+.+}-{4:4}, at: super_trylock_shared fs/super.c:562 [inline]\n #1: ffff8880118400e0 (\u0026amp;type-\u0026gt;s_umount_key#50){.+.+}-{4:4}, at: super_cache_scan+0x91/0x4b0 fs/super.c:197\n #2: ffff888011840610 (sb_internal#2){.+.+}-{0:0}, at: f2fs_evict_inode+0x8d9/0x1b60 fs/f2fs/inode.c:890\n\nstack backtrace:\nCPU: 0 UID: 0 PID: 73 Comm: kswapd0 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\nCall Trace:\n \u0026lt;TASK\u0026gt;\n dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120\n print_circular_bug+0x2ee/0x310 kernel/locking/lockdep.c:2043\n check_noncircular+0x134/0x160 kernel/locking/lockdep.c:2175\n check_prev_add kernel/locking/lockdep.c:3165 [inline]\n check_prevs_add kernel/locking/lockdep.c:3284 [inline]\n validate_chain+0xb9b/0x2140 kernel/locking/lockdep.c:3908\n __lock_acquire+0xab9/0xd20 kernel/locking/lockdep.c:5237\n lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5868\n down_read+0x46/0x2e0 kernel/locking/rwsem.c:1537\n f2fs_down_read fs/f2fs/f2fs.h:2278 [inline]\n f2fs_lock_op fs/f2fs/f2fs.h:2357 [inline]\n f2fs_do_truncate_blocks+0x21c/0x10c0 fs/f2fs/file.c:791\n f2fs_truncate_blocks+0x10a/0x300 fs/f2fs/file.c:867\n f2fs_truncate+0x489/0x7c0 fs/f2fs/file.c:925\n f2fs_evict_inode+0x9f2/0x1b60 fs/f2fs/inode.c:897\n evict+0x504/0x9c0 fs/inode.c:810\n f2fs_evict_inode+0x1dc/0x1b60 fs/f2fs/inode.c:853\n evict+0x504/0x9c0 fs/inode.c:810\n dispose_list fs/inode.c:852 [inline]\n prune_icache_sb+0x21b/0x2c0 fs/inode.c:1000\n super_cache_scan+0x39b/0x4b0 fs/super.c:224\n do_shrink_slab+0x6ef/0x1110 mm/shrinker.c:437\n shrink_slab_memcg mm/shrinker.c:550 [inline]\n shrink_slab+0x7ef/0x10d0 mm/shrinker.c:628\n shrink_one+0x28a/0x7c0 mm/vmscan.c:4955\n shrink_many mm/vmscan.c:5016 [inline]\n lru_gen_shrink_node mm/vmscan.c:5094 [inline]\n shrink_node+0x315d/0x3780 mm/vmscan.c:6081\n kswapd_shrink_node mm/vmscan.c:6941 [inline]\n balance_pgdat mm/vmscan.c:7124 [inline]\n kswapd+0x147c/0x2800 mm/vmscan.c:7389\n kthread+0x70e/0x8a0 kernel/kthread.c:463\n ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n \u0026lt;/TASK\u0026gt;\n\nThe root cause is deadlock among four locks as below:\n\nkswapd\n- fs_reclaim\t\t\t\t--- Lock A\n - shrink_one\n  - evict\n   - f2fs_evict_inode\n    - sb_start_intwrite\t\t\t--- Lock B\n\n- iput\n - evict\n  - f2fs_evict_inode\n   - sb_start_intwrite\t\t\t--- Lock B\n   - f2fs_truncate\n    - f2fs_truncate_blocks\n     - f2fs_do_truncate_blocks\n      - f2fs_lock_op\t\t\t--- Lock C\n\nioctl\n- f2fs_ioc_commit_atomic_write\n - f2fs_lock_op\t\t\t\t--- Lock C\n  - __f2fs_commit_atomic_write\n   - __replace_atomic_write_block\n    - f2fs_get_dnode_of_data\n     - __get_node_folio\n      - f2fs_check_nid_range\n       - f2fs_handle_error\n        - f2fs_record_errors\n         - f2fs_down_write\t\t--- Lock D\n\nopen\n- do_open\n - do_truncate\n  - security_inode_need_killpriv\n   - f2fs_getxattr\n    - lookup_all_xattrs\n     - f2fs_handle_error\n      - f2fs_record_errors\n       - f2fs_down_write\t\t--- Lock D\n        - f2fs_commit_super\n         - read_mapping_folio\n          - filemap_alloc_folio_noprof\n           - prepare_alloc_pages\n            - fs_reclaim_acquire\t--- Lock A\n\nIn order to a\n---truncated---(CVE-2025-71065)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: bound check rq_pages index in inline path\n\nsvc_rdma_copy_inline_range indexed rqstp-\u0026gt;rq_pages[rc_curpage] without\nverifying rc_curpage stays within the allocated page array. Add guards\nbefore the first use and after advancing to a new page.(CVE-2025-71068)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/ttm: Avoid NULL pointer deref for evicted BOs\n\nIt is possible for a BO to exist that is not currently associated with a\nresource, e.g. because it has been evicted.\n\nWhen devcoredump tries to read the contents of all BOs for dumping, we need\nto expect this as well -- in this case, ENODATA is recorded instead of the\nbuffer contents.(CVE-2025-71083)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/cm: Fix leaking the multicast GID table reference\n\nIf the CM ID is destroyed while the CM event for multicast creating is\nstill queued the cancel_work_sync() will prevent the work from running\nwhich also prevents destroying the ah_attr. This leaks a refcount and\ntriggers a WARN:\n\n   GID entry ref leak for dev syz1 index 2 ref=573\n   WARNING: CPU: 1 PID: 655 at drivers/infiniband/core/cache.c:809 release_gid_table drivers/infiniband/core/cache.c:806 [inline]\n   WARNING: CPU: 1 PID: 655 at drivers/infiniband/core/cache.c:809 gid_table_release_one+0x284/0x3cc drivers/infiniband/core/cache.c:886\n\nDestroy the ah_attr after canceling the work, it is safe to call this\ntwice.(CVE-2025-71084)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nteam: fix check for port enabled in team_queue_override_port_prio_changed()\n\nThere has been a syzkaller bug reported recently with the following\ntrace:\n\nlist_del corruption, ffff888058bea080-\u0026gt;prev is LIST_POISON2 (dead000000000122)\n------------[ cut here ]------------\nkernel BUG at lib/list_debug.c:59!\nOops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\nCPU: 3 UID: 0 PID: 21246 Comm: syz.0.2928 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\nRIP: 0010:__list_del_entry_valid_or_report+0x13e/0x200 lib/list_debug.c:59\nCode: 48 c7 c7 e0 71 f0 8b e8 30 08 ef fc 90 0f 0b 48 89 ef e8 a5 02 55 fd 48 89 ea 48 89 de 48 c7 c7 40 72 f0 8b e8 13 08 ef fc 90 \u0026lt;0f\u0026gt; 0b 48 89 ef e8 88 02 55 fd 48 89 ea 48 b8 00 00 00 00 00 fc ff\nRSP: 0018:ffffc9000d49f370 EFLAGS: 00010286\nRAX: 000000000000004e RBX: ffff888058bea080 RCX: ffffc9002817d000\nRDX: 0000000000000000 RSI: ffffffff819becc6 RDI: 0000000000000005\nRBP: dead000000000122 R08: 0000000000000005 R09: 0000000000000000\nR10: 0000000080000000 R11: 0000000000000001 R12: ffff888039e9c230\nR13: ffff888058bea088 R14: ffff888058bea080 R15: ffff888055461480\nFS:  00007fbbcfe6f6c0(0000) GS:ffff8880d6d0a000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000000110c3afcb0 CR3: 00000000382c7000 CR4: 0000000000352ef0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n __list_del_entry_valid include/linux/list.h:132 [inline]\n __list_del_entry include/linux/list.h:223 [inline]\n list_del_rcu include/linux/rculist.h:178 [inline]\n __team_queue_override_port_del drivers/net/team/team_core.c:826 [inline]\n __team_queue_override_port_del drivers/net/team/team_core.c:821 [inline]\n team_queue_override_port_prio_changed drivers/net/team/team_core.c:883 [inline]\n team_priority_option_set+0x171/0x2f0 drivers/net/team/team_core.c:1534\n team_option_set drivers/net/team/team_core.c:376 [inline]\n team_nl_options_set_doit+0x8ae/0xe60 drivers/net/team/team_core.c:2653\n genl_family_rcv_msg_doit+0x209/0x2f0 net/netlink/genetlink.c:1115\n genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]\n genl_rcv_msg+0x55c/0x800 net/netlink/genetlink.c:1210\n netlink_rcv_skb+0x158/0x420 net/netlink/af_netlink.c:2552\n genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219\n netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]\n netlink_unicast+0x5aa/0x870 net/netlink/af_netlink.c:1346\n netlink_sendmsg+0x8c8/0xdd0 net/netlink/af_netlink.c:1896\n sock_sendmsg_nosec net/socket.c:727 [inline]\n __sock_sendmsg net/socket.c:742 [inline]\n ____sys_sendmsg+0xa98/0xc70 net/socket.c:2630\n ___sys_sendmsg+0x134/0x1d0 net/socket.c:2684\n __sys_sendmsg+0x16d/0x220 net/socket.c:2716\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xcd/0xfa0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nThe problem is in this flow:\n1) Port is enabled, queue_id != 0, in qom_list\n2) Port gets disabled\n        -\u0026gt; team_port_disable()\n        -\u0026gt; team_queue_override_port_del()\n        -\u0026gt; del (removed from list)\n3) Port is disabled, queue_id != 0, not in any list\n4) Priority changes\n        -\u0026gt; team_queue_override_port_prio_changed()\n        -\u0026gt; checks: port disabled \u0026amp;\u0026amp; queue_id != 0\n        -\u0026gt; calls del - hits the BUG as it is removed already\n\nTo fix this, change the check in team_queue_override_port_prio_changed()\nso it returns early if port is not enabled.(CVE-2025-71091)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly\n\nThe netlink response for RDMA_NL_LS_OP_IP_RESOLVE should always have a\nLS_NLA_TYPE_DGID attribute, it is invalid if it does not.\n\nUse the nl parsing logic properly and call nla_parse_deprecated() to fill\nthe nlattrs array and then directly index that array to get the data for\nthe DGID. Just fail if it is NULL.\n\nRemove the for loop searching for the nla, and squash the validation and\nparsing into one function.\n\nFixes an uninitialized read from the stack triggered by userspace if it\ndoes not provide the DGID to a kernel initiated RDMA_NL_LS_OP_IP_RESOLVE\nquery.\n\n    BUG: KMSAN: uninit-value in hex_byte_pack include/linux/hex.h:13 [inline]\n    BUG: KMSAN: uninit-value in ip6_string+0xef4/0x13a0 lib/vsprintf.c:1490\n     hex_byte_pack include/linux/hex.h:13 [inline]\n     ip6_string+0xef4/0x13a0 lib/vsprintf.c:1490\n     ip6_addr_string+0x18a/0x3e0 lib/vsprintf.c:1509\n     ip_addr_string+0x245/0xee0 lib/vsprintf.c:1633\n     pointer+0xc09/0x1bd0 lib/vsprintf.c:2542\n     vsnprintf+0xf8a/0x1bd0 lib/vsprintf.c:2930\n     vprintk_store+0x3ae/0x1530 kernel/printk/printk.c:2279\n     vprintk_emit+0x307/0xcd0 kernel/printk/printk.c:2426\n     vprintk_default+0x3f/0x50 kernel/printk/printk.c:2465\n     vprintk+0x36/0x50 kernel/printk/printk_safe.c:82\n     _printk+0x17e/0x1b0 kernel/printk/printk.c:2475\n     ib_nl_process_good_ip_rsep drivers/infiniband/core/addr.c:128 [inline]\n     ib_nl_handle_ip_res_resp+0x963/0x9d0 drivers/infiniband/core/addr.c:141\n     rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:-1 [inline]\n     rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline]\n     rdma_nl_rcv+0xefa/0x11c0 drivers/infiniband/core/netlink.c:259\n     netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]\n     netlink_unicast+0xf04/0x12b0 net/netlink/af_netlink.c:1346\n     netlink_sendmsg+0x10b3/0x1250 net/netlink/af_netlink.c:1896\n     sock_sendmsg_nosec net/socket.c:714 [inline]\n     __sock_sendmsg+0x333/0x3d0 net/socket.c:729\n     ____sys_sendmsg+0x7e0/0xd80 net/socket.c:2617\n     ___sys_sendmsg+0x271/0x3b0 net/socket.c:2671\n     __sys_sendmsg+0x1aa/0x300 net/socket.c:2703\n     __compat_sys_sendmsg net/compat.c:346 [inline]\n     __do_compat_sys_sendmsg net/compat.c:353 [inline]\n     __se_compat_sys_sendmsg net/compat.c:350 [inline]\n     __ia32_compat_sys_sendmsg+0xa4/0x100 net/compat.c:350\n     ia32_sys_call+0x3f6c/0x4310 arch/x86/include/generated/asm/syscalls_32.h:371\n     do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]\n     __do_fast_syscall_32+0xb0/0x150 arch/x86/entry/syscall_32.c:306\n     do_fast_syscall_32+0x38/0x80 arch/x86/entry/syscall_32.c:331\n     do_SYSENTER_32+0x1f/0x30 arch/x86/entry/syscall_32.c:3(CVE-2025-71096)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv4: Fix reference count leak when using error routes with nexthop objects\n\nWhen a nexthop object is deleted, it is marked as dead and then\nfib_table_flush() is called to flush all the routes that are using the\ndead nexthop.\n\nThe current logic in fib_table_flush() is to only flush error routes\n(e.g., blackhole) when it is called as part of network namespace\ndismantle (i.e., with flush_all=true). Therefore, error routes are not\nflushed when their nexthop object is deleted:\n\n # ip link add name dummy1 up type dummy\n # ip nexthop add id 1 dev dummy1\n # ip route add 198.51.100.1/32 nhid 1\n # ip route add blackhole 198.51.100.2/32 nhid 1\n # ip nexthop del id 1\n # ip route show\n blackhole 198.51.100.2 nhid 1 dev dummy1\n\nAs such, they keep holding a reference on the nexthop object which in\nturn holds a reference on the nexthop device, resulting in a reference\ncount leak:\n\n # ip link del dev dummy1\n [   70.516258] unregister_netdevice: waiting for dummy1 to become free. Usage count = 2\n\nFix by flushing error routes when their nexthop is marked as dead.\n\nIPv6 does not suffer from this problem.(CVE-2025-71097)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Avoid walking the Namespace if start_node is NULL\n\nAlthough commit 0c9992315e73 (\u0026quot;ACPICA: Avoid walking the ACPI Namespace\nif it is not there\u0026quot;) fixed the situation when both start_node and\nacpi_gbl_root_node are NULL, the Linux kernel mainline now still crashed\non Honor Magicbook 14 Pro [1].\n\nThat happens due to the access to the member of parent_node in\nacpi_ns_get_next_node().  The NULL pointer dereference will always\nhappen, no matter whether or not the start_node is equal to\nACPI_ROOT_OBJECT, so move the check of start_node being NULL\nout of the if block.\n\nUnfortunately, all the attempts to contact Honor have failed, they\nrefused to provide any technical support for Linux.\n\nThe bad DSDT table\u0026apos;s dump could be found on GitHub [2].\n\nDMI: HONOR FMB-P/FMB-P-PCB, BIOS 1.13 05/08/2025\n\n[ rjw: Subject adjustment, changelog edits ](CVE-2025-71118)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf\n\nA zero length gss_token results in pages == 0 and in_token-\u0026gt;pages[0]\nis NULL. The code unconditionally evaluates\npage_address(in_token-\u0026gt;pages[0]) for the initial memcpy, which can\ndereference NULL even when the copy length is 0. Guard the first\nmemcpy so it only runs when length \u0026gt; 0.(CVE-2025-71120)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: BPF: Sign extend kfunc call arguments\n\nThe kfunc calls are native calls so they should follow LoongArch calling\nconventions. Sign extend its arguments properly to avoid kernel panic.\nThis is done by adding a new emit_abi_ext() helper. The emit_abi_ext()\nhelper performs extension in place meaning a value already store in the\ntarget register (Note: this is different from the existing sign_extend()\nhelper and thus we can\u0026apos;t reuse it).(CVE-2025-71129)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/tilcdc: Fix removal actions in case of failed probe\n\nThe drm_kms_helper_poll_fini() and drm_atomic_helper_shutdown() helpers\nshould only be called when the device has been successfully registered.\nCurrently, these functions are called unconditionally in tilcdc_fini(),\nwhich causes warnings during probe deferral scenarios.\n\n[    7.972317] WARNING: CPU: 0 PID: 23 at drivers/gpu/drm/drm_atomic_state_helper.c:175 drm_atomic_helper_crtc_duplicate_state+0x60/0x68\n...\n[    8.005820]  drm_atomic_helper_crtc_duplicate_state from drm_atomic_get_crtc_state+0x68/0x108\n[    8.005858]  drm_atomic_get_crtc_state from drm_atomic_helper_disable_all+0x90/0x1c8\n[    8.005885]  drm_atomic_helper_disable_all from drm_atomic_helper_shutdown+0x90/0x144\n[    8.005911]  drm_atomic_helper_shutdown from tilcdc_fini+0x68/0xf8 [tilcdc]\n[    8.005957]  tilcdc_fini [tilcdc] from tilcdc_pdev_probe+0xb0/0x6d4 [tilcdc]\n\nFix this by rewriting the failed probe cleanup path using the standard\ngoto error handling pattern, which ensures that cleanup functions are\nonly called on successfully initialized resources. Additionally, remove\nthe now-unnecessary is_registered flag.(CVE-2025-71141)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: stm32: dmamux: fix device leak on route allocation\n\nMake sure to drop the reference taken when looking up the DMA mux\nplatform device during route allocation.\n\nNote that holding a reference to a device does not prevent its driver\ndata from going away so there is no point in keeping the reference.(CVE-2025-71186)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe()\n\nWhen ksmbd_iov_pin_rsp() fails, we should call ksmbd_session_rpc_close().(CVE-2025-71220)\n\nIn the Linux kernel, a race condition vulnerability exists in the mmp_pdma driver. The vulnerability occurs in the mmp_pdma_residue() function which lacks proper locking mechanisms, potentially leading to use-after-free issues when accessing descriptor lists and descriptor contents.\n\nThe race condition occurs when multiple threads call tx_status() while the tasklet on another CPU is freeing completed descriptors. This issue can be reproduced when running dmatest on the same channel with multiple threads (threads_per_chan \u0026gt; 1).\n\nThe fix involves protecting the chain_running list iteration and descriptor access with the chan-\u0026gt;desc_lock spinlock.(CVE-2025-71221)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb/server: fix refcount leak in smb2_open()\n\nWhen ksmbd_vfs_getattr() fails, the reference count of ksmbd_file\nmust be released.(CVE-2025-71223)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmd: suspend array while updating raid_disks via sysfs\n\nIn raid1_reshape(), freeze_array() is called before modifying the r1bio\nmemory pool (conf-\u0026gt;r1bio_pool) and conf-\u0026gt;raid_disks, and\nunfreeze_array() is called after the update is completed.\n\nHowever, freeze_array() only waits until nr_sync_pending and\n(nr_pending - nr_queued) of all buckets reaches zero. When an I/O error\noccurs, nr_queued is increased and the corresponding r1bio is queued to\neither retry_list or bio_end_io_list. As a result, freeze_array() may\nunblock before these r1bios are released.\n\nThis can lead to a situation where conf-\u0026gt;raid_disks and the mempool have\nalready been updated while queued r1bios, allocated with the old\nraid_disks value, are later released. Consequently, free_r1bio() may\naccess memory out of bounds in put_all_bios() and release r1bios of the\nwrong size to the new mempool, potentially causing issues with the\nmempool as well.\n\nSince only normal I/O might increase nr_queued while an I/O error occurs,\nsuspending the array avoids this issue.\n\nNote: Updating raid_disks via ioctl SET_ARRAY_INFO already suspends\nthe array. Therefore, we suspend the array when updating raid_disks\nvia sysfs to avoid this issue too.(CVE-2025-71225)\n\nIn the Linux kernel, the following vulnerability has been resolved:  scsi: qla2xxx: Free sp in error path to fix system crash  System crash seen during load/unload test in a loop,  [61110.449331] qla2xxx [0000:27:00.0]-0042:0: Disabled MSI-X. [61110.467494](CVE-2025-71232)\n\nIn the Linux kernel, there is a race condition vulnerability in the SCSI qla2xxx driver. System crash was observed during load/unload loop testing. The root cause was a memory free operation occurring in interrupt context. When device discovery/fabric scan was in progress and module unload was issued setting the UNLOADING flag, work queue items could not be allocated and mapped memory had to be freed in interrupt context, leading to system crash.(CVE-2025-71235)\n\nA NULL pointer dereference vulnerability exists in the SCSI qla2xxx driver subsystem of the Linux kernel. When the system attempts to free associated memory in the qla_fab_async_scan function, it fails to validate whether the sp pointer is NULL, leading to kernel NULL pointer dereference and system crashes. This vulnerability can be exploited by attackers to cause denial of service.(CVE-2025-71236)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: sock: fix hardened usercopy panic in sock_recv_errqueue\n\nskbuff_fclone_cache was created without defining a usercopy region,\n[1] unlike skbuff_head_cache which properly whitelists the cb[] field.\n[2] This causes a usercopy BUG() when CONFIG_HARDENED_USERCOPY is\nenabled and the kernel attempts to copy sk_buff.cb data to userspace\nvia sock_recv_errqueue() -\u0026gt; put_cmsg().\n\nThe crash occurs when: 1. TCP allocates an skb using alloc_skb_fclone()\n   (from skbuff_fclone_cache) [1]\n2. The skb is cloned via skb_clone() using the pre-allocated fclone\n[3] 3. The cloned skb is queued to sk_error_queue for timestamp\nreporting 4. Userspace reads the error queue via recvmsg(MSG_ERRQUEUE)\n5. sock_recv_errqueue() calls put_cmsg() to copy serr-\u0026gt;ee from skb-\u0026gt;cb\n[4] 6. __check_heap_object() fails because skbuff_fclone_cache has no\n   usercopy whitelist [5]\n\nWhen cloned skbs allocated from skbuff_fclone_cache are used in the\nsocket error queue, accessing the sock_exterr_skb structure in skb-\u0026gt;cb\nvia put_cmsg() triggers a usercopy hardening violation:\n\n[    5.379589] usercopy: Kernel memory exposure attempt detected from SLUB object \u0026apos;skbuff_fclone_cache\u0026apos; (offset 296, size 16)!\n[    5.382796] kernel BUG at mm/usercopy.c:102!\n[    5.383923] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\n[    5.384903] CPU: 1 UID: 0 PID: 138 Comm: poc_put_cmsg Not tainted 6.12.57 #7\n[    5.384903] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\n[    5.384903] RIP: 0010:usercopy_abort+0x6c/0x80\n[    5.384903] Code: 1a 86 51 48 c7 c2 40 15 1a 86 41 52 48 c7 c7 c0 15 1a 86 48 0f 45 d6 48 c7 c6 80 15 1a 86 48 89 c1 49 0f 45 f3 e8 84 27 88 ff \u0026lt;0f\u0026gt; 0b 490\n[    5.384903] RSP: 0018:ffffc900006f77a8 EFLAGS: 00010246\n[    5.384903] RAX: 000000000000006f RBX: ffff88800f0ad2a8 RCX: 1ffffffff0f72e74\n[    5.384903] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff87b973a0\n[    5.384903] RBP: 0000000000000010 R08: 0000000000000000 R09: fffffbfff0f72e74\n[    5.384903] R10: 0000000000000003 R11: 79706f6372657375 R12: 0000000000000001\n[    5.384903] R13: ffff88800f0ad2b8 R14: ffffea00003c2b40 R15: ffffea00003c2b00\n[    5.384903] FS:  0000000011bc4380(0000) GS:ffff8880bf100000(0000) knlGS:0000000000000000\n[    5.384903] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[    5.384903] CR2: 000056aa3b8e5fe4 CR3: 000000000ea26004 CR4: 0000000000770ef0\n[    5.384903] PKRU: 55555554\n[    5.384903] Call Trace:\n[    5.384903]  \u0026lt;TASK\u0026gt;\n[    5.384903]  __check_heap_object+0x9a/0xd0\n[    5.384903]  __check_object_size+0x46c/0x690\n[    5.384903]  put_cmsg+0x129/0x5e0\n[    5.384903]  sock_recv_errqueue+0x22f/0x380\n[    5.384903]  tls_sw_recvmsg+0x7ed/0x1960\n[    5.384903]  ? srso_alias_return_thunk+0x5/0xfbef5\n[    5.384903]  ? schedule+0x6d/0x270\n[    5.384903]  ? srso_alias_return_thunk+0x5/0xfbef5\n[    5.384903]  ? mutex_unlock+0x81/0xd0\n[    5.384903]  ? __pfx_mutex_unlock+0x10/0x10\n[    5.384903]  ? __pfx_tls_sw_recvmsg+0x10/0x10\n[    5.384903]  ? _raw_spin_lock_irqsave+0x8f/0xf0\n[    5.384903]  ? _raw_read_unlock_irqrestore+0x20/0x40\n[    5.384903]  ? srso_alias_return_thunk+0x5/0xfbef5\n\nThe crash offset 296 corresponds to skb2-\u0026gt;cb within skbuff_fclones:\n  - sizeof(struct sk_buff) = 232 - offsetof(struct sk_buff, cb) = 40 -\n  offset of skb2.cb in fclones = 232 + 40 = 272 - crash offset 296 =\n  272 + 24 (inside sock_exterr_skb.ee)\n\nThis patch uses a local stack variable as a bounce buffer to avoid the hardened usercopy check failure.\n\n[1] https://elixir.bootlin.com/linux/v6.12.62/source/net/ipv4/tcp.c#L885\n[2] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5104\n[3] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5566\n[4] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5491\n[5] https://elixir.bootlin.com/linux/v6.12.62/source/mm/slub.c#L5719(CVE-2026-22977)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix memory leak in skb_segment_list for GRO packets\n\nWhen skb_segment_list() is called during packet forwarding, it handles\npackets that were aggregated by the GRO engine.\n\nHistorically, the segmentation logic in skb_segment_list assumes that\nindividual segments are split from a parent SKB and may need to carry\ntheir own socket memory accounting. Accordingly, the code transfers\ntruesize from the parent to the newly created segments.\n\nPrior to commit ed4cccef64c1 (\u0026quot;gro: fix ownership transfer\u0026quot;), this\ntruesize subtraction in skb_segment_list() was valid because fragments\nstill carry a reference to the original socket.\n\nHowever, commit ed4cccef64c1 (\u0026quot;gro: fix ownership transfer\u0026quot;) changed\nthis behavior by ensuring that fraglist entries are explicitly\norphaned (skb-\u0026gt;sk = NULL) to prevent illegal orphaning later in the\nstack. This change meant that the entire socket memory charge remained\nwith the head SKB, but the corresponding accounting logic in\nskb_segment_list() was never updated.\n\nAs a result, the current code unconditionally adds each fragment\u0026apos;s\ntruesize to delta_truesize and subtracts it from the parent SKB. Since\nthe fragments are no longer charged to the socket, this subtraction\nresults in an effective under-count of memory when the head is freed.\nThis causes sk_wmem_alloc to remain non-zero, preventing socket\ndestruction and leading to a persistent memory leak.\n\nThe leak can be observed via KMEMLEAK when tearing down the networking\nenvironment:\n\nunreferenced object 0xffff8881e6eb9100 (size 2048):\n  comm \u0026quot;ping\u0026quot;, pid 6720, jiffies 4295492526\n  backtrace:\n    kmem_cache_alloc_noprof+0x5c6/0x800\n    sk_prot_alloc+0x5b/0x220\n    sk_alloc+0x35/0xa00\n    inet6_create.part.0+0x303/0x10d0\n    __sock_create+0x248/0x640\n    __sys_socket+0x11b/0x1d0\n\nSince skb_segment_list() is exclusively used for SKB_GSO_FRAGLIST\npackets constructed by GRO, the truesize adjustment is removed.\n\nThe call to skb_release_head_state() must be preserved. As documented in\ncommit cf673ed0e057 (\u0026quot;net: fix fraglist segmentation reference count\nleak\u0026quot;), it is still required to correctly drop references to SKB\nextensions that may be overwritten during __copy_skb_header().(CVE-2026-22979)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: prevent potential out-of-bounds reads in handle_auth_done()\n\nPerform an explicit bounds check on payload_len to avoid a possible\nout-of-bounds access in the callout.\n\n[ idryomov: changelog ](CVE-2026-22984)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: make free_choose_arg_map() resilient to partial allocation\n\nfree_choose_arg_map() may dereference a NULL pointer if its caller fails\nafter a partial allocation.\n\nFor example, in decode_choose_args(), if allocation of arg_map-\u0026gt;args\nfails, execution jumps to the fail label and free_choose_arg_map() is\ncalled. Since arg_map-\u0026gt;size is updated to a non-zero value before memory\nallocation, free_choose_arg_map() will iterate over arg_map-\u0026gt;args and\ndereference a NULL pointer.\n\nTo prevent this potential NULL pointer dereference and make\nfree_choose_arg_map() more resilient, add checks for pointers before\niterating.(CVE-2026-22991)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_qfq: do not free existing class in qfq_change_class()\n\nFixes qfq_change_class() error case.\n\ncl-\u0026gt;qdisc and cl should only be freed if a new class and qdisc\nwere allocated, or we risk various UAF.(CVE-2026-22999)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()\n\nBlamed commit did not take care of VLAN encapsulations\nas spotted by syzbot [1].\n\nUse skb_vlan_inet_prepare() instead of pskb_inet_may_pull().\n\n[1]\n BUG: KMSAN: uninit-value in __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline]\n BUG: KMSAN: uninit-value in INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline]\n BUG: KMSAN: uninit-value in IP6_ECN_decapsulate+0x7a8/0x1fa0 include/net/inet_ecn.h:321\n  __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline]\n  INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline]\n  IP6_ECN_decapsulate+0x7a8/0x1fa0 include/net/inet_ecn.h:321\n  ip6ip6_dscp_ecn_decapsulate+0x16f/0x1b0 net/ipv6/ip6_tunnel.c:729\n  __ip6_tnl_rcv+0xed9/0x1b50 net/ipv6/ip6_tunnel.c:860\n  ip6_tnl_rcv+0xc3/0x100 net/ipv6/ip6_tunnel.c:903\n gre_rcv+0x1529/0x1b90 net/ipv6/ip6_gre.c:-1\n  ip6_protocol_deliver_rcu+0x1c89/0x2c60 net/ipv6/ip6_input.c:438\n  ip6_input_finish+0x1f4/0x4a0 net/ipv6/ip6_input.c:489\n  NF_HOOK include/linux/netfilter.h:318 [inline]\n  ip6_input+0x9c/0x330 net/ipv6/ip6_input.c:500\n  ip6_mc_input+0x7ca/0xc10 net/ipv6/ip6_input.c:590\n  dst_input include/net/dst.h:474 [inline]\n  ip6_rcv_finish+0x958/0x990 net/ipv6/ip6_input.c:79\n  NF_HOOK include/linux/netfilter.h:318 [inline]\n  ipv6_rcv+0xf1/0x3c0 net/ipv6/ip6_input.c:311\n  __netif_receive_skb_one_core net/core/dev.c:6139 [inline]\n  __netif_receive_skb+0x1df/0xac0 net/core/dev.c:6252\n  netif_receive_skb_internal net/core/dev.c:6338 [inline]\n  netif_receive_skb+0x57/0x630 net/core/dev.c:6397\n  tun_rx_batched+0x1df/0x980 drivers/net/tun.c:1485\n  tun_get_user+0x5c0e/0x6c60 drivers/net/tun.c:1953\n  tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1999\n  new_sync_write fs/read_write.c:593 [inline]\n  vfs_write+0xbe2/0x15d0 fs/read_write.c:686\n  ksys_write fs/read_write.c:738 [inline]\n  __do_sys_write fs/read_write.c:749 [inline]\n  __se_sys_write fs/read_write.c:746 [inline]\n  __x64_sys_write+0x1fb/0x4d0 fs/read_write.c:746\n  x64_sys_call+0x30ab/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:2\n  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n  do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nUninit was created at:\n  slab_post_alloc_hook mm/slub.c:4960 [inline]\n  slab_alloc_node mm/slub.c:5263 [inline]\n  kmem_cache_alloc_node_noprof+0x9e7/0x17a0 mm/slub.c:5315\n  kmalloc_reserve+0x13c/0x4b0 net/core/skbuff.c:586\n  __alloc_skb+0x805/0x1040 net/core/skbuff.c:690\n  alloc_skb include/linux/skbuff.h:1383 [inline]\n  alloc_skb_with_frags+0xc5/0xa60 net/core/skbuff.c:6712\n  sock_alloc_send_pskb+0xacc/0xc60 net/core/sock.c:2995\n  tun_alloc_skb drivers/net/tun.c:1461 [inline]\n  tun_get_user+0x1142/0x6c60 drivers/net/tun.c:1794\n  tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1999\n  new_sync_write fs/read_write.c:593 [inline]\n  vfs_write+0xbe2/0x15d0 fs/read_write.c:686\n  ksys_write fs/read_write.c:738 [inline]\n  __do_sys_write fs/read_write.c:749 [inline]\n  __se_sys_write fs/read_write.c:746 [inline]\n  __x64_sys_write+0x1fb/0x4d0 fs/read_write.c:746\n  x64_sys_call+0x30ab/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:2\n  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n  do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nCPU: 0 UID: 0 PID: 6465 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(none)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025(CVE-2026-23003)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv6: Fix use-after-free in inet6_addr_del().\n\nsyzbot reported use-after-free of inet6_ifaddr in\ninet6_addr_del(). [0]\n\nThe cited commit accidentally moved ipv6_del_addr() for\nmngtmpaddr before reading its ifp-\u0026gt;flags for temporary\naddresses in inet6_addr_del().\n\nLet\u0026apos;s move ipv6_del_addr() down to fix the UAF.\n\n[0]:\nBUG: KASAN: slab-use-after-free in inet6_addr_del.constprop.0+0x67a/0x6b0 net/ipv6/addrconf.c:3117\nRead of size 4 at addr ffff88807b89c86c by task syz.3.1618/9593\n\nCPU: 0 UID: 0 PID: 9593 Comm: syz.3.1618 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025\nCall Trace:\n \u0026lt;TASK\u0026gt;\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xcd/0x630 mm/kasan/report.c:482\n kasan_report+0xe0/0x110 mm/kasan/report.c:595\n inet6_addr_del.constprop.0+0x67a/0x6b0 net/ipv6/addrconf.c:3117\n addrconf_del_ifaddr+0x11e/0x190 net/ipv6/addrconf.c:3181\n inet6_ioctl+0x1e5/0x2b0 net/ipv6/af_inet6.c:582\n sock_do_ioctl+0x118/0x280 net/socket.c:1254\n sock_ioctl+0x227/0x6b0 net/socket.c:1375\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:597 [inline]\n __se_sys_ioctl fs/ioctl.c:583 [inline]\n __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f164cf8f749\nCode: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f164de64038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\nRAX: ffffffffffffffda RBX: 00007f164d1e5fa0 RCX: 00007f164cf8f749\nRDX: 0000200000000000 RSI: 0000000000008936 RDI: 0000000000000003\nRBP: 00007f164d013f91 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 00007f164d1e6038 R14: 00007f164d1e5fa0 R15: 00007ffde15c8288\n \u0026lt;/TASK\u0026gt;\n\nAllocated by task 9593:\n kasan_save_stack+0x33/0x60 mm/kasan/common.c:56\n kasan_save_track+0x14/0x30 mm/kasan/common.c:77\n poison_kmalloc_redzone mm/kasan/common.c:397 [inline]\n __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:414\n kmalloc_noprof include/linux/slab.h:957 [inline]\n kzalloc_noprof include/linux/slab.h:1094 [inline]\n ipv6_add_addr+0x4e3/0x2010 net/ipv6/addrconf.c:1120\n inet6_addr_add+0x256/0x9b0 net/ipv6/addrconf.c:3050\n addrconf_add_ifaddr+0x1fc/0x450 net/ipv6/addrconf.c:3160\n inet6_ioctl+0x103/0x2b0 net/ipv6/af_inet6.c:580\n sock_do_ioctl+0x118/0x280 net/socket.c:1254\n sock_ioctl+0x227/0x6b0 net/socket.c:1375\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:597 [inline]\n __se_sys_ioctl fs/ioctl.c:583 [inline]\n __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFreed by task 6099:\n kasan_save_stack+0x33/0x60 mm/kasan/common.c:56\n kasan_save_track+0x14/0x30 mm/kasan/common.c:77\n kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:584\n poison_slab_object mm/kasan/common.c:252 [inline]\n __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:284\n kasan_slab_free include/linux/kasan.h:234 [inline]\n slab_free_hook mm/slub.c:2540 [inline]\n slab_free_freelist_hook mm/slub.c:2569 [inline]\n slab_free_bulk mm/slub.c:6696 [inline]\n kmem_cache_free_bulk mm/slub.c:7383 [inline]\n kmem_cache_free_bulk+0x2bf/0x680 mm/slub.c:7362\n kfree_bulk include/linux/slab.h:830 [inline]\n kvfree_rcu_bulk+0x1b7/0x1e0 mm/slab_common.c:1523\n kvfree_rcu_drain_ready mm/slab_common.c:1728 [inline]\n kfree_rcu_monitor+0x1d0/0x2f0 mm/slab_common.c:1801\n process_one_work+0x9ba/0x1b20 kernel/workqueue.c:3257\n process_scheduled_works kernel/workqu\n---truncated---(CVE-2026-23010)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv4: ip_gre: make ipgre_header() robust\n\nAnalog to commit db5b4e39c4e6 (\u0026quot;ip6_gre: make ip6gre_header() robust\u0026quot;)\n\nOver the years, syzbot found many ways to crash the kernel\nin ipgre_header() [1].\n\nThis involves team or bonding drivers ability to dynamically\nchange their dev-\u0026gt;needed_headroom and/or dev-\u0026gt;hard_header_len\n\nIn this particular crash mld_newpack() allocated an skb\nwith a too small reserve/headroom, and by the time mld_sendpack()\nwas called, syzbot managed to attach an ipgre device.\n\n[1]\nskbuff: skb_under_panic: text:ffffffff89ea3cb7 len:2030915468 put:2030915372 head:ffff888058b43000 data:ffff887fdfa6e194 tail:0x120 end:0x6c0 dev:team0\n kernel BUG at net/core/skbuff.c:213 !\nOops: invalid opcode: 0000 [#1] SMP KASAN PTI\nCPU: 1 UID: 0 PID: 1322 Comm: kworker/1:9 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025\nWorkqueue: mld mld_ifc_work\n RIP: 0010:skb_panic+0x157/0x160 net/core/skbuff.c:213\nCall Trace:\n \u0026lt;TASK\u0026gt;\n  skb_under_panic net/core/skbuff.c:223 [inline]\n  skb_push+0xc3/0xe0 net/core/skbuff.c:2641\n  ipgre_header+0x67/0x290 net/ipv4/ip_gre.c:897\n  dev_hard_header include/linux/netdevice.h:3436 [inline]\n  neigh_connected_output+0x286/0x460 net/core/neighbour.c:1618\n  NF_HOOK_COND include/linux/netfilter.h:307 [inline]\n  ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247\n  NF_HOOK+0x9e/0x380 include/linux/netfilter.h:318\n  mld_sendpack+0x8d4/0xe60 net/ipv6/mcast.c:1855\n  mld_send_cr net/ipv6/mcast.c:2154 [inline]\n  mld_ifc_work+0x83e/0xd60 net/ipv6/mcast.c:2693\n  process_one_work kernel/workqueue.c:3257 [inline]\n  process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340\n  worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421\n  kthread+0x711/0x8a0 kernel/kthread.c:463\n  ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158\n  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246(CVE-2026-23011)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: pegasus: fix memory leak in update_eth_regs_async()\n\nWhen asynchronously writing to the device registers and if usb_submit_urb()\nfail, the code fail to release allocated to this point resources.(CVE-2026-23021)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/page_alloc: prevent pcp corruption with SMP=n\n\nThe kernel test robot has reported:\n\n BUG: spinlock trylock failure on UP on CPU#0, kcompactd0/28\n  lock: 0xffff888807e35ef0, .magic: dead4ead, .owner: kcompactd0/28, .owner_cpu: 0\n CPU: 0 UID: 0 PID: 28 Comm: kcompactd0 Not tainted 6.18.0-rc5-00127-ga06157804399 #1 PREEMPT  8cc09ef94dcec767faa911515ce9e609c45db470\n Call Trace:\n  \u0026lt;IRQ\u0026gt;\n  __dump_stack (lib/dump_stack.c:95)\n  dump_stack_lvl (lib/dump_stack.c:123)\n  dump_stack (lib/dump_stack.c:130)\n  spin_dump (kernel/locking/spinlock_debug.c:71)\n  do_raw_spin_trylock (kernel/locking/spinlock_debug.c:?)\n  _raw_spin_trylock (include/linux/spinlock_api_smp.h:89 kernel/locking/spinlock.c:138)\n  __free_frozen_pages (mm/page_alloc.c:2973)\n  ___free_pages (mm/page_alloc.c:5295)\n  __free_pages (mm/page_alloc.c:5334)\n  tlb_remove_table_rcu (include/linux/mm.h:? include/linux/mm.h:3122 include/asm-generic/tlb.h:220 mm/mmu_gather.c:227 mm/mmu_gather.c:290)\n  ? __cfi_tlb_remove_table_rcu (mm/mmu_gather.c:289)\n  ? rcu_core (kernel/rcu/tree.c:?)\n  rcu_core (include/linux/rcupdate.h:341 kernel/rcu/tree.c:2607 kernel/rcu/tree.c:2861)\n  rcu_core_si (kernel/rcu/tree.c:2879)\n  handle_softirqs (arch/x86/include/asm/jump_label.h:36 include/trace/events/irq.h:142 kernel/softirq.c:623)\n  __irq_exit_rcu (arch/x86/include/asm/jump_label.h:36 kernel/softirq.c:725)\n  irq_exit_rcu (kernel/softirq.c:741)\n  sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1052)\n  \u0026lt;/IRQ\u0026gt;\n  \u0026lt;TASK\u0026gt;\n RIP: 0010:_raw_spin_unlock_irqrestore (arch/x86/include/asm/preempt.h:95 include/linux/spinlock_api_smp.h:152 kernel/locking/spinlock.c:194)\n  free_pcppages_bulk (mm/page_alloc.c:1494)\n  drain_pages_zone (include/linux/spinlock.h:391 mm/page_alloc.c:2632)\n  __drain_all_pages (mm/page_alloc.c:2731)\n  drain_all_pages (mm/page_alloc.c:2747)\n  kcompactd (mm/compaction.c:3115)\n  kthread (kernel/kthread.c:465)\n  ? __cfi_kcompactd (mm/compaction.c:3166)\n  ? __cfi_kthread (kernel/kthread.c:412)\n  ret_from_fork (arch/x86/kernel/process.c:164)\n  ? __cfi_kthread (kernel/kthread.c:412)\n  ret_from_fork_asm (arch/x86/entry/entry_64.S:255)\n  \u0026lt;/TASK\u0026gt;\n\nMatthew has analyzed the report and identified that in drain_page_zone()\nwe are in a section protected by spin_lock(\u0026amp;pcp-\u0026gt;lock) and then get an\ninterrupt that attempts spin_trylock() on the same lock.  The code is\ndesigned to work this way without disabling IRQs and occasionally fail the\ntrylock with a fallback.  However, the SMP=n spinlock implementation\nassumes spin_trylock() will always succeed, and thus it\u0026apos;s normally a\nno-op.  Here the enabled lock debugging catches the problem, but otherwise\nit could cause a corruption of the pcp structure.\n\nThe problem has been introduced by commit 574907741599 (\u0026quot;mm/page_alloc:\nleave IRQs enabled for per-cpu page allocations\u0026quot;).  The pcp locking scheme\nrecognizes the need for disabling IRQs to prevent nesting spin_trylock()\nsections on SMP=n, but the need to prevent the nesting in spin_lock() has\nnot been recognized.  Fix it by introducing local wrappers that change the\nspin_lock() to spin_lock_iqsave() with SMP=n and use them in all places\nthat do spin_lock(\u0026amp;pcp-\u0026gt;lock).\n\n[(CVE-2026-23025)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnull_blk: fix kmemleak by releasing references to fault configfs items\n\nWhen CONFIG_BLK_DEV_NULL_BLK_FAULT_INJECTION is enabled, the null-blk\ndriver sets up fault injection support by creating the timeout_inject,\nrequeue_inject, and init_hctx_fault_inject configfs items as children\nof the top-level nullbX configfs group.\n\nHowever, when the nullbX device is removed, the references taken to\nthese fault-config configfs items are not released. As a result,\nkmemleak reports a memory leak, for example:\n\nunreferenced object 0xc00000021ff25c40 (size 32):\n  comm \u0026quot;mkdir\u0026quot;, pid 10665, jiffies 4322121578\n  hex dump (first 32 bytes):\n    69 6e 69 74 5f 68 63 74 78 5f 66 61 75 6c 74 5f  init_hctx_fault_\n    69 6e 6a 65 63 74 00 88 00 00 00 00 00 00 00 00  inject..........\n  backtrace (crc 1a018c86):\n    __kmalloc_node_track_caller_noprof+0x494/0xbd8\n    kvasprintf+0x74/0xf4\n    config_item_set_name+0xf0/0x104\n    config_group_init_type_name+0x48/0xfc\n    fault_config_init+0x48/0xf0\n    0xc0080000180559e4\n    configfs_mkdir+0x304/0x814\n    vfs_mkdir+0x49c/0x604\n    do_mkdirat+0x314/0x3d0\n    sys_mkdir+0xa0/0xd8\n    system_call_exception+0x1b0/0x4f0\n    system_call_vectored_common+0x15c/0x2ec\n\nFix this by explicitly releasing the references to the fault-config\nconfigfs items when dropping the reference to the top-level nullbX\nconfigfs group.(CVE-2026-23032)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\npnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()\n\nIn nfs4_ff_alloc_deviceid_node(), if the allocation for ds_versions fails,\nthe function jumps to the out_scratch label without freeing the already\nallocated dsaddrs list, leading to a memory leak.\n\nFix this by jumping to the out_err_drain_dsaddrs label, which properly\nfrees the dsaddrs list before cleaning up other resources.(CVE-2026-23038)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: make calc_target() set t-\u0026gt;paused, not just clear it\n\nCurrently calc_target() clears t-\u0026gt;paused if the request shouldn\u0026apos;t be\npaused anymore, but doesn\u0026apos;t ever set t-\u0026gt;paused even though it\u0026apos;s able to\ndetermine when the request should be paused.  Setting t-\u0026gt;paused is left\nto __submit_request() which is fine for regular requests but doesn\u0026apos;t\nwork for linger requests -- since __submit_request() doesn\u0026apos;t operate\non linger requests, there is nowhere for lreq-\u0026gt;t.paused to be set.\nOne consequence of this is that watches don\u0026apos;t get reestablished on\npaused -\u0026gt; unpaused transitions in cases where requests have been paused\nlong enough for the (paused) unwatch request to time out and for the\nsubsequent (re)watch request to enter the paused state.  On top of the\nwatch not getting reestablished, rbd_reregister_watch() gets stuck with\nrbd_dev-\u0026gt;watch_mutex held:\n\n  rbd_register_watch\n    __rbd_register_watch\n      ceph_osdc_watch\n        linger_reg_commit_wait\n\nIt\u0026apos;s waiting for lreq-\u0026gt;reg_commit_wait to be completed, but for that to\nhappen the respective request needs to end up on need_resend_linger list\nand be kicked when requests are unpaused.  There is no chance for that\nif the request in question is never marked paused in the first place.\n\nThe fact that rbd_dev-\u0026gt;watch_mutex remains taken out forever then\nprevents the image from getting unmapped -- \u0026quot;rbd unmap\u0026quot; would inevitably\nhang in D state on an attempt to grab the mutex.(CVE-2026-23047)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\npNFS: Fix a deadlock when returning a delegation during open()\n\nBen Coddington reports seeing a hang in the following stack trace:\n  0 [ffffd0b50e1774e0] __schedule at ffffffff9ca05415\n  1 [ffffd0b50e177548] schedule at ffffffff9ca05717\n  2 [ffffd0b50e177558] bit_wait at ffffffff9ca061e1\n  3 [ffffd0b50e177568] __wait_on_bit at ffffffff9ca05cfb\n  4 [ffffd0b50e1775c8] out_of_line_wait_on_bit at ffffffff9ca05ea5\n  5 [ffffd0b50e177618] pnfs_roc at ffffffffc154207b [nfsv4]\n  6 [ffffd0b50e1776b8] _nfs4_proc_delegreturn at ffffffffc1506586 [nfsv4]\n  7 [ffffd0b50e177788] nfs4_proc_delegreturn at ffffffffc1507480 [nfsv4]\n  8 [ffffd0b50e1777f8] nfs_do_return_delegation at ffffffffc1523e41 [nfsv4]\n  9 [ffffd0b50e177838] nfs_inode_set_delegation at ffffffffc1524a75 [nfsv4]\n 10 [ffffd0b50e177888] nfs4_process_delegation at ffffffffc14f41dd [nfsv4]\n 11 [ffffd0b50e1778a0] _nfs4_opendata_to_nfs4_state at ffffffffc1503edf [nfsv4]\n 12 [ffffd0b50e1778c0] _nfs4_open_and_get_state at ffffffffc1504e56 [nfsv4]\n 13 [ffffd0b50e177978] _nfs4_do_open at ffffffffc15051b8 [nfsv4]\n 14 [ffffd0b50e1779f8] nfs4_do_open at ffffffffc150559c [nfsv4]\n 15 [ffffd0b50e177a80] nfs4_atomic_open at ffffffffc15057fb [nfsv4]\n 16 [ffffd0b50e177ad0] nfs4_file_open at ffffffffc15219be [nfsv4]\n 17 [ffffd0b50e177b78] do_dentry_open at ffffffff9c09e6ea\n 18 [ffffd0b50e177ba8] vfs_open at ffffffff9c0a082e\n 19 [ffffd0b50e177bd0] dentry_open at ffffffff9c0a0935\n\nThe issue is that the delegreturn is being asked to wait for a layout\nreturn that cannot complete because a state recovery was initiated. The\nstate recovery cannot complete until the open() finishes processing the\ndelegations it was given.\n\nThe solution is to propagate the existing flags that indicate a\nnon-blocking call to the function pnfs_roc(), so that it knows not to\nwait in this situation.(CVE-2026-23050)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: hv_netvsc: reject RSS hash key programming without RX indirection table\n\nRSS configuration requires a valid RX indirection table. When the device\nreports a single receive queue, rndis_filter_device_add() does not\nallocate an indirection table, accepting RSS hash key updates in this\nstate leads to a hang.\n\nFix this by gating netvsc_set_rxfh() on ndc-\u0026gt;rx_table_sz and return\n-EOPNOTSUPP when the table is absent. This aligns set_rxfh with the device\ncapabilities and prevents incorrect behavior.(CVE-2026-23054)\n\nA buffer overflow vulnerability exists in the QLogic Fibre Channel driver (qla2xxx) of the Linux kernel. In the functions `qla27xx_copy_fpin_pkt()` and `qla27xx_copy_multiple_pkt()`, the code uses the firmware-reported `frame_size` to calculate the copy length into `item-\u0026gt;iocb`. However, the `iocb` member is defined as a fixed-size 64-byte array within `struct purex_item`. If the reported `frame_size` exceeds 64 bytes, subsequent `memcpy` calls will overflow the boundary of the `iocb` member. This cross-member write is unsafe and can lead to memory corruption, potentially exploitable to compromise the confidentiality, integrity, and availability of the kernel.(CVE-2026-23059)\n\nA NULL pointer dereference vulnerability exists in the be2net network driver within the Linux kernel, specifically in the be_cmd_get_mac_from_list() function. According to the function\u0026apos;s contract, when the parameter pmac_id_valid is set to false, the driver may request a PMAC_ID from the network card\u0026apos;s firmware and store it at the provided address pmac_id. However, there is a location within the driver where both conditions pmac_id_valid == false and pmac_id == NULL are passed simultaneously. This results in an attempt to dereference a NULL pointer, potentially leading to a kernel crash or system instability.(CVE-2026-23084)\n\nA memory address truncation vulnerability exists in the irqchip/gic-v3-its driver of the Linux kernel. On 32-bit ARM machines with CONFIG_ARM_LPAE enabled, when using larger VMSPLIT configurations, lowmem allocations may be backed by physical memory addresses above the 32-bit address limit. The GICv3 driver allocates the \u0026apos;itt\u0026apos; object using GFP_KERNEL. Since all memory below the 4GB physical address limit is in ZONE_DMA in this configuration, kmalloc() defaults to higher addresses in ZONE_NORMAL. However, the driver stores these physical addresses in 32-bit \u0026apos;unsigned long\u0026apos; variables, causing the high addresses to be truncated, which leads to system crashes.(CVE-2026-23085)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nuacce: fix isolate sysfs check condition\n\nuacce supports the device isolation feature. If the driver\nimplements the isolate_err_threshold_read and\nisolate_err_threshold_write callback functions, uacce will create\nsysfs files now. Users can read and configure the isolation policy\nthrough sysfs. Currently, sysfs files are created as long as either\nisolate_err_threshold_read or isolate_err_threshold_write callback\nfunctions are present.\n\nHowever, accessing a non-existent callback function may cause the\nsystem to crash. Therefore, intercept the creation of sysfs if\nneither read nor write exists; create sysfs if either is supported,\nbut intercept unsupported operations at the call site.(CVE-2026-23094)\n\nA deadlock vulnerability exists in the Linux kernel due to incorrect lock acquisition ordering. This vulnerability affects the migration functionality for hugetlb (huge page) file folios. The specific scenario is: when two kernel tasks (Tasks) attempt to acquire the `folio_lock` and `i_mmap_rwsem` locks in opposite orders, a circular wait is formed, leading to a system deadlock. For example, Task A holds `folio_lock` and then tries to acquire the `i_mmap_rwsem` read lock, while Task B holds the `i_mmap_rwsem` write lock and then tries to acquire `folio_lock`. This lock ordering violates the rules defined in mm/rmap.c. This vulnerability can render parts of the affected system unavailable, impacting system availability.(CVE-2026-23097)\n\nIn the Linux kernel SCSI core layer, there is a fragile ordering logic between marking commands as completed or failed, designed to ensure the error handler only wakes when the last running command completes or times out. This logic contains race conditions. These race conditions can cause the SCSI layer to fail to wake the error handler, leaving I/O through the SCSI host stuck as the error state cannot advance. Specifically, there are two issues: 1. A memory ordering issue within the `scsi_dec_host_busy()` function. The write operation that clears the `SCMD_STATE_INFLIGHT` flag may be reordered with read counting operations in `scsi_host_busy()`. This can cause other CPUs to see inconsistent busy counts, preventing the correct triggering of the error handler wake-up. 2. A general ordering issue with the `scsi_eh_inc_host_failed()` function. It counts busy commands before incrementing the `host_failed` count, which can race with the processing of a final command in `scsi_dec_host_busy()`, resulting in neither side waking the error handler task.(CVE-2026-23110)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec\n\nnvmet_tcp_build_pdu_iovec() could walk past cmd-\u0026gt;req.sg when a PDU\nlength or offset exceeds sg_cnt and then use bogus sg-\u0026gt;length/offset\nvalues, leading to _copy_to_iter() GPF/KASAN. Guard sg_idx, remaining\nentries, and sg-\u0026gt;length/offset before building the bvec.(CVE-2026-23112)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove\n\nOn APUs such as Raven and Renoir (GC 9.1.0, 9.2.2, 9.3.0), the ih1 and\nih2 interrupt ring buffers are not initialized. This is by design, as\nthese secondary IH rings are only available on discrete GPUs. See\nvega10_ih_sw_init() which explicitly skips ih1/ih2 initialization when\nAMD_IS_APU is set.\n\nHowever, amdgpu_gmc_filter_faults_remove() unconditionally uses ih1 to\nget the timestamp of the last interrupt entry. When retry faults are\nenabled on APUs (noretry=0), this function is called from the SVM page\nfault recovery path, resulting in a NULL pointer dereference when\namdgpu_ih_decode_iv_ts_helper() attempts to access ih-\u0026gt;ring[].\n\nThe crash manifests as:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000004\n  RIP: 0010:amdgpu_ih_decode_iv_ts_helper+0x22/0x40 [amdgpu]\n  Call Trace:\n   amdgpu_gmc_filter_faults_remove+0x60/0x130 [amdgpu]\n   svm_range_restore_pages+0xae5/0x11c0 [amdgpu]\n   amdgpu_vm_handle_fault+0xc8/0x340 [amdgpu]\n   gmc_v9_0_process_interrupt+0x191/0x220 [amdgpu]\n   amdgpu_irq_dispatch+0xed/0x2c0 [amdgpu]\n   amdgpu_ih_process+0x84/0x100 [amdgpu]\n\nThis issue was exposed by commit 1446226d32a4 (\u0026quot;drm/amdgpu: Remove GC HW\nIP 9.3.0 from noretry=1\u0026quot;) which changed the default for Renoir APU from\nnoretry=1 to noretry=0, enabling retry fault handling and thus\nexercising the buggy code path.\n\nFix this by adding a check for ih1.ring_size before attempting to use\nit. Also restore the soft_ih support from commit dd299441654f (\u0026quot;drm/amdgpu:\nRework retry fault removal\u0026quot;).  This is needed if the hardware doesn\u0026apos;t\nsupport secondary HW IH rings.\n\nv2: additional updates (Alex)\n\n(cherry picked from commit 6ce8d536c80aa1f059e82184f0d1994436b1d526)(CVE-2026-23163)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready()\n\nWhen the socket is closed while in TCP_LISTEN a callback is run to\nflush all outstanding packets, which in turns calls\nnvmet_tcp_listen_data_ready() with the sk_callback_lock held.\nSo we need to check if we are in TCP_LISTEN before attempting\nto get the sk_callback_lock() to avoid a deadlock.(CVE-2026-23179)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nASoC: amd: fix memory leak in acp3x pdm dma ops(CVE-2026-23190)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()\n\nIn iscsit_dec_session_usage_count(), the function calls complete() while\nholding the sess-\u0026gt;session_usage_lock. Similar to the connection usage count\nlogic, the waiter signaled by complete() (e.g., in the session release\npath) may wake up and free the iscsit_session structure immediately.\n\nThis creates a race condition where the current thread may attempt to\nexecute spin_unlock_bh() on a session structure that has already been\ndeallocated, resulting in a KASAN slab-use-after-free.\n\nTo resolve this, release the session_usage_lock before calling complete()\nto ensure all dereferences of the sess pointer are finished before the\nwaiter is allowed to proceed with deallocation.(CVE-2026-23193)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb/client: fix memory leak in smb2_open_file()\n\nReproducer:\n\n  1. server: directories are exported read-only\n  2. client: mount -t cifs //${server_ip}/export /mnt\n  3. client: dd if=/dev/zero of=/mnt/file bs=512 count=1000 oflag=direct\n  4. client: umount /mnt\n  5. client: sleep 1\n  6. client: modprobe -r cifs\n\nThe error message is as follows:\n\n  =============================================================================\n  BUG cifs_small_rq (Not tainted): Objects remaining on __kmem_cache_shutdown()\n  -----------------------------------------------------------------------------\n\n  Object 0x00000000d47521be @offset=14336\n  ...\n  WARNING: mm/slub.c:1251 at __kmem_cache_shutdown+0x34e/0x440, CPU#0: modprobe/1577\n  ...\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   kmem_cache_destroy+0x94/0x190\n   cifs_destroy_request_bufs+0x3e/0x50 [cifs]\n   cleanup_module+0x4e/0x540 [cifs]\n   __se_sys_delete_module+0x278/0x400\n   __x64_sys_delete_module+0x5f/0x70\n   x64_sys_call+0x2299/0x2ff0\n   do_syscall_64+0x89/0x350\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n  ...\n  kmem_cache_destroy cifs_small_rq: Slab cache still has objects when called from cifs_destroy_request_bufs+0x3e/0x50 [cifs]\n  WARNING: mm/slab_common.c:532 at kmem_cache_destroy+0x16b/0x190, CPU#0: modprobe/1577(CVE-2026-23205)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()\n\nIn iscsit_dec_conn_usage_count(), the function calls complete() while\nholding the conn-\u0026gt;conn_usage_lock. As soon as complete() is invoked, the\nwaiter (such as iscsit_close_connection()) may wake up and proceed to free\nthe iscsit_conn structure.\n\nIf the waiter frees the memory before the current thread reaches\nspin_unlock_bh(), it results in a KASAN slab-use-after-free as the function\nattempts to release a lock within the already-freed connection structure.\n\nFix this by releasing the spinlock before calling complete().(CVE-2026-23216)\n\nIn the Linux kernel, the ksmbd component contains an infinite loop vulnerability. The problem occurs when a signed request fails smb2 signature verification check. In __process_request(), if check_sign_req() returns an error, set_smb2_rsp_status(work, STATUS_ACCESS_DENIED) is called. set_smb2_rsp_status() sets work-\u0026gt;next_smb2_rcv_hdr_off to zero. By resetting next_smb2_rcv_hdr_off to zero, the pointer to the next command in the chain is lost. Consequently, is_chained_smb2_message() continues to point to the same request header instead of advancing. If the header\u0026apos;s NextCommand field is non-zero, the function returns true, causing __handle_ksmbd_work() to repeatedly process the same failed request in an infinite loop. This results in the kernel log being flooded with \u0026quot;bad smb2 signature\u0026quot; messages and high CPU usage.(CVE-2026-23220)\n\nIn the Linux kernel, the following vulnerability has been resolved:  smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection()  On kthread_run() failure in ksmbd_tcp_new_connection(), the transport is freed via free_transport(), which does not decrement active_num_conn, leaking this counter.  Replace free_transport() with ksmbd_tcp_disconnect().  The Linux kernel CVE team has assigned CVE-2026-23228 to this issue.(CVE-2026-23228)","status":"published","published":"2026-03-15T11:10:34Z","modified":"2026-08-18T01:19:38.135892245Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"ROOT-OS-UBUNTU-2404-CVE-2025-39948","title":"CVE-2025-39948 in linux - Patched by Root","description":"Root has patched CVE-2025-39948 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.","status":"published","published":"2026-11-06T15:54:27Z","modified":"2026-11-06T16:16:05.812726476Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-06T16:59:12.925458Z"},{"id":"UBUNTU-CVE-2025-39948","description":"In the Linux kernel, the following vulnerability has been resolved: ice: fix Rx page leak on multi-buffer frames The ice_put_rx_mbuf() function handles calling ice_put_rx_buf() for each buffer in the current frame. This function was introduced as part of handling multi-buffer XDP support in the ice driver. It works by iterating over the buffers from first_desc up to 1 plus the total number of fragments in the frame, cached from before the XDP program was executed. If the hardware posts a descriptor with a size of 0, the logic used in ice_put_rx_mbuf() breaks. Such descriptors get skipped and don't get added as fragments in ice_add_xdp_frag. Since the buffer isn't counted as a fragment, we do not iterate over it in ice_put_rx_mbuf(), and thus we don't call ice_put_rx_buf(). Because we don't call ice_put_rx_buf(), we don't attempt to re-use the page or free it. This leaves a stale page in the ring, as we don't increment next_to_alloc. The ice_reuse_rx_page() assumes that the next_to_alloc has been incremented properly, and that it always points to a buffer with a NULL page. Since this function doesn't check, it will happily recycle a page over the top of the next_to_alloc buffer, losing track of the old page. Note that this leak only occurs for multi-buffer frames. The ice_put_rx_mbuf() function always handles at least one buffer, so a single-buffer frame will always get handled correctly. It is not clear precisely why the hardware hands us descriptors with a size of 0 sometimes, but it happens somewhat regularly with \"jumbo frames\" used by 9K MTU. To fix ice_put_rx_mbuf(), we need to make sure to call ice_put_rx_buf() on all buffers between first_desc and next_to_clean. Borrow the logic of a similar function in i40e used for this same purpose. Use the same logic also in ice_get_pgcnts(). Instead of iterating over just the number of fragments, use a loop which iterates until the current index reaches to the next_to_clean element just past the current frame. Unlike i40e, the ice_put_rx_mbuf() function does call ice_put_rx_buf() on the last buffer of the frame indicating the end of packet. For non-linear (multi-buffer) frames, we need to take care when adjusting the pagecnt_bias. An XDP program might release fragments from the tail of the frame, in which case that fragment page is already released. Only update the pagecnt_bias for the first descriptor and fragments still remaining post-XDP program. Take care to only access the shared info for fragmented buffers, as this avoids a significant cache miss. The xdp_xmit value only needs to be updated if an XDP program is run, and only once per packet. Drop the xdp_xmit pointer argument from ice_put_rx_mbuf(). Instead, set xdp_xmit in the ice_clean_rx_irq() function directly. This avoids needing to pass the argument and avoids an extra bit-wise OR for each buffer in the frame. Move the increment of the ntc local variable to ensure its updated *before* all calls to ice_get_pgcnts() or ice_put_rx_mbuf(), as the loop logic requires the index of the element just after the current frame. Now that we use an index pointer in the ring to identify the packet, we no longer need to track or cache the number of fragments in the rx_ring.","status":"published","published":"2025-10-04T08:15:00Z","modified":"2026-11-11T09:39:07.427055066Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-11T10:01:00.373799Z"},{"id":"AZL-75296","title":"CVE-2025-39948 affecting package kernel 6.6.161.1-1","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix Rx page leak on multi-buffer frames\n\nThe ice_put_rx_mbuf() function handles calling ice_put_rx_buf() for each\nbuffer in the current frame. This function was introduced as part of\nhandling multi-buffer XDP support in the ice driver.\n\nIt works by iterating over the buffers from first_desc up to 1 plus the\ntotal number of fragments in the frame, cached from before the XDP program\nwas executed.\n\nIf the hardware posts a descriptor with a size of 0, the logic used in\nice_put_rx_mbuf() breaks. Such descriptors get skipped and don't get added\nas fragments in ice_add_xdp_frag. Since the buffer isn't counted as a\nfragment, we do not iterate over it in ice_put_rx_mbuf(), and thus we don't\ncall ice_put_rx_buf().\n\nBecause we don't call ice_put_rx_buf(), we don't attempt to re-use the\npage or free it. This leaves a stale page in the ring, as we don't\nincrement next_to_alloc.\n\nThe ice_reuse_rx_page() assumes that the next_to_alloc has been incremented\nproperly, and that it always points to a buffer with a NULL page. Since\nthis function doesn't check, it will happily recycle a page over the top\nof the next_to_alloc buffer, losing track of the old page.\n\nNote that this leak only occurs for multi-buffer frames. The\nice_put_rx_mbuf() function always handles at least one buffer, so a\nsingle-buffer frame will always get handled correctly. It is not clear\nprecisely why the hardware hands us descriptors with a size of 0 sometimes,\nbut it happens somewhat regularly with \"jumbo frames\" used by 9K MTU.\n\nTo fix ice_put_rx_mbuf(), we need to make sure to call ice_put_rx_buf() on\nall buffers between first_desc and next_to_clean. Borrow the logic of a\nsimilar function in i40e used for this same purpose. Use the same logic\nalso in ice_get_pgcnts().\n\nInstead of iterating over just the number of fragments, use a loop which\niterates until the current index reaches to the next_to_clean element just\npast the current frame. Unlike i40e, the ice_put_rx_mbuf() function does\ncall ice_put_rx_buf() on the last buffer of the frame indicating the end of\npacket.\n\nFor non-linear (multi-buffer) frames, we need to take care when adjusting\nthe pagecnt_bias. An XDP program might release fragments from the tail of\nthe frame, in which case that fragment page is already released. Only\nupdate the pagecnt_bias for the first descriptor and fragments still\nremaining post-XDP program. Take care to only access the shared info for\nfragmented buffers, as this avoids a significant cache miss.\n\nThe xdp_xmit value only needs to be updated if an XDP program is run, and\nonly once per packet. Drop the xdp_xmit pointer argument from\nice_put_rx_mbuf(). Instead, set xdp_xmit in the ice_clean_rx_irq() function\ndirectly. This avoids needing to pass the argument and avoids an extra\nbit-wise OR for each buffer in the frame.\n\nMove the increment of the ntc local variable to ensure its updated *before*\nall calls to ice_get_pgcnts() or ice_put_rx_mbuf(), as the loop logic\nrequires the index of the element just after the current frame.\n\nNow that we use an index pointer in the ring to identify the packet, we no\nlonger need to track or cache the number of fragments in the rx_ring.","status":"published","published":"2025-10-04T08:15:47Z","modified":"2026-11-05T14:17:19.67474328Z","updated_at":"2026-11-05T16:41:24.456773Z"},{"id":"openSUSE-SU-2025:20091-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2025-21816: hrtimers: Force migrate away hrtimers queued after (bsc#1238472).\n- CVE-2025-38653: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (bsc#1248630).\n- CVE-2025-38718: sctp: linearize cloned gso packets in sctp_rcv (bsc#1249161).\n- CVE-2025-39676: scsi: qla4xxx: Prevent a potential error pointer dereference (bsc#1249302).\n- CVE-2025-39702: ipv6: sr: Fix MAC comparison to be constant-time (bsc#1249317).\n- CVE-2025-39756: fs: Prevent file descriptor table allocations exceeding INT_MAX (bsc#1249512).\n- CVE-2025-39779: btrfs: subpage: keep TOWRITE tag until folio is cleaned (bsc#1249495).\n- CVE-2025-39812: sctp: initialize more fields in sctp_v6_from_sk() (bsc#1250202).\n- CVE-2025-39866: fs: writeback: fix use-after-free in __mark_inode_dirty() (bsc#1250455).\n- CVE-2025-39876: net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (bsc#1250400).\n- CVE-2025-39881: kernfs: Fix UAF in polling when open file is released (bsc#1250379).\n- CVE-2025-39895: sched: Fix sched_numa_find_nth_cpu() if mask offline (bsc#1250721).\n- CVE-2025-39903: of_numa: fix uninitialized memory nodes causing kernel panic (bsc#1250749).\n- CVE-2025-39911: i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (bsc#1250704).\n- CVE-2025-39947: net/mlx5e: Harden uplink netdev access against device unbind (bsc#1251232).\n- CVE-2025-39948: ice: fix Rx page leak on multi-buffer frames (bsc#1251233).\n- CVE-2025-39949: qed: Don't collect too many protection override GRC elements (bsc#1251177).\n- CVE-2025-39950: net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (bsc#1251176).\n- CVE-2025-39955: tcp: Clear tcp_sk(sk)-\u003efastopen_rsk in tcp_disconnect() (bsc#1251804).\n- CVE-2025-39956: igc: don't fail igc_probe() on LED setup error (bsc#1251809).\n- CVE-2025-39963: io_uring: fix incorrect io_kiocb reference in io_link_skb (bsc#1251819).\n- CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).\n- CVE-2025-39969: i40e: fix validation of VF state in get resources (bsc#1252044).\n- CVE-2025-39970: i40e: fix input validation logic for action_meta (bsc#1252051).\n- CVE-2025-39971: i40e: fix idx validation in config queues msg (bsc#1252052).\n- CVE-2025-39972: i40e: fix idx validation in i40e_validate_queue_map (bsc#1252039).\n- CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252035).\n- CVE-2025-39978: octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (bsc#1252069).\n- CVE-2025-39979: net/mlx5: fs, add API for sharing HWS action by refcount (bsc#1252067).\n- CVE-2025-39984: net: tun: Update napi-\u003eskb after XDP process (bsc#1252081).\n- CVE-2025-39992: mm: swap: check for stable address space before operating on the VMA (bsc#1252076).\n- CVE-2025-40000: wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (bsc#1252062).\n- CVE-2025-40005: spi: cadence-quadspi: Implement refcount to handle unbind during busy (bsc#1252349).\n- CVE-2025-40012: net/smc: fix warning in smc_rx_splice() when calling get_page() (bsc#1252330).\n- CVE-2025-40018: ipvs: Defer ip_vs_ftp unregister during netns cleanup (bsc#1252688).\n- CVE-2025-40040: mm/ksm: fix flag-dropping behavior in ksm_madvise (bsc#1252780).\n- CVE-2025-40051: vhost: vringh: Modify the return value check (bsc#1252858).\n- CVE-2025-40056: vhost: vringh: Fix copy_to_iter return value check (bsc#1252826).\n- CVE-2025-40060: coresight: trbe: Return NULL pointer for allocation failures (bsc#1252848).\n- CVE-2025-40078: bpf: Explicitly check accesses to bpf_sock_addr (bsc#1252789).\n- CVE-2025-40080: nbd: restrict sockets to TCP and UDP (bsc#1252774).\n- CVE-2025-40100: btrfs: do not assert we found block group item when creating free space tree (bsc#1252918).\n\nThe following non security issues were fixed:\n\n- add bug reference to existing hv_netvsc change (bsc#1252265)\n- amd-pstate-ut: Reset amd-pstate driver mode after running selftests (bsc#1249226).\n- cgroup/cpuset: Remove remote_partition_check() \u0026 make update_cpumasks_hier() handle remote partition (bsc#1241166).\n- cpuset: Use new excpus for nocpu error check when enabling root partition (bsc#1241166).\n- cpuset: fix failure to enable isolated partition when containing isolcpus (bsc#1241166).\n- doc/README.SUSE: Correct the character used for TAINT_NO_SUPPORT\n  The character was previously 'N', but upstream used it for TAINT_TEST,\n  which prompted the change of TAINT_NO_SUPPORT to 'n'.\n- dpll: zl3073x: Add firmware loading functionality (bsc#1252253).\n- dpll: zl3073x: Add functions to access hardware registers (bsc#1252253).\n- dpll: zl3073x: Add low-level flash functions (bsc#1252253).\n- dpll: zl3073x: Add support to get fractional frequency offset (bsc#1252253).\n- dpll: zl3073x: Add support to get phase offset on connected input pin (bsc#1252253).\n- dpll: zl3073x: Add support to get/set esync on pins (bsc#1252253).\n- dpll: zl3073x: Fix double free in zl3073x_devlink_flash_update() (bsc#1252253).\n- dpll: zl3073x: Handle missing or corrupted flash configuration (bsc#1252253).\n- dpll: zl3073x: Implement devlink flash callback (bsc#1252253).\n- dpll: zl3073x: Increase maximum size of flash utility (bsc#1252253).\n- dpll: zl3073x: Refactor DPLL initialization (bsc#1252253).\n- drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (git-fixes).\n- drm/xe/guc: Prepare GuC register list and update ADS size for error capture (stable-fixes).\n- ixgbe: handle IXGBE_VF_FEATURES_NEGOTIATE mbox cmd (bsc#1247222).\n- ixgbe: handle IXGBE_VF_GET_PF_LINK_STATE mailbox operation (bsc#1247222).\n- ixgbevf: fix getting link speed data for E610 devices (bsc#1247222).\n- ixgbevf: fix mailbox API compatibility by negotiating supported features (bsc#1247222).\n- kbuild/modfinal: Link livepatches with module-common.o (bsc#1218644, bsc#1252270).\n- kdb: Replace deprecated strcpy() with memmove() in vkdb_printf() (bsc#1252939).\n- kernel-subpackage-spec: Do not doubly-sign modules (bsc#1251930).\n- nvme-auth: update sc_c in host response (git-fixes bsc#1249397).\n- perf hwmon_pmu: Fix uninitialized variable warning (perf-sle16-v6.13-userspace-update, git-fixes).\n- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (git-fixes).\n- powerpc/fadump: skip parameter area allocation when fadump is disabled (jsc#PED-9891 git-fixes).\n- proc: fix missing pde_set_flags() for net proc files (bsc#1248630)\n- proc: fix type confusion in pde_set_flags() (bsc#1248630)\n- rpm/check-for-config-changes: ignore CONFIG_SCHED_PROXY_EXEC, too (bsc#1250946)\n- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (bsc#1252267).\n- x86/microcode/AMD: Limit Entrysign signature checking to known generations (bsc#1252725).\n- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (bsc#1252734).\n- x86/resctrl: Refactor resctrl_arch_rmid_read() (bsc#1252734).\n- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (jsc#PED-348).\n","status":"published","published":"2025-11-26T17:04:24Z","modified":"2026-03-23T04:54:17.007181Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"SUSE-SU-2025:21040-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.\n\nThe following security bugs were fixed:\n\n- CVE-2025-38008: mm/page_alloc: fix race condition in unaccepted memory handling (bsc#1244939).\n- CVE-2025-38539: trace/fgraph: Fix the warning caused by missing unregister notifier (bsc#1248211).\n- CVE-2025-38552: mptcp: plug races between subflow fail and subflow creation (bsc#1248230).\n- CVE-2025-38653: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (bsc#1248630).\n- CVE-2025-38699: scsi: bfa: Double-free fix (bsc#1249224).\n- CVE-2025-38700: scsi: libiscsi: Initialize iscsi_conn-\u003edd_data only if memory is allocated (bsc#1249182).\n- CVE-2025-38718: sctp: linearize cloned gso packets in sctp_rcv (bsc#1249161).\n- CVE-2025-39673: ppp: fix race conditions in ppp_fill_forward_path (bsc#1249320).\n- CVE-2025-39676: scsi: qla4xxx: Prevent a potential error pointer dereference (bsc#1249302).\n- CVE-2025-39683: tracing: Limit access to parser-\u003ebuffer when trace_get_user failed (bsc#1249286).\n- CVE-2025-39697: nfs: remove dead code for the old swap over NFS implementation (bsc#1249319).\n- CVE-2025-39702: ipv6: sr: Fix MAC comparison to be constant-time (bsc#1249317).\n- CVE-2025-39756: fs: Prevent file descriptor table allocations exceeding INT_MAX (bsc#1249512).\n- CVE-2025-39794: ARM: tegra: Use I/O memcpy to write to IRAM (bsc#1249595).\n- CVE-2025-39812: sctp: initialize more fields in sctp_v6_from_sk() (bsc#1250202).\n- CVE-2025-39813: ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (bsc#1250032).\n- CVE-2025-39828: atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control() (bsc#1250205).\n- CVE-2025-39851: vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (bsc#1250296).\n- CVE-2025-39866: fs: writeback: fix use-after-free in __mark_inode_dirty() (bsc#1250455).\n- CVE-2025-39876: net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (bsc#1250400).\n- CVE-2025-39881: kernfs: Fix UAF in polling when open file is released (bsc#1250379).\n- CVE-2025-39895: sched: Fix sched_numa_find_nth_cpu() if mask offline (bsc#1250721).\n- CVE-2025-39898: e1000e: fix heap overflow in e1000_set_eeprom (bsc#1250742).\n- CVE-2025-39902: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (bsc#1250702).\n- CVE-2025-39911: i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (bsc#1250704).\n- CVE-2025-39945: cnic: Fix use-after-free bugs in cnic_delete_task (bsc#1251230).\n- CVE-2025-39946: tls: make sure to abort the stream if headers are bogus (bsc#1251114).\n- CVE-2025-39947: net/mlx5e: Harden uplink netdev access against device unbind (bsc#1251232).\n- CVE-2025-39948: ice: fix Rx page leak on multi-buffer frames (bsc#1251233).\n- CVE-2025-39949: qed: Don't collect too many protection override GRC elements (bsc#1251177).\n- CVE-2025-39955: tcp: Clear tcp_sk(sk)-\u003efastopen_rsk in tcp_disconnect() (bsc#1251804).\n- CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).\n- CVE-2025-39969: i40e: fix validation of VF state in get resources (bsc#1252044).\n- CVE-2025-39970: i40e: fix input validation logic for action_meta (bsc#1252051).\n- CVE-2025-39971: i40e: fix idx validation in config queues msg (bsc#1252052).\n- CVE-2025-39972: i40e: fix idx validation in i40e_validate_queue_map (bsc#1252039).\n- CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252035).\n- CVE-2025-39978: octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (bsc#1252069).\n- CVE-2025-40000: wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (bsc#1252062).\n- CVE-2025-40005: spi: cadence-quadspi: Implement refcount to handle unbind during busy (bsc#1252349).\n- CVE-2025-40018: ipvs: Defer ip_vs_ftp unregister during netns cleanup (bsc#1252688).\n- CVE-2025-40051: vhost: vringh: Modify the return value check (bsc#1252858).\n- CVE-2025-40056: vhost: vringh: Fix copy_to_iter return value check (bsc#1252826).\n- CVE-2025-40060: coresight: trbe: Return NULL pointer for allocation failures (bsc#1252848).\n- CVE-2025-40078: bpf: Explicitly check accesses to bpf_sock_addr (bsc#1252789).\n- CVE-2025-40080: nbd: restrict sockets to TCP and UDP (bsc#1252774).\n- CVE-2025-40100: btrfs: do not assert we found block group item when creating free space tree (bsc#1252918).\n\nThe following non-security bugs were fixed:\n\n- ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (stable-fixes).\n- ACPI: battery: Add synchronization between interface updates (git-fixes).\n- ACPI: battery: Check for error code from devm_mutex_init() call (git-fixes).\n- ACPI: battery: allocate driver data through devm_ APIs (stable-fixes).\n- ACPI: battery: initialize mutexes through devm_ APIs (stable-fixes).\n- ACPI: button: Call input_free_device() on failing input device registration (git-fixes).\n- ACPI: property: Add code comments explaining what is going on (stable-fixes).\n- ACPI: property: Disregard references in data-only subnode lists (stable-fixes).\n- ACPI: property: Do not pass NULL handles to acpi_attach_data() (stable-fixes git-fixes).\n- ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (git-fixes).\n- ACPI: x86: Move acpi_quirk_skip_serdev_enumeration() out of CONFIG_X86_ANDROID_TABLETS (stable-fixes).\n- ACPICA: Allow to skip Global Lock initialization (stable-fixes).\n- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (git-fixes).\n- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (git-fixes).\n- ALSA: usb-audio: fix control pipe direction (git-fixes).\n- ASoC: Intel: avs: Unprepare a stream when XRUN occurs (git-fixes).\n- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (git-fixes).\n- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (git-fixes).\n- ASoC: amd: acp: Adjust pdm gain value (stable-fixes).\n- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (git-fixes).\n- ASoC: fsl_sai: fix bit order for DSD format (git-fixes).\n- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (git-fixes).\n- ASoC: nau8821: Cancel jdet_work before handling jack ejection (git-fixes).\n- ASoC: nau8821: Generalize helper to clear IRQ status (git-fixes).\n- ASoC: qdsp6: q6asm: do not sleep while atomic (git-fixes).\n- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (stable-fixes).\n- Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset (git-fixes).\n- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (stable-fixes).\n- Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (git-fixes).\n- HID: hid-input: only ignore 0 battery events for digitizers (git-fixes).\n- HID: multitouch: fix name of Stylus input devices (git-fixes).\n- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (git-fixes).\n- KVM: PPC: Fix misleading interrupts comment in kvmppc_prepare_to_enter() (bsc#1215199).\n- KVM: SEV: Read save fields from GHCB exactly once (git-fixes).\n- KVM: SEV: Rename kvm_ghcb_get_sw_exit_code() to kvm_get_cached_sw_exit_code() (git-fixes).\n- KVM: SEV: Validate XCR0 provided by guest in GHCB (git-fixes).\n- KVM: SVM: Inject #GP if memory operand for INVPCID is non-canonical (git-fixes).\n- KVM: SVM: Pass through GHCB MSR if and only if VM is an SEV-ES guest (git-fixes).\n- KVM: SVM: Set RFLAGS.IF=1 in C code, to get VMRUN out of the STI shadow (git-fixes).\n- KVM: x86/mmu: Prevent installing hugepages when mem attributes are changing (git-fixes).\n- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (git-fixes).\n- KVM: x86: Clear pv_unhalted on all transitions to KVM_MP_STATE_RUNNABLE (git-fixes).\n- KVM: x86: Do not bleed PVCLOCK_GUEST_STOPPED across PV clocks (git-fixes).\n- KVM: x86: Do not inject PV async #PF if SEND_ALWAYS=0 and guest state is protected (git-fixes).\n- KVM: x86: Introduce kvm_set_mp_state() (git-fixes).\n- KVM: x86: Introduce kvm_x86_call() to simplify static calls of kvm_x86_ops (git-fixes).\n- KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update() (git-fixes).\n- KVM: x86: Process \"guest stopped request\" once per guest time update (git-fixes).\n- KVM: x86: Replace static_call_cond() with static_call() (git-fixes).\n- KVM: x86: Set PVCLOCK_GUEST_STOPPED only for kvmclock, not for Xen PV clock (git-fixes).\n- KVM: x86: Snapshot the host's DEBUGCTL after disabling IRQs (git-fixes).\n- KVM: x86: Snapshot the host's DEBUGCTL in common x86 (git-fixes).\n- KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer (git-fixes).\n- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (git-fixes).\n- NFSD: Fix crash in nfsd4_read_release() (git-fixes).\n- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (git-fixes).\n- NFSD: Minor cleanup in layoutcommit processing (git-fixes).\n- NFSD: Rework encoding and decoding of nfsd4_deviceid (git-fixes).\n- PCI/AER: Support errors introduced by PCIe r6.0 (stable-fixes).\n- PCI: Add PCI_VDEVICE_SUB helper macro (stable-fixes).\n- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (stable-fixes).\n- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (git-fixes).\n- PCI: j721e: Enable ACSPCIE Refclk if \"ti,syscon-acspcie-proxy-ctrl\" exists (stable-fixes).\n- PCI: j721e: Fix programming sequence of \"strap\" settings (git-fixes).\n- PM: runtime: Add new devm functions (stable-fixes).\n- Revert \"KVM: VMX: Move LOAD_IA32_PERF_GLOBAL_CTRL errata handling out of setup_vmcs_config()\" (git-fixes).\n- USB: serial: option: add SIMCom 8230C compositions (git-fixes).\n- USB: serial: option: add SIMCom 8230C compositions (stable-fixes).\n- accel/ivpu: Add missing MODULE_FIRMWARE metadata (git-fixes).\n- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (git-fixes).\n- add bug reference to existing hv_netvsc change (bsc#1252265)\n- arm64, mm: avoid always making PTE dirty in pte_mkwrite() (git-fixes)\n- arm64: cputype: Add Neoverse-V3AE definitions (git-fixes)\n- arm64: errata: Apply workarounds for Neoverse-V3AE (git-fixes)\n- arm64: mte: Do not flag the zero page as PG_mte_tagged (git-fixes)\n- bpf: Allow helper bpf_get_[ns_]current_pid_tgid() for all prog types (bsc#1252364).\n- bpf: Avoid RCU context warning when unpinning htab with internal structs (git-fixes).\n- bpf: Check link_create.flags parameter for multi_kprobe (git-fixes).\n- bpf: Check link_create.flags parameter for multi_uprobe (git-fixes).\n- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (git-fixes).\n- bpf: Use preempt_count() directly in bpf_send_signal_common() (git-fixes).\n- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (git-fixes).\n- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (git-fixes).\n- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (git-fixes).\n- can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (git-fixes).\n- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (stable-fixes).\n- can: netlink: can_changelink(): allow disabling of automatic restart (git-fixes).\n- can: rcar_canfd: Fix controller mode setting (stable-fixes).\n- clk: at91: peripheral: fix return value (git-fixes).\n- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (git-fixes).\n- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (git-fixes).\n- clk: tegra: do not overallocate memory for bpmp clocks (git-fixes).\n- cpufreq: CPPC: fix perf_to_khz/khz_to_perf conversion exception (git-fixes).\n- cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (stable-fixes git-fixes).\n- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (stable-fixes git-fixes).\n- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (git-fixes).\n- cpufreq: scmi: Skip SCMI devices that are not used by the CPUs (stable-fixes).\n- cpufreq: tegra186: Set target frequency for all cpus in policy (git-fixes).\n- cpuidle: governors: menu: Avoid using invalid recent intervals data (git-fixes).\n- cpuidle: menu: Avoid discarding useful information (stable-fixes).\n- cpuidle: qcom-spm: fix device and OF node leaks at probe (git-fixes).\n- crypto: essiv - Check ssize for decryption and in-place encryption (git-fixes).\n- crypto: rng - Ensure set_ent is always present (git-fixes).\n- driver core/PM: Set power.no_callbacks along with power.no_pm (stable-fixes).\n- drivers/perf: arm_spe: Use perf_allow_kernel() for permissions (git-fixes).\n- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (git-fixes).\n- drm/amd/display: Disable scaling on DCE6 for now (git-fixes).\n- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (git-fixes).\n- drm/amd/display: Properly disable scaling on DCE6 (git-fixes).\n- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji (git-fixes).\n- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland (git-fixes).\n- drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (git-fixes).\n- drm/amd/powerplay: Fix CIK shutdown temperature (git-fixes).\n- drm/amd: Check whether secure display TA loaded successfully (stable-fixes).\n- drm/amdgpu: Add additional DCE6 SCL registers (git-fixes).\n- drm/amdgpu: use atomic functions with memory barriers for vm fault info (git-fixes).\n- drm/bridge: lt9211: Drop check for last nibble of version register (git-fixes).\n- drm/etnaviv: fix flush sequence logic (git-fixes).\n- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (stable-fixes).\n- drm/exynos: exynos7_drm_decon: properly clear channels during bind (stable-fixes).\n- drm/i915/guc: Skip communication warning on reset in progress (git-fixes).\n- drm/mediatek: Fix device use-after-free on unbind (git-fixes).\n- drm/msm/a6xx: Fix GMU firmware parser (git-fixes).\n- drm/msm/adreno: De-spaghettify the use of memory barriers (stable-fixes).\n- drm/msm/dpu: Fix pixel extension sub-sampling (git-fixes).\n- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (git-fixes).\n- drm/panel: kingdisplay-kd097d04: Disable EoTp (git-fixes).\n- drm/panel: sitronix-st7789v: fix sync flags for t28cp45tn89 (git-fixes).\n- drm/rockchip: vop2: use correct destination rectangle height check (git-fixes).\n- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (git-fixes).\n- drm/vmwgfx: Fix Use-after-free in validation (git-fixes).\n- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (git-fixes).\n- drm/vmwgfx: Fix copy-paste typo in validation (git-fixes).\n- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (git-fixes).\n- ext4: check fast symlink for ea_inode correctly (git-fixes).\n- ext4: do not convert the unwritten extents if data writeback fails (git-fixes).\n- ext4: do not try to clear the orphan_present feature block device is r/o (git-fixes).\n- ext4: ensure i_size is smaller than maxbytes (git-fixes).\n- ext4: factor out ext4_get_maxbytes() (git-fixes).\n- ext4: fix calculation of credits for extent tree modification (git-fixes).\n- ext4: fix checks for orphan inodes (bsc#1250119).\n- ext4: fix fsmap end of range reporting with bigalloc (git-fixes).\n- ext4: fix hole length calculation overflow in non-extent inodes (git-fixes).\n- ext4: fix largest free orders lists corruption on mb_optimize_scan switch (git-fixes).\n- ext4: fix reserved gdt blocks handling in fsmap (git-fixes).\n- ext4: fix zombie groups in average fragment size lists (git-fixes).\n- ext4: preserve SB_I_VERSION on remount (git-fixes).\n- ext4: reorder capability check last (git-fixes).\n- fbdev: Fix logic error in \"offb\" name match (git-fixes).\n- fbdev: atyfb: Check if pll_ops-\u003einit_pll failed (git-fixes).\n- fbdev: valkyriefb: Fix reference count leak in valkyriefb_init (git-fixes).\n- firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode (git-fixes).\n- fs: udf: fix OOB read in lengthAllocDescs handling (git-fixes).\n- ftrace: fix incorrect hash size in register_ftrace_direct() (git-fixes).\n- gpio: wcd934x: mark the GPIO controller as sleeping (git-fixes).\n- hfs: validate record offset in hfsplus_bmap_alloc (git-fixes).\n- hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() (git-fixes).\n- hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (git-fixes).\n- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (git-fixes).\n- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (git-fixes).\n- hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() (git-fixes).\n- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (stable-fixes).\n- i2c: ocores: use devm_ managed clks (git-fixes).\n- iomap: Fix iomap_adjust_read_range for plen calculation (git-fixes).\n- iomap: handle a post-direct I/O invalidate race in iomap_write_delalloc_release (git-fixes).\n- iommu/vt-d: Disallow dirty tracking if incoherent page walk (git-fixes).\n- iommu/vt-d: PRS isn't usable if PDS isn't supported (git-fixes).\n- isofs: Verify inode mode when loading from disk (git-fixes).\n- jbd2: do not try to recover wiped journal (git-fixes).\n- kABI fix for KVM: x86: Snapshot the host's DEBUGCTL in common x86 (git-fixes).\n- kdb: Replace deprecated strcpy() with memmove() in vkdb_printf() (bsc#1252939).\n- kernel-subpackage-spec: Do not doubly-sign modules (bsc#1251930).\n- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (stable-fixes).\n- locking/mutex: Introduce devm_mutex_init() (stable-fixes).\n- locking/mutex: Mark devm_mutex_init() as __must_check (stable-fixes).\n- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (git-fixes).\n- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (git-fixes).\n- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (git-fixes).\n- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (git-fixes).\n- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (stable-fixes).\n- media: solo6x10: replace max(a, min(b, c)) by clamp(b, a, c) (git-fixes).\n- media: tuner: xc5000: Fix use-after-free in xc5000_release (git-fixes).\n- media: tunner: xc5000: Refactor firmware load (stable-fixes).\n- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (stable-fixes).\n- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (stable-fixes).\n- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (git-fixes).\n- misc: fastrpc: Add missing dev_err newlines (stable-fixes).\n- misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup (git-fixes).\n- misc: fastrpc: Fix fastrpc_map_lookup operation (git-fixes).\n- misc: fastrpc: Save actual DMA size in fastrpc_map structure (git-fixes).\n- misc: fastrpc: Skip reference for DMA handles (git-fixes).\n- misc: fastrpc: fix possible map leak in fastrpc_put_args (git-fixes).\n- mmc: core: SPI mode remove cmd7 (stable-fixes).\n- module: Prevent silent truncation of module name in delete_module(2) (git-fixes).\n- most: usb: Fix use-after-free in hdm_disconnect (git-fixes).\n- most: usb: hdm_probe: Fix calling put_device() before device initialization (git-fixes).\n- mtd: rawnand: fsmc: Default to autodetect buswidth (stable-fixes).\n- net: mana: Use page pool fragments for RX buffers instead of full pages to improve memory efficiency (bsc#1248754).\n- net: phy: dp83869: fix STRAP_OPMODE bitmask (git-fixes).\n- net: sysfs: Fix /sys/class/net/\u0026lt;iface\u003e path (git-fixes).\n- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (git-fixes).\n- net: usb: asix_devices: Check return value of usbnet_get_endpoints (git-fixes).\n- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (git-fixes).\n- net: usb: lan78xx: fix use of improperly initialized dev-\u003echipid in lan78xx_reset (git-fixes).\n- net: usb: rtl8150: Fix frame padding (git-fixes).\n- netfilter: nft_objref: validate objref and objrefmap expressions (bsc#1250237).\n- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (git-fixes).\n- nvme-multipath: Skip nr_active increments in RETRY disposition (git-fixes).\n- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (git-fixes).\n- nvme/tcp: handle tls partially sent records in write_space() (git-fixes).\n- overlayfs: set ctime when setting mtime and atime (stable-fixes).\n- ovl: Always reevaluate the file signature for IMA (stable-fixes).\n- ovl: fix file reference leak when submitting aio (stable-fixes).\n- ovl: fix incorrect fdput() on aio completion (stable-fixes).\n- perf/amd/ibs: Fix -\u003econfig to sample period calculation for OP PMU (git-fixes).\n- perf/amd/ibs: Fix perf_ibs_op.cnt_mask for CurCnt (git-fixes).\n- perf/amd: Prevent grouping of IBS events (git-fixes).\n- perf/aux: Fix pending disable flow when the AUX ring buffer overruns (git-fixes).\n- perf/bpf: Robustify perf_event_free_bpf_prog() (git-fixes).\n- perf/core: Fix WARN in perf_cgroup_switch() (git-fixes).\n- perf/core: Fix broken throttling when max_samples_per_tick=1 (git-fixes).\n- perf/core: Fix child_total_time_enabled accounting bug at task exit (git-fixes).\n- perf/core: Fix low freq setting via IOC_PERIOD (git-fixes).\n- perf/core: Fix pmus_lock vs. pmus_srcu ordering (git-fixes).\n- perf/core: Fix small negative period being ignored (git-fixes).\n- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (git-fixes).\n- perf/hw_breakpoint: Return EOPNOTSUPP for unsupported breakpoint type (git-fixes).\n- perf/ring_buffer: Allow the EPOLLRDNORM flag for poll (git-fixes).\n- perf/x86/amd: Warn only on new bits set (git-fixes).\n- perf/x86/intel/ds: Unconditionally drain PEBS DS when changing PEBS_DATA_CFG (git-fixes).\n- perf/x86/intel/pt: Fix sampling synchronization (git-fixes).\n- perf/x86/intel/uncore: Fix the scale of IIO free running counters on ICX (git-fixes).\n- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR (git-fixes).\n- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SPR (git-fixes).\n- perf/x86/intel: Allow to setup LBR for counting event for BPF (git-fixes).\n- perf/x86/intel: Allow to update user space GPRs from PEBS records (git-fixes).\n- perf/x86/intel: Apply static call for drain_pebs (git-fixes).\n- perf/x86/intel: Avoid disable PMU if !cpuc-\u003eenabled in sample read (git-fixes).\n- perf/x86/intel: Fix crash in icl_update_topdown_event() (git-fixes).\n- perf/x86/intel: Only check the group flag for X86 leader (git-fixes).\n- perf/x86/intel: Use better start period for frequency mode (git-fixes).\n- perf/x86: Fix low freqency setting issue (git-fixes).\n- perf/x86: Fix non-sampling (counting) events on certain x86 platforms (git-fixes).\n- perf: Ensure bpf_perf_link path is properly serialized (git-fixes).\n- perf: Extract a few helpers (git-fixes).\n- perf: Fix cgroup state vs ERROR (git-fixes).\n- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (git-fixes).\n- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (git-fixes).\n- phy: cdns-dphy: Store hs_clk_rate and return it (stable-fixes).\n- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (stable-fixes).\n- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (stable-fixes).\n- powerpc/boot: Fix build with gcc 15 (bsc#1215199).\n- powerpc/kvm: Fix ifdef to remove build warning (bsc#1215199).\n- powerpc/powernv/pci: Fix underflow and leak issue (bsc#1215199).\n- powerpc/pseries/msi: Fix potential underflow and leak issue (bsc#1215199).\n- powerpc: export MIN RMA size (bsc#1236743 ltc#211409).\n- powerpc: floppy: Add missing checks after DMA map (bsc#1215199).\n- powerpc: increase MIN RMA size for CAS negotiation (bsc#1236743 ltc#211409 bsc#1252269 ltc#215957).\n- proc: fix missing pde_set_flags() for net proc files (bsc#1248630)\n- proc: fix type confusion in pde_set_flags() (bsc#1248630)\n- r8152: add error handling in rtl8152_driver_init (git-fixes).\n- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (git-fixes).\n- regmap: slimbus: fix bus_context pointer in regmap init calls (git-fixes).\n- regulator: bd718x7: Fix voltages scaled by resistor divider (git-fixes).\n- rpm/check-for-config-changes: ignore CONFIG_SCHED_PROXY_EXEC, too (bsc#1250946).\n- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (stable-fixes).\n- rtc: interface: Fix long-standing race when setting alarm (stable-fixes).\n- rtc: optee: fix memory leak on driver removal (git-fixes).\n- rtc: x1205: Fix Xicor X1205 vendor prefix (git-fixes).\n- s390: Initialize psw mask in perf_arch_fetch_caller_regs() (git-fixes).\n- samples/bpf: Fix compilation failure for samples/bpf on LoongArch Fedora (git-fixes).\n- sched/fair: set_load_weight() must also call reweight_task() (git-fixes)\n- sched/idle: Conditionally handle tick broadcast in default_idle_call() (bsc#1248517).\n- selftests/bpf: Add test for unpinning htab with internal timer struct (git-fixes).\n- selftests/bpf: Fix C++ compile error from missing _Bool type (git-fixes).\n- selftests/bpf: Fix a fd leak in error paths in open_netns (git-fixes).\n- selftests/bpf: Fix backtrace printing for selftests crashes (git-fixes).\n- selftests/bpf: Fix compile error from rlim_t in sk_storage_map.c (git-fixes).\n- selftests/bpf: Fix compile if backtrace support missing in libc (git-fixes).\n- selftests/bpf: Fix compiling core_reloc.c with musl-libc (git-fixes).\n- selftests/bpf: Fix compiling flow_dissector.c with musl-libc (git-fixes).\n- selftests/bpf: Fix compiling kfree_skb.c with musl-libc (git-fixes).\n- selftests/bpf: Fix compiling parse_tcp_hdr_opt.c with musl-libc (git-fixes).\n- selftests/bpf: Fix compiling tcp_rtt.c with musl-libc (git-fixes).\n- selftests/bpf: Fix cross-compiling urandom_read (git-fixes).\n- selftests/bpf: Fix error compiling bpf_iter_setsockopt.c with musl libc (git-fixes).\n- selftests/bpf: Fix error compiling tc_redirect.c with musl libc (git-fixes).\n- selftests/bpf: Fix error compiling test_lru_map.c (git-fixes).\n- selftests/bpf: Fix errors compiling cg_storage_multi.h with musl libc (git-fixes).\n- selftests/bpf: Fix errors compiling decap_sanity.c with musl libc (git-fixes).\n- selftests/bpf: Fix errors compiling lwt_redirect.c with musl libc (git-fixes).\n- selftests/bpf: Fix redefinition errors compiling lwt_reroute.c (git-fixes).\n- selftests/bpf: Fix umount cgroup2 error in test_sockmap (git-fixes).\n- selftests/bpf: Use bpf_link__destroy in fill_link_info tests (git-fixes).\n- selftests/tracing: Fix event filter test to retry up to 10 times (git-fixes).\n- selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (git-fixes).\n- serial: 8250_dw: handle reset control deassert error (git-fixes).\n- skmsg: Return copied bytes in sk_msg_memcopy_from_iter (bsc#1250650).\n- smb: client: fix crypto buffers in non-linear memory (bsc#1250491, boo#1239206).\n- smb: client: fix potential cfid UAF in smb2_query_info_compound (bsc#1248886).\n- spi: spi-nxp-fspi: add extra delay after dll locked (git-fixes).\n- staging: axis-fifo: fix TX handling on copy_from_user() failure (git-fixes).\n- staging: axis-fifo: fix maximum TX packet length check (git-fixes).\n- staging: axis-fifo: flush RX FIFO on read errors (git-fixes).\n- sunrpc: fix null pointer dereference on zero-length checksum (git-fixes).\n- tcp: Do not call reqsk_fastopen_remove() in tcp_conn_request() (git-fixes).\n- tcp_bpf: Fix copied value in tcp_bpf_sendmsg (bsc#1250650).\n- tools/resolve_btfids: Fix build when cross compiling kernel with clang (git-fixes).\n- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (git-fixes).\n- tracing/selftests: Fix kprobe event name test for .isra. functions (git-fixes).\n- tracing: Correct the refcount if the hist/hist_debug file fails to open (git-fixes).\n- tracing: Fix filter string testing (git-fixes).\n- tracing: Remove unneeded goto out logic (bsc#1249286).\n- udf: Make sure i_lenExtents is uptodate on inode eviction (git-fixes).\n- udf: Verify partition map count (git-fixes).\n- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (git-fixes).\n- usb: hub: Fix flushing of delayed work used for post resume purposes (git-fixes).\n- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (git-fixes).\n- usb: phy: twl6030: Fix incorrect type for ret (git-fixes).\n- usb: xhci: Avoid queuing redundant Stop Endpoint commands (git-fixes).\n- usb: xhci: Limit Stop Endpoint retries (git-fixes).\n- usb: xhci: Limit Stop Endpoint retries (git-fixes).\n- usbnet: Fix using smp_processor_id() in preemptible code warnings (git-fixes).\n- usbnet: Prevents free active kevent (git-fixes).\n- wifi: ath10k: Fix memory leak on unsupported WMI command (git-fixes).\n- wifi: ath11k: Add missing platform IDs for quirk table (git-fixes).\n- wifi: ath12k: free skb during idr cleanup callback (git-fixes).\n- wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (git-fixes).\n- wifi: mac80211: reset FILS discovery and unsol probe resp intervals (git-fixes).\n- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (stable-fixes).\n- wifi: rtlwifi: rtl8192cu: Do not claim USB ID 07b8:8188 (stable-fixes).\n- x86/idle: Sanitize X86_BUG_AMD_E400 handling (bsc#1248517).\n- xfs: rename the old_crc variable in xlog_recover_process (git-fixes).\n- xhci: dbc: enable back DbC in resume if it was enabled before suspend (git-fixes).\n- xhci: retry Stop Endpoint on buggy NEC controllers (git-fixes).\n","status":"published","published":"2025-11-13T15:32:12Z","modified":"2026-03-23T04:49:14.000054Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2025:21052-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2025-38008: mm/page_alloc: fix race condition in unaccepted memory handling (bsc#1244939).\n- CVE-2025-38539: trace/fgraph: Fix the warning caused by missing unregister notifier (bsc#1248211).\n- CVE-2025-38552: mptcp: plug races between subflow fail and subflow creation (bsc#1248230).\n- CVE-2025-38653: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (bsc#1248630).\n- CVE-2025-38699: scsi: bfa: Double-free fix (bsc#1249224).\n- CVE-2025-38700: scsi: libiscsi: Initialize iscsi_conn-\u003edd_data only if memory is allocated (bsc#1249182).\n- CVE-2025-38718: sctp: linearize cloned gso packets in sctp_rcv (bsc#1249161).\n- CVE-2025-39673: ppp: fix race conditions in ppp_fill_forward_path (bsc#1249320).\n- CVE-2025-39676: scsi: qla4xxx: Prevent a potential error pointer dereference (bsc#1249302).\n- CVE-2025-39683: tracing: Limit access to parser-\u003ebuffer when trace_get_user failed (bsc#1249286).\n- CVE-2025-39697: nfs: remove dead code for the old swap over NFS implementation (bsc#1249319).\n- CVE-2025-39702: ipv6: sr: Fix MAC comparison to be constant-time (bsc#1249317).\n- CVE-2025-39756: fs: Prevent file descriptor table allocations exceeding INT_MAX (bsc#1249512).\n- CVE-2025-39794: ARM: tegra: Use I/O memcpy to write to IRAM (bsc#1249595).\n- CVE-2025-39812: sctp: initialize more fields in sctp_v6_from_sk() (bsc#1250202).\n- CVE-2025-39813: ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (bsc#1250032).\n- CVE-2025-39828: atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control() (bsc#1250205).\n- CVE-2025-39851: vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (bsc#1250296).\n- CVE-2025-39866: fs: writeback: fix use-after-free in __mark_inode_dirty() (bsc#1250455).\n- CVE-2025-39876: net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (bsc#1250400).\n- CVE-2025-39881: kernfs: Fix UAF in polling when open file is released (bsc#1250379).\n- CVE-2025-39895: sched: Fix sched_numa_find_nth_cpu() if mask offline (bsc#1250721).\n- CVE-2025-39898: e1000e: fix heap overflow in e1000_set_eeprom (bsc#1250742).\n- CVE-2025-39902: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (bsc#1250702).\n- CVE-2025-39911: i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (bsc#1250704).\n- CVE-2025-39945: cnic: Fix use-after-free bugs in cnic_delete_task (bsc#1251230).\n- CVE-2025-39946: tls: make sure to abort the stream if headers are bogus (bsc#1251114).\n- CVE-2025-39947: net/mlx5e: Harden uplink netdev access against device unbind (bsc#1251232).\n- CVE-2025-39948: ice: fix Rx page leak on multi-buffer frames (bsc#1251233).\n- CVE-2025-39949: qed: Don't collect too many protection override GRC elements (bsc#1251177).\n- CVE-2025-39955: tcp: Clear tcp_sk(sk)-\u003efastopen_rsk in tcp_disconnect() (bsc#1251804).\n- CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).\n- CVE-2025-39969: i40e: fix validation of VF state in get resources (bsc#1252044).\n- CVE-2025-39970: i40e: fix input validation logic for action_meta (bsc#1252051).\n- CVE-2025-39971: i40e: fix idx validation in config queues msg (bsc#1252052).\n- CVE-2025-39972: i40e: fix idx validation in i40e_validate_queue_map (bsc#1252039).\n- CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252035).\n- CVE-2025-39978: octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (bsc#1252069).\n- CVE-2025-40000: wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (bsc#1252062).\n- CVE-2025-40005: spi: cadence-quadspi: Implement refcount to handle unbind during busy (bsc#1252349).\n- CVE-2025-40018: ipvs: Defer ip_vs_ftp unregister during netns cleanup (bsc#1252688).\n- CVE-2025-40051: vhost: vringh: Modify the return value check (bsc#1252858).\n- CVE-2025-40056: vhost: vringh: Fix copy_to_iter return value check (bsc#1252826).\n- CVE-2025-40060: coresight: trbe: Return NULL pointer for allocation failures (bsc#1252848).\n- CVE-2025-40078: bpf: Explicitly check accesses to bpf_sock_addr (bsc#1252789).\n- CVE-2025-40080: nbd: restrict sockets to TCP and UDP (bsc#1252774).\n- CVE-2025-40100: btrfs: do not assert we found block group item when creating free space tree (bsc#1252918).\n\nThe following non-security bugs were fixed:\n\n- ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (stable-fixes).\n- ACPI: battery: Add synchronization between interface updates (git-fixes).\n- ACPI: battery: Check for error code from devm_mutex_init() call (git-fixes).\n- ACPI: battery: allocate driver data through devm_ APIs (stable-fixes).\n- ACPI: battery: initialize mutexes through devm_ APIs (stable-fixes).\n- ACPI: button: Call input_free_device() on failing input device registration (git-fixes).\n- ACPI: property: Add code comments explaining what is going on (stable-fixes).\n- ACPI: property: Disregard references in data-only subnode lists (stable-fixes).\n- ACPI: property: Do not pass NULL handles to acpi_attach_data() (stable-fixes git-fixes).\n- ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (git-fixes).\n- ACPI: x86: Move acpi_quirk_skip_serdev_enumeration() out of CONFIG_X86_ANDROID_TABLETS (stable-fixes).\n- ACPICA: Allow to skip Global Lock initialization (stable-fixes).\n- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (git-fixes).\n- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (git-fixes).\n- ALSA: usb-audio: fix control pipe direction (git-fixes).\n- ASoC: Intel: avs: Unprepare a stream when XRUN occurs (git-fixes).\n- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (git-fixes).\n- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (git-fixes).\n- ASoC: amd: acp: Adjust pdm gain value (stable-fixes).\n- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (git-fixes).\n- ASoC: fsl_sai: fix bit order for DSD format (git-fixes).\n- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (git-fixes).\n- ASoC: nau8821: Cancel jdet_work before handling jack ejection (git-fixes).\n- ASoC: nau8821: Generalize helper to clear IRQ status (git-fixes).\n- ASoC: qdsp6: q6asm: do not sleep while atomic (git-fixes).\n- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (stable-fixes).\n- Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset (git-fixes).\n- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (stable-fixes).\n- Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (git-fixes).\n- HID: hid-input: only ignore 0 battery events for digitizers (git-fixes).\n- HID: multitouch: fix name of Stylus input devices (git-fixes).\n- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (git-fixes).\n- KVM: PPC: Fix misleading interrupts comment in kvmppc_prepare_to_enter() (bsc#1215199).\n- KVM: SEV: Read save fields from GHCB exactly once (git-fixes).\n- KVM: SEV: Rename kvm_ghcb_get_sw_exit_code() to kvm_get_cached_sw_exit_code() (git-fixes).\n- KVM: SEV: Validate XCR0 provided by guest in GHCB (git-fixes).\n- KVM: SVM: Inject #GP if memory operand for INVPCID is non-canonical (git-fixes).\n- KVM: SVM: Pass through GHCB MSR if and only if VM is an SEV-ES guest (git-fixes).\n- KVM: SVM: Set RFLAGS.IF=1 in C code, to get VMRUN out of the STI shadow (git-fixes).\n- KVM: x86/mmu: Prevent installing hugepages when mem attributes are changing (git-fixes).\n- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (git-fixes).\n- KVM: x86: Clear pv_unhalted on all transitions to KVM_MP_STATE_RUNNABLE (git-fixes).\n- KVM: x86: Do not bleed PVCLOCK_GUEST_STOPPED across PV clocks (git-fixes).\n- KVM: x86: Do not inject PV async #PF if SEND_ALWAYS=0 and guest state is protected (git-fixes).\n- KVM: x86: Introduce kvm_set_mp_state() (git-fixes).\n- KVM: x86: Introduce kvm_x86_call() to simplify static calls of kvm_x86_ops (git-fixes).\n- KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update() (git-fixes).\n- KVM: x86: Process \"guest stopped request\" once per guest time update (git-fixes).\n- KVM: x86: Replace static_call_cond() with static_call() (git-fixes).\n- KVM: x86: Set PVCLOCK_GUEST_STOPPED only for kvmclock, not for Xen PV clock (git-fixes).\n- KVM: x86: Snapshot the host's DEBUGCTL after disabling IRQs (git-fixes).\n- KVM: x86: Snapshot the host's DEBUGCTL in common x86 (git-fixes).\n- KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer (git-fixes).\n- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (git-fixes).\n- NFSD: Fix crash in nfsd4_read_release() (git-fixes).\n- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (git-fixes).\n- NFSD: Minor cleanup in layoutcommit processing (git-fixes).\n- NFSD: Rework encoding and decoding of nfsd4_deviceid (git-fixes).\n- PCI/AER: Support errors introduced by PCIe r6.0 (stable-fixes).\n- PCI: Add PCI_VDEVICE_SUB helper macro (stable-fixes).\n- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (stable-fixes).\n- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (git-fixes).\n- PCI: j721e: Enable ACSPCIE Refclk if \"ti,syscon-acspcie-proxy-ctrl\" exists (stable-fixes).\n- PCI: j721e: Fix programming sequence of \"strap\" settings (git-fixes).\n- PM: runtime: Add new devm functions (stable-fixes).\n- Revert \"KVM: VMX: Move LOAD_IA32_PERF_GLOBAL_CTRL errata handling out of setup_vmcs_config()\" (git-fixes).\n- USB: serial: option: add SIMCom 8230C compositions (git-fixes).\n- USB: serial: option: add SIMCom 8230C compositions (stable-fixes).\n- accel/ivpu: Add missing MODULE_FIRMWARE metadata (git-fixes).\n- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (git-fixes).\n- add bug reference to existing hv_netvsc change (bsc#1252265)\n- arm64, mm: avoid always making PTE dirty in pte_mkwrite() (git-fixes)\n- arm64: cputype: Add Neoverse-V3AE definitions (git-fixes)\n- arm64: errata: Apply workarounds for Neoverse-V3AE (git-fixes)\n- arm64: mte: Do not flag the zero page as PG_mte_tagged (git-fixes)\n- bpf: Allow helper bpf_get_[ns_]current_pid_tgid() for all prog types (bsc#1252364).\n- bpf: Avoid RCU context warning when unpinning htab with internal structs (git-fixes).\n- bpf: Check link_create.flags parameter for multi_kprobe (git-fixes).\n- bpf: Check link_create.flags parameter for multi_uprobe (git-fixes).\n- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (git-fixes).\n- bpf: Use preempt_count() directly in bpf_send_signal_common() (git-fixes).\n- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (git-fixes).\n- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (git-fixes).\n- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (git-fixes).\n- can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (git-fixes).\n- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (stable-fixes).\n- can: netlink: can_changelink(): allow disabling of automatic restart (git-fixes).\n- can: rcar_canfd: Fix controller mode setting (stable-fixes).\n- clk: at91: peripheral: fix return value (git-fixes).\n- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (git-fixes).\n- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (git-fixes).\n- clk: tegra: do not overallocate memory for bpmp clocks (git-fixes).\n- cpufreq: CPPC: fix perf_to_khz/khz_to_perf conversion exception (git-fixes).\n- cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (stable-fixes git-fixes).\n- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (stable-fixes git-fixes).\n- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (git-fixes).\n- cpufreq: scmi: Skip SCMI devices that are not used by the CPUs (stable-fixes).\n- cpufreq: tegra186: Set target frequency for all cpus in policy (git-fixes).\n- cpuidle: governors: menu: Avoid using invalid recent intervals data (git-fixes).\n- cpuidle: menu: Avoid discarding useful information (stable-fixes).\n- cpuidle: qcom-spm: fix device and OF node leaks at probe (git-fixes).\n- crypto: essiv - Check ssize for decryption and in-place encryption (git-fixes).\n- crypto: rng - Ensure set_ent is always present (git-fixes).\n- driver core/PM: Set power.no_callbacks along with power.no_pm (stable-fixes).\n- drivers/perf: arm_spe: Use perf_allow_kernel() for permissions (git-fixes).\n- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (git-fixes).\n- drm/amd/display: Disable scaling on DCE6 for now (git-fixes).\n- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (git-fixes).\n- drm/amd/display: Properly disable scaling on DCE6 (git-fixes).\n- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji (git-fixes).\n- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland (git-fixes).\n- drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (git-fixes).\n- drm/amd/powerplay: Fix CIK shutdown temperature (git-fixes).\n- drm/amd: Check whether secure display TA loaded successfully (stable-fixes).\n- drm/amdgpu: Add additional DCE6 SCL registers (git-fixes).\n- drm/amdgpu: use atomic functions with memory barriers for vm fault info (git-fixes).\n- drm/bridge: lt9211: Drop check for last nibble of version register (git-fixes).\n- drm/etnaviv: fix flush sequence logic (git-fixes).\n- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (stable-fixes).\n- drm/exynos: exynos7_drm_decon: properly clear channels during bind (stable-fixes).\n- drm/i915/guc: Skip communication warning on reset in progress (git-fixes).\n- drm/mediatek: Fix device use-after-free on unbind (git-fixes).\n- drm/msm/a6xx: Fix GMU firmware parser (git-fixes).\n- drm/msm/adreno: De-spaghettify the use of memory barriers (stable-fixes).\n- drm/msm/dpu: Fix pixel extension sub-sampling (git-fixes).\n- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (git-fixes).\n- drm/panel: kingdisplay-kd097d04: Disable EoTp (git-fixes).\n- drm/panel: sitronix-st7789v: fix sync flags for t28cp45tn89 (git-fixes).\n- drm/rockchip: vop2: use correct destination rectangle height check (git-fixes).\n- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (git-fixes).\n- drm/vmwgfx: Fix Use-after-free in validation (git-fixes).\n- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (git-fixes).\n- drm/vmwgfx: Fix copy-paste typo in validation (git-fixes).\n- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (git-fixes).\n- ext4: check fast symlink for ea_inode correctly (git-fixes).\n- ext4: do not convert the unwritten extents if data writeback fails (git-fixes).\n- ext4: do not try to clear the orphan_present feature block device is r/o (git-fixes).\n- ext4: ensure i_size is smaller than maxbytes (git-fixes).\n- ext4: factor out ext4_get_maxbytes() (git-fixes).\n- ext4: fix calculation of credits for extent tree modification (git-fixes).\n- ext4: fix checks for orphan inodes (bsc#1250119).\n- ext4: fix fsmap end of range reporting with bigalloc (git-fixes).\n- ext4: fix hole length calculation overflow in non-extent inodes (git-fixes).\n- ext4: fix largest free orders lists corruption on mb_optimize_scan switch (git-fixes).\n- ext4: fix reserved gdt blocks handling in fsmap (git-fixes).\n- ext4: fix zombie groups in average fragment size lists (git-fixes).\n- ext4: preserve SB_I_VERSION on remount (git-fixes).\n- ext4: reorder capability check last (git-fixes).\n- fbdev: Fix logic error in \"offb\" name match (git-fixes).\n- fbdev: atyfb: Check if pll_ops-\u003einit_pll failed (git-fixes).\n- fbdev: valkyriefb: Fix reference count leak in valkyriefb_init (git-fixes).\n- firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode (git-fixes).\n- fs: udf: fix OOB read in lengthAllocDescs handling (git-fixes).\n- ftrace: fix incorrect hash size in register_ftrace_direct() (git-fixes).\n- gpio: wcd934x: mark the GPIO controller as sleeping (git-fixes).\n- hfs: validate record offset in hfsplus_bmap_alloc (git-fixes).\n- hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() (git-fixes).\n- hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (git-fixes).\n- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (git-fixes).\n- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (git-fixes).\n- hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() (git-fixes).\n- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (stable-fixes).\n- i2c: ocores: use devm_ managed clks (git-fixes).\n- iomap: Fix iomap_adjust_read_range for plen calculation (git-fixes).\n- iomap: handle a post-direct I/O invalidate race in iomap_write_delalloc_release (git-fixes).\n- iommu/vt-d: Disallow dirty tracking if incoherent page walk (git-fixes).\n- iommu/vt-d: PRS isn't usable if PDS isn't supported (git-fixes).\n- isofs: Verify inode mode when loading from disk (git-fixes).\n- jbd2: do not try to recover wiped journal (git-fixes).\n- kABI fix for KVM: x86: Snapshot the host's DEBUGCTL in common x86 (git-fixes).\n- kdb: Replace deprecated strcpy() with memmove() in vkdb_printf() (bsc#1252939).\n- kernel-subpackage-spec: Do not doubly-sign modules (bsc#1251930).\n- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (stable-fixes).\n- locking/mutex: Introduce devm_mutex_init() (stable-fixes).\n- locking/mutex: Mark devm_mutex_init() as __must_check (stable-fixes).\n- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (git-fixes).\n- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (git-fixes).\n- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (git-fixes).\n- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (git-fixes).\n- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (stable-fixes).\n- media: solo6x10: replace max(a, min(b, c)) by clamp(b, a, c) (git-fixes).\n- media: tuner: xc5000: Fix use-after-free in xc5000_release (git-fixes).\n- media: tunner: xc5000: Refactor firmware load (stable-fixes).\n- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (stable-fixes).\n- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (stable-fixes).\n- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (git-fixes).\n- misc: fastrpc: Add missing dev_err newlines (stable-fixes).\n- misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup (git-fixes).\n- misc: fastrpc: Fix fastrpc_map_lookup operation (git-fixes).\n- misc: fastrpc: Save actual DMA size in fastrpc_map structure (git-fixes).\n- misc: fastrpc: Skip reference for DMA handles (git-fixes).\n- misc: fastrpc: fix possible map leak in fastrpc_put_args (git-fixes).\n- mmc: core: SPI mode remove cmd7 (stable-fixes).\n- most: usb: Fix use-after-free in hdm_disconnect (git-fixes).\n- most: usb: hdm_probe: Fix calling put_device() before device initialization (git-fixes).\n- mtd: rawnand: fsmc: Default to autodetect buswidth (stable-fixes).\n- net: mana: Use page pool fragments for RX buffers instead of full pages to improve memory efficiency (bsc#1248754).\n- net: phy: dp83869: fix STRAP_OPMODE bitmask (git-fixes).\n- net: sysfs: Fix /sys/class/net/\u0026lt;iface\u003e path (git-fixes).\n- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (git-fixes).\n- net: usb: asix_devices: Check return value of usbnet_get_endpoints (git-fixes).\n- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (git-fixes).\n- net: usb: lan78xx: fix use of improperly initialized dev-\u003echipid in lan78xx_reset (git-fixes).\n- net: usb: rtl8150: Fix frame padding (git-fixes).\n- netfilter: nft_objref: validate objref and objrefmap expressions (bsc#1250237).\n- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (git-fixes).\n- nvme-multipath: Skip nr_active increments in RETRY disposition (git-fixes).\n- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (git-fixes).\n- nvme/tcp: handle tls partially sent records in write_space() (git-fixes).\n- overlayfs: set ctime when setting mtime and atime (stable-fixes).\n- ovl: Always reevaluate the file signature for IMA (stable-fixes).\n- ovl: fix file reference leak when submitting aio (stable-fixes).\n- ovl: fix incorrect fdput() on aio completion (stable-fixes).\n- perf/amd/ibs: Fix -\u003econfig to sample period calculation for OP PMU (git-fixes).\n- perf/amd/ibs: Fix perf_ibs_op.cnt_mask for CurCnt (git-fixes).\n- perf/amd: Prevent grouping of IBS events (git-fixes).\n- perf/aux: Fix pending disable flow when the AUX ring buffer overruns (git-fixes).\n- perf/bpf: Robustify perf_event_free_bpf_prog() (git-fixes).\n- perf/core: Fix WARN in perf_cgroup_switch() (git-fixes).\n- perf/core: Fix broken throttling when max_samples_per_tick=1 (git-fixes).\n- perf/core: Fix child_total_time_enabled accounting bug at task exit (git-fixes).\n- perf/core: Fix low freq setting via IOC_PERIOD (git-fixes).\n- perf/core: Fix pmus_lock vs. pmus_srcu ordering (git-fixes).\n- perf/core: Fix small negative period being ignored (git-fixes).\n- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (git-fixes).\n- perf/hw_breakpoint: Return EOPNOTSUPP for unsupported breakpoint type (git-fixes).\n- perf/ring_buffer: Allow the EPOLLRDNORM flag for poll (git-fixes).\n- perf/x86/amd: Warn only on new bits set (git-fixes).\n- perf/x86/intel/ds: Unconditionally drain PEBS DS when changing PEBS_DATA_CFG (git-fixes).\n- perf/x86/intel/pt: Fix sampling synchronization (git-fixes).\n- perf/x86/intel/uncore: Fix the scale of IIO free running counters on ICX (git-fixes).\n- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR (git-fixes).\n- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SPR (git-fixes).\n- perf/x86/intel: Allow to setup LBR for counting event for BPF (git-fixes).\n- perf/x86/intel: Allow to update user space GPRs from PEBS records (git-fixes).\n- perf/x86/intel: Apply static call for drain_pebs (git-fixes).\n- perf/x86/intel: Avoid disable PMU if !cpuc-\u003eenabled in sample read (git-fixes).\n- perf/x86/intel: Fix crash in icl_update_topdown_event() (git-fixes).\n- perf/x86/intel: Only check the group flag for X86 leader (git-fixes).\n- perf/x86/intel: Use better start period for frequency mode (git-fixes).\n- perf/x86: Fix low freqency setting issue (git-fixes).\n- perf/x86: Fix non-sampling (counting) events on certain x86 platforms (git-fixes).\n- perf: Ensure bpf_perf_link path is properly serialized (git-fixes).\n- perf: Extract a few helpers (git-fixes).\n- perf: Fix cgroup state vs ERROR (git-fixes).\n- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (git-fixes).\n- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (git-fixes).\n- phy: cdns-dphy: Store hs_clk_rate and return it (stable-fixes).\n- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (stable-fixes).\n- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (stable-fixes).\n- powerpc/boot: Fix build with gcc 15 (bsc#1215199).\n- powerpc/kvm: Fix ifdef to remove build warning (bsc#1215199).\n- powerpc/powernv/pci: Fix underflow and leak issue (bsc#1215199).\n- powerpc/pseries/msi: Fix potential underflow and leak issue (bsc#1215199).\n- powerpc: export MIN RMA size (bsc#1236743 ltc#211409).\n- powerpc: floppy: Add missing checks after DMA map (bsc#1215199).\n- powerpc: increase MIN RMA size for CAS negotiation (bsc#1236743 ltc#211409 bsc#1252269 ltc#215957).\n- proc: fix missing pde_set_flags() for net proc files (bsc#1248630)\n- proc: fix type confusion in pde_set_flags() (bsc#1248630)\n- r8152: add error handling in rtl8152_driver_init (git-fixes).\n- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (git-fixes).\n- regmap: slimbus: fix bus_context pointer in regmap init calls (git-fixes).\n- regulator: bd718x7: Fix voltages scaled by resistor divider (git-fixes).\n- rpm/check-for-config-changes: ignore CONFIG_SCHED_PROXY_EXEC, too (bsc#1250946).\n- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (stable-fixes).\n- rtc: interface: Fix long-standing race when setting alarm (stable-fixes).\n- rtc: optee: fix memory leak on driver removal (git-fixes).\n- rtc: x1205: Fix Xicor X1205 vendor prefix (git-fixes).\n- s390: Initialize psw mask in perf_arch_fetch_caller_regs() (git-fixes).\n- samples/bpf: Fix compilation failure for samples/bpf on LoongArch Fedora (git-fixes).\n- sched/fair: set_load_weight() must also call reweight_task() (git-fixes)\n- sched/idle: Conditionally handle tick broadcast in default_idle_call() (bsc#1248517).\n- selftests/bpf: Add test for unpinning htab with internal timer struct (git-fixes).\n- selftests/bpf: Fix C++ compile error from missing _Bool type (git-fixes).\n- selftests/bpf: Fix a fd leak in error paths in open_netns (git-fixes).\n- selftests/bpf: Fix backtrace printing for selftests crashes (git-fixes).\n- selftests/bpf: Fix compile error from rlim_t in sk_storage_map.c (git-fixes).\n- selftests/bpf: Fix compile if backtrace support missing in libc (git-fixes).\n- selftests/bpf: Fix compiling core_reloc.c with musl-libc (git-fixes).\n- selftests/bpf: Fix compiling flow_dissector.c with musl-libc (git-fixes).\n- selftests/bpf: Fix compiling kfree_skb.c with musl-libc (git-fixes).\n- selftests/bpf: Fix compiling parse_tcp_hdr_opt.c with musl-libc (git-fixes).\n- selftests/bpf: Fix compiling tcp_rtt.c with musl-libc (git-fixes).\n- selftests/bpf: Fix cross-compiling urandom_read (git-fixes).\n- selftests/bpf: Fix error compiling bpf_iter_setsockopt.c with musl libc (git-fixes).\n- selftests/bpf: Fix error compiling tc_redirect.c with musl libc (git-fixes).\n- selftests/bpf: Fix error compiling test_lru_map.c (git-fixes).\n- selftests/bpf: Fix errors compiling cg_storage_multi.h with musl libc (git-fixes).\n- selftests/bpf: Fix errors compiling decap_sanity.c with musl libc (git-fixes).\n- selftests/bpf: Fix errors compiling lwt_redirect.c with musl libc (git-fixes).\n- selftests/bpf: Fix redefinition errors compiling lwt_reroute.c (git-fixes).\n- selftests/bpf: Fix umount cgroup2 error in test_sockmap (git-fixes).\n- selftests/bpf: Use bpf_link__destroy in fill_link_info tests (git-fixes).\n- selftests/tracing: Fix event filter test to retry up to 10 times (git-fixes).\n- selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (git-fixes).\n- serial: 8250_dw: handle reset control deassert error (git-fixes).\n- serial: jsm: fix NPE during jsm_uart_port_init (git fixes, bsc#1246244).\n- skmsg: Return copied bytes in sk_msg_memcopy_from_iter (bsc#1250650).\n- smb: client: fix crypto buffers in non-linear memory (bsc#1250491, boo#1239206).\n- smb: client: fix potential cfid UAF in smb2_query_info_compound (bsc#1248886).\n- spi: spi-nxp-fspi: add extra delay after dll locked (git-fixes).\n- staging: axis-fifo: fix TX handling on copy_from_user() failure (git-fixes).\n- staging: axis-fifo: fix maximum TX packet length check (git-fixes).\n- staging: axis-fifo: flush RX FIFO on read errors (git-fixes).\n- sunrpc: fix null pointer dereference on zero-length checksum (git-fixes).\n- tcp: Do not call reqsk_fastopen_remove() in tcp_conn_request() (git-fixes).\n- tcp_bpf: Fix copied value in tcp_bpf_sendmsg (bsc#1250650).\n- tools/resolve_btfids: Fix build when cross compiling kernel with clang (git-fixes).\n- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (git-fixes).\n- tracing/selftests: Fix kprobe event name test for .isra. functions (git-fixes).\n- tracing: Correct the refcount if the hist/hist_debug file fails to open (git-fixes).\n- tracing: Fix filter string testing (git-fixes).\n- tracing: Remove unneeded goto out logic (bsc#1249286).\n- udf: Make sure i_lenExtents is uptodate on inode eviction (git-fixes).\n- udf: Verify partition map count (git-fixes).\n- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (git-fixes).\n- usb: hub: Fix flushing of delayed work used for post resume purposes (git-fixes).\n- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (git-fixes).\n- usb: phy: twl6030: Fix incorrect type for ret (git-fixes).\n- usb: xhci: Avoid queuing redundant Stop Endpoint commands (git-fixes).\n- usb: xhci: Limit Stop Endpoint retries (git-fixes).\n- usbnet: Fix using smp_processor_id() in preemptible code warnings (git-fixes).\n- usbnet: Prevents free active kevent (git-fixes).\n- wifi: ath10k: Fix memory leak on unsupported WMI command (git-fixes).\n- wifi: ath11k: Add missing platform IDs for quirk table (git-fixes).\n- wifi: ath12k: free skb during idr cleanup callback (git-fixes).\n- wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (git-fixes).\n- wifi: mac80211: reset FILS discovery and unsol probe resp intervals (git-fixes).\n- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (stable-fixes).\n- wifi: rtlwifi: rtl8192cu: Do not claim USB ID 07b8:8188 (stable-fixes).\n- x86/idle: Sanitize X86_BUG_AMD_E400 handling (bsc#1248517).\n- xfs: rename the old_crc variable in xlog_recover_process (git-fixes).\n- xhci: dbc: enable back DbC in resume if it was enabled before suspend (git-fixes).\n- xhci: retry Stop Endpoint on buggy NEC controllers (git-fixes).\n","status":"published","published":"2025-11-25T18:51:32Z","modified":"2026-03-23T04:49:14.56319Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2025:21056-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.\n\nThe following security bugs were fixed:\n\n- CVE-2025-38008: mm/page_alloc: fix race condition in unaccepted memory handling (bsc#1244939).\n- CVE-2025-38539: trace/fgraph: Fix the warning caused by missing unregister notifier (bsc#1248211).\n- CVE-2025-38552: mptcp: plug races between subflow fail and subflow creation (bsc#1248230).\n- CVE-2025-38653: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (bsc#1248630).\n- CVE-2025-38699: scsi: bfa: Double-free fix (bsc#1249224).\n- CVE-2025-38700: scsi: libiscsi: Initialize iscsi_conn-\u003edd_data only if memory is allocated (bsc#1249182).\n- CVE-2025-38718: sctp: linearize cloned gso packets in sctp_rcv (bsc#1249161).\n- CVE-2025-39673: ppp: fix race conditions in ppp_fill_forward_path (bsc#1249320).\n- CVE-2025-39676: scsi: qla4xxx: Prevent a potential error pointer dereference (bsc#1249302).\n- CVE-2025-39683: tracing: Limit access to parser-\u003ebuffer when trace_get_user failed (bsc#1249286).\n- CVE-2025-39697: nfs: remove dead code for the old swap over NFS implementation (bsc#1249319).\n- CVE-2025-39702: ipv6: sr: Fix MAC comparison to be constant-time (bsc#1249317).\n- CVE-2025-39756: fs: Prevent file descriptor table allocations exceeding INT_MAX (bsc#1249512).\n- CVE-2025-39794: ARM: tegra: Use I/O memcpy to write to IRAM (bsc#1249595).\n- CVE-2025-39812: sctp: initialize more fields in sctp_v6_from_sk() (bsc#1250202).\n- CVE-2025-39813: ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (bsc#1250032).\n- CVE-2025-39828: atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control() (bsc#1250205).\n- CVE-2025-39851: vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (bsc#1250296).\n- CVE-2025-39866: fs: writeback: fix use-after-free in __mark_inode_dirty() (bsc#1250455).\n- CVE-2025-39876: net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (bsc#1250400).\n- CVE-2025-39881: kernfs: Fix UAF in polling when open file is released (bsc#1250379).\n- CVE-2025-39895: sched: Fix sched_numa_find_nth_cpu() if mask offline (bsc#1250721).\n- CVE-2025-39898: e1000e: fix heap overflow in e1000_set_eeprom (bsc#1250742).\n- CVE-2025-39902: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (bsc#1250702).\n- CVE-2025-39911: i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (bsc#1250704).\n- CVE-2025-39945: cnic: Fix use-after-free bugs in cnic_delete_task (bsc#1251230).\n- CVE-2025-39946: tls: make sure to abort the stream if headers are bogus (bsc#1251114).\n- CVE-2025-39947: net/mlx5e: Harden uplink netdev access against device unbind (bsc#1251232).\n- CVE-2025-39948: ice: fix Rx page leak on multi-buffer frames (bsc#1251233).\n- CVE-2025-39949: qed: Don't collect too many protection override GRC elements (bsc#1251177).\n- CVE-2025-39955: tcp: Clear tcp_sk(sk)-\u003efastopen_rsk in tcp_disconnect() (bsc#1251804).\n- CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).\n- CVE-2025-39969: i40e: fix validation of VF state in get resources (bsc#1252044).\n- CVE-2025-39970: i40e: fix input validation logic for action_meta (bsc#1252051).\n- CVE-2025-39971: i40e: fix idx validation in config queues msg (bsc#1252052).\n- CVE-2025-39972: i40e: fix idx validation in i40e_validate_queue_map (bsc#1252039).\n- CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252035).\n- CVE-2025-39978: octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (bsc#1252069).\n- CVE-2025-40000: wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (bsc#1252062).\n- CVE-2025-40005: spi: cadence-quadspi: Implement refcount to handle unbind during busy (bsc#1252349).\n- CVE-2025-40018: ipvs: Defer ip_vs_ftp unregister during netns cleanup (bsc#1252688).\n- CVE-2025-40051: vhost: vringh: Modify the return value check (bsc#1252858).\n- CVE-2025-40056: vhost: vringh: Fix copy_to_iter return value check (bsc#1252826).\n- CVE-2025-40060: coresight: trbe: Return NULL pointer for allocation failures (bsc#1252848).\n- CVE-2025-40078: bpf: Explicitly check accesses to bpf_sock_addr (bsc#1252789).\n- CVE-2025-40080: nbd: restrict sockets to TCP and UDP (bsc#1252774).\n- CVE-2025-40100: btrfs: do not assert we found block group item when creating free space tree (bsc#1252918).\n\nThe following non-security bugs were fixed:\n\n- ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (stable-fixes).\n- ACPI: battery: Add synchronization between interface updates (git-fixes).\n- ACPI: battery: Check for error code from devm_mutex_init() call (git-fixes).\n- ACPI: battery: allocate driver data through devm_ APIs (stable-fixes).\n- ACPI: battery: initialize mutexes through devm_ APIs (stable-fixes).\n- ACPI: button: Call input_free_device() on failing input device registration (git-fixes).\n- ACPI: property: Add code comments explaining what is going on (stable-fixes).\n- ACPI: property: Disregard references in data-only subnode lists (stable-fixes).\n- ACPI: property: Do not pass NULL handles to acpi_attach_data() (stable-fixes git-fixes).\n- ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (git-fixes).\n- ACPI: x86: Move acpi_quirk_skip_serdev_enumeration() out of CONFIG_X86_ANDROID_TABLETS (stable-fixes).\n- ACPICA: Allow to skip Global Lock initialization (stable-fixes).\n- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (git-fixes).\n- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (git-fixes).\n- ALSA: usb-audio: fix control pipe direction (git-fixes).\n- ASoC: Intel: avs: Unprepare a stream when XRUN occurs (git-fixes).\n- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (git-fixes).\n- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (git-fixes).\n- ASoC: amd: acp: Adjust pdm gain value (stable-fixes).\n- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (git-fixes).\n- ASoC: fsl_sai: fix bit order for DSD format (git-fixes).\n- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (git-fixes).\n- ASoC: nau8821: Cancel jdet_work before handling jack ejection (git-fixes).\n- ASoC: nau8821: Generalize helper to clear IRQ status (git-fixes).\n- ASoC: qdsp6: q6asm: do not sleep while atomic (git-fixes).\n- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (stable-fixes).\n- Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset (git-fixes).\n- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (stable-fixes).\n- Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (git-fixes).\n- HID: hid-input: only ignore 0 battery events for digitizers (git-fixes).\n- HID: multitouch: fix name of Stylus input devices (git-fixes).\n- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (git-fixes).\n- KVM: PPC: Fix misleading interrupts comment in kvmppc_prepare_to_enter() (bsc#1215199).\n- KVM: SEV: Read save fields from GHCB exactly once (git-fixes).\n- KVM: SEV: Rename kvm_ghcb_get_sw_exit_code() to kvm_get_cached_sw_exit_code() (git-fixes).\n- KVM: SEV: Validate XCR0 provided by guest in GHCB (git-fixes).\n- KVM: SVM: Inject #GP if memory operand for INVPCID is non-canonical (git-fixes).\n- KVM: SVM: Pass through GHCB MSR if and only if VM is an SEV-ES guest (git-fixes).\n- KVM: SVM: Set RFLAGS.IF=1 in C code, to get VMRUN out of the STI shadow (git-fixes).\n- KVM: x86/mmu: Prevent installing hugepages when mem attributes are changing (git-fixes).\n- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (git-fixes).\n- KVM: x86: Clear pv_unhalted on all transitions to KVM_MP_STATE_RUNNABLE (git-fixes).\n- KVM: x86: Do not bleed PVCLOCK_GUEST_STOPPED across PV clocks (git-fixes).\n- KVM: x86: Do not inject PV async #PF if SEND_ALWAYS=0 and guest state is protected (git-fixes).\n- KVM: x86: Introduce kvm_set_mp_state() (git-fixes).\n- KVM: x86: Introduce kvm_x86_call() to simplify static calls of kvm_x86_ops (git-fixes).\n- KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update() (git-fixes).\n- KVM: x86: Process \"guest stopped request\" once per guest time update (git-fixes).\n- KVM: x86: Replace static_call_cond() with static_call() (git-fixes).\n- KVM: x86: Set PVCLOCK_GUEST_STOPPED only for kvmclock, not for Xen PV clock (git-fixes).\n- KVM: x86: Snapshot the host's DEBUGCTL after disabling IRQs (git-fixes).\n- KVM: x86: Snapshot the host's DEBUGCTL in common x86 (git-fixes).\n- KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer (git-fixes).\n- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (git-fixes).\n- NFSD: Fix crash in nfsd4_read_release() (git-fixes).\n- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (git-fixes).\n- NFSD: Minor cleanup in layoutcommit processing (git-fixes).\n- NFSD: Rework encoding and decoding of nfsd4_deviceid (git-fixes).\n- PCI/AER: Support errors introduced by PCIe r6.0 (stable-fixes).\n- PCI: Add PCI_VDEVICE_SUB helper macro (stable-fixes).\n- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (stable-fixes).\n- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (git-fixes).\n- PCI: j721e: Enable ACSPCIE Refclk if \"ti,syscon-acspcie-proxy-ctrl\" exists (stable-fixes).\n- PCI: j721e: Fix programming sequence of \"strap\" settings (git-fixes).\n- PM: runtime: Add new devm functions (stable-fixes).\n- Revert \"KVM: VMX: Move LOAD_IA32_PERF_GLOBAL_CTRL errata handling out of setup_vmcs_config()\" (git-fixes).\n- USB: serial: option: add SIMCom 8230C compositions (git-fixes).\n- USB: serial: option: add SIMCom 8230C compositions (stable-fixes).\n- accel/ivpu: Add missing MODULE_FIRMWARE metadata (git-fixes).\n- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (git-fixes).\n- add bug reference to existing hv_netvsc change (bsc#1252265)\n- arm64, mm: avoid always making PTE dirty in pte_mkwrite() (git-fixes)\n- arm64: cputype: Add Neoverse-V3AE definitions (git-fixes)\n- arm64: errata: Apply workarounds for Neoverse-V3AE (git-fixes)\n- arm64: mte: Do not flag the zero page as PG_mte_tagged (git-fixes)\n- bpf: Allow helper bpf_get_[ns_]current_pid_tgid() for all prog types (bsc#1252364).\n- bpf: Avoid RCU context warning when unpinning htab with internal structs (git-fixes).\n- bpf: Check link_create.flags parameter for multi_kprobe (git-fixes).\n- bpf: Check link_create.flags parameter for multi_uprobe (git-fixes).\n- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (git-fixes).\n- bpf: Use preempt_count() directly in bpf_send_signal_common() (git-fixes).\n- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (git-fixes).\n- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (git-fixes).\n- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (git-fixes).\n- can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (git-fixes).\n- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (stable-fixes).\n- can: netlink: can_changelink(): allow disabling of automatic restart (git-fixes).\n- can: rcar_canfd: Fix controller mode setting (stable-fixes).\n- clk: at91: peripheral: fix return value (git-fixes).\n- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (git-fixes).\n- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (git-fixes).\n- clk: tegra: do not overallocate memory for bpmp clocks (git-fixes).\n- cpufreq: CPPC: fix perf_to_khz/khz_to_perf conversion exception (git-fixes).\n- cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (stable-fixes git-fixes).\n- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (stable-fixes git-fixes).\n- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (git-fixes).\n- cpufreq: scmi: Skip SCMI devices that are not used by the CPUs (stable-fixes).\n- cpufreq: tegra186: Set target frequency for all cpus in policy (git-fixes).\n- cpuidle: governors: menu: Avoid using invalid recent intervals data (git-fixes).\n- cpuidle: menu: Avoid discarding useful information (stable-fixes).\n- cpuidle: qcom-spm: fix device and OF node leaks at probe (git-fixes).\n- crypto: essiv - Check ssize for decryption and in-place encryption (git-fixes).\n- crypto: rng - Ensure set_ent is always present (git-fixes).\n- driver core/PM: Set power.no_callbacks along with power.no_pm (stable-fixes).\n- drivers/perf: arm_spe: Use perf_allow_kernel() for permissions (git-fixes).\n- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (git-fixes).\n- drm/amd/display: Disable scaling on DCE6 for now (git-fixes).\n- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (git-fixes).\n- drm/amd/display: Properly disable scaling on DCE6 (git-fixes).\n- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji (git-fixes).\n- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland (git-fixes).\n- drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (git-fixes).\n- drm/amd/powerplay: Fix CIK shutdown temperature (git-fixes).\n- drm/amd: Check whether secure display TA loaded successfully (stable-fixes).\n- drm/amdgpu: Add additional DCE6 SCL registers (git-fixes).\n- drm/amdgpu: use atomic functions with memory barriers for vm fault info (git-fixes).\n- drm/bridge: lt9211: Drop check for last nibble of version register (git-fixes).\n- drm/etnaviv: fix flush sequence logic (git-fixes).\n- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (stable-fixes).\n- drm/exynos: exynos7_drm_decon: properly clear channels during bind (stable-fixes).\n- drm/i915/guc: Skip communication warning on reset in progress (git-fixes).\n- drm/mediatek: Fix device use-after-free on unbind (git-fixes).\n- drm/msm/a6xx: Fix GMU firmware parser (git-fixes).\n- drm/msm/adreno: De-spaghettify the use of memory barriers (stable-fixes).\n- drm/msm/dpu: Fix pixel extension sub-sampling (git-fixes).\n- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (git-fixes).\n- drm/panel: kingdisplay-kd097d04: Disable EoTp (git-fixes).\n- drm/panel: sitronix-st7789v: fix sync flags for t28cp45tn89 (git-fixes).\n- drm/rockchip: vop2: use correct destination rectangle height check (git-fixes).\n- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (git-fixes).\n- drm/vmwgfx: Fix Use-after-free in validation (git-fixes).\n- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (git-fixes).\n- drm/vmwgfx: Fix copy-paste typo in validation (git-fixes).\n- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (git-fixes).\n- ext4: check fast symlink for ea_inode correctly (git-fixes).\n- ext4: do not convert the unwritten extents if data writeback fails (git-fixes).\n- ext4: do not try to clear the orphan_present feature block device is r/o (git-fixes).\n- ext4: ensure i_size is smaller than maxbytes (git-fixes).\n- ext4: factor out ext4_get_maxbytes() (git-fixes).\n- ext4: fix calculation of credits for extent tree modification (git-fixes).\n- ext4: fix checks for orphan inodes (bsc#1250119).\n- ext4: fix fsmap end of range reporting with bigalloc (git-fixes).\n- ext4: fix hole length calculation overflow in non-extent inodes (git-fixes).\n- ext4: fix largest free orders lists corruption on mb_optimize_scan switch (git-fixes).\n- ext4: fix reserved gdt blocks handling in fsmap (git-fixes).\n- ext4: fix zombie groups in average fragment size lists (git-fixes).\n- ext4: preserve SB_I_VERSION on remount (git-fixes).\n- ext4: reorder capability check last (git-fixes).\n- fbdev: Fix logic error in \"offb\" name match (git-fixes).\n- fbdev: atyfb: Check if pll_ops-\u003einit_pll failed (git-fixes).\n- fbdev: valkyriefb: Fix reference count leak in valkyriefb_init (git-fixes).\n- firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode (git-fixes).\n- fs: udf: fix OOB read in lengthAllocDescs handling (git-fixes).\n- ftrace: fix incorrect hash size in register_ftrace_direct() (git-fixes).\n- gpio: wcd934x: mark the GPIO controller as sleeping (git-fixes).\n- hfs: validate record offset in hfsplus_bmap_alloc (git-fixes).\n- hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() (git-fixes).\n- hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (git-fixes).\n- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (git-fixes).\n- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (git-fixes).\n- hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() (git-fixes).\n- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (stable-fixes).\n- i2c: ocores: use devm_ managed clks (git-fixes).\n- iomap: Fix iomap_adjust_read_range for plen calculation (git-fixes).\n- iomap: handle a post-direct I/O invalidate race in iomap_write_delalloc_release (git-fixes).\n- iommu/vt-d: Disallow dirty tracking if incoherent page walk (git-fixes).\n- iommu/vt-d: PRS isn't usable if PDS isn't supported (git-fixes).\n- isofs: Verify inode mode when loading from disk (git-fixes).\n- jbd2: do not try to recover wiped journal (git-fixes).\n- kABI fix for KVM: x86: Snapshot the host's DEBUGCTL in common x86 (git-fixes).\n- kdb: Replace deprecated strcpy() with memmove() in vkdb_printf() (bsc#1252939).\n- kernel-subpackage-spec: Do not doubly-sign modules (bsc#1251930).\n- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (stable-fixes).\n- locking/mutex: Introduce devm_mutex_init() (stable-fixes).\n- locking/mutex: Mark devm_mutex_init() as __must_check (stable-fixes).\n- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (git-fixes).\n- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (git-fixes).\n- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (git-fixes).\n- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (git-fixes).\n- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (stable-fixes).\n- media: solo6x10: replace max(a, min(b, c)) by clamp(b, a, c) (git-fixes).\n- media: tuner: xc5000: Fix use-after-free in xc5000_release (git-fixes).\n- media: tunner: xc5000: Refactor firmware load (stable-fixes).\n- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (stable-fixes).\n- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (stable-fixes).\n- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (git-fixes).\n- misc: fastrpc: Add missing dev_err newlines (stable-fixes).\n- misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup (git-fixes).\n- misc: fastrpc: Fix fastrpc_map_lookup operation (git-fixes).\n- misc: fastrpc: Save actual DMA size in fastrpc_map structure (git-fixes).\n- misc: fastrpc: Skip reference for DMA handles (git-fixes).\n- misc: fastrpc: fix possible map leak in fastrpc_put_args (git-fixes).\n- mmc: core: SPI mode remove cmd7 (stable-fixes).\n- module: Prevent silent truncation of module name in delete_module(2) (git-fixes).\n- most: usb: Fix use-after-free in hdm_disconnect (git-fixes).\n- most: usb: hdm_probe: Fix calling put_device() before device initialization (git-fixes).\n- mtd: rawnand: fsmc: Default to autodetect buswidth (stable-fixes).\n- net: mana: Use page pool fragments for RX buffers instead of full pages to improve memory efficiency (bsc#1248754).\n- net: phy: dp83869: fix STRAP_OPMODE bitmask (git-fixes).\n- net: sysfs: Fix /sys/class/net/\u0026lt;iface\u003e path (git-fixes).\n- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (git-fixes).\n- net: usb: asix_devices: Check return value of usbnet_get_endpoints (git-fixes).\n- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (git-fixes).\n- net: usb: lan78xx: fix use of improperly initialized dev-\u003echipid in lan78xx_reset (git-fixes).\n- net: usb: rtl8150: Fix frame padding (git-fixes).\n- netfilter: nft_objref: validate objref and objrefmap expressions (bsc#1250237).\n- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (git-fixes).\n- nvme-multipath: Skip nr_active increments in RETRY disposition (git-fixes).\n- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (git-fixes).\n- nvme/tcp: handle tls partially sent records in write_space() (git-fixes).\n- overlayfs: set ctime when setting mtime and atime (stable-fixes).\n- ovl: Always reevaluate the file signature for IMA (stable-fixes).\n- ovl: fix file reference leak when submitting aio (stable-fixes).\n- ovl: fix incorrect fdput() on aio completion (stable-fixes).\n- perf/amd/ibs: Fix -\u003econfig to sample period calculation for OP PMU (git-fixes).\n- perf/amd/ibs: Fix perf_ibs_op.cnt_mask for CurCnt (git-fixes).\n- perf/amd: Prevent grouping of IBS events (git-fixes).\n- perf/aux: Fix pending disable flow when the AUX ring buffer overruns (git-fixes).\n- perf/bpf: Robustify perf_event_free_bpf_prog() (git-fixes).\n- perf/core: Fix WARN in perf_cgroup_switch() (git-fixes).\n- perf/core: Fix broken throttling when max_samples_per_tick=1 (git-fixes).\n- perf/core: Fix child_total_time_enabled accounting bug at task exit (git-fixes).\n- perf/core: Fix low freq setting via IOC_PERIOD (git-fixes).\n- perf/core: Fix pmus_lock vs. pmus_srcu ordering (git-fixes).\n- perf/core: Fix small negative period being ignored (git-fixes).\n- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (git-fixes).\n- perf/hw_breakpoint: Return EOPNOTSUPP for unsupported breakpoint type (git-fixes).\n- perf/ring_buffer: Allow the EPOLLRDNORM flag for poll (git-fixes).\n- perf/x86/amd: Warn only on new bits set (git-fixes).\n- perf/x86/intel/ds: Unconditionally drain PEBS DS when changing PEBS_DATA_CFG (git-fixes).\n- perf/x86/intel/pt: Fix sampling synchronization (git-fixes).\n- perf/x86/intel/uncore: Fix the scale of IIO free running counters on ICX (git-fixes).\n- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR (git-fixes).\n- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SPR (git-fixes).\n- perf/x86/intel: Allow to setup LBR for counting event for BPF (git-fixes).\n- perf/x86/intel: Allow to update user space GPRs from PEBS records (git-fixes).\n- perf/x86/intel: Apply static call for drain_pebs (git-fixes).\n- perf/x86/intel: Avoid disable PMU if !cpuc-\u003eenabled in sample read (git-fixes).\n- perf/x86/intel: Fix crash in icl_update_topdown_event() (git-fixes).\n- perf/x86/intel: Only check the group flag for X86 leader (git-fixes).\n- perf/x86/intel: Use better start period for frequency mode (git-fixes).\n- perf/x86: Fix low freqency setting issue (git-fixes).\n- perf/x86: Fix non-sampling (counting) events on certain x86 platforms (git-fixes).\n- perf: Ensure bpf_perf_link path is properly serialized (git-fixes).\n- perf: Extract a few helpers (git-fixes).\n- perf: Fix cgroup state vs ERROR (git-fixes).\n- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (git-fixes).\n- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (git-fixes).\n- phy: cdns-dphy: Store hs_clk_rate and return it (stable-fixes).\n- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (stable-fixes).\n- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (stable-fixes).\n- powerpc/boot: Fix build with gcc 15 (bsc#1215199).\n- powerpc/kvm: Fix ifdef to remove build warning (bsc#1215199).\n- powerpc/powernv/pci: Fix underflow and leak issue (bsc#1215199).\n- powerpc/pseries/msi: Fix potential underflow and leak issue (bsc#1215199).\n- powerpc: export MIN RMA size (bsc#1236743 ltc#211409).\n- powerpc: floppy: Add missing checks after DMA map (bsc#1215199).\n- powerpc: increase MIN RMA size for CAS negotiation (bsc#1236743 ltc#211409 bsc#1252269 ltc#215957).\n- proc: fix missing pde_set_flags() for net proc files (bsc#1248630)\n- proc: fix type confusion in pde_set_flags() (bsc#1248630)\n- r8152: add error handling in rtl8152_driver_init (git-fixes).\n- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (git-fixes).\n- regmap: slimbus: fix bus_context pointer in regmap init calls (git-fixes).\n- regulator: bd718x7: Fix voltages scaled by resistor divider (git-fixes).\n- rpm/check-for-config-changes: ignore CONFIG_SCHED_PROXY_EXEC, too (bsc#1250946).\n- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (stable-fixes).\n- rtc: interface: Fix long-standing race when setting alarm (stable-fixes).\n- rtc: optee: fix memory leak on driver removal (git-fixes).\n- rtc: x1205: Fix Xicor X1205 vendor prefix (git-fixes).\n- s390: Initialize psw mask in perf_arch_fetch_caller_regs() (git-fixes).\n- samples/bpf: Fix compilation failure for samples/bpf on LoongArch Fedora (git-fixes).\n- sched/fair: set_load_weight() must also call reweight_task() (git-fixes)\n- sched/idle: Conditionally handle tick broadcast in default_idle_call() (bsc#1248517).\n- selftests/bpf: Add test for unpinning htab with internal timer struct (git-fixes).\n- selftests/bpf: Fix C++ compile error from missing _Bool type (git-fixes).\n- selftests/bpf: Fix a fd leak in error paths in open_netns (git-fixes).\n- selftests/bpf: Fix backtrace printing for selftests crashes (git-fixes).\n- selftests/bpf: Fix compile error from rlim_t in sk_storage_map.c (git-fixes).\n- selftests/bpf: Fix compile if backtrace support missing in libc (git-fixes).\n- selftests/bpf: Fix compiling core_reloc.c with musl-libc (git-fixes).\n- selftests/bpf: Fix compiling flow_dissector.c with musl-libc (git-fixes).\n- selftests/bpf: Fix compiling kfree_skb.c with musl-libc (git-fixes).\n- selftests/bpf: Fix compiling parse_tcp_hdr_opt.c with musl-libc (git-fixes).\n- selftests/bpf: Fix compiling tcp_rtt.c with musl-libc (git-fixes).\n- selftests/bpf: Fix cross-compiling urandom_read (git-fixes).\n- selftests/bpf: Fix error compiling bpf_iter_setsockopt.c with musl libc (git-fixes).\n- selftests/bpf: Fix error compiling tc_redirect.c with musl libc (git-fixes).\n- selftests/bpf: Fix error compiling test_lru_map.c (git-fixes).\n- selftests/bpf: Fix errors compiling cg_storage_multi.h with musl libc (git-fixes).\n- selftests/bpf: Fix errors compiling decap_sanity.c with musl libc (git-fixes).\n- selftests/bpf: Fix errors compiling lwt_redirect.c with musl libc (git-fixes).\n- selftests/bpf: Fix redefinition errors compiling lwt_reroute.c (git-fixes).\n- selftests/bpf: Fix umount cgroup2 error in test_sockmap (git-fixes).\n- selftests/bpf: Use bpf_link__destroy in fill_link_info tests (git-fixes).\n- selftests/tracing: Fix event filter test to retry up to 10 times (git-fixes).\n- selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (git-fixes).\n- serial: 8250_dw: handle reset control deassert error (git-fixes).\n- skmsg: Return copied bytes in sk_msg_memcopy_from_iter (bsc#1250650).\n- smb: client: fix crypto buffers in non-linear memory (bsc#1250491, boo#1239206).\n- smb: client: fix potential cfid UAF in smb2_query_info_compound (bsc#1248886).\n- spi: spi-nxp-fspi: add extra delay after dll locked (git-fixes).\n- staging: axis-fifo: fix TX handling on copy_from_user() failure (git-fixes).\n- staging: axis-fifo: fix maximum TX packet length check (git-fixes).\n- staging: axis-fifo: flush RX FIFO on read errors (git-fixes).\n- sunrpc: fix null pointer dereference on zero-length checksum (git-fixes).\n- tcp: Do not call reqsk_fastopen_remove() in tcp_conn_request() (git-fixes).\n- tcp_bpf: Fix copied value in tcp_bpf_sendmsg (bsc#1250650).\n- tools/resolve_btfids: Fix build when cross compiling kernel with clang (git-fixes).\n- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (git-fixes).\n- tracing/selftests: Fix kprobe event name test for .isra. functions (git-fixes).\n- tracing: Correct the refcount if the hist/hist_debug file fails to open (git-fixes).\n- tracing: Fix filter string testing (git-fixes).\n- tracing: Remove unneeded goto out logic (bsc#1249286).\n- udf: Make sure i_lenExtents is uptodate on inode eviction (git-fixes).\n- udf: Verify partition map count (git-fixes).\n- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (git-fixes).\n- usb: hub: Fix flushing of delayed work used for post resume purposes (git-fixes).\n- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (git-fixes).\n- usb: phy: twl6030: Fix incorrect type for ret (git-fixes).\n- usb: xhci: Avoid queuing redundant Stop Endpoint commands (git-fixes).\n- usb: xhci: Limit Stop Endpoint retries (git-fixes).\n- usb: xhci: Limit Stop Endpoint retries (git-fixes).\n- usbnet: Fix using smp_processor_id() in preemptible code warnings (git-fixes).\n- usbnet: Prevents free active kevent (git-fixes).\n- wifi: ath10k: Fix memory leak on unsupported WMI command (git-fixes).\n- wifi: ath11k: Add missing platform IDs for quirk table (git-fixes).\n- wifi: ath12k: free skb during idr cleanup callback (git-fixes).\n- wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (git-fixes).\n- wifi: mac80211: reset FILS discovery and unsol probe resp intervals (git-fixes).\n- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (stable-fixes).\n- wifi: rtlwifi: rtl8192cu: Do not claim USB ID 07b8:8188 (stable-fixes).\n- x86/idle: Sanitize X86_BUG_AMD_E400 handling (bsc#1248517).\n- xfs: rename the old_crc variable in xlog_recover_process (git-fixes).\n- xhci: dbc: enable back DbC in resume if it was enabled before suspend (git-fixes).\n- xhci: retry Stop Endpoint on buggy NEC controllers (git-fixes).\n","status":"published","published":"2025-11-13T14:22:56Z","modified":"2026-03-23T04:51:09.505261Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2025:21064-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2025-38008: mm/page_alloc: fix race condition in unaccepted memory handling (bsc#1244939).\n- CVE-2025-38539: trace/fgraph: Fix the warning caused by missing unregister notifier (bsc#1248211).\n- CVE-2025-38552: mptcp: plug races between subflow fail and subflow creation (bsc#1248230).\n- CVE-2025-38653: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (bsc#1248630).\n- CVE-2025-38699: scsi: bfa: Double-free fix (bsc#1249224).\n- CVE-2025-38700: scsi: libiscsi: Initialize iscsi_conn-\u003edd_data only if memory is allocated (bsc#1249182).\n- CVE-2025-38718: sctp: linearize cloned gso packets in sctp_rcv (bsc#1249161).\n- CVE-2025-39673: ppp: fix race conditions in ppp_fill_forward_path (bsc#1249320).\n- CVE-2025-39676: scsi: qla4xxx: Prevent a potential error pointer dereference (bsc#1249302).\n- CVE-2025-39683: tracing: Limit access to parser-\u003ebuffer when trace_get_user failed (bsc#1249286).\n- CVE-2025-39697: nfs: remove dead code for the old swap over NFS implementation (bsc#1249319).\n- CVE-2025-39702: ipv6: sr: Fix MAC comparison to be constant-time (bsc#1249317).\n- CVE-2025-39756: fs: Prevent file descriptor table allocations exceeding INT_MAX (bsc#1249512).\n- CVE-2025-39794: ARM: tegra: Use I/O memcpy to write to IRAM (bsc#1249595).\n- CVE-2025-39812: sctp: initialize more fields in sctp_v6_from_sk() (bsc#1250202).\n- CVE-2025-39813: ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (bsc#1250032).\n- CVE-2025-39828: atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control() (bsc#1250205).\n- CVE-2025-39851: vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (bsc#1250296).\n- CVE-2025-39866: fs: writeback: fix use-after-free in __mark_inode_dirty() (bsc#1250455).\n- CVE-2025-39876: net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (bsc#1250400).\n- CVE-2025-39881: kernfs: Fix UAF in polling when open file is released (bsc#1250379).\n- CVE-2025-39895: sched: Fix sched_numa_find_nth_cpu() if mask offline (bsc#1250721).\n- CVE-2025-39898: e1000e: fix heap overflow in e1000_set_eeprom (bsc#1250742).\n- CVE-2025-39902: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (bsc#1250702).\n- CVE-2025-39911: i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (bsc#1250704).\n- CVE-2025-39945: cnic: Fix use-after-free bugs in cnic_delete_task (bsc#1251230).\n- CVE-2025-39946: tls: make sure to abort the stream if headers are bogus (bsc#1251114).\n- CVE-2025-39947: net/mlx5e: Harden uplink netdev access against device unbind (bsc#1251232).\n- CVE-2025-39948: ice: fix Rx page leak on multi-buffer frames (bsc#1251233).\n- CVE-2025-39949: qed: Don't collect too many protection override GRC elements (bsc#1251177).\n- CVE-2025-39955: tcp: Clear tcp_sk(sk)-\u003efastopen_rsk in tcp_disconnect() (bsc#1251804).\n- CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).\n- CVE-2025-39969: i40e: fix validation of VF state in get resources (bsc#1252044).\n- CVE-2025-39970: i40e: fix input validation logic for action_meta (bsc#1252051).\n- CVE-2025-39971: i40e: fix idx validation in config queues msg (bsc#1252052).\n- CVE-2025-39972: i40e: fix idx validation in i40e_validate_queue_map (bsc#1252039).\n- CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252035).\n- CVE-2025-39978: octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (bsc#1252069).\n- CVE-2025-40000: wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (bsc#1252062).\n- CVE-2025-40005: spi: cadence-quadspi: Implement refcount to handle unbind during busy (bsc#1252349).\n- CVE-2025-40018: ipvs: Defer ip_vs_ftp unregister during netns cleanup (bsc#1252688).\n- CVE-2025-40051: vhost: vringh: Modify the return value check (bsc#1252858).\n- CVE-2025-40056: vhost: vringh: Fix copy_to_iter return value check (bsc#1252826).\n- CVE-2025-40060: coresight: trbe: Return NULL pointer for allocation failures (bsc#1252848).\n- CVE-2025-40078: bpf: Explicitly check accesses to bpf_sock_addr (bsc#1252789).\n- CVE-2025-40080: nbd: restrict sockets to TCP and UDP (bsc#1252774).\n- CVE-2025-40100: btrfs: do not assert we found block group item when creating free space tree (bsc#1252918).\n\nThe following non-security bugs were fixed:\n\n- ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path (stable-fixes).\n- ACPI: battery: Add synchronization between interface updates (git-fixes).\n- ACPI: battery: Check for error code from devm_mutex_init() call (git-fixes).\n- ACPI: battery: allocate driver data through devm_ APIs (stable-fixes).\n- ACPI: battery: initialize mutexes through devm_ APIs (stable-fixes).\n- ACPI: button: Call input_free_device() on failing input device registration (git-fixes).\n- ACPI: property: Add code comments explaining what is going on (stable-fixes).\n- ACPI: property: Disregard references in data-only subnode lists (stable-fixes).\n- ACPI: property: Do not pass NULL handles to acpi_attach_data() (stable-fixes git-fixes).\n- ACPI: video: Fix use-after-free in acpi_video_switch_brightness() (git-fixes).\n- ACPI: x86: Move acpi_quirk_skip_serdev_enumeration() out of CONFIG_X86_ANDROID_TABLETS (stable-fixes).\n- ACPICA: Allow to skip Global Lock initialization (stable-fixes).\n- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (git-fixes).\n- ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (git-fixes).\n- ALSA: usb-audio: fix control pipe direction (git-fixes).\n- ASoC: Intel: avs: Unprepare a stream when XRUN occurs (git-fixes).\n- ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (git-fixes).\n- ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (git-fixes).\n- ASoC: amd: acp: Adjust pdm gain value (stable-fixes).\n- ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (git-fixes).\n- ASoC: fsl_sai: fix bit order for DSD format (git-fixes).\n- ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (git-fixes).\n- ASoC: nau8821: Cancel jdet_work before handling jack ejection (git-fixes).\n- ASoC: nau8821: Generalize helper to clear IRQ status (git-fixes).\n- ASoC: qdsp6: q6asm: do not sleep while atomic (git-fixes).\n- ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue (stable-fixes).\n- Bluetooth: btmtksdio: Add pmctrl handling for BT closed state during reset (git-fixes).\n- Bluetooth: btusb: Add USB ID 2001:332a for D-Link AX9U rev. A1 (stable-fixes).\n- Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (git-fixes).\n- HID: hid-input: only ignore 0 battery events for digitizers (git-fixes).\n- HID: multitouch: fix name of Stylus input devices (git-fixes).\n- Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (git-fixes).\n- KVM: PPC: Fix misleading interrupts comment in kvmppc_prepare_to_enter() (bsc#1215199).\n- KVM: SEV: Read save fields from GHCB exactly once (git-fixes).\n- KVM: SEV: Rename kvm_ghcb_get_sw_exit_code() to kvm_get_cached_sw_exit_code() (git-fixes).\n- KVM: SEV: Validate XCR0 provided by guest in GHCB (git-fixes).\n- KVM: SVM: Inject #GP if memory operand for INVPCID is non-canonical (git-fixes).\n- KVM: SVM: Pass through GHCB MSR if and only if VM is an SEV-ES guest (git-fixes).\n- KVM: SVM: Set RFLAGS.IF=1 in C code, to get VMRUN out of the STI shadow (git-fixes).\n- KVM: x86/mmu: Prevent installing hugepages when mem attributes are changing (git-fixes).\n- KVM: x86: Bypass register cache when querying CPL from kvm_sched_out() (git-fixes).\n- KVM: x86: Clear pv_unhalted on all transitions to KVM_MP_STATE_RUNNABLE (git-fixes).\n- KVM: x86: Do not bleed PVCLOCK_GUEST_STOPPED across PV clocks (git-fixes).\n- KVM: x86: Do not inject PV async #PF if SEND_ALWAYS=0 and guest state is protected (git-fixes).\n- KVM: x86: Introduce kvm_set_mp_state() (git-fixes).\n- KVM: x86: Introduce kvm_x86_call() to simplify static calls of kvm_x86_ops (git-fixes).\n- KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update() (git-fixes).\n- KVM: x86: Process \"guest stopped request\" once per guest time update (git-fixes).\n- KVM: x86: Replace static_call_cond() with static_call() (git-fixes).\n- KVM: x86: Set PVCLOCK_GUEST_STOPPED only for kvmclock, not for Xen PV clock (git-fixes).\n- KVM: x86: Snapshot the host's DEBUGCTL after disabling IRQs (git-fixes).\n- KVM: x86: Snapshot the host's DEBUGCTL in common x86 (git-fixes).\n- KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer (git-fixes).\n- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (git-fixes).\n- NFSD: Fix crash in nfsd4_read_release() (git-fixes).\n- NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul() (git-fixes).\n- NFSD: Minor cleanup in layoutcommit processing (git-fixes).\n- NFSD: Rework encoding and decoding of nfsd4_deviceid (git-fixes).\n- PCI/AER: Support errors introduced by PCIe r6.0 (stable-fixes).\n- PCI: Add PCI_VDEVICE_SUB helper macro (stable-fixes).\n- PCI: endpoint: Remove surplus return statement from pci_epf_test_clean_dma_chan() (stable-fixes).\n- PCI: endpoint: pci-epf-test: Add NULL check for DMA channels before release (git-fixes).\n- PCI: j721e: Enable ACSPCIE Refclk if \"ti,syscon-acspcie-proxy-ctrl\" exists (stable-fixes).\n- PCI: j721e: Fix programming sequence of \"strap\" settings (git-fixes).\n- PM: runtime: Add new devm functions (stable-fixes).\n- Revert \"KVM: VMX: Move LOAD_IA32_PERF_GLOBAL_CTRL errata handling out of setup_vmcs_config()\" (git-fixes).\n- USB: serial: option: add SIMCom 8230C compositions (git-fixes).\n- USB: serial: option: add SIMCom 8230C compositions (stable-fixes).\n- accel/ivpu: Add missing MODULE_FIRMWARE metadata (git-fixes).\n- accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages() (git-fixes).\n- add bug reference to existing hv_netvsc change (bsc#1252265)\n- arm64, mm: avoid always making PTE dirty in pte_mkwrite() (git-fixes)\n- arm64: cputype: Add Neoverse-V3AE definitions (git-fixes)\n- arm64: errata: Apply workarounds for Neoverse-V3AE (git-fixes)\n- arm64: mte: Do not flag the zero page as PG_mte_tagged (git-fixes)\n- bpf: Allow helper bpf_get_[ns_]current_pid_tgid() for all prog types (bsc#1252364).\n- bpf: Avoid RCU context warning when unpinning htab with internal structs (git-fixes).\n- bpf: Check link_create.flags parameter for multi_kprobe (git-fixes).\n- bpf: Check link_create.flags parameter for multi_uprobe (git-fixes).\n- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} (git-fixes).\n- bpf: Use preempt_count() directly in bpf_send_signal_common() (git-fixes).\n- btrfs: avoid potential out-of-bounds in btrfs_encode_fh() (git-fixes).\n- btrfs: fix clearing of BTRFS_FS_RELOC_RUNNING if relocation already running (git-fixes).\n- btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range() (git-fixes).\n- can: bxcan: bxcan_start_xmit(): use can_dev_dropped_skb() instead of can_dropped_invalid_skb() (git-fixes).\n- can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled (stable-fixes).\n- can: netlink: can_changelink(): allow disabling of automatic restart (git-fixes).\n- can: rcar_canfd: Fix controller mode setting (stable-fixes).\n- clk: at91: peripheral: fix return value (git-fixes).\n- clk: mediatek: clk-mux: Do not pass flags to clk_mux_determine_rate_flags() (git-fixes).\n- clk: mediatek: mt8195-infra_ao: Fix parent for infra_ao_hdmi_26m (git-fixes).\n- clk: tegra: do not overallocate memory for bpmp clocks (git-fixes).\n- cpufreq: CPPC: fix perf_to_khz/khz_to_perf conversion exception (git-fixes).\n- cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() (stable-fixes git-fixes).\n- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (stable-fixes git-fixes).\n- cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus() (git-fixes).\n- cpufreq: scmi: Skip SCMI devices that are not used by the CPUs (stable-fixes).\n- cpufreq: tegra186: Set target frequency for all cpus in policy (git-fixes).\n- cpuidle: governors: menu: Avoid using invalid recent intervals data (git-fixes).\n- cpuidle: menu: Avoid discarding useful information (stable-fixes).\n- cpuidle: qcom-spm: fix device and OF node leaks at probe (git-fixes).\n- crypto: essiv - Check ssize for decryption and in-place encryption (git-fixes).\n- crypto: rng - Ensure set_ent is always present (git-fixes).\n- driver core/PM: Set power.no_callbacks along with power.no_pm (stable-fixes).\n- drivers/perf: arm_spe: Use perf_allow_kernel() for permissions (git-fixes).\n- drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs (git-fixes).\n- drm/amd/display: Disable scaling on DCE6 for now (git-fixes).\n- drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6 (git-fixes).\n- drm/amd/display: Properly disable scaling on DCE6 (git-fixes).\n- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji (git-fixes).\n- drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland (git-fixes).\n- drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (git-fixes).\n- drm/amd/powerplay: Fix CIK shutdown temperature (git-fixes).\n- drm/amd: Check whether secure display TA loaded successfully (stable-fixes).\n- drm/amdgpu: Add additional DCE6 SCL registers (git-fixes).\n- drm/amdgpu: use atomic functions with memory barriers for vm fault info (git-fixes).\n- drm/bridge: lt9211: Drop check for last nibble of version register (git-fixes).\n- drm/etnaviv: fix flush sequence logic (git-fixes).\n- drm/exynos: exynos7_drm_decon: fix uninitialized crtc reference in functions (stable-fixes).\n- drm/exynos: exynos7_drm_decon: properly clear channels during bind (stable-fixes).\n- drm/i915/guc: Skip communication warning on reset in progress (git-fixes).\n- drm/mediatek: Fix device use-after-free on unbind (git-fixes).\n- drm/msm/a6xx: Fix GMU firmware parser (git-fixes).\n- drm/msm/adreno: De-spaghettify the use of memory barriers (stable-fixes).\n- drm/msm/dpu: Fix pixel extension sub-sampling (git-fixes).\n- drm/nouveau: fix bad ret code in nouveau_bo_move_prep (git-fixes).\n- drm/panel: kingdisplay-kd097d04: Disable EoTp (git-fixes).\n- drm/panel: sitronix-st7789v: fix sync flags for t28cp45tn89 (git-fixes).\n- drm/rockchip: vop2: use correct destination rectangle height check (git-fixes).\n- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (git-fixes).\n- drm/vmwgfx: Fix Use-after-free in validation (git-fixes).\n- drm/vmwgfx: Fix a null-ptr access in the cursor snooper (git-fixes).\n- drm/vmwgfx: Fix copy-paste typo in validation (git-fixes).\n- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (git-fixes).\n- ext4: check fast symlink for ea_inode correctly (git-fixes).\n- ext4: do not convert the unwritten extents if data writeback fails (git-fixes).\n- ext4: do not try to clear the orphan_present feature block device is r/o (git-fixes).\n- ext4: ensure i_size is smaller than maxbytes (git-fixes).\n- ext4: factor out ext4_get_maxbytes() (git-fixes).\n- ext4: fix calculation of credits for extent tree modification (git-fixes).\n- ext4: fix checks for orphan inodes (bsc#1250119).\n- ext4: fix fsmap end of range reporting with bigalloc (git-fixes).\n- ext4: fix hole length calculation overflow in non-extent inodes (git-fixes).\n- ext4: fix largest free orders lists corruption on mb_optimize_scan switch (git-fixes).\n- ext4: fix reserved gdt blocks handling in fsmap (git-fixes).\n- ext4: fix zombie groups in average fragment size lists (git-fixes).\n- ext4: preserve SB_I_VERSION on remount (git-fixes).\n- ext4: reorder capability check last (git-fixes).\n- fbdev: Fix logic error in \"offb\" name match (git-fixes).\n- fbdev: atyfb: Check if pll_ops-\u003einit_pll failed (git-fixes).\n- fbdev: valkyriefb: Fix reference count leak in valkyriefb_init (git-fixes).\n- firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode (git-fixes).\n- fs: udf: fix OOB read in lengthAllocDescs handling (git-fixes).\n- ftrace: fix incorrect hash size in register_ftrace_direct() (git-fixes).\n- gpio: wcd934x: mark the GPIO controller as sleeping (git-fixes).\n- hfs: validate record offset in hfsplus_bmap_alloc (git-fixes).\n- hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() (git-fixes).\n- hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (git-fixes).\n- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (git-fixes).\n- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (git-fixes).\n- hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() (git-fixes).\n- hid: fix I2C read buffer overflow in raw_event() for mcp2221 (stable-fixes).\n- i2c: ocores: use devm_ managed clks (git-fixes).\n- iomap: Fix iomap_adjust_read_range for plen calculation (git-fixes).\n- iomap: handle a post-direct I/O invalidate race in iomap_write_delalloc_release (git-fixes).\n- iommu/vt-d: Disallow dirty tracking if incoherent page walk (git-fixes).\n- iommu/vt-d: PRS isn't usable if PDS isn't supported (git-fixes).\n- isofs: Verify inode mode when loading from disk (git-fixes).\n- jbd2: do not try to recover wiped journal (git-fixes).\n- kABI fix for KVM: x86: Snapshot the host's DEBUGCTL in common x86 (git-fixes).\n- kdb: Replace deprecated strcpy() with memmove() in vkdb_printf() (bsc#1252939).\n- kernel-subpackage-spec: Do not doubly-sign modules (bsc#1251930).\n- lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older (stable-fixes).\n- locking/mutex: Introduce devm_mutex_init() (stable-fixes).\n- locking/mutex: Mark devm_mutex_init() as __must_check (stable-fixes).\n- mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop (git-fixes).\n- mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes (git-fixes).\n- mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call (git-fixes).\n- media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe (git-fixes).\n- media: nxp: imx8-isi: Drop unused argument to mxc_isi_channel_chain() (stable-fixes).\n- media: solo6x10: replace max(a, min(b, c)) by clamp(b, a, c) (git-fixes).\n- media: tuner: xc5000: Fix use-after-free in xc5000_release (git-fixes).\n- media: tunner: xc5000: Refactor firmware load (stable-fixes).\n- mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type (stable-fixes).\n- mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value (stable-fixes).\n- mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag (git-fixes).\n- misc: fastrpc: Add missing dev_err newlines (stable-fixes).\n- misc: fastrpc: Fix dma_buf object leak in fastrpc_map_lookup (git-fixes).\n- misc: fastrpc: Fix fastrpc_map_lookup operation (git-fixes).\n- misc: fastrpc: Save actual DMA size in fastrpc_map structure (git-fixes).\n- misc: fastrpc: Skip reference for DMA handles (git-fixes).\n- misc: fastrpc: fix possible map leak in fastrpc_put_args (git-fixes).\n- mmc: core: SPI mode remove cmd7 (stable-fixes).\n- most: usb: Fix use-after-free in hdm_disconnect (git-fixes).\n- most: usb: hdm_probe: Fix calling put_device() before device initialization (git-fixes).\n- mtd: rawnand: fsmc: Default to autodetect buswidth (stable-fixes).\n- net: mana: Use page pool fragments for RX buffers instead of full pages to improve memory efficiency (bsc#1248754).\n- net: phy: dp83869: fix STRAP_OPMODE bitmask (git-fixes).\n- net: sysfs: Fix /sys/class/net/\u0026lt;iface\u003e path (git-fixes).\n- net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock (git-fixes).\n- net: usb: asix_devices: Check return value of usbnet_get_endpoints (git-fixes).\n- net: usb: lan78xx: Add error handling to lan78xx_init_mac_address (git-fixes).\n- net: usb: lan78xx: fix use of improperly initialized dev-\u003echipid in lan78xx_reset (git-fixes).\n- net: usb: rtl8150: Fix frame padding (git-fixes).\n- netfilter: nft_objref: validate objref and objrefmap expressions (bsc#1250237).\n- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (git-fixes).\n- nvme-multipath: Skip nr_active increments in RETRY disposition (git-fixes).\n- nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk (git-fixes).\n- nvme/tcp: handle tls partially sent records in write_space() (git-fixes).\n- overlayfs: set ctime when setting mtime and atime (stable-fixes).\n- ovl: Always reevaluate the file signature for IMA (stable-fixes).\n- ovl: fix file reference leak when submitting aio (stable-fixes).\n- ovl: fix incorrect fdput() on aio completion (stable-fixes).\n- perf/amd/ibs: Fix -\u003econfig to sample period calculation for OP PMU (git-fixes).\n- perf/amd/ibs: Fix perf_ibs_op.cnt_mask for CurCnt (git-fixes).\n- perf/amd: Prevent grouping of IBS events (git-fixes).\n- perf/aux: Fix pending disable flow when the AUX ring buffer overruns (git-fixes).\n- perf/bpf: Robustify perf_event_free_bpf_prog() (git-fixes).\n- perf/core: Fix WARN in perf_cgroup_switch() (git-fixes).\n- perf/core: Fix broken throttling when max_samples_per_tick=1 (git-fixes).\n- perf/core: Fix child_total_time_enabled accounting bug at task exit (git-fixes).\n- perf/core: Fix low freq setting via IOC_PERIOD (git-fixes).\n- perf/core: Fix pmus_lock vs. pmus_srcu ordering (git-fixes).\n- perf/core: Fix small negative period being ignored (git-fixes).\n- perf/core: Fix the WARN_ON_ONCE is out of lock protected region (git-fixes).\n- perf/hw_breakpoint: Return EOPNOTSUPP for unsupported breakpoint type (git-fixes).\n- perf/ring_buffer: Allow the EPOLLRDNORM flag for poll (git-fixes).\n- perf/x86/amd: Warn only on new bits set (git-fixes).\n- perf/x86/intel/ds: Unconditionally drain PEBS DS when changing PEBS_DATA_CFG (git-fixes).\n- perf/x86/intel/pt: Fix sampling synchronization (git-fixes).\n- perf/x86/intel/uncore: Fix the scale of IIO free running counters on ICX (git-fixes).\n- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR (git-fixes).\n- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SPR (git-fixes).\n- perf/x86/intel: Allow to setup LBR for counting event for BPF (git-fixes).\n- perf/x86/intel: Allow to update user space GPRs from PEBS records (git-fixes).\n- perf/x86/intel: Apply static call for drain_pebs (git-fixes).\n- perf/x86/intel: Avoid disable PMU if !cpuc-\u003eenabled in sample read (git-fixes).\n- perf/x86/intel: Fix crash in icl_update_topdown_event() (git-fixes).\n- perf/x86/intel: Only check the group flag for X86 leader (git-fixes).\n- perf/x86/intel: Use better start period for frequency mode (git-fixes).\n- perf/x86: Fix low freqency setting issue (git-fixes).\n- perf/x86: Fix non-sampling (counting) events on certain x86 platforms (git-fixes).\n- perf: Ensure bpf_perf_link path is properly serialized (git-fixes).\n- perf: Extract a few helpers (git-fixes).\n- perf: Fix cgroup state vs ERROR (git-fixes).\n- phy: cadence: cdns-dphy: Fix PLL lock and O_CMN_READY polling (git-fixes).\n- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (git-fixes).\n- phy: cdns-dphy: Store hs_clk_rate and return it (stable-fixes).\n- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (stable-fixes).\n- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (stable-fixes).\n- powerpc/boot: Fix build with gcc 15 (bsc#1215199).\n- powerpc/kvm: Fix ifdef to remove build warning (bsc#1215199).\n- powerpc/powernv/pci: Fix underflow and leak issue (bsc#1215199).\n- powerpc/pseries/msi: Fix potential underflow and leak issue (bsc#1215199).\n- powerpc: export MIN RMA size (bsc#1236743 ltc#211409).\n- powerpc: floppy: Add missing checks after DMA map (bsc#1215199).\n- powerpc: increase MIN RMA size for CAS negotiation (bsc#1236743 ltc#211409 bsc#1252269 ltc#215957).\n- proc: fix missing pde_set_flags() for net proc files (bsc#1248630)\n- proc: fix type confusion in pde_set_flags() (bsc#1248630)\n- r8152: add error handling in rtl8152_driver_init (git-fixes).\n- r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (git-fixes).\n- regmap: slimbus: fix bus_context pointer in regmap init calls (git-fixes).\n- regulator: bd718x7: Fix voltages scaled by resistor divider (git-fixes).\n- rpm/check-for-config-changes: ignore CONFIG_SCHED_PROXY_EXEC, too (bsc#1250946).\n- rtc: interface: Ensure alarm irq is enabled when UIE is enabled (stable-fixes).\n- rtc: interface: Fix long-standing race when setting alarm (stable-fixes).\n- rtc: optee: fix memory leak on driver removal (git-fixes).\n- rtc: x1205: Fix Xicor X1205 vendor prefix (git-fixes).\n- s390: Initialize psw mask in perf_arch_fetch_caller_regs() (git-fixes).\n- samples/bpf: Fix compilation failure for samples/bpf on LoongArch Fedora (git-fixes).\n- sched/fair: set_load_weight() must also call reweight_task() (git-fixes)\n- sched/idle: Conditionally handle tick broadcast in default_idle_call() (bsc#1248517).\n- selftests/bpf: Add test for unpinning htab with internal timer struct (git-fixes).\n- selftests/bpf: Fix C++ compile error from missing _Bool type (git-fixes).\n- selftests/bpf: Fix a fd leak in error paths in open_netns (git-fixes).\n- selftests/bpf: Fix backtrace printing for selftests crashes (git-fixes).\n- selftests/bpf: Fix compile error from rlim_t in sk_storage_map.c (git-fixes).\n- selftests/bpf: Fix compile if backtrace support missing in libc (git-fixes).\n- selftests/bpf: Fix compiling core_reloc.c with musl-libc (git-fixes).\n- selftests/bpf: Fix compiling flow_dissector.c with musl-libc (git-fixes).\n- selftests/bpf: Fix compiling kfree_skb.c with musl-libc (git-fixes).\n- selftests/bpf: Fix compiling parse_tcp_hdr_opt.c with musl-libc (git-fixes).\n- selftests/bpf: Fix compiling tcp_rtt.c with musl-libc (git-fixes).\n- selftests/bpf: Fix cross-compiling urandom_read (git-fixes).\n- selftests/bpf: Fix error compiling bpf_iter_setsockopt.c with musl libc (git-fixes).\n- selftests/bpf: Fix error compiling tc_redirect.c with musl libc (git-fixes).\n- selftests/bpf: Fix error compiling test_lru_map.c (git-fixes).\n- selftests/bpf: Fix errors compiling cg_storage_multi.h with musl libc (git-fixes).\n- selftests/bpf: Fix errors compiling decap_sanity.c with musl libc (git-fixes).\n- selftests/bpf: Fix errors compiling lwt_redirect.c with musl libc (git-fixes).\n- selftests/bpf: Fix redefinition errors compiling lwt_reroute.c (git-fixes).\n- selftests/bpf: Fix umount cgroup2 error in test_sockmap (git-fixes).\n- selftests/bpf: Use bpf_link__destroy in fill_link_info tests (git-fixes).\n- selftests/tracing: Fix event filter test to retry up to 10 times (git-fixes).\n- selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (git-fixes).\n- serial: 8250_dw: handle reset control deassert error (git-fixes).\n- serial: jsm: fix NPE during jsm_uart_port_init (git fixes, bsc#1246244).\n- skmsg: Return copied bytes in sk_msg_memcopy_from_iter (bsc#1250650).\n- smb: client: fix crypto buffers in non-linear memory (bsc#1250491, boo#1239206).\n- smb: client: fix potential cfid UAF in smb2_query_info_compound (bsc#1248886).\n- spi: spi-nxp-fspi: add extra delay after dll locked (git-fixes).\n- staging: axis-fifo: fix TX handling on copy_from_user() failure (git-fixes).\n- staging: axis-fifo: fix maximum TX packet length check (git-fixes).\n- staging: axis-fifo: flush RX FIFO on read errors (git-fixes).\n- sunrpc: fix null pointer dereference on zero-length checksum (git-fixes).\n- tcp: Do not call reqsk_fastopen_remove() in tcp_conn_request() (git-fixes).\n- tcp_bpf: Fix copied value in tcp_bpf_sendmsg (bsc#1250650).\n- tools/resolve_btfids: Fix build when cross compiling kernel with clang (git-fixes).\n- tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single (git-fixes).\n- tracing/selftests: Fix kprobe event name test for .isra. functions (git-fixes).\n- tracing: Correct the refcount if the hist/hist_debug file fails to open (git-fixes).\n- tracing: Fix filter string testing (git-fixes).\n- tracing: Remove unneeded goto out logic (bsc#1249286).\n- udf: Make sure i_lenExtents is uptodate on inode eviction (git-fixes).\n- udf: Verify partition map count (git-fixes).\n- usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm (git-fixes).\n- usb: hub: Fix flushing of delayed work used for post resume purposes (git-fixes).\n- usb: hub: fix detection of high tier USB3 devices behind suspended hubs (git-fixes).\n- usb: phy: twl6030: Fix incorrect type for ret (git-fixes).\n- usb: xhci: Avoid queuing redundant Stop Endpoint commands (git-fixes).\n- usb: xhci: Limit Stop Endpoint retries (git-fixes).\n- usbnet: Fix using smp_processor_id() in preemptible code warnings (git-fixes).\n- usbnet: Prevents free active kevent (git-fixes).\n- wifi: ath10k: Fix memory leak on unsupported WMI command (git-fixes).\n- wifi: ath11k: Add missing platform IDs for quirk table (git-fixes).\n- wifi: ath12k: free skb during idr cleanup callback (git-fixes).\n- wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode (git-fixes).\n- wifi: mac80211: reset FILS discovery and unsol probe resp intervals (git-fixes).\n- wifi: mt76: mt7921u: Add VID/PID for Netgear A7500 (stable-fixes).\n- wifi: rtlwifi: rtl8192cu: Do not claim USB ID 07b8:8188 (stable-fixes).\n- x86/idle: Sanitize X86_BUG_AMD_E400 handling (bsc#1248517).\n- xfs: rename the old_crc variable in xlog_recover_process (git-fixes).\n- xhci: dbc: enable back DbC in resume if it was enabled before suspend (git-fixes).\n- xhci: retry Stop Endpoint on buggy NEC controllers (git-fixes).\n","status":"published","published":"2025-11-25T16:39:37Z","modified":"2026-03-23T04:49:14.886014Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2025:21080-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2025-21816: hrtimers: Force migrate away hrtimers queued after (bsc#1238472).\n- CVE-2025-38653: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (bsc#1248630).\n- CVE-2025-38718: sctp: linearize cloned gso packets in sctp_rcv (bsc#1249161).\n- CVE-2025-39676: scsi: qla4xxx: Prevent a potential error pointer dereference (bsc#1249302).\n- CVE-2025-39702: ipv6: sr: Fix MAC comparison to be constant-time (bsc#1249317).\n- CVE-2025-39756: fs: Prevent file descriptor table allocations exceeding INT_MAX (bsc#1249512).\n- CVE-2025-39779: btrfs: subpage: keep TOWRITE tag until folio is cleaned (bsc#1249495).\n- CVE-2025-39812: sctp: initialize more fields in sctp_v6_from_sk() (bsc#1250202).\n- CVE-2025-39866: fs: writeback: fix use-after-free in __mark_inode_dirty() (bsc#1250455).\n- CVE-2025-39876: net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (bsc#1250400).\n- CVE-2025-39881: kernfs: Fix UAF in polling when open file is released (bsc#1250379).\n- CVE-2025-39895: sched: Fix sched_numa_find_nth_cpu() if mask offline (bsc#1250721).\n- CVE-2025-39903: of_numa: fix uninitialized memory nodes causing kernel panic (bsc#1250749).\n- CVE-2025-39911: i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (bsc#1250704).\n- CVE-2025-39947: net/mlx5e: Harden uplink netdev access against device unbind (bsc#1251232).\n- CVE-2025-39948: ice: fix Rx page leak on multi-buffer frames (bsc#1251233).\n- CVE-2025-39949: qed: Don't collect too many protection override GRC elements (bsc#1251177).\n- CVE-2025-39950: net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (bsc#1251176).\n- CVE-2025-39955: tcp: Clear tcp_sk(sk)-\u003efastopen_rsk in tcp_disconnect() (bsc#1251804).\n- CVE-2025-39956: igc: don't fail igc_probe() on LED setup error (bsc#1251809).\n- CVE-2025-39963: io_uring: fix incorrect io_kiocb reference in io_link_skb (bsc#1251819).\n- CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).\n- CVE-2025-39969: i40e: fix validation of VF state in get resources (bsc#1252044).\n- CVE-2025-39970: i40e: fix input validation logic for action_meta (bsc#1252051).\n- CVE-2025-39971: i40e: fix idx validation in config queues msg (bsc#1252052).\n- CVE-2025-39972: i40e: fix idx validation in i40e_validate_queue_map (bsc#1252039).\n- CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252035).\n- CVE-2025-39978: octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (bsc#1252069).\n- CVE-2025-39979: net/mlx5: fs, add API for sharing HWS action by refcount (bsc#1252067).\n- CVE-2025-39984: net: tun: Update napi-\u003eskb after XDP process (bsc#1252081).\n- CVE-2025-39992: mm: swap: check for stable address space before operating on the VMA (bsc#1252076).\n- CVE-2025-40000: wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (bsc#1252062).\n- CVE-2025-40005: spi: cadence-quadspi: Implement refcount to handle unbind during busy (bsc#1252349).\n- CVE-2025-40012: net/smc: fix warning in smc_rx_splice() when calling get_page() (bsc#1252330).\n- CVE-2025-40018: ipvs: Defer ip_vs_ftp unregister during netns cleanup (bsc#1252688).\n- CVE-2025-40040: mm/ksm: fix flag-dropping behavior in ksm_madvise (bsc#1252780).\n- CVE-2025-40051: vhost: vringh: Modify the return value check (bsc#1252858).\n- CVE-2025-40056: vhost: vringh: Fix copy_to_iter return value check (bsc#1252826).\n- CVE-2025-40060: coresight: trbe: Return NULL pointer for allocation failures (bsc#1252848).\n- CVE-2025-40078: bpf: Explicitly check accesses to bpf_sock_addr (bsc#1252789).\n- CVE-2025-40080: nbd: restrict sockets to TCP and UDP (bsc#1252774).\n- CVE-2025-40100: btrfs: do not assert we found block group item when creating free space tree (bsc#1252918).\n\nThe following non security issues were fixed:\n\n- add bug reference to existing hv_netvsc change (bsc#1252265)\n- amd-pstate-ut: Reset amd-pstate driver mode after running selftests (bsc#1249226).\n- cgroup/cpuset: Remove remote_partition_check() \u0026 make update_cpumasks_hier() handle remote partition (bsc#1241166).\n- cpuset: Use new excpus for nocpu error check when enabling root partition (bsc#1241166).\n- cpuset: fix failure to enable isolated partition when containing isolcpus (bsc#1241166).\n- doc/README.SUSE: Correct the character used for TAINT_NO_SUPPORT\n  The character was previously 'N', but upstream used it for TAINT_TEST,\n  which prompted the change of TAINT_NO_SUPPORT to 'n'.\n- dpll: zl3073x: Add firmware loading functionality (bsc#1252253).\n- dpll: zl3073x: Add functions to access hardware registers (bsc#1252253).\n- dpll: zl3073x: Add low-level flash functions (bsc#1252253).\n- dpll: zl3073x: Add support to get fractional frequency offset (bsc#1252253).\n- dpll: zl3073x: Add support to get phase offset on connected input pin (bsc#1252253).\n- dpll: zl3073x: Add support to get/set esync on pins (bsc#1252253).\n- dpll: zl3073x: Fix double free in zl3073x_devlink_flash_update() (bsc#1252253).\n- dpll: zl3073x: Handle missing or corrupted flash configuration (bsc#1252253).\n- dpll: zl3073x: Implement devlink flash callback (bsc#1252253).\n- dpll: zl3073x: Increase maximum size of flash utility (bsc#1252253).\n- dpll: zl3073x: Refactor DPLL initialization (bsc#1252253).\n- drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (git-fixes).\n- drm/xe/guc: Prepare GuC register list and update ADS size for error capture (stable-fixes).\n- ixgbe: handle IXGBE_VF_FEATURES_NEGOTIATE mbox cmd (bsc#1247222).\n- ixgbe: handle IXGBE_VF_GET_PF_LINK_STATE mailbox operation (bsc#1247222).\n- ixgbevf: fix getting link speed data for E610 devices (bsc#1247222).\n- ixgbevf: fix mailbox API compatibility by negotiating supported features (bsc#1247222).\n- kbuild/modfinal: Link livepatches with module-common.o (bsc#1218644, bsc#1252270).\n- kdb: Replace deprecated strcpy() with memmove() in vkdb_printf() (bsc#1252939).\n- kernel-subpackage-spec: Do not doubly-sign modules (bsc#1251930).\n- nvme-auth: update sc_c in host response (git-fixes bsc#1249397).\n- perf hwmon_pmu: Fix uninitialized variable warning (perf-sle16-v6.13-userspace-update, git-fixes).\n- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (git-fixes).\n- powerpc/fadump: skip parameter area allocation when fadump is disabled (jsc#PED-9891 git-fixes).\n- proc: fix missing pde_set_flags() for net proc files (bsc#1248630)\n- proc: fix type confusion in pde_set_flags() (bsc#1248630)\n- rpm/check-for-config-changes: ignore CONFIG_SCHED_PROXY_EXEC, too (bsc#1250946)\n- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (bsc#1252267).\n- x86/microcode/AMD: Limit Entrysign signature checking to known generations (bsc#1252725).\n- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (bsc#1252734).\n- x86/resctrl: Refactor resctrl_arch_rmid_read() (bsc#1252734).\n- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (jsc#PED-348).\n","status":"published","published":"2025-11-26T15:59:00Z","modified":"2026-03-23T04:51:10.586527Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2025:21147-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2025-21816: hrtimers: Force migrate away hrtimers queued after (bsc#1238472).\n- CVE-2025-38653: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (bsc#1248630).\n- CVE-2025-38718: sctp: linearize cloned gso packets in sctp_rcv (bsc#1249161).\n- CVE-2025-39676: scsi: qla4xxx: Prevent a potential error pointer dereference (bsc#1249302).\n- CVE-2025-39702: ipv6: sr: Fix MAC comparison to be constant-time (bsc#1249317).\n- CVE-2025-39756: fs: Prevent file descriptor table allocations exceeding INT_MAX (bsc#1249512).\n- CVE-2025-39779: btrfs: subpage: keep TOWRITE tag until folio is cleaned (bsc#1249495).\n- CVE-2025-39812: sctp: initialize more fields in sctp_v6_from_sk() (bsc#1250202).\n- CVE-2025-39866: fs: writeback: fix use-after-free in __mark_inode_dirty() (bsc#1250455).\n- CVE-2025-39876: net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (bsc#1250400).\n- CVE-2025-39881: kernfs: Fix UAF in polling when open file is released (bsc#1250379).\n- CVE-2025-39895: sched: Fix sched_numa_find_nth_cpu() if mask offline (bsc#1250721).\n- CVE-2025-39903: of_numa: fix uninitialized memory nodes causing kernel panic (bsc#1250749).\n- CVE-2025-39911: i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (bsc#1250704).\n- CVE-2025-39947: net/mlx5e: Harden uplink netdev access against device unbind (bsc#1251232).\n- CVE-2025-39948: ice: fix Rx page leak on multi-buffer frames (bsc#1251233).\n- CVE-2025-39949: qed: Don't collect too many protection override GRC elements (bsc#1251177).\n- CVE-2025-39950: net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (bsc#1251176).\n- CVE-2025-39955: tcp: Clear tcp_sk(sk)-\u003efastopen_rsk in tcp_disconnect() (bsc#1251804).\n- CVE-2025-39956: igc: don't fail igc_probe() on LED setup error (bsc#1251809).\n- CVE-2025-39963: io_uring: fix incorrect io_kiocb reference in io_link_skb (bsc#1251819).\n- CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).\n- CVE-2025-39969: i40e: fix validation of VF state in get resources (bsc#1252044).\n- CVE-2025-39970: i40e: fix input validation logic for action_meta (bsc#1252051).\n- CVE-2025-39971: i40e: fix idx validation in config queues msg (bsc#1252052).\n- CVE-2025-39972: i40e: fix idx validation in i40e_validate_queue_map (bsc#1252039).\n- CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252035).\n- CVE-2025-39978: octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (bsc#1252069).\n- CVE-2025-39979: net/mlx5: fs, add API for sharing HWS action by refcount (bsc#1252067).\n- CVE-2025-39984: net: tun: Update napi-\u003eskb after XDP process (bsc#1252081).\n- CVE-2025-39992: mm: swap: check for stable address space before operating on the VMA (bsc#1252076).\n- CVE-2025-40000: wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (bsc#1252062).\n- CVE-2025-40005: spi: cadence-quadspi: Implement refcount to handle unbind during busy (bsc#1252349).\n- CVE-2025-40012: net/smc: fix warning in smc_rx_splice() when calling get_page() (bsc#1252330).\n- CVE-2025-40018: ipvs: Defer ip_vs_ftp unregister during netns cleanup (bsc#1252688).\n- CVE-2025-40040: mm/ksm: fix flag-dropping behavior in ksm_madvise (bsc#1252780).\n- CVE-2025-40051: vhost: vringh: Modify the return value check (bsc#1252858).\n- CVE-2025-40056: vhost: vringh: Fix copy_to_iter return value check (bsc#1252826).\n- CVE-2025-40060: coresight: trbe: Return NULL pointer for allocation failures (bsc#1252848).\n- CVE-2025-40078: bpf: Explicitly check accesses to bpf_sock_addr (bsc#1252789).\n- CVE-2025-40080: nbd: restrict sockets to TCP and UDP (bsc#1252774).\n- CVE-2025-40100: btrfs: do not assert we found block group item when creating free space tree (bsc#1252918).\n\nThe following non security issues were fixed:\n\n- add bug reference to existing hv_netvsc change (bsc#1252265)\n- amd-pstate-ut: Reset amd-pstate driver mode after running selftests (bsc#1249226).\n- cgroup/cpuset: Remove remote_partition_check() \u0026 make update_cpumasks_hier() handle remote partition (bsc#1241166).\n- cpuset: Use new excpus for nocpu error check when enabling root partition (bsc#1241166).\n- cpuset: fix failure to enable isolated partition when containing isolcpus (bsc#1241166).\n- doc/README.SUSE: Correct the character used for TAINT_NO_SUPPORT\n  The character was previously 'N', but upstream used it for TAINT_TEST,\n  which prompted the change of TAINT_NO_SUPPORT to 'n'.\n- dpll: zl3073x: Add firmware loading functionality (bsc#1252253).\n- dpll: zl3073x: Add functions to access hardware registers (bsc#1252253).\n- dpll: zl3073x: Add low-level flash functions (bsc#1252253).\n- dpll: zl3073x: Add support to get fractional frequency offset (bsc#1252253).\n- dpll: zl3073x: Add support to get phase offset on connected input pin (bsc#1252253).\n- dpll: zl3073x: Add support to get/set esync on pins (bsc#1252253).\n- dpll: zl3073x: Fix double free in zl3073x_devlink_flash_update() (bsc#1252253).\n- dpll: zl3073x: Handle missing or corrupted flash configuration (bsc#1252253).\n- dpll: zl3073x: Implement devlink flash callback (bsc#1252253).\n- dpll: zl3073x: Increase maximum size of flash utility (bsc#1252253).\n- dpll: zl3073x: Refactor DPLL initialization (bsc#1252253).\n- drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (git-fixes).\n- drm/xe/guc: Prepare GuC register list and update ADS size for error capture (stable-fixes).\n- ixgbe: handle IXGBE_VF_FEATURES_NEGOTIATE mbox cmd (bsc#1247222).\n- ixgbe: handle IXGBE_VF_GET_PF_LINK_STATE mailbox operation (bsc#1247222).\n- ixgbevf: fix getting link speed data for E610 devices (bsc#1247222).\n- ixgbevf: fix mailbox API compatibility by negotiating supported features (bsc#1247222).\n- kbuild/modfinal: Link livepatches with module-common.o (bsc#1218644, bsc#1252270).\n- kdb: Replace deprecated strcpy() with memmove() in vkdb_printf() (bsc#1252939).\n- kernel-subpackage-spec: Do not doubly-sign modules (bsc#1251930).\n- nvme-auth: update sc_c in host response (git-fixes bsc#1249397).\n- perf hwmon_pmu: Fix uninitialized variable warning (perf-sle16-v6.13-userspace-update, git-fixes).\n- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (git-fixes).\n- powerpc/fadump: skip parameter area allocation when fadump is disabled (jsc#PED-9891 git-fixes).\n- proc: fix missing pde_set_flags() for net proc files (bsc#1248630)\n- proc: fix type confusion in pde_set_flags() (bsc#1248630)\n- rpm/check-for-config-changes: ignore CONFIG_SCHED_PROXY_EXEC, too (bsc#1250946)\n- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (bsc#1252267).\n- x86/microcode/AMD: Limit Entrysign signature checking to known generations (bsc#1252725).\n- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (bsc#1252734).\n- x86/resctrl: Refactor resctrl_arch_rmid_read() (bsc#1252734).\n- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (jsc#PED-348).\n","status":"published","published":"2025-11-26T15:59:00Z","modified":"2026-03-23T04:51:14.374541Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2025:21180-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2025-21816: hrtimers: Force migrate away hrtimers queued after (bsc#1238472).\n- CVE-2025-38653: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (bsc#1248630).\n- CVE-2025-38718: sctp: linearize cloned gso packets in sctp_rcv (bsc#1249161).\n- CVE-2025-39676: scsi: qla4xxx: Prevent a potential error pointer dereference (bsc#1249302).\n- CVE-2025-39702: ipv6: sr: Fix MAC comparison to be constant-time (bsc#1249317).\n- CVE-2025-39756: fs: Prevent file descriptor table allocations exceeding INT_MAX (bsc#1249512).\n- CVE-2025-39779: btrfs: subpage: keep TOWRITE tag until folio is cleaned (bsc#1249495).\n- CVE-2025-39812: sctp: initialize more fields in sctp_v6_from_sk() (bsc#1250202).\n- CVE-2025-39866: fs: writeback: fix use-after-free in __mark_inode_dirty() (bsc#1250455).\n- CVE-2025-39876: net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (bsc#1250400).\n- CVE-2025-39881: kernfs: Fix UAF in polling when open file is released (bsc#1250379).\n- CVE-2025-39895: sched: Fix sched_numa_find_nth_cpu() if mask offline (bsc#1250721).\n- CVE-2025-39903: of_numa: fix uninitialized memory nodes causing kernel panic (bsc#1250749).\n- CVE-2025-39911: i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (bsc#1250704).\n- CVE-2025-39947: net/mlx5e: Harden uplink netdev access against device unbind (bsc#1251232).\n- CVE-2025-39948: ice: fix Rx page leak on multi-buffer frames (bsc#1251233).\n- CVE-2025-39949: qed: Don't collect too many protection override GRC elements (bsc#1251177).\n- CVE-2025-39950: net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (bsc#1251176).\n- CVE-2025-39955: tcp: Clear tcp_sk(sk)-\u003efastopen_rsk in tcp_disconnect() (bsc#1251804).\n- CVE-2025-39956: igc: don't fail igc_probe() on LED setup error (bsc#1251809).\n- CVE-2025-39963: io_uring: fix incorrect io_kiocb reference in io_link_skb (bsc#1251819).\n- CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).\n- CVE-2025-39969: i40e: fix validation of VF state in get resources (bsc#1252044).\n- CVE-2025-39970: i40e: fix input validation logic for action_meta (bsc#1252051).\n- CVE-2025-39971: i40e: fix idx validation in config queues msg (bsc#1252052).\n- CVE-2025-39972: i40e: fix idx validation in i40e_validate_queue_map (bsc#1252039).\n- CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252035).\n- CVE-2025-39978: octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (bsc#1252069).\n- CVE-2025-39979: net/mlx5: fs, add API for sharing HWS action by refcount (bsc#1252067).\n- CVE-2025-39984: net: tun: Update napi-\u003eskb after XDP process (bsc#1252081).\n- CVE-2025-39992: mm: swap: check for stable address space before operating on the VMA (bsc#1252076).\n- CVE-2025-40000: wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (bsc#1252062).\n- CVE-2025-40005: spi: cadence-quadspi: Implement refcount to handle unbind during busy (bsc#1252349).\n- CVE-2025-40012: net/smc: fix warning in smc_rx_splice() when calling get_page() (bsc#1252330).\n- CVE-2025-40018: ipvs: Defer ip_vs_ftp unregister during netns cleanup (bsc#1252688).\n- CVE-2025-40040: mm/ksm: fix flag-dropping behavior in ksm_madvise (bsc#1252780).\n- CVE-2025-40051: vhost: vringh: Modify the return value check (bsc#1252858).\n- CVE-2025-40056: vhost: vringh: Fix copy_to_iter return value check (bsc#1252826).\n- CVE-2025-40060: coresight: trbe: Return NULL pointer for allocation failures (bsc#1252848).\n- CVE-2025-40078: bpf: Explicitly check accesses to bpf_sock_addr (bsc#1252789).\n- CVE-2025-40080: nbd: restrict sockets to TCP and UDP (bsc#1252774).\n- CVE-2025-40100: btrfs: do not assert we found block group item when creating free space tree (bsc#1252918).\n\nThe following non security issues were fixed:\n\n- add bug reference to existing hv_netvsc change (bsc#1252265)\n- amd-pstate-ut: Reset amd-pstate driver mode after running selftests (bsc#1249226).\n- cgroup/cpuset: Remove remote_partition_check() \u0026 make update_cpumasks_hier() handle remote partition (bsc#1241166).\n- cpuset: Use new excpus for nocpu error check when enabling root partition (bsc#1241166).\n- cpuset: fix failure to enable isolated partition when containing isolcpus (bsc#1241166).\n- doc/README.SUSE: Correct the character used for TAINT_NO_SUPPORT\n  The character was previously 'N', but upstream used it for TAINT_TEST,\n  which prompted the change of TAINT_NO_SUPPORT to 'n'.\n- dpll: zl3073x: Add firmware loading functionality (bsc#1252253).\n- dpll: zl3073x: Add functions to access hardware registers (bsc#1252253).\n- dpll: zl3073x: Add low-level flash functions (bsc#1252253).\n- dpll: zl3073x: Add support to get fractional frequency offset (bsc#1252253).\n- dpll: zl3073x: Add support to get phase offset on connected input pin (bsc#1252253).\n- dpll: zl3073x: Add support to get/set esync on pins (bsc#1252253).\n- dpll: zl3073x: Fix double free in zl3073x_devlink_flash_update() (bsc#1252253).\n- dpll: zl3073x: Handle missing or corrupted flash configuration (bsc#1252253).\n- dpll: zl3073x: Implement devlink flash callback (bsc#1252253).\n- dpll: zl3073x: Increase maximum size of flash utility (bsc#1252253).\n- dpll: zl3073x: Refactor DPLL initialization (bsc#1252253).\n- drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (git-fixes).\n- drm/xe/guc: Prepare GuC register list and update ADS size for error capture (stable-fixes).\n- ixgbe: handle IXGBE_VF_FEATURES_NEGOTIATE mbox cmd (bsc#1247222).\n- ixgbe: handle IXGBE_VF_GET_PF_LINK_STATE mailbox operation (bsc#1247222).\n- ixgbevf: fix getting link speed data for E610 devices (bsc#1247222).\n- ixgbevf: fix mailbox API compatibility by negotiating supported features (bsc#1247222).\n- kbuild/modfinal: Link livepatches with module-common.o (bsc#1218644, bsc#1252270).\n- kdb: Replace deprecated strcpy() with memmove() in vkdb_printf() (bsc#1252939).\n- kernel-subpackage-spec: Do not doubly-sign modules (bsc#1251930).\n- nvme-auth: update sc_c in host response (git-fixes bsc#1249397).\n- perf hwmon_pmu: Fix uninitialized variable warning (perf-sle16-v6.13-userspace-update, git-fixes).\n- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (git-fixes).\n- powerpc/fadump: skip parameter area allocation when fadump is disabled (jsc#PED-9891 git-fixes).\n- proc: fix missing pde_set_flags() for net proc files (bsc#1248630)\n- proc: fix type confusion in pde_set_flags() (bsc#1248630)\n- rpm/check-for-config-changes: ignore CONFIG_SCHED_PROXY_EXEC, too (bsc#1250946)\n- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (bsc#1252267).\n- x86/microcode/AMD: Limit Entrysign signature checking to known generations (bsc#1252725).\n- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (bsc#1252734).\n- x86/resctrl: Refactor resctrl_arch_rmid_read() (bsc#1252734).\n- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (jsc#PED-348).\n","status":"published","published":"2025-11-26T15:35:38Z","modified":"2026-03-23T04:49:17.772412Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2025:4057-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2025-38008: mm/page_alloc: fix race condition in unaccepted memory handling (bsc#1244939).\n- CVE-2025-38539: trace/fgraph: Fix the warning caused by missing unregister notifier (bsc#1248211).\n- CVE-2025-38552: mptcp: plug races between subflow fail and subflow creation (bsc#1248230).\n- CVE-2025-38653: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (bsc#1248630).\n- CVE-2025-38699: scsi: bfa: Double-free fix (bsc#1249224).\n- CVE-2025-38700: scsi: libiscsi: Initialize iscsi_conn-\u003edd_data only if memory is allocated (bsc#1249182).\n- CVE-2025-38718: sctp: linearize cloned gso packets in sctp_rcv (bsc#1249161).\n- CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).\n- CVE-2025-38735: gve: prevent ethtool ops after shutdown (bsc#1249288).\n- CVE-2025-39673: ppp: fix race conditions in ppp_fill_forward_path (bsc#1249320).\n- CVE-2025-39676: scsi: qla4xxx: Prevent a potential error pointer dereference (bsc#1249302).\n- CVE-2025-39683: tracing: Limit access to parser-\u003ebuffer when trace_get_user failed (bsc#1249286).\n- CVE-2025-39697: nfs: remove dead code for the old swap over NFS implementation (bsc#1249319).\n- CVE-2025-39702: ipv6: sr: Fix MAC comparison to be constant-time (bsc#1249317).\n- CVE-2025-39756: fs: Prevent file descriptor table allocations exceeding INT_MAX (bsc#1249512).\n- CVE-2025-39794: ARM: tegra: Use I/O memcpy to write to IRAM (bsc#1249595).\n- CVE-2025-39810: bnxt_en: Fix memory corruption when FW resources change during ifdown (bsc#1249975).\n- CVE-2025-39812: sctp: initialize more fields in sctp_v6_from_sk() (bsc#1250202).\n- CVE-2025-39813: ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (bsc#1250032).\n- CVE-2025-39828: atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control() (bsc#1250205).\n- CVE-2025-39832: net/mlx5: Add sync reset drop mode support (bsc#1249901).\n- CVE-2025-39847: ppp: fix memory leak in pad_compress_skb (bsc#1250292).\n- CVE-2025-39850: vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (bsc#1250276).\n- CVE-2025-39851: vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (bsc#1250296).\n- CVE-2025-39853: i40e: Fix potential invalid access when MAC list is empty (bsc#1250275).\n- CVE-2025-39854: ice: fix NULL access of tx-\u003ein_use in ice_ll_ts_intr (bsc#1250297).\n- CVE-2025-39866: fs: writeback: fix use-after-free in __mark_inode_dirty() (bsc#1250455).\n- CVE-2025-39876: net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (bsc#1250400).\n- CVE-2025-39881: kernfs: Fix UAF in polling when open file is released (bsc#1250379).\n- CVE-2025-39895: sched: Fix sched_numa_find_nth_cpu() if mask offline (bsc#1250721).\n- CVE-2025-39898: e1000e: fix heap overflow in e1000_set_eeprom (bsc#1250742).\n- CVE-2025-39900: net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (bsc#1250758).\n- CVE-2025-39902: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (bsc#1250702).\n- CVE-2025-39911: i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (bsc#1250704).\n- CVE-2025-39945: cnic: Fix use-after-free bugs in cnic_delete_task (bsc#1251230).\n- CVE-2025-39946: tls: make sure to abort the stream if headers are bogus (bsc#1251114).\n- CVE-2025-39947: net/mlx5e: Harden uplink netdev access against device unbind (bsc#1251232).\n- CVE-2025-39948: ice: fix Rx page leak on multi-buffer frames (bsc#1251233).\n- CVE-2025-39949: qed: Don't collect too many protection override GRC elements (bsc#1251177).\n- CVE-2025-39955: tcp: Clear tcp_sk(sk)-\u003efastopen_rsk in tcp_disconnect() (bsc#1251804).\n- CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).\n- CVE-2025-39969: i40e: fix validation of VF state in get resources (bsc#1252044).\n- CVE-2025-39970: i40e: fix input validation logic for action_meta (bsc#1252051).\n- CVE-2025-39971: i40e: fix idx validation in config queues msg (bsc#1252052).\n- CVE-2025-39972: i40e: fix idx validation in i40e_validate_queue_map (bsc#1252039).\n- CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252035).\n- CVE-2025-39978: octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (bsc#1252069).\n- CVE-2025-39984: net: tun: Update napi-\u003eskb after XDP process (bsc#1252081).\n- CVE-2025-40000: wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (bsc#1252062).\n- CVE-2025-40005: spi: cadence-quadspi: Implement refcount to handle unbind during busy (bsc#1252349).\n- CVE-2025-40012: net/smc: fix warning in smc_rx_splice() when calling get_page() (bsc#1252330).\n- CVE-2025-40018: ipvs: Defer ip_vs_ftp unregister during netns cleanup (bsc#1252688).\n- CVE-2025-40051: vhost: vringh: Modify the return value check (bsc#1252858).\n- CVE-2025-40056: vhost: vringh: Fix copy_to_iter return value check (bsc#1252826).\n- CVE-2025-40060: coresight: trbe: Return NULL pointer for allocation failures (bsc#1252848).\n- CVE-2025-40078: bpf: Explicitly check accesses to bpf_sock_addr (bsc#1252789).\n- CVE-2025-40100: btrfs: do not assert we found block group item when creating free space tree (bsc#1252918).\n\nThe following non security issues were fixed:\n\n- ACPI/processor_idle: Add FFH state handling (jsc#PED-13815).\n- ACPI/processor_idle: Export acpi_processor_ffh_play_dead() (jsc#PED-13815).\n- ACPI: battery: Add synchronization between interface updates (git-fixes).\n- ACPI: processor: Rescan 'dead' SMT siblings during initialization (jsc#PED-13815).\n- KVM: PPC: Fix misleading interrupts comment in kvmppc_prepare_to_enter() (bsc#1215199).\n- KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update() (git-fixes).\n- KVM: x86: Process 'guest stopped request' once per guest time update (git-fixes).\n- PM: hibernate: Add pm_hibernation_mode_is_suspend() (bsc#1243112).\n- PM: hibernate: Add stub for pm_hibernate_is_recovering() (bsc#1243112).\n- PM: hibernate: Fix pm_hibernation_mode_is_suspend() build breakage (bsc#1243112).\n- PM: hibernate: add new api pm_hibernate_is_recovering() (bsc#1243112).\n- bpf: Allow helper bpf_get_[ns_]current_pid_tgid() for all prog types (bsc#1252364).\n- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (stable-fixes git-fixes).\n- cpuidle: Do not return from cpuidle_play_dead() on callback failures (jsc#PED-13815).\n- dpll: Make ZL3073X invisible (bsc#1252253).\n- dpll: zl3073x: Add firmware loading functionality (bsc#1252253).\n- dpll: zl3073x: Add functions to access hardware registers (bsc#1252253).\n- dpll: zl3073x: Add low-level flash functions (bsc#1252253).\n- dpll: zl3073x: Add support to get fractional frequency offset (bsc#1252253).\n- dpll: zl3073x: Add support to get phase offset on connected input pin (bsc#1252253).\n- dpll: zl3073x: Add support to get/set esync on pins (bsc#1252253).\n- dpll: zl3073x: Fix build failure (bsc#1252253).\n- dpll: zl3073x: Fix double free in zl3073x_devlink_flash_update() (bsc#1252253).\n- dpll: zl3073x: Handle missing or corrupted flash configuration (bsc#1252253).\n- dpll: zl3073x: Implement devlink flash callback (bsc#1252253).\n- dpll: zl3073x: Increase maximum size of flash utility (bsc#1252253).\n- dpll: zl3073x: Refactor DPLL initialization (bsc#1252253).\n- dpll: zl3073x: ZL3073X_I2C and ZL3073X_SPI should depend on NET (bsc#1252253).\n- drm/amd : Update MES API header file for v11 \u0026 v12 (stable-fixes).\n- drm/amd/amdgpu: Implement MES suspend/resume gang functionality for v12 (bsc#1243112).\n- drm/amd/display: Add NULL check for stream before dereference in 'dm_vupdate_high_irq' (bsc#1243112).\n- drm/amd/display: Enable Dynamic DTBCLK Switch (bsc#1243112).\n- drm/amd/display: Fix vupdate_offload_work doc (bsc#1243112).\n- drm/amd/display: fix dmub access race condition (bsc#1243112).\n- drm/amd/display: more liberal vmin/vmax update for freesync (bsc#1243112).\n- drm/amd/include : MES v11 and v12 API header update (stable-fixes).\n- drm/amd/include : Update MES v12 API for fence update (stable-fixes).\n- drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (git-fixes).\n- drm/amd: Avoid evicting resources at S5 (bsc#1243112).\n- drm/amd: Check whether secure display TA loaded successfully (bsc#1243112).\n- drm/amd: Fix hybrid sleep (bsc#1243112).\n- drm/amd: Only restore cached manual clock settings in restore if OD enabled (bsc#1243112).\n- drm/amd: Restore cached manual clock settings during resume (bsc#1243112).\n- drm/amdgpu/mes11: implement detect and reset callback (bsc#1243112).\n- drm/amdgpu/mes12: implement detect and reset callback (bsc#1243112).\n- drm/amdgpu/mes: add front end for detect and reset hung queue (bsc#1243112).\n- drm/amdgpu/vpe: cancel delayed work in hw_fini (bsc#1243112).\n- drm/amdgpu: Avoid rma causes GPU duplicate reset (bsc#1243112).\n- drm/amdgpu: Fix for GPU reset being blocked by KIQ I/O (bsc#1243112).\n- drm/amdgpu: Report individual reset error (bsc#1243112).\n- drm/amdgpu: do not resume device in thaw for normal hibernation (bsc#1243112).\n- drm/amdgpu: fix link error for !PM_SLEEP (bsc#1243112).\n- drm/amdkfd: Fix mmap write lock not release (bsc#1243112).\n- drm/xe/guc: Prepare GuC register list and update ADS size for error capture (stable-fixes).\n- ext4: fix checks for orphan inodes (bsc#1250119).\n- hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (git-fixes).\n- intel_idle: Provide the default enter_dead() handler (jsc#PED-13815).\n- intel_idle: Rescan 'dead' SMT siblings during initialization (jsc#PED-13815).\n- intel_idle: Use subsys_initcall_sync() for initialization (jsc#PED-13815).\n- ixgbe: handle IXGBE_VF_FEATURES_NEGOTIATE mbox cmd (bsc#1247222).\n- ixgbe: handle IXGBE_VF_GET_PF_LINK_STATE mailbox operation (bsc#1247222).\n- ixgbevf: fix getting link speed data for E610 devices (bsc#1247222).\n- ixgbevf: fix mailbox API compatibility by negotiating supported features (bsc#1247222).\n- kdb: Replace deprecated strcpy() with memmove() in vkdb_printf() (bsc#1252939).\n- net: mana: Use page pool fragments for RX buffers instead of full pages to improve memory efficiency (bsc#1248754).\n- netfilter: nft_objref: validate objref and objrefmap expressions (bsc#1250237).\n- nvme-auth: update bi_directional flag (git-fixes bsc#1249735).\n- nvme-auth: update sc_c in host response (git-fixes bsc#1249397).\n- nvme-fc: use lock accessing port_state and rport state (bsc#1245193 bsc#1247500).\n- nvme-tcp: send only permitted commands for secure concat (git-fixes bsc#1247683).\n- nvmet-fc: avoid scheduling association deletion twice (bsc#1245193 bsc#1247500).\n- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (bsc#1245193 bsc#1247500).\n- nvmet-fcloop: call done callback even when remote port is gone (bsc#1245193 bsc#1247500).\n- perf/x86/intel: Allow to update user space GPRs from PEBS records (git-fixes).\n- perf/x86/intel: Fix crash in icl_update_topdown_event() (git-fixes).\n- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (git-fixes).\n- platform/x86/amd/pmc: Add 1Ah family series to STB support list (bsc#1243112).\n- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (bsc#1243112).\n- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (bsc#1243112).\n- platform/x86/amd/pmc: Add VPE information for AMDI000A platform (bsc#1243112).\n- platform/x86/amd/pmc: Add idlemask support for 1Ah family (bsc#1243112).\n- platform/x86/amd/pmc: Extend support for PMC features on new AMD platform (bsc#1243112).\n- platform/x86/amd/pmc: Fix SMU command submission path on new AMD platform (bsc#1243112).\n- platform/x86/amd/pmc: Modify SMU message port for latest AMD platform (bsc#1243112).\n- platform/x86/amd/pmc: Notify user when platform does not support s0ix transition (bsc#1243112).\n- platform/x86/amd/pmc: Remove unnecessary line breaks (bsc#1243112).\n- platform/x86/amd/pmc: Send OS_HINT command for AMDI000A platform (bsc#1243112).\n- platform/x86/amd/pmc: Send OS_HINT command for new AMD platform (bsc#1243112).\n- platform/x86/amd/pmc: Update IP information structure for newer SoCs (bsc#1243112).\n- platform/x86/amd/pmc: Use ARRAY_SIZE() to fill num_ips information (bsc#1243112).\n- platform/x86/amd/pmc: call amd_pmc_get_ip_info() during driver probe (bsc#1243112).\n- platform/x86/amd: pmc: Add new ACPI ID AMDI000B (bsc#1243112).\n- platform/x86/amd: pmc: Drop SMU F/W match for Cezanne (bsc#1243112).\n- platform/x86/amd: pmc: Use guard(mutex) (bsc#1243112).\n- powerpc/boot: Fix build with gcc 15 (bsc#1215199).\n- powerpc/fadump: skip parameter area allocation when fadump is disabled (jsc#PED-9891 git-fixes).\n- powerpc/kvm: Fix ifdef to remove build warning (bsc#1215199).\n- powerpc/powernv/pci: Fix underflow and leak issue (bsc#1215199).\n- powerpc/pseries/msi: Fix potential underflow and leak issue (bsc#1215199).\n- powerpc: floppy: Add missing checks after DMA map (bsc#1215199).\n- proc: fix missing pde_set_flags() for net proc files (bsc#1248630)\n- proc: fix type confusion in pde_set_flags() (bsc#1248630)\n- sched/idle: Conditionally handle tick broadcast in default_idle_call() (bsc#1248517).\n- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (bsc#1250519).\n- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (bsc#1250519).\n- scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET (bsc#1250519).\n- scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail (bsc#1250519).\n- scsi: lpfc: Copyright updates for 14.4.0.11 patches (bsc#1250519).\n- scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted (bsc#1250519).\n- scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology (bsc#1250519).\n- scsi: lpfc: Fix buffer free/clear order in deferred receive path (bsc#1250519).\n- scsi: lpfc: Fix wrong function reference in a comment (bsc#1250519).\n- scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup (bsc#1250519).\n- scsi: lpfc: Remove redundant assignment to avoid memory leak (bsc#1250519).\n- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (bsc#1250519).\n- scsi: lpfc: Update lpfc version to 14.4.0.11 (bsc#1250519).\n- scsi: lpfc: Use int type to store negative error codes (bsc#1250519).\n- scsi: lpfc: use min() to improve code (bsc#1250519).\n- serial: sc16is7xx: rename Kconfig CONFIG_SERIAL_SC16IS7XX_CORE (bsc#1252469) Re-enable CONFIG_SERIAL_SC16IS7X for aarch64 and x86_64 default configurations, but keep it disabled for kvmsmall configurations. For ppc64 and s390x drivers was not enabled, so keep it that way. Add sc16is7xx_spi and sc16is7xx_i2c drivers to supported list.\n- skmsg: Return copied bytes in sk_msg_memcopy_from_iter (bsc#1250650).\n- smb: client: fix crypto buffers in non-linear memory (bsc#1250491, bsc#1239206).\n- smb: client: fix potential cfid UAF in smb2_query_info_compound (bsc#1248886).\n- tcp_bpf: Fix copied value in tcp_bpf_sendmsg (bsc#1250650).\n- tracing: Remove unneeded goto out logic (bsc#1249286).\n- x86/idle: Sanitize X86_BUG_AMD_E400 handling (bsc#1248517).\n- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (bsc#1252734).\n- x86/resctrl: Refactor resctrl_arch_rmid_read() (bsc#1252734).\n- x86/smp: Allow calling mwait_play_dead with an arbitrary hint (jsc#PED-13815).\n- x86/smp: Fix mwait_play_dead() and acpi_processor_ffh_play_dead() noreturn behavior (jsc#PED-13815).\n- x86/smp: PM/hibernate: Split arch_resume_nosmt() (jsc#PED-13815).\n- x86/topology: Implement topology_is_core_online() to address SMT regression (jsc#PED-13815).\n","status":"published","published":"2025-11-11T18:36:09Z","modified":"2026-02-04T02:23:19.824916Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2025:4128-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP6 Azure kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2025-38008: mm/page_alloc: fix race condition in unaccepted memory handling (bsc#1244939).\n- CVE-2025-38539: trace/fgraph: Fix the warning caused by missing unregister notifier (bsc#1248211).\n- CVE-2025-38552: mptcp: plug races between subflow fail and subflow creation (bsc#1248230).\n- CVE-2025-38653: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (bsc#1248630).\n- CVE-2025-38699: scsi: bfa: Double-free fix (bsc#1249224).\n- CVE-2025-38700: scsi: libiscsi: Initialize iscsi_conn-\u003edd_data only if memory is allocated (bsc#1249182).\n- CVE-2025-38718: sctp: linearize cloned gso packets in sctp_rcv (bsc#1249161).\n- CVE-2025-39673: ppp: fix race conditions in ppp_fill_forward_path (bsc#1249320).\n- CVE-2025-39676: scsi: qla4xxx: Prevent a potential error pointer dereference (bsc#1249302).\n- CVE-2025-39683: tracing: Limit access to parser-\u003ebuffer when trace_get_user failed (bsc#1249286).\n- CVE-2025-39697: nfs: remove dead code for the old swap over NFS implementation (bsc#1249319).\n- CVE-2025-39702: ipv6: sr: Fix MAC comparison to be constant-time (bsc#1249317).\n- CVE-2025-39756: fs: Prevent file descriptor table allocations exceeding INT_MAX (bsc#1249512).\n- CVE-2025-39794: ARM: tegra: Use I/O memcpy to write to IRAM (bsc#1249595).\n- CVE-2025-39812: sctp: initialize more fields in sctp_v6_from_sk() (bsc#1250202).\n- CVE-2025-39813: ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (bsc#1250032).\n- CVE-2025-39851: vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (bsc#1250296).\n- CVE-2025-39866: fs: writeback: fix use-after-free in __mark_inode_dirty() (bsc#1250455).\n- CVE-2025-39876: net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (bsc#1250400).\n- CVE-2025-39881: kernfs: Fix UAF in polling when open file is released (bsc#1250379).\n- CVE-2025-39895: sched: Fix sched_numa_find_nth_cpu() if mask offline (bsc#1250721).\n- CVE-2025-39902: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (bsc#1250702).\n- CVE-2025-39911: i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (bsc#1250704).\n- CVE-2025-39945: cnic: Fix use-after-free bugs in cnic_delete_task (bsc#1251230).\n- CVE-2025-39946: tls: make sure to abort the stream if headers are bogus (bsc#1251114).\n- CVE-2025-39947: net/mlx5e: Harden uplink netdev access against device unbind (bsc#1251232).\n- CVE-2025-39948: ice: fix Rx page leak on multi-buffer frames (bsc#1251233).\n- CVE-2025-39949: qed: Don't collect too many protection override GRC elements (bsc#1251177).\n- CVE-2025-39955: tcp: Clear tcp_sk(sk)-\u003efastopen_rsk in tcp_disconnect() (bsc#1251804).\n- CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).\n- CVE-2025-39969: i40e: fix validation of VF state in get resources (bsc#1252044).\n- CVE-2025-39970: i40e: fix input validation logic for action_meta (bsc#1252051).\n- CVE-2025-39971: i40e: fix idx validation in config queues msg (bsc#1252052).\n- CVE-2025-39972: i40e: fix idx validation in i40e_validate_queue_map (bsc#1252039).\n- CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252035).\n- CVE-2025-39978: octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (bsc#1252069).\n- CVE-2025-40000: wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (bsc#1252062).\n- CVE-2025-40005: spi: cadence-quadspi: Implement refcount to handle unbind during busy (bsc#1252349).\n- CVE-2025-40018: ipvs: Defer ip_vs_ftp unregister during netns cleanup (bsc#1252688).\n- CVE-2025-40051: vhost: vringh: Modify the return value check (bsc#1252858).\n- CVE-2025-40056: vhost: vringh: Fix copy_to_iter return value check (bsc#1252826).\n- CVE-2025-40060: coresight: trbe: Return NULL pointer for allocation failures (bsc#1252848).\n- CVE-2025-40078: bpf: Explicitly check accesses to bpf_sock_addr (bsc#1252789).\n- CVE-2025-40080: nbd: restrict sockets to TCP and UDP (bsc#1252774).\n- CVE-2025-40100: btrfs: do not assert we found block group item when creating free space tree (bsc#1252918).\n\nThe following non security issues were fixed:\n\n- ACPI: battery: Add synchronization between interface updates (git-fixes).\n- KVM: PPC: Fix misleading interrupts comment in kvmppc_prepare_to_enter() (bsc#1215199).\n- KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update() (git-fixes).\n- KVM: x86: Process 'guest stopped request' once per guest time update (git-fixes).\n- bpf: Allow helper bpf_get_[ns_]current_pid_tgid() for all prog types (bsc#1252364).\n- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (stable-fixes git-fixes).\n- drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (git-fixes).\n- ext4: fix checks for orphan inodes (bsc#1250119).\n- hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (git-fixes).\n- kdb: Replace deprecated strcpy() with memmove() in vkdb_printf() (bsc#1252939).\n- module: Prevent silent truncation of module name in delete_module(2) (git-fixes).\n- net: mana: Use page pool fragments for RX buffers instead of full pages to improve memory efficiency (bsc#1248754).\n- netfilter: nft_objref: validate objref and objrefmap expressions (bsc#1250237).\n- perf/x86/intel: Allow to update user space GPRs from PEBS records (git-fixes).\n- perf/x86/intel: Fix crash in icl_update_topdown_event() (git-fixes).\n- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (git-fixes).\n- powerpc/boot: Fix build with gcc 15 (bsc#1215199).\n- powerpc/kvm: Fix ifdef to remove build warning (bsc#1215199).\n- powerpc/powernv/pci: Fix underflow and leak issue (bsc#1215199).\n- powerpc/pseries/msi: Fix potential underflow and leak issue (bsc#1215199).\n- powerpc: floppy: Add missing checks after DMA map (bsc#1215199).\n- proc: fix missing pde_set_flags() for net proc files (bsc#1248630)\n- proc: fix type confusion in pde_set_flags() (bsc#1248630)\n- sched/idle: Conditionally handle tick broadcast in default_idle_call() (bsc#1248517).\n- skmsg: Return copied bytes in sk_msg_memcopy_from_iter (bsc#1250650).\n- smb: client: fix crypto buffers in non-linear memory (bsc#1250491, bsc#1239206).\n- smb: client: fix potential cfid UAF in smb2_query_info_compound (bsc#1248886).\n- tcp_bpf: Fix copied value in tcp_bpf_sendmsg (bsc#1250650).\n- tracing: Remove unneeded goto out logic (bsc#1249286).\n- x86/idle: Sanitize X86_BUG_AMD_E400 handling (bsc#1248517).\n","status":"published","published":"2025-11-18T13:51:55Z","modified":"2026-02-04T04:08:37.496065Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2025:4132-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP7 Azure kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2025-38008: mm/page_alloc: fix race condition in unaccepted memory handling (bsc#1244939).\n- CVE-2025-38539: trace/fgraph: Fix the warning caused by missing unregister notifier (bsc#1248211).\n- CVE-2025-38552: mptcp: plug races between subflow fail and subflow creation (bsc#1248230).\n- CVE-2025-38653: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (bsc#1248630).\n- CVE-2025-38699: scsi: bfa: Double-free fix (bsc#1249224).\n- CVE-2025-38700: scsi: libiscsi: Initialize iscsi_conn-\u003edd_data only if memory is allocated (bsc#1249182).\n- CVE-2025-38718: sctp: linearize cloned gso packets in sctp_rcv (bsc#1249161).\n- CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).\n- CVE-2025-38735: gve: prevent ethtool ops after shutdown (bsc#1249288).\n- CVE-2025-39673: ppp: fix race conditions in ppp_fill_forward_path (bsc#1249320).\n- CVE-2025-39676: scsi: qla4xxx: Prevent a potential error pointer dereference (bsc#1249302).\n- CVE-2025-39683: tracing: Limit access to parser-\u003ebuffer when trace_get_user failed (bsc#1249286).\n- CVE-2025-39697: nfs: remove dead code for the old swap over NFS implementation (bsc#1249319).\n- CVE-2025-39702: ipv6: sr: Fix MAC comparison to be constant-time (bsc#1249317).\n- CVE-2025-39756: fs: Prevent file descriptor table allocations exceeding INT_MAX (bsc#1249512).\n- CVE-2025-39794: ARM: tegra: Use I/O memcpy to write to IRAM (bsc#1249595).\n- CVE-2025-39810: bnxt_en: Fix memory corruption when FW resources change during ifdown (bsc#1249975).\n- CVE-2025-39812: sctp: initialize more fields in sctp_v6_from_sk() (bsc#1250202).\n- CVE-2025-39813: ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (bsc#1250032).\n- CVE-2025-39828: atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control() (bsc#1250205).\n- CVE-2025-39832: net/mlx5: Add sync reset drop mode support (bsc#1249901).\n- CVE-2025-39847: ppp: fix memory leak in pad_compress_skb (bsc#1250292).\n- CVE-2025-39850: vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (bsc#1250276).\n- CVE-2025-39851: vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (bsc#1250296).\n- CVE-2025-39853: i40e: Fix potential invalid access when MAC list is empty (bsc#1250275).\n- CVE-2025-39854: ice: fix NULL access of tx-\u003ein_use in ice_ll_ts_intr (bsc#1250297).\n- CVE-2025-39866: fs: writeback: fix use-after-free in __mark_inode_dirty() (bsc#1250455).\n- CVE-2025-39876: net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (bsc#1250400).\n- CVE-2025-39881: kernfs: Fix UAF in polling when open file is released (bsc#1250379).\n- CVE-2025-39895: sched: Fix sched_numa_find_nth_cpu() if mask offline (bsc#1250721).\n- CVE-2025-39900: net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (bsc#1250758).\n- CVE-2025-39902: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (bsc#1250702).\n- CVE-2025-39911: i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (bsc#1250704).\n- CVE-2025-39945: cnic: Fix use-after-free bugs in cnic_delete_task (bsc#1251230).\n- CVE-2025-39946: tls: make sure to abort the stream if headers are bogus (bsc#1251114).\n- CVE-2025-39947: net/mlx5e: Harden uplink netdev access against device unbind (bsc#1251232).\n- CVE-2025-39948: ice: fix Rx page leak on multi-buffer frames (bsc#1251233).\n- CVE-2025-39949: qed: Don't collect too many protection override GRC elements (bsc#1251177).\n- CVE-2025-39955: tcp: Clear tcp_sk(sk)-\u003efastopen_rsk in tcp_disconnect() (bsc#1251804).\n- CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).\n- CVE-2025-39969: i40e: fix validation of VF state in get resources (bsc#1252044).\n- CVE-2025-39970: i40e: fix input validation logic for action_meta (bsc#1252051).\n- CVE-2025-39971: i40e: fix idx validation in config queues msg (bsc#1252052).\n- CVE-2025-39972: i40e: fix idx validation in i40e_validate_queue_map (bsc#1252039).\n- CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252035).\n- CVE-2025-39978: octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (bsc#1252069).\n- CVE-2025-39984: net: tun: Update napi-\u003eskb after XDP process (bsc#1252081).\n- CVE-2025-40000: wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (bsc#1252062).\n- CVE-2025-40005: spi: cadence-quadspi: Implement refcount to handle unbind during busy (bsc#1252349).\n- CVE-2025-40012: net/smc: fix warning in smc_rx_splice() when calling get_page() (bsc#1252330).\n- CVE-2025-40018: ipvs: Defer ip_vs_ftp unregister during netns cleanup (bsc#1252688).\n- CVE-2025-40051: vhost: vringh: Modify the return value check (bsc#1252858).\n- CVE-2025-40056: vhost: vringh: Fix copy_to_iter return value check (bsc#1252826).\n- CVE-2025-40060: coresight: trbe: Return NULL pointer for allocation failures (bsc#1252848).\n- CVE-2025-40078: bpf: Explicitly check accesses to bpf_sock_addr (bsc#1252789).\n- CVE-2025-40080: nbd: restrict sockets to TCP and UDP (bsc#1252774).\n- CVE-2025-40100: btrfs: do not assert we found block group item when creating free space tree (bsc#1252918).\n\nThe following non security issues were fixed:\n\n- ACPI/processor_idle: Add FFH state handling (jsc#PED-13815).\n- ACPI/processor_idle: Export acpi_processor_ffh_play_dead() (jsc#PED-13815).\n- ACPI: battery: Add synchronization between interface updates (git-fixes).\n- ACPI: processor: Rescan 'dead' SMT siblings during initialization (jsc#PED-13815).\n- KVM: PPC: Fix misleading interrupts comment in kvmppc_prepare_to_enter() (bsc#1215199).\n- KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update() (git-fixes).\n- KVM: x86: Process 'guest stopped request' once per guest time update (git-fixes).\n- PM: hibernate: Add pm_hibernation_mode_is_suspend() (bsc#1243112).\n- PM: hibernate: Add stub for pm_hibernate_is_recovering() (bsc#1243112).\n- PM: hibernate: Fix pm_hibernation_mode_is_suspend() build breakage (bsc#1243112).\n- PM: hibernate: add new api pm_hibernate_is_recovering() (bsc#1243112).\n- bpf: Allow helper bpf_get_[ns_]current_pid_tgid() for all prog types (bsc#1252364).\n- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (stable-fixes git-fixes).\n- cpuidle: Do not return from cpuidle_play_dead() on callback failures (jsc#PED-13815).\n- dpll: Make ZL3073X invisible (bsc#1252253).\n- dpll: zl3073x: Add firmware loading functionality (bsc#1252253).\n- dpll: zl3073x: Add functions to access hardware registers (bsc#1252253).\n- dpll: zl3073x: Add low-level flash functions (bsc#1252253).\n- dpll: zl3073x: Add support to get fractional frequency offset (bsc#1252253).\n- dpll: zl3073x: Add support to get phase offset on connected input pin (bsc#1252253).\n- dpll: zl3073x: Add support to get/set esync on pins (bsc#1252253).\n- dpll: zl3073x: Fix build failure (bsc#1252253).\n- dpll: zl3073x: Fix double free in zl3073x_devlink_flash_update() (bsc#1252253).\n- dpll: zl3073x: Handle missing or corrupted flash configuration (bsc#1252253).\n- dpll: zl3073x: Implement devlink flash callback (bsc#1252253).\n- dpll: zl3073x: Increase maximum size of flash utility (bsc#1252253).\n- dpll: zl3073x: Refactor DPLL initialization (bsc#1252253).\n- dpll: zl3073x: ZL3073X_I2C and ZL3073X_SPI should depend on NET (bsc#1252253).\n- drm/amd : Update MES API header file for v11 \u0026 v12 (stable-fixes).\n- drm/amd/amdgpu: Implement MES suspend/resume gang functionality for v12 (bsc#1243112).\n- drm/amd/display: Add NULL check for stream before dereference in 'dm_vupdate_high_irq' (bsc#1243112).\n- drm/amd/display: Enable Dynamic DTBCLK Switch (bsc#1243112).\n- drm/amd/display: Fix vupdate_offload_work doc (bsc#1243112).\n- drm/amd/display: fix dmub access race condition (bsc#1243112).\n- drm/amd/display: more liberal vmin/vmax update for freesync (bsc#1243112).\n- drm/amd/include : MES v11 and v12 API header update (stable-fixes).\n- drm/amd/include : Update MES v12 API for fence update (stable-fixes).\n- drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (git-fixes).\n- drm/amd: Avoid evicting resources at S5 (bsc#1243112).\n- drm/amd: Check whether secure display TA loaded successfully (bsc#1243112).\n- drm/amd: Fix hybrid sleep (bsc#1243112).\n- drm/amd: Only restore cached manual clock settings in restore if OD enabled (bsc#1243112).\n- drm/amd: Restore cached manual clock settings during resume (bsc#1243112).\n- drm/amdgpu/mes11: implement detect and reset callback (bsc#1243112).\n- drm/amdgpu/mes12: implement detect and reset callback (bsc#1243112).\n- drm/amdgpu/mes: add front end for detect and reset hung queue (bsc#1243112).\n- drm/amdgpu/vpe: cancel delayed work in hw_fini (bsc#1243112).\n- drm/amdgpu: Avoid rma causes GPU duplicate reset (bsc#1243112).\n- drm/amdgpu: Fix for GPU reset being blocked by KIQ I/O (bsc#1243112).\n- drm/amdgpu: Report individual reset error (bsc#1243112).\n- drm/amdgpu: do not resume device in thaw for normal hibernation (bsc#1243112).\n- drm/amdgpu: fix link error for !PM_SLEEP (bsc#1243112).\n- drm/amdkfd: Fix mmap write lock not release (bsc#1243112).\n- drm/xe/guc: Prepare GuC register list and update ADS size for error capture (stable-fixes).\n- ext4: fix checks for orphan inodes (bsc#1250119).\n- hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (git-fixes).\n- intel_idle: Provide the default enter_dead() handler (jsc#PED-13815).\n- intel_idle: Rescan 'dead' SMT siblings during initialization (jsc#PED-13815).\n- intel_idle: Use subsys_initcall_sync() for initialization (jsc#PED-13815).\n- ixgbe: handle IXGBE_VF_FEATURES_NEGOTIATE mbox cmd (bsc#1247222).\n- ixgbe: handle IXGBE_VF_GET_PF_LINK_STATE mailbox operation (bsc#1247222).\n- ixgbevf: fix getting link speed data for E610 devices (bsc#1247222).\n- ixgbevf: fix mailbox API compatibility by negotiating supported features (bsc#1247222).\n- kdb: Replace deprecated strcpy() with memmove() in vkdb_printf() (bsc#1252939).\n- module: Prevent silent truncation of module name in delete_module(2) (git-fixes).\n- net: mana: Use page pool fragments for RX buffers instead of full pages to improve memory efficiency (bsc#1248754).\n- netfilter: nft_objref: validate objref and objrefmap expressions (bsc#1250237).\n- nvme-auth: update bi_directional flag (git-fixes bsc#1249735).\n- nvme-auth: update sc_c in host response (git-fixes bsc#1249397).\n- nvme-fc: use lock accessing port_state and rport state (bsc#1245193 bsc#1247500).\n- nvme-tcp: send only permitted commands for secure concat (git-fixes bsc#1247683).\n- nvmet-fc: avoid scheduling association deletion twice (bsc#1245193 bsc#1247500).\n- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (bsc#1245193 bsc#1247500).\n- nvmet-fcloop: call done callback even when remote port is gone (bsc#1245193 bsc#1247500).\n- perf/x86/intel: Allow to update user space GPRs from PEBS records (git-fixes).\n- perf/x86/intel: Fix crash in icl_update_topdown_event() (git-fixes).\n- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (git-fixes).\n- platform/x86/amd/pmc: Add 1Ah family series to STB support list (bsc#1243112).\n- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (bsc#1243112).\n- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (bsc#1243112).\n- platform/x86/amd/pmc: Add VPE information for AMDI000A platform (bsc#1243112).\n- platform/x86/amd/pmc: Add idlemask support for 1Ah family (bsc#1243112).\n- platform/x86/amd/pmc: Extend support for PMC features on new AMD platform (bsc#1243112).\n- platform/x86/amd/pmc: Fix SMU command submission path on new AMD platform (bsc#1243112).\n- platform/x86/amd/pmc: Modify SMU message port for latest AMD platform (bsc#1243112).\n- platform/x86/amd/pmc: Notify user when platform does not support s0ix transition (bsc#1243112).\n- platform/x86/amd/pmc: Remove unnecessary line breaks (bsc#1243112).\n- platform/x86/amd/pmc: Send OS_HINT command for AMDI000A platform (bsc#1243112).\n- platform/x86/amd/pmc: Send OS_HINT command for new AMD platform (bsc#1243112).\n- platform/x86/amd/pmc: Update IP information structure for newer SoCs (bsc#1243112).\n- platform/x86/amd/pmc: Use ARRAY_SIZE() to fill num_ips information (bsc#1243112).\n- platform/x86/amd/pmc: call amd_pmc_get_ip_info() during driver probe (bsc#1243112).\n- platform/x86/amd: pmc: Add new ACPI ID AMDI000B (bsc#1243112).\n- platform/x86/amd: pmc: Drop SMU F/W match for Cezanne (bsc#1243112).\n- platform/x86/amd: pmc: Use guard(mutex) (bsc#1243112).\n- powerpc/boot: Fix build with gcc 15 (bsc#1215199).\n- powerpc/fadump: skip parameter area allocation when fadump is disabled (jsc#PED-9891 git-fixes).\n- powerpc/kvm: Fix ifdef to remove build warning (bsc#1215199).\n- powerpc/powernv/pci: Fix underflow and leak issue (bsc#1215199).\n- powerpc/pseries/msi: Fix potential underflow and leak issue (bsc#1215199).\n- powerpc: floppy: Add missing checks after DMA map (bsc#1215199).\n- proc: fix missing pde_set_flags() for net proc files (bsc#1248630)\n- proc: fix type confusion in pde_set_flags() (bsc#1248630)\n- sched/idle: Conditionally handle tick broadcast in default_idle_call() (bsc#1248517).\n- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (bsc#1250519).\n- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (bsc#1250519).\n- scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET (bsc#1250519).\n- scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail (bsc#1250519).\n- scsi: lpfc: Copyright updates for 14.4.0.11 patches (bsc#1250519).\n- scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted (bsc#1250519).\n- scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology (bsc#1250519).\n- scsi: lpfc: Fix buffer free/clear order in deferred receive path (bsc#1250519).\n- scsi: lpfc: Fix wrong function reference in a comment (bsc#1250519).\n- scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup (bsc#1250519).\n- scsi: lpfc: Remove redundant assignment to avoid memory leak (bsc#1250519).\n- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (bsc#1250519).\n- scsi: lpfc: Update lpfc version to 14.4.0.11 (bsc#1250519).\n- scsi: lpfc: Use int type to store negative error codes (bsc#1250519).\n- scsi: lpfc: use min() to improve code (bsc#1250519).\n- serial: sc16is7xx: rename Kconfig CONFIG_SERIAL_SC16IS7XX_CORE (bsc#1252469).\n- skmsg: Return copied bytes in sk_msg_memcopy_from_iter (bsc#1250650).\n- smb: client: fix crypto buffers in non-linear memory (bsc#1250491, bsc#1239206).\n- smb: client: fix potential cfid UAF in smb2_query_info_compound (bsc#1248886).\n- tcp_bpf: Fix copied value in tcp_bpf_sendmsg (bsc#1250650).\n- tracing: Remove unneeded goto out logic (bsc#1249286).\n- x86/idle: Sanitize X86_BUG_AMD_E400 handling (bsc#1248517).\n- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (bsc#1252734).\n- x86/resctrl: Refactor resctrl_arch_rmid_read() (bsc#1252734).\n- x86/smp: Allow calling mwait_play_dead with an arbitrary hint (jsc#PED-13815).\n- x86/smp: Fix mwait_play_dead() and acpi_processor_ffh_play_dead() noreturn behavior (jsc#PED-13815).\n- x86/smp: PM/hibernate: Split arch_resume_nosmt() (jsc#PED-13815).\n- x86/topology: Implement topology_is_core_online() to address SMT regression (jsc#PED-13815).\n","status":"published","published":"2025-11-18T16:45:55Z","modified":"2026-02-04T02:24:43.256655Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2025:4140-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2025-38008: mm/page_alloc: fix race condition in unaccepted memory handling (bsc#1244939).\n- CVE-2025-38539: trace/fgraph: Fix the warning caused by missing unregister notifier (bsc#1248211).\n- CVE-2025-38552: mptcp: plug races between subflow fail and subflow creation (bsc#1248230).\n- CVE-2025-38653: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (bsc#1248630).\n- CVE-2025-38699: scsi: bfa: Double-free fix (bsc#1249224).\n- CVE-2025-38700: scsi: libiscsi: Initialize iscsi_conn-\u003edd_data only if memory is allocated (bsc#1249182).\n- CVE-2025-38718: sctp: linearize cloned gso packets in sctp_rcv (bsc#1249161).\n- CVE-2025-39673: ppp: fix race conditions in ppp_fill_forward_path (bsc#1249320).\n- CVE-2025-39676: scsi: qla4xxx: Prevent a potential error pointer dereference (bsc#1249302).\n- CVE-2025-39683: tracing: Limit access to parser-\u003ebuffer when trace_get_user failed (bsc#1249286).\n- CVE-2025-39697: nfs: remove dead code for the old swap over NFS implementation (bsc#1249319).\n- CVE-2025-39702: ipv6: sr: Fix MAC comparison to be constant-time (bsc#1249317).\n- CVE-2025-39756: fs: Prevent file descriptor table allocations exceeding INT_MAX (bsc#1249512).\n- CVE-2025-39794: ARM: tegra: Use I/O memcpy to write to IRAM (bsc#1249595).\n- CVE-2025-39812: sctp: initialize more fields in sctp_v6_from_sk() (bsc#1250202).\n- CVE-2025-39813: ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (bsc#1250032).\n- CVE-2025-39828: atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control() (bsc#1250205).\n- CVE-2025-39851: vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (bsc#1250296).\n- CVE-2025-39866: fs: writeback: fix use-after-free in __mark_inode_dirty() (bsc#1250455).\n- CVE-2025-39876: net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (bsc#1250400).\n- CVE-2025-39881: kernfs: Fix UAF in polling when open file is released (bsc#1250379).\n- CVE-2025-39895: sched: Fix sched_numa_find_nth_cpu() if mask offline (bsc#1250721).\n- CVE-2025-39902: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (bsc#1250702).\n- CVE-2025-39911: i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (bsc#1250704).\n- CVE-2025-39945: cnic: Fix use-after-free bugs in cnic_delete_task (bsc#1251230).\n- CVE-2025-39946: tls: make sure to abort the stream if headers are bogus (bsc#1251114).\n- CVE-2025-39947: net/mlx5e: Harden uplink netdev access against device unbind (bsc#1251232).\n- CVE-2025-39948: ice: fix Rx page leak on multi-buffer frames (bsc#1251233).\n- CVE-2025-39949: qed: Don't collect too many protection override GRC elements (bsc#1251177).\n- CVE-2025-39955: tcp: Clear tcp_sk(sk)-\u003efastopen_rsk in tcp_disconnect() (bsc#1251804).\n- CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).\n- CVE-2025-39969: i40e: fix validation of VF state in get resources (bsc#1252044).\n- CVE-2025-39970: i40e: fix input validation logic for action_meta (bsc#1252051).\n- CVE-2025-39971: i40e: fix idx validation in config queues msg (bsc#1252052).\n- CVE-2025-39972: i40e: fix idx validation in i40e_validate_queue_map (bsc#1252039).\n- CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252035).\n- CVE-2025-39978: octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (bsc#1252069).\n- CVE-2025-40000: wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (bsc#1252062).\n- CVE-2025-40005: spi: cadence-quadspi: Implement refcount to handle unbind during busy (bsc#1252349).\n- CVE-2025-40018: ipvs: Defer ip_vs_ftp unregister during netns cleanup (bsc#1252688).\n- CVE-2025-40051: vhost: vringh: Modify the return value check (bsc#1252858).\n- CVE-2025-40056: vhost: vringh: Fix copy_to_iter return value check (bsc#1252826).\n- CVE-2025-40060: coresight: trbe: Return NULL pointer for allocation failures (bsc#1252848).\n- CVE-2025-40078: bpf: Explicitly check accesses to bpf_sock_addr (bsc#1252789).\n- CVE-2025-40080: nbd: restrict sockets to TCP and UDP (bsc#1252774).\n- CVE-2025-40100: btrfs: do not assert we found block group item when creating free space tree (bsc#1252918).\n\nThe following non security issues were fixed:\n\n- ACPI: battery: Add synchronization between interface updates (git-fixes).\n- KVM: PPC: Fix misleading interrupts comment in kvmppc_prepare_to_enter() (bsc#1215199).\n- KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update() (git-fixes).\n- KVM: x86: Process 'guest stopped request' once per guest time update (git-fixes).\n- bpf: Allow helper bpf_get_[ns_]current_pid_tgid() for all prog types (bsc#1252364).\n- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (stable-fixes git-fixes).\n- drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (git-fixes).\n- ext4: fix checks for orphan inodes (bsc#1250119).\n- hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (git-fixes).\n- kdb: Replace deprecated strcpy() with memmove() in vkdb_printf() (bsc#1252939).\n- module: Prevent silent truncation of module name in delete_module(2) (git-fixes).\n- net: mana: Use page pool fragments for RX buffers instead of full pages to improve memory efficiency (bsc#1248754).\n- netfilter: nft_objref: validate objref and objrefmap expressions (bsc#1250237).\n- perf/x86/intel: Allow to update user space GPRs from PEBS records (git-fixes).\n- perf/x86/intel: Fix crash in icl_update_topdown_event() (git-fixes).\n- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (git-fixes).\n- powerpc/boot: Fix build with gcc 15 (bsc#1215199).\n- powerpc/kvm: Fix ifdef to remove build warning (bsc#1215199).\n- powerpc/powernv/pci: Fix underflow and leak issue (bsc#1215199).\n- powerpc/pseries/msi: Fix potential underflow and leak issue (bsc#1215199).\n- powerpc: export MIN RMA size (bsc#1236743 ltc#211409).\n- powerpc: floppy: Add missing checks after DMA map (bsc#1215199).\n- powerpc: increase MIN RMA size for CAS negotiation (bsc#1236743 ltc#211409 bsc#1252269 ltc#215957).\n- proc: fix missing pde_set_flags() for net proc files (bsc#1248630)\n- proc: fix type confusion in pde_set_flags() (bsc#1248630)\n- sched/idle: Conditionally handle tick broadcast in default_idle_call() (bsc#1248517).\n- skmsg: Return copied bytes in sk_msg_memcopy_from_iter (bsc#1250650).\n- smb: client: fix crypto buffers in non-linear memory (bsc#1250491, bsc#1239206).\n- smb: client: fix potential cfid UAF in smb2_query_info_compound (bsc#1248886).\n- tcp_bpf: Fix copied value in tcp_bpf_sendmsg (bsc#1250650).\n- tracing: Remove unneeded goto out logic (bsc#1249286).\n- x86/idle: Sanitize X86_BUG_AMD_E400 handling (bsc#1248517).\n","status":"published","published":"2025-11-19T13:15:27Z","modified":"2026-03-23T04:51:48.443875Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2025:4141-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2025-38008: mm/page_alloc: fix race condition in unaccepted memory handling (bsc#1244939).\n- CVE-2025-38539: trace/fgraph: Fix the warning caused by missing unregister notifier (bsc#1248211).\n- CVE-2025-38552: mptcp: plug races between subflow fail and subflow creation (bsc#1248230).\n- CVE-2025-38653: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (bsc#1248630).\n- CVE-2025-38699: scsi: bfa: Double-free fix (bsc#1249224).\n- CVE-2025-38700: scsi: libiscsi: Initialize iscsi_conn-\u003edd_data only if memory is allocated (bsc#1249182).\n- CVE-2025-38718: sctp: linearize cloned gso packets in sctp_rcv (bsc#1249161).\n- CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324).\n- CVE-2025-38735: gve: prevent ethtool ops after shutdown (bsc#1249288).\n- CVE-2025-39673: ppp: fix race conditions in ppp_fill_forward_path (bsc#1249320).\n- CVE-2025-39676: scsi: qla4xxx: Prevent a potential error pointer dereference (bsc#1249302).\n- CVE-2025-39683: tracing: Limit access to parser-\u003ebuffer when trace_get_user failed (bsc#1249286).\n- CVE-2025-39697: nfs: remove dead code for the old swap over NFS implementation (bsc#1249319).\n- CVE-2025-39702: ipv6: sr: Fix MAC comparison to be constant-time (bsc#1249317).\n- CVE-2025-39756: fs: Prevent file descriptor table allocations exceeding INT_MAX (bsc#1249512).\n- CVE-2025-39794: ARM: tegra: Use I/O memcpy to write to IRAM (bsc#1249595).\n- CVE-2025-39810: bnxt_en: Fix memory corruption when FW resources change during ifdown (bsc#1249975).\n- CVE-2025-39812: sctp: initialize more fields in sctp_v6_from_sk() (bsc#1250202).\n- CVE-2025-39813: ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (bsc#1250032).\n- CVE-2025-39828: atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control() (bsc#1250205).\n- CVE-2025-39832: net/mlx5: Add sync reset drop mode support (bsc#1249901).\n- CVE-2025-39847: ppp: fix memory leak in pad_compress_skb (bsc#1250292).\n- CVE-2025-39850: vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects (bsc#1250276).\n- CVE-2025-39851: vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (bsc#1250296).\n- CVE-2025-39853: i40e: Fix potential invalid access when MAC list is empty (bsc#1250275).\n- CVE-2025-39854: ice: fix NULL access of tx-\u003ein_use in ice_ll_ts_intr (bsc#1250297).\n- CVE-2025-39866: fs: writeback: fix use-after-free in __mark_inode_dirty() (bsc#1250455).\n- CVE-2025-39876: net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (bsc#1250400).\n- CVE-2025-39881: kernfs: Fix UAF in polling when open file is released (bsc#1250379).\n- CVE-2025-39895: sched: Fix sched_numa_find_nth_cpu() if mask offline (bsc#1250721).\n- CVE-2025-39900: net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y (bsc#1250758).\n- CVE-2025-39902: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (bsc#1250702).\n- CVE-2025-39911: i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (bsc#1250704).\n- CVE-2025-39945: cnic: Fix use-after-free bugs in cnic_delete_task (bsc#1251230).\n- CVE-2025-39946: tls: make sure to abort the stream if headers are bogus (bsc#1251114).\n- CVE-2025-39947: net/mlx5e: Harden uplink netdev access against device unbind (bsc#1251232).\n- CVE-2025-39948: ice: fix Rx page leak on multi-buffer frames (bsc#1251233).\n- CVE-2025-39949: qed: Don't collect too many protection override GRC elements (bsc#1251177).\n- CVE-2025-39955: tcp: Clear tcp_sk(sk)-\u003efastopen_rsk in tcp_disconnect() (bsc#1251804).\n- CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).\n- CVE-2025-39969: i40e: fix validation of VF state in get resources (bsc#1252044).\n- CVE-2025-39970: i40e: fix input validation logic for action_meta (bsc#1252051).\n- CVE-2025-39971: i40e: fix idx validation in config queues msg (bsc#1252052).\n- CVE-2025-39972: i40e: fix idx validation in i40e_validate_queue_map (bsc#1252039).\n- CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252035).\n- CVE-2025-39978: octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (bsc#1252069).\n- CVE-2025-39984: net: tun: Update napi-\u003eskb after XDP process (bsc#1252081).\n- CVE-2025-40000: wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (bsc#1252062).\n- CVE-2025-40005: spi: cadence-quadspi: Implement refcount to handle unbind during busy (bsc#1252349).\n- CVE-2025-40012: net/smc: fix warning in smc_rx_splice() when calling get_page() (bsc#1252330).\n- CVE-2025-40018: ipvs: Defer ip_vs_ftp unregister during netns cleanup (bsc#1252688).\n- CVE-2025-40051: vhost: vringh: Modify the return value check (bsc#1252858).\n- CVE-2025-40056: vhost: vringh: Fix copy_to_iter return value check (bsc#1252826).\n- CVE-2025-40060: coresight: trbe: Return NULL pointer for allocation failures (bsc#1252848).\n- CVE-2025-40078: bpf: Explicitly check accesses to bpf_sock_addr (bsc#1252789).\n- CVE-2025-40100: btrfs: do not assert we found block group item when creating free space tree (bsc#1252918).\n\nThe following non security issues were fixed:\n\n- ACPI/processor_idle: Add FFH state handling (jsc#PED-13815).\n- ACPI/processor_idle: Export acpi_processor_ffh_play_dead() (jsc#PED-13815).\n- ACPI: battery: Add synchronization between interface updates (git-fixes).\n- ACPI: processor: Rescan 'dead' SMT siblings during initialization (jsc#PED-13815).\n- KVM: PPC: Fix misleading interrupts comment in kvmppc_prepare_to_enter() (bsc#1215199).\n- KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update() (git-fixes).\n- KVM: x86: Process 'guest stopped request' once per guest time update (git-fixes).\n- PM: hibernate: Add pm_hibernation_mode_is_suspend() (bsc#1243112).\n- PM: hibernate: Add stub for pm_hibernate_is_recovering() (bsc#1243112).\n- PM: hibernate: Fix pm_hibernation_mode_is_suspend() build breakage (bsc#1243112).\n- PM: hibernate: add new api pm_hibernate_is_recovering() (bsc#1243112).\n- Reapply 'x86/smp: Eliminate mwait_play_dead_cpuid_hint()' (jsc#PED-13815).\n- bpf: Allow helper bpf_get_[ns_]current_pid_tgid() for all prog types (bsc#1252364).\n- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (stable-fixes git-fixes).\n- cpuidle: Do not return from cpuidle_play_dead() on callback failures (jsc#PED-13815).\n- dpll: Make ZL3073X invisible (bsc#1252253).\n- dpll: zl3073x: Add firmware loading functionality (bsc#1252253).\n- dpll: zl3073x: Add functions to access hardware registers (bsc#1252253).\n- dpll: zl3073x: Add low-level flash functions (bsc#1252253).\n- dpll: zl3073x: Add support to get fractional frequency offset (bsc#1252253).\n- dpll: zl3073x: Add support to get phase offset on connected input pin (bsc#1252253).\n- dpll: zl3073x: Add support to get/set esync on pins (bsc#1252253).\n- dpll: zl3073x: Fix build failure (bsc#1252253).\n- dpll: zl3073x: Fix double free in zl3073x_devlink_flash_update() (bsc#1252253).\n- dpll: zl3073x: Handle missing or corrupted flash configuration (bsc#1252253).\n- dpll: zl3073x: Implement devlink flash callback (bsc#1252253).\n- dpll: zl3073x: Increase maximum size of flash utility (bsc#1252253).\n- dpll: zl3073x: Refactor DPLL initialization (bsc#1252253).\n- dpll: zl3073x: ZL3073X_I2C and ZL3073X_SPI should depend on NET (bsc#1252253).\n- drm/amd : Update MES API header file for v11 \u0026 v12 (stable-fixes).\n- drm/amd/amdgpu: Implement MES suspend/resume gang functionality for v12 (bsc#1243112).\n- drm/amd/display: Add NULL check for stream before dereference in 'dm_vupdate_high_irq' (bsc#1243112).\n- drm/amd/display: Enable Dynamic DTBCLK Switch (bsc#1243112).\n- drm/amd/display: Fix vupdate_offload_work doc (bsc#1243112).\n- drm/amd/display: fix dmub access race condition (bsc#1243112).\n- drm/amd/display: more liberal vmin/vmax update for freesync (bsc#1243112).\n- drm/amd/include : MES v11 and v12 API header update (stable-fixes).\n- drm/amd/include : Update MES v12 API for fence update (stable-fixes).\n- drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (git-fixes).\n- drm/amd: Avoid evicting resources at S5 (bsc#1243112).\n- drm/amd: Check whether secure display TA loaded successfully (bsc#1243112).\n- drm/amd: Fix hybrid sleep (bsc#1243112).\n- drm/amd: Only restore cached manual clock settings in restore if OD enabled (bsc#1243112).\n- drm/amd: Restore cached manual clock settings during resume (bsc#1243112).\n- drm/amdgpu/mes11: implement detect and reset callback (bsc#1243112).\n- drm/amdgpu/mes12: implement detect and reset callback (bsc#1243112).\n- drm/amdgpu/mes: add front end for detect and reset hung queue (bsc#1243112).\n- drm/amdgpu/vpe: cancel delayed work in hw_fini (bsc#1243112).\n- drm/amdgpu: Avoid rma causes GPU duplicate reset (bsc#1243112).\n- drm/amdgpu: Fix for GPU reset being blocked by KIQ I/O (bsc#1243112).\n- drm/amdgpu: Report individual reset error (bsc#1243112).\n- drm/amdgpu: do not resume device in thaw for normal hibernation (bsc#1243112).\n- drm/amdgpu: fix link error for !PM_SLEEP (bsc#1243112).\n- drm/amdkfd: Fix mmap write lock not release (bsc#1243112).\n- drm/xe/guc: Prepare GuC register list and update ADS size for error capture (stable-fixes).\n- ext4: fix checks for orphan inodes (bsc#1250119).\n- hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (git-fixes).\n- intel_idle: Provide the default enter_dead() handler (jsc#PED-13815).\n- intel_idle: Rescan 'dead' SMT siblings during initialization (jsc#PED-13815).\n- intel_idle: Use subsys_initcall_sync() for initialization (jsc#PED-13815).\n- ixgbe: handle IXGBE_VF_FEATURES_NEGOTIATE mbox cmd (bsc#1247222).\n- ixgbe: handle IXGBE_VF_GET_PF_LINK_STATE mailbox operation (bsc#1247222).\n- ixgbevf: fix getting link speed data for E610 devices (bsc#1247222).\n- ixgbevf: fix mailbox API compatibility by negotiating supported features (bsc#1247222).\n- kdb: Replace deprecated strcpy() with memmove() in vkdb_printf() (bsc#1252939).\n- module: Prevent silent truncation of module name in delete_module(2) (git-fixes).\n- net: mana: Use page pool fragments for RX buffers instead of full pages to improve memory efficiency (bsc#1248754).\n- netfilter: nft_objref: validate objref and objrefmap expressions (bsc#1250237).\n- nvme-auth: update bi_directional flag (git-fixes bsc#1249735).\n- nvme-auth: update sc_c in host response (git-fixes bsc#1249397).\n- nvme-fc: use lock accessing port_state and rport state (bsc#1245193 bsc#1247500).\n- nvme-tcp: send only permitted commands for secure concat (git-fixes bsc#1247683).\n- nvmet-fc: avoid scheduling association deletion twice (bsc#1245193 bsc#1247500).\n- nvmet-fc: move lsop put work to nvmet_fc_ls_req_op (bsc#1245193 bsc#1247500).\n- nvmet-fcloop: call done callback even when remote port is gone (bsc#1245193 bsc#1247500).\n- perf/x86/intel: Allow to update user space GPRs from PEBS records (git-fixes).\n- perf/x86/intel: Fix crash in icl_update_topdown_event() (git-fixes).\n- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (git-fixes).\n- platform/x86/amd/pmc: Add 1Ah family series to STB support list (bsc#1243112).\n- platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list (bsc#1243112).\n- platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list (bsc#1243112).\n- platform/x86/amd/pmc: Add VPE information for AMDI000A platform (bsc#1243112).\n- platform/x86/amd/pmc: Add idlemask support for 1Ah family (bsc#1243112).\n- platform/x86/amd/pmc: Extend support for PMC features on new AMD platform (bsc#1243112).\n- platform/x86/amd/pmc: Fix SMU command submission path on new AMD platform (bsc#1243112).\n- platform/x86/amd/pmc: Modify SMU message port for latest AMD platform (bsc#1243112).\n- platform/x86/amd/pmc: Notify user when platform does not support s0ix transition (bsc#1243112).\n- platform/x86/amd/pmc: Remove unnecessary line breaks (bsc#1243112).\n- platform/x86/amd/pmc: Send OS_HINT command for AMDI000A platform (bsc#1243112).\n- platform/x86/amd/pmc: Send OS_HINT command for new AMD platform (bsc#1243112).\n- platform/x86/amd/pmc: Update IP information structure for newer SoCs (bsc#1243112).\n- platform/x86/amd/pmc: Use ARRAY_SIZE() to fill num_ips information (bsc#1243112).\n- platform/x86/amd/pmc: call amd_pmc_get_ip_info() during driver probe (bsc#1243112).\n- platform/x86/amd: pmc: Add new ACPI ID AMDI000B (bsc#1243112).\n- platform/x86/amd: pmc: Drop SMU F/W match for Cezanne (bsc#1243112).\n- platform/x86/amd: pmc: Use guard(mutex) (bsc#1243112).\n- powerpc/boot: Fix build with gcc 15 (bsc#1215199).\n- powerpc/fadump: skip parameter area allocation when fadump is disabled (jsc#PED-9891 git-fixes).\n- powerpc/kvm: Fix ifdef to remove build warning (bsc#1215199).\n- powerpc/powernv/pci: Fix underflow and leak issue (bsc#1215199).\n- powerpc/pseries/msi: Fix potential underflow and leak issue (bsc#1215199).\n- powerpc: floppy: Add missing checks after DMA map (bsc#1215199).\n- proc: fix missing pde_set_flags() for net proc files (bsc#1248630)\n- proc: fix type confusion in pde_set_flags() (bsc#1248630)\n- sched/idle: Conditionally handle tick broadcast in default_idle_call() (bsc#1248517).\n- scsi: fc: Avoid -Wflex-array-member-not-at-end warnings (bsc#1250519).\n- scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress (bsc#1250519).\n- scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET (bsc#1250519).\n- scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail (bsc#1250519).\n- scsi: lpfc: Copyright updates for 14.4.0.11 patches (bsc#1250519).\n- scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted (bsc#1250519).\n- scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology (bsc#1250519).\n- scsi: lpfc: Fix buffer free/clear order in deferred receive path (bsc#1250519).\n- scsi: lpfc: Fix wrong function reference in a comment (bsc#1250519).\n- scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup (bsc#1250519).\n- scsi: lpfc: Remove redundant assignment to avoid memory leak (bsc#1250519).\n- scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport (bsc#1250519).\n- scsi: lpfc: Update lpfc version to 14.4.0.11 (bsc#1250519).\n- scsi: lpfc: Use int type to store negative error codes (bsc#1250519).\n- scsi: lpfc: use min() to improve code (bsc#1250519).\n- serial: sc16is7xx: rename Kconfig CONFIG_SERIAL_SC16IS7XX_CORE (bsc#1252469)\n- skmsg: Return copied bytes in sk_msg_memcopy_from_iter (bsc#1250650).\n- smb: client: fix crypto buffers in non-linear memory (bsc#1250491, bsc#1239206).\n- smb: client: fix potential cfid UAF in smb2_query_info_compound (bsc#1248886).\n- tcp_bpf: Fix copied value in tcp_bpf_sendmsg (bsc#1250650).\n- tracing: Remove unneeded goto out logic (bsc#1249286).\n- x86/idle: Sanitize X86_BUG_AMD_E400 handling (bsc#1248517).\n- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (bsc#1252734).\n- x86/resctrl: Refactor resctrl_arch_rmid_read() (bsc#1252734).\n- x86/smp: Allow calling mwait_play_dead with an arbitrary hint (jsc#PED-13815).\n- x86/smp: Fix mwait_play_dead() and acpi_processor_ffh_play_dead() noreturn behavior (jsc#PED-13815).\n- x86/smp: PM/hibernate: Split arch_resume_nosmt() (jsc#PED-13815).\n- x86/topology: Implement topology_is_core_online() to address SMT regression (jsc#PED-13815).\n","status":"published","published":"2025-11-19T14:06:18Z","modified":"2026-03-23T04:50:23.099088Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2025:4301-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP6 RT kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2025-38008: mm/page_alloc: fix race condition in unaccepted memory handling (bsc#1244939).\n- CVE-2025-38539: trace/fgraph: Fix the warning caused by missing unregister notifier (bsc#1248211).\n- CVE-2025-38552: mptcp: plug races between subflow fail and subflow creation (bsc#1248230).\n- CVE-2025-38653: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (bsc#1248630).\n- CVE-2025-38699: scsi: bfa: Double-free fix (bsc#1249224).\n- CVE-2025-38700: scsi: libiscsi: Initialize iscsi_conn-\u003edd_data only if memory is allocated (bsc#1249182).\n- CVE-2025-38718: sctp: linearize cloned gso packets in sctp_rcv (bsc#1249161).\n- CVE-2025-39673: ppp: fix race conditions in ppp_fill_forward_path (bsc#1249320).\n- CVE-2025-39676: scsi: qla4xxx: Prevent a potential error pointer dereference (bsc#1249302).\n- CVE-2025-39683: tracing: Limit access to parser-\u003ebuffer when trace_get_user failed (bsc#1249286).\n- CVE-2025-39697: nfs: remove dead code for the old swap over NFS implementation (bsc#1249319 bsc#1252236).\n- CVE-2025-39702: ipv6: sr: Fix MAC comparison to be constant-time (bsc#1249317).\n- CVE-2025-39756: fs: Prevent file descriptor table allocations exceeding INT_MAX (bsc#1249512).\n- CVE-2025-39794: ARM: tegra: Use I/O memcpy to write to IRAM (bsc#1249595).\n- CVE-2025-39812: sctp: initialize more fields in sctp_v6_from_sk() (bsc#1250202).\n- CVE-2025-39813: ftrace: Fix potential warning in trace_printk_seq during ftrace_dump (bsc#1250032).\n- CVE-2025-39828: atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control() (bsc#1250205).\n- CVE-2025-39851: vxlan: Fix NPD when refreshing an FDB entry with a nexthop object (bsc#1250296).\n- CVE-2025-39866: fs: writeback: fix use-after-free in __mark_inode_dirty() (bsc#1250455).\n- CVE-2025-39876: net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (bsc#1250400).\n- CVE-2025-39881: kernfs: Fix UAF in polling when open file is released (bsc#1250379).\n- CVE-2025-39895: sched: Fix sched_numa_find_nth_cpu() if mask offline (bsc#1250721).\n- CVE-2025-39902: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (bsc#1250702).\n- CVE-2025-39911: i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (bsc#1250704).\n- CVE-2025-39945: cnic: Fix use-after-free bugs in cnic_delete_task (bsc#1251230).\n- CVE-2025-39946: tls: make sure to abort the stream if headers are bogus (bsc#1251114).\n- CVE-2025-39947: net/mlx5e: Harden uplink netdev access against device unbind (bsc#1251232).\n- CVE-2025-39948: ice: fix Rx page leak on multi-buffer frames (bsc#1251233).\n- CVE-2025-39949: qed: Don't collect too many protection override GRC elements (bsc#1251177).\n- CVE-2025-39955: tcp: Clear tcp_sk(sk)-\u003efastopen_rsk in tcp_disconnect() (bsc#1251804).\n- CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).\n- CVE-2025-39969: i40e: fix validation of VF state in get resources (bsc#1252044).\n- CVE-2025-39970: i40e: fix input validation logic for action_meta (bsc#1252051).\n- CVE-2025-39971: i40e: fix idx validation in config queues msg (bsc#1252052).\n- CVE-2025-39972: i40e: fix idx validation in i40e_validate_queue_map (bsc#1252039).\n- CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252035).\n- CVE-2025-39978: octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (bsc#1252069).\n- CVE-2025-40000: wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (bsc#1252062).\n- CVE-2025-40005: spi: cadence-quadspi: Implement refcount to handle unbind during busy (bsc#1252349).\n- CVE-2025-40018: ipvs: Defer ip_vs_ftp unregister during netns cleanup (bsc#1252688).\n- CVE-2025-40051: vhost: vringh: Modify the return value check (bsc#1252858).\n- CVE-2025-40056: vhost: vringh: Fix copy_to_iter return value check (bsc#1252826).\n- CVE-2025-40060: coresight: trbe: Return NULL pointer for allocation failures (bsc#1252848).\n- CVE-2025-40078: bpf: Explicitly check accesses to bpf_sock_addr (bsc#1252789).\n- CVE-2025-40080: nbd: restrict sockets to TCP and UDP (bsc#1252774).\n- CVE-2025-40100: btrfs: do not assert we found block group item when creating free space tree (bsc#1252918).\n\nThe following non security issues were fixed:\n\n- ACPI: battery: Add synchronization between interface updates (git-fixes).\n- KVM: PPC: Fix misleading interrupts comment in kvmppc_prepare_to_enter() (bsc#1215199).\n- KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update() (git-fixes).\n- KVM: x86: Process 'guest stopped request' once per guest time update (git-fixes).\n- bpf: Allow helper bpf_get_[ns_]current_pid_tgid() for all prog types (bsc#1252364).\n- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() (stable-fixes git-fixes).\n- drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (git-fixes).\n- ext4: fix checks for orphan inodes (bsc#1250119).\n- hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (git-fixes).\n- kdb: Replace deprecated strcpy() with memmove() in vkdb_printf() (bsc#1252939).\n- module: Prevent silent truncation of module name in delete_module(2) (git-fixes).\n- net: mana: Use page pool fragments for RX buffers instead of full pages to improve memory efficiency (bsc#1248754).\n- netfilter: nft_objref: validate objref and objrefmap expressions (bsc#1250237). No CVE available yet, please see the bugzilla ticket referenced.\n- perf/x86/intel: Allow to update user space GPRs from PEBS records (git-fixes).\n- perf/x86/intel: Fix crash in icl_update_topdown_event() (git-fixes).\n- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (git-fixes).\n- powerpc/boot: Fix build with gcc 15 (bsc#1215199).\n- powerpc/kvm: Fix ifdef to remove build warning (bsc#1215199).\n- powerpc/powernv/pci: Fix underflow and leak issue (bsc#1215199).\n- powerpc/pseries/msi: Fix potential underflow and leak issue (bsc#1215199).\n- powerpc: export MIN RMA size (bsc#1236743 ltc#211409).\n- powerpc: floppy: Add missing checks after DMA map (bsc#1215199).\n- powerpc: increase MIN RMA size for CAS negotiation (bsc#1236743 ltc#211409 bsc#1252269 ltc#215957).\n- proc: fix missing pde_set_flags() for net proc files (bsc#1248630)\n- proc: fix type confusion in pde_set_flags() (bsc#1248630)\n- sched/idle: Conditionally handle tick broadcast in default_idle_call() (bsc#1248517).\n- serial: jsm: fix NPE during jsm_uart_port_init (git fixes, bsc#1246244).\n- skmsg: Return copied bytes in sk_msg_memcopy_from_iter (bsc#1250650).\n- smb: client: fix crypto buffers in non-linear memory (bsc#1250491, bsc#1239206).\n- smb: client: fix potential cfid UAF in smb2_query_info_compound (bsc#1248886).\n- tcp_bpf: Fix copied value in tcp_bpf_sendmsg (bsc#1250650).\n- tracing: Remove unneeded goto out logic (bsc#1249286).\n- x86/idle: Sanitize X86_BUG_AMD_E400 handling (bsc#1248517).\n","status":"published","published":"2025-11-28T12:59:04Z","modified":"2026-02-04T02:13:26.819076Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2026:20561-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2025-21816: hrtimers: Force migrate away hrtimers queued after (bsc#1238472).\n- CVE-2025-38653: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (bsc#1248630).\n- CVE-2025-38718: sctp: linearize cloned gso packets in sctp_rcv (bsc#1249161).\n- CVE-2025-39676: scsi: qla4xxx: Prevent a potential error pointer dereference (bsc#1249302).\n- CVE-2025-39702: ipv6: sr: Fix MAC comparison to be constant-time (bsc#1249317).\n- CVE-2025-39756: fs: Prevent file descriptor table allocations exceeding INT_MAX (bsc#1249512).\n- CVE-2025-39779: btrfs: subpage: keep TOWRITE tag until folio is cleaned (bsc#1249495).\n- CVE-2025-39812: sctp: initialize more fields in sctp_v6_from_sk() (bsc#1250202).\n- CVE-2025-39866: fs: writeback: fix use-after-free in __mark_inode_dirty() (bsc#1250455).\n- CVE-2025-39876: net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() (bsc#1250400).\n- CVE-2025-39881: kernfs: Fix UAF in polling when open file is released (bsc#1250379).\n- CVE-2025-39895: sched: Fix sched_numa_find_nth_cpu() if mask offline (bsc#1250721).\n- CVE-2025-39903: of_numa: fix uninitialized memory nodes causing kernel panic (bsc#1250749).\n- CVE-2025-39911: i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path (bsc#1250704).\n- CVE-2025-39947: net/mlx5e: Harden uplink netdev access against device unbind (bsc#1251232).\n- CVE-2025-39948: ice: fix Rx page leak on multi-buffer frames (bsc#1251233).\n- CVE-2025-39949: qed: Don't collect too many protection override GRC elements (bsc#1251177).\n- CVE-2025-39950: net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (bsc#1251176).\n- CVE-2025-39955: tcp: Clear tcp_sk(sk)-\u003efastopen_rsk in tcp_disconnect() (bsc#1251804).\n- CVE-2025-39956: igc: don't fail igc_probe() on LED setup error (bsc#1251809).\n- CVE-2025-39963: io_uring: fix incorrect io_kiocb reference in io_link_skb (bsc#1251819).\n- CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).\n- CVE-2025-39969: i40e: fix validation of VF state in get resources (bsc#1252044).\n- CVE-2025-39970: i40e: fix input validation logic for action_meta (bsc#1252051).\n- CVE-2025-39971: i40e: fix idx validation in config queues msg (bsc#1252052).\n- CVE-2025-39972: i40e: fix idx validation in i40e_validate_queue_map (bsc#1252039).\n- CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252035).\n- CVE-2025-39978: octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (bsc#1252069).\n- CVE-2025-39979: net/mlx5: fs, add API for sharing HWS action by refcount (bsc#1252067).\n- CVE-2025-39984: net: tun: Update napi-\u003eskb after XDP process (bsc#1252081).\n- CVE-2025-39992: mm: swap: check for stable address space before operating on the VMA (bsc#1252076).\n- CVE-2025-40000: wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() (bsc#1252062).\n- CVE-2025-40005: spi: cadence-quadspi: Implement refcount to handle unbind during busy (bsc#1252349).\n- CVE-2025-40012: net/smc: fix warning in smc_rx_splice() when calling get_page() (bsc#1252330).\n- CVE-2025-40018: ipvs: Defer ip_vs_ftp unregister during netns cleanup (bsc#1252688).\n- CVE-2025-40040: mm/ksm: fix flag-dropping behavior in ksm_madvise (bsc#1252780).\n- CVE-2025-40051: vhost: vringh: Modify the return value check (bsc#1252858).\n- CVE-2025-40056: vhost: vringh: Fix copy_to_iter return value check (bsc#1252826).\n- CVE-2025-40060: coresight: trbe: Return NULL pointer for allocation failures (bsc#1252848).\n- CVE-2025-40078: bpf: Explicitly check accesses to bpf_sock_addr (bsc#1252789).\n- CVE-2025-40080: nbd: restrict sockets to TCP and UDP (bsc#1252774).\n- CVE-2025-40100: btrfs: do not assert we found block group item when creating free space tree (bsc#1252918).\n\nThe following non security issues were fixed:\n\n- add bug reference to existing hv_netvsc change (bsc#1252265)\n- amd-pstate-ut: Reset amd-pstate driver mode after running selftests (bsc#1249226).\n- cgroup/cpuset: Remove remote_partition_check() \u0026 make update_cpumasks_hier() handle remote partition (bsc#1241166).\n- cpuset: Use new excpus for nocpu error check when enabling root partition (bsc#1241166).\n- cpuset: fix failure to enable isolated partition when containing isolcpus (bsc#1241166).\n- doc/README.SUSE: Correct the character used for TAINT_NO_SUPPORT\n  The character was previously 'N', but upstream used it for TAINT_TEST,\n  which prompted the change of TAINT_NO_SUPPORT to 'n'.\n- dpll: zl3073x: Add firmware loading functionality (bsc#1252253).\n- dpll: zl3073x: Add functions to access hardware registers (bsc#1252253).\n- dpll: zl3073x: Add low-level flash functions (bsc#1252253).\n- dpll: zl3073x: Add support to get fractional frequency offset (bsc#1252253).\n- dpll: zl3073x: Add support to get phase offset on connected input pin (bsc#1252253).\n- dpll: zl3073x: Add support to get/set esync on pins (bsc#1252253).\n- dpll: zl3073x: Fix double free in zl3073x_devlink_flash_update() (bsc#1252253).\n- dpll: zl3073x: Handle missing or corrupted flash configuration (bsc#1252253).\n- dpll: zl3073x: Implement devlink flash callback (bsc#1252253).\n- dpll: zl3073x: Increase maximum size of flash utility (bsc#1252253).\n- dpll: zl3073x: Refactor DPLL initialization (bsc#1252253).\n- drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() (git-fixes).\n- drm/xe/guc: Prepare GuC register list and update ADS size for error capture (stable-fixes).\n- ixgbe: handle IXGBE_VF_FEATURES_NEGOTIATE mbox cmd (bsc#1247222).\n- ixgbe: handle IXGBE_VF_GET_PF_LINK_STATE mailbox operation (bsc#1247222).\n- ixgbevf: fix getting link speed data for E610 devices (bsc#1247222).\n- ixgbevf: fix mailbox API compatibility by negotiating supported features (bsc#1247222).\n- kbuild/modfinal: Link livepatches with module-common.o (bsc#1218644, bsc#1252270).\n- kdb: Replace deprecated strcpy() with memmove() in vkdb_printf() (bsc#1252939).\n- kernel-subpackage-spec: Do not doubly-sign modules (bsc#1251930).\n- nvme-auth: update sc_c in host response (git-fixes bsc#1249397).\n- perf hwmon_pmu: Fix uninitialized variable warning (perf-sle16-v6.13-userspace-update, git-fixes).\n- phy: cadence: cdns-dphy: Update calibration wait time for startup state machine (git-fixes).\n- powerpc/fadump: skip parameter area allocation when fadump is disabled (jsc#PED-9891 git-fixes).\n- proc: fix missing pde_set_flags() for net proc files (bsc#1248630)\n- proc: fix type confusion in pde_set_flags() (bsc#1248630)\n- rpm/check-for-config-changes: ignore CONFIG_SCHED_PROXY_EXEC, too (bsc#1250946)\n- scsi: storvsc: Prefer returning channel with the same CPU as on the I/O issuing CPU (bsc#1252267).\n- x86/microcode/AMD: Limit Entrysign signature checking to known generations (bsc#1252725).\n- x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID (bsc#1252734).\n- x86/resctrl: Refactor resctrl_arch_rmid_read() (bsc#1252734).\n- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (jsc#PED-348).\n","status":"published","published":"2025-11-26T15:35:13Z","modified":"2026-07-09T18:24:04.205475419Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"USN-8095-1","title":"linux, linux-aws, linux-gcp, linux-gcp-6.8, linux-gke, linux-gkeop, linux-hwe-6.8, linux-ibm, linux-ibm-6.8, linux-lowlatency, linux-lowlatency-hwe-6.8, linux-oracle, linux-oracle-6.8 vulnerabilities","description":"\nQualys discovered that several vulnerabilities existed in the AppArmor\nLinux kernel Security Module (LSM). An unprivileged local attacker could\nuse these issues to load, replace, and remove arbitrary AppArmor profiles\ncausing denial of service, exposure of sensitive information (kernel\nmemory), local privilege escalation, or possibly escape a container.\n(LP: #2143853)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - MIPS architecture;\n  - Nios II architecture;\n  - PA-RISC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - Sun Sparc architecture;\n  - User-Mode Linux (UML);\n  - x86 architecture;\n  - Xtensa architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - ATM drivers;\n  - Drivers core;\n  - Block device driver;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Hardware random number generator core;\n  - Character device driver;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - DMA engine subsystem;\n  - ARM SCMI message protocol;\n  - EFI core;\n  - Intel Stratix 10 firmware drivers;\n  - GPU drivers;\n  - HID subsystem;\n  - CoreSight HW tracing drivers;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - Input Device (Tablet) drivers;\n  - IOMMU subsystem;\n  - ISDN/mISDN subsystem;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - Fastrpc Driver;\n  - MOST (Media Oriented Systems Transport) drivers;\n  - MTD block device drivers;\n  - Ethernet bonding driver;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - Texas Instruments network drivers;\n  - Ethernet team driver;\n  - NVME drivers;\n  - PCI subsystem;\n  - PCCARD (PCMCIA/CardBus) bus subsystem;\n  - Performance monitor drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - ARM PM domains;\n  - PPS (Pulse Per Second) driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - Texas Instruments SoC drivers;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - TTY drivers;\n  - Userspace I/O drivers;\n  - Cadence USB3 driver;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Renesas USBHS Controller drivers;\n  - USB Mass Storage drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Framebuffer layer;\n  - Xen hypervisor drivers;\n  - AFS file system;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - File systems infrastructure;\n  - EFI Variable file system;\n  - exFAT file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - GFS2 file system;\n  - HFS file system;\n  - HFS+ file system;\n  - HugeTLB file system;\n  - JFS file system;\n  - KERNFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - OrangeFS file system;\n  - Proc file system;\n  - Diskquota system;\n  - SMB network file system;\n  - SquashFS file system;\n  - UDF file system;\n  - XFS file system;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - BPF subsystem;\n  - Mellanox drivers;\n  - NFS page cache wrapper;\n  - Memory management;\n  - Memory Management;\n  - Media input infrastructure;\n  - Bluetooth subsystem;\n  - IP tunnels definitions;\n  - Network traffic control;\n  - Rose network layer;\n  - Network sockets;\n  - io_uring subsystem;\n  - Control group (cgroup);\n  - Kernel crash support code;\n  - Kernel futex primitives;\n  - PID allocator;\n  - Scheduler infrastructure;\n  - Syscalls implementation;\n  - Timer subsystem;\n  - Tracing infrastructure;\n  - 9P file system network protocol;\n  - Amateur Radio drivers;\n  - B.A.T.M.A.N. meshing protocol;\n  - Ethernet bridge;\n  - Ceph Core library;\n  - Networking core;\n  - Devlink API;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - Open vSwitch;\n  - RF switch subsystem;\n  - SCTP protocol;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Intel ASoC drivers;\n  - QCOM ASoC drivers;\n  - USB sound devices;\n(CVE-2025-21833, CVE-2025-22103, CVE-2025-22105, CVE-2025-22106,\nCVE-2025-22107, CVE-2025-22113, CVE-2025-22121, CVE-2025-22124,\nCVE-2025-22125, CVE-2025-23129, CVE-2025-23130, CVE-2025-23133,\nCVE-2025-23143, CVE-2025-37860, CVE-2025-38105, CVE-2025-38502,\nCVE-2025-38556, CVE-2025-38627, CVE-2025-38643, CVE-2025-38709,\nCVE-2025-39678, CVE-2025-39697, CVE-2025-39805, CVE-2025-39806,\nCVE-2025-39807, CVE-2025-39808, CVE-2025-39810, CVE-2025-39811,\nCVE-2025-39812, CVE-2025-39813, CVE-2025-39815, CVE-2025-39817,\nCVE-2025-39819, CVE-2025-39823, CVE-2025-39824, CVE-2025-39825,\nCVE-2025-39826, CVE-2025-39827, CVE-2025-39828, CVE-2025-39829,\nCVE-2025-39832, CVE-2025-39835, CVE-2025-39836, CVE-2025-39838,\nCVE-2025-39839, CVE-2025-39841, CVE-2025-39842, CVE-2025-39843,\nCVE-2025-39844, CVE-2025-39845, CVE-2025-39846, CVE-2025-39847,\nCVE-2025-39848, CVE-2025-39849, CVE-2025-39850, CVE-2025-39851,\nCVE-2025-39852, CVE-2025-39853, CVE-2025-39854, CVE-2025-39857,\nCVE-2025-39860, CVE-2025-39861, CVE-2025-39863, CVE-2025-39864,\nCVE-2025-39865, CVE-2025-39866, CVE-2025-39869, CVE-2025-39870,\nCVE-2025-39871, CVE-2025-39873, CVE-2025-39876, CVE-2025-39877,\nCVE-2025-39880, CVE-2025-39881, CVE-2025-39883, CVE-2025-39885,\nCVE-2025-39886, CVE-2025-39891, CVE-2025-39894, CVE-2025-39895,\nCVE-2025-39897, CVE-2025-39899, CVE-2025-39901, CVE-2025-39902,\nCVE-2025-39907, CVE-2025-39909, CVE-2025-39911, CVE-2025-39913,\nCVE-2025-39914, CVE-2025-39916, CVE-2025-39920, CVE-2025-39923,\nCVE-2025-39927, CVE-2025-39929, CVE-2025-39931, CVE-2025-39932,\nCVE-2025-39934, CVE-2025-39937, CVE-2025-39938, CVE-2025-39940,\nCVE-2025-39942, CVE-2025-39943, CVE-2025-39944, CVE-2025-39945,\nCVE-2025-39947, CVE-2025-39948, CVE-2025-39949, CVE-2025-39950,\nCVE-2025-39951, CVE-2025-39952, CVE-2025-39953, CVE-2025-39955,\nCVE-2025-39957, CVE-2025-39961, CVE-2025-39965, CVE-2025-39967,\nCVE-2025-39968, CVE-2025-39969, CVE-2025-39970, CVE-2025-39971,\nCVE-2025-39972, CVE-2025-39973, CVE-2025-39977, CVE-2025-39978,\nCVE-2025-39980, CVE-2025-39981, CVE-2025-39982, CVE-2025-39985,\nCVE-2025-39986, CVE-2025-39987, CVE-2025-39988, CVE-2025-39991,\nCVE-2025-39992, CVE-2025-39994, CVE-2025-39995, CVE-2025-39996,\nCVE-2025-39998, CVE-2025-40000, CVE-2025-40001, CVE-2025-40006,\nCVE-2025-40008, CVE-2025-40009, CVE-2025-40010, CVE-2025-40011,\nCVE-2025-40013, CVE-2025-40016, CVE-2025-40020, CVE-2025-40021,\nCVE-2025-40024, CVE-2025-40026, CVE-2025-40027, CVE-2025-40029,\nCVE-2025-40030, CVE-2025-40031, CVE-2025-40032, CVE-2025-40033,\nCVE-2025-40035, CVE-2025-40036, CVE-2025-40037, CVE-2025-40038,\nCVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40047,\nCVE-2025-40048, CVE-2025-40049, CVE-2025-40051, CVE-2025-40052,\nCVE-2025-40053, CVE-2025-40055, CVE-2025-40056, CVE-2025-40057,\nCVE-2025-40058, CVE-2025-40059, CVE-2025-40060, CVE-2025-40061,\nCVE-2025-40062, CVE-2025-40067, CVE-2025-40068, CVE-2025-40070,\nCVE-2025-40071, CVE-2025-40077, CVE-2025-40078, CVE-2025-40079,\nCVE-2025-40080, CVE-2025-40081, CVE-2025-40083, CVE-2025-40084,\nCVE-2025-40085, CVE-2025-40087, CVE-2025-40088, CVE-2025-40092,\nCVE-2025-40093, CVE-2025-40094, CVE-2025-40095, CVE-2025-40096,\nCVE-2025-40099, CVE-2025-40100, CVE-2025-40101, CVE-2025-40103,\nCVE-2025-40104, CVE-2025-40105, CVE-2025-40106, CVE-2025-40107,\nCVE-2025-40109, CVE-2025-40110, CVE-2025-40111, CVE-2025-40112,\nCVE-2025-40115, CVE-2025-40116, CVE-2025-40118, CVE-2025-40120,\nCVE-2025-40121, CVE-2025-40123, CVE-2025-40124, CVE-2025-40125,\nCVE-2025-40126, CVE-2025-40127, CVE-2025-40129, CVE-2025-40134,\nCVE-2025-40137, CVE-2025-40140, CVE-2025-40141, CVE-2025-40153,\nCVE-2025-40154, CVE-2025-40155, CVE-2025-40156, CVE-2025-40159,\nCVE-2025-40160, CVE-2025-40165, CVE-2025-40166, CVE-2025-40167,\nCVE-2025-40169, CVE-2025-40171, CVE-2025-40172, CVE-2025-40173,\nCVE-2025-40176, CVE-2025-40178, CVE-2025-40179, CVE-2025-40180,\nCVE-2025-40183, CVE-2025-40187, CVE-2025-40188, CVE-2025-40192,\nCVE-2025-40193, CVE-2025-40194, CVE-2025-40196, CVE-2025-40198,\nCVE-2025-40200, CVE-2025-40201, CVE-2025-40204, CVE-2025-40205,\nCVE-2025-40206, CVE-2025-40207, CVE-2025-40211, CVE-2025-40218,\nCVE-2025-40219, CVE-2025-40220, CVE-2025-40221, CVE-2025-40223,\nCVE-2025-40226, CVE-2025-40231, CVE-2025-40233, CVE-2025-40235,\nCVE-2025-40237, CVE-2025-40238, CVE-2025-40240, CVE-2025-40242,\nCVE-2025-40243, CVE-2025-40244, CVE-2025-40245, CVE-2025-40248,\nCVE-2025-40250, CVE-2025-40251, CVE-2025-40252, CVE-2025-40253,\nCVE-2025-40254, CVE-2025-40257, CVE-2025-40258, CVE-2025-40259,\nCVE-2025-40261, CVE-2025-40262, CVE-2025-40263, CVE-2025-40264,\nCVE-2025-40266, CVE-2025-40268, CVE-2025-40269, CVE-2025-40271,\nCVE-2025-40272, CVE-2025-40273, CVE-2025-40275, CVE-2025-40277,\nCVE-2025-40278, CVE-2025-40279, CVE-2025-40280, CVE-2025-40281,\nCVE-2025-40282, CVE-2025-40283, CVE-2025-40284, CVE-2025-40285,\nCVE-2025-40286, CVE-2025-40287, CVE-2025-40288, CVE-2025-40289,\nCVE-2025-40292, CVE-2025-40293, CVE-2025-40294, CVE-2025-40301,\nCVE-2025-40303, CVE-2025-40304, CVE-2025-40305, CVE-2025-40306,\nCVE-2025-40307, CVE-2025-40308, CVE-2025-40309, CVE-2025-40310,\nCVE-2025-40311, CVE-2025-40312, CVE-2025-40313, CVE-2025-40314,\nCVE-2025-40315, CVE-2025-40317, CVE-2025-40318, CVE-2025-40319,\nCVE-2025-40320, CVE-2025-40321, CVE-2025-40322, CVE-2025-40323,\nCVE-2025-40324, CVE-2025-40328, CVE-2025-40329, CVE-2025-40331,\nCVE-2025-40333, CVE-2025-40337, CVE-2025-40339, CVE-2025-40341,\nCVE-2025-40342, CVE-2025-40343, CVE-2025-40345, CVE-2025-40346,\nCVE-2025-40347, CVE-2025-40349, CVE-2025-40350, CVE-2025-40351,\nCVE-2025-40353, CVE-2025-40358, CVE-2025-40360, CVE-2025-40363,\nCVE-2025-68168, CVE-2025-68171, CVE-2025-68172, CVE-2025-68173,\nCVE-2025-68176, CVE-2025-68177, CVE-2025-68178, CVE-2025-68179,\nCVE-2025-68180, CVE-2025-68183, CVE-2025-68184, CVE-2025-68185,\nCVE-2025-68190, CVE-2025-68191, CVE-2025-68192, CVE-2025-68194,\nCVE-2025-68198, CVE-2025-68200, CVE-2025-68201, CVE-2025-68204,\nCVE-2025-68208, CVE-2025-68213, CVE-2025-68214, CVE-2025-68217,\nCVE-2025-68218, CVE-2025-68219, CVE-2025-68220, CVE-2025-68222,\nCVE-2025-68223, CVE-2025-68227, CVE-2025-68229, CVE-2025-68231,\nCVE-2025-68233, CVE-2025-68235, CVE-2025-68237, CVE-2025-68238,\nCVE-2025-68241, CVE-2025-68244, CVE-2025-68245, CVE-2025-68246,\nCVE-2025-68249, CVE-2025-68282, CVE-2025-68283, CVE-2025-68284,\nCVE-2025-68285, CVE-2025-68286, CVE-2025-68287, CVE-2025-68288,\nCVE-2025-68289, CVE-2025-68290, CVE-2025-68295, CVE-2025-68297,\nCVE-2025-68301, CVE-2025-68302, CVE-2025-68303, CVE-2025-68305,\nCVE-2025-68307, CVE-2025-68308, CVE-2025-68310, CVE-2025-68311,\nCVE-2025-68312, CVE-2025-68313, CVE-2025-68315, CVE-2025-68320,\nCVE-2025-68321, CVE-2025-68322, CVE-2025-68327, CVE-2025-68328,\nCVE-2025-68330, CVE-2025-68331, CVE-2025-68339, CVE-2025-68340,\nCVE-2025-68342, CVE-2025-68343, CVE-2025-68734)\n","status":"published","published":"2026-03-16T14:03:41Z","modified":"2026-11-03T14:38:36.494075469Z","updated_at":"2026-11-03T15:14:17.286738Z"},{"id":"USN-8095-2","title":"linux-fips, linux-aws-fips, linux-gcp-fips vulnerabilities","description":"\nQualys discovered that several vulnerabilities existed in the AppArmor\nLinux kernel Security Module (LSM). An unprivileged local attacker could\nuse these issues to load, replace, and remove arbitrary AppArmor profiles\ncausing denial of service, exposure of sensitive information (kernel\nmemory), local privilege escalation, or possibly escape a container.\n(LP: #2143853)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - MIPS architecture;\n  - Nios II architecture;\n  - PA-RISC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - Sun Sparc architecture;\n  - User-Mode Linux (UML);\n  - x86 architecture;\n  - Xtensa architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - ATM drivers;\n  - Drivers core;\n  - Block device driver;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Hardware random number generator core;\n  - Character device driver;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - DMA engine subsystem;\n  - ARM SCMI message protocol;\n  - EFI core;\n  - Intel Stratix 10 firmware drivers;\n  - GPU drivers;\n  - HID subsystem;\n  - CoreSight HW tracing drivers;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - Input Device (Tablet) drivers;\n  - IOMMU subsystem;\n  - ISDN/mISDN subsystem;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - Fastrpc Driver;\n  - MOST (Media Oriented Systems Transport) drivers;\n  - MTD block device drivers;\n  - Ethernet bonding driver;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - Texas Instruments network drivers;\n  - Ethernet team driver;\n  - NVME drivers;\n  - PCI subsystem;\n  - PCCARD (PCMCIA/CardBus) bus subsystem;\n  - Performance monitor drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - ARM PM domains;\n  - PPS (Pulse Per Second) driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - Texas Instruments SoC drivers;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - TTY drivers;\n  - Userspace I/O drivers;\n  - Cadence USB3 driver;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Renesas USBHS Controller drivers;\n  - USB Mass Storage drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Framebuffer layer;\n  - Xen hypervisor drivers;\n  - AFS file system;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - File systems infrastructure;\n  - EFI Variable file system;\n  - exFAT file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - GFS2 file system;\n  - HFS file system;\n  - HFS+ file system;\n  - HugeTLB file system;\n  - JFS file system;\n  - KERNFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - OrangeFS file system;\n  - Proc file system;\n  - Diskquota system;\n  - SMB network file system;\n  - SquashFS file system;\n  - UDF file system;\n  - XFS file system;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - BPF subsystem;\n  - Mellanox drivers;\n  - NFS page cache wrapper;\n  - Memory management;\n  - Memory Management;\n  - Media input infrastructure;\n  - Bluetooth subsystem;\n  - IP tunnels definitions;\n  - Network traffic control;\n  - Rose network layer;\n  - Network sockets;\n  - io_uring subsystem;\n  - Control group (cgroup);\n  - Kernel crash support code;\n  - Kernel futex primitives;\n  - PID allocator;\n  - Scheduler infrastructure;\n  - Syscalls implementation;\n  - Timer subsystem;\n  - Tracing infrastructure;\n  - 9P file system network protocol;\n  - Amateur Radio drivers;\n  - B.A.T.M.A.N. meshing protocol;\n  - Ethernet bridge;\n  - Ceph Core library;\n  - Networking core;\n  - Devlink API;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - Open vSwitch;\n  - RF switch subsystem;\n  - SCTP protocol;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Intel ASoC drivers;\n  - QCOM ASoC drivers;\n  - USB sound devices;\n(CVE-2025-21833, CVE-2025-22103, CVE-2025-22105, CVE-2025-22106,\nCVE-2025-22107, CVE-2025-22113, CVE-2025-22121, CVE-2025-22124,\nCVE-2025-22125, CVE-2025-23129, CVE-2025-23130, CVE-2025-23133,\nCVE-2025-23143, CVE-2025-37860, CVE-2025-38105, CVE-2025-38502,\nCVE-2025-38556, CVE-2025-38627, CVE-2025-38643, CVE-2025-38709,\nCVE-2025-39678, CVE-2025-39697, CVE-2025-39805, CVE-2025-39806,\nCVE-2025-39807, CVE-2025-39808, CVE-2025-39810, CVE-2025-39811,\nCVE-2025-39812, CVE-2025-39813, CVE-2025-39815, CVE-2025-39817,\nCVE-2025-39819, CVE-2025-39823, CVE-2025-39824, CVE-2025-39825,\nCVE-2025-39826, CVE-2025-39827, CVE-2025-39828, CVE-2025-39829,\nCVE-2025-39832, CVE-2025-39835, CVE-2025-39836, CVE-2025-39838,\nCVE-2025-39839, CVE-2025-39841, CVE-2025-39842, CVE-2025-39843,\nCVE-2025-39844, CVE-2025-39845, CVE-2025-39846, CVE-2025-39847,\nCVE-2025-39848, CVE-2025-39849, CVE-2025-39850, CVE-2025-39851,\nCVE-2025-39852, CVE-2025-39853, CVE-2025-39854, CVE-2025-39857,\nCVE-2025-39860, CVE-2025-39861, CVE-2025-39863, CVE-2025-39864,\nCVE-2025-39865, CVE-2025-39866, CVE-2025-39869, CVE-2025-39870,\nCVE-2025-39871, CVE-2025-39873, CVE-2025-39876, CVE-2025-39877,\nCVE-2025-39880, CVE-2025-39881, CVE-2025-39883, CVE-2025-39885,\nCVE-2025-39886, CVE-2025-39891, CVE-2025-39894, CVE-2025-39895,\nCVE-2025-39897, CVE-2025-39899, CVE-2025-39901, CVE-2025-39902,\nCVE-2025-39907, CVE-2025-39909, CVE-2025-39911, CVE-2025-39913,\nCVE-2025-39914, CVE-2025-39916, CVE-2025-39920, CVE-2025-39923,\nCVE-2025-39927, CVE-2025-39929, CVE-2025-39931, CVE-2025-39932,\nCVE-2025-39934, CVE-2025-39937, CVE-2025-39938, CVE-2025-39940,\nCVE-2025-39942, CVE-2025-39943, CVE-2025-39944, CVE-2025-39945,\nCVE-2025-39947, CVE-2025-39948, CVE-2025-39949, CVE-2025-39950,\nCVE-2025-39951, CVE-2025-39952, CVE-2025-39953, CVE-2025-39955,\nCVE-2025-39957, CVE-2025-39961, CVE-2025-39965, CVE-2025-39967,\nCVE-2025-39968, CVE-2025-39969, CVE-2025-39970, CVE-2025-39971,\nCVE-2025-39972, CVE-2025-39973, CVE-2025-39977, CVE-2025-39978,\nCVE-2025-39980, CVE-2025-39981, CVE-2025-39982, CVE-2025-39985,\nCVE-2025-39986, CVE-2025-39987, CVE-2025-39988, CVE-2025-39991,\nCVE-2025-39992, CVE-2025-39994, CVE-2025-39995, CVE-2025-39996,\nCVE-2025-39998, CVE-2025-40000, CVE-2025-40001, CVE-2025-40006,\nCVE-2025-40008, CVE-2025-40009, CVE-2025-40010, CVE-2025-40011,\nCVE-2025-40013, CVE-2025-40016, CVE-2025-40020, CVE-2025-40021,\nCVE-2025-40024, CVE-2025-40026, CVE-2025-40027, CVE-2025-40029,\nCVE-2025-40030, CVE-2025-40031, CVE-2025-40032, CVE-2025-40033,\nCVE-2025-40035, CVE-2025-40036, CVE-2025-40037, CVE-2025-40038,\nCVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40047,\nCVE-2025-40048, CVE-2025-40049, CVE-2025-40051, CVE-2025-40052,\nCVE-2025-40053, CVE-2025-40055, CVE-2025-40056, CVE-2025-40057,\nCVE-2025-40058, CVE-2025-40059, CVE-2025-40060, CVE-2025-40061,\nCVE-2025-40062, CVE-2025-40067, CVE-2025-40068, CVE-2025-40070,\nCVE-2025-40071, CVE-2025-40077, CVE-2025-40078, CVE-2025-40079,\nCVE-2025-40080, CVE-2025-40081, CVE-2025-40083, CVE-2025-40084,\nCVE-2025-40085, CVE-2025-40087, CVE-2025-40088, CVE-2025-40092,\nCVE-2025-40093, CVE-2025-40094, CVE-2025-40095, CVE-2025-40096,\nCVE-2025-40099, CVE-2025-40100, CVE-2025-40101, CVE-2025-40103,\nCVE-2025-40104, CVE-2025-40105, CVE-2025-40106, CVE-2025-40107,\nCVE-2025-40109, CVE-2025-40110, CVE-2025-40111, CVE-2025-40112,\nCVE-2025-40115, CVE-2025-40116, CVE-2025-40118, CVE-2025-40120,\nCVE-2025-40121, CVE-2025-40123, CVE-2025-40124, CVE-2025-40125,\nCVE-2025-40126, CVE-2025-40127, CVE-2025-40129, CVE-2025-40134,\nCVE-2025-40137, CVE-2025-40140, CVE-2025-40141, CVE-2025-40153,\nCVE-2025-40154, CVE-2025-40155, CVE-2025-40156, CVE-2025-40159,\nCVE-2025-40160, CVE-2025-40165, CVE-2025-40166, CVE-2025-40167,\nCVE-2025-40169, CVE-2025-40171, CVE-2025-40172, CVE-2025-40173,\nCVE-2025-40176, CVE-2025-40178, CVE-2025-40179, CVE-2025-40180,\nCVE-2025-40183, CVE-2025-40187, CVE-2025-40188, CVE-2025-40192,\nCVE-2025-40193, CVE-2025-40194, CVE-2025-40196, CVE-2025-40198,\nCVE-2025-40200, CVE-2025-40201, CVE-2025-40204, CVE-2025-40205,\nCVE-2025-40206, CVE-2025-40207, CVE-2025-40211, CVE-2025-40218,\nCVE-2025-40219, CVE-2025-40220, CVE-2025-40221, CVE-2025-40223,\nCVE-2025-40226, CVE-2025-40231, CVE-2025-40233, CVE-2025-40235,\nCVE-2025-40237, CVE-2025-40238, CVE-2025-40240, CVE-2025-40242,\nCVE-2025-40243, CVE-2025-40244, CVE-2025-40245, CVE-2025-40248,\nCVE-2025-40250, CVE-2025-40251, CVE-2025-40252, CVE-2025-40253,\nCVE-2025-40254, CVE-2025-40257, CVE-2025-40258, CVE-2025-40259,\nCVE-2025-40261, CVE-2025-40262, CVE-2025-40263, CVE-2025-40264,\nCVE-2025-40266, CVE-2025-40268, CVE-2025-40269, CVE-2025-40271,\nCVE-2025-40272, CVE-2025-40273, CVE-2025-40275, CVE-2025-40277,\nCVE-2025-40278, CVE-2025-40279, CVE-2025-40280, CVE-2025-40281,\nCVE-2025-40282, CVE-2025-40283, CVE-2025-40284, CVE-2025-40285,\nCVE-2025-40286, CVE-2025-40287, CVE-2025-40288, CVE-2025-40289,\nCVE-2025-40292, CVE-2025-40293, CVE-2025-40294, CVE-2025-40301,\nCVE-2025-40303, CVE-2025-40304, CVE-2025-40305, CVE-2025-40306,\nCVE-2025-40307, CVE-2025-40308, CVE-2025-40309, CVE-2025-40310,\nCVE-2025-40311, CVE-2025-40312, CVE-2025-40313, CVE-2025-40314,\nCVE-2025-40315, CVE-2025-40317, CVE-2025-40318, CVE-2025-40319,\nCVE-2025-40320, CVE-2025-40321, CVE-2025-40322, CVE-2025-40323,\nCVE-2025-40324, CVE-2025-40328, CVE-2025-40329, CVE-2025-40331,\nCVE-2025-40333, CVE-2025-40337, CVE-2025-40339, CVE-2025-40341,\nCVE-2025-40342, CVE-2025-40343, CVE-2025-40345, CVE-2025-40346,\nCVE-2025-40347, CVE-2025-40349, CVE-2025-40350, CVE-2025-40351,\nCVE-2025-40353, CVE-2025-40358, CVE-2025-40360, CVE-2025-40363,\nCVE-2025-68168, CVE-2025-68171, CVE-2025-68172, CVE-2025-68173,\nCVE-2025-68176, CVE-2025-68177, CVE-2025-68178, CVE-2025-68179,\nCVE-2025-68180, CVE-2025-68183, CVE-2025-68184, CVE-2025-68185,\nCVE-2025-68190, CVE-2025-68191, CVE-2025-68192, CVE-2025-68194,\nCVE-2025-68198, CVE-2025-68200, CVE-2025-68201, CVE-2025-68204,\nCVE-2025-68208, CVE-2025-68213, CVE-2025-68214, CVE-2025-68217,\nCVE-2025-68218, CVE-2025-68219, CVE-2025-68220, CVE-2025-68222,\nCVE-2025-68223, CVE-2025-68227, CVE-2025-68229, CVE-2025-68231,\nCVE-2025-68233, CVE-2025-68235, CVE-2025-68237, CVE-2025-68238,\nCVE-2025-68241, CVE-2025-68244, CVE-2025-68245, CVE-2025-68246,\nCVE-2025-68249, CVE-2025-68282, CVE-2025-68283, CVE-2025-68284,\nCVE-2025-68285, CVE-2025-68286, CVE-2025-68287, CVE-2025-68288,\nCVE-2025-68289, CVE-2025-68290, CVE-2025-68295, CVE-2025-68297,\nCVE-2025-68301, CVE-2025-68302, CVE-2025-68303, CVE-2025-68305,\nCVE-2025-68307, CVE-2025-68308, CVE-2025-68310, CVE-2025-68311,\nCVE-2025-68312, CVE-2025-68313, CVE-2025-68315, CVE-2025-68320,\nCVE-2025-68321, CVE-2025-68322, CVE-2025-68327, CVE-2025-68328,\nCVE-2025-68330, CVE-2025-68331, CVE-2025-68339, CVE-2025-68340,\nCVE-2025-68342, CVE-2025-68343, CVE-2025-68734)\n","status":"published","published":"2026-03-16T23:02:27Z","modified":"2026-11-03T14:35:38.945380735Z","updated_at":"2026-11-03T15:16:05.953168Z"},{"id":"USN-8095-3","title":"linux-realtime, linux-realtime-6.8 vulnerabilities","description":"Qualys discovered that several vulnerabilities existed in the AppArmor\nLinux kernel Security Module (LSM). An unprivileged local attacker could\nuse these issues to load, replace, and remove arbitrary AppArmor profiles\ncausing denial of service, exposure of sensitive information (kernel\nmemory), local privilege escalation, or possibly escape a container.\n(LP: #2143853)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - MIPS architecture;\n  - Nios II architecture;\n  - PA-RISC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - Sun Sparc architecture;\n  - User-Mode Linux (UML);\n  - x86 architecture;\n  - Xtensa architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - ATM drivers;\n  - Drivers core;\n  - Block device driver;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Hardware random number generator core;\n  - Character device driver;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - DMA engine subsystem;\n  - ARM SCMI message protocol;\n  - EFI core;\n  - Intel Stratix 10 firmware drivers;\n  - GPU drivers;\n  - HID subsystem;\n  - CoreSight HW tracing drivers;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - Input Device (Tablet) drivers;\n  - IOMMU subsystem;\n  - ISDN/mISDN subsystem;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - Fastrpc Driver;\n  - MOST (Media Oriented Systems Transport) drivers;\n  - MTD block device drivers;\n  - Ethernet bonding driver;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - Texas Instruments network drivers;\n  - Ethernet team driver;\n  - NVME drivers;\n  - PCI subsystem;\n  - PCCARD (PCMCIA/CardBus) bus subsystem;\n  - Performance monitor drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - ARM PM domains;\n  - PPS (Pulse Per Second) driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - Texas Instruments SoC drivers;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - TTY drivers;\n  - Userspace I/O drivers;\n  - Cadence USB3 driver;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Renesas USBHS Controller drivers;\n  - USB Mass Storage drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Framebuffer layer;\n  - Xen hypervisor drivers;\n  - AFS file system;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - File systems infrastructure;\n  - EFI Variable file system;\n  - exFAT file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - GFS2 file system;\n  - HFS file system;\n  - HFS+ file system;\n  - HugeTLB file system;\n  - JFS file system;\n  - KERNFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - OrangeFS file system;\n  - Proc file system;\n  - Diskquota system;\n  - SMB network file system;\n  - SquashFS file system;\n  - UDF file system;\n  - XFS file system;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - BPF subsystem;\n  - Mellanox drivers;\n  - NFS page cache wrapper;\n  - Memory management;\n  - Memory Management;\n  - Media input infrastructure;\n  - Bluetooth subsystem;\n  - IP tunnels definitions;\n  - Network traffic control;\n  - Rose network layer;\n  - Network sockets;\n  - io_uring subsystem;\n  - Control group (cgroup);\n  - Kernel crash support code;\n  - Kernel futex primitives;\n  - PID allocator;\n  - Scheduler infrastructure;\n  - Syscalls implementation;\n  - Timer subsystem;\n  - Tracing infrastructure;\n  - 9P file system network protocol;\n  - Amateur Radio drivers;\n  - B.A.T.M.A.N. meshing protocol;\n  - Ethernet bridge;\n  - Ceph Core library;\n  - Networking core;\n  - Devlink API;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - Open vSwitch;\n  - RF switch subsystem;\n  - SCTP protocol;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Intel ASoC drivers;\n  - QCOM ASoC drivers;\n  - USB sound devices;\n(CVE-2025-21833, CVE-2025-22103, CVE-2025-22105, CVE-2025-22106,\nCVE-2025-22107, CVE-2025-22113, CVE-2025-22121, CVE-2025-22124,\nCVE-2025-22125, CVE-2025-23129, CVE-2025-23130, CVE-2025-23133,\nCVE-2025-23143, CVE-2025-37860, CVE-2025-38105, CVE-2025-38502,\nCVE-2025-38556, CVE-2025-38627, CVE-2025-38643, CVE-2025-38709,\nCVE-2025-39678, CVE-2025-39697, CVE-2025-39805, CVE-2025-39806,\nCVE-2025-39807, CVE-2025-39808, CVE-2025-39810, CVE-2025-39811,\nCVE-2025-39812, CVE-2025-39813, CVE-2025-39815, CVE-2025-39817,\nCVE-2025-39819, CVE-2025-39823, CVE-2025-39824, CVE-2025-39825,\nCVE-2025-39826, CVE-2025-39827, CVE-2025-39828, CVE-2025-39829,\nCVE-2025-39832, CVE-2025-39835, CVE-2025-39836, CVE-2025-39838,\nCVE-2025-39839, CVE-2025-39841, CVE-2025-39842, CVE-2025-39843,\nCVE-2025-39844, CVE-2025-39845, CVE-2025-39846, CVE-2025-39847,\nCVE-2025-39848, CVE-2025-39849, CVE-2025-39850, CVE-2025-39851,\nCVE-2025-39852, CVE-2025-39853, CVE-2025-39854, CVE-2025-39857,\nCVE-2025-39860, CVE-2025-39861, CVE-2025-39863, CVE-2025-39864,\nCVE-2025-39865, CVE-2025-39866, CVE-2025-39869, CVE-2025-39870,\nCVE-2025-39871, CVE-2025-39873, CVE-2025-39876, CVE-2025-39877,\nCVE-2025-39880, CVE-2025-39881, CVE-2025-39883, CVE-2025-39885,\nCVE-2025-39886, CVE-2025-39891, CVE-2025-39894, CVE-2025-39895,\nCVE-2025-39897, CVE-2025-39899, CVE-2025-39901, CVE-2025-39902,\nCVE-2025-39907, CVE-2025-39909, CVE-2025-39911, CVE-2025-39913,\nCVE-2025-39914, CVE-2025-39916, CVE-2025-39920, CVE-2025-39923,\nCVE-2025-39927, CVE-2025-39929, CVE-2025-39931, CVE-2025-39932,\nCVE-2025-39934, CVE-2025-39937, CVE-2025-39938, CVE-2025-39940,\nCVE-2025-39942, CVE-2025-39943, CVE-2025-39944, CVE-2025-39945,\nCVE-2025-39947, CVE-2025-39948, CVE-2025-39949, CVE-2025-39950,\nCVE-2025-39951, CVE-2025-39952, CVE-2025-39953, CVE-2025-39955,\nCVE-2025-39957, CVE-2025-39961, CVE-2025-39965, CVE-2025-39967,\nCVE-2025-39968, CVE-2025-39969, CVE-2025-39970, CVE-2025-39971,\nCVE-2025-39972, CVE-2025-39973, CVE-2025-39977, CVE-2025-39978,\nCVE-2025-39980, CVE-2025-39981, CVE-2025-39982, CVE-2025-39985,\nCVE-2025-39986, CVE-2025-39987, CVE-2025-39988, CVE-2025-39991,\nCVE-2025-39992, CVE-2025-39994, CVE-2025-39995, CVE-2025-39996,\nCVE-2025-39998, CVE-2025-40000, CVE-2025-40001, CVE-2025-40006,\nCVE-2025-40008, CVE-2025-40009, CVE-2025-40010, CVE-2025-40011,\nCVE-2025-40013, CVE-2025-40016, CVE-2025-40020, CVE-2025-40021,\nCVE-2025-40024, CVE-2025-40026, CVE-2025-40027, CVE-2025-40029,\nCVE-2025-40030, CVE-2025-40031, CVE-2025-40032, CVE-2025-40033,\nCVE-2025-40035, CVE-2025-40036, CVE-2025-40037, CVE-2025-40038,\nCVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40047,\nCVE-2025-40048, CVE-2025-40049, CVE-2025-40051, CVE-2025-40052,\nCVE-2025-40053, CVE-2025-40055, CVE-2025-40056, CVE-2025-40057,\nCVE-2025-40058, CVE-2025-40059, CVE-2025-40060, CVE-2025-40061,\nCVE-2025-40062, CVE-2025-40067, CVE-2025-40068, CVE-2025-40070,\nCVE-2025-40071, CVE-2025-40077, CVE-2025-40078, CVE-2025-40079,\nCVE-2025-40080, CVE-2025-40081, CVE-2025-40083, CVE-2025-40084,\nCVE-2025-40085, CVE-2025-40087, CVE-2025-40088, CVE-2025-40092,\nCVE-2025-40093, CVE-2025-40094, CVE-2025-40095, CVE-2025-40096,\nCVE-2025-40099, CVE-2025-40100, CVE-2025-40101, CVE-2025-40103,\nCVE-2025-40104, CVE-2025-40105, CVE-2025-40106, CVE-2025-40107,\nCVE-2025-40109, CVE-2025-40110, CVE-2025-40111, CVE-2025-40112,\nCVE-2025-40115, CVE-2025-40116, CVE-2025-40118, CVE-2025-40120,\nCVE-2025-40121, CVE-2025-40123, CVE-2025-40124, CVE-2025-40125,\nCVE-2025-40126, CVE-2025-40127, CVE-2025-40129, CVE-2025-40134,\nCVE-2025-40137, CVE-2025-40140, CVE-2025-40141, CVE-2025-40153,\nCVE-2025-40154, CVE-2025-40155, CVE-2025-40156, CVE-2025-40159,\nCVE-2025-40160, CVE-2025-40165, CVE-2025-40166, CVE-2025-40167,\nCVE-2025-40169, CVE-2025-40171, CVE-2025-40172, CVE-2025-40173,\nCVE-2025-40176, CVE-2025-40178, CVE-2025-40179, CVE-2025-40180,\nCVE-2025-40183, CVE-2025-40187, CVE-2025-40188, CVE-2025-40192,\nCVE-2025-40193, CVE-2025-40194, CVE-2025-40196, CVE-2025-40198,\nCVE-2025-40200, CVE-2025-40201, CVE-2025-40204, CVE-2025-40205,\nCVE-2025-40206, CVE-2025-40207, CVE-2025-40211, CVE-2025-40218,\nCVE-2025-40219, CVE-2025-40220, CVE-2025-40221, CVE-2025-40223,\nCVE-2025-40226, CVE-2025-40231, CVE-2025-40233, CVE-2025-40235,\nCVE-2025-40237, CVE-2025-40238, CVE-2025-40240, CVE-2025-40242,\nCVE-2025-40243, CVE-2025-40244, CVE-2025-40245, CVE-2025-40248,\nCVE-2025-40250, CVE-2025-40251, CVE-2025-40252, CVE-2025-40253,\nCVE-2025-40254, CVE-2025-40257, CVE-2025-40258, CVE-2025-40259,\nCVE-2025-40261, CVE-2025-40262, CVE-2025-40263, CVE-2025-40264,\nCVE-2025-40266, CVE-2025-40268, CVE-2025-40269, CVE-2025-40271,\nCVE-2025-40272, CVE-2025-40273, CVE-2025-40275, CVE-2025-40277,\nCVE-2025-40278, CVE-2025-40279, CVE-2025-40280, CVE-2025-40281,\nCVE-2025-40282, CVE-2025-40283, CVE-2025-40284, CVE-2025-40285,\nCVE-2025-40286, CVE-2025-40287, CVE-2025-40288, CVE-2025-40289,\nCVE-2025-40292, CVE-2025-40293, CVE-2025-40294, CVE-2025-40301,\nCVE-2025-40303, CVE-2025-40304, CVE-2025-40305, CVE-2025-40306,\nCVE-2025-40307, CVE-2025-40308, CVE-2025-40309, CVE-2025-40310,\nCVE-2025-40311, CVE-2025-40312, CVE-2025-40313, CVE-2025-40314,\nCVE-2025-40315, CVE-2025-40317, CVE-2025-40318, CVE-2025-40319,\nCVE-2025-40320, CVE-2025-40321, CVE-2025-40322, CVE-2025-40323,\nCVE-2025-40324, CVE-2025-40328, CVE-2025-40329, CVE-2025-40331,\nCVE-2025-40333, CVE-2025-40337, CVE-2025-40339, CVE-2025-40341,\nCVE-2025-40342, CVE-2025-40343, CVE-2025-40345, CVE-2025-40346,\nCVE-2025-40347, CVE-2025-40349, CVE-2025-40350, CVE-2025-40351,\nCVE-2025-40353, CVE-2025-40358, CVE-2025-40360, CVE-2025-40363,\nCVE-2025-68168, CVE-2025-68171, CVE-2025-68172, CVE-2025-68173,\nCVE-2025-68176, CVE-2025-68177, CVE-2025-68178, CVE-2025-68179,\nCVE-2025-68180, CVE-2025-68183, CVE-2025-68184, CVE-2025-68185,\nCVE-2025-68190, CVE-2025-68191, CVE-2025-68192, CVE-2025-68194,\nCVE-2025-68198, CVE-2025-68200, CVE-2025-68201, CVE-2025-68204,\nCVE-2025-68208, CVE-2025-68213, CVE-2025-68214, CVE-2025-68217,\nCVE-2025-68218, CVE-2025-68219, CVE-2025-68220, CVE-2025-68222,\nCVE-2025-68223, CVE-2025-68227, CVE-2025-68229, CVE-2025-68231,\nCVE-2025-68233, CVE-2025-68235, CVE-2025-68237, CVE-2025-68238,\nCVE-2025-68241, CVE-2025-68244, CVE-2025-68245, CVE-2025-68246,\nCVE-2025-68249, CVE-2025-68282, CVE-2025-68283, CVE-2025-68284,\nCVE-2025-68285, CVE-2025-68286, CVE-2025-68287, CVE-2025-68288,\nCVE-2025-68289, CVE-2025-68290, CVE-2025-68295, CVE-2025-68297,\nCVE-2025-68301, CVE-2025-68302, CVE-2025-68303, CVE-2025-68305,\nCVE-2025-68307, CVE-2025-68308, CVE-2025-68310, CVE-2025-68311,\nCVE-2025-68312, CVE-2025-68313, CVE-2025-68315, CVE-2025-68320,\nCVE-2025-68321, CVE-2025-68322, CVE-2025-68327, CVE-2025-68328,\nCVE-2025-68330, CVE-2025-68331, CVE-2025-68339, CVE-2025-68340,\nCVE-2025-68342, CVE-2025-68343, CVE-2025-68734)\n","status":"published","published":"2026-03-17T18:06:26Z","modified":"2026-11-03T14:34:41.040000385Z","updated_at":"2026-11-03T15:16:54.00292Z"},{"id":"USN-8095-4","title":"linux-aws-6.8 vulnerabilities","description":"Qualys discovered that several vulnerabilities existed in the AppArmor\nLinux kernel Security Module (LSM). An unprivileged local attacker could\nuse these issues to load, replace, and remove arbitrary AppArmor profiles\ncausing denial of service, exposure of sensitive information (kernel\nmemory), local privilege escalation, or possibly escape a container.\n(LP: #2143853)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - MIPS architecture;\n  - Nios II architecture;\n  - PA-RISC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - Sun Sparc architecture;\n  - User-Mode Linux (UML);\n  - x86 architecture;\n  - Xtensa architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - ATM drivers;\n  - Drivers core;\n  - Block device driver;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Hardware random number generator core;\n  - Character device driver;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - DMA engine subsystem;\n  - ARM SCMI message protocol;\n  - EFI core;\n  - Intel Stratix 10 firmware drivers;\n  - GPU drivers;\n  - HID subsystem;\n  - CoreSight HW tracing drivers;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - Input Device (Tablet) drivers;\n  - IOMMU subsystem;\n  - ISDN/mISDN subsystem;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - Fastrpc Driver;\n  - MOST (Media Oriented Systems Transport) drivers;\n  - MTD block device drivers;\n  - Ethernet bonding driver;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - Texas Instruments network drivers;\n  - Ethernet team driver;\n  - NVME drivers;\n  - PCI subsystem;\n  - PCCARD (PCMCIA/CardBus) bus subsystem;\n  - Performance monitor drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - ARM PM domains;\n  - PPS (Pulse Per Second) driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - Texas Instruments SoC drivers;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - TTY drivers;\n  - Userspace I/O drivers;\n  - Cadence USB3 driver;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Renesas USBHS Controller drivers;\n  - USB Mass Storage drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Framebuffer layer;\n  - Xen hypervisor drivers;\n  - AFS file system;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - File systems infrastructure;\n  - EFI Variable file system;\n  - exFAT file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - GFS2 file system;\n  - HFS file system;\n  - HFS+ file system;\n  - HugeTLB file system;\n  - JFS file system;\n  - KERNFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - OrangeFS file system;\n  - Proc file system;\n  - Diskquota system;\n  - SMB network file system;\n  - SquashFS file system;\n  - UDF file system;\n  - XFS file system;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - BPF subsystem;\n  - Mellanox drivers;\n  - NFS page cache wrapper;\n  - Memory management;\n  - Memory Management;\n  - Media input infrastructure;\n  - Bluetooth subsystem;\n  - IP tunnels definitions;\n  - Network traffic control;\n  - Rose network layer;\n  - Network sockets;\n  - io_uring subsystem;\n  - Control group (cgroup);\n  - Kernel crash support code;\n  - Kernel futex primitives;\n  - PID allocator;\n  - Scheduler infrastructure;\n  - Syscalls implementation;\n  - Timer subsystem;\n  - Tracing infrastructure;\n  - 9P file system network protocol;\n  - Amateur Radio drivers;\n  - B.A.T.M.A.N. meshing protocol;\n  - Ethernet bridge;\n  - Ceph Core library;\n  - Networking core;\n  - Devlink API;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - Open vSwitch;\n  - RF switch subsystem;\n  - SCTP protocol;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Intel ASoC drivers;\n  - QCOM ASoC drivers;\n  - USB sound devices;\n(CVE-2025-21833, CVE-2025-22103, CVE-2025-22105, CVE-2025-22106,\nCVE-2025-22107, CVE-2025-22113, CVE-2025-22121, CVE-2025-22124,\nCVE-2025-22125, CVE-2025-23129, CVE-2025-23130, CVE-2025-23133,\nCVE-2025-23143, CVE-2025-37860, CVE-2025-38105, CVE-2025-38502,\nCVE-2025-38556, CVE-2025-38627, CVE-2025-38643, CVE-2025-38709,\nCVE-2025-39678, CVE-2025-39697, CVE-2025-39805, CVE-2025-39806,\nCVE-2025-39807, CVE-2025-39808, CVE-2025-39810, CVE-2025-39811,\nCVE-2025-39812, CVE-2025-39813, CVE-2025-39815, CVE-2025-39817,\nCVE-2025-39819, CVE-2025-39823, CVE-2025-39824, CVE-2025-39825,\nCVE-2025-39826, CVE-2025-39827, CVE-2025-39828, CVE-2025-39829,\nCVE-2025-39832, CVE-2025-39835, CVE-2025-39836, CVE-2025-39838,\nCVE-2025-39839, CVE-2025-39841, CVE-2025-39842, CVE-2025-39843,\nCVE-2025-39844, CVE-2025-39845, CVE-2025-39846, CVE-2025-39847,\nCVE-2025-39848, CVE-2025-39849, CVE-2025-39850, CVE-2025-39851,\nCVE-2025-39852, CVE-2025-39853, CVE-2025-39854, CVE-2025-39857,\nCVE-2025-39860, CVE-2025-39861, CVE-2025-39863, CVE-2025-39864,\nCVE-2025-39865, CVE-2025-39866, CVE-2025-39869, CVE-2025-39870,\nCVE-2025-39871, CVE-2025-39873, CVE-2025-39876, CVE-2025-39877,\nCVE-2025-39880, CVE-2025-39881, CVE-2025-39883, CVE-2025-39885,\nCVE-2025-39886, CVE-2025-39891, CVE-2025-39894, CVE-2025-39895,\nCVE-2025-39897, CVE-2025-39899, CVE-2025-39901, CVE-2025-39902,\nCVE-2025-39907, CVE-2025-39909, CVE-2025-39911, CVE-2025-39913,\nCVE-2025-39914, CVE-2025-39916, CVE-2025-39920, CVE-2025-39923,\nCVE-2025-39927, CVE-2025-39929, CVE-2025-39931, CVE-2025-39932,\nCVE-2025-39934, CVE-2025-39937, CVE-2025-39938, CVE-2025-39940,\nCVE-2025-39942, CVE-2025-39943, CVE-2025-39944, CVE-2025-39945,\nCVE-2025-39947, CVE-2025-39948, CVE-2025-39949, CVE-2025-39950,\nCVE-2025-39951, CVE-2025-39952, CVE-2025-39953, CVE-2025-39955,\nCVE-2025-39957, CVE-2025-39961, CVE-2025-39965, CVE-2025-39967,\nCVE-2025-39968, CVE-2025-39969, CVE-2025-39970, CVE-2025-39971,\nCVE-2025-39972, CVE-2025-39973, CVE-2025-39977, CVE-2025-39978,\nCVE-2025-39980, CVE-2025-39981, CVE-2025-39982, CVE-2025-39985,\nCVE-2025-39986, CVE-2025-39987, CVE-2025-39988, CVE-2025-39991,\nCVE-2025-39992, CVE-2025-39994, CVE-2025-39995, CVE-2025-39996,\nCVE-2025-39998, CVE-2025-40000, CVE-2025-40001, CVE-2025-40006,\nCVE-2025-40008, CVE-2025-40009, CVE-2025-40010, CVE-2025-40011,\nCVE-2025-40013, CVE-2025-40016, CVE-2025-40020, CVE-2025-40021,\nCVE-2025-40024, CVE-2025-40026, CVE-2025-40027, CVE-2025-40029,\nCVE-2025-40030, CVE-2025-40031, CVE-2025-40032, CVE-2025-40033,\nCVE-2025-40035, CVE-2025-40036, CVE-2025-40037, CVE-2025-40038,\nCVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40047,\nCVE-2025-40048, CVE-2025-40049, CVE-2025-40051, CVE-2025-40052,\nCVE-2025-40053, CVE-2025-40055, CVE-2025-40056, CVE-2025-40057,\nCVE-2025-40058, CVE-2025-40059, CVE-2025-40060, CVE-2025-40061,\nCVE-2025-40062, CVE-2025-40067, CVE-2025-40068, CVE-2025-40070,\nCVE-2025-40071, CVE-2025-40077, CVE-2025-40078, CVE-2025-40079,\nCVE-2025-40080, CVE-2025-40081, CVE-2025-40083, CVE-2025-40084,\nCVE-2025-40085, CVE-2025-40087, CVE-2025-40088, CVE-2025-40092,\nCVE-2025-40093, CVE-2025-40094, CVE-2025-40095, CVE-2025-40096,\nCVE-2025-40099, CVE-2025-40100, CVE-2025-40101, CVE-2025-40103,\nCVE-2025-40104, CVE-2025-40105, CVE-2025-40106, CVE-2025-40107,\nCVE-2025-40109, CVE-2025-40110, CVE-2025-40111, CVE-2025-40112,\nCVE-2025-40115, CVE-2025-40116, CVE-2025-40118, CVE-2025-40120,\nCVE-2025-40121, CVE-2025-40123, CVE-2025-40124, CVE-2025-40125,\nCVE-2025-40126, CVE-2025-40127, CVE-2025-40129, CVE-2025-40134,\nCVE-2025-40137, CVE-2025-40140, CVE-2025-40141, CVE-2025-40153,\nCVE-2025-40154, CVE-2025-40155, CVE-2025-40156, CVE-2025-40159,\nCVE-2025-40160, CVE-2025-40165, CVE-2025-40166, CVE-2025-40167,\nCVE-2025-40169, CVE-2025-40171, CVE-2025-40172, CVE-2025-40173,\nCVE-2025-40176, CVE-2025-40178, CVE-2025-40179, CVE-2025-40180,\nCVE-2025-40183, CVE-2025-40187, CVE-2025-40188, CVE-2025-40192,\nCVE-2025-40193, CVE-2025-40194, CVE-2025-40196, CVE-2025-40198,\nCVE-2025-40200, CVE-2025-40201, CVE-2025-40204, CVE-2025-40205,\nCVE-2025-40206, CVE-2025-40207, CVE-2025-40211, CVE-2025-40218,\nCVE-2025-40219, CVE-2025-40220, CVE-2025-40221, CVE-2025-40223,\nCVE-2025-40226, CVE-2025-40231, CVE-2025-40233, CVE-2025-40235,\nCVE-2025-40237, CVE-2025-40238, CVE-2025-40240, CVE-2025-40242,\nCVE-2025-40243, CVE-2025-40244, CVE-2025-40245, CVE-2025-40248,\nCVE-2025-40250, CVE-2025-40251, CVE-2025-40252, CVE-2025-40253,\nCVE-2025-40254, CVE-2025-40257, CVE-2025-40258, CVE-2025-40259,\nCVE-2025-40261, CVE-2025-40262, CVE-2025-40263, CVE-2025-40264,\nCVE-2025-40266, CVE-2025-40268, CVE-2025-40269, CVE-2025-40271,\nCVE-2025-40272, CVE-2025-40273, CVE-2025-40275, CVE-2025-40277,\nCVE-2025-40278, CVE-2025-40279, CVE-2025-40280, CVE-2025-40281,\nCVE-2025-40282, CVE-2025-40283, CVE-2025-40284, CVE-2025-40285,\nCVE-2025-40286, CVE-2025-40287, CVE-2025-40288, CVE-2025-40289,\nCVE-2025-40292, CVE-2025-40293, CVE-2025-40294, CVE-2025-40301,\nCVE-2025-40303, CVE-2025-40304, CVE-2025-40305, CVE-2025-40306,\nCVE-2025-40307, CVE-2025-40308, CVE-2025-40309, CVE-2025-40310,\nCVE-2025-40311, CVE-2025-40312, CVE-2025-40313, CVE-2025-40314,\nCVE-2025-40315, CVE-2025-40317, CVE-2025-40318, CVE-2025-40319,\nCVE-2025-40320, CVE-2025-40321, CVE-2025-40322, CVE-2025-40323,\nCVE-2025-40324, CVE-2025-40328, CVE-2025-40329, CVE-2025-40331,\nCVE-2025-40333, CVE-2025-40337, CVE-2025-40339, CVE-2025-40341,\nCVE-2025-40342, CVE-2025-40343, CVE-2025-40345, CVE-2025-40346,\nCVE-2025-40347, CVE-2025-40349, CVE-2025-40350, CVE-2025-40351,\nCVE-2025-40353, CVE-2025-40358, CVE-2025-40360, CVE-2025-40363,\nCVE-2025-68168, CVE-2025-68171, CVE-2025-68172, CVE-2025-68173,\nCVE-2025-68176, CVE-2025-68177, CVE-2025-68178, CVE-2025-68179,\nCVE-2025-68180, CVE-2025-68183, CVE-2025-68184, CVE-2025-68185,\nCVE-2025-68190, CVE-2025-68191, CVE-2025-68192, CVE-2025-68194,\nCVE-2025-68198, CVE-2025-68200, CVE-2025-68201, CVE-2025-68204,\nCVE-2025-68208, CVE-2025-68213, CVE-2025-68214, CVE-2025-68217,\nCVE-2025-68218, CVE-2025-68219, CVE-2025-68220, CVE-2025-68222,\nCVE-2025-68223, CVE-2025-68227, CVE-2025-68229, CVE-2025-68231,\nCVE-2025-68233, CVE-2025-68235, CVE-2025-68237, CVE-2025-68238,\nCVE-2025-68241, CVE-2025-68244, CVE-2025-68245, CVE-2025-68246,\nCVE-2025-68249, CVE-2025-68282, CVE-2025-68283, CVE-2025-68284,\nCVE-2025-68285, CVE-2025-68286, CVE-2025-68287, CVE-2025-68288,\nCVE-2025-68289, CVE-2025-68290, CVE-2025-68295, CVE-2025-68297,\nCVE-2025-68301, CVE-2025-68302, CVE-2025-68303, CVE-2025-68305,\nCVE-2025-68307, CVE-2025-68308, CVE-2025-68310, CVE-2025-68311,\nCVE-2025-68312, CVE-2025-68313, CVE-2025-68315, CVE-2025-68320,\nCVE-2025-68321, CVE-2025-68322, CVE-2025-68327, CVE-2025-68328,\nCVE-2025-68330, CVE-2025-68331, CVE-2025-68339, CVE-2025-68340,\nCVE-2025-68342, CVE-2025-68343, CVE-2025-68734)\n","status":"published","published":"2026-03-23T14:01:42Z","modified":"2026-11-03T14:35:07.834088684Z","updated_at":"2026-11-03T15:16:36.034517Z"},{"id":"USN-8095-5","title":"linux-raspi, linux-raspi-realtime vulnerabilities","description":"Qualys discovered that several vulnerabilities existed in the AppArmor\nLinux kernel Security Module (LSM). An unprivileged local attacker could\nuse these issues to load, replace, and remove arbitrary AppArmor profiles\ncausing denial of service, exposure of sensitive information (kernel\nmemory), local privilege escalation, or possibly escape a container.\n(LP: #2143853)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - MIPS architecture;\n  - Nios II architecture;\n  - PA-RISC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - Sun Sparc architecture;\n  - User-Mode Linux (UML);\n  - x86 architecture;\n  - Xtensa architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - ATM drivers;\n  - Drivers core;\n  - Block device driver;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Hardware random number generator core;\n  - Character device driver;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - DMA engine subsystem;\n  - ARM SCMI message protocol;\n  - EFI core;\n  - Intel Stratix 10 firmware drivers;\n  - GPU drivers;\n  - HID subsystem;\n  - CoreSight HW tracing drivers;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - Input Device (Tablet) drivers;\n  - IOMMU subsystem;\n  - ISDN/mISDN subsystem;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - Fastrpc Driver;\n  - MOST (Media Oriented Systems Transport) drivers;\n  - MTD block device drivers;\n  - Ethernet bonding driver;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - Texas Instruments network drivers;\n  - Ethernet team driver;\n  - NVME drivers;\n  - PCI subsystem;\n  - PCCARD (PCMCIA/CardBus) bus subsystem;\n  - Performance monitor drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - ARM PM domains;\n  - PPS (Pulse Per Second) driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - Texas Instruments SoC drivers;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - TTY drivers;\n  - Userspace I/O drivers;\n  - Cadence USB3 driver;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Renesas USBHS Controller drivers;\n  - USB Mass Storage drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Framebuffer layer;\n  - Xen hypervisor drivers;\n  - AFS file system;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - File systems infrastructure;\n  - EFI Variable file system;\n  - exFAT file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - GFS2 file system;\n  - HFS file system;\n  - HFS+ file system;\n  - HugeTLB file system;\n  - JFS file system;\n  - KERNFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - OrangeFS file system;\n  - Proc file system;\n  - Diskquota system;\n  - SMB network file system;\n  - SquashFS file system;\n  - UDF file system;\n  - XFS file system;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - BPF subsystem;\n  - Mellanox drivers;\n  - NFS page cache wrapper;\n  - Memory management;\n  - Memory Management;\n  - Media input infrastructure;\n  - Bluetooth subsystem;\n  - IP tunnels definitions;\n  - Network traffic control;\n  - Rose network layer;\n  - Network sockets;\n  - io_uring subsystem;\n  - Control group (cgroup);\n  - Kernel crash support code;\n  - Kernel futex primitives;\n  - PID allocator;\n  - Scheduler infrastructure;\n  - Syscalls implementation;\n  - Timer subsystem;\n  - Tracing infrastructure;\n  - 9P file system network protocol;\n  - Amateur Radio drivers;\n  - B.A.T.M.A.N. meshing protocol;\n  - Ethernet bridge;\n  - Ceph Core library;\n  - Networking core;\n  - Devlink API;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - Open vSwitch;\n  - RF switch subsystem;\n  - SCTP protocol;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Intel ASoC drivers;\n  - QCOM ASoC drivers;\n  - USB sound devices;\n(CVE-2025-21833, CVE-2025-22103, CVE-2025-22105, CVE-2025-22106,\nCVE-2025-22107, CVE-2025-22113, CVE-2025-22121, CVE-2025-22124,\nCVE-2025-22125, CVE-2025-23129, CVE-2025-23130, CVE-2025-23133,\nCVE-2025-23143, CVE-2025-37860, CVE-2025-38105, CVE-2025-38502,\nCVE-2025-38556, CVE-2025-38627, CVE-2025-38643, CVE-2025-38709,\nCVE-2025-39678, CVE-2025-39697, CVE-2025-39805, CVE-2025-39806,\nCVE-2025-39807, CVE-2025-39808, CVE-2025-39810, CVE-2025-39811,\nCVE-2025-39812, CVE-2025-39813, CVE-2025-39815, CVE-2025-39817,\nCVE-2025-39819, CVE-2025-39823, CVE-2025-39824, CVE-2025-39825,\nCVE-2025-39826, CVE-2025-39827, CVE-2025-39828, CVE-2025-39829,\nCVE-2025-39832, CVE-2025-39835, CVE-2025-39836, CVE-2025-39838,\nCVE-2025-39839, CVE-2025-39841, CVE-2025-39842, CVE-2025-39843,\nCVE-2025-39844, CVE-2025-39845, CVE-2025-39846, CVE-2025-39847,\nCVE-2025-39848, CVE-2025-39849, CVE-2025-39850, CVE-2025-39851,\nCVE-2025-39852, CVE-2025-39853, CVE-2025-39854, CVE-2025-39857,\nCVE-2025-39860, CVE-2025-39861, CVE-2025-39863, CVE-2025-39864,\nCVE-2025-39865, CVE-2025-39866, CVE-2025-39869, CVE-2025-39870,\nCVE-2025-39871, CVE-2025-39873, CVE-2025-39876, CVE-2025-39877,\nCVE-2025-39880, CVE-2025-39881, CVE-2025-39883, CVE-2025-39885,\nCVE-2025-39886, CVE-2025-39891, CVE-2025-39894, CVE-2025-39895,\nCVE-2025-39897, CVE-2025-39899, CVE-2025-39901, CVE-2025-39902,\nCVE-2025-39907, CVE-2025-39909, CVE-2025-39911, CVE-2025-39913,\nCVE-2025-39914, CVE-2025-39916, CVE-2025-39920, CVE-2025-39923,\nCVE-2025-39927, CVE-2025-39929, CVE-2025-39931, CVE-2025-39932,\nCVE-2025-39934, CVE-2025-39937, CVE-2025-39938, CVE-2025-39940,\nCVE-2025-39942, CVE-2025-39943, CVE-2025-39944, CVE-2025-39945,\nCVE-2025-39947, CVE-2025-39948, CVE-2025-39949, CVE-2025-39950,\nCVE-2025-39951, CVE-2025-39952, CVE-2025-39953, CVE-2025-39955,\nCVE-2025-39957, CVE-2025-39961, CVE-2025-39965, CVE-2025-39967,\nCVE-2025-39968, CVE-2025-39969, CVE-2025-39970, CVE-2025-39971,\nCVE-2025-39972, CVE-2025-39973, CVE-2025-39977, CVE-2025-39978,\nCVE-2025-39980, CVE-2025-39981, CVE-2025-39982, CVE-2025-39985,\nCVE-2025-39986, CVE-2025-39987, CVE-2025-39988, CVE-2025-39991,\nCVE-2025-39992, CVE-2025-39994, CVE-2025-39995, CVE-2025-39996,\nCVE-2025-39998, CVE-2025-40000, CVE-2025-40001, CVE-2025-40006,\nCVE-2025-40008, CVE-2025-40009, CVE-2025-40010, CVE-2025-40011,\nCVE-2025-40013, CVE-2025-40016, CVE-2025-40020, CVE-2025-40021,\nCVE-2025-40024, CVE-2025-40026, CVE-2025-40027, CVE-2025-40029,\nCVE-2025-40030, CVE-2025-40031, CVE-2025-40032, CVE-2025-40033,\nCVE-2025-40035, CVE-2025-40036, CVE-2025-40037, CVE-2025-40038,\nCVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40047,\nCVE-2025-40048, CVE-2025-40049, CVE-2025-40051, CVE-2025-40052,\nCVE-2025-40053, CVE-2025-40055, CVE-2025-40056, CVE-2025-40057,\nCVE-2025-40058, CVE-2025-40059, CVE-2025-40060, CVE-2025-40061,\nCVE-2025-40062, CVE-2025-40067, CVE-2025-40068, CVE-2025-40070,\nCVE-2025-40071, CVE-2025-40077, CVE-2025-40078, CVE-2025-40079,\nCVE-2025-40080, CVE-2025-40081, CVE-2025-40083, CVE-2025-40084,\nCVE-2025-40085, CVE-2025-40087, CVE-2025-40088, CVE-2025-40092,\nCVE-2025-40093, CVE-2025-40094, CVE-2025-40095, CVE-2025-40096,\nCVE-2025-40099, CVE-2025-40100, CVE-2025-40101, CVE-2025-40103,\nCVE-2025-40104, CVE-2025-40105, CVE-2025-40106, CVE-2025-40107,\nCVE-2025-40109, CVE-2025-40110, CVE-2025-40111, CVE-2025-40112,\nCVE-2025-40115, CVE-2025-40116, CVE-2025-40118, CVE-2025-40120,\nCVE-2025-40121, CVE-2025-40123, CVE-2025-40124, CVE-2025-40125,\nCVE-2025-40126, CVE-2025-40127, CVE-2025-40129, CVE-2025-40134,\nCVE-2025-40137, CVE-2025-40140, CVE-2025-40141, CVE-2025-40153,\nCVE-2025-40154, CVE-2025-40155, CVE-2025-40156, CVE-2025-40159,\nCVE-2025-40160, CVE-2025-40165, CVE-2025-40166, CVE-2025-40167,\nCVE-2025-40169, CVE-2025-40171, CVE-2025-40172, CVE-2025-40173,\nCVE-2025-40176, CVE-2025-40178, CVE-2025-40179, CVE-2025-40180,\nCVE-2025-40183, CVE-2025-40187, CVE-2025-40188, CVE-2025-40192,\nCVE-2025-40193, CVE-2025-40194, CVE-2025-40196, CVE-2025-40198,\nCVE-2025-40200, CVE-2025-40201, CVE-2025-40204, CVE-2025-40205,\nCVE-2025-40206, CVE-2025-40207, CVE-2025-40211, CVE-2025-40218,\nCVE-2025-40219, CVE-2025-40220, CVE-2025-40221, CVE-2025-40223,\nCVE-2025-40226, CVE-2025-40231, CVE-2025-40233, CVE-2025-40235,\nCVE-2025-40237, CVE-2025-40238, CVE-2025-40240, CVE-2025-40242,\nCVE-2025-40243, CVE-2025-40244, CVE-2025-40245, CVE-2025-40248,\nCVE-2025-40250, CVE-2025-40251, CVE-2025-40252, CVE-2025-40253,\nCVE-2025-40254, CVE-2025-40257, CVE-2025-40258, CVE-2025-40259,\nCVE-2025-40261, CVE-2025-40262, CVE-2025-40263, CVE-2025-40264,\nCVE-2025-40266, CVE-2025-40268, CVE-2025-40269, CVE-2025-40271,\nCVE-2025-40272, CVE-2025-40273, CVE-2025-40275, CVE-2025-40277,\nCVE-2025-40278, CVE-2025-40279, CVE-2025-40280, CVE-2025-40281,\nCVE-2025-40282, CVE-2025-40283, CVE-2025-40284, CVE-2025-40285,\nCVE-2025-40286, CVE-2025-40287, CVE-2025-40288, CVE-2025-40289,\nCVE-2025-40292, CVE-2025-40293, CVE-2025-40294, CVE-2025-40301,\nCVE-2025-40303, CVE-2025-40304, CVE-2025-40305, CVE-2025-40306,\nCVE-2025-40307, CVE-2025-40308, CVE-2025-40309, CVE-2025-40310,\nCVE-2025-40311, CVE-2025-40312, CVE-2025-40313, CVE-2025-40314,\nCVE-2025-40315, CVE-2025-40317, CVE-2025-40318, CVE-2025-40319,\nCVE-2025-40320, CVE-2025-40321, CVE-2025-40322, CVE-2025-40323,\nCVE-2025-40324, CVE-2025-40328, CVE-2025-40329, CVE-2025-40331,\nCVE-2025-40333, CVE-2025-40337, CVE-2025-40339, CVE-2025-40341,\nCVE-2025-40342, CVE-2025-40343, CVE-2025-40345, CVE-2025-40346,\nCVE-2025-40347, CVE-2025-40349, CVE-2025-40350, CVE-2025-40351,\nCVE-2025-40353, CVE-2025-40358, CVE-2025-40360, CVE-2025-40363,\nCVE-2025-68168, CVE-2025-68171, CVE-2025-68172, CVE-2025-68173,\nCVE-2025-68176, CVE-2025-68177, CVE-2025-68178, CVE-2025-68179,\nCVE-2025-68180, CVE-2025-68183, CVE-2025-68184, CVE-2025-68185,\nCVE-2025-68190, CVE-2025-68191, CVE-2025-68192, CVE-2025-68194,\nCVE-2025-68198, CVE-2025-68200, CVE-2025-68201, CVE-2025-68204,\nCVE-2025-68208, CVE-2025-68213, CVE-2025-68214, CVE-2025-68217,\nCVE-2025-68218, CVE-2025-68219, CVE-2025-68220, CVE-2025-68222,\nCVE-2025-68223, CVE-2025-68227, CVE-2025-68229, CVE-2025-68231,\nCVE-2025-68233, CVE-2025-68235, CVE-2025-68237, CVE-2025-68238,\nCVE-2025-68241, CVE-2025-68244, CVE-2025-68245, CVE-2025-68246,\nCVE-2025-68249, CVE-2025-68282, CVE-2025-68283, CVE-2025-68284,\nCVE-2025-68285, CVE-2025-68286, CVE-2025-68287, CVE-2025-68288,\nCVE-2025-68289, CVE-2025-68290, CVE-2025-68295, CVE-2025-68297,\nCVE-2025-68301, CVE-2025-68302, CVE-2025-68303, CVE-2025-68305,\nCVE-2025-68307, CVE-2025-68308, CVE-2025-68310, CVE-2025-68311,\nCVE-2025-68312, CVE-2025-68313, CVE-2025-68315, CVE-2025-68320,\nCVE-2025-68321, CVE-2025-68322, CVE-2025-68327, CVE-2025-68328,\nCVE-2025-68330, CVE-2025-68331, CVE-2025-68339, CVE-2025-68340,\nCVE-2025-68342, CVE-2025-68343, CVE-2025-68734)\n","status":"published","published":"2026-04-01T18:04:35Z","modified":"2026-11-03T14:35:15.998762447Z","updated_at":"2026-11-03T15:16:22.507285Z"},{"id":"USN-8100-1","title":"linux-nvidia, linux-nvidia-6.8, linux-nvidia-lowlatency vulnerabilities","description":"Qualys discovered that several vulnerabilities existed in the AppArmor\nLinux kernel Security Module (LSM). An unprivileged local attacker could\nuse these issues to load, replace, and remove arbitrary AppArmor profiles\ncausing denial of service, exposure of sensitive information (kernel\nmemory), local privilege escalation, or possibly escape a container.\n(LP: #2143853)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - MIPS architecture;\n  - Nios II architecture;\n  - PA-RISC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - Sun Sparc architecture;\n  - User-Mode Linux (UML);\n  - x86 architecture;\n  - Xtensa architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - ATM drivers;\n  - Drivers core;\n  - Block device driver;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Hardware random number generator core;\n  - Character device driver;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - DMA engine subsystem;\n  - ARM SCMI message protocol;\n  - EFI core;\n  - Intel Stratix 10 firmware drivers;\n  - GPU drivers;\n  - HID subsystem;\n  - CoreSight HW tracing drivers;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - Input Device (Tablet) drivers;\n  - IOMMU subsystem;\n  - ISDN/mISDN subsystem;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - Fastrpc Driver;\n  - MOST (Media Oriented Systems Transport) drivers;\n  - MTD block device drivers;\n  - Ethernet bonding driver;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - Texas Instruments network drivers;\n  - Ethernet team driver;\n  - NVME drivers;\n  - PCI subsystem;\n  - PCCARD (PCMCIA/CardBus) bus subsystem;\n  - Performance monitor drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - ARM PM domains;\n  - PPS (Pulse Per Second) driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - Texas Instruments SoC drivers;\n  - SPI subsystem;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - TTY drivers;\n  - Userspace I/O drivers;\n  - Cadence USB3 driver;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Renesas USBHS Controller drivers;\n  - USB Mass Storage drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Framebuffer layer;\n  - Xen hypervisor drivers;\n  - AFS file system;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - File systems infrastructure;\n  - EFI Variable file system;\n  - exFAT file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - GFS2 file system;\n  - HFS file system;\n  - HFS+ file system;\n  - HugeTLB file system;\n  - JFS file system;\n  - KERNFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - OrangeFS file system;\n  - Proc file system;\n  - Diskquota system;\n  - SMB network file system;\n  - SquashFS file system;\n  - UDF file system;\n  - XFS file system;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - BPF subsystem;\n  - Mellanox drivers;\n  - NFS page cache wrapper;\n  - Memory management;\n  - Memory Management;\n  - Media input infrastructure;\n  - Bluetooth subsystem;\n  - IP tunnels definitions;\n  - Network traffic control;\n  - Rose network layer;\n  - Network sockets;\n  - io_uring subsystem;\n  - Control group (cgroup);\n  - Kernel crash support code;\n  - Kernel futex primitives;\n  - PID allocator;\n  - Scheduler infrastructure;\n  - Syscalls implementation;\n  - Timer subsystem;\n  - Tracing infrastructure;\n  - 9P file system network protocol;\n  - Amateur Radio drivers;\n  - B.A.T.M.A.N. meshing protocol;\n  - Ethernet bridge;\n  - Ceph Core library;\n  - Networking core;\n  - Devlink API;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - Open vSwitch;\n  - RF switch subsystem;\n  - SCTP protocol;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Intel ASoC drivers;\n  - QCOM ASoC drivers;\n  - USB sound devices;\n(CVE-2025-21833, CVE-2025-22103, CVE-2025-22105, CVE-2025-22106,\nCVE-2025-22107, CVE-2025-22113, CVE-2025-22121, CVE-2025-22124,\nCVE-2025-22125, CVE-2025-23129, CVE-2025-23130, CVE-2025-23133,\nCVE-2025-23143, CVE-2025-37860, CVE-2025-38105, CVE-2025-38502,\nCVE-2025-38556, CVE-2025-38627, CVE-2025-38643, CVE-2025-38709,\nCVE-2025-39678, CVE-2025-39697, CVE-2025-39805, CVE-2025-39806,\nCVE-2025-39807, CVE-2025-39808, CVE-2025-39810, CVE-2025-39811,\nCVE-2025-39812, CVE-2025-39813, CVE-2025-39815, CVE-2025-39817,\nCVE-2025-39819, CVE-2025-39823, CVE-2025-39824, CVE-2025-39825,\nCVE-2025-39826, CVE-2025-39827, CVE-2025-39828, CVE-2025-39829,\nCVE-2025-39832, CVE-2025-39835, CVE-2025-39836, CVE-2025-39838,\nCVE-2025-39839, CVE-2025-39841, CVE-2025-39842, CVE-2025-39843,\nCVE-2025-39844, CVE-2025-39845, CVE-2025-39846, CVE-2025-39847,\nCVE-2025-39848, CVE-2025-39849, CVE-2025-39850, CVE-2025-39851,\nCVE-2025-39852, CVE-2025-39853, CVE-2025-39854, CVE-2025-39857,\nCVE-2025-39860, CVE-2025-39861, CVE-2025-39863, CVE-2025-39864,\nCVE-2025-39865, CVE-2025-39866, CVE-2025-39869, CVE-2025-39870,\nCVE-2025-39871, CVE-2025-39873, CVE-2025-39876, CVE-2025-39877,\nCVE-2025-39880, CVE-2025-39881, CVE-2025-39883, CVE-2025-39885,\nCVE-2025-39886, CVE-2025-39891, CVE-2025-39894, CVE-2025-39895,\nCVE-2025-39897, CVE-2025-39899, CVE-2025-39901, CVE-2025-39902,\nCVE-2025-39907, CVE-2025-39909, CVE-2025-39911, CVE-2025-39913,\nCVE-2025-39914, CVE-2025-39916, CVE-2025-39920, CVE-2025-39923,\nCVE-2025-39927, CVE-2025-39929, CVE-2025-39931, CVE-2025-39932,\nCVE-2025-39934, CVE-2025-39937, CVE-2025-39938, CVE-2025-39940,\nCVE-2025-39942, CVE-2025-39943, CVE-2025-39944, CVE-2025-39945,\nCVE-2025-39947, CVE-2025-39948, CVE-2025-39949, CVE-2025-39950,\nCVE-2025-39951, CVE-2025-39952, CVE-2025-39953, CVE-2025-39955,\nCVE-2025-39957, CVE-2025-39961, CVE-2025-39965, CVE-2025-39967,\nCVE-2025-39968, CVE-2025-39969, CVE-2025-39970, CVE-2025-39971,\nCVE-2025-39972, CVE-2025-39973, CVE-2025-39977, CVE-2025-39978,\nCVE-2025-39980, CVE-2025-39981, CVE-2025-39982, CVE-2025-39985,\nCVE-2025-39986, CVE-2025-39987, CVE-2025-39988, CVE-2025-39991,\nCVE-2025-39992, CVE-2025-39994, CVE-2025-39995, CVE-2025-39996,\nCVE-2025-39998, CVE-2025-40000, CVE-2025-40001, CVE-2025-40006,\nCVE-2025-40008, CVE-2025-40009, CVE-2025-40010, CVE-2025-40011,\nCVE-2025-40013, CVE-2025-40016, CVE-2025-40020, CVE-2025-40021,\nCVE-2025-40024, CVE-2025-40026, CVE-2025-40027, CVE-2025-40029,\nCVE-2025-40030, CVE-2025-40031, CVE-2025-40032, CVE-2025-40033,\nCVE-2025-40035, CVE-2025-40036, CVE-2025-40037, CVE-2025-40038,\nCVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40047,\nCVE-2025-40048, CVE-2025-40049, CVE-2025-40051, CVE-2025-40052,\nCVE-2025-40053, CVE-2025-40055, CVE-2025-40056, CVE-2025-40057,\nCVE-2025-40058, CVE-2025-40059, CVE-2025-40060, CVE-2025-40061,\nCVE-2025-40062, CVE-2025-40067, CVE-2025-40068, CVE-2025-40070,\nCVE-2025-40071, CVE-2025-40077, CVE-2025-40078, CVE-2025-40079,\nCVE-2025-40080, CVE-2025-40081, CVE-2025-40083, CVE-2025-40084,\nCVE-2025-40085, CVE-2025-40087, CVE-2025-40088, CVE-2025-40092,\nCVE-2025-40093, CVE-2025-40094, CVE-2025-40095, CVE-2025-40096,\nCVE-2025-40099, CVE-2025-40100, CVE-2025-40101, CVE-2025-40103,\nCVE-2025-40104, CVE-2025-40105, CVE-2025-40106, CVE-2025-40107,\nCVE-2025-40109, CVE-2025-40110, CVE-2025-40111, CVE-2025-40112,\nCVE-2025-40115, CVE-2025-40116, CVE-2025-40118, CVE-2025-40120,\nCVE-2025-40121, CVE-2025-40123, CVE-2025-40124, CVE-2025-40125,\nCVE-2025-40126, CVE-2025-40127, CVE-2025-40129, CVE-2025-40134,\nCVE-2025-40137, CVE-2025-40140, CVE-2025-40141, CVE-2025-40153,\nCVE-2025-40154, CVE-2025-40155, CVE-2025-40156, CVE-2025-40159,\nCVE-2025-40160, CVE-2025-40165, CVE-2025-40166, CVE-2025-40167,\nCVE-2025-40169, CVE-2025-40171, CVE-2025-40172, CVE-2025-40173,\nCVE-2025-40176, CVE-2025-40178, CVE-2025-40179, CVE-2025-40180,\nCVE-2025-40183, CVE-2025-40187, CVE-2025-40188, CVE-2025-40192,\nCVE-2025-40193, CVE-2025-40194, CVE-2025-40196, CVE-2025-40198,\nCVE-2025-40200, CVE-2025-40201, CVE-2025-40204, CVE-2025-40205,\nCVE-2025-40206, CVE-2025-40207, CVE-2025-40211, CVE-2025-40218,\nCVE-2025-40219, CVE-2025-40220, CVE-2025-40221, CVE-2025-40223,\nCVE-2025-40226, CVE-2025-40231, CVE-2025-40233, CVE-2025-40235,\nCVE-2025-40237, CVE-2025-40238, CVE-2025-40240, CVE-2025-40242,\nCVE-2025-40243, CVE-2025-40244, CVE-2025-40245, CVE-2025-40248,\nCVE-2025-40250, CVE-2025-40251, CVE-2025-40252, CVE-2025-40253,\nCVE-2025-40254, CVE-2025-40257, CVE-2025-40258, CVE-2025-40259,\nCVE-2025-40261, CVE-2025-40262, CVE-2025-40263, CVE-2025-40264,\nCVE-2025-40266, CVE-2025-40268, CVE-2025-40269, CVE-2025-40271,\nCVE-2025-40272, CVE-2025-40273, CVE-2025-40275, CVE-2025-40277,\nCVE-2025-40278, CVE-2025-40279, CVE-2025-40280, CVE-2025-40281,\nCVE-2025-40282, CVE-2025-40283, CVE-2025-40284, CVE-2025-40285,\nCVE-2025-40286, CVE-2025-40287, CVE-2025-40288, CVE-2025-40289,\nCVE-2025-40292, CVE-2025-40293, CVE-2025-40294, CVE-2025-40301,\nCVE-2025-40303, CVE-2025-40304, CVE-2025-40305, CVE-2025-40306,\nCVE-2025-40307, CVE-2025-40308, CVE-2025-40309, CVE-2025-40310,\nCVE-2025-40311, CVE-2025-40312, CVE-2025-40313, CVE-2025-40314,\nCVE-2025-40315, CVE-2025-40317, CVE-2025-40318, CVE-2025-40319,\nCVE-2025-40320, CVE-2025-40321, CVE-2025-40322, CVE-2025-40323,\nCVE-2025-40324, CVE-2025-40328, CVE-2025-40329, CVE-2025-40331,\nCVE-2025-40333, CVE-2025-40337, CVE-2025-40339, CVE-2025-40341,\nCVE-2025-40342, CVE-2025-40343, CVE-2025-40345, CVE-2025-40346,\nCVE-2025-40347, CVE-2025-40349, CVE-2025-40350, CVE-2025-40351,\nCVE-2025-40353, CVE-2025-40358, CVE-2025-40360, CVE-2025-40363,\nCVE-2025-68168, CVE-2025-68171, CVE-2025-68172, CVE-2025-68173,\nCVE-2025-68176, CVE-2025-68177, CVE-2025-68178, CVE-2025-68179,\nCVE-2025-68180, CVE-2025-68183, CVE-2025-68184, CVE-2025-68185,\nCVE-2025-68190, CVE-2025-68191, CVE-2025-68192, CVE-2025-68194,\nCVE-2025-68198, CVE-2025-68200, CVE-2025-68201, CVE-2025-68204,\nCVE-2025-68208, CVE-2025-68213, CVE-2025-68214, CVE-2025-68217,\nCVE-2025-68218, CVE-2025-68219, CVE-2025-68220, CVE-2025-68222,\nCVE-2025-68223, CVE-2025-68227, CVE-2025-68229, CVE-2025-68231,\nCVE-2025-68233, CVE-2025-68235, CVE-2025-68237, CVE-2025-68238,\nCVE-2025-68241, CVE-2025-68244, CVE-2025-68245, CVE-2025-68246,\nCVE-2025-68249, CVE-2025-68282, CVE-2025-68283, CVE-2025-68284,\nCVE-2025-68285, CVE-2025-68286, CVE-2025-68287, CVE-2025-68288,\nCVE-2025-68289, CVE-2025-68290, CVE-2025-68295, CVE-2025-68297,\nCVE-2025-68301, CVE-2025-68302, CVE-2025-68303, CVE-2025-68305,\nCVE-2025-68307, CVE-2025-68308, CVE-2025-68310, CVE-2025-68311,\nCVE-2025-68312, CVE-2025-68313, CVE-2025-68315, CVE-2025-68320,\nCVE-2025-68321, CVE-2025-68322, CVE-2025-68327, CVE-2025-68328,\nCVE-2025-68330, CVE-2025-68331, CVE-2025-68339, CVE-2025-68340,\nCVE-2025-68342, CVE-2025-68343, CVE-2025-68734, CVE-2026-23202,\nCVE-2026-23207)\n","status":"published","published":"2026-03-16T20:48:11Z","modified":"2026-11-04T20:01:36.961728599Z","updated_at":"2026-11-04T20:16:32.566315Z"},{"id":"USN-8125-1","title":"linux-azure vulnerabilities","description":"Qualys discovered that several vulnerabilities existed in the AppArmor\nLinux kernel Security Module (LSM). An unprivileged local attacker could\nuse these issues to load, replace, and remove arbitrary AppArmor profiles\ncausing denial of service, exposure of sensitive information (kernel\nmemory), local privilege escalation, or possibly escape a container.\n(LP: #2143853)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - MIPS architecture;\n  - Nios II architecture;\n  - PA-RISC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - Sun Sparc architecture;\n  - User-Mode Linux (UML);\n  - x86 architecture;\n  - Xtensa architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - ATM drivers;\n  - Drivers core;\n  - Block device driver;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Hardware random number generator core;\n  - Character device driver;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - DMA engine subsystem;\n  - ARM SCMI message protocol;\n  - EFI core;\n  - Intel Stratix 10 firmware drivers;\n  - GPU drivers;\n  - HID subsystem;\n  - CoreSight HW tracing drivers;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - Input Device (Tablet) drivers;\n  - IOMMU subsystem;\n  - ISDN/mISDN subsystem;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - Fastrpc Driver;\n  - MOST (Media Oriented Systems Transport) drivers;\n  - MTD block device drivers;\n  - Ethernet bonding driver;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - Texas Instruments network drivers;\n  - Ethernet team driver;\n  - NVME drivers;\n  - PCI subsystem;\n  - PCCARD (PCMCIA/CardBus) bus subsystem;\n  - Performance monitor drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - ARM PM domains;\n  - PPS (Pulse Per Second) driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - Texas Instruments SoC drivers;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - TTY drivers;\n  - Userspace I/O drivers;\n  - Cadence USB3 driver;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Renesas USBHS Controller drivers;\n  - USB Mass Storage drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Framebuffer layer;\n  - Xen hypervisor drivers;\n  - AFS file system;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - File systems infrastructure;\n  - EFI Variable file system;\n  - exFAT file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - GFS2 file system;\n  - HFS file system;\n  - HFS+ file system;\n  - HugeTLB file system;\n  - JFS file system;\n  - KERNFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - OrangeFS file system;\n  - Proc file system;\n  - Diskquota system;\n  - SMB network file system;\n  - SquashFS file system;\n  - UDF file system;\n  - XFS file system;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - BPF subsystem;\n  - Mellanox drivers;\n  - NFS page cache wrapper;\n  - Memory management;\n  - Memory Management;\n  - Media input infrastructure;\n  - Bluetooth subsystem;\n  - IP tunnels definitions;\n  - Network traffic control;\n  - Rose network layer;\n  - Network sockets;\n  - io_uring subsystem;\n  - Control group (cgroup);\n  - Kernel crash support code;\n  - Kernel futex primitives;\n  - PID allocator;\n  - Scheduler infrastructure;\n  - Syscalls implementation;\n  - Timer subsystem;\n  - Tracing infrastructure;\n  - 9P file system network protocol;\n  - Amateur Radio drivers;\n  - B.A.T.M.A.N. meshing protocol;\n  - Ethernet bridge;\n  - Ceph Core library;\n  - Networking core;\n  - Devlink API;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - Open vSwitch;\n  - RF switch subsystem;\n  - SCTP protocol;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Intel ASoC drivers;\n  - QCOM ASoC drivers;\n  - USB sound devices;\n(CVE-2025-21833, CVE-2025-22037, CVE-2025-22103, CVE-2025-22105,\nCVE-2025-22106, CVE-2025-22107, CVE-2025-22113, CVE-2025-22121,\nCVE-2025-22124, CVE-2025-22125, CVE-2025-23129, CVE-2025-23130,\nCVE-2025-23133, CVE-2025-23143, CVE-2025-37860, CVE-2025-37899,\nCVE-2025-38105, CVE-2025-38502, CVE-2025-38556, CVE-2025-38627,\nCVE-2025-38643, CVE-2025-38709, CVE-2025-39678, CVE-2025-39697,\nCVE-2025-39805, CVE-2025-39806, CVE-2025-39807, CVE-2025-39808,\nCVE-2025-39810, CVE-2025-39811, CVE-2025-39812, CVE-2025-39813,\nCVE-2025-39815, CVE-2025-39817, CVE-2025-39819, CVE-2025-39823,\nCVE-2025-39824, CVE-2025-39825, CVE-2025-39826, CVE-2025-39827,\nCVE-2025-39828, CVE-2025-39829, CVE-2025-39832, CVE-2025-39835,\nCVE-2025-39836, CVE-2025-39838, CVE-2025-39839, CVE-2025-39841,\nCVE-2025-39842, CVE-2025-39843, CVE-2025-39844, CVE-2025-39845,\nCVE-2025-39846, CVE-2025-39847, CVE-2025-39848, CVE-2025-39849,\nCVE-2025-39850, CVE-2025-39851, CVE-2025-39852, CVE-2025-39853,\nCVE-2025-39854, CVE-2025-39857, CVE-2025-39860, CVE-2025-39861,\nCVE-2025-39863, CVE-2025-39864, CVE-2025-39865, CVE-2025-39866,\nCVE-2025-39869, CVE-2025-39870, CVE-2025-39871, CVE-2025-39873,\nCVE-2025-39876, CVE-2025-39877, CVE-2025-39880, CVE-2025-39881,\nCVE-2025-39883, CVE-2025-39885, CVE-2025-39886, CVE-2025-39891,\nCVE-2025-39894, CVE-2025-39895, CVE-2025-39897, CVE-2025-39899,\nCVE-2025-39901, CVE-2025-39902, CVE-2025-39907, CVE-2025-39909,\nCVE-2025-39911, CVE-2025-39913, CVE-2025-39914, CVE-2025-39916,\nCVE-2025-39920, CVE-2025-39923, CVE-2025-39927, CVE-2025-39929,\nCVE-2025-39931, CVE-2025-39932, CVE-2025-39934, CVE-2025-39937,\nCVE-2025-39938, CVE-2025-39940, CVE-2025-39942, CVE-2025-39943,\nCVE-2025-39944, CVE-2025-39945, CVE-2025-39947, CVE-2025-39948,\nCVE-2025-39949, CVE-2025-39950, CVE-2025-39951, CVE-2025-39952,\nCVE-2025-39953, CVE-2025-39955, CVE-2025-39957, CVE-2025-39961,\nCVE-2025-39965, CVE-2025-39967, CVE-2025-39968, CVE-2025-39969,\nCVE-2025-39970, CVE-2025-39971, CVE-2025-39972, CVE-2025-39973,\nCVE-2025-39977, CVE-2025-39978, CVE-2025-39980, CVE-2025-39981,\nCVE-2025-39982, CVE-2025-39985, CVE-2025-39986, CVE-2025-39987,\nCVE-2025-39988, CVE-2025-39991, CVE-2025-39992, CVE-2025-39994,\nCVE-2025-39995, CVE-2025-39996, CVE-2025-39998, CVE-2025-40000,\nCVE-2025-40001, CVE-2025-40006, CVE-2025-40008, CVE-2025-40009,\nCVE-2025-40010, CVE-2025-40011, CVE-2025-40013, CVE-2025-40016,\nCVE-2025-40020, CVE-2025-40021, CVE-2025-40024, CVE-2025-40026,\nCVE-2025-40027, CVE-2025-40029, CVE-2025-40030, CVE-2025-40031,\nCVE-2025-40032, CVE-2025-40033, CVE-2025-40035, CVE-2025-40036,\nCVE-2025-40037, CVE-2025-40038, CVE-2025-40042, CVE-2025-40043,\nCVE-2025-40044, CVE-2025-40047, CVE-2025-40048, CVE-2025-40049,\nCVE-2025-40051, CVE-2025-40052, CVE-2025-40053, CVE-2025-40055,\nCVE-2025-40056, CVE-2025-40057, CVE-2025-40058, CVE-2025-40059,\nCVE-2025-40060, CVE-2025-40061, CVE-2025-40062, CVE-2025-40067,\nCVE-2025-40068, CVE-2025-40070, CVE-2025-40071, CVE-2025-40077,\nCVE-2025-40078, CVE-2025-40079, CVE-2025-40080, CVE-2025-40081,\nCVE-2025-40083, CVE-2025-40084, CVE-2025-40085, CVE-2025-40087,\nCVE-2025-40088, CVE-2025-40092, CVE-2025-40093, CVE-2025-40094,\nCVE-2025-40095, CVE-2025-40096, CVE-2025-40099, CVE-2025-40100,\nCVE-2025-40101, CVE-2025-40103, CVE-2025-40104, CVE-2025-40105,\nCVE-2025-40106, CVE-2025-40107, CVE-2025-40109, CVE-2025-40110,\nCVE-2025-40111, CVE-2025-40112, CVE-2025-40115, CVE-2025-40116,\nCVE-2025-40118, CVE-2025-40120, CVE-2025-40121, CVE-2025-40123,\nCVE-2025-40124, CVE-2025-40125, CVE-2025-40126, CVE-2025-40127,\nCVE-2025-40129, CVE-2025-40134, CVE-2025-40137, CVE-2025-40140,\nCVE-2025-40141, CVE-2025-40153, CVE-2025-40154, CVE-2025-40155,\nCVE-2025-40156, CVE-2025-40159, CVE-2025-40160, CVE-2025-40165,\nCVE-2025-40166, CVE-2025-40167, CVE-2025-40169, CVE-2025-40171,\nCVE-2025-40172, CVE-2025-40173, CVE-2025-40176, CVE-2025-40178,\nCVE-2025-40179, CVE-2025-40180, CVE-2025-40183, CVE-2025-40187,\nCVE-2025-40188, CVE-2025-40192, CVE-2025-40193, CVE-2025-40194,\nCVE-2025-40196, CVE-2025-40198, CVE-2025-40200, CVE-2025-40201,\nCVE-2025-40202, CVE-2025-40204, CVE-2025-40205, CVE-2025-40206,\nCVE-2025-40207, CVE-2025-40211, CVE-2025-40218, CVE-2025-40219,\nCVE-2025-40220, CVE-2025-40221, CVE-2025-40223, CVE-2025-40226,\nCVE-2025-40231, CVE-2025-40233, CVE-2025-40235, CVE-2025-40237,\nCVE-2025-40238, CVE-2025-40240, CVE-2025-40242, CVE-2025-40243,\nCVE-2025-40244, CVE-2025-40245, CVE-2025-40248, CVE-2025-40250,\nCVE-2025-40251, CVE-2025-40252, CVE-2025-40253, CVE-2025-40254,\nCVE-2025-40257, CVE-2025-40258, CVE-2025-40259, CVE-2025-40261,\nCVE-2025-40262, CVE-2025-40263, CVE-2025-40264, CVE-2025-40266,\nCVE-2025-40268, CVE-2025-40269, CVE-2025-40271, CVE-2025-40272,\nCVE-2025-40273, CVE-2025-40275, CVE-2025-40277, CVE-2025-40278,\nCVE-2025-40279, CVE-2025-40280, CVE-2025-40281, CVE-2025-40282,\nCVE-2025-40283, CVE-2025-40284, CVE-2025-40285, CVE-2025-40286,\nCVE-2025-40287, CVE-2025-40288, CVE-2025-40289, CVE-2025-40292,\nCVE-2025-40293, CVE-2025-40294, CVE-2025-40301, CVE-2025-40303,\nCVE-2025-40304, CVE-2025-40305, CVE-2025-40306, CVE-2025-40307,\nCVE-2025-40308, CVE-2025-40309, CVE-2025-40310, CVE-2025-40311,\nCVE-2025-40312, CVE-2025-40313, CVE-2025-40314, CVE-2025-40315,\nCVE-2025-40317, CVE-2025-40318, CVE-2025-40319, CVE-2025-40320,\nCVE-2025-40321, CVE-2025-40322, CVE-2025-40323, CVE-2025-40324,\nCVE-2025-40328, CVE-2025-40329, CVE-2025-40331, CVE-2025-40333,\nCVE-2025-40337, CVE-2025-40339, CVE-2025-40341, CVE-2025-40342,\nCVE-2025-40343, CVE-2025-40345, CVE-2025-40346, CVE-2025-40347,\nCVE-2025-40349, CVE-2025-40350, CVE-2025-40351, CVE-2025-40353,\nCVE-2025-40358, CVE-2025-40360, CVE-2025-40363, CVE-2025-68168,\nCVE-2025-68171, CVE-2025-68172, CVE-2025-68173, CVE-2025-68176,\nCVE-2025-68177, CVE-2025-68178, CVE-2025-68179, CVE-2025-68180,\nCVE-2025-68183, CVE-2025-68184, CVE-2025-68185, CVE-2025-68190,\nCVE-2025-68191, CVE-2025-68192, CVE-2025-68194, CVE-2025-68198,\nCVE-2025-68200, CVE-2025-68201, CVE-2025-68204, CVE-2025-68208,\nCVE-2025-68213, CVE-2025-68214, CVE-2025-68217, CVE-2025-68218,\nCVE-2025-68219, CVE-2025-68220, CVE-2025-68222, CVE-2025-68223,\nCVE-2025-68227, CVE-2025-68229, CVE-2025-68231, CVE-2025-68233,\nCVE-2025-68235, CVE-2025-68237, CVE-2025-68238, CVE-2025-68241,\nCVE-2025-68244, CVE-2025-68245, CVE-2025-68246, CVE-2025-68249,\nCVE-2025-68282, CVE-2025-68283, CVE-2025-68284, CVE-2025-68285,\nCVE-2025-68286, CVE-2025-68287, CVE-2025-68288, CVE-2025-68289,\nCVE-2025-68290, CVE-2025-68295, CVE-2025-68297, CVE-2025-68301,\nCVE-2025-68302, CVE-2025-68303, CVE-2025-68305, CVE-2025-68307,\nCVE-2025-68308, CVE-2025-68310, CVE-2025-68311, CVE-2025-68312,\nCVE-2025-68313, CVE-2025-68315, CVE-2025-68320, CVE-2025-68321,\nCVE-2025-68322, CVE-2025-68327, CVE-2025-68328, CVE-2025-68330,\nCVE-2025-68331, CVE-2025-68339, CVE-2025-68340, CVE-2025-68342,\nCVE-2025-68343, CVE-2025-68734)\n","status":"published","published":"2026-03-25T19:11:40Z","modified":"2026-11-03T14:35:10.177253555Z","updated_at":"2026-11-03T15:16:30.201391Z"},{"id":"USN-8126-1","title":"linux-azure-6.8 vulnerabilities","description":"Qualys discovered that several vulnerabilities existed in the AppArmor\nLinux kernel Security Module (LSM). An unprivileged local attacker could\nuse these issues to load, replace, and remove arbitrary AppArmor profiles\ncausing denial of service, exposure of sensitive information (kernel\nmemory), local privilege escalation, or possibly escape a container.\n(LP: #2143853)\n\nIt was discovered that improper initialization of CPU cache memory could\nallow a local attacker with hypervisor access to overwrite SEV-SNP guest\nmemory resulting in loss of data integrity. (CVE-2024-36331)\n\nOleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos,\nand Flavien Solt discovered that some AMD processors may allow an attacker\nto infer data from previous stores, potentially resulting in the leakage of\nprivileged information. A local attacker could possibly use this to expose\nsensitive information. (CVE-2024-36350, CVE-2024-36357)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM32 architecture;\n  - ARM64 architecture;\n  - MIPS architecture;\n  - Nios II architecture;\n  - PA-RISC architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - Sun Sparc architecture;\n  - User-Mode Linux (UML);\n  - x86 architecture;\n  - Xtensa architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - ATM drivers;\n  - Drivers core;\n  - ATA over ethernet (AOE) driver;\n  - DRBD Distributed Replicated Block Device drivers;\n  - Block device driver;\n  - Network block device driver;\n  - Ublk userspace block driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Hardware random number generator core;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - Buffer Sharing and Synchronization framework;\n  - DMA engine subsystem;\n  - EDAC drivers;\n  - Arm Firmware Framework for ARMv8-A(FFA);\n  - ARM SCMI message protocol;\n  - EFI core;\n  - Intel Stratix 10 firmware drivers;\n  - FPGA Framework;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - CoreSight HW tracing drivers;\n  - I2C subsystem;\n  - I3C subsystem;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - Input Device (Tablet) drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - ISDN/mISDN subsystem;\n  - Mailbox framework;\n  - MCB driver;\n  - Multiple devices driver;\n  - Media drivers;\n  - Multifunction device drivers;\n  - Fastrpc Driver;\n  - Microchip PCI driver;\n  - Intel Management Engine Interface driver;\n  - PCI Endpoint Test driver;\n  - TI TPS6594 PFSM driver;\n  - VMware VMCI Driver;\n  - MMC subsystem;\n  - MOST (Media Oriented Systems Transport) drivers;\n  - MTD block device drivers;\n  - Ethernet bonding driver;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - Texas Instruments network drivers;\n  - Ethernet team driver;\n  - MediaTek network drivers;\n  - NVDIMM (Non-Volatile Memory Device) drivers;\n  - NVME drivers;\n  - PCI subsystem;\n  - PCCARD (PCMCIA/CardBus) bus subsystem;\n  - Amlogic Meson DDR PMU;\n  - Performance monitor drivers;\n  - PHY drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - ARM PM domains;\n  - Power supply drivers;\n  - Powercap sysfs driver;\n  - PPS (Pulse Per Second) driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - RapidIO drivers;\n  - Voltage and Current Regulator drivers;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - ASPEED SoC drivers;\n  - QCOM SoC drivers;\n  - Samsung SoC drivers;\n  - Texas Instruments SoC drivers;\n  - SPI subsystem;\n  - small TFT LCD display modules;\n  - Media staging drivers;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - Thunderbolt and USB4 drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Userspace I/O drivers;\n  - Cadence USB3 driver;\n  - ChipIdea USB driver;\n  - USB Device Class drivers;\n  - USB core drivers;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Renesas USBHS Controller drivers;\n  - USB Mass Storage drivers;\n  - USB Type-C support driver;\n  - USB Type-C Connector System Software Interface driver;\n  - VFIO drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Backlight driver;\n  - Framebuffer layer;\n  - TSM Common Guest driver;\n  - Virtio drivers;\n  - Xen hypervisor drivers;\n  - AFS file system;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EFI Variable file system;\n  - exFAT file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - GFS2 file system;\n  - HFS file system;\n  - HFS+ file system;\n  - HugeTLB file system;\n  - Journaling layer for block devices (JBD2);\n  - JFFS2 file system;\n  - JFS file system;\n  - KERNFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - OrangeFS file system;\n  - Overlay file system;\n  - Proc file system;\n  - Diskquota system;\n  - SMB network file system;\n  - SquashFS file system;\n  - UDF file system;\n  - XFS file system;\n  - DRM display driver;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - BPF subsystem;\n  - Memory Management;\n  - Internal shared memory driver;\n  - LZO compression library;\n  - Mellanox drivers;\n  - NFS page cache wrapper;\n  - padata parallel execution mechanism;\n  - Memory management;\n  - Networking subsytem;\n  - Media input infrastructure;\n  - Bluetooth subsystem;\n  - IP tunnels definitions;\n  - Netfilter;\n  - Network traffic control;\n  - Rose network layer;\n  - SCTP protocol;\n  - Network sockets;\n  - UDP network protocol;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Digital Audio (PCM) driver;\n  - Universal MIDI packet (UMP) support module;\n  - Tracing infrastructure;\n  - User-space API (UAPI);\n  - io_uring subsystem;\n  - IPC subsystem;\n  - Control group (cgroup);\n  - Kernel crash support code;\n  - Perf events;\n  - Kernel exit() syscall;\n  - Kernel futex primitives;\n  - IRQ subsystem;\n  - Padata parallel execution mechanism;\n  - Kernel command line parsing driver;\n  - PID allocator;\n  - Hibernation control;\n  - RCU subsystem;\n  - Restartable seuqences system call mechanism;\n  - Scheduler infrastructure;\n  - Syscalls implementation;\n  - Timer subsystem;\n  - Maple Tree data structure library;\n  - KASAN memory debugging framework;\n  - 802.1Q VLAN protocol;\n  - 9P file system network protocol;\n  - Appletalk network protocol;\n  - Amateur Radio drivers;\n  - B.A.T.M.A.N. meshing protocol;\n  - Ethernet bridge;\n  - CAN network layer;\n  - Ceph Core library;\n  - Networking core;\n  - Devlink API;\n  - Distributed Switch Architecture;\n  - HSR network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Management Component Transport Protocol (MCTP);\n  - MultiProtocol Label Switching driver;\n  - Multipath TCP;\n  - NetLabel subsystem;\n  - Netlink;\n  - NFC subsystem;\n  - Open vSwitch;\n  - RDS protocol;\n  - RF switch subsystem;\n  - RxRPC session sockets;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - Integrity Measurement Architecture(IMA) framework;\n  - ALSA framework;\n  - WCD audio codecs;\n  - Intel ASoC drivers;\n  - MediaTek ASoC drivers;\n  - QCOM ASoC drivers;\n  - SoC audio core drivers;\n  - USB sound devices;\n  - Virtio sound driver;\n  - CPU Power monitoring subsystem;\n  - KVM subsystem;\n(CVE-2025-21833, CVE-2025-21884, CVE-2025-21931, CVE-2025-22026,\nCVE-2025-22037, CVE-2025-22101, CVE-2025-22102, CVE-2025-22103,\nCVE-2025-22105, CVE-2025-22106, CVE-2025-22107, CVE-2025-22113,\nCVE-2025-22115, CVE-2025-22120, CVE-2025-22121, CVE-2025-22124,\nCVE-2025-22125, CVE-2025-22126, CVE-2025-22128, CVE-2025-23129,\nCVE-2025-23130, CVE-2025-23133, CVE-2025-23140, CVE-2025-23141,\nCVE-2025-23142, CVE-2025-23143, CVE-2025-23144, CVE-2025-23145,\nCVE-2025-23146, CVE-2025-23147, CVE-2025-23148, CVE-2025-23149,\nCVE-2025-23150, CVE-2025-23151, CVE-2025-23155, CVE-2025-23156,\nCVE-2025-23157, CVE-2025-23158, CVE-2025-23159, CVE-2025-23160,\nCVE-2025-23161, CVE-2025-23163, CVE-2025-37738, CVE-2025-37739,\nCVE-2025-37740, CVE-2025-37741, CVE-2025-37742, CVE-2025-37744,\nCVE-2025-37745, CVE-2025-37748, CVE-2025-37749, CVE-2025-37754,\nCVE-2025-37755, CVE-2025-37757, CVE-2025-37758, CVE-2025-37759,\nCVE-2025-37761, CVE-2025-37763, CVE-2025-37764, CVE-2025-37765,\nCVE-2025-37766, CVE-2025-37767, CVE-2025-37768, CVE-2025-37769,\nCVE-2025-37770, CVE-2025-37771, CVE-2025-37772, CVE-2025-37773,\nCVE-2025-37775, CVE-2025-37777, CVE-2025-37778, CVE-2025-37780,\nCVE-2025-37781, CVE-2025-37784, CVE-2025-37786, CVE-2025-37787,\nCVE-2025-37788, CVE-2025-37789, CVE-2025-37790, CVE-2025-37792,\nCVE-2025-37793, CVE-2025-37794, CVE-2025-37796, CVE-2025-37799,\nCVE-2025-37800, CVE-2025-37801, CVE-2025-37803, CVE-2025-37805,\nCVE-2025-37808, CVE-2025-37809, CVE-2025-37810, CVE-2025-37811,\nCVE-2025-37812, CVE-2025-37813, CVE-2025-37815, CVE-2025-37816,\nCVE-2025-37817, CVE-2025-37819, CVE-2025-37820, CVE-2025-37822,\nCVE-2025-37823, CVE-2025-37824, CVE-2025-37826, CVE-2025-37827,\nCVE-2025-37828, CVE-2025-37829, CVE-2025-37830, CVE-2025-37831,\nCVE-2025-37836, CVE-2025-37839, CVE-2025-37840, CVE-2025-37841,\nCVE-2025-37842, CVE-2025-37844, CVE-2025-37846, CVE-2025-37849,\nCVE-2025-37850, CVE-2025-37851, CVE-2025-37852, CVE-2025-37853,\nCVE-2025-37854, CVE-2025-37856, CVE-2025-37857, CVE-2025-37858,\nCVE-2025-37859, CVE-2025-37860, CVE-2025-37861, CVE-2025-37862,\nCVE-2025-37863, CVE-2025-37864, CVE-2025-37865, CVE-2025-37867,\nCVE-2025-37869, CVE-2025-37871, CVE-2025-37872, CVE-2025-37873,\nCVE-2025-37874, CVE-2025-37875, CVE-2025-37878, CVE-2025-37879,\nCVE-2025-37881, CVE-2025-37883, CVE-2025-37884, CVE-2025-37885,\nCVE-2025-37886, CVE-2025-37887, CVE-2025-37891, CVE-2025-37892,\nCVE-2025-37897, CVE-2025-37899, CVE-2025-37900, CVE-2025-37901,\nCVE-2025-37903, CVE-2025-37905, CVE-2025-37909, CVE-2025-37911,\nCVE-2025-37912, CVE-2025-37913, CVE-2025-37914, CVE-2025-37915,\nCVE-2025-37916, CVE-2025-37917, CVE-2025-37918, CVE-2025-37920,\nCVE-2025-37921, CVE-2025-37922, CVE-2025-37923, CVE-2025-37924,\nCVE-2025-37925, CVE-2025-37927, CVE-2025-37928, CVE-2025-37930,\nCVE-2025-37931, CVE-2025-37933, CVE-2025-37935, CVE-2025-37936,\nCVE-2025-37938, CVE-2025-37940, CVE-2025-37943, CVE-2025-37944,\nCVE-2025-37945, CVE-2025-37947, CVE-2025-37948, CVE-2025-37949,\nCVE-2025-37951, CVE-2025-37952, CVE-2025-37956, CVE-2025-37957,\nCVE-2025-37959, CVE-2025-37960, CVE-2025-37961, CVE-2025-37962,\nCVE-2025-37963, CVE-2025-37967, CVE-2025-37968, CVE-2025-37969,\nCVE-2025-37970, CVE-2025-37972, CVE-2025-37973, CVE-2025-37975,\nCVE-2025-37977, CVE-2025-37978, CVE-2025-37979, CVE-2025-37980,\nCVE-2025-37982, CVE-2025-37983, CVE-2025-37984, CVE-2025-37985,\nCVE-2025-37986, CVE-2025-37987, CVE-2025-37988, CVE-2025-37989,\nCVE-2025-37990, CVE-2025-37991, CVE-2025-37992, CVE-2025-37994,\nCVE-2025-37995, CVE-2025-37998, CVE-2025-38003, CVE-2025-38004,\nCVE-2025-38005, CVE-2025-38006, CVE-2025-38007, CVE-2025-38008,\nCVE-2025-38009, CVE-2025-38010, CVE-2025-38011, CVE-2025-38013,\nCVE-2025-38014, CVE-2025-38015, CVE-2025-38018, CVE-2025-38019,\nCVE-2025-38020, CVE-2025-38023, CVE-2025-38024, CVE-2025-38027,\nCVE-2025-38031, CVE-2025-38034, CVE-2025-38035, CVE-2025-38037,\nCVE-2025-38039, CVE-2025-38040, CVE-2025-38043, CVE-2025-38044,\nCVE-2025-38045, CVE-2025-38048, CVE-2025-38051, CVE-2025-38052,\nCVE-2025-38053, CVE-2025-38055, CVE-2025-38057, CVE-2025-38058,\nCVE-2025-38059, CVE-2025-38060, CVE-2025-38061, CVE-2025-38062,\nCVE-2025-38063, CVE-2025-38065, CVE-2025-38066, CVE-2025-38067,\nCVE-2025-38068, CVE-2025-38071, CVE-2025-38072, CVE-2025-38074,\nCVE-2025-38075, CVE-2025-38077, CVE-2025-38078, CVE-2025-38079,\nCVE-2025-38080, CVE-2025-38081, CVE-2025-38084, CVE-2025-38085,\nCVE-2025-38086, CVE-2025-38087, CVE-2025-38088, CVE-2025-38089,\nCVE-2025-38090, CVE-2025-38094, CVE-2025-38095, CVE-2025-38097,\nCVE-2025-38098, CVE-2025-38099, CVE-2025-38100, CVE-2025-38101,\nCVE-2025-38102, CVE-2025-38103, CVE-2025-38104, CVE-2025-38105,\nCVE-2025-38107, CVE-2025-38108, CVE-2025-38109, CVE-2025-38110,\nCVE-2025-38111, CVE-2025-38112, CVE-2025-38113, CVE-2025-38115,\nCVE-2025-38117, CVE-2025-38119, CVE-2025-38120, CVE-2025-38122,\nCVE-2025-38123, CVE-2025-38124, CVE-2025-38125, CVE-2025-38126,\nCVE-2025-38127, CVE-2025-38129, CVE-2025-38131, CVE-2025-38135,\nCVE-2025-38136, CVE-2025-38138, CVE-2025-38142, CVE-2025-38143,\nCVE-2025-38145, CVE-2025-38146, CVE-2025-38147, CVE-2025-38148,\nCVE-2025-38149, CVE-2025-38153, CVE-2025-38154, CVE-2025-38155,\nCVE-2025-38156, CVE-2025-38157, CVE-2025-38158, CVE-2025-38159,\nCVE-2025-38160, CVE-2025-38161, CVE-2025-38162, CVE-2025-38163,\nCVE-2025-38164, CVE-2025-38165, CVE-2025-38166, CVE-2025-38167,\nCVE-2025-38169, CVE-2025-38170, CVE-2025-38173, CVE-2025-38174,\nCVE-2025-38180, CVE-2025-38181, CVE-2025-38182, CVE-2025-38183,\nCVE-2025-38184, CVE-2025-38185, CVE-2025-38190, CVE-2025-38191,\nCVE-2025-38192, CVE-2025-38193, CVE-2025-38194, CVE-2025-38197,\nCVE-2025-38198, CVE-2025-38200, CVE-2025-38202, CVE-2025-38208,\nCVE-2025-38210, CVE-2025-38211, CVE-2025-38212, CVE-2025-38214,\nCVE-2025-38215, CVE-2025-38217, CVE-2025-38218, CVE-2025-38219,\nCVE-2025-38220, CVE-2025-38222, CVE-2025-38225, CVE-2025-38226,\nCVE-2025-38229, CVE-2025-38230, CVE-2025-38231, CVE-2025-38232,\nCVE-2025-38236, CVE-2025-38239, CVE-2025-38245, CVE-2025-38246,\nCVE-2025-38248, CVE-2025-38249, CVE-2025-38250, CVE-2025-38251,\nCVE-2025-38253, CVE-2025-38255, CVE-2025-38257, CVE-2025-38258,\nCVE-2025-38259, CVE-2025-38260, CVE-2025-38262, CVE-2025-38263,\nCVE-2025-38264, CVE-2025-38265, CVE-2025-38269, CVE-2025-38274,\nCVE-2025-38275, CVE-2025-38277, CVE-2025-38278, CVE-2025-38279,\nCVE-2025-38280, CVE-2025-38282, CVE-2025-38283, CVE-2025-38285,\nCVE-2025-38286, CVE-2025-38289, CVE-2025-38290, CVE-2025-38292,\nCVE-2025-38293, CVE-2025-38295, CVE-2025-38298, CVE-2025-38299,\nCVE-2025-38300, CVE-2025-38303, CVE-2025-38304, CVE-2025-38305,\nCVE-2025-38307, CVE-2025-38310, CVE-2025-38312, CVE-2025-38313,\nCVE-2025-38319, CVE-2025-38320, CVE-2025-38321, CVE-2025-38322,\nCVE-2025-38323, CVE-2025-38324, CVE-2025-38326, CVE-2025-38328,\nCVE-2025-38331, CVE-2025-38332, CVE-2025-38333, CVE-2025-38334,\nCVE-2025-38335, CVE-2025-38336, CVE-2025-38337, CVE-2025-38338,\nCVE-2025-38342, CVE-2025-38343, CVE-2025-38344, CVE-2025-38345,\nCVE-2025-38346, CVE-2025-38347, CVE-2025-38348, CVE-2025-38349,\nCVE-2025-38351, CVE-2025-38354, CVE-2025-38361, CVE-2025-38362,\nCVE-2025-38363, CVE-2025-38364, CVE-2025-38365, CVE-2025-38368,\nCVE-2025-38369, CVE-2025-38371, CVE-2025-38373, CVE-2025-38374,\nCVE-2025-38375, CVE-2025-38376, CVE-2025-38377, CVE-2025-38382,\nCVE-2025-38384, CVE-2025-38385, CVE-2025-38386, CVE-2025-38387,\nCVE-2025-38388, CVE-2025-38389, CVE-2025-38390, CVE-2025-38391,\nCVE-2025-38392, CVE-2025-38393, CVE-2025-38395, CVE-2025-38396,\nCVE-2025-38399, CVE-2025-38400, CVE-2025-38401, CVE-2025-38402,\nCVE-2025-38403, CVE-2025-38405, CVE-2025-38406, CVE-2025-38407,\nCVE-2025-38408, CVE-2025-38409, CVE-2025-38410, CVE-2025-38412,\nCVE-2025-38414, CVE-2025-38415, CVE-2025-38416, CVE-2025-38418,\nCVE-2025-38419, CVE-2025-38420, CVE-2025-38422, CVE-2025-38424,\nCVE-2025-38425, CVE-2025-38427, CVE-2025-38428, CVE-2025-38429,\nCVE-2025-38430, CVE-2025-38436, CVE-2025-38437, CVE-2025-38439,\nCVE-2025-38441, CVE-2025-38443, CVE-2025-38444, CVE-2025-38445,\nCVE-2025-38448, CVE-2025-38449, CVE-2025-38455, CVE-2025-38456,\nCVE-2025-38457, CVE-2025-38458, CVE-2025-38459, CVE-2025-38460,\nCVE-2025-38461, CVE-2025-38462, CVE-2025-38463, CVE-2025-38464,\nCVE-2025-38465, CVE-2025-38466, CVE-2025-38467, CVE-2025-38468,\nCVE-2025-38469, CVE-2025-38470, CVE-2025-38471, CVE-2025-38472,\nCVE-2025-38473, CVE-2025-38474, CVE-2025-38476, CVE-2025-38478,\nCVE-2025-38480, CVE-2025-38481, CVE-2025-38482, CVE-2025-38483,\nCVE-2025-38485, CVE-2025-38487, CVE-2025-38488, CVE-2025-38489,\nCVE-2025-38490, CVE-2025-38491, CVE-2025-38493, CVE-2025-38494,\nCVE-2025-38495, CVE-2025-38496, CVE-2025-38497, CVE-2025-38499,\nCVE-2025-38501, CVE-2025-38502, CVE-2025-38503, CVE-2025-38506,\nCVE-2025-38507, CVE-2025-38510, CVE-2025-38511, CVE-2025-38512,\nCVE-2025-38513, CVE-2025-38514, CVE-2025-38515, CVE-2025-38516,\nCVE-2025-38520, CVE-2025-38521, CVE-2025-38524, CVE-2025-38526,\nCVE-2025-38527, CVE-2025-38528, CVE-2025-38529, CVE-2025-38530,\nCVE-2025-38531, CVE-2025-38532, CVE-2025-38533, CVE-2025-38535,\nCVE-2025-38537, CVE-2025-38538, CVE-2025-38539, CVE-2025-38540,\nCVE-2025-38542, CVE-2025-38543, CVE-2025-38544, CVE-2025-38546,\nCVE-2025-38548, CVE-2025-38549, CVE-2025-38550, CVE-2025-38551,\nCVE-2025-38552, CVE-2025-38553, CVE-2025-38555, CVE-2025-38556,\nCVE-2025-38560, CVE-2025-38561, CVE-2025-38562, CVE-2025-38566,\nCVE-2025-38568, CVE-2025-38569, CVE-2025-38571, CVE-2025-38572,\nCVE-2025-38574, CVE-2025-38576, CVE-2025-38577, CVE-2025-38578,\nCVE-2025-38579, CVE-2025-38581, CVE-2025-38582, CVE-2025-38583,\nCVE-2025-38584, CVE-2025-38585, CVE-2025-38587, CVE-2025-38588,\nCVE-2025-38590, CVE-2025-38593, CVE-2025-38595, CVE-2025-38601,\nCVE-2025-38602, CVE-2025-38604, CVE-2025-38608, CVE-2025-38609,\nCVE-2025-38610, CVE-2025-38612, CVE-2025-38614, CVE-2025-38615,\nCVE-2025-38619, CVE-2025-38622, CVE-2025-38623, CVE-2025-38624,\nCVE-2025-38625, CVE-2025-38626, CVE-2025-38627, CVE-2025-38630,\nCVE-2025-38632, CVE-2025-38634, CVE-2025-38635, CVE-2025-38639,\nCVE-2025-38640, CVE-2025-38643, CVE-2025-38644, CVE-2025-38645,\nCVE-2025-38646, CVE-2025-38648, CVE-2025-38650, CVE-2025-38652,\nCVE-2025-38653, CVE-2025-38659, CVE-2025-38660, CVE-2025-38663,\nCVE-2025-38664, CVE-2025-38665, CVE-2025-38668, CVE-2025-38670,\nCVE-2025-38671, CVE-2025-38675, CVE-2025-38676, CVE-2025-38677,\nCVE-2025-38679, CVE-2025-38680, CVE-2025-38681, CVE-2025-38684,\nCVE-2025-38685, CVE-2025-38686, CVE-2025-38687, CVE-2025-38688,\nCVE-2025-38691, CVE-2025-38692, CVE-2025-38693, CVE-2025-38694,\nCVE-2025-38695, CVE-2025-38696, CVE-2025-38697, CVE-2025-38698,\nCVE-2025-38699, CVE-2025-38700, CVE-2025-38701, CVE-2025-38702,\nCVE-2025-38703, CVE-2025-38704, CVE-2025-38705, CVE-2025-38706,\nCVE-2025-38707, CVE-2025-38708, CVE-2025-38709, CVE-2025-38710,\nCVE-2025-38711, CVE-2025-38712, CVE-2025-38713, CVE-2025-38714,\nCVE-2025-38715, CVE-2025-38716, CVE-2025-38718, CVE-2025-38721,\nCVE-2025-38722, CVE-2025-38724, CVE-2025-38725, CVE-2025-38728,\nCVE-2025-38729, CVE-2025-38730, CVE-2025-38732, CVE-2025-38734,\nCVE-2025-38735, CVE-2025-39673, CVE-2025-39675, CVE-2025-39676,\nCVE-2025-39678, CVE-2025-39679, CVE-2025-39681, CVE-2025-39683,\nCVE-2025-39684, CVE-2025-39685, CVE-2025-39686, CVE-2025-39687,\nCVE-2025-39689, CVE-2025-39691, CVE-2025-39692, CVE-2025-39693,\nCVE-2025-39694, CVE-2025-39697, CVE-2025-39698, CVE-2025-39701,\nCVE-2025-39702, CVE-2025-39703, CVE-2025-39705, CVE-2025-39706,\nCVE-2025-39707, CVE-2025-39709, CVE-2025-39710, CVE-2025-39711,\nCVE-2025-39712, CVE-2025-39713, CVE-2025-39714, CVE-2025-39715,\nCVE-2025-39716, CVE-2025-39718, CVE-2025-39719, CVE-2025-39720,\nCVE-2025-39721, CVE-2025-39724, CVE-2025-39726, CVE-2025-39730,\nCVE-2025-39731, CVE-2025-39732, CVE-2025-39734, CVE-2025-39736,\nCVE-2025-39737, CVE-2025-39738, CVE-2025-39739, CVE-2025-39742,\nCVE-2025-39743, CVE-2025-39744, CVE-2025-39746, CVE-2025-39747,\nCVE-2025-39748, CVE-2025-39749, CVE-2025-39750, CVE-2025-39752,\nCVE-2025-39753, CVE-2025-39756, CVE-2025-39757, CVE-2025-39758,\nCVE-2025-39759, CVE-2025-39760, CVE-2025-39761, CVE-2025-39763,\nCVE-2025-39766, CVE-2025-39770, CVE-2025-39772, CVE-2025-39773,\nCVE-2025-39776, CVE-2025-39779, CVE-2025-39781, CVE-2025-39782,\nCVE-2025-39783, CVE-2025-39787, CVE-2025-39788, CVE-2025-39790,\nCVE-2025-39794, CVE-2025-39795, CVE-2025-39797, CVE-2025-39798,\nCVE-2025-39800, CVE-2025-39801, CVE-2025-39805, CVE-2025-39806,\nCVE-2025-39807, CVE-2025-39808, CVE-2025-39810, CVE-2025-39811,\nCVE-2025-39812, CVE-2025-39813, CVE-2025-39815, CVE-2025-39817,\nCVE-2025-39819, CVE-2025-39823, CVE-2025-39824, CVE-2025-39825,\nCVE-2025-39826, CVE-2025-39827, CVE-2025-39828, CVE-2025-39829,\nCVE-2025-39832, CVE-2025-39835, CVE-2025-39836, CVE-2025-39838,\nCVE-2025-39839, CVE-2025-39841, CVE-2025-39842, CVE-2025-39843,\nCVE-2025-39844, CVE-2025-39845, CVE-2025-39846, CVE-2025-39847,\nCVE-2025-39848, CVE-2025-39849, CVE-2025-39850, CVE-2025-39851,\nCVE-2025-39852, CVE-2025-39853, CVE-2025-39854, CVE-2025-39857,\nCVE-2025-39860, CVE-2025-39861, CVE-2025-39863, CVE-2025-39864,\nCVE-2025-39865, CVE-2025-39866, CVE-2025-39869, CVE-2025-39870,\nCVE-2025-39871, CVE-2025-39873, CVE-2025-39876, CVE-2025-39877,\nCVE-2025-39880, CVE-2025-39881, CVE-2025-39883, CVE-2025-39885,\nCVE-2025-39886, CVE-2025-39889, CVE-2025-39890, CVE-2025-39891,\nCVE-2025-39894, CVE-2025-39895, CVE-2025-39897, CVE-2025-39899,\nCVE-2025-39901, CVE-2025-39902, CVE-2025-39907, CVE-2025-39909,\nCVE-2025-39911, CVE-2025-39913, CVE-2025-39914, CVE-2025-39916,\nCVE-2025-39920, CVE-2025-39923, CVE-2025-39927, CVE-2025-39929,\nCVE-2025-39931, CVE-2025-39932, CVE-2025-39934, CVE-2025-39937,\nCVE-2025-39938, CVE-2025-39940, CVE-2025-39942, CVE-2025-39943,\nCVE-2025-39944, CVE-2025-39945, CVE-2025-39946, CVE-2025-39947,\nCVE-2025-39948, CVE-2025-39949, CVE-2025-39950, CVE-2025-39951,\nCVE-2025-39952, CVE-2025-39953, CVE-2025-39955, CVE-2025-39957,\nCVE-2025-39961, CVE-2025-39965, CVE-2025-39967, CVE-2025-39968,\nCVE-2025-39969, CVE-2025-39970, CVE-2025-39971, CVE-2025-39972,\nCVE-2025-39973, CVE-2025-39977, CVE-2025-39978, CVE-2025-39980,\nCVE-2025-39981, CVE-2025-39982, CVE-2025-39985, CVE-2025-39986,\nCVE-2025-39987, CVE-2025-39988, CVE-2025-39989, CVE-2025-39991,\nCVE-2025-39992, CVE-2025-39994, CVE-2025-39995, CVE-2025-39996,\nCVE-2025-39998, CVE-2025-40000, CVE-2025-40001, CVE-2025-40006,\nCVE-2025-40008, CVE-2025-40009, CVE-2025-40010, CVE-2025-40011,\nCVE-2025-40013, CVE-2025-40016, CVE-2025-40019, CVE-2025-40020,\nCVE-2025-40021, CVE-2025-40024, CVE-2025-40026, CVE-2025-40027,\nCVE-2025-40029, CVE-2025-40030, CVE-2025-40031, CVE-2025-40032,\nCVE-2025-40033, CVE-2025-40035, CVE-2025-40036, CVE-2025-40037,\nCVE-2025-40038, CVE-2025-40042, CVE-2025-40043, CVE-2025-40044,\nCVE-2025-40047, CVE-2025-40048, CVE-2025-40049, CVE-2025-40051,\nCVE-2025-40052, CVE-2025-40053, CVE-2025-40055, CVE-2025-40056,\nCVE-2025-40057, CVE-2025-40058, CVE-2025-40059, CVE-2025-40060,\nCVE-2025-40061, CVE-2025-40062, CVE-2025-40067, CVE-2025-40068,\nCVE-2025-40070, CVE-2025-40071, CVE-2025-40077, CVE-2025-40078,\nCVE-2025-40079, CVE-2025-40080, CVE-2025-40081, CVE-2025-40083,\nCVE-2025-40084, CVE-2025-40085, CVE-2025-40087, CVE-2025-40088,\nCVE-2025-40092, CVE-2025-40093, CVE-2025-40094, CVE-2025-40095,\nCVE-2025-40096, CVE-2025-40099, CVE-2025-40100, CVE-2025-40101,\nCVE-2025-40103, CVE-2025-40104, CVE-2025-40105, CVE-2025-40106,\nCVE-2025-40107, CVE-2025-40109, CVE-2025-40110, CVE-2025-40111,\nCVE-2025-40112, CVE-2025-40115, CVE-2025-40116, CVE-2025-40118,\nCVE-2025-40120, CVE-2025-40121, CVE-2025-40123, CVE-2025-40124,\nCVE-2025-40125, CVE-2025-40126, CVE-2025-40127, CVE-2025-40129,\nCVE-2025-40134, CVE-2025-40137, CVE-2025-40140, CVE-2025-40141,\nCVE-2025-40153, CVE-2025-40154, CVE-2025-40155, CVE-2025-40156,\nCVE-2025-40159, CVE-2025-40160, CVE-2025-40165, CVE-2025-40166,\nCVE-2025-40167, CVE-2025-40169, CVE-2025-40171, CVE-2025-40172,\nCVE-2025-40173, CVE-2025-40176, CVE-2025-40178, CVE-2025-40179,\nCVE-2025-40180, CVE-2025-40183, CVE-2025-40187, CVE-2025-40188,\nCVE-2025-40192, CVE-2025-40193, CVE-2025-40194, CVE-2025-40196,\nCVE-2025-40198, CVE-2025-40200, CVE-2025-40201, CVE-2025-40202,\nCVE-2025-40204, CVE-2025-40205, CVE-2025-40206, CVE-2025-40207,\nCVE-2025-40211, CVE-2025-40215, CVE-2025-40218, CVE-2025-40219,\nCVE-2025-40220, CVE-2025-40221, CVE-2025-40223, CVE-2025-40226,\nCVE-2025-40231, CVE-2025-40233, CVE-2025-40235, CVE-2025-40237,\nCVE-2025-40238, CVE-2025-40240, CVE-2025-40242, CVE-2025-40243,\nCVE-2025-40244, CVE-2025-40245, CVE-2025-40248, CVE-2025-40250,\nCVE-2025-40251, CVE-2025-40252, CVE-2025-40253, CVE-2025-40254,\nCVE-2025-40257, CVE-2025-40258, CVE-2025-40259, CVE-2025-40261,\nCVE-2025-40262, CVE-2025-40263, CVE-2025-40264, CVE-2025-40266,\nCVE-2025-40268, CVE-2025-40269, CVE-2025-40271, CVE-2025-40272,\nCVE-2025-40273, CVE-2025-40275, CVE-2025-40277, CVE-2025-40278,\nCVE-2025-40279, CVE-2025-40280, CVE-2025-40281, CVE-2025-40282,\nCVE-2025-40283, CVE-2025-40284, CVE-2025-40285, CVE-2025-40286,\nCVE-2025-40287, CVE-2025-40288, CVE-2025-40289, CVE-2025-40292,\nCVE-2025-40293, CVE-2025-40294, CVE-2025-40297, CVE-2025-40301,\nCVE-2025-40303, CVE-2025-40304, CVE-2025-40305, CVE-2025-40306,\nCVE-2025-40307, CVE-2025-40308, CVE-2025-40309, CVE-2025-40310,\nCVE-2025-40311, CVE-2025-40312, CVE-2025-40313, CVE-2025-40314,\nCVE-2025-40315, CVE-2025-40317, CVE-2025-40318, CVE-2025-40319,\nCVE-2025-40320, CVE-2025-40321, CVE-2025-40322, CVE-2025-40323,\nCVE-2025-40324, CVE-2025-40328, CVE-2025-40329, CVE-2025-40331,\nCVE-2025-40333, CVE-2025-40337, CVE-2025-40339, CVE-2025-40341,\nCVE-2025-40342, CVE-2025-40343, CVE-2025-40345, CVE-2025-40346,\nCVE-2025-40347, CVE-2025-40349, CVE-2025-40350, CVE-2025-40351,\nCVE-2025-40353, CVE-2025-40358, CVE-2025-40360, CVE-2025-40363,\nCVE-2025-68168, CVE-2025-68171, CVE-2025-68172, CVE-2025-68173,\nCVE-2025-68176, CVE-2025-68177, CVE-2025-68178, CVE-2025-68179,\nCVE-2025-68180, CVE-2025-68183, CVE-2025-68184, CVE-2025-68185,\nCVE-2025-68190, CVE-2025-68191, CVE-2025-68192, CVE-2025-68194,\nCVE-2025-68198, CVE-2025-68200, CVE-2025-68201, CVE-2025-68204,\nCVE-2025-68208, CVE-2025-68213, CVE-2025-68214, CVE-2025-68217,\nCVE-2025-68218, CVE-2025-68219, CVE-2025-68220, CVE-2025-68222,\nCVE-2025-68223, CVE-2025-68227, CVE-2025-68229, CVE-2025-68231,\nCVE-2025-68233, CVE-2025-68235, CVE-2025-68237, CVE-2025-68238,\nCVE-2025-68241, CVE-2025-68244, CVE-2025-68245, CVE-2025-68246,\nCVE-2025-68249, CVE-2025-68282, CVE-2025-68283, CVE-2025-68284,\nCVE-2025-68285, CVE-2025-68286, CVE-2025-68287, CVE-2025-68288,\nCVE-2025-68289, CVE-2025-68290, CVE-2025-68295, CVE-2025-68297,\nCVE-2025-68301, CVE-2025-68302, CVE-2025-68303, CVE-2025-68305,\nCVE-2025-68307, CVE-2025-68308, CVE-2025-68310, CVE-2025-68311,\nCVE-2025-68312, CVE-2025-68313, CVE-2025-68315, CVE-2025-68320,\nCVE-2025-68321, CVE-2025-68322, CVE-2025-68327, CVE-2025-68328,\nCVE-2025-68330, CVE-2025-68331, CVE-2025-68339, CVE-2025-68340,\nCVE-2025-68342, CVE-2025-68343, CVE-2025-68734, CVE-2025-68750)\n","status":"published","published":"2026-03-25T19:13:52Z","modified":"2026-11-03T14:35:29.863770912Z","updated_at":"2026-11-03T15:16:14.724953Z"},{"id":"USN-8165-1","title":"linux-azure-fips vulnerabilities","description":"Qualys discovered that several vulnerabilities existed in the AppArmor\nLinux kernel Security Module (LSM). An unprivileged local attacker could\nuse these issues to load, replace, and remove arbitrary AppArmor profiles\ncausing denial of service, exposure of sensitive information (kernel\nmemory), local privilege escalation, or possibly escape a container.\n(LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403,\nCVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407,\nCVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - MIPS architecture;\n  - Nios II architecture;\n  - PA-RISC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - Sun Sparc architecture;\n  - User-Mode Linux (UML);\n  - x86 architecture;\n  - Xtensa architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - ATM drivers;\n  - Drivers core;\n  - Block device driver;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Hardware random number generator core;\n  - Character device driver;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - DMA engine subsystem;\n  - ARM SCMI message protocol;\n  - EFI core;\n  - Intel Stratix 10 firmware drivers;\n  - GPU drivers;\n  - HID subsystem;\n  - CoreSight HW tracing drivers;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - Input Device (Tablet) drivers;\n  - IOMMU subsystem;\n  - ISDN/mISDN subsystem;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - Fastrpc Driver;\n  - MOST (Media Oriented Systems Transport) drivers;\n  - MTD block device drivers;\n  - Ethernet bonding driver;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - Texas Instruments network drivers;\n  - Ethernet team driver;\n  - NVME drivers;\n  - PCI subsystem;\n  - PCCARD (PCMCIA/CardBus) bus subsystem;\n  - Performance monitor drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - ARM PM domains;\n  - PPS (Pulse Per Second) driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - Texas Instruments SoC drivers;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - TTY drivers;\n  - Userspace I/O drivers;\n  - Cadence USB3 driver;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Renesas USBHS Controller drivers;\n  - USB Mass Storage drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Framebuffer layer;\n  - Xen hypervisor drivers;\n  - AFS file system;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - File systems infrastructure;\n  - EFI Variable file system;\n  - exFAT file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - GFS2 file system;\n  - HFS file system;\n  - HFS+ file system;\n  - HugeTLB file system;\n  - JFS file system;\n  - KERNFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - OrangeFS file system;\n  - Proc file system;\n  - Diskquota system;\n  - SMB network file system;\n  - SquashFS file system;\n  - UDF file system;\n  - XFS file system;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - BPF subsystem;\n  - Mellanox drivers;\n  - NFS page cache wrapper;\n  - Memory management;\n  - Memory Management;\n  - Media input infrastructure;\n  - Bluetooth subsystem;\n  - IP tunnels definitions;\n  - Network traffic control;\n  - Rose network layer;\n  - Network sockets;\n  - io_uring subsystem;\n  - Control group (cgroup);\n  - Kernel crash support code;\n  - Kernel futex primitives;\n  - PID allocator;\n  - Scheduler infrastructure;\n  - Syscalls implementation;\n  - Timer subsystem;\n  - Tracing infrastructure;\n  - 9P file system network protocol;\n  - Amateur Radio drivers;\n  - B.A.T.M.A.N. meshing protocol;\n  - Ethernet bridge;\n  - Ceph Core library;\n  - Networking core;\n  - Devlink API;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - Open vSwitch;\n  - RF switch subsystem;\n  - SCTP protocol;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Intel ASoC drivers;\n  - QCOM ASoC drivers;\n  - USB sound devices;\n(CVE-2025-21833, CVE-2025-22103, CVE-2025-22105, CVE-2025-22106,\nCVE-2025-22107, CVE-2025-22113, CVE-2025-22121, CVE-2025-22124,\nCVE-2025-22125, CVE-2025-23129, CVE-2025-23130, CVE-2025-23133,\nCVE-2025-23143, CVE-2025-37860, CVE-2025-38105, CVE-2025-38502,\nCVE-2025-38556, CVE-2025-38627, CVE-2025-38643, CVE-2025-38709,\nCVE-2025-39678, CVE-2025-39697, CVE-2025-39805, CVE-2025-39806,\nCVE-2025-39807, CVE-2025-39808, CVE-2025-39810, CVE-2025-39811,\nCVE-2025-39812, CVE-2025-39813, CVE-2025-39815, CVE-2025-39817,\nCVE-2025-39819, CVE-2025-39823, CVE-2025-39824, CVE-2025-39825,\nCVE-2025-39826, CVE-2025-39827, CVE-2025-39828, CVE-2025-39829,\nCVE-2025-39832, CVE-2025-39835, CVE-2025-39836, CVE-2025-39838,\nCVE-2025-39839, CVE-2025-39841, CVE-2025-39842, CVE-2025-39843,\nCVE-2025-39844, CVE-2025-39845, CVE-2025-39846, CVE-2025-39847,\nCVE-2025-39848, CVE-2025-39849, CVE-2025-39850, CVE-2025-39851,\nCVE-2025-39852, CVE-2025-39853, CVE-2025-39854, CVE-2025-39857,\nCVE-2025-39860, CVE-2025-39861, CVE-2025-39863, CVE-2025-39864,\nCVE-2025-39865, CVE-2025-39866, CVE-2025-39869, CVE-2025-39870,\nCVE-2025-39871, CVE-2025-39873, CVE-2025-39876, CVE-2025-39877,\nCVE-2025-39880, CVE-2025-39881, CVE-2025-39883, CVE-2025-39885,\nCVE-2025-39886, CVE-2025-39891, CVE-2025-39894, CVE-2025-39895,\nCVE-2025-39897, CVE-2025-39899, CVE-2025-39901, CVE-2025-39902,\nCVE-2025-39907, CVE-2025-39909, CVE-2025-39911, CVE-2025-39913,\nCVE-2025-39914, CVE-2025-39916, CVE-2025-39920, CVE-2025-39923,\nCVE-2025-39927, CVE-2025-39929, CVE-2025-39931, CVE-2025-39932,\nCVE-2025-39934, CVE-2025-39937, CVE-2025-39938, CVE-2025-39940,\nCVE-2025-39942, CVE-2025-39943, CVE-2025-39944, CVE-2025-39945,\nCVE-2025-39947, CVE-2025-39948, CVE-2025-39949, CVE-2025-39950,\nCVE-2025-39951, CVE-2025-39952, CVE-2025-39953, CVE-2025-39955,\nCVE-2025-39957, CVE-2025-39961, CVE-2025-39965, CVE-2025-39967,\nCVE-2025-39968, CVE-2025-39969, CVE-2025-39970, CVE-2025-39971,\nCVE-2025-39972, CVE-2025-39973, CVE-2025-39977, CVE-2025-39978,\nCVE-2025-39980, CVE-2025-39981, CVE-2025-39982, CVE-2025-39985,\nCVE-2025-39986, CVE-2025-39987, CVE-2025-39988, CVE-2025-39991,\nCVE-2025-39992, CVE-2025-39994, CVE-2025-39995, CVE-2025-39996,\nCVE-2025-39998, CVE-2025-40000, CVE-2025-40001, CVE-2025-40006,\nCVE-2025-40008, CVE-2025-40009, CVE-2025-40010, CVE-2025-40011,\nCVE-2025-40013, CVE-2025-40016, CVE-2025-40020, CVE-2025-40021,\nCVE-2025-40024, CVE-2025-40026, CVE-2025-40027, CVE-2025-40029,\nCVE-2025-40030, CVE-2025-40031, CVE-2025-40032, CVE-2025-40033,\nCVE-2025-40035, CVE-2025-40036, CVE-2025-40037, CVE-2025-40038,\nCVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40047,\nCVE-2025-40048, CVE-2025-40049, CVE-2025-40051, CVE-2025-40052,\nCVE-2025-40053, CVE-2025-40055, CVE-2025-40056, CVE-2025-40057,\nCVE-2025-40058, CVE-2025-40059, CVE-2025-40060, CVE-2025-40061,\nCVE-2025-40062, CVE-2025-40067, CVE-2025-40068, CVE-2025-40070,\nCVE-2025-40071, CVE-2025-40077, CVE-2025-40078, CVE-2025-40079,\nCVE-2025-40080, CVE-2025-40081, CVE-2025-40083, CVE-2025-40084,\nCVE-2025-40085, CVE-2025-40087, CVE-2025-40088, CVE-2025-40092,\nCVE-2025-40093, CVE-2025-40094, CVE-2025-40095, CVE-2025-40096,\nCVE-2025-40099, CVE-2025-40100, CVE-2025-40101, CVE-2025-40103,\nCVE-2025-40104, CVE-2025-40105, CVE-2025-40106, CVE-2025-40107,\nCVE-2025-40109, CVE-2025-40110, CVE-2025-40111, CVE-2025-40112,\nCVE-2025-40115, CVE-2025-40116, CVE-2025-40118, CVE-2025-40120,\nCVE-2025-40121, CVE-2025-40123, CVE-2025-40124, CVE-2025-40125,\nCVE-2025-40126, CVE-2025-40127, CVE-2025-40129, CVE-2025-40134,\nCVE-2025-40137, CVE-2025-40140, CVE-2025-40141, CVE-2025-40153,\nCVE-2025-40154, CVE-2025-40155, CVE-2025-40156, CVE-2025-40159,\nCVE-2025-40160, CVE-2025-40165, CVE-2025-40166, CVE-2025-40167,\nCVE-2025-40169, CVE-2025-40171, CVE-2025-40172, CVE-2025-40173,\nCVE-2025-40176, CVE-2025-40178, CVE-2025-40179, CVE-2025-40180,\nCVE-2025-40183, CVE-2025-40187, CVE-2025-40188, CVE-2025-40192,\nCVE-2025-40193, CVE-2025-40194, CVE-2025-40196, CVE-2025-40198,\nCVE-2025-40200, CVE-2025-40201, CVE-2025-40202, CVE-2025-40204,\nCVE-2025-40205, CVE-2025-40206, CVE-2025-40207, CVE-2025-40211,\nCVE-2025-40218, CVE-2025-40219, CVE-2025-40220, CVE-2025-40221,\nCVE-2025-40223, CVE-2025-40226, CVE-2025-40231, CVE-2025-40233,\nCVE-2025-40235, CVE-2025-40237, CVE-2025-40238, CVE-2025-40240,\nCVE-2025-40242, CVE-2025-40243, CVE-2025-40244, CVE-2025-40245,\nCVE-2025-40248, CVE-2025-40250, CVE-2025-40251, CVE-2025-40252,\nCVE-2025-40253, CVE-2025-40254, CVE-2025-40257, CVE-2025-40258,\nCVE-2025-40259, CVE-2025-40261, CVE-2025-40262, CVE-2025-40263,\nCVE-2025-40264, CVE-2025-40266, CVE-2025-40268, CVE-2025-40269,\nCVE-2025-40271, CVE-2025-40272, CVE-2025-40273, CVE-2025-40275,\nCVE-2025-40277, CVE-2025-40278, CVE-2025-40279, CVE-2025-40280,\nCVE-2025-40281, CVE-2025-40282, CVE-2025-40283, CVE-2025-40284,\nCVE-2025-40285, CVE-2025-40286, CVE-2025-40287, CVE-2025-40288,\nCVE-2025-40289, CVE-2025-40292, CVE-2025-40293, CVE-2025-40294,\nCVE-2025-40301, CVE-2025-40303, CVE-2025-40304, CVE-2025-40305,\nCVE-2025-40306, CVE-2025-40307, CVE-2025-40308, CVE-2025-40309,\nCVE-2025-40310, CVE-2025-40311, CVE-2025-40312, CVE-2025-40313,\nCVE-2025-40314, CVE-2025-40315, CVE-2025-40317, CVE-2025-40318,\nCVE-2025-40319, CVE-2025-40320, CVE-2025-40321, CVE-2025-40322,\nCVE-2025-40323, CVE-2025-40324, CVE-2025-40328, CVE-2025-40329,\nCVE-2025-40331, CVE-2025-40333, CVE-2025-40337, CVE-2025-40339,\nCVE-2025-40341, CVE-2025-40342, CVE-2025-40343, CVE-2025-40345,\nCVE-2025-40346, CVE-2025-40347, CVE-2025-40349, CVE-2025-40350,\nCVE-2025-40351, CVE-2025-40353, CVE-2025-40358, CVE-2025-40360,\nCVE-2025-40363, CVE-2025-68168, CVE-2025-68171, CVE-2025-68172,\nCVE-2025-68173, CVE-2025-68176, CVE-2025-68177, CVE-2025-68178,\nCVE-2025-68179, CVE-2025-68180, CVE-2025-68183, CVE-2025-68184,\nCVE-2025-68185, CVE-2025-68190, CVE-2025-68191, CVE-2025-68192,\nCVE-2025-68194, CVE-2025-68198, CVE-2025-68200, CVE-2025-68201,\nCVE-2025-68204, CVE-2025-68208, CVE-2025-68213, CVE-2025-68214,\nCVE-2025-68217, CVE-2025-68218, CVE-2025-68219, CVE-2025-68220,\nCVE-2025-68222, CVE-2025-68223, CVE-2025-68227, CVE-2025-68229,\nCVE-2025-68231, CVE-2025-68233, CVE-2025-68235, CVE-2025-68237,\nCVE-2025-68238, CVE-2025-68241, CVE-2025-68244, CVE-2025-68245,\nCVE-2025-68246, CVE-2025-68249, CVE-2025-68282, CVE-2025-68283,\nCVE-2025-68284, CVE-2025-68285, CVE-2025-68286, CVE-2025-68287,\nCVE-2025-68288, CVE-2025-68289, CVE-2025-68290, CVE-2025-68295,\nCVE-2025-68297, CVE-2025-68301, CVE-2025-68302, CVE-2025-68303,\nCVE-2025-68305, CVE-2025-68307, CVE-2025-68308, CVE-2025-68310,\nCVE-2025-68311, CVE-2025-68312, CVE-2025-68313, CVE-2025-68315,\nCVE-2025-68320, CVE-2025-68321, CVE-2025-68322, CVE-2025-68327,\nCVE-2025-68328, CVE-2025-68330, CVE-2025-68331, CVE-2025-68339,\nCVE-2025-68340, CVE-2025-68342, CVE-2025-68343, CVE-2025-68734,\nCVE-2026-23060, CVE-2026-23074, CVE-2026-23111)\n","status":"published","published":"2026-04-09T23:38:24Z","modified":"2026-11-04T20:01:11.526209673Z","updated_at":"2026-11-04T20:16:32.566315Z"},{"id":"USN-8261-1","title":"linux-xilinx vulnerabilities","description":"Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo\nRizzo discovered that some AMD Zen processors did not properly verify the\nsignature of CPU microcode. This flaw is known as EntrySign. A privileged\nattacker could possibly use this issue to cause load malicious CPU\nmicrocode causing loss of integrity and confidentiality. (CVE-2024-36347)\n\nQualys discovered that several vulnerabilities existed in the AppArmor\nLinux kernel Security Module (LSM). An unprivileged local attacker could\nuse these issues to load, replace, and remove arbitrary AppArmor profiles\ncausing denial of service, exposure of sensitive information (kernel\nmemory), local privilege escalation, or possibly escape a container.\n(LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403,\nCVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407,\nCVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - MIPS architecture;\n  - Nios II architecture;\n  - PA-RISC architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - Sun Sparc architecture;\n  - User-Mode Linux (UML);\n  - x86 architecture;\n  - Xtensa architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - ATM drivers;\n  - Drivers core;\n  - Block device driver;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Character device driver;\n  - Hardware random number generator core;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - DMA engine subsystem;\n  - ARM SCMI message protocol;\n  - EFI core;\n  - Intel Stratix 10 firmware drivers;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - CoreSight HW tracing drivers;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - Input Device (Tablet) drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - ISDN/mISDN subsystem;\n  - Macintosh device drivers;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - Fastrpc Driver;\n  - MOST (Media Oriented Systems Transport) drivers;\n  - MTD block device drivers;\n  - Ethernet bonding driver;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - Texas Instruments network drivers;\n  - Ethernet team driver;\n  - MediaTek network drivers;\n  - NVME drivers;\n  - PA-RISC drivers;\n  - PCI subsystem;\n  - PCCARD (PCMCIA/CardBus) bus subsystem;\n  - Performance monitor drivers;\n  - Pin controllers subsystem;\n  - Chrome hardware platform drivers;\n  - x86 platform drivers;\n  - ARM PM domains;\n  - PPS (Pulse Per Second) driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - Voltage and Current Regulator drivers;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - Texas Instruments SoC drivers;\n  - SPI subsystem;\n  - Media Oriented Systems Transport (MOST) driver;\n  - Realtek RTL8723BS SDIO drivers;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - TTY drivers;\n  - Userspace I/O drivers;\n  - Cadence USB3 driver;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Renesas USBHS Controller drivers;\n  - USB Mass Storage drivers;\n  - USB Type-C Connector System Software Interface driver;\n  - Virtio Host (VHOST) subsystem;\n  - Backlight driver;\n  - Framebuffer layer;\n  - Watchdog drivers;\n  - Xen hypervisor drivers;\n  - AFS file system;\n  - BFS file system;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - File systems infrastructure;\n  - EFI Variable file system;\n  - exFAT file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - GFS2 file system;\n  - HFS file system;\n  - HFS+ file system;\n  - HugeTLB file system;\n  - Journaling layer for block devices (JBD2);\n  - JFS file system;\n  - KERNFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - OrangeFS file system;\n  - Proc file system;\n  - Diskquota system;\n  - SMB network file system;\n  - SquashFS file system;\n  - UDF file system;\n  - XFS file system;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - BPF subsystem;\n  - Ethernet bridge;\n  - Mellanox drivers;\n  - NFS page cache wrapper;\n  - Memory management;\n  - Memory Management;\n  - Media input infrastructure;\n  - Bluetooth subsystem;\n  - IP tunnels definitions;\n  - Network traffic control;\n  - Rose network layer;\n  - Network sockets;\n  - io_uring subsystem;\n  - Control group (cgroup);\n  - Kernel crash support code;\n  - Kernel futex primitives;\n  - Locking primitives;\n  - PID allocator;\n  - Scheduler infrastructure;\n  - Shadow Call Stack mechanism;\n  - Syscalls implementation;\n  - Timer subsystem;\n  - Tracing infrastructure;\n  - 9P file system network protocol;\n  - Amateur Radio drivers;\n  - B.A.T.M.A.N. meshing protocol;\n  - CAIF protocol;\n  - Ceph Core library;\n  - Networking core;\n  - Devlink API;\n  - Ethtool driver;\n  - Handshake API;\n  - HSR network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NET/ROM layer;\n  - NFC subsystem;\n  - Open vSwitch;\n  - RF switch subsystem;\n  - SCTP protocol;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Key management;\n  - Simplified Mandatory Access Control Kernel framework;\n  - FireWire sound drivers;\n  - HD-audio driver;\n  - Turtle Beach Wavefront ALSA driver;\n  - Intel ASoC drivers;\n  - QCOM ASoC drivers;\n  - STMicroelectronics SoC drivers;\n  - USB sound devices;\n  - KVM subsystem;\n(CVE-2024-57795, CVE-2025-21833, CVE-2025-22022, CVE-2025-22103,\nCVE-2025-22105, CVE-2025-22106, CVE-2025-22107, CVE-2025-22111,\nCVE-2025-22113, CVE-2025-22121, CVE-2025-22124, CVE-2025-22125,\nCVE-2025-23129, CVE-2025-23130, CVE-2025-23133, CVE-2025-23143,\nCVE-2025-37860, CVE-2025-38022, CVE-2025-38105, CVE-2025-38234,\nCVE-2025-38502, CVE-2025-38556, CVE-2025-38627, CVE-2025-38643,\nCVE-2025-38709, CVE-2025-39678, CVE-2025-39697, CVE-2025-39805,\nCVE-2025-39806, CVE-2025-39807, CVE-2025-39808, CVE-2025-39810,\nCVE-2025-39811, CVE-2025-39812, CVE-2025-39813, CVE-2025-39815,\nCVE-2025-39817, CVE-2025-39819, CVE-2025-39823, CVE-2025-39824,\nCVE-2025-39825, CVE-2025-39826, CVE-2025-39827, CVE-2025-39828,\nCVE-2025-39829, CVE-2025-39832, CVE-2025-39835, CVE-2025-39836,\nCVE-2025-39838, CVE-2025-39839, CVE-2025-39841, CVE-2025-39842,\nCVE-2025-39843, CVE-2025-39844, CVE-2025-39845, CVE-2025-39846,\nCVE-2025-39847, CVE-2025-39848, CVE-2025-39849, CVE-2025-39850,\nCVE-2025-39851, CVE-2025-39852, CVE-2025-39853, CVE-2025-39854,\nCVE-2025-39857, CVE-2025-39860, CVE-2025-39861, CVE-2025-39863,\nCVE-2025-39864, CVE-2025-39865, CVE-2025-39866, CVE-2025-39869,\nCVE-2025-39870, CVE-2025-39871, CVE-2025-39873, CVE-2025-39876,\nCVE-2025-39877, CVE-2025-39880, CVE-2025-39881, CVE-2025-39883,\nCVE-2025-39885, CVE-2025-39886, CVE-2025-39891, CVE-2025-39894,\nCVE-2025-39895, CVE-2025-39899, CVE-2025-39901, CVE-2025-39902,\nCVE-2025-39907, CVE-2025-39909, CVE-2025-39911, CVE-2025-39913,\nCVE-2025-39914, CVE-2025-39916, CVE-2025-39920, CVE-2025-39923,\nCVE-2025-39927, CVE-2025-39929, CVE-2025-39931, CVE-2025-39932,\nCVE-2025-39934, CVE-2025-39937, CVE-2025-39938, CVE-2025-39940,\nCVE-2025-39942, CVE-2025-39943, CVE-2025-39944, CVE-2025-39945,\nCVE-2025-39947, CVE-2025-39948, CVE-2025-39949, CVE-2025-39950,\nCVE-2025-39951, CVE-2025-39952, CVE-2025-39953, CVE-2025-39955,\nCVE-2025-39957, CVE-2025-39961, CVE-2025-39965, CVE-2025-39967,\nCVE-2025-39968, CVE-2025-39969, CVE-2025-39970, CVE-2025-39971,\nCVE-2025-39972, CVE-2025-39973, CVE-2025-39977, CVE-2025-39978,\nCVE-2025-39980, CVE-2025-39981, CVE-2025-39982, CVE-2025-39985,\nCVE-2025-39986, CVE-2025-39987, CVE-2025-39988, CVE-2025-39991,\nCVE-2025-39992, CVE-2025-39994, CVE-2025-39995, CVE-2025-39996,\nCVE-2025-39998, CVE-2025-40000, CVE-2025-40001, CVE-2025-40006,\nCVE-2025-40008, CVE-2025-40009, CVE-2025-40010, CVE-2025-40011,\nCVE-2025-40013, CVE-2025-40016, CVE-2025-40020, CVE-2025-40021,\nCVE-2025-40024, CVE-2025-40026, CVE-2025-40027, CVE-2025-40029,\nCVE-2025-40030, CVE-2025-40031, CVE-2025-40032, CVE-2025-40033,\nCVE-2025-40035, CVE-2025-40036, CVE-2025-40037, CVE-2025-40038,\nCVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40047,\nCVE-2025-40048, CVE-2025-40049, CVE-2025-40051, CVE-2025-40052,\nCVE-2025-40053, CVE-2025-40055, CVE-2025-40056, CVE-2025-40057,\nCVE-2025-40058, CVE-2025-40059, CVE-2025-40060, CVE-2025-40061,\nCVE-2025-40062, CVE-2025-40067, CVE-2025-40068, CVE-2025-40070,\nCVE-2025-40071, CVE-2025-40077, CVE-2025-40078, CVE-2025-40079,\nCVE-2025-40080, CVE-2025-40081, CVE-2025-40083, CVE-2025-40084,\nCVE-2025-40085, CVE-2025-40087, CVE-2025-40088, CVE-2025-40092,\nCVE-2025-40093, CVE-2025-40094, CVE-2025-40095, CVE-2025-40096,\nCVE-2025-40099, CVE-2025-40100, CVE-2025-40101, CVE-2025-40103,\nCVE-2025-40104, CVE-2025-40105, CVE-2025-40106, CVE-2025-40107,\nCVE-2025-40109, CVE-2025-40110, CVE-2025-40111, CVE-2025-40112,\nCVE-2025-40115, CVE-2025-40116, CVE-2025-40118, CVE-2025-40120,\nCVE-2025-40121, CVE-2025-40123, CVE-2025-40124, CVE-2025-40125,\nCVE-2025-40126, CVE-2025-40127, CVE-2025-40129, CVE-2025-40134,\nCVE-2025-40137, CVE-2025-40140, CVE-2025-40141, CVE-2025-40153,\nCVE-2025-40154, CVE-2025-40155, CVE-2025-40156, CVE-2025-40159,\nCVE-2025-40160, CVE-2025-40164, CVE-2025-40165, CVE-2025-40166,\nCVE-2025-40167, CVE-2025-40169, CVE-2025-40171, CVE-2025-40172,\nCVE-2025-40173, CVE-2025-40176, CVE-2025-40178, CVE-2025-40179,\nCVE-2025-40180, CVE-2025-40183, CVE-2025-40187, CVE-2025-40188,\nCVE-2025-40192, CVE-2025-40193, CVE-2025-40194, CVE-2025-40196,\nCVE-2025-40198, CVE-2025-40200, CVE-2025-40201, CVE-2025-40202,\nCVE-2025-40204, CVE-2025-40205, CVE-2025-40206, CVE-2025-40207,\nCVE-2025-40211, CVE-2025-40218, CVE-2025-40219, CVE-2025-40220,\nCVE-2025-40221, CVE-2025-40223, CVE-2025-40226, CVE-2025-40231,\nCVE-2025-40233, CVE-2025-40235, CVE-2025-40237, CVE-2025-40238,\nCVE-2025-40240, CVE-2025-40242, CVE-2025-40243, CVE-2025-40244,\nCVE-2025-40245, CVE-2025-40248, CVE-2025-40250, CVE-2025-40251,\nCVE-2025-40252, CVE-2025-40253, CVE-2025-40254, CVE-2025-40257,\nCVE-2025-40258, CVE-2025-40259, CVE-2025-40261, CVE-2025-40262,\nCVE-2025-40263, CVE-2025-40264, CVE-2025-40266, CVE-2025-40268,\nCVE-2025-40269, CVE-2025-40271, CVE-2025-40272, CVE-2025-40273,\nCVE-2025-40275, CVE-2025-40277, CVE-2025-40278, CVE-2025-40279,\nCVE-2025-40280, CVE-2025-40281, CVE-2025-40282, CVE-2025-40283,\nCVE-2025-40284, CVE-2025-40285, CVE-2025-40286, CVE-2025-40287,\nCVE-2025-40288, CVE-2025-40289, CVE-2025-40292, CVE-2025-40293,\nCVE-2025-40294, CVE-2025-40301, CVE-2025-40303, CVE-2025-40304,\nCVE-2025-40305, CVE-2025-40306, CVE-2025-40307, CVE-2025-40308,\nCVE-2025-40309, CVE-2025-40310, CVE-2025-40311, CVE-2025-40312,\nCVE-2025-40313, CVE-2025-40314, CVE-2025-40315, CVE-2025-40317,\nCVE-2025-40318, CVE-2025-40319, CVE-2025-40320, CVE-2025-40321,\nCVE-2025-40322, CVE-2025-40323, CVE-2025-40324, CVE-2025-40325,\nCVE-2025-40328, CVE-2025-40329, CVE-2025-40331, CVE-2025-40333,\nCVE-2025-40337, CVE-2025-40339, CVE-2025-40341, CVE-2025-40342,\nCVE-2025-40343, CVE-2025-40345, CVE-2025-40346, CVE-2025-40347,\nCVE-2025-40349, CVE-2025-40350, CVE-2025-40351, CVE-2025-40353,\nCVE-2025-40358, CVE-2025-40360, CVE-2025-40363, CVE-2025-68168,\nCVE-2025-68171, CVE-2025-68172, CVE-2025-68173, CVE-2025-68176,\nCVE-2025-68177, CVE-2025-68178, CVE-2025-68179, CVE-2025-68180,\nCVE-2025-68183, CVE-2025-68184, CVE-2025-68185, CVE-2025-68190,\nCVE-2025-68191, CVE-2025-68192, CVE-2025-68194, CVE-2025-68198,\nCVE-2025-68200, CVE-2025-68201, CVE-2025-68204, CVE-2025-68206,\nCVE-2025-68208, CVE-2025-68213, CVE-2025-68214, CVE-2025-68217,\nCVE-2025-68218, CVE-2025-68219, CVE-2025-68220, CVE-2025-68222,\nCVE-2025-68223, CVE-2025-68227, CVE-2025-68229, CVE-2025-68231,\nCVE-2025-68233, CVE-2025-68235, CVE-2025-68237, CVE-2025-68238,\nCVE-2025-68241, CVE-2025-68244, CVE-2025-68245, CVE-2025-68246,\nCVE-2025-68249, CVE-2025-68254, CVE-2025-68255, CVE-2025-68256,\nCVE-2025-68257, CVE-2025-68258, CVE-2025-68259, CVE-2025-68261,\nCVE-2025-68263, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266,\nCVE-2025-68282, CVE-2025-68283, CVE-2025-68284, CVE-2025-68285,\nCVE-2025-68286, CVE-2025-68287, CVE-2025-68288, CVE-2025-68289,\nCVE-2025-68290, CVE-2025-68295, CVE-2025-68297, CVE-2025-68301,\nCVE-2025-68302, CVE-2025-68303, CVE-2025-68305, CVE-2025-68307,\nCVE-2025-68308, CVE-2025-68310, CVE-2025-68311, CVE-2025-68312,\nCVE-2025-68313, CVE-2025-68315, CVE-2025-68320, CVE-2025-68321,\nCVE-2025-68322, CVE-2025-68325, CVE-2025-68327, CVE-2025-68328,\nCVE-2025-68330, CVE-2025-68331, CVE-2025-68332, CVE-2025-68335,\nCVE-2025-68336, CVE-2025-68337, CVE-2025-68339, CVE-2025-68340,\nCVE-2025-68342, CVE-2025-68343, CVE-2025-68344, CVE-2025-68345,\nCVE-2025-68346, CVE-2025-68347, CVE-2025-68349, CVE-2025-68354,\nCVE-2025-68362, CVE-2025-68363, CVE-2025-68364, CVE-2025-68366,\nCVE-2025-68367, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374,\nCVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724,\nCVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733,\nCVE-2025-68734, CVE-2025-68740, CVE-2025-68741, CVE-2025-68742,\nCVE-2025-68744, CVE-2025-68746, CVE-2025-68753, CVE-2025-68755,\nCVE-2025-68756, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759,\nCVE-2025-68763, CVE-2025-68764, CVE-2025-68765, CVE-2025-68766,\nCVE-2025-68767, CVE-2025-68769, CVE-2025-68770, CVE-2025-68771,\nCVE-2025-68772, CVE-2025-68773, CVE-2025-68774, CVE-2025-68775,\nCVE-2025-68776, CVE-2025-68777, CVE-2025-68778, CVE-2025-68780,\nCVE-2025-68782, CVE-2025-68783, CVE-2025-68785, CVE-2025-68786,\nCVE-2025-68787, CVE-2025-68788, CVE-2025-68794, CVE-2025-68795,\nCVE-2025-68796, CVE-2025-68797, CVE-2025-68798, CVE-2025-68799,\nCVE-2025-68800, CVE-2025-68801, CVE-2025-68804, CVE-2025-68806,\nCVE-2025-68808, CVE-2025-68809, CVE-2025-68810, CVE-2025-68811,\nCVE-2025-68813, CVE-2025-68814, CVE-2025-68815, CVE-2025-68816,\nCVE-2025-68817, CVE-2025-68818, CVE-2025-68819, CVE-2025-68820,\nCVE-2025-71064, CVE-2025-71065, CVE-2025-71066, CVE-2025-71067,\nCVE-2025-71068, CVE-2025-71069, CVE-2025-71071, CVE-2025-71072,\nCVE-2025-71075, CVE-2025-71077, CVE-2025-71078, CVE-2025-71079,\nCVE-2025-71081, CVE-2025-71082, CVE-2025-71083, CVE-2025-71084,\nCVE-2025-71085, CVE-2025-71086, CVE-2025-71087, CVE-2025-71088,\nCVE-2025-71089, CVE-2025-71091, CVE-2025-71093, CVE-2025-71094,\nCVE-2025-71095, CVE-2025-71096, CVE-2025-71097, CVE-2025-71098,\nCVE-2025-71101, CVE-2025-71102, CVE-2025-71104, CVE-2025-71105,\nCVE-2025-71107, CVE-2025-71108, CVE-2025-71109, CVE-2025-71111,\nCVE-2025-71112, CVE-2025-71113, CVE-2025-71114, CVE-2025-71116,\nCVE-2025-71118, CVE-2025-71119, CVE-2025-71120, CVE-2025-71121,\nCVE-2025-71122, CVE-2025-71125, CVE-2025-71126, CVE-2025-71127,\nCVE-2025-71130, CVE-2025-71131, CVE-2025-71132, CVE-2025-71133,\nCVE-2025-71135, CVE-2025-71136, CVE-2025-71137, CVE-2025-71138,\nCVE-2025-71140, CVE-2025-71141, CVE-2025-71143, CVE-2025-71147,\nCVE-2025-71148, CVE-2025-71150, CVE-2025-71151, CVE-2025-71153,\nCVE-2025-71154, CVE-2026-23060, CVE-2026-23074, CVE-2026-23111,\nCVE-2026-23112, CVE-2026-23209, CVE-2026-23231, CVE-2026-23273)\n","status":"published","published":"2026-05-07T15:54:20Z","modified":"2026-09-07T14:05:25.637433365Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}