{"id":"CVE-2025-40136","aliases":["BELL-CVE-2025-40136","DEBIAN-CVE-2025-40136","EUVD-2025-124947","GHSA-p5f2-4xpv-wwqj","OESA-2026-2417","OESA-2026-2418","ROOT-OS-DEBIAN-12-CVE-2025-40136","ROOT-OS-UBUNTU-2404-CVE-2025-40136","SUSE-SU-2026:0447-1","SUSE-SU-2026:0472-1","SUSE-SU-2026:0587-1","SUSE-SU-2026:24179-1","SUSE-SU-2026:24184-1","SUSE-SU-2026:24197-1","SUSE-SU-2026:24235-1","UBUNTU-CVE-2025-40136","USN-8029-1","USN-8029-2","USN-8029-3","USN-8030-1","USN-8048-1","openSUSE-SU-2026:22091-1"],"status":"published","title":"crypto: hisilicon/qm - request reserved interrupt for virtual function","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: hisilicon/qm - request reserved interrupt for virtual function\n\nThe device interrupt vector 3 is an error interrupt for\nphysical function and a reserved interrupt for virtual function.\nHowever, the driver has not registered the reserved interrupt for\nvirtual function. When allocating interrupts, the number of interrupts\nis allocated based on powers of two, which includes this interrupt.\nWhen the system enables GICv4 and the virtual function passthrough\nto the virtual machine, releasing the interrupt in the driver\ntriggers a warning.\n\nThe WARNING report is:\nWARNING: CPU: 62 PID: 14889 at arch/arm64/kvm/vgic/vgic-its.c:852 its_free_ite+0x94/0xb4\n\nTherefore, register a reserved interrupt for VF and set the\nIRQF_NO_AUTOEN flag to avoid that warning.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","from":"osv"},"epss":{"day":"2026-11-10","score":0.00247,"percentile":0.16074,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2025-11-12T10:23:23Z","modified":"2026-11-10T02:50:05Z","fixes":[{"ecosystem":"Alpaquita:23","package":"linux-lts","fixed_in":["6.1.191-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"linux-lts","fixed_in":["6.12.115-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"linux-lts","fixed_in":["6.18.35-r1"],"sources":["osv"]},{"ecosystem":"Linux","package":"Kernel","fixed_in":["6.1.191","6.6.160","6.12.114","6.17.3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["6.12.115-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["6.17.6-1"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"linux","fixed_in":["6.1.190-1.aikido.167"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-linux","fixed_in":["6.1.190-1.aikido.167"],"sources":["osv"]},{"ecosystem":"Root:Ubuntu:24.04","package":"linux","fixed_in":["6.8.0-149.149.aikido.91"],"sources":["osv"]},{"ecosystem":"Root:Ubuntu:24.04","package":"rootio-linux","fixed_in":["6.8.0-149.149.aikido.91"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws-6.17","fixed_in":["6.17.0-1007.7~24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.17","fixed_in":["6.17.0-1008.8~24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-6.17","fixed_in":["6.17.0-1008.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.17","fixed_in":["6.17.0-1011.11"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle-6.17","fixed_in":["6.17.0-1007.7~24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime-6.17","fixed_in":["6.17.0-1006.7~24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"linux","fixed_in":["6.17.0-14.14"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"linux-aws","fixed_in":["6.17.0-1007.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"linux-azure","fixed_in":["6.17.0-1008.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"linux-gcp","fixed_in":["6.17.0-1007.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"linux-oracle","fixed_in":["6.17.0-1007.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"linux-raspi","fixed_in":["6.17.0-1008.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"linux-realtime","fixed_in":["6.17.0-1006.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"linux-riscv","fixed_in":["6.17.0-14.14.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:23","package":"linux-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.189-r0"},{"fixed":"6.1.191-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"linux-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.12.112-r0"},{"fixed":"6.12.115-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"linux-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.12.92-r1"},{"fixed":"6.18.35-r1"}]}]},{"source":"osv","ecosystem":"Linux","package":"Kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.0"},{"fixed":"6.1.191"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.160"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.114"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.17.3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.112-1","6.1.115-1","6.1.119-1","6.1.123-1","6.1.124-1","6.1.128-1","6.1.129-1","6.1.133-1","6.1.135-1","6.1.137-1","6.1.139-1","6.1.140-1","6.1.147-1","6.1.148-1","6.1.153-1","6.1.158-1","6.1.159-1","6.1.162-1","6.1.164-1","6.1.170-1","6.1.170-2","6.1.170-3","6.1.172-1","6.1.174-1","6.1.176-1","6.1.177-1","6.1.180-1","6.1.187-1","6.1.190-1","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1","6.10-1~exp1","6.10.1-1~exp1","6.10.11-1","6.10.11-1~bpo12+1","6.10.12-1","6.10.3-1","6.10.4-1","6.10.6-1","6.10.6-1~bpo12+1","6.10.7-1","6.10.9-1","6.11-1~exp1","6.11.10-1","6.11.10-1~bpo12+1","6.11.2-1","6.11.4-1","6.11.5-1","6.11.5-1~bpo12+1","6.11.6-1","6.11.7-1","6.11.9-1","6.11~rc4-1~exp1","6.11~rc5-1~exp1","6.12.10-1","6.12.100-1","6.12.101-1","6.12.105-1","6.12.107-1","6.12.11-1","6.12.11-1+alpha","6.12.11-1+alpha.1","6.12.111-1","6.12.113-1","6.12.115-1","6.12.115-2","6.12.12-1","6.12.12-1~bpo12+1","6.12.13-1","6.12.15-1","6.12.16-1","6.12.17-1","6.12.19-1","6.12.20-1","6.12.21-1","6.12.22-1","6.12.22-1~bpo12+1","6.12.25-1","6.12.27-1","6.12.27-1~bpo12+1","6.12.29-1","6.12.3-1","6.12.30-1","6.12.30-1~bpo12+1","6.12.31-1","6.12.32-1","6.12.32-1~bpo12+1","6.12.33-1","6.12.33-1~bpo12+1","6.12.35-1","6.12.35-1~bpo12+1","6.12.37-1","6.12.38-1","6.12.38-1~bpo12+1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.5-1","6.12.57-1","6.12.57-1~bpo12+1","6.12.6-1","6.12.63-1","6.12.63-1~bpo12+1","6.12.69-1","6.12.69-1~bpo12+1","6.12.73-1","6.12.73-1~bpo12+1","6.12.74-1","6.12.74-2","6.12.74-2~bpo12+1","6.12.8-1","6.12.85-1","6.12.85-1~bpo12+1","6.12.86-1","6.12.86-1~bpo12+1","6.12.88-1","6.12.88-1~bpo12+1","6.12.9-1","6.12.9-1+alpha","6.12.9-1~bpo12+1","6.12.90-1","6.12.90-1~bpo12+1","6.12.90-2","6.12.90-2~bpo12+1","6.12.94-1","6.12.94-1~bpo12+1","6.12.95-1","6.12.95-1~bpo12+1","6.12.96-1","6.12~rc6-1~exp1","6.13.10-1~exp1","6.13.11-1~exp1","6.13.2-1~exp1","6.13.3-1~exp1","6.13.4-1~exp1","6.13.5-1~exp1","6.13.6-1~exp1","6.13.7-1~exp1","6.13.8-1~exp1","6.13.9-1~exp1","6.13~rc6-1~exp1","6.13~rc7-1~exp1","6.14.3-1~exp1","6.14.5-1~exp1","6.14.6-1~exp1","6.15-1~exp1","6.15.1-1~exp1","6.15.2-1~exp1","6.15.3-1~exp1","6.15.4-1~exp1","6.15.5-1~exp1","6.15.6-1~exp1","6.15~rc7-1~exp1","6.16-1~exp1","6.16.1-1~exp1","6.16.10-1","6.16.11-1","6.16.12-1","6.16.12-1~bpo13+1","6.16.12-2","6.16.3-1","6.16.3-1~bpo13+1","6.16.5-1","6.16.6-1","6.16.7-1","6.16.8-1","6.16.9-1","6.16~rc7-1~exp1","6.17.10-1","6.17.11-1","6.17.12-1","6.17.13-1","6.17.13-1~bpo13+1","6.17.2-1~exp1","6.17.5-1~exp1","6.17.6-1","6.17.7-1","6.17.7-2","6.17.8-1","6.17.8-1~bpo13+1","6.17.9-1","6.18.1-1~exp1","6.18.10-1","6.18.12-1","6.18.12-1~bpo13+1","6.18.13-1","6.18.14-1","6.18.15-1","6.18.15-1~bpo13+1","6.18.2-1~exp1","6.18.3-1","6.18.5-1","6.18.5-1~bpo13+1","6.18.8-1","6.18.9-1","6.18.9-1~bpo13+1","6.18~rc4-1~exp1","6.18~rc4-1~exp2","6.18~rc5-1~exp1","6.18~rc6-1~exp1","6.18~rc7-1~exp1","6.19-1~exp1","6.19.10-1","6.19.10-1~bpo13+1","6.19.11-1","6.19.11-1~bpo13+1","6.19.12-1","6.19.13-1","6.19.13-1~bpo13+1","6.19.14-1","6.19.14-1~bpo13+1","6.19.2-1~exp1","6.19.3-1~exp1","6.19.4-1~exp1","6.19.5-1~exp1","6.19.6-1","6.19.6-2","6.19.6-2~bpo13+1","6.19.8-1","6.19.8-1~bpo13+1","6.19~rc4-1~exp1","6.19~rc5-1~exp1","6.19~rc6-1~exp1","6.19~rc7-1~exp1","6.19~rc8-1~exp1","6.3.1-1~exp1","6.3.11-1","6.3.2-1~exp1","6.3.4-1~exp1","6.3.5-1~exp1","6.3.7-1","6.3.7-1~bpo12+1","6.4.1-1~exp1","6.4.11-1","6.4.13-1","6.4.4-1","6.4.4-1~bpo12+1","6.4.4-2","6.4.4-3","6.4.4-3~bpo12+1","6.4~rc6-1~exp1","6.4~rc7-1~exp1","6.5.1-1~exp1","6.5.10-1","6.5.10-1~bpo12+1","6.5.13-1","6.5.3-1","6.5.3-1~bpo12+1","6.5.6-1","6.5.8-1","6.5~rc4-1~exp1","6.5~rc6-1~exp1","6.5~rc7-1~exp1","6.6.11-1","6.6.13-1","6.6.13-1~bpo12+1","6.6.15-1","6.6.15-2","6.6.3-1~exp1","6.6.4-1~exp1","6.6.7-1~exp1","6.6.8-1","6.6.9-1","6.7-1~exp1","6.7.1-1~exp1","6.7.12-1","6.7.12-1~bpo12+1","6.7.4-1~exp1","6.7.7-1","6.7.9-1","6.7.9-2","6.8.11-1","6.8.12-1","6.8.12-1~bpo12+1","6.8.9-1","6.9.10-1","6.9.10-1~bpo12+1","6.9.11-1","6.9.12-1","6.9.2-1~exp1","6.9.7-1","6.9.7-1~bpo12+1","6.9.8-1","6.9.9-1","7.0-1~exp1","7.0.1-1~exp1","7.0.10-1","7.0.10-1~bpo13+1","7.0.12-1","7.0.12-2","7.0.12-2~bpo13+1","7.0.13-1","7.0.13-1~bpo13+1","7.0.14-1","7.0.3-1","7.0.4-1","7.0.4-1~bpo13+1","7.0.7-1","7.0.7-1~bpo13+1","7.0.9-1","7.0.9-1~bpo13+1","7.1.1-1~exp1","7.1.10-1","7.1.12-1","7.1.13-1","7.1.13-1~bpo13+1","7.1.2-1~exp1","7.1.3-1","7.1.3-1+sunvdc","7.1.3-1~bpo13+1","7.1.4-1","7.1.5-1","7.1.6-1","7.1.7-1","7.1.7-1~bpo13+1","7.1.8-1","7.1.8-1~bpo13+1","7.1.8-2","7.1.9-1","7.1.9-1+sparc64","7.1~rc2-1~exp1","7.1~rc3-1~exp1","7.1~rc4-1~exp1","7.1~rc4-1~exp2","7.1~rc5-1~exp1","7.1~rc7-1~exp1","7.2.10-1","7.2.11-1","7.2.11-1~bpo13+1","7.2.12-1","7.2.13-1","7.2.14-1","7.2.15-1","7.2.2-1~exp1","7.2.3-1~exp1","7.2.6-1","7.2.6-1~bpo13+1","7.2.7-1","7.2.8-1","7.2.9-1","7.2.9-1~bpo13+1","7.2~rc3-1~exp1","7.2~rc5-1~exp1","7.2~rc7-1~exp1","7.3.1-1~exp1","7.3~rc6-1~exp1","7.3~rc7-1~exp1"]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.115-2"}]}],"versions":["6.12.100-1","6.12.101-1","6.12.105-1","6.12.107-1","6.12.111-1","6.12.113-1","6.12.115-1","6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.57-1","6.12.57-1~bpo12+1","6.12.63-1","6.12.63-1~bpo12+1","6.12.69-1","6.12.69-1~bpo12+1","6.12.73-1","6.12.73-1~bpo12+1","6.12.74-1","6.12.74-2","6.12.74-2~bpo12+1","6.12.85-1","6.12.85-1~bpo12+1","6.12.86-1","6.12.86-1~bpo12+1","6.12.88-1","6.12.88-1~bpo12+1","6.12.90-1","6.12.90-1~bpo12+1","6.12.90-2","6.12.90-2~bpo12+1","6.12.94-1","6.12.94-1~bpo12+1","6.12.95-1","6.12.95-1~bpo12+1","6.12.96-1"]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.6-1"}]}],"versions":["6.12.100-1","6.12.101-1","6.12.105-1","6.12.107-1","6.12.111-1","6.12.113-1","6.12.115-1","6.12.115-2","6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.57-1","6.12.57-1~bpo12+1","6.12.63-1","6.12.63-1~bpo12+1","6.12.69-1","6.12.69-1~bpo12+1","6.12.73-1","6.12.73-1~bpo12+1","6.12.74-1","6.12.74-2","6.12.74-2~bpo12+1","6.12.85-1","6.12.85-1~bpo12+1","6.12.86-1","6.12.86-1~bpo12+1","6.12.88-1","6.12.88-1~bpo12+1","6.12.90-1","6.12.90-1~bpo12+1","6.12.90-2","6.12.90-2~bpo12+1","6.12.94-1","6.12.94-1~bpo12+1","6.12.95-1","6.12.95-1~bpo12+1","6.12.96-1","6.13.10-1~exp1","6.13.11-1~exp1","6.13.2-1~exp1","6.13.3-1~exp1","6.13.4-1~exp1","6.13.5-1~exp1","6.13.6-1~exp1","6.13.7-1~exp1","6.13.8-1~exp1","6.13.9-1~exp1","6.13~rc6-1~exp1","6.13~rc7-1~exp1","6.14.3-1~exp1","6.14.5-1~exp1","6.14.6-1~exp1","6.15-1~exp1","6.15.1-1~exp1","6.15.2-1~exp1","6.15.3-1~exp1","6.15.4-1~exp1","6.15.5-1~exp1","6.15.6-1~exp1","6.15~rc7-1~exp1","6.16-1~exp1","6.16.1-1~exp1","6.16.10-1","6.16.11-1","6.16.12-1","6.16.12-1~bpo13+1","6.16.12-2","6.16.3-1","6.16.3-1~bpo13+1","6.16.5-1","6.16.6-1","6.16.7-1","6.16.8-1","6.16.9-1","6.16~rc7-1~exp1","6.17.2-1~exp1","6.17.5-1~exp1"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.0-145.0.12.138.oe2403"}]}],"bundled":108},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.0-145.1.12.150.oe2403sp1"}]}],"bundled":122},{"source":"osv","ecosystem":"Root:Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.190-1.aikido.167"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.190-1.aikido.167"}]}]},{"source":"osv","ecosystem":"Root:Ubuntu:24.04","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-149.149.aikido.91"}]}]},{"source":"osv","ecosystem":"Root:Ubuntu:24.04","package":"rootio-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-149.149.aikido.91"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.31.1"}]}],"bundled":171},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.31.1"}]}],"bundled":171},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.31.1.150700.17.21.1"}]}],"bundled":171},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.31.1"}]}],"bundled":171},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.31.1"}]}],"bundled":171},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.31.1"}]}],"bundled":171},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.31.1"}]}],"bundled":171},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.31.1"}]}],"bundled":171},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.31.1"}]}],"bundled":171},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.31.1"}]}],"bundled":171},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.31.1"}]}],"bundled":171},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"kernel-livepatch-SLE15-SP7_Update_9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150700.15.3.1"}]}],"bundled":171},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.31.1"}]}],"bundled":171},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.31.1"}]}],"bundled":171},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.20.27.1"}]}],"bundled":172},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"kernel-source-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.20.27.1"}]}],"bundled":172},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"kernel-syms-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.20.27.1"}]}],"bundled":172},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"kernel-livepatch-SLE15-SP7-RT_Update_9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150700.1.3.2"}]}],"bundled":171},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP7","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.7.31.2"}]}],"bundled":171},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP7","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.7.31.1"}]}],"bundled":171},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP7","package":"kernel-syms-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.7.31.1"}]}],"bundled":171},{"source":"osv","ecosystem":"SUSE:Linux Micro Extras 6.2","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Micro Extras 6.2","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1.160000.2.26"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1.160000.2.26"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1.160000.2.26"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.0-28.30~16.04.1","4.8.0-30.32~16.04.1","4.8.0-32.34~16.04.1","4.8.0-34.36~16.04.1","4.10.0-14.16~16.04.1","4.10.0-19.21~16.04.1","4.10.0-20.22~16.04.1","4.10.0-21.23~16.04.1","4.10.0-22.24~16.04.1","4.10.0-24.28~16.04.1","4.10.0-26.30~16.04.1","4.11.0-13.19~16.04.1","4.11.0-14.20~16.04.1","4.13.0-16.19~16.04.3","4.13.0-17.20~16.04.1","4.13.0-19.22~16.04.1","4.13.0-21.24~16.04.1","4.13.0-25.29~16.04.2","4.15.0-13.14~16.04.1","4.15.0-15.16~16.04.1","4.15.0-20.21~16.04.1","4.15.0-22.24~16.04.1","4.15.0-23.25~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1021.24~18.04.1","5.0.0-1022.25~18.04.1","5.0.0-1023.26~18.04.1","5.0.0-1024.27~18.04.1","5.0.0-1025.28","5.0.0-1027.30"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1019.21~18.04.1","5.3.0-1023.25~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.2","5.3.0-1033.35","5.3.0-1034.36","5.3.0-1035.37"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.2","4.15.0-1003.3","4.15.0-1004.4","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1012.12","4.15.0-1013.13","4.15.0-1014.14","4.15.0-1018.18","4.15.0-1019.19","4.15.0-1021.21","4.15.0-1022.23","4.15.0-1023.24","4.15.0-1025.26","4.15.0-1028.29","4.15.0-1030.31","4.15.0-1031.32","4.15.0-1032.33","4.15.0-1035.36","4.15.0-1036.38","4.15.0-1037.39","4.18.0-1011.11~18.04.1","4.18.0-1013.13~18.04.1","4.18.0-1014.14~18.04.1","4.18.0-1018.18~18.04.1","4.18.0-1019.19~18.04.1","4.18.0-1020.20~18.04.1","4.18.0-1023.24~18.04.1","4.18.0-1024.25~18.04.1","4.18.0-1025.27~18.04.1","5.0.0-1014.14~18.04.1","5.0.0-1016.17~18.04.1","5.0.0-1018.19~18.04.1","5.0.0-1020.21~18.04.1","5.0.0-1022.23~18.04.1","5.0.0-1023.24~18.04.1","5.0.0-1025.27~18.04.1","5.0.0-1027.29~18.04.1","5.0.0-1028.30~18.04.1","5.0.0-1029.31~18.04.1","5.0.0-1031.33","5.0.0-1032.34","5.0.0-1035.37","5.0.0-1036.38"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8~18.04.1","5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1019.20~18.04.1","5.3.0-1020.21~18.04.1","5.3.0-1022.23~18.04.1","5.3.0-1028.29~18.04.1","5.3.0-1031.32~18.04.1","5.3.0-1032.33~18.04.1","5.3.0-1034.35~18.04.1","5.3.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-1006.6~18.04.1","4.18.0-1007.7~18.04.1","4.18.0-1008.8~18.04.1","5.0.0-1012.12~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1001.1","4.15.0-1003.3","4.15.0-1005.5","4.15.0-1006.6","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1010.10","4.15.0-1014.14","4.15.0-1015.15","4.15.0-1017.18","4.15.0-1018.19","4.15.0-1019.20","4.15.0-1021.22","4.15.0-1023.24","4.15.0-1024.25","4.15.0-1025.26","4.15.0-1026.27","4.15.0-1027.28","4.15.0-1028.29","4.15.0-1029.31","4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1042.45","4.15.0-1044.70","5.0.0-1020.20~18.04.1","5.0.0-1021.21~18.04.1","5.0.0-1025.26~18.04.1","5.0.0-1026.27~18.04.1","5.0.0-1028.29~18.04.1","5.0.0-1029.30~18.04.1","5.0.0-1031.32","5.0.0-1033.34","5.0.0-1034.35"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1020.22~18.04.1","5.3.0-1026.28~18.04.1","5.3.0-1029.31~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-4.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1041.43","4.15.0-1042.44","4.15.0-1044.46","4.15.0-1045.48","4.15.0-1046.49","4.15.0-1048.51","4.15.0-1049.52","4.15.0-1050.53","4.15.0-1052.55","4.15.0-1055.58","4.15.0-1057.60","4.15.0-1058.61","4.15.0-1059.62","4.15.0-1063.66","4.15.0-1064.67","4.15.0-1066.69","4.15.0-1067.70","4.15.0-1069.72","4.15.0-1070.73","4.15.0-1072.76","4.15.0-1073.78","4.15.0-1074.79","4.15.0-1076.81","4.15.0-1077.82","4.15.0-1078.83","4.15.0-1079.84"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1025.25~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.31~18.04.1","5.4.0-1030.32~18.04.1","5.4.0-1032.34~18.04.1","5.4.0-1033.35~18.04.1","5.4.0-1035.37~18.04.1","5.4.0-1036.38~18.04.1","5.4.0-1037.39~18.04.1","5.4.0-1039.41~18.04.1","5.4.0-1040.42~18.04.1","5.4.0-1042.44~18.04.1","5.4.0-1043.45~18.04.1","5.4.0-1044.46~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1","5.4.0-1052.55~18.04.1","5.4.0-1053.56~18.04.1","5.4.0-1054.57~18.04.1","5.4.0-1055.58~18.04.1","5.4.0-1056.59~18.04.1","5.4.0-1057.60~18.04.1","5.4.0-1059.62~18.04.1","5.4.0-1061.64~18.04.1","5.4.0-1062.65~18.04.1","5.4.0-1063.66~18.04.1","5.4.0-1065.68~18.04.1","5.4.0-1066.69~18.04.1","5.4.0-1067.70~18.04.1","5.4.0-1068.71~18.04.1","5.4.0-1071.76~18.04.3","5.4.0-1072.77~18.04.1","5.4.0-1074.79~18.04.1","5.4.0-1076.82~18.04.1","5.4.0-1078.84~18.04.1","5.4.0-1080.86~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gkeop-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1001.1","5.4.0-1003.3","5.4.0-1004.5","5.4.0-1005.6","5.4.0-1007.8~18.04.1","5.4.0-1008.9~18.04.1","5.4.0-1009.10~18.04.1","5.4.0-1010.11~18.04.1","5.4.0-1011.12~18.04.2","5.4.0-1012.13~18.04.1","5.4.0-1013.14~18.04.1","5.4.0-1014.15~18.04.1","5.4.0-1015.16~18.04.1","5.4.0-1016.17~18.04.1","5.4.0-1018.19~18.04.1","5.4.0-1021.22~18.04.1","5.4.0-1022.23~18.04.1","5.4.0-1023.24~18.04.1","5.4.0-1024.25~18.04.1","5.4.0-1025.26~18.04.1","5.4.0-1026.27~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.30~18.04.2","5.4.0-1031.32~18.04.1","5.4.0-1032.33~18.04.1","5.4.0-1033.34~18.04.1","5.4.0-1034.35~18.04.1","5.4.0-1036.37~18.04.1","5.4.0-1037.38~18.04.1","5.4.0-1038.39~18.04.1","5.4.0-1039.40~18.04.1","5.4.0-1040.41~18.04.1","5.4.0-1043.44~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1048.51~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-13.14~18.04.1","4.18.0-14.15~18.04.1","4.18.0-15.16~18.04.1","4.18.0-16.17~18.04.1","4.18.0-17.18~18.04.1","4.18.0-18.19~18.04.1","4.18.0-20.21~18.04.1","4.18.0-21.22~18.04.1","4.18.0-22.23~18.04.1","4.18.0-24.25~18.04.1","4.18.0-25.26~18.04.1","5.0.0-23.24~18.04.1","5.0.0-25.26~18.04.1","5.0.0-27.28~18.04.1","5.0.0-29.31~18.04.1","5.0.0-31.33~18.04.1","5.0.0-32.34~18.04.2","5.0.0-35.38~18.04.1","5.0.0-36.39~18.04.1","5.0.0-37.40~18.04.1","5.3.0-26.28~18.04.1","5.3.0-28.30~18.04.1","5.3.0-40.32~18.04.1","5.3.0-42.34~18.04.1","5.3.0-45.37~18.04.1","5.3.0-46.38~18.04.1","5.3.0-51.44~18.04.2","5.3.0-53.47~18.04.1","5.3.0-59.53~18.04.1","5.3.0-61.55~18.04.1","5.3.0-62.56~18.04.1","5.3.0-64.58~18.04.1","5.3.0-65.59","5.3.0-66.60","5.3.0-67.61","5.3.0-68.63","5.3.0-69.65","5.3.0-70.66","5.3.0-72.68","5.3.0-73.69","5.3.0-74.70","5.3.0-75.71","5.3.0-76.72"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-15.16~18.04.1","5.0.0-16.17~18.04.1","5.0.0-17.18~18.04.1","5.0.0-19.20~18.04.1","5.0.0-20.21~18.04.1","5.3.0-19.20~18.04.2","5.3.0-22.24~18.04.1","5.3.0-23.25~18.04.1","5.3.0-23.25~18.04.2","5.3.0-24.26~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.3","4.15.0-1004.5","4.15.0-1006.9","4.15.0-1008.11","4.15.0-1009.12","4.15.0-1012.15","4.15.0-1013.16","4.15.0-1015.18","4.15.0-1017.20","4.15.0-1018.21","4.15.0-1021.24","4.15.0-1024.29","4.15.0-1026.31","4.15.0-1028.33","4.15.0-1030.35","4.15.0-1033.38","4.15.0-1034.39","4.15.0-1035.40","4.15.0-1036.41","4.15.0-1038.43","4.15.0-1039.44","4.15.0-1043.48","4.15.0-1045.50","4.15.0-1050.57","4.15.0-1056.65","4.15.0-1057.66","4.15.0-1059.68","4.15.0-1063.72","4.15.0-1064.73","4.15.0-1065.75","4.15.0-1066.76","4.15.0-1067.77","4.15.0-1069.79","4.15.0-1073.83","4.15.0-1076.86","4.15.0-1079.89","4.15.0-1080.90","4.15.0-1081.91","4.15.0-1087.97","4.15.0-1090.100","4.15.0-1091.101","4.15.0-1093.103","4.15.0-1094.104","4.15.0-1096.106","4.15.0-1097.107","4.15.0-1099.109","4.15.0-1100.110","4.15.0-1101.112","4.15.0-1102.113","4.15.0-1103.114"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1007.12~18.04.1","5.0.0-1008.13~18.04.1","5.0.0-1009.14~18.04.1","5.0.0-1010.15~18.04.1","5.0.0-1011.16","5.0.0-1013.18","5.0.0-1014.19"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1011.12~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.18~18.04.1","5.3.0-1018.20~18.04.1","5.3.0-1024.26~18.04.1","5.3.0-1027.29~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.9~20.04.2","5.11.0-1014.15~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.2","5.11.0-1021.22~20.04.2","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.2","5.13.0-1011.12~20.04.1","5.13.0-1012.13~20.04.1","5.13.0-1014.15~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1019.21~20.04.1","5.13.0-1021.23~20.04.2","5.13.0-1022.24~20.04.1","5.13.0-1023.25~20.04.1","5.13.0-1025.27~20.04.1","5.13.0-1028.31~20.04.1","5.13.0-1029.32~20.04.1","5.13.0-1031.35~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1041.43~20.04.1","5.8.0-1042.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1007.7~20.04.2","5.11.0-1012.13~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10~20.04.2","5.13.0-1012.14~20.04.1","5.13.0-1013.15~20.04.1","5.13.0-1014.16~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1021.24~20.04.1","5.13.0-1022.26~20.04.1","5.13.0-1023.27~20.04.1","5.13.0-1025.29~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1029.34~20.04.1","5.13.0-1031.37~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1033.35~20.04.1","5.8.0-1036.38~20.04.1","5.8.0-1039.42~20.04.1","5.8.0-1040.43~20.04.1","5.8.0-1041.44~20.04.1","5.8.0-1042.45~20.04.1","5.8.0-1043.46~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1063.66+cvm2.2","5.4.0-1063.66+cvm3.2","5.4.0-1064.67+cvm1.1","5.4.0-1065.68+cvm2.1","5.4.0-1067.70+cvm1.1","5.4.0-1068.71+cvm1.1","5.4.0-1069.72+cvm1.1","5.4.0-1070.73+cvm1.1","5.4.0-1072.75+cvm1.1","5.4.0-1073.76+cvm1.1","5.4.0-1074.77+cvm1.1","5.4.0-1076.79+cvm1.1","5.4.0-1078.81+cvm1.1","5.4.0-1080.83+cvm1.1","5.4.0-1083.87+cvm1.1","5.4.0-1085.90+cvm1.1","5.4.0-1085.90+cvm2.1","5.4.0-1086.91+cvm1.1","5.4.0-1089.94+cvm1.2","5.4.0-1090.95+cvm1.1","5.4.0-1091.96+cvm1.1","5.4.0-1092.97+cvm1.1","5.4.0-1095.101+cvm1.1","5.4.0-1098.104+cvm1.1","5.4.0-1100.106+cvm1.1","5.4.0-1103.109+cvm1.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.10~20.04.1","5.11.0-1014.16~20.04.1","5.11.0-1017.19~20.04.1","5.11.0-1018.20~20.04.2","5.11.0-1020.22~20.04.1","5.11.0-1021.23~20.04.1","5.11.0-1022.24~20.04.1","5.11.0-1023.25~20.04.1","5.11.0-1024.26~20.04.1","5.11.0-1026.29~20.04.1","5.11.0-1028.32~20.04.1","5.11.0-1029.33~20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.3","5.13.0-1012.15~20.04.1","5.13.0-1013.16~20.04.1","5.13.0-1015.18~20.04.1","5.13.0-1019.23~20.04.1","5.13.0-1021.25~20.04.1","5.13.0-1023.28~20.04.1","5.13.0-1024.29~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1030.36~20.04.1","5.13.0-1031.37~20.04.1","5.13.0-1033.40~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1032.34~20.04.1","5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1039.41"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1033.35","5.4.0-1035.37","5.4.0-1036.38","5.4.0-1037.39","5.4.0-1039.41","5.4.0-1041.43","5.4.0-1042.44","5.4.0-1043.45","5.4.0-1044.46","5.4.0-1046.48","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1055.58","5.4.0-1056.59","5.4.0-1057.60","5.4.0-1059.62","5.4.0-1061.64","5.4.0-1062.65","5.4.0-1063.66","5.4.0-1065.68","5.4.0-1066.69","5.4.0-1067.70","5.4.0-1068.71","5.4.0-1071.76","5.4.0-1072.77","5.4.0-1074.79","5.4.0-1076.82","5.4.0-1078.84","5.4.0-1080.86","5.4.0-1081.87","5.4.0-1083.89","5.4.0-1084.90","5.4.0-1086.93","5.4.0-1087.94","5.4.0-1090.97","5.4.0-1091.98","5.4.0-1094.101","5.4.0-1095.102","5.4.0-1096.103","5.4.0-1097.104","5.4.0-1098.105","5.4.0-1099.106","5.4.0-1100.107","5.4.0-1101.108","5.4.0-1102.109","5.4.0-1103.110","5.4.0-1104.111","5.4.0-1105.112"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1011.14~20.04.1","5.15.0-1014.17~20.04.1","5.15.0-1015.18~20.04.1","5.15.0-1016.19~20.04.1","5.15.0-1019.23~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1023.28~20.04.2","5.15.0-1027.32~20.04.1","5.15.0-1028.33~20.04.1","5.15.0-1029.34~20.04.1","5.15.0-1031.36~20.04.1","5.15.0-1032.37~20.04.1","5.15.0-1033.38~20.04.1","5.15.0-1034.39~20.04.1","5.15.0-1036.41~20.04.1","5.15.0-1037.42~20.04.1","5.15.0-1038.43~20.04.1","5.15.0-1039.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1008.9","5.4.0-1009.10","5.4.0-1010.11","5.4.0-1011.12","5.4.0-1012.13","5.4.0-1013.14","5.4.0-1014.15","5.4.0-1015.16","5.4.0-1016.17","5.4.0-1018.19","5.4.0-1021.22","5.4.0-1022.23","5.4.0-1023.24","5.4.0-1024.25","5.4.0-1025.26","5.4.0-1026.27","5.4.0-1027.28","5.4.0-1029.30","5.4.0-1031.32","5.4.0-1032.33","5.4.0-1033.34","5.4.0-1034.35","5.4.0-1036.37","5.4.0-1037.38","5.4.0-1038.39","5.4.0-1039.40","5.4.0-1040.41","5.4.0-1043.44","5.4.0-1046.48","5.4.0-1048.51","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1056.60","5.4.0-1057.61","5.4.0-1060.64","5.4.0-1061.65","5.4.0-1062.66","5.4.0-1064.68","5.4.0-1065.69","5.4.0-1066.70","5.4.0-1067.71","5.4.0-1068.72","5.4.0-1069.73","5.4.0-1070.74","5.4.0-1071.75","5.4.0-1072.76","5.4.0-1073.77","5.4.0-1074.78","5.4.0-1075.79","5.4.0-1076.80","5.4.0-1077.81","5.4.0-1078.82","5.4.0-1079.83","5.4.0-1080.84","5.4.0-1081.85","5.4.0-1083.87","5.4.0-1084.88","5.4.0-1085.89","5.4.0-1086.90","5.4.0-1087.91","5.4.0-1088.92","5.4.0-1089.93","5.4.0-1090.94","5.4.0-1091.95","5.4.0-1092.96","5.4.0-1093.97","5.4.0-1094.98","5.4.0-1095.99","5.4.0-1096.100","5.4.0-1097.101","5.4.0-1098.102","5.4.0-1099.103","5.4.0-1100.104","5.4.0-1101.105","5.4.0-1102.106"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gkeop-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1003.5~20.04.2","5.15.0-1005.7~20.04.1","5.15.0-1007.10~20.04.1","5.15.0-1008.12~20.04.1","5.15.0-1011.15~20.04.2","5.15.0-1012.16~20.04.1","5.15.0-1013.17~20.04.1","5.15.0-1015.19~20.04.1","5.15.0-1016.21~20.04.1","5.15.0-1017.22~20.04.1","5.15.0-1018.23~20.04.1","5.15.0-1019.24~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1021.26~20.04.1","5.15.0-1022.27~20.04.1","5.15.0-1023.28~20.04.1","5.15.0-1024.29~20.04.1","5.15.0-1025.30~20.04.1","5.15.0-1026.31~20.04.1","5.15.0-1027.32~20.04.1","5.15.0-1028.33~20.04.1","5.15.0-1030.35~20.04.1","5.15.0-1031.37~20.04.1","5.15.0-1032.38~20.04.1","5.15.0-1033.39~20.04.1","5.15.0-1034.40~20.04.1","5.15.0-1035.41~20.04.1","5.15.0-1036.42~20.04.1","5.15.0-1037.43~20.04.1","5.15.0-1038.44~20.04.1","5.15.0-1039.45~20.04.1","5.15.0-1040.46~20.04.1","5.15.0-1043.50~20.04.1","5.15.0-1044.51~20.04.1","5.15.0-1045.52~20.04.1","5.15.0-1046.53~20.04.1","5.15.0-1047.54~20.04.1","5.15.0-1048.55~20.04.1","5.15.0-1049.56~20.04.1","5.15.0-1050.57~20.04.1","5.15.0-1051.58~20.04.1","5.15.0-1052.59~20.04.1","5.15.0-1053.60~20.04.1","5.15.0-1054.61~20.04.1","5.15.0-1055.62~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-22.23~20.04.1","5.11.0-25.27~20.04.1","5.11.0-27.29~20.04.1","5.11.0-34.36~20.04.1","5.11.0-36.40~20.04.1","5.11.0-37.41~20.04.2","5.11.0-38.42~20.04.1","5.11.0-40.44~20.04.2","5.11.0-41.45~20.04.1","5.11.0-43.47~20.04.2","5.11.0-44.48~20.04.2","5.11.0-46.51~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-21.21~20.04.1","5.13.0-22.22~20.04.1","5.13.0-23.23~20.04.2","5.13.0-25.26~20.04.1","5.13.0-27.29~20.04.1","5.13.0-28.31~20.04.1","5.13.0-30.33~20.04.1","5.13.0-35.40~20.04.1","5.13.0-37.42~20.04.1","5.13.0-39.44~20.04.1","5.13.0-40.45~20.04.1","5.13.0-41.46~20.04.1","5.13.0-44.49~20.04.1","5.13.0-48.54~20.04.1","5.13.0-51.58~20.04.1","5.13.0-52.59~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-23.24~20.04.1","5.8.0-25.26~20.04.1","5.8.0-28.30~20.04.1","5.8.0-29.31~20.04.1","5.8.0-31.33~20.04.1","5.8.0-33.36~20.04.1","5.8.0-34.37~20.04.2","5.8.0-36.40~20.04.1","5.8.0-38.43~20.04.1","5.8.0-40.45~20.04.1","5.8.0-41.46~20.04.1","5.8.0-43.49~20.04.1","5.8.0-44.50~20.04.1","5.8.0-45.51~20.04.1","5.8.0-48.54~20.04.1","5.8.0-49.55~20.04.1","5.8.0-50.56~20.04.1","5.8.0-53.60~20.04.1","5.8.0-55.62~20.04.1","5.8.0-59.66~20.04.1","5.8.0-63.71~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-intel-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1007.7","5.13.0-1008.8","5.13.0-1009.9","5.13.0-1010.10","5.13.0-1011.11","5.13.0-1014.15","5.13.0-1017.19"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.10.0-1008.9","5.10.0-1011.12","5.10.0-1013.14","5.10.0-1014.15","5.10.0-1016.17","5.10.0-1017.18","5.10.0-1019.20","5.10.0-1021.22","5.10.0-1022.23","5.10.0-1023.24","5.10.0-1025.26","5.10.0-1026.27","5.10.0-1029.30","5.10.0-1032.33","5.10.0-1033.34","5.10.0-1034.35","5.10.0-1038.40","5.10.0-1044.46","5.10.0-1045.47","5.10.0-1049.51","5.10.0-1050.52","5.10.0-1051.53","5.10.0-1052.54","5.10.0-1053.55","5.10.0-1055.58","5.10.0-1057.61"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10","5.13.0-1010.11","5.13.0-1012.16","5.13.0-1014.18","5.13.0-1017.21","5.13.0-1019.23","5.13.0-1020.24","5.13.0-1021.25","5.13.0-1022.26","5.13.0-1026.32","5.13.0-1028.35","5.13.0-1029.36"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.14.0-1004.4","5.14.0-1005.5","5.14.0-1007.7","5.14.0-1008.8","5.14.0-1010.10","5.14.0-1011.11","5.14.0-1013.13","5.14.0-1018.19","5.14.0-1020.22","5.14.0-1022.24","5.14.0-1024.26","5.14.0-1027.30","5.14.0-1029.32","5.14.0-1031.34","5.14.0-1032.35","5.14.0-1033.36","5.14.0-1034.37","5.14.0-1036.40","5.14.0-1038.42","5.14.0-1042.47","5.14.0-1044.49","5.14.0-1045.51","5.14.0-1046.53","5.14.0-1047.54","5.14.0-1048.55","5.14.0-1049.56","5.14.0-1050.57","5.14.0-1051.58","5.14.0-1052.59","5.14.0-1054.61","5.14.0-1055.62","5.14.0-1056.63","5.14.0-1057.64","5.14.0-1058.66","5.14.0-1059.67"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.6.0-1007.7","5.6.0-1008.8","5.6.0-1010.10","5.6.0-1011.11","5.6.0-1013.13","5.6.0-1017.17","5.6.0-1018.18","5.6.0-1020.20","5.6.0-1021.21","5.6.0-1023.23","5.6.0-1026.26","5.6.0-1027.27","5.6.0-1028.28","5.6.0-1031.32","5.6.0-1032.33","5.6.0-1033.35","5.6.0-1034.36","5.6.0-1035.37","5.6.0-1036.39","5.6.0-1039.43","5.6.0-1042.46","5.6.0-1047.51","5.6.0-1048.52","5.6.0-1050.54","5.6.0-1052.56","5.6.0-1053.57","5.6.0-1054.58","5.6.0-1055.59","5.6.0-1056.60"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1008.8~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1011.13~20.04.2","5.13.0-1015.19~20.04.1","5.13.0-1016.20~20.04.1","5.13.0-1018.22~20.04.1","5.13.0-1021.26~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1030.35~20.04.1","5.13.0-1033.39~20.04.1","5.13.0-1034.40~20.04.1","5.13.0-1036.43~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1031.32~20.04.2","5.8.0-1033.34~20.04.1","5.8.0-1034.35~20.04.2","5.8.0-1037.38~20.04.1","5.8.0-1038.39~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8","5.3.0-1014.16","5.3.0-1015.17","5.3.0-1017.19","5.4.0-1004.4","5.4.0-1006.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-24.28","5.4.0-26.30","5.4.0-27.31","5.4.0-28.32","5.4.0-30.34","5.4.0-31.35","5.4.0-33.37","5.4.0-34.38","5.4.0-36.41","5.4.0-37.42","5.4.0-39.44","5.4.0-40.45"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1018.19~20.04.2","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1024.25~20.04.1","5.11.0-1026.28~20.04.1","5.11.0-1028.31~20.04.1","5.11.0-1029.32~20.04.1","5.11.0-1030.34","5.11.0-1031.35"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-14.16~20.04.1","5.8.0-14.16~20.04.3","5.8.0-16.18~20.04.1","5.8.0-17.19~20.04.1","5.8.0-18.20~20.04.1","5.8.0-20.22~20.04.1","5.8.0-22.24~20.04.1","5.8.0-25.27~20.04.1","5.8.0-26.28~20.04.1","5.8.0-29.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-allwinner-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1007.7~22.04.1","5.19.0-1009.9~22.04.1","5.19.0-1010.10~22.04.1","5.19.0-1011.11~22.04.1","5.19.0-1012.12~22.04.1","5.19.0-1013.13~22.04.1","5.19.0-1014.14~22.04.1","5.19.0-1015.15~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1019.20~22.04.1","5.19.0-1020.21~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1026.27~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1029.30~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1008.8~22.04.1","6.5.0-1010.10~22.04.1","6.5.0-1011.11~22.04.1","6.5.0-1012.12~22.04.1","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.2","6.5.0-1018.18~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1021.21~22.04.1","6.5.0-1022.22~22.04.1","6.5.0-1023.23~22.04.1","6.5.0-1024.24~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1009.9~22.04.2","6.8.0-1010.10~22.04.2","6.8.0-1011.12~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.15~22.04.1","6.8.0-1015.16~22.04.1","6.8.0-1016.17~22.04.2","6.8.0-1017.18~22.04.1","6.8.0-1018.19~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1023.25~22.04.1","6.8.0-1024.26~22.04.1","6.8.0-1027.29~22.04.1","6.8.0-1028.30~22.04.1","6.8.0-1029.31~22.04.1","6.8.0-1030.32~22.04.1","6.8.0-1031.33~22.04.1","6.8.0-1032.34~22.04.1","6.8.0-1033.35~22.04.1","6.8.0-1035.37~22.04.1","6.8.0-1036.38~22.04.1","6.8.0-1039.41~22.04.1","6.8.0-1040.42~22.04.1","6.8.0-1041.43~22.04.1","6.8.0-1042.44~22.04.1","6.8.0-1043.45~22.04.1","6.8.0-1044.46~22.04.1","6.8.0-1045.47~22.04.1","6.8.0-1046.49~22.04.1","6.8.0-1047.50~22.04.1","6.8.0-1050.53~22.04.1","6.8.0-1051.54~22.04.1","6.8.0-1052.55~22.04.1","6.8.0-1053.56~22.04.1","6.8.0-1055.58~22.04.1","6.8.0-1057.60~22.04.1","6.8.0-1060.63~22.04.1","6.8.0-1061.64~22.04.1","6.8.0-1062.65~22.04.2","6.8.0-1063.66~22.04.1","6.8.0-1064.67~22.04.1","6.8.0-1065.68~22.04.1","6.8.0-1066.69~22.04.1","6.8.0-1069.74~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.21~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1025.28~22.04.1","5.19.0-1026.29~22.04.1","5.19.0-1027.30~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1","6.2.0-1019.19~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.7~22.04.1","6.5.0-1009.9~22.04.1","6.5.0-1010.10~22.04.1","6.5.0-1011.11~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.1","6.5.0-1018.19~22.04.2","6.5.0-1019.20~22.04.1","6.5.0-1021.22~22.04.1","6.5.0-1022.23~22.04.1","6.5.0-1023.24~22.04.1","6.5.0-1024.25~22.04.1","6.5.0-1025.26~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1009.9~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1012.14~22.04.1","6.8.0-1013.15~22.04.1","6.8.0-1014.16~22.04.1","6.8.0-1015.17~22.04.2","6.8.0-1017.20~22.04.1","6.8.0-1018.21~22.04.1","6.8.0-1020.23~22.04.1","6.8.0-1021.25~22.04.1","6.8.0-1025.30~22.04.1","6.8.0-1026.31~22.04.1","6.8.0-1027.32~22.04.1","6.8.0-1028.33~22.04.1","6.8.0-1029.34~22.04.1","6.8.0-1030.35~22.04.1","6.8.0-1031.36~22.04.1","6.8.0-1034.39~22.04.1","6.8.0-1036.42~22.04.1","6.8.0-1040.46~22.04.1","6.8.0-1041.47~22.04.1","6.8.0-1044.50~22.04.1","6.8.0-1051.57~22.04.1","6.8.0-1052.58~22.04.1","6.8.0-1059.65~22.04.1","6.8.0-1062.69~22.04.1","6.8.0-1063.71~22.04.1","6.8.0-1064.72~22.04.1","6.8.0-1065.73~22.04.1","6.8.0-1067.75~22.04.1","6.8.0-1068.76~22.04.1","6.8.0-1070.78~22.04.1","6.8.0-1073.82~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1025.28~22.04.1.1","5.19.0-1026.29~22.04.1.1","5.19.0-1027.30~22.04.2.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1.1","6.2.0-1009.9~22.04.3.1","6.2.0-1011.11~22.04.1.1","6.2.0-1012.12~22.04.1.1","6.2.0-1014.14~22.04.1.1","6.2.0-1015.15~22.04.1.1","6.2.0-1016.16~22.04.1.1","6.2.0-1017.17~22.04.1.1","6.2.0-1018.18~22.04.1.1","6.2.0-1019.19~22.04.1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1041.48~22.04.1","6.8.0-1042.49~22.04.1","6.8.0-1044.51~22.04.1","6.8.0-1046.53~22.04.1","6.8.0-1053.60~22.04.1","6.8.0-1058.65~22.04.1","6.8.0-1061.68~22.04.1","6.8.0-1062.69~22.04.1","6.8.0-1063.70~22.04.1","6.8.0-1064.71~22.04.1","6.8.0-1065.72~22.04.1","6.8.0-1066.73~22.04.1","6.8.0-1068.75~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.22~22.04.2","5.19.0-1021.23~22.04.1","5.19.0-1022.24~22.04.1","5.19.0-1024.26~22.04.1","5.19.0-1025.27~22.04.1","5.19.0-1026.28~22.04.1","5.19.0-1027.29~22.04.1","5.19.0-1030.32~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1011.11~22.04.3","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1016.18~22.04.1","6.2.0-1017.19~22.04.1","6.2.0-1018.20~22.04.1","6.2.0-1019.21~22.04.1","6.2.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1010.10~22.04.3","6.5.0-1011.11~22.04.1","6.5.0-1013.13~22.04.1","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.1","6.5.0-1018.18~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1022.24~22.04.1","6.5.0-1023.25~22.04.1","6.5.0-1024.26~22.04.1","6.5.0-1025.27~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1010.11~22.04.1","6.8.0-1011.12~22.04.1","6.8.0-1012.13~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.16~22.04.1","6.8.0-1015.17~22.04.1","6.8.0-1016.18~22.04.1","6.8.0-1017.19~22.04.1","6.8.0-1018.20~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1024.26~22.04.1","6.8.0-1025.27~22.04.1","6.8.0-1026.28~22.04.1","6.8.0-1027.29~22.04.1","6.8.0-1028.30~22.04.1","6.8.0-1029.31~22.04.1","6.8.0-1030.32~22.04.1","6.8.0-1031.33~22.04.1","6.8.0-1032.34~22.04.1","6.8.0-1033.35~22.04.1","6.8.0-1034.36~22.04.2","6.8.0-1036.38~22.04.1","6.8.0-1037.39~22.04.1","6.8.0-1040.42~22.04.1","6.8.0-1041.43~22.04.1","6.8.0-1042.45~22.04.1","6.8.0-1043.46~22.04.1","6.8.0-1044.47~22.04.1","6.8.0-1045.48~22.04.1","6.8.0-1046.49~22.04.1","6.8.0-1047.50~22.04.2","6.8.0-1048.51~22.04.1","6.8.0-1052.55~22.04.1","6.8.0-1053.56~22.04.1","6.8.0-1054.57~22.04.1","6.8.0-1058.61~22.04.1","6.8.0-1060.63~22.04.1","6.8.0-1063.69~22.04.1","6.8.0-1064.72~22.04.1","6.8.0-1065.73~22.04.1","6.8.0-1066.74~22.04.1","6.8.0-1067.75~22.04.1","6.8.0-1069.77~22.04.1","6.8.0-1070.78~22.04.1","6.8.0-1073.81~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-28.29~22.04.1","5.19.0-32.33~22.04.1","5.19.0-35.36~22.04.1","5.19.0-38.39~22.04.1","5.19.0-40.41~22.04.1","5.19.0-41.42~22.04.1","5.19.0-42.43~22.04.1","5.19.0-43.44~22.04.1","5.19.0-45.46~22.04.1","5.19.0-46.47~22.04.1","5.19.0-50.50"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-25.25~22.04.2","6.2.0-26.26~22.04.1","6.2.0-31.31~22.04.1","6.2.0-32.32~22.04.1","6.2.0-33.33~22.04.1","6.2.0-34.34~22.04.1","6.2.0-35.35~22.04.1","6.2.0-36.37~22.04.1","6.2.0-37.38~22.04.1","6.2.0-39.40~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-14.14~22.04.1","6.5.0-15.15~22.04.1","6.5.0-17.17~22.04.1","6.5.0-18.18~22.04.1","6.5.0-21.21~22.04.1","6.5.0-25.25~22.04.1","6.5.0-26.26~22.04.1","6.5.0-27.28~22.04.1","6.5.0-28.29~22.04.1","6.5.0-35.35~22.04.1","6.5.0-41.41~22.04.2","6.5.0-44.44~22.04.1","6.5.0-45.45~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-38.38~22.04.1","6.8.0-39.39~22.04.1","6.8.0-40.40~22.04.3","6.8.0-45.45~22.04.1","6.8.0-47.47~22.04.1","6.8.0-48.48~22.04.1","6.8.0-49.49~22.04.1","6.8.0-50.51~22.04.1","6.8.0-51.52~22.04.1","6.8.0-52.53~22.04.1","6.8.0-57.59~22.04.1","6.8.0-58.60~22.04.1","6.8.0-59.61~22.04.1","6.8.0-60.63~22.04.1","6.8.0-64.67~22.04.1","6.8.0-65.68~22.04.1","6.8.0-78.78~22.04.1","6.8.0-79.79~22.04.1","6.8.0-83.83~22.04.1","6.8.0-84.84~22.04.1","6.8.0-85.85~22.04.1","6.8.0-86.87~22.04.1","6.8.0-87.88~22.04.1","6.8.0-88.89~22.04.2","6.8.0-90.91~22.04.1","6.8.0-94.96~22.04.1","6.8.0-100.100~22.04.1","6.8.0-101.101~22.04.1","6.8.0-106.106~22.04.1","6.8.0-107.107~22.04.1","6.8.0-110.110~22.04.1","6.8.0-111.111~22.04.1","6.8.0-117.117~22.04.1","6.8.0-124.124~22.04.1","6.8.0-134.134~22.04.1","6.8.0-136.136~22.04.1","6.8.0-138.138~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-ibm-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.13~22.04.1","6.8.0-1014.14~22.04.1","6.8.0-1015.15~22.04.1","6.8.0-1016.16~22.04.1","6.8.0-1017.17~22.04.1","6.8.0-1018.18~22.04.1","6.8.0-1019.19~22.04.1","6.8.0-1023.23~22.04.1","6.8.0-1024.24~22.04.1","6.8.0-1025.25~22.04.1","6.8.0-1026.26~22.04.1","6.8.0-1027.27~22.04.1","6.8.0-1028.28~22.04.1","6.8.0-1029.29~22.04.1","6.8.0-1030.30~22.04.1","6.8.0-1033.33~22.04.1","6.8.0-1036.36~22.04.1","6.8.0-1037.37~22.04.1","6.8.0-1038.38~22.04.1","6.8.0-1039.39~22.04.1","6.8.0-1040.40~22.04.1","6.8.0-1041.41~22.04.1","6.8.0-1042.42~22.04.1","6.8.0-1043.43~22.04.1","6.8.0-1044.44~22.04.1","6.8.0-1045.45~22.04.1","6.8.0-1049.49~22.04.1","6.8.0-1050.50~22.04.1","6.8.0-1051.51~22.04.1","6.8.0-1052.52~22.04.1","6.8.0-1055.56~22.04.1","6.8.0-1057.58~22.04.1","6.8.0-1060.61~22.04.1","6.8.0-1061.62~22.04.1","6.8.0-1062.63~22.04.1","6.8.0-1063.64~22.04.1","6.8.0-1066.67~22.04.1","6.8.0-1069.70~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-intel-iot-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1073.75"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1030.30"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-14.14.1~22.04.1","6.5.0-15.15.1.1~22.04.1","6.5.0-17.17.1.1.1~22.04.1","6.5.0-21.21.1~22.04.1","6.5.0-25.25.1~22.04.1","6.5.0-26.26.1~22.04.1","6.5.0-27.28.1~22.04.1","6.5.0-28.29.1~22.04.1","6.5.0-35.35.1~22.04.1","6.5.0-41.41.1~22.04.1","6.5.0-42.42.1~22.04.1","6.5.0-44.44.1~22.04.1","6.5.0-45.45.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-38.38.1~22.04.2","6.8.0-40.40.1~22.04.1","6.8.0-44.44.1~22.04.1","6.8.0-45.45.1~22.04.1","6.8.0-47.47.1~22.04.1","6.8.0-48.48.3~22.04.1","6.8.0-49.49.1~22.04.1","6.8.0-50.51.1~22.04.1","6.8.0-51.52.1~22.04.1","6.8.0-52.53.1~22.04.1","6.8.0-54.56.1~22.04.1","6.8.0-55.57.1~22.04.1","6.8.0-56.58.1~22.04.1","6.8.0-57.59.1~22.04.1","6.8.0-58.60.1~22.04.1","6.8.0-59.61.1~22.04.1","6.8.0-60.63.1~22.04.1","6.8.0-62.65.1~22.04.1","6.8.0-63.66.1~22.04.1","6.8.0-64.67.1~22.04.1","6.8.0-65.68.1~22.04.1","6.8.0-78.78.1~22.04.1","6.8.0-79.79.1~22.04.1","6.8.0-83.83.1~22.04.1","6.8.0-84.84.1~22.04.1","6.8.0-85.85.1~22.04.1","6.8.0-86.87.1~22.04.1","6.8.0-87.88.1~22.04.1","6.8.0-88.89.1~22.04.1","6.8.0-90.91.1~22.04.1","6.8.0-94.96.1~22.04.1","6.8.0-100.100.1~22.04.1","6.8.0-101.101.1~22.04.1","6.8.0-106.106.1~22.04.1","6.8.0-107.107.1~22.04.1","6.8.0-110.110.1~22.04.1","6.8.0-111.111.1~22.04.1","6.8.0-117.117.1~22.04.1","6.8.0-134.134.1~22.04.1","6.8.0-136.136.2~22.04.1","6.8.0-137.137.1~22.04.1","6.8.0-138.138.1~22.04.1","6.8.0-139.139.1~22.04.1","6.8.0-142.142.1~22.04.1","6.8.0-146.146.1~22.04.1","6.8.0-149.149.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1003.3~22.04.1","6.2.0-1009.9","6.2.0-1010.10","6.2.0-1011.11","6.2.0-1012.12","6.2.0-1013.13","6.2.0-1015.15"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1004.4","6.5.0-1007.7","6.5.0-1013.13","6.5.0-1014.14","6.5.0-1015.15","6.5.0-1018.18","6.5.0-1019.19","6.5.0-1021.22","6.5.0-1022.23","6.5.0-1023.24","6.5.0-1024.25"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1009.9~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.15~22.04.1","6.8.0-1015.16~22.04.1","6.8.0-1017.19~22.04.1","6.8.0-1018.20~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1022.25~22.04.2","6.8.0-1023.26~22.04.1","6.8.0-1024.27~22.04.1","6.8.0-1025.28~22.04.1","6.8.0-1026.29~22.04.1","6.8.0-1027.30~22.04.1","6.8.0-1028.31~22.04.1","6.8.0-1029.32~22.04.1","6.8.0-1030.33~22.04.1","6.8.0-1031.34~22.04.1","6.8.0-1032.35~22.04.1","6.8.0-1035.38~22.04.1","6.8.0-1036.39~22.04.1","6.8.0-1038.41~22.04.1","6.8.0-1039.42~22.04.1","6.8.0-1040.43~22.04.1","6.8.0-1041.44~22.04.2","6.8.0-1042.45~22.04.1","6.8.0-1043.46~22.04.1","6.8.0-1044.47~22.04.1","6.8.0-1045.48~22.04.1","6.8.0-1046.49~22.04.1","6.8.0-1047.50~22.04.1","6.8.0-1049.52~22.04.1","6.8.0-1050.53~22.04.1","6.8.0-1051.54~22.04.1","6.8.0-1052.55~22.04.1","6.8.0-1054.57~22.04.1","6.8.0-1055.58~22.04.1","6.8.0-1058.61~22.04.1","6.8.0-1059.62~22.04.1","6.8.0-1060.63~22.04.1","6.8.0-1061.64~22.04.1","6.8.0-1062.65~22.04.1","6.8.0-1063.66~22.04.1","6.8.0-1064.67~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-5.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.17.0-1003.3","5.17.0-1004.4","5.17.0-1006.6","5.17.0-1011.12","5.17.0-1012.13","5.17.0-1013.14","5.17.0-1014.15","5.17.0-1015.16","5.17.0-1016.17","5.17.0-1017.18","5.17.0-1018.19","5.17.0-1019.20","5.17.0-1020.21","5.17.0-1021.22","5.17.0-1024.25","5.17.0-1025.26","5.17.0-1026.27","5.17.0-1027.28","5.17.0-1028.29","5.17.0-1029.30","5.17.0-1030.31","5.17.0-1031.32","5.17.0-1032.33","5.17.0-1033.34","5.17.0-1034.35","5.17.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.0-1006.6","6.0.0-1007.7","6.0.0-1008.8","6.0.0-1009.9","6.0.0-1010.10","6.0.0-1011.11","6.0.0-1012.12","6.0.0-1013.13","6.0.0-1014.14","6.0.0-1015.15","6.0.0-1016.16","6.0.0-1017.17","6.0.0-1018.18","6.0.0-1019.19","6.0.0-1020.20","6.0.0-1021.21"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.0-1004.4","6.1.0-1006.6","6.1.0-1007.7","6.1.0-1008.8","6.1.0-1009.9","6.1.0-1010.10","6.1.0-1012.12","6.1.0-1013.13","6.1.0-1014.14","6.1.0-1015.15","6.1.0-1016.16","6.1.0-1017.17","6.1.0-1019.19","6.1.0-1020.20","6.1.0-1021.21","6.1.0-1022.22","6.1.0-1023.23","6.1.0-1024.24","6.1.0-1025.25","6.1.0-1026.26","6.1.0-1027.27","6.1.0-1028.28","6.1.0-1029.29","6.1.0-1033.33","6.1.0-1034.34","6.1.0-1035.35","6.1.0-1036.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1003.3","6.5.0-1004.4","6.5.0-1006.6","6.5.0-1007.7","6.5.0-1008.8","6.5.0-1009.10","6.5.0-1011.12","6.5.0-1013.14","6.5.0-1014.15","6.5.0-1015.16","6.5.0-1016.17","6.5.0-1018.19","6.5.0-1019.20","6.5.0-1020.21","6.5.0-1022.23","6.5.0-1023.24","6.5.0-1024.25","6.5.0-1025.26","6.5.0-1027.28"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1013.13~22.04.4","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1018.18~22.04.1","6.5.0-1019.19~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1021.21~22.04.1","6.5.0-1023.23~22.04.1","6.5.0-1024.24~22.04.1","6.5.0-1025.25~22.04.1","6.5.0-1026.26~22.04.1","6.5.0-1027.27~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1006.6~22.04.3","6.8.0-1008.8~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.13~22.04.1","6.8.0-1014.14~22.04.1","6.8.0-1015.15~22.04.1","6.8.0-1016.17~22.04.1","6.8.0-1017.18~22.04.1","6.8.0-1018.19~22.04.1","6.8.0-1019.20~22.04.1","6.8.0-1020.21~22.04.1","6.8.0-1021.22~22.04.1","6.8.0-1022.23~22.04.1","6.8.0-1023.24~22.04.1","6.8.0-1024.25~22.04.1","6.8.0-1025.26~22.04.1","6.8.0-1026.27~22.04.1","6.8.0-1027.28~22.04.1","6.8.0-1028.29~22.04.1","6.8.0-1029.30~22.04.1","6.8.0-1030.31~22.04.1","6.8.0-1032.33~22.04.1","6.8.0-1033.34~22.04.1","6.8.0-1035.36~22.04.1","6.8.0-1037.38~22.04.1","6.8.0-1038.39~22.04.1","6.8.0-1039.40~22.04.1","6.8.0-1040.41~22.04.1","6.8.0-1041.42~22.04.1","6.8.0-1042.43~22.04.1","6.8.0-1043.44~22.04.1","6.8.0-1044.45~22.04.1","6.8.0-1047.48~22.04.1","6.8.0-1049.50~22.04.1","6.8.0-1050.51~22.04.1","6.8.0-1052.53~22.04.1","6.8.0-1054.55~22.04.1","6.8.0-1057.58~22.04.1","6.8.0-1058.61~22.04.1","6.8.0-1059.62~22.04.1","6.8.0-1060.63~22.04.1","6.8.0-1061.64~22.04.1","6.8.0-1062.65~22.04.1","6.8.0-1067.71~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1032.35"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1004.4","5.13.0-1006.6+22.04.1","5.13.0-1007.7+22.04.1","5.13.0-1010.11+22.04.1","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1006.6","5.15.0-1007.7","5.15.0-1008.8","5.15.0-1011.12","5.15.0-1012.13","5.15.0-1014.16","5.15.0-1015.17","5.15.0-1016.18","5.15.0-1017.19","5.15.0-1018.21","5.15.0-1019.22","5.15.0-1020.23","5.15.0-1022.26","5.15.0-1023.27","5.15.0-1026.30","5.15.0-1027.31","5.15.0-1028.32"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1012.13~22.04.1","5.19.0-1015.16~22.04.1","5.19.0-1016.17~22.04.1","5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1","5.19.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-17.17.1.1~22.04.1","6.5.0-21.21.1~22.04.1","6.5.0-25.25.1~22.04.1","6.5.0-26.26.1~22.04.1","6.5.0-27.28.1~22.04.1","6.5.0-28.29.1~22.04.1","6.5.0-35.35.1~22.04.1","6.5.0-40.40.1~22.04.1","6.5.0-42.42.1~22.04.1","6.5.0-45.45.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-38.38.1~22.04.1","6.8.0-39.39.1~22.04.1","6.8.0-40.40.1~22.04.1","6.8.0-41.41.1~22.04.1","6.8.0-44.44.1~22.04.1","6.8.0-47.47.1~22.04.1","6.8.0-48.48.1~22.04.2","6.8.0-49.49.1~22.04.1","6.8.0-50.51.1~22.04.1","6.8.0-51.52.1~22.04.1","6.8.0-52.53.1~22.04.1","6.8.0-53.55.1~22.04.1","6.8.0-55.57.1~22.04.1","6.8.0-56.58.1~22.04.1","6.8.0-57.59.1~22.04.1","6.8.0-58.60.1~22.04.1","6.8.0-59.61.1~22.04.1","6.8.0-62.65~22.04.1","6.8.0-63.66~22.04.1","6.8.0-64.67~22.04.1","6.8.0-71.71~22.04.1","6.8.0-78.78~22.04.1","6.8.0-79.79~22.04.1","6.8.0-83.83~22.04.1","6.8.0-84.84~22.04.1","6.8.0-86.87~22.04.1","6.8.0-87.88~22.04.1","6.8.0-88.89~22.04.1","6.8.0-90.91~22.04.1","6.8.0-94.96~22.04.1","6.8.0-100.100~22.04.1","6.8.0-101.101~22.04.1","6.8.0-106.106~22.04.1","6.8.0-107.107~22.04.1","6.8.0-110.110~22.04.1","6.8.0-111.111~22.04.1","6.8.0-117.117~22.04.1","6.8.0-124.124~22.04.1","6.8.0-134.134~22.04.1","6.8.0-136.136~22.04.3","6.8.0-137.137~22.04.1","6.8.0-138.138~22.04.1","6.8.0-139.139~22.04.1","6.8.0-142.142~22.04.1","6.8.0-146.146~22.04.1","6.8.0-149.149~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1014.16~22.04.1","5.19.0-1015.17~22.04.1","5.19.0-1016.18~22.04.1","5.19.0-1017.19~22.04.1","5.19.0-1018.20~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1006.7~22.04.1","6.2.0-1007.8~22.04.1","6.2.0-1009.10~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.8~22.04.1","6.5.0-1008.9~22.04.1","6.5.0-1009.10~22.04.1","6.5.0-1010.11~22.04.1","6.5.0-1011.12~22.04.1","6.5.0-1012.13~22.04.1","6.5.0-1014.15~22.04.1","6.5.0-1015.16~22.04.1","6.5.0-1016.17~22.04.1","6.5.0-1017.18~22.04.1","6.5.0-1018.19~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:22.04:LTS","package":"linux-realtime-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.1-1004.4~22.04.1","6.8.1-1005.5~22.04.2","6.8.1-1006.6~22.04.1","6.8.1-1007.7~22.04.1","6.8.1-1008.8~22.04.1","6.8.1-1009.9~22.04.1","6.8.1-1010.10~22.04.1","6.8.1-1011.11~22.04.1","6.8.1-1012.12~22.04.1","6.8.1-1013.14~22.04.1","6.8.1-1014.15~22.04.1","6.8.1-1015.16~22.04.1","6.8.1-1016.17~22.04.1","6.8.1-1017.18~22.04.1","6.8.1-1018.19~22.04.1","6.8.1-1019.20~22.04.1","6.8.1-1020.21~22.04.1","6.8.1-1021.22~22.04.1","6.8.1-1022.23~22.04.1","6.8.1-1023.24~22.04.1","6.8.1-1024.25~22.04.1","6.8.1-1025.26~22.04.1","6.8.1-1026.27~22.04.1","6.8.1-1030.31~22.04.1","6.8.1-1031.32~22.04.1","6.8.1-1034.35~22.04.1","6.8.1-1035.36~22.04.1","6.8.1-1036.37~22.04.1","6.8.1-1037.38~22.04.1","6.8.1-1038.39~22.04.1","6.8.1-1039.40~22.04.1","6.8.1-1040.41~22.04.1","6.8.1-1041.42~22.04.1","6.8.1-1042.43~22.04.1","6.8.1-1045.46~22.04.1","6.8.1-1046.47~22.04.2","6.8.1-1047.48~22.04.1","6.8.1-1048.49~22.04.1","6.8.1-1051.52~22.04.1","6.8.1-1052.53~22.04.1","6.8.1-1055.56~22.04.1","6.8.1-1056.57~22.04.2","6.8.1-1057.58~22.04.1","6.8.1-1058.59~22.04.1","6.8.1-1059.60~22.04.1","6.8.1-1060.61~22.04.1","6.8.1-1061.62~22.04.1","6.8.1-1064.65~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-9.9","6.6.0-14.14","6.8.0-11.11","6.8.0-20.20","6.8.0-22.22","6.8.0-28.28","6.8.0-31.31","6.8.0-35.35","6.8.0-36.36","6.8.0-38.38","6.8.0-39.39","6.8.0-40.40","6.8.0-41.41","6.8.0-44.44","6.8.0-45.45","6.8.0-47.47","6.8.0-48.48","6.8.0-49.49","6.8.0-50.51","6.8.0-51.52","6.8.0-52.53","6.8.0-53.55","6.8.0-54.56","6.8.0-55.57","6.8.0-56.58","6.8.0-57.59","6.8.0-58.60","6.8.0-59.61","6.8.0-60.63","6.8.0-62.65","6.8.0-63.66","6.8.0-64.67","6.8.0-71.71","6.8.0-78.78","6.8.0-79.79","6.8.0-83.83","6.8.0-84.84","6.8.0-85.85","6.8.0-86.87","6.8.0-87.88","6.8.0-88.89","6.8.0-90.91","6.8.0-94.96","6.8.0-100.100","6.8.0-101.101","6.8.0-106.106","6.8.0-107.107","6.8.0-110.110","6.8.0-111.111","6.8.0-117.117","6.8.0-124.124","6.8.0-134.134","6.8.0-136.136","6.8.0-137.137","6.8.0-138.138","6.8.0-139.139","6.8.0-142.142","6.8.0-146.146","6.8.0-147.147","6.8.0-149.149"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1008.8","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1006.6","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1016.17","6.8.0-1017.18","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1023.25","6.8.0-1024.26","6.8.0-1025.27","6.8.0-1026.28","6.8.0-1027.29","6.8.0-1028.30","6.8.0-1029.31","6.8.0-1030.32","6.8.0-1031.33","6.8.0-1032.34","6.8.0-1033.35","6.8.0-1035.37","6.8.0-1036.38","6.8.0-1038.40","6.8.0-1039.41","6.8.0-1040.42","6.8.0-1041.43","6.8.0-1042.44","6.8.0-1043.45","6.8.0-1044.46","6.8.0-1045.47","6.8.0-1046.49","6.8.0-1047.50","6.8.0-1050.53","6.8.0-1051.54","6.8.0-1052.55","6.8.0-1053.56","6.8.0-1055.58","6.8.0-1057.60","6.8.0-1060.63","6.8.0-1061.64","6.8.0-1062.65","6.8.0-1063.66","6.8.0-1064.67","6.8.0-1065.68","6.8.0-1066.69","6.8.0-1067.70","6.8.0-1069.74"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1009.9~24.04.1","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1016.16~24.04.1","6.14.0-1017.17~24.04.1","6.14.0-1018.18~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1007.7~24.04.1"}]}],"versions":["6.17.0-1005.5~24.04.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.7","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1012.14","6.8.0-1013.15","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.20","6.8.0-1018.21","6.8.0-1020.23","6.8.0-1021.25","6.8.0-1025.30","6.8.0-1026.31","6.8.0-1027.32","6.8.0-1028.33","6.8.0-1029.34","6.8.0-1030.35","6.8.0-1031.36","6.8.0-1034.39","6.8.0-1038.44","6.8.0-1040.46","6.8.0-1041.47","6.8.0-1042.48","6.8.0-1044.50","6.8.0-1046.52","6.8.0-1051.57","6.8.0-1052.58","6.8.0-1054.60","6.8.0-1056.62","6.8.0-1058.64","6.8.0-1059.65","6.8.0-1062.69","6.8.0-1063.71","6.8.0-1064.72","6.8.0-1065.73","6.8.0-1067.75","6.8.0-1068.76","6.8.0-1070.78","6.8.0-1071.79"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1008.8~24.04.1","6.11.0-1012.12~24.04.1","6.11.0-1013.13~24.04.1","6.11.0-1014.14~24.04.1","6.11.0-1015.15~24.04.1","6.11.0-1017.17~24.04.1","6.11.0-1018.18~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1010.10~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1041.48","6.8.0-1044.51","6.8.0-1046.53","6.8.0-1053.60","6.8.0-1058.65","6.8.0-1061.68","6.8.0-1062.69","6.8.0-1063.70","6.8.0-1064.71","6.8.0-1065.72","6.8.0-1066.73","6.8.0-1068.75","6.8.0-1069.76"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-fde-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-fde-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1005.5~24.04.1","6.17.0-1010.10~24.04.1","6.17.0-1015.15~24.04.1","6.17.0-1017.17~24.04.1","6.17.0-1018.18~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-nvidia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1013.14","6.8.0-1014.15","6.8.0-1016.17","6.8.0-1018.19","6.8.0-1019.20","6.8.0-1022.23","6.8.0-1025.27","6.8.0-1027.30","6.8.0-1029.32","6.8.0-1039.42"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-nvidia-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1003.3","6.14.0-1006.6","6.14.0-1007.7"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.7","6.6.0-1001.1","6.8.0-1002.2","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.9","6.8.0-1009.10","6.8.0-1010.11","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1024.26","6.8.0-1025.27","6.8.0-1026.28","6.8.0-1027.29","6.8.0-1028.30","6.8.0-1029.31","6.8.0-1030.32","6.8.0-1031.33","6.8.0-1032.34","6.8.0-1033.35","6.8.0-1034.36","6.8.0-1036.38","6.8.0-1037.39","6.8.0-1039.41","6.8.0-1040.42","6.8.0-1041.43","6.8.0-1042.45","6.8.0-1043.46","6.8.0-1044.47","6.8.0-1045.48","6.8.0-1046.49","6.8.0-1047.50","6.8.0-1048.51","6.8.0-1052.55","6.8.0-1053.56","6.8.0-1054.57","6.8.0-1055.58","6.8.0-1058.61","6.8.0-1060.63","6.8.0-1063.69","6.8.0-1064.72","6.8.0-1065.73","6.8.0-1066.74","6.8.0-1067.75","6.8.0-1069.77","6.8.0-1070.78","6.8.0-1071.79","6.8.0-1073.81"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1006.6~24.04.2","6.11.0-1011.11~24.04.1","6.11.0-1013.13~24.04.1","6.11.0-1014.14~24.04.1","6.11.0-1015.15~24.04.1","6.11.0-1016.16~24.04.1","6.11.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1014.15~24.04.1","6.14.0-1015.16~24.04.1","6.14.0-1016.17~24.04.1","6.14.0-1017.18~24.04.1","6.14.0-1018.19~24.04.1","6.14.0-1019.20~24.04.1","6.14.0-1020.21~24.04.1","6.14.0-1021.22~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1008.8~24.04.1"}]}],"versions":["6.17.0-1004.4~24.04.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1003.5","6.8.0-1004.7","6.8.0-1005.8","6.8.0-1006.9","6.8.0-1007.10","6.8.0-1008.11","6.8.0-1009.12","6.8.0-1010.13","6.8.0-1011.14","6.8.0-1012.15","6.8.0-1013.17","6.8.0-1014.18","6.8.0-1015.19","6.8.0-1016.20","6.8.0-1017.21","6.8.0-1019.23","6.8.0-1020.24","6.8.0-1021.25","6.8.0-1022.26","6.8.0-1023.27","6.8.0-1024.28","6.8.0-1025.29","6.8.0-1026.30","6.8.0-1027.31","6.8.0-1028.32","6.8.0-1029.33","6.8.0-1032.36","6.8.0-1033.37","6.8.0-1035.39","6.8.0-1036.40","6.8.0-1037.41","6.8.0-1038.43","6.8.0-1039.44","6.8.0-1040.45","6.8.0-1041.46","6.8.0-1042.47","6.8.0-1043.48","6.8.0-1044.49","6.8.0-1048.53","6.8.0-1049.54","6.8.0-1050.56","6.8.0-1051.57","6.8.0-1054.60","6.8.0-1055.61","6.8.0-1058.64","6.8.0-1059.67","6.8.0-1060.68","6.8.0-1061.69","6.8.0-1062.70","6.8.0-1064.72","6.8.0-1065.73","6.8.0-1066.74","6.8.0-1068.77"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1001.3","6.8.0-1002.4","6.8.0-1003.5","6.8.0-1004.6","6.8.0-1006.8","6.8.0-1007.9","6.8.0-1008.10","6.8.0-1009.11","6.8.0-1010.12","6.8.0-1011.13","6.8.0-1012.14","6.8.0-1013.15","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1022.24","6.8.0-1023.25","6.8.0-1024.26","6.8.0-1025.28","6.8.0-1026.29","6.8.0-1027.30","6.8.0-1028.31","6.8.0-1029.32","6.8.0-1030.33","6.8.0-1031.34","6.8.0-1035.38","6.8.0-1036.39","6.8.0-1037.40","6.8.0-1038.41","6.8.0-1041.44","6.8.0-1042.45","6.8.0-1045.48","6.8.0-1046.50","6.8.0-1047.51","6.8.0-1048.52","6.8.0-1049.53","6.8.0-1050.54","6.8.0-1051.55","6.8.0-1052.56","6.8.0-1053.57"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-hwe-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-17.17~24.04.2","6.11.0-19.19~24.04.1","6.11.0-21.21~24.04.1","6.11.0-24.24~24.04.1","6.11.0-25.25~24.04.1","6.11.0-26.26~24.04.1","6.11.0-28.28~24.04.1","6.11.0-29.29~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-hwe-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-24.24~24.04.3","6.14.0-27.27~24.04.1","6.14.0-28.28~24.04.1","6.14.0-29.29~24.04.1","6.14.0-32.32~24.04.1","6.14.0-33.33~24.04.1","6.14.0-34.34~24.04.1","6.14.0-35.35~24.04.1","6.14.0-36.36~24.04.1","6.14.0-37.37~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1009.9","6.8.0-1001.1","6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1015.15","6.8.0-1016.16","6.8.0-1017.17","6.8.0-1018.18","6.8.0-1019.19","6.8.0-1022.22","6.8.0-1023.23","6.8.0-1024.24","6.8.0-1025.25","6.8.0-1026.26","6.8.0-1027.27","6.8.0-1028.28","6.8.0-1029.29","6.8.0-1030.30","6.8.0-1033.33","6.8.0-1036.36","6.8.0-1037.37","6.8.0-1038.38","6.8.0-1039.39","6.8.0-1040.40","6.8.0-1041.41","6.8.0-1042.42","6.8.0-1043.43","6.8.0-1044.44","6.8.0-1045.45","6.8.0-1049.49","6.8.0-1050.50","6.8.0-1051.51","6.8.0-1052.52","6.8.0-1055.56","6.8.0-1057.58","6.8.0-1060.61","6.8.0-1061.62","6.8.0-1062.63","6.8.0-1063.64","6.8.0-1064.65","6.8.0-1065.66","6.8.0-1066.67","6.8.0-1067.68","6.8.0-1069.70"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-9.9.1","6.6.0-14.14.1","6.8.0-7.7.1","6.8.0-25.25.3","6.8.0-28.28.1","6.8.0-31.31.1","6.8.0-35.35.1","6.8.0-36.36.1","6.8.0-38.38.1","6.8.0-39.39.1","6.8.0-40.40.1","6.8.0-41.41.1","6.8.0-44.44.1","6.8.0-45.45.1","6.8.0-47.47.1","6.8.0-48.48.3","6.8.0-49.49.1","6.8.0-50.51.1","6.8.0-51.52.1","6.8.0-52.53.1","6.8.0-53.55.2","6.8.0-54.56.1","6.8.0-55.57.1","6.8.0-56.58.1","6.8.0-57.59.1","6.8.0-58.60.1","6.8.0-59.61.1","6.8.0-60.63.1","6.8.0-62.65.1","6.8.0-63.66.1","6.8.0-64.67.1","6.8.0-65.68.1","6.8.0-78.78.1","6.8.0-79.79.1","6.8.0-83.83.1","6.8.0-84.84.1","6.8.0-85.85.1","6.8.0-86.87.1","6.8.0-87.88.1","6.8.0-88.89.1","6.8.0-90.91.1","6.8.0-94.96.1","6.8.0-100.100.1","6.8.0-101.101.1","6.8.0-106.106.1","6.8.0-107.107.1","6.8.0-110.110.1","6.8.0-111.111.1","6.8.0-117.117.1","6.8.0-134.134.1","6.8.0-136.136.2","6.8.0-137.137.1","6.8.0-138.138.1","6.8.0-139.139.1","6.8.0-142.142.1","6.8.0-146.146.1","6.8.0-147.147.1","6.8.0-149.149.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency-hwe-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1009.10~24.04.1","6.11.0-1011.12~24.04.1","6.11.0-1012.13~24.04.1","6.11.0-1013.14~24.04.1","6.11.0-1014.15~24.04.1","6.11.0-1015.16~24.04.2","6.11.0-1016.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1022.25","6.8.0-1023.26","6.8.0-1024.27","6.8.0-1025.28","6.8.0-1026.29","6.8.0-1027.30","6.8.0-1028.31","6.8.0-1029.32","6.8.0-1030.33","6.8.0-1031.34","6.8.0-1032.35","6.8.0-1035.38","6.8.0-1036.39","6.8.0-1038.41","6.8.0-1039.42","6.8.0-1040.43","6.8.0-1041.44","6.8.0-1042.45","6.8.0-1043.46","6.8.0-1044.47","6.8.0-1045.48","6.8.0-1046.49","6.8.0-1047.50","6.8.0-1049.52","6.8.0-1050.53","6.8.0-1051.54","6.8.0-1052.55","6.8.0-1054.57","6.8.0-1055.58","6.8.0-1058.61","6.8.0-1059.62","6.8.0-1060.63","6.8.0-1061.64","6.8.0-1062.65","6.8.0-1063.66","6.8.0-1064.67","6.8.0-1067.70"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1002.2","6.11.0-1003.3","6.11.0-1007.7","6.11.0-1010.10","6.11.0-1011.11","6.11.0-1012.12","6.11.0-1013.13","6.11.0-1016.16"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1008.8"}]}],"versions":["6.17.0-1004.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1009.9.1","6.8.0-1011.11.1","6.8.0-1012.12.1","6.8.0-1013.14.1","6.8.0-1014.15.1","6.8.0-1015.16.1","6.8.0-1017.19.1","6.8.0-1018.20.1","6.8.0-1019.21.1","6.8.0-1020.22.1","6.8.0-1021.23.1","6.8.0-1022.25.2","6.8.0-1023.26.1","6.8.0-1024.27.1","6.8.0-1025.28.1","6.8.0-1026.29.1","6.8.0-1027.30.1","6.8.0-1028.31.1","6.8.0-1029.32.1","6.8.0-1030.33.1","6.8.0-1031.34.1","6.8.0-1032.35.1","6.8.0-1035.38.1","6.8.0-1036.39.1","6.8.0-1038.41.1","6.8.0-1039.42.1","6.8.0-1040.43.1","6.8.0-1041.44.1","6.8.0-1042.45.1","6.8.0-1043.46.1","6.8.0-1044.47.1","6.8.0-1045.48.1","6.8.0-1046.49.1","6.8.0-1047.50.1","6.8.0-1049.52.1","6.8.0-1050.53.1","6.8.0-1051.54.1","6.8.0-1052.55.1","6.8.0-1054.57.1","6.8.0-1055.58.1","6.8.0-1058.61.1","6.8.0-1059.62.1","6.8.0-1060.63.1","6.8.0-1061.64.1","6.8.0-1062.65.1","6.8.0-1063.66.1","6.8.0-1064.67.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-tegra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1003.3","6.8.0-1004.4","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1016.16","6.8.0-1019.19","6.8.0-1020.20","6.8.0-1021.21","6.8.0-1022.22","6.8.0-1023.23","6.8.0-1024.24","6.8.0-1025.25","6.8.0-1026.26","6.8.0-1029.30","6.8.0-1030.31","6.8.0-1031.32","6.8.0-1032.34","6.8.0-1035.38","6.8.0-1036.39","6.8.0-1038.42"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1007.7","6.11.0-1008.8","6.11.0-1009.9","6.11.0-1010.10","6.11.0-1011.11","6.11.0-1012.12","6.11.0-1013.13","6.11.0-1015.15","6.11.0-1016.16","6.11.0-1017.17","6.11.0-1018.18","6.11.0-1020.20","6.11.0-1021.21","6.11.0-1022.22","6.11.0-1023.23","6.11.0-1024.24","6.11.0-1025.25","6.11.0-1027.27"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1004.4","6.14.0-1005.5","6.14.0-1006.6","6.14.0-1007.7","6.14.0-1008.8","6.14.0-1010.10","6.14.0-1011.11","6.14.0-1012.12","6.14.0-1013.13","6.14.0-1014.14","6.14.0-1015.15","6.14.0-1016.16","6.14.0-1017.17","6.14.0-1018.18","6.14.0-1019.19","6.14.0-1020.20"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1011.11"}]}],"versions":["6.17.0-1005.5","6.17.0-1006.6","6.17.0-1007.7","6.17.0-1008.8","6.17.0-1009.9","6.17.0-1010.10"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1016.16","6.8.0-1017.17","6.8.0-1018.18","6.8.0-1019.19","6.8.0-1020.20","6.8.0-1024.24","6.8.0-1025.25","6.8.0-1026.26","6.8.0-1027.27","6.8.0-1028.28","6.8.0-1029.29","6.8.0-1030.30","6.8.0-1031.31","6.8.0-1032.32"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1010.10","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1008.8","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1015.16","6.8.0-1016.17","6.8.0-1017.18","6.8.0-1018.19","6.8.0-1019.20","6.8.0-1020.21","6.8.0-1021.22","6.8.0-1022.23","6.8.0-1023.24","6.8.0-1024.25","6.8.0-1025.26","6.8.0-1026.27","6.8.0-1027.28","6.8.0-1028.29","6.8.0-1029.30","6.8.0-1030.31","6.8.0-1032.33","6.8.0-1033.34","6.8.0-1035.36","6.8.0-1037.38","6.8.0-1038.39","6.8.0-1039.40","6.8.0-1040.41","6.8.0-1041.42","6.8.0-1042.43","6.8.0-1043.44","6.8.0-1044.45","6.8.0-1047.48","6.8.0-1049.50","6.8.0-1050.51","6.8.0-1052.53","6.8.0-1054.55","6.8.0-1057.58","6.8.0-1058.61","6.8.0-1059.62","6.8.0-1060.63","6.8.0-1061.64","6.8.0-1062.65","6.8.0-1063.66","6.8.0-1064.67","6.8.0-1067.71"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1009.9~24.04.1","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1016.16~24.04.1","6.14.0-1017.17~24.04.1","6.14.0-1018.18~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1007.7~24.04.1"}]}],"versions":["6.17.0-1004.4~24.04.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1005.7","6.7.0-1001.1","6.8.0-1001.1","6.8.0-1002.2","6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.10","6.8.0-1010.11","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.23","6.8.0-1020.24","6.8.0-1024.28","6.8.0-1028.32","6.8.0-1029.33","6.8.0-1030.34","6.8.0-1031.35","6.8.0-1032.36","6.8.0-1035.39","6.8.0-1036.40","6.8.0-1038.42","6.8.0-1039.43","6.8.0-1040.44","6.8.0-1041.45","6.8.0-1042.46","6.8.0-1043.47","6.8.0-1044.48","6.8.0-1045.49","6.8.0-1047.51","6.8.0-1048.52","6.8.0-1050.54","6.8.0-1051.55","6.8.0-1052.56","6.8.0-1053.57","6.8.0-1056.60","6.8.0-1057.61","6.8.0-1060.64","6.8.0-1061.65","6.8.0-1062.66","6.8.0-1063.67","6.8.0-1064.68","6.8.0-1065.69","6.8.0-1068.72"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-2019.20"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.1-1015.16"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-9.9.1","6.8.0-20.20.1","6.8.0-28.28.1","6.8.0-31.31.1","6.8.0-35.35.1","6.8.0-36.36.1","6.8.0-38.38.1","6.8.0-39.39.1","6.8.0-40.40.1","6.8.0-41.41.1","6.8.0-44.44.1","6.8.0-47.47.1","6.8.0-48.48.1","6.8.0-49.49.1","6.8.0-50.51.1","6.8.0-51.52.1","6.8.0-52.53.1","6.8.0-53.55.1","6.8.0-55.57.1","6.8.0-56.58.1","6.8.0-57.59.1","6.8.0-58.60.1","6.8.0-59.61.1","6.8.0-60.63.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-22.22.1~24.04.1","6.14.0-23.23.1~24.04.1","6.14.0-24.24.1~24.04.1","6.14.0-27.27.1~24.04.1","6.14.0-28.28.1~24.04.1","6.14.0-29.29.1~24.04.1","6.14.0-32.32.1~24.04.1","6.14.0-33.33.1~24.04.1","6.14.0-34.34.1~24.04.1","6.14.0-35.35.1~24.04.1","6.14.0-36.36.1~24.04.1","6.14.0-37.37.1~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1005.5","6.8.0-1008.8","6.8.0-1010.10"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-xilinx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1008.9","6.8.0-1009.10","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1017.18","6.8.0-1018.19","6.8.0-1019.20","6.8.0-1020.21","6.8.0-1021.22","6.8.0-1022.23","6.8.0-1023.24","6.8.0-1024.25","6.8.0-1028.29","6.8.0-1029.30","6.8.0-1032.33","6.8.0-1033.34","6.8.0-1034.35","6.8.0-1035.36","6.8.0-1036.37"]},{"source":"osv","ecosystem":"Ubuntu:Nvidia-BlueField:24.04:LTS","package":"linux-bluefield","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1011.15","6.8.0-1012.16","6.8.0-1013.17","6.8.0-1014.18","6.8.0-1016.20","6.8.0-1017.21","6.8.0-1022.26","6.8.0-1023.27","6.8.0-1026.30","6.8.0-1028.33","6.8.0-1029.34","6.8.0-1030.35","6.8.0-1031.36","6.8.0-1032.37","6.8.0-1033.38","6.8.0-1036.41"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-raspi-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.7.0-2001.1","6.8.0-2001.1","6.8.0-2002.2","6.8.0-2004.4","6.8.0-2005.5","6.8.0-2006.6","6.8.0-2007.7","6.8.0-2008.8","6.8.0-2009.9","6.8.0-2010.10","6.8.0-2011.11","6.8.0-2012.12","6.8.0-2013.14","6.8.0-2014.15","6.8.0-2015.16","6.8.0-2016.17","6.8.0-2017.18","6.8.0-2018.19","6.8.0-2019.20","6.8.0-2022.23","6.8.0-2023.24","6.8.0-2024.25","6.8.0-2025.26","6.8.0-2026.27","6.8.0-2028.29","6.8.0-2029.30","6.8.0-2030.31","6.8.0-2031.32","6.8.0-2032.33","6.8.0-2033.34","6.8.0-2034.35","6.8.0-2035.36","6.8.0-2036.37","6.8.0-2037.38","6.8.0-2038.39","6.8.0-2040.41","6.8.0-2041.42","6.8.0-2042.43","6.8.0-2043.44","6.8.0-2045.46","6.8.0-2046.47","6.8.0-2049.50","6.8.0-2050.52","6.8.0-2051.53","6.8.0-2052.54","6.8.0-2053.55","6.8.0-2054.56","6.8.0-2056.58"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1008.19","6.8.1-1001.1","6.8.1-1002.2","6.8.1-1003.3","6.8.1-1004.4","6.8.1-1005.5","6.8.1-1006.6","6.8.1-1007.7","6.8.1-1008.8","6.8.1-1009.9","6.8.1-1010.10","6.8.1-1011.11","6.8.1-1012.12","6.8.1-1013.14","6.8.1-1014.15","6.8.1-1015.16","6.8.1-1016.17","6.8.1-1017.18","6.8.1-1018.19","6.8.1-1019.20","6.8.1-1020.21","6.8.1-1021.22","6.8.1-1022.23","6.8.1-1023.24","6.8.1-1024.25","6.8.1-1025.26","6.8.1-1026.27","6.8.1-1030.31","6.8.1-1031.32","6.8.1-1033.34","6.8.1-1034.35","6.8.1-1035.36","6.8.1-1036.37","6.8.1-1037.38","6.8.1-1038.39","6.8.1-1039.40","6.8.1-1040.41","6.8.1-1041.42","6.8.1-1042.43","6.8.1-1045.46","6.8.1-1046.47","6.8.1-1047.48","6.8.1-1048.49","6.8.1-1051.52","6.8.1-1052.53","6.8.1-1055.56","6.8.1-1056.57","6.8.1-1057.58","6.8.1-1058.59","6.8.1-1059.60","6.8.1-1060.61","6.8.1-1061.62","6.8.1-1062.63","6.8.1-1064.65"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1003.3~24.04.3","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1016.16~24.04.1","6.14.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1006.7~24.04.1"}]}],"versions":["6.17.0-1004.5~24.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-aws-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1035.37+fips1","6.8.0-1036.38+fips1","6.8.0-1038.40+fips1","6.8.0-1039.41+fips1","6.8.0-1040.42+fips1","6.8.0-1041.43+fips1","6.8.0-1042.44+fips1","6.8.0-1043.45+fips1","6.8.0-1044.46+fips1","6.8.0-1045.47+fips1","6.8.0-1046.49+fips1","6.8.0-1047.50+fips1","6.8.0-1050.53+fips1","6.8.0-1051.54+fips1","6.8.0-1052.55+fips1","6.8.0-1053.56+fips1","6.8.0-1055.58+fips1","6.8.0-1057.60+fips1","6.8.0-1060.63+fips1","6.8.0-1061.64+fips1","6.8.0-1062.65+fips1","6.8.0-1063.66+fips1","6.8.0-1064.67+fips1","6.8.0-1065.68+fips1","6.8.0-1066.69+fips1","6.8.0-1067.70+fips1","6.8.0-1069.74+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-azure-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1034.39+fips1","6.8.0-1040.46+fips1","6.8.0-1044.50+fips1","6.8.0-1046.52+fips1","6.8.0-1047.53+fips1","6.8.0-1052.58+fips1","6.8.0-1053.59+fips1","6.8.0-1054.60+fips1","6.8.0-1059.65+fips1","6.8.0-1062.69+fips1","6.8.0-1063.71+fips2","6.8.0-1064.72+fips1","6.8.0-1065.73+fips1","6.8.0-1067.75+fips1","6.8.0-1068.76+fips1","6.8.0-1069.77+fips1","6.8.0-1071.79+fips1","6.8.0-1073.82+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-38.38+fips4","6.8.0-78.78+fips1","6.8.0-79.79+fips1","6.8.0-83.83+fips1","6.8.0-84.84+fips1","6.8.0-85.85+fips1","6.8.0-86.87+fips1","6.8.0-87.88+fips1","6.8.0-88.89+fips1","6.8.0-90.91+fips1","6.8.0-94.96+fips1","6.8.0-100.100+fips1","6.8.0-101.101+fips1","6.8.0-106.106+fips1","6.8.0-107.107+fips1","6.8.0-110.110+fips2","6.8.0-111.111+fips1","6.8.0-116.116+fips1","6.8.0-124.124+fips1","6.8.0-134.134+fips1","6.8.0-136.136+fips2","6.8.0-137.137+fips1","6.8.0-138.138+fips1","6.8.0-139.139+fips1","6.8.0-142.142+fips1","6.8.0-146.146+fips1","6.8.0-147.147+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-gcp-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1036.38+fips1","6.8.0-1037.39+fips1","6.8.0-1039.41+fips1","6.8.0-1040.42+fips1","6.8.0-1041.43+fips1","6.8.0-1042.45+fips1","6.8.0-1043.46+fips1","6.8.0-1044.47+fips1","6.8.0-1045.48+fips1","6.8.0-1046.49+fips1","6.8.0-1047.50+fips1","6.8.0-1048.51+fips1","6.8.0-1052.55+fips1","6.8.0-1053.56+fips1","6.8.0-1054.57+fips1","6.8.0-1055.58+fips1","6.8.0-1058.61+fips1","6.8.0-1060.63+fips1","6.8.0-1063.69+fips1","6.8.0-1064.72+fips1","6.8.0-1065.73+fips1","6.8.0-1066.74+fips1","6.8.0-1067.75+fips1","6.8.0-1068.76+fips1","6.8.0-1070.78+fips1","6.8.0-1071.79+fips1","6.8.0-1073.81+fips1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-14.14"}]}],"versions":["6.14.0-15.15","6.15.0-3.3","6.15.0-4.4","6.16.0-13.13","6.16.0-16.16","6.17.0-3.3","6.17.0-4.4","6.17.0-5.5","6.17.0-6.6","6.17.0-7.7","6.17.0-8.8","6.17.0-12.12"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1007.7"}]}],"versions":["6.14.0-1005.5","6.14.0-1007.7+25.10.2","6.16.0-1001.1","6.17.0-1001.1","6.17.0-1002.2","6.17.0-1003.3","6.17.0-1004.4","6.17.0-1005.5","6.17.0-1006.6"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1008.8"}]}],"versions":["6.14.0-1004.4","6.14.0-1007.7+25.10.1","6.16.0-1001.1","6.17.0-1002.2","6.17.0-1003.3","6.17.0-1004.4","6.17.0-1006.6","6.17.0-1007.7"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1003.3","6.17.0-1004.4","6.17.0-1005.5","6.17.0-1007.7","6.17.0-1008.8","6.17.0-1010.10","6.17.0-1012.12","6.17.0-1014.14","6.17.0-1015.15","6.17.0-1017.17"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1007.7"}]}],"versions":["6.14.0-1006.6","6.14.0-1009.9+25.10.1","6.16.0-1001.1","6.17.0-1001.1","6.17.0-1002.2","6.17.0-1003.3","6.17.0-1004.4","6.17.0-1005.5","6.17.0-1006.6"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1007.7"}]}],"versions":["6.14.0-1005.5","6.14.0-1007.7+25.10.1","6.16.0-1001.1","6.17.0-1001.1","6.17.0-1002.2","6.17.0-1003.3","6.17.0-1005.5","6.17.0-1006.6"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-raspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1008.8"}]}],"versions":["6.14.0-1005.5","6.17.0-1003.3","6.17.0-1004.4","6.17.0-1005.5","6.17.0-1006.6","6.17.0-1007.7"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1006.7"}]}],"versions":["6.14.0-1002.2","6.17.0-1001.2","6.17.0-1002.3","6.17.0-1003.4","6.17.0-1004.5","6.17.0-1005.6"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-14.14.1"}]}],"versions":["6.14.0-13.13.2","6.17.0-4.4.1","6.17.0-5.5.1","6.17.0-6.6.1","6.17.0-7.7.1","6.17.0-8.8.1","6.17.0-12.12.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-14.14"}]}],"versions":["6.14.0-15.15","6.15.0-3.3","6.15.0-4.4","6.16.0-13.13","6.16.0-16.16","6.17.0-3.3","6.17.0-4.4","6.17.0-5.5","6.17.0-6.6","6.17.0-7.7","6.17.0-8.8","6.17.0-12.12"],"bundled":367},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-raspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1008.8"}]}],"versions":["6.14.0-1005.5","6.17.0-1003.3","6.17.0-1004.4","6.17.0-1005.5","6.17.0-1006.6","6.17.0-1007.7"],"bundled":367},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1006.7"}]}],"versions":["6.14.0-1002.2","6.17.0-1001.2","6.17.0-1002.3","6.17.0-1003.4","6.17.0-1004.5","6.17.0-1005.6"],"bundled":367},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1007.7"}]}],"versions":["6.14.0-1005.5","6.14.0-1007.7+25.10.2","6.16.0-1001.1","6.17.0-1001.1","6.17.0-1002.2","6.17.0-1003.3","6.17.0-1004.4","6.17.0-1005.5","6.17.0-1006.6"],"bundled":367},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1007.7"}]}],"versions":["6.14.0-1005.5","6.14.0-1007.7+25.10.1","6.16.0-1001.1","6.17.0-1001.1","6.17.0-1002.2","6.17.0-1003.3","6.17.0-1005.5","6.17.0-1006.6"],"bundled":367},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1008.8"}]}],"versions":["6.14.0-1004.4","6.14.0-1007.7+25.10.1","6.16.0-1001.1","6.17.0-1002.2","6.17.0-1003.3","6.17.0-1004.4","6.17.0-1006.6","6.17.0-1007.7"],"bundled":367},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1007.7"}]}],"versions":["6.14.0-1006.6","6.14.0-1009.9+25.10.1","6.16.0-1001.1","6.17.0-1001.1","6.17.0-1002.2","6.17.0-1003.3","6.17.0-1004.4","6.17.0-1005.5","6.17.0-1006.6"],"bundled":366},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1011.11"}]}],"versions":["6.17.0-1005.5","6.17.0-1006.6","6.17.0-1007.7","6.17.0-1008.8","6.17.0-1009.9","6.17.0-1010.10"],"bundled":366},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"dtb-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1.160000.2.25"}]}],"bundled":401},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.39.1"}]}],"bundled":401}],"products":[{"vendor":"linux","product":"linux"}],"references":[{"url":"https://git.kernel.org/stable/c/e0a82361cef20380b1c0f342c7e92f8ddabeefc2","tags":["web"]},{"url":"https://git.kernel.org/stable/c/5f75857ed634d04266301d7a4f695a7deeb9bfdc","tags":["web"]},{"url":"https://git.kernel.org/stable/c/24315474ca913c0693939ab74b389ee04c7d3020","tags":["web"]},{"url":"https://git.kernel.org/stable/c/854da2b0df1654d63963d587b12fec6068d89643","tags":["web","report"]},{"url":"https://git.kernel.org/stable/c/9228facb308157ac0bdd264b873187896f7a9c7a","tags":["web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40136","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-p5f2-4xpv-wwqj"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-40136","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40136.json","tags":["advisory"]},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-40136","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2417","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56611","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56760","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21908","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21931","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21970","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21971","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21980","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21981","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21986","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21995","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22001","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22009","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22071","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22077","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-23138","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-23157","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37740","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37748","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37766","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37768","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37770","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37771","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37778","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37793","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37805","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37815","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37831","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37844","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37853","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37881","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37889","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37905","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37918","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37947","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37967","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38014","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38037","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38043","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38051","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38064","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38113","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38122","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38123","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38131","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38148","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38161","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38183","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38193","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38194","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38241","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38255","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38304","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38307","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38321","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38344","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38364","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38461","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38462","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38488","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38499","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38552","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38575","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38609","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38721","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39676","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39682","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39702","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39728","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39756","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39770","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39812","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39841","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39894","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39937","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39955","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39980","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40018","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40062","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40078","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40240","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40254","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40280","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40281","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40331","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68283","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68284","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68285","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68304","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68740","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68742","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68795","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68820","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71064","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22976","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22994","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23053","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23056","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23063","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23253","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23260","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23268","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23271","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23273","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31447","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43047","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43048","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43407","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2418","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23292","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23296","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23313","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23317","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23319","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23352","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23359","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23360","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23374","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23383","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23388","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43053","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43147","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43261","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43289","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43470","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260447-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1205462","tags":["report"]},{"url":"https://bugzilla.suse.com/1214285","tags":["report"]},{"url":"https://bugzilla.suse.com/1215199","tags":["report"]},{"url":"https://bugzilla.suse.com/1223800","tags":["report"]},{"url":"https://bugzilla.suse.com/1228490","tags":["report"]},{"url":"https://bugzilla.suse.com/1233563","tags":["report"]},{"url":"https://bugzilla.suse.com/1234842","tags":["report"]},{"url":"https://bugzilla.suse.com/1235566","tags":["report"]},{"url":"https://bugzilla.suse.com/1241437","tags":["report"]},{"url":"https://bugzilla.suse.com/1242505","tags":["report"]},{"url":"https://bugzilla.suse.com/1242909","tags":["report"]},{"url":"https://bugzilla.suse.com/1243662","tags":["report"]},{"url":"https://bugzilla.suse.com/1243677","tags":["report"]},{"url":"https://bugzilla.suse.com/1243678","tags":["report"]},{"url":"https://bugzilla.suse.com/1245538","tags":["report"]},{"url":"https://bugzilla.suse.com/1246022","tags":["report"]},{"url":"https://bugzilla.suse.com/1246184","tags":["report"]},{"url":"https://bugzilla.suse.com/1246447","tags":["report"]},{"url":"https://bugzilla.suse.com/1247030","tags":["report"]},{"url":"https://bugzilla.suse.com/1247712","tags":["report"]},{"url":"https://bugzilla.suse.com/1248211","tags":["report"]},{"url":"https://bugzilla.suse.com/1249307","tags":["report"]},{"url":"https://bugzilla.suse.com/1249904","tags":["report"]},{"url":"https://bugzilla.suse.com/1250032","tags":["report"]},{"url":"https://bugzilla.suse.com/1250082","tags":["report"]},{"url":"https://bugzilla.suse.com/1250388","tags":["report"]},{"url":"https://bugzilla.suse.com/1250705","tags":["report"]},{"url":"https://bugzilla.suse.com/1250748","tags":["report"]},{"url":"https://bugzilla.suse.com/1252511","tags":["report"]},{"url":"https://bugzilla.suse.com/1252712","tags":["report"]},{"url":"https://bugzilla.suse.com/1252891","tags":["report"]},{"url":"https://bugzilla.suse.com/1252900","tags":["report"]},{"url":"https://bugzilla.suse.com/1253087","tags":["report"]},{"url":"https://bugzilla.suse.com/1253330","tags":["report"]},{"url":"https://bugzilla.suse.com/1253340","tags":["report"]},{"url":"https://bugzilla.suse.com/1253348","tags":["report"]},{"url":"https://bugzilla.suse.com/1253433","tags":["report"]},{"url":"https://bugzilla.suse.com/1253443","tags":["report"]},{"url":"https://bugzilla.suse.com/1253451","tags":["report"]},{"url":"https://bugzilla.suse.com/1253471","tags":["report"]},{"url":"https://bugzilla.suse.com/1253739","tags":["report"]},{"url":"https://bugzilla.suse.com/1254244","tags":["report"]},{"url":"https://bugzilla.suse.com/1254447","tags":["report"]},{"url":"https://bugzilla.suse.com/1254465","tags":["report"]},{"url":"https://bugzilla.suse.com/1254510","tags":["report"]},{"url":"https://bugzilla.suse.com/1254624","tags":["report"]},{"url":"https://bugzilla.suse.com/1254767","tags":["report"]},{"url":"https://bugzilla.suse.com/1254835","tags":["report"]},{"url":"https://bugzilla.suse.com/1254839","tags":["report"]},{"url":"https://bugzilla.suse.com/1254842","tags":["report"]},{"url":"https://bugzilla.suse.com/1254845","tags":["report"]},{"url":"https://bugzilla.suse.com/1254852","tags":["report"]},{"url":"https://bugzilla.suse.com/1254871","tags":["report"]},{"url":"https://bugzilla.suse.com/1255102","tags":["report"]},{"url":"https://bugzilla.suse.com/1255120","tags":["report"]},{"url":"https://bugzilla.suse.com/1255128","tags":["report"]},{"url":"https://bugzilla.suse.com/1255138","tags":["report"]},{"url":"https://bugzilla.suse.com/1255140","tags":["report"]},{"url":"https://bugzilla.suse.com/1255157","tags":["report"]},{"url":"https://bugzilla.suse.com/1255164","tags":["report"]},{"url":"https://bugzilla.suse.com/1255172","tags":["report"]},{"url":"https://bugzilla.suse.com/1255216","tags":["report"]},{"url":"https://bugzilla.suse.com/1255226","tags":["report"]},{"url":"https://bugzilla.suse.com/1255241","tags":["report"]},{"url":"https://bugzilla.suse.com/1255255","tags":["report"]},{"url":"https://bugzilla.suse.com/1255260","tags":["report"]},{"url":"https://bugzilla.suse.com/1255261","tags":["report"]},{"url":"https://bugzilla.suse.com/1255266","tags":["report"]},{"url":"https://bugzilla.suse.com/1255268","tags":["report"]},{"url":"https://bugzilla.suse.com/1255269","tags":["report"]},{"url":"https://bugzilla.suse.com/1255327","tags":["report"]},{"url":"https://bugzilla.suse.com/1255346","tags":["report"]},{"url":"https://bugzilla.suse.com/1255377","tags":["report"]},{"url":"https://bugzilla.suse.com/1255401","tags":["report"]},{"url":"https://bugzilla.suse.com/1255403","tags":["report"]},{"url":"https://bugzilla.suse.com/1255417","tags":["report"]},{"url":"https://bugzilla.suse.com/1255482","tags":["report"]},{"url":"https://bugzilla.suse.com/1255488","tags":["report"]},{"url":"https://bugzilla.suse.com/1255537","tags":["report"]},{"url":"https://bugzilla.suse.com/1255539","tags":["report"]},{"url":"https://bugzilla.suse.com/1255544","tags":["report"]},{"url":"https://bugzilla.suse.com/1255547","tags":["report"]},{"url":"https://bugzilla.suse.com/1255548","tags":["report"]},{"url":"https://bugzilla.suse.com/1255552","tags":["report"]},{"url":"https://bugzilla.suse.com/1255568","tags":["report"]},{"url":"https://bugzilla.suse.com/1255569","tags":["report"]},{"url":"https://bugzilla.suse.com/1255615","tags":["report"]},{"url":"https://bugzilla.suse.com/1255622","tags":["report"]},{"url":"https://bugzilla.suse.com/1255695","tags":["report"]},{"url":"https://bugzilla.suse.com/1255930","tags":["report"]},{"url":"https://bugzilla.suse.com/1256280","tags":["report"]},{"url":"https://bugzilla.suse.com/1256528","tags":["report"]},{"url":"https://bugzilla.suse.com/1256568","tags":["report"]},{"url":"https://bugzilla.suse.com/1256579","tags":["report"]},{"url":"https://bugzilla.suse.com/1256582","tags":["report"]},{"url":"https://bugzilla.suse.com/1256584","tags":["report"]},{"url":"https://bugzilla.suse.com/1256586","tags":["report"]},{"url":"https://bugzilla.suse.com/1256591","tags":["report"]},{"url":"https://bugzilla.suse.com/1256592","tags":["report"]},{"url":"https://bugzilla.suse.com/1256593","tags":["report"]},{"url":"https://bugzilla.suse.com/1256594","tags":["report"]},{"url":"https://bugzilla.suse.com/1256597","tags":["report"]},{"url":"https://bugzilla.suse.com/1256605","tags":["report"]},{"url":"https://bugzilla.suse.com/1256606","tags":["report"]},{"url":"https://bugzilla.suse.com/1256607","tags":["report"]},{"url":"https://bugzilla.suse.com/1256608","tags":["report"]},{"url":"https://bugzilla.suse.com/1256609","tags":["report"]},{"url":"https://bugzilla.suse.com/1256610","tags":["report"]},{"url":"https://bugzilla.suse.com/1256611","tags":["report"]},{"url":"https://bugzilla.suse.com/1256612","tags":["report"]},{"url":"https://bugzilla.suse.com/1256613","tags":["report"]},{"url":"https://bugzilla.suse.com/1256616","tags":["report"]},{"url":"https://bugzilla.suse.com/1256617","tags":["report"]},{"url":"https://bugzilla.suse.com/1256619","tags":["report"]},{"url":"https://bugzilla.suse.com/1256622","tags":["report"]},{"url":"https://bugzilla.suse.com/1256623","tags":["report"]},{"url":"https://bugzilla.suse.com/1256625","tags":["report"]},{"url":"https://bugzilla.suse.com/1256627","tags":["report"]},{"url":"https://bugzilla.suse.com/1256628","tags":["report"]},{"url":"https://bugzilla.suse.com/1256630","tags":["report"]},{"url":"https://bugzilla.suse.com/1256638","tags":["report"]},{"url":"https://bugzilla.suse.com/1256641","tags":["report"]},{"url":"https://bugzilla.suse.com/1256645","tags":["report"]},{"url":"https://bugzilla.suse.com/1256646","tags":["report"]},{"url":"https://bugzilla.suse.com/1256650","tags":["report"]},{"url":"https://bugzilla.suse.com/1256651","tags":["report"]},{"url":"https://bugzilla.suse.com/1256653","tags":["report"]},{"url":"https://bugzilla.suse.com/1256654","tags":["report"]},{"url":"https://bugzilla.suse.com/1256655","tags":["report"]},{"url":"https://bugzilla.suse.com/1256659","tags":["report"]},{"url":"https://bugzilla.suse.com/1256660","tags":["report"]},{"url":"https://bugzilla.suse.com/1256661","tags":["report"]},{"url":"https://bugzilla.suse.com/1256664","tags":["report"]},{"url":"https://bugzilla.suse.com/1256665","tags":["report"]},{"url":"https://bugzilla.suse.com/1256674","tags":["report"]},{"url":"https://bugzilla.suse.com/1256680","tags":["report"]},{"url":"https://bugzilla.suse.com/1256682","tags":["report"]},{"url":"https://bugzilla.suse.com/1256688","tags":["report"]},{"url":"https://bugzilla.suse.com/1256689","tags":["report"]},{"url":"https://bugzilla.suse.com/1256690","tags":["report"]},{"url":"https://bugzilla.suse.com/1256726","tags":["report"]},{"url":"https://bugzilla.suse.com/1256728","tags":["report"]},{"url":"https://bugzilla.suse.com/1256730","tags":["report"]},{"url":"https://bugzilla.suse.com/1256733","tags":["report"]},{"url":"https://bugzilla.suse.com/1256737","tags":["report"]},{"url":"https://bugzilla.suse.com/1256741","tags":["report"]},{"url":"https://bugzilla.suse.com/1256742","tags":["report"]},{"url":"https://bugzilla.suse.com/1256744","tags":["report"]},{"url":"https://bugzilla.suse.com/1256748","tags":["report"]},{"url":"https://bugzilla.suse.com/1256749","tags":["report"]},{"url":"https://bugzilla.suse.com/1256752","tags":["report"]},{"url":"https://bugzilla.suse.com/1256754","tags":["report"]},{"url":"https://bugzilla.suse.com/1256756","tags":["report"]},{"url":"https://bugzilla.suse.com/1256757","tags":["report"]},{"url":"https://bugzilla.suse.com/1256759","tags":["report"]},{"url":"https://bugzilla.suse.com/1256760","tags":["report"]},{"url":"https://bugzilla.suse.com/1256761","tags":["report"]},{"url":"https://bugzilla.suse.com/1256763","tags":["report"]},{"url":"https://bugzilla.suse.com/1256770","tags":["report"]},{"url":"https://bugzilla.suse.com/1256773","tags":["report"]},{"url":"https://bugzilla.suse.com/1256774","tags":["report"]},{"url":"https://bugzilla.suse.com/1256777","tags":["report"]},{"url":"https://bugzilla.suse.com/1256779","tags":["report"]},{"url":"https://bugzilla.suse.com/1256781","tags":["report"]},{"url":"https://bugzilla.suse.com/1256785","tags":["report"]},{"url":"https://bugzilla.suse.com/1256792","tags":["report"]},{"url":"https://bugzilla.suse.com/1256794","tags":["report"]},{"url":"https://bugzilla.suse.com/1256861","tags":["report"]},{"url":"https://bugzilla.suse.com/1256863","tags":["report"]},{"url":"https://bugzilla.suse.com/1257035","tags":["report"]},{"url":"https://bugzilla.suse.com/1257053","tags":["report"]},{"url":"https://bugzilla.suse.com/1257154","tags":["report"]},{"url":"https://bugzilla.suse.com/1257155","tags":["report"]},{"url":"https://bugzilla.suse.com/1257158","tags":["report"]},{"url":"https://bugzilla.suse.com/1257163","tags":["report"]},{"url":"https://bugzilla.suse.com/1257164","tags":["report"]},{"url":"https://bugzilla.suse.com/1257167","tags":["report"]},{"url":"https://bugzilla.suse.com/1257168","tags":["report"]},{"url":"https://bugzilla.suse.com/1257180","tags":["report"]},{"url":"https://bugzilla.suse.com/1257202","tags":["report"]},{"url":"https://bugzilla.suse.com/1257204","tags":["report"]},{"url":"https://bugzilla.suse.com/1257207","tags":["report"]},{"url":"https://bugzilla.suse.com/1257208","tags":["report"]},{"url":"https://bugzilla.suse.com/1257215","tags":["report"]},{"url":"https://bugzilla.suse.com/1257217","tags":["report"]},{"url":"https://bugzilla.suse.com/1257218","tags":["report"]},{"url":"https://bugzilla.suse.com/1257220","tags":["report"]},{"url":"https://bugzilla.suse.com/1257221","tags":["report"]},{"url":"https://bugzilla.suse.com/1257227","tags":["report"]},{"url":"https://bugzilla.suse.com/1257232","tags":["report"]},{"url":"https://bugzilla.suse.com/1257234","tags":["report"]},{"url":"https://bugzilla.suse.com/1257236","tags":["report"]},{"url":"https://bugzilla.suse.com/1257245","tags":["report"]},{"url":"https://bugzilla.suse.com/1257277","tags":["report"]},{"url":"https://bugzilla.suse.com/1257282","tags":["report"]},{"url":"https://bugzilla.suse.com/1257296","tags":["report"]},{"url":"https://bugzilla.suse.com/1257473","tags":["report"]},{"url":"https://bugzilla.suse.com/1257603","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-53714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-54013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53070","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-37744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-37751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-37813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38322","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39689","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39836","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39880","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40202","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40261","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40355","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40363","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68171","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68200","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68215","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68256","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68261","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68301","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68320","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68363","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68365","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68366","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68367","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68372","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68764","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68768","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68771","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68773","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68775","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68788","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68797","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68801","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68802","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68804","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68808","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68820","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71076","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71077","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71078","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71081","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71082","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71083","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71084","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71087","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71094","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71095","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71096","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71114","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71116","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71118","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71119","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71120","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71130","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71147","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22977","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22985","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22992","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22993","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23001","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23006","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23011","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260472-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1257332","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23010","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260587-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624179-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1258335","tags":["report"]},{"url":"https://bugzilla.suse.com/1260474","tags":["report"]},{"url":"https://bugzilla.suse.com/1261564","tags":["report"]},{"url":"https://bugzilla.suse.com/1261816","tags":["report"]},{"url":"https://bugzilla.suse.com/1264330","tags":["report"]},{"url":"https://bugzilla.suse.com/1264607","tags":["report"]},{"url":"https://bugzilla.suse.com/1264747","tags":["report"]},{"url":"https://bugzilla.suse.com/1266410","tags":["report"]},{"url":"https://bugzilla.suse.com/1266848","tags":["report"]},{"url":"https://bugzilla.suse.com/1267464","tags":["report"]},{"url":"https://bugzilla.suse.com/1267672","tags":["report"]},{"url":"https://bugzilla.suse.com/1271817","tags":["report"]},{"url":"https://bugzilla.suse.com/1271901","tags":["report"]},{"url":"https://bugzilla.suse.com/1271950","tags":["report"]},{"url":"https://bugzilla.suse.com/1272145","tags":["report"]},{"url":"https://bugzilla.suse.com/1272215","tags":["report"]},{"url":"https://bugzilla.suse.com/1272347","tags":["report"]},{"url":"https://bugzilla.suse.com/1272388","tags":["report"]},{"url":"https://bugzilla.suse.com/1272473","tags":["report"]},{"url":"https://bugzilla.suse.com/1272571","tags":["report"]},{"url":"https://bugzilla.suse.com/1272802","tags":["report"]},{"url":"https://bugzilla.suse.com/1272803","tags":["report"]},{"url":"https://bugzilla.suse.com/1272890","tags":["report"]},{"url":"https://bugzilla.suse.com/1273040","tags":["report"]},{"url":"https://bugzilla.suse.com/1273059","tags":["report"]},{"url":"https://bugzilla.suse.com/1273116","tags":["report"]},{"url":"https://bugzilla.suse.com/1273258","tags":["report"]},{"url":"https://bugzilla.suse.com/1273275","tags":["report"]},{"url":"https://bugzilla.suse.com/1273290","tags":["report"]},{"url":"https://bugzilla.suse.com/1273297","tags":["report"]},{"url":"https://bugzilla.suse.com/1273320","tags":["report"]},{"url":"https://bugzilla.suse.com/1273491","tags":["report"]},{"url":"https://bugzilla.suse.com/1273512","tags":["report"]},{"url":"https://bugzilla.suse.com/1273784","tags":["report"]},{"url":"https://bugzilla.suse.com/1273879","tags":["report"]},{"url":"https://bugzilla.suse.com/1273889","tags":["report"]},{"url":"https://bugzilla.suse.com/1273938","tags":["report"]},{"url":"https://bugzilla.suse.com/1273970","tags":["report"]},{"url":"https://bugzilla.suse.com/1273976","tags":["report"]},{"url":"https://bugzilla.suse.com/1273982","tags":["report"]},{"url":"https://bugzilla.suse.com/1274037","tags":["report"]},{"url":"https://bugzilla.suse.com/1274061","tags":["report"]},{"url":"https://bugzilla.suse.com/1274245","tags":["report"]},{"url":"https://bugzilla.suse.com/1274297","tags":["report"]},{"url":"https://bugzilla.suse.com/1274298","tags":["report"]},{"url":"https://bugzilla.suse.com/1274316","tags":["report"]},{"url":"https://bugzilla.suse.com/1274319","tags":["report"]},{"url":"https://bugzilla.suse.com/1274538","tags":["report"]},{"url":"https://bugzilla.suse.com/1274629","tags":["report"]},{"url":"https://bugzilla.suse.com/1274663","tags":["report"]},{"url":"https://bugzilla.suse.com/1274776","tags":["report"]},{"url":"https://bugzilla.suse.com/1274818","tags":["report"]},{"url":"https://bugzilla.suse.com/1274824","tags":["report"]},{"url":"https://bugzilla.suse.com/1274836","tags":["report"]},{"url":"https://bugzilla.suse.com/1274890","tags":["report"]},{"url":"https://bugzilla.suse.com/1274912","tags":["report"]},{"url":"https://bugzilla.suse.com/1274920","tags":["report"]},{"url":"https://bugzilla.suse.com/1275137","tags":["report"]},{"url":"https://bugzilla.suse.com/1275142","tags":["report"]},{"url":"https://bugzilla.suse.com/1275170","tags":["report"]},{"url":"https://bugzilla.suse.com/1275495","tags":["report"]},{"url":"https://bugzilla.suse.com/1275543","tags":["report"]},{"url":"https://bugzilla.suse.com/1275545","tags":["report"]},{"url":"https://bugzilla.suse.com/1275549","tags":["report"]},{"url":"https://bugzilla.suse.com/1275559","tags":["report"]},{"url":"https://bugzilla.suse.com/1275567","tags":["report"]},{"url":"https://bugzilla.suse.com/1275682","tags":["report"]},{"url":"https://bugzilla.suse.com/1275740","tags":["report"]},{"url":"https://bugzilla.suse.com/1275924","tags":["report"]},{"url":"https://bugzilla.suse.com/1275953","tags":["report"]},{"url":"https://bugzilla.suse.com/1275972","tags":["report"]},{"url":"https://bugzilla.suse.com/1275977","tags":["report"]},{"url":"https://bugzilla.suse.com/1276007","tags":["report"]},{"url":"https://bugzilla.suse.com/1276009","tags":["report"]},{"url":"https://bugzilla.suse.com/1276262","tags":["report"]},{"url":"https://bugzilla.suse.com/1276287","tags":["report"]},{"url":"https://bugzilla.suse.com/1276295","tags":["report"]},{"url":"https://bugzilla.suse.com/1276337","tags":["report"]},{"url":"https://bugzilla.suse.com/1276338","tags":["report"]},{"url":"https://bugzilla.suse.com/1276340","tags":["report"]},{"url":"https://bugzilla.suse.com/1276345","tags":["report"]},{"url":"https://bugzilla.suse.com/1276347","tags":["report"]},{"url":"https://bugzilla.suse.com/1276349","tags":["report"]},{"url":"https://bugzilla.suse.com/1276352","tags":["report"]},{"url":"https://bugzilla.suse.com/1276353","tags":["report"]},{"url":"https://bugzilla.suse.com/1276388","tags":["report"]},{"url":"https://bugzilla.suse.com/1276460","tags":["report"]},{"url":"https://bugzilla.suse.com/1276461","tags":["report"]},{"url":"https://bugzilla.suse.com/1276462","tags":["report"]},{"url":"https://bugzilla.suse.com/1276474","tags":["report"]},{"url":"https://bugzilla.suse.com/1276475","tags":["report"]},{"url":"https://bugzilla.suse.com/1276504","tags":["report"]},{"url":"https://bugzilla.suse.com/1276508","tags":["report"]},{"url":"https://bugzilla.suse.com/1276519","tags":["report"]},{"url":"https://bugzilla.suse.com/1276532","tags":["report"]},{"url":"https://bugzilla.suse.com/1276535","tags":["report"]},{"url":"https://bugzilla.suse.com/1276538","tags":["report"]},{"url":"https://bugzilla.suse.com/1276563","tags":["report"]},{"url":"https://bugzilla.suse.com/1276565","tags":["report"]},{"url":"https://bugzilla.suse.com/1276570","tags":["report"]},{"url":"https://bugzilla.suse.com/1276573","tags":["report"]},{"url":"https://bugzilla.suse.com/1276579","tags":["report"]},{"url":"https://bugzilla.suse.com/1276783","tags":["report"]},{"url":"https://bugzilla.suse.com/1276852","tags":["report"]},{"url":"https://bugzilla.suse.com/1276921","tags":["report"]},{"url":"https://bugzilla.suse.com/1276923","tags":["report"]},{"url":"https://bugzilla.suse.com/1276927","tags":["report"]},{"url":"https://bugzilla.suse.com/1276930","tags":["report"]},{"url":"https://bugzilla.suse.com/1276947","tags":["report"]},{"url":"https://bugzilla.suse.com/1277030","tags":["report"]},{"url":"https://bugzilla.suse.com/1277032","tags":["report"]},{"url":"https://bugzilla.suse.com/1277036","tags":["report"]},{"url":"https://bugzilla.suse.com/1277098","tags":["report"]},{"url":"https://bugzilla.suse.com/1277101","tags":["report"]},{"url":"https://bugzilla.suse.com/1277109","tags":["report"]},{"url":"https://bugzilla.suse.com/1277122","tags":["report"]},{"url":"https://bugzilla.suse.com/1277128","tags":["report"]},{"url":"https://bugzilla.suse.com/1277129","tags":["report"]},{"url":"https://bugzilla.suse.com/1277143","tags":["report"]},{"url":"https://bugzilla.suse.com/1277149","tags":["report"]},{"url":"https://bugzilla.suse.com/1277153","tags":["report"]},{"url":"https://bugzilla.suse.com/1277215","tags":["report"]},{"url":"https://bugzilla.suse.com/1277217","tags":["report"]},{"url":"https://bugzilla.suse.com/1277218","tags":["report"]},{"url":"https://bugzilla.suse.com/1277234","tags":["report"]},{"url":"https://bugzilla.suse.com/1277245","tags":["report"]},{"url":"https://bugzilla.suse.com/1277272","tags":["report"]},{"url":"https://bugzilla.suse.com/1277277","tags":["report"]},{"url":"https://bugzilla.suse.com/1277296","tags":["report"]},{"url":"https://bugzilla.suse.com/1277314","tags":["report"]},{"url":"https://bugzilla.suse.com/1277342","tags":["report"]},{"url":"https://bugzilla.suse.com/1277371","tags":["report"]},{"url":"https://bugzilla.suse.com/1277372","tags":["report"]},{"url":"https://bugzilla.suse.com/1277374","tags":["report"]},{"url":"https://bugzilla.suse.com/1277379","tags":["report"]},{"url":"https://bugzilla.suse.com/1277382","tags":["report"]},{"url":"https://bugzilla.suse.com/1277392","tags":["report"]},{"url":"https://bugzilla.suse.com/1277396","tags":["report"]},{"url":"https://bugzilla.suse.com/1277401","tags":["report"]},{"url":"https://bugzilla.suse.com/1277405","tags":["report"]},{"url":"https://bugzilla.suse.com/1277410","tags":["report"]},{"url":"https://bugzilla.suse.com/1277452","tags":["report"]},{"url":"https://bugzilla.suse.com/1277489","tags":["report"]},{"url":"https://bugzilla.suse.com/1277493","tags":["report"]},{"url":"https://bugzilla.suse.com/1277555","tags":["report"]},{"url":"https://bugzilla.suse.com/1277556","tags":["report"]},{"url":"https://bugzilla.suse.com/1277557","tags":["report"]},{"url":"https://bugzilla.suse.com/1277558","tags":["report"]},{"url":"https://bugzilla.suse.com/1277568","tags":["report"]},{"url":"https://bugzilla.suse.com/1277615","tags":["report"]},{"url":"https://bugzilla.suse.com/1277625","tags":["report"]},{"url":"https://bugzilla.suse.com/1277626","tags":["report"]},{"url":"https://bugzilla.suse.com/1277640","tags":["report"]},{"url":"https://bugzilla.suse.com/1277662","tags":["report"]},{"url":"https://bugzilla.suse.com/1277674","tags":["report"]},{"url":"https://bugzilla.suse.com/1277705","tags":["report"]},{"url":"https://bugzilla.suse.com/1277766","tags":["report"]},{"url":"https://bugzilla.suse.com/1277781","tags":["report"]},{"url":"https://bugzilla.suse.com/1277784","tags":["report"]},{"url":"https://bugzilla.suse.com/1277792","tags":["report"]},{"url":"https://bugzilla.suse.com/1277801","tags":["report"]},{"url":"https://bugzilla.suse.com/1277805","tags":["report"]},{"url":"https://bugzilla.suse.com/1277820","tags":["report"]},{"url":"https://bugzilla.suse.com/1277823","tags":["report"]},{"url":"https://bugzilla.suse.com/1277824","tags":["report"]},{"url":"https://bugzilla.suse.com/1277840","tags":["report"]},{"url":"https://bugzilla.suse.com/1277843","tags":["report"]},{"url":"https://bugzilla.suse.com/1277844","tags":["report"]},{"url":"https://bugzilla.suse.com/1277857","tags":["report"]},{"url":"https://bugzilla.suse.com/1277864","tags":["report"]},{"url":"https://bugzilla.suse.com/1277885","tags":["report"]},{"url":"https://bugzilla.suse.com/1277892","tags":["report"]},{"url":"https://bugzilla.suse.com/1277895","tags":["report"]},{"url":"https://bugzilla.suse.com/1277896","tags":["report"]},{"url":"https://bugzilla.suse.com/1277897","tags":["report"]},{"url":"https://bugzilla.suse.com/1277900","tags":["report"]},{"url":"https://bugzilla.suse.com/1277904","tags":["report"]},{"url":"https://bugzilla.suse.com/1277906","tags":["report"]},{"url":"https://bugzilla.suse.com/1277910","tags":["report"]},{"url":"https://bugzilla.suse.com/1277913","tags":["report"]},{"url":"https://bugzilla.suse.com/1277915","tags":["report"]},{"url":"https://bugzilla.suse.com/1278031","tags":["report"]},{"url":"https://bugzilla.suse.com/1278035","tags":["report"]},{"url":"https://bugzilla.suse.com/1278053","tags":["report"]},{"url":"https://bugzilla.suse.com/1278054","tags":["report"]},{"url":"https://bugzilla.suse.com/1278056","tags":["report"]},{"url":"https://bugzilla.suse.com/1278063","tags":["report"]},{"url":"https://bugzilla.suse.com/1278067","tags":["report"]},{"url":"https://bugzilla.suse.com/1278087","tags":["report"]},{"url":"https://bugzilla.suse.com/1278091","tags":["report"]},{"url":"https://bugzilla.suse.com/1278100","tags":["report"]},{"url":"https://bugzilla.suse.com/1278191","tags":["report"]},{"url":"https://bugzilla.suse.com/1278195","tags":["report"]},{"url":"https://bugzilla.suse.com/1278199","tags":["report"]},{"url":"https://bugzilla.suse.com/1278205","tags":["report"]},{"url":"https://bugzilla.suse.com/1278215","tags":["report"]},{"url":"https://bugzilla.suse.com/1278216","tags":["report"]},{"url":"https://bugzilla.suse.com/1278225","tags":["report"]},{"url":"https://bugzilla.suse.com/1278245","tags":["report"]},{"url":"https://bugzilla.suse.com/1278247","tags":["report"]},{"url":"https://bugzilla.suse.com/1278255","tags":["report"]},{"url":"https://bugzilla.suse.com/1278311","tags":["report"]},{"url":"https://bugzilla.suse.com/1278314","tags":["report"]},{"url":"https://bugzilla.suse.com/1278315","tags":["report"]},{"url":"https://bugzilla.suse.com/1278363","tags":["report"]},{"url":"https://bugzilla.suse.com/1278708","tags":["report"]},{"url":"https://bugzilla.suse.com/1279116","tags":["report"]},{"url":"https://bugzilla.suse.com/1279497","tags":["report"]},{"url":"https://bugzilla.suse.com/1279525","tags":["report"]},{"url":"https://bugzilla.suse.com/1279527","tags":["report"]},{"url":"https://bugzilla.suse.com/1279532","tags":["report"]},{"url":"https://bugzilla.suse.com/1279535","tags":["report"]},{"url":"https://bugzilla.suse.com/1279536","tags":["report"]},{"url":"https://bugzilla.suse.com/1279569","tags":["report"]},{"url":"https://bugzilla.suse.com/1279581","tags":["report"]},{"url":"https://bugzilla.suse.com/1279590","tags":["report"]},{"url":"https://bugzilla.suse.com/1279621","tags":["report"]},{"url":"https://bugzilla.suse.com/1279702","tags":["report"]},{"url":"https://bugzilla.suse.com/1279786","tags":["report"]},{"url":"https://bugzilla.suse.com/1279799","tags":["report"]},{"url":"https://bugzilla.suse.com/1279819","tags":["report"]},{"url":"https://bugzilla.suse.com/1279835","tags":["report"]},{"url":"https://bugzilla.suse.com/1279850","tags":["report"]},{"url":"https://bugzilla.suse.com/1279875","tags":["report"]},{"url":"https://bugzilla.suse.com/1279878","tags":["report"]},{"url":"https://bugzilla.suse.com/1279888","tags":["report"]},{"url":"https://bugzilla.suse.com/1280143","tags":["report"]},{"url":"https://bugzilla.suse.com/1280146","tags":["report"]},{"url":"https://bugzilla.suse.com/1280148","tags":["report"]},{"url":"https://bugzilla.suse.com/1280151","tags":["report"]},{"url":"https://bugzilla.suse.com/1280163","tags":["report"]},{"url":"https://bugzilla.suse.com/1280166","tags":["report"]},{"url":"https://bugzilla.suse.com/1280171","tags":["report"]},{"url":"https://bugzilla.suse.com/1280178","tags":["report"]},{"url":"https://bugzilla.suse.com/1280179","tags":["report"]},{"url":"https://bugzilla.suse.com/1280184","tags":["report"]},{"url":"https://bugzilla.suse.com/1280193","tags":["report"]},{"url":"https://bugzilla.suse.com/1280206","tags":["report"]},{"url":"https://bugzilla.suse.com/1280235","tags":["report"]},{"url":"https://bugzilla.suse.com/1280237","tags":["report"]},{"url":"https://bugzilla.suse.com/1280243","tags":["report"]},{"url":"https://bugzilla.suse.com/1280251","tags":["report"]},{"url":"https://bugzilla.suse.com/1280252","tags":["report"]},{"url":"https://bugzilla.suse.com/1280263","tags":["report"]},{"url":"https://bugzilla.suse.com/1280296","tags":["report"]},{"url":"https://bugzilla.suse.com/1280298","tags":["report"]},{"url":"https://bugzilla.suse.com/1280299","tags":["report"]},{"url":"https://bugzilla.suse.com/1280303","tags":["report"]},{"url":"https://bugzilla.suse.com/1280309","tags":["report"]},{"url":"https://bugzilla.suse.com/1280333","tags":["report"]},{"url":"https://bugzilla.suse.com/1280334","tags":["report"]},{"url":"https://bugzilla.suse.com/1280335","tags":["report"]},{"url":"https://bugzilla.suse.com/1280336","tags":["report"]},{"url":"https://bugzilla.suse.com/1280338","tags":["report"]},{"url":"https://bugzilla.suse.com/1280350","tags":["report"]},{"url":"https://bugzilla.suse.com/1280375","tags":["report"]},{"url":"https://bugzilla.suse.com/1280379","tags":["report"]},{"url":"https://bugzilla.suse.com/1280383","tags":["report"]},{"url":"https://bugzilla.suse.com/1280384","tags":["report"]},{"url":"https://bugzilla.suse.com/1280387","tags":["report"]},{"url":"https://bugzilla.suse.com/1280388","tags":["report"]},{"url":"https://bugzilla.suse.com/1280449","tags":["report"]},{"url":"https://bugzilla.suse.com/1280451","tags":["report"]},{"url":"https://bugzilla.suse.com/1280455","tags":["report"]},{"url":"https://bugzilla.suse.com/1280456","tags":["report"]},{"url":"https://bugzilla.suse.com/1280464","tags":["report"]},{"url":"https://bugzilla.suse.com/1280468","tags":["report"]},{"url":"https://bugzilla.suse.com/1280477","tags":["report"]},{"url":"https://bugzilla.suse.com/1280487","tags":["report"]},{"url":"https://bugzilla.suse.com/1280488","tags":["report"]},{"url":"https://bugzilla.suse.com/1280490","tags":["report"]},{"url":"https://bugzilla.suse.com/1280494","tags":["report"]},{"url":"https://bugzilla.suse.com/1280508","tags":["report"]},{"url":"https://bugzilla.suse.com/1280509","tags":["report"]},{"url":"https://bugzilla.suse.com/1280518","tags":["report"]},{"url":"https://bugzilla.suse.com/1280525","tags":["report"]},{"url":"https://bugzilla.suse.com/1280544","tags":["report"]},{"url":"https://bugzilla.suse.com/1280546","tags":["report"]},{"url":"https://bugzilla.suse.com/1280548","tags":["report"]},{"url":"https://bugzilla.suse.com/1280551","tags":["report"]},{"url":"https://bugzilla.suse.com/1280576","tags":["report"]},{"url":"https://bugzilla.suse.com/1280577","tags":["report"]},{"url":"https://bugzilla.suse.com/1280711","tags":["report"]},{"url":"https://bugzilla.suse.com/1280716","tags":["report"]},{"url":"https://bugzilla.suse.com/1280717","tags":["report"]},{"url":"https://bugzilla.suse.com/1280719","tags":["report"]},{"url":"https://bugzilla.suse.com/1280720","tags":["report"]},{"url":"https://bugzilla.suse.com/1280726","tags":["report"]},{"url":"https://bugzilla.suse.com/1280727","tags":["report"]},{"url":"https://bugzilla.suse.com/1280733","tags":["report"]},{"url":"https://bugzilla.suse.com/1280758","tags":["report"]},{"url":"https://bugzilla.suse.com/1280761","tags":["report"]},{"url":"https://bugzilla.suse.com/1280766","tags":["report"]},{"url":"https://bugzilla.suse.com/1280786","tags":["report"]},{"url":"https://bugzilla.suse.com/1280797","tags":["report"]},{"url":"https://bugzilla.suse.com/1280870","tags":["report"]},{"url":"https://bugzilla.suse.com/1280872","tags":["report"]},{"url":"https://bugzilla.suse.com/1280901","tags":["report"]},{"url":"https://bugzilla.suse.com/1280920","tags":["report"]},{"url":"https://bugzilla.suse.com/1280923","tags":["report"]},{"url":"https://bugzilla.suse.com/1280969","tags":["report"]},{"url":"https://bugzilla.suse.com/1280985","tags":["report"]},{"url":"https://bugzilla.suse.com/1280993","tags":["report"]},{"url":"https://bugzilla.suse.com/1281010","tags":["report"]},{"url":"https://bugzilla.suse.com/1281014","tags":["report"]},{"url":"https://bugzilla.suse.com/1281025","tags":["report"]},{"url":"https://bugzilla.suse.com/1281054","tags":["report"]},{"url":"https://bugzilla.suse.com/1281057","tags":["report"]},{"url":"https://bugzilla.suse.com/1281077","tags":["report"]},{"url":"https://bugzilla.suse.com/1281085","tags":["report"]},{"url":"https://bugzilla.suse.com/1281136","tags":["report"]},{"url":"https://bugzilla.suse.com/1281201","tags":["report"]},{"url":"https://bugzilla.suse.com/1281202","tags":["report"]},{"url":"https://bugzilla.suse.com/1281224","tags":["report"]},{"url":"https://bugzilla.suse.com/1281226","tags":["report"]},{"url":"https://bugzilla.suse.com/1281228","tags":["report"]},{"url":"https://bugzilla.suse.com/1281229","tags":["report"]},{"url":"https://bugzilla.suse.com/1281231","tags":["report"]},{"url":"https://bugzilla.suse.com/1281273","tags":["report"]},{"url":"https://bugzilla.suse.com/1281295","tags":["report"]},{"url":"https://bugzilla.suse.com/1281379","tags":["report"]},{"url":"https://bugzilla.suse.com/1281387","tags":["report"]},{"url":"https://bugzilla.suse.com/1281399","tags":["report"]},{"url":"https://bugzilla.suse.com/1281408","tags":["report"]},{"url":"https://bugzilla.suse.com/1281496","tags":["report"]},{"url":"https://bugzilla.suse.com/1281514","tags":["report"]},{"url":"https://bugzilla.suse.com/1281525","tags":["report"]},{"url":"https://bugzilla.suse.com/1281546","tags":["report"]},{"url":"https://bugzilla.suse.com/1281597","tags":["report"]},{"url":"https://bugzilla.suse.com/1281599","tags":["report"]},{"url":"https://bugzilla.suse.com/1281644","tags":["report"]},{"url":"https://bugzilla.suse.com/1281645","tags":["report"]},{"url":"https://bugzilla.suse.com/1281660","tags":["report"]},{"url":"https://bugzilla.suse.com/1281680","tags":["report"]},{"url":"https://bugzilla.suse.com/1281682","tags":["report"]},{"url":"https://bugzilla.suse.com/1281683","tags":["report"]},{"url":"https://bugzilla.suse.com/1281717","tags":["report"]},{"url":"https://bugzilla.suse.com/1281732","tags":["report"]},{"url":"https://bugzilla.suse.com/1281738","tags":["report"]},{"url":"https://bugzilla.suse.com/1281754","tags":["report"]},{"url":"https://bugzilla.suse.com/1281777","tags":["report"]},{"url":"https://bugzilla.suse.com/1281778","tags":["report"]},{"url":"https://bugzilla.suse.com/1281786","tags":["report"]},{"url":"https://bugzilla.suse.com/1281789","tags":["report"]},{"url":"https://bugzilla.suse.com/1281795","tags":["report"]},{"url":"https://bugzilla.suse.com/1281808","tags":["report"]},{"url":"https://bugzilla.suse.com/1281825","tags":["report"]},{"url":"https://bugzilla.suse.com/1281845","tags":["report"]},{"url":"https://bugzilla.suse.com/1281922","tags":["report"]},{"url":"https://bugzilla.suse.com/1281955","tags":["report"]},{"url":"https://bugzilla.suse.com/1281956","tags":["report"]},{"url":"https://bugzilla.suse.com/1281964","tags":["report"]},{"url":"https://bugzilla.suse.com/1281973","tags":["report"]},{"url":"https://bugzilla.suse.com/1281991","tags":["report"]},{"url":"https://bugzilla.suse.com/1282003","tags":["report"]},{"url":"https://bugzilla.suse.com/1282013","tags":["report"]},{"url":"https://bugzilla.suse.com/1282020","tags":["report"]},{"url":"https://bugzilla.suse.com/1282050","tags":["report"]},{"url":"https://bugzilla.suse.com/1282054","tags":["report"]},{"url":"https://bugzilla.suse.com/1282072","tags":["report"]},{"url":"https://bugzilla.suse.com/1282104","tags":["report"]},{"url":"https://bugzilla.suse.com/1282110","tags":["report"]},{"url":"https://bugzilla.suse.com/1282113","tags":["report"]},{"url":"https://bugzilla.suse.com/1282143","tags":["report"]},{"url":"https://bugzilla.suse.com/1282147","tags":["report"]},{"url":"https://bugzilla.suse.com/1282197","tags":["report"]},{"url":"https://bugzilla.suse.com/1282270","tags":["report"]},{"url":"https://bugzilla.suse.com/1282271","tags":["report"]},{"url":"https://bugzilla.suse.com/1282288","tags":["report"]},{"url":"https://bugzilla.suse.com/1282648","tags":["report"]},{"url":"https://bugzilla.suse.com/1282672","tags":["report"]},{"url":"https://bugzilla.suse.com/1282747","tags":["report"]},{"url":"https://bugzilla.suse.com/1282774","tags":["report"]},{"url":"https://bugzilla.suse.com/1282803","tags":["report"]},{"url":"https://bugzilla.suse.com/1282808","tags":["report"]},{"url":"https://bugzilla.suse.com/1282812","tags":["report"]},{"url":"https://bugzilla.suse.com/1282823","tags":["report"]},{"url":"https://bugzilla.suse.com/1282881","tags":["report"]},{"url":"https://bugzilla.suse.com/1282891","tags":["report"]},{"url":"https://bugzilla.suse.com/1282906","tags":["report"]},{"url":"https://bugzilla.suse.com/1282975","tags":["report"]},{"url":"https://bugzilla.suse.com/1282997","tags":["report"]},{"url":"https://bugzilla.suse.com/1283119","tags":["report"]},{"url":"https://bugzilla.suse.com/1283130","tags":["report"]},{"url":"https://bugzilla.suse.com/1283149","tags":["report"]},{"url":"https://bugzilla.suse.com/1283154","tags":["report"]},{"url":"https://bugzilla.suse.com/1283163","tags":["report"]},{"url":"https://bugzilla.suse.com/1283166","tags":["report"]},{"url":"https://bugzilla.suse.com/1283173","tags":["report"]},{"url":"https://bugzilla.suse.com/1283176","tags":["report"]},{"url":"https://bugzilla.suse.com/1283201","tags":["report"]},{"url":"https://bugzilla.suse.com/1283203","tags":["report"]},{"url":"https://bugzilla.suse.com/1283205","tags":["report"]},{"url":"https://bugzilla.suse.com/1283213","tags":["report"]},{"url":"https://bugzilla.suse.com/1283230","tags":["report"]},{"url":"https://bugzilla.suse.com/1283296","tags":["report"]},{"url":"https://bugzilla.suse.com/1283312","tags":["report"]},{"url":"https://bugzilla.suse.com/1283328","tags":["report"]},{"url":"https://bugzilla.suse.com/1283450","tags":["report"]},{"url":"https://bugzilla.suse.com/1283475","tags":["report"]},{"url":"https://bugzilla.suse.com/1283479","tags":["report"]},{"url":"https://bugzilla.suse.com/1283489","tags":["report"]},{"url":"https://bugzilla.suse.com/1283490","tags":["report"]},{"url":"https://bugzilla.suse.com/1283517","tags":["report"]},{"url":"https://bugzilla.suse.com/1283739","tags":["report"]},{"url":"https://bugzilla.suse.com/1283794","tags":["report"]},{"url":"https://bugzilla.suse.com/1283795","tags":["report"]},{"url":"https://bugzilla.suse.com/1283805","tags":["report"]},{"url":"https://bugzilla.suse.com/1283880","tags":["report"]},{"url":"https://bugzilla.suse.com/1283906","tags":["report"]},{"url":"https://bugzilla.suse.com/1283945","tags":["report"]},{"url":"https://bugzilla.suse.com/1284146","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23352","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43272","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45836","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46272","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63838","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63881","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63983","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64009","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64070","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64173","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64235","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64299","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64324","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64372","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64414","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64422","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64457","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64474","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64594","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64598","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68266","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68290","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68343","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68367","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68400","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68451","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68477","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72012","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72025","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72070","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72102","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72129","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72130","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72147","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72256","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72299","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72321","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72322","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72352","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72413","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72433","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72444","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72491","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74256","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74258","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74267","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74290","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74365","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74389","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74440","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74450","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74467","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74480","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74483","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74484","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74485","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74490","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74492","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74493","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74515","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74564","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74579","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74588","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74589","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74590","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74592","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74594","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74605","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74609","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74628","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74630","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74631","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74634","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74636","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74638","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74659","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74666","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74671","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74688","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74689","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74692","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74694","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74696","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74697","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74700","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74726","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74735","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80521","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80585","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80631","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80664","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80694","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80747","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80756","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80793","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80836","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80841","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80844","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80880","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80932","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80979","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80983","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81001","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89451","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89453","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89477","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89480","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89482","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89485","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89501","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89503","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89510","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89530","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89531","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89532","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89533","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89534","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89540","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89541","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89544","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89548","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89564","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89644","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89658","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89671","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89672","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89683","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89684","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89685","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89688","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89690","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89691","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89694","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89696","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89697","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89698","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89707","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89747","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89780","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89968","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90065","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90074","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90228","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90240","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90293","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90294","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90307","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90309","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90413","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90414","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90415","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90417","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90428","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90430","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93109","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93110","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93212","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93782","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93810","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93826","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93827","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97413","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97477","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97520","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97521","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97543","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97544","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97546","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97552","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97573","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97574","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97605","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98028","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-98091","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624184-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624197-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624235-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-40136","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-40136","tags":["report"]},{"url":"https://git.kernel.org/linus/9228facb308157ac0bdd264b873187896f7a9c7a","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8029-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8030-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8029-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8048-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8029-3","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-40001","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40002","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40003","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40004","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40029","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40030","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40031","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40032","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40033","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40034","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40035","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40036","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40037","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40038","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40039","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40040","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40042","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40043","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40044","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40045","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40046","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40047","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40048","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40049","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40050","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40051","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40052","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40053","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40054","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40055","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40056","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40057","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40058","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40059","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40060","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40061","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40062","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40063","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40064","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40065","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40066","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40067","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40068","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40069","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40070","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40071","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40072","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40073","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40074","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40075","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40076","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40077","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40078","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40079","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40080","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40081","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40082","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40084","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40085","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40086","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40087","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40088","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40089","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40091","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40092","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40093","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40094","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40095","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40096","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40097","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40098","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40099","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40100","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40101","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40102","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40103","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40104","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40105","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40106","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40110","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40111","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40112","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40113","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40115","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40116","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40117","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40118","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40119","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40120","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40121","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40122","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40123","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40124","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40125","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40126","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40127","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40129","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40130","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40131","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40132","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40133","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40134","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40135","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40137","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40138","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40139","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40140","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40141","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40142","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40143","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40145","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40146","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40147","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40148","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40149","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40150","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40152","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40153","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40154","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40155","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40156","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40158","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40159","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40160","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40161","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40162","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40163","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40164","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40165","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40166","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40167","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40168","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40169","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40170","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40171","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40172","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40173","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40174","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40175","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40176","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40177","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40178","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40179","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40180","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40181","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40182","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40183","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40184","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40185","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40186","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40187","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40188","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40189","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40191","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40192","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40193","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40194","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40195","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40196","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40198","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40199","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40200","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40201","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40203","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40204","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40205","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40206","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40207","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40208","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40209","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40210","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40211","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40212","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40213","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40217","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40218","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40219","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40220","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40221","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40222","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40223","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40224","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40225","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40226","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40227","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40228","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40229","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40230","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40231","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40233","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40234","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40235","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40236","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40237","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40238","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40239","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40240","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40241","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40242","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40243","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40244","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40245","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40256","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40267","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40268","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40269","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40270","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40271","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40272","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40273","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40274","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40275","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40276","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40277","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40278","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40279","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40280","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40281","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40282","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40283","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40284","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40285","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40286","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40287","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40288","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40289","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40291","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40292","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40293","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40294","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40295","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40296","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40297","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40298","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40299","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40301","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40302","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40303","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40304","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40305","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40306","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40307","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40308","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40309","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40310","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40311","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40312","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40313","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40314","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40315","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40316","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40317","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40318","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40319","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40320","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40321","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40322","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40323","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40324","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40326","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40327","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40328","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40329","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40330","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40331","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40332","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40333","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40334","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40335","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40336","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40337","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40338","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40339","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40340","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40341","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40342","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40343","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40344","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40346","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40347","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40349","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40350","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40351","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40352","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40353","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40354","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40355","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40356","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40357","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40358","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40359","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40360","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40362","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40363","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68167","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68168","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68169","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68170","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68171","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68172","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68173","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68174","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68175","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68176","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68177","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68178","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68179","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68180","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68181","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68182","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68183","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68184","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68185","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68186","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68187","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68188","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68189","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68190","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68191","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68192","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68193","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68194","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68196","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68197","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68198","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68199","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68200","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68201","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68202","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68204","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68205","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68206","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68207","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68208","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68209","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68210","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68211","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68239","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68240","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68241","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68242","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68243","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68244","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68245","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68246","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68247","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68248","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68249","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68250","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68251","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68253","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68309","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68310","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68311","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68312","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68313","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68314","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68315","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68316","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68317","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68318","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68319","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68320","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68321","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68322","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68734","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40041","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40151","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-40136","title":"crypto: hisilicon/qm - request reserved interrupt for virtual function","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: hisilicon/qm - request reserved interrupt for virtual function\n\nThe device interrupt vector 3 is an error interrupt for\nphysical function and a reserved interrupt for virtual function.\nHowever, the driver has not registered the reserved interrupt for\nvirtual function. When allocating interrupts, the number of interrupts\nis allocated based on powers of two, which includes this interrupt.\nWhen the system enables GICv4 and the virtual function passthrough\nto the virtual machine, releasing the interrupt in the driver\ntriggers a warning.\n\nThe WARNING report is:\nWARNING: CPU: 62 PID: 14889 at arch/arm64/kvm/vgic/vgic-its.c:852 its_free_ite+0x94/0xb4\n\nTherefore, register a reserved interrupt for VF and set the\nIRQF_NO_AUTOEN flag to avoid that warning.","status":"published","published":"2025-11-12T10:23:23.33Z","modified":"2026-10-30T12:22:51.433Z","updated_at":"2026-11-02T14:32:34.773122Z"}],"euvd":[{"id":"EUVD-2025-124947","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: hisilicon/qm - request reserved interrupt for virtual function\n\nThe device interrupt vector 3 is an error interrupt for\nphysical function and a reserved interrupt for virtual function.\nHowever, the driver has not registered the reserved interrupt for\nvirtual function. When allocating interrupts, the number of interrupts\nis allocated based on powers of two, which includes this interrupt.\nWhen the system enables GICv4 and the virtual function passthrough\nto the virtual machine, releasing the interrupt in the driver\ntriggers a warning.\n\nThe WARNING report is:\nWARNING: CPU: 62 PID: 14889 at arch/arm64/kvm/vgic/vgic-its.c:852 its_free_ite+0x94/0xb4\n\nTherefore, register a reserved interrupt for VF and set the\nIRQF_NO_AUTOEN flag to avoid that warning.","status":"published","published":"2025-11-12T10:23:23Z","modified":"2026-10-30T12:22:51Z","updated_at":"2026-11-02T16:59:11.516867Z"}],"ghsa":[{"id":"GHSA-p5f2-4xpv-wwqj","title":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: hisilicon/qm -...","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: hisilicon/qm - request reserved interrupt for virtual function\n\nThe device interrupt vector 3 is an error interrupt for\nphysical function and a reserved interrupt for virtual function.\nHowever, the driver has not registered the reserved interrupt for\nvirtual function. When allocating interrupts, the number of interrupts\nis allocated based on powers of two, which includes this interrupt.\nWhen the system enables GICv4 and the virtual function passthrough\nto the virtual machine, releasing the interrupt in the driver\ntriggers a warning.\n\nThe WARNING report is:\nWARNING: CPU: 62 PID: 14889 at arch/arm64/kvm/vgic/vgic-its.c:852 its_free_ite+0x94/0xb4\n\nTherefore, register a reserved interrupt for VF and set the\nIRQF_NO_AUTOEN flag to avoid that warning.","status":"published","published":"2025-11-12T12:30:27Z","modified":"2026-10-30T15:32:19Z","updated_at":"2026-11-02T15:14:43.487331Z"}],"nvd":[{"id":"CVE-2025-40136","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: hisilicon/qm - request reserved interrupt for virtual function\n\nThe device interrupt vector 3 is an error interrupt for\nphysical function and a reserved interrupt for virtual function.\nHowever, the driver has not registered the reserved interrupt for\nvirtual function. When allocating interrupts, the number of interrupts\nis allocated based on powers of two, which includes this interrupt.\nWhen the system enables GICv4 and the virtual function passthrough\nto the virtual machine, releasing the interrupt in the driver\ntriggers a warning.\n\nThe WARNING report is:\nWARNING: CPU: 62 PID: 14889 at arch/arm64/kvm/vgic/vgic-its.c:852 its_free_ite+0x94/0xb4\n\nTherefore, register a reserved interrupt for VF and set the\nIRQF_NO_AUTOEN flag to avoid that warning.","status":"published","published":"2025-11-12T11:15:43.327Z","modified":"2026-10-30T13:18:13.7Z","updated_at":"2026-11-02T14:11:43.650381Z"}],"osv":[{"id":"OESA-2026-2417","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\n\nIn the Linux kernel, the following vulnerability has been resolved:mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MMWe currently assume that there is at least one VMA in a MM, which isn ttrue.So we might end up having find_vma() return NULL, to then de-referenceNULL.  So properly handle find_vma() returning NULL.This fixes the report:Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTIKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]CPU: 1 UID: 0 PID: 6021 Comm: syz-executor284 Not tainted 6.12.0-rc7-syzkaller-00187-gf868cd251776 #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024RIP: 0010:migrate_to_node mm/mempolicy.c:1090 [inline]RIP: 0010:do_migrate_pages+0x403/0x6f0 mm/mempolicy.c:1194Code: ...RSP: 0018:ffffc9000375fd08 EFLAGS: 00010246RAX: 0000000000000000 RBX: ffffc9000375fd78 RCX: 0000000000000000RDX: ffff88807e171300 RSI: dffffc0000000000 RDI: ffff88803390c044RBP: ffff88807e171428 R08: 0000000000000014 R09: fffffbfff2039ef1R10: ffffffff901cf78f R11: 0000000000000000 R12: 0000000000000003R13: ffffc9000375fe90 R14: ffffc9000375fe98 R15: ffffc9000375fdf8FS:  00005555919e1380(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033CR2: 00005555919e1ca8 CR3: 000000007f12a000 CR4: 00000000003526f0DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400Call Trace: \u0026lt;TASK\u0026gt; kernel_migrate_pages+0x5b2/0x750 mm/mempolicy.c:1709 __do_sys_migrate_pages mm/mempolicy.c:1727 [inline] __se_sys_migrate_pages mm/mempolicy.c:1723 [inline] __x64_sys_migrate_pages+0x96/0x100 mm/mempolicy.c:1723 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f[akpm@linux-foundation.org: add unlikely()](CVE-2024-56611)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nPCI/MSI: Handle lack of irqdomain gracefully\n\nAlexandre observed a warning emitted from pci_msi_setup_msi_irqs() on a\nRISCV platform which does not provide PCI/MSI support:\n\n WARNING: CPU: 1 PID: 1 at drivers/pci/msi/msi.h:121 pci_msi_setup_msi_irqs+0x2c/0x32\n __pci_enable_msix_range+0x30c/0x596\n pci_msi_setup_msi_irqs+0x2c/0x32\n pci_alloc_irq_vectors_affinity+0xb8/0xe2\n\nRISCV uses hierarchical interrupt domains and correctly does not implement\nthe legacy fallback. The warning triggers from the legacy fallback stub.\n\nThat warning is bogus as the PCI/MSI layer knows whether a PCI/MSI parent\ndomain is associated with the device or not. There is a check for MSI-X,\nwhich has a legacy assumption. But that legacy fallback assumption is only\nvalid when legacy support is enabled, but otherwise the check should simply\nreturn -ENOTSUPP.\n\nLoongarch tripped over the same problem and blindly enabled legacy support\nwithout implementing the legacy fallbacks. There are weak implementations\nwhich return an error, so the problem was papered over.\n\nCorrect pci_msi_domain_supports() to evaluate the legacy mode and add\nthe missing supported check into the MSI enable path to complete it.(CVE-2024-56760)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFS: fix nfs_release_folio() to not deadlock via kcompactd writeback\n\nAdd PF_KCOMPACTD flag and current_is_kcompactd() helper to check for it so\nnfs_release_folio() can skip calling nfs_wb_folio() from kcompactd.\n\nOtherwise NFS can deadlock waiting for kcompactd enduced writeback which\nrecurses back to NFS (which triggers writeback to NFSD via NFS loopback\nmount on the same host, NFSD blocks waiting for XFS\u0026apos;s call to\n__filemap_get_folio):\n\n6070.550357] INFO: task kcompactd0:58 blocked for more than 4435 seconds.\n\n{---\n[58] \u0026quot;kcompactd0\u0026quot;\n[\u0026lt;0\u0026gt;] folio_wait_bit+0xe8/0x200\n[\u0026lt;0\u0026gt;] folio_wait_writeback+0x2b/0x80\n[\u0026lt;0\u0026gt;] nfs_wb_folio+0x80/0x1b0 [nfs]\n[\u0026lt;0\u0026gt;] nfs_release_folio+0x68/0x130 [nfs]\n[\u0026lt;0\u0026gt;] split_huge_page_to_list_to_order+0x362/0x840\n[\u0026lt;0\u0026gt;] migrate_pages_batch+0x43d/0xb90\n[\u0026lt;0\u0026gt;] migrate_pages_sync+0x9a/0x240\n[\u0026lt;0\u0026gt;] migrate_pages+0x93c/0x9f0\n[\u0026lt;0\u0026gt;] compact_zone+0x8e2/0x1030\n[\u0026lt;0\u0026gt;] compact_node+0xdb/0x120\n[\u0026lt;0\u0026gt;] kcompactd+0x121/0x2e0\n[\u0026lt;0\u0026gt;] kthread+0xcf/0x100\n[\u0026lt;0\u0026gt;] ret_from_fork+0x31/0x40\n[\u0026lt;0\u0026gt;] ret_from_fork_asm+0x1a/0x30\n---}\n\n[(CVE-2025-21908)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nhwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio\n\nCommit b15c87263a69 (\u0026quot;hwpoison, memory_hotplug: allow hwpoisoned pages to\nbe offlined) add page poison checks in do_migrate_range in order to make\noffline hwpoisoned page possible by introducing isolate_lru_page and\ntry_to_unmap for hwpoisoned page.  However folio lock must be held before\ncalling try_to_unmap.  Add it to fix this problem.\n\nWarning will be produced if folio is not locked during unmap:\n\n  ------------[ cut here ]------------\n  kernel BUG at ./include/linux/swapops.h:400!\n  Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP\n  Modules linked in:\n  CPU: 4 UID: 0 PID: 411 Comm: bash Tainted: G        W          6.13.0-rc1-00016-g3c434c7ee82a-dirty #41\n  Tainted: [W]=WARN\n  Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0 02/06/2015\n  pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n  pc : try_to_unmap_one+0xb08/0xd3c\n  lr : try_to_unmap_one+0x3dc/0xd3c\n  Call trace:\n   try_to_unmap_one+0xb08/0xd3c (P)\n   try_to_unmap_one+0x3dc/0xd3c (L)\n   rmap_walk_anon+0xdc/0x1f8\n   rmap_walk+0x3c/0x58\n   try_to_unmap+0x88/0x90\n   unmap_poisoned_folio+0x30/0xa8\n   do_migrate_range+0x4a0/0x568\n   offline_pages+0x5a4/0x670\n   memory_block_action+0x17c/0x374\n   memory_subsys_offline+0x3c/0x78\n   device_offline+0xa4/0xd0\n   state_store+0x8c/0xf0\n   dev_attr_store+0x18/0x2c\n   sysfs_kf_write+0x44/0x54\n   kernfs_fop_write_iter+0x118/0x1a8\n   vfs_write+0x3a8/0x4bc\n   ksys_write+0x6c/0xf8\n   __arm64_sys_write+0x1c/0x28\n   invoke_syscall+0x44/0x100\n   el0_svc_common.constprop.0+0x40/0xe0\n   do_el0_svc+0x1c/0x28\n   el0_svc+0x30/0xd0\n   el0t_64_sync_handler+0xc8/0xcc\n   el0t_64_sync+0x198/0x19c\n  Code: f9407be0 b5fff320 d4210000 17ffff97 (d4210000)\n  ---[ end trace 0000000000000000 ]---(CVE-2025-21931)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Bridge, fix the crash caused by LAG state check\n\nWhen removing LAG device from bridge, NETDEV_CHANGEUPPER event is\ntriggered. Driver finds the lower devices (PFs) to flush all the\noffloaded entries. And mlx5_lag_is_shared_fdb is checked, it returns\nfalse if one of PF is unloaded. In such case,\nmlx5_esw_bridge_lag_rep_get() and its caller return NULL, instead of\nthe alive PF, and the flush is skipped.\n\nBesides, the bridge fdb entry\u0026apos;s lastuse is updated in mlx5 bridge\nevent handler. But this SWITCHDEV_FDB_ADD_TO_BRIDGE event can be\nignored in this case because the upper interface for bond is deleted,\nand the entry will never be aged because lastuse is never updated.\n\nTo make things worse, as the entry is alive, mlx5 bridge workqueue\nkeeps sending that event, which is then handled by kernel bridge\nnotifier. It causes the following crash when accessing the passed bond\nnetdev which is already destroyed.\n\nTo fix this issue, remove such checks. LAG state is already checked in\ncommit 15f8f168952f (\u0026quot;net/mlx5: Bridge, verify LAG state when adding\nbond to bridge\u0026quot;), driver still need to skip offload if LAG becomes\ninvalid state after initialization.\n\n Oops: stack segment: 0000 [#1] SMP\n CPU: 3 UID: 0 PID: 23695 Comm: kworker/u40:3 Tainted: G           OE      6.11.0_mlnx #1\n Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n Workqueue: mlx5_bridge_wq mlx5_esw_bridge_update_work [mlx5_core]\n RIP: 0010:br_switchdev_event+0x2c/0x110 [bridge]\n Code: 44 00 00 48 8b 02 48 f7 00 00 02 00 00 74 69 41 54 55 53 48 83 ec 08 48 8b a8 08 01 00 00 48 85 ed 74 4a 48 83 fe 02 48 89 d3 \u0026lt;4c\u0026gt; 8b 65 00 74 23 76 49 48 83 fe 05 74 7e 48 83 fe 06 75 2f 0f b7\n RSP: 0018:ffffc900092cfda0 EFLAGS: 00010297\n RAX: ffff888123bfe000 RBX: ffffc900092cfe08 RCX: 00000000ffffffff\n RDX: ffffc900092cfe08 RSI: 0000000000000001 RDI: ffffffffa0c585f0\n RBP: 6669746f6e690a30 R08: 0000000000000000 R09: ffff888123ae92c8\n R10: 0000000000000000 R11: fefefefefefefeff R12: ffff888123ae9c60\n R13: 0000000000000001 R14: ffffc900092cfe08 R15: 0000000000000000\n FS:  0000000000000000(0000) GS:ffff88852c980000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007f15914c8734 CR3: 0000000002830005 CR4: 0000000000770ef0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n PKRU: 55555554\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  ? __die_body+0x1a/0x60\n  ? die+0x38/0x60\n  ? do_trap+0x10b/0x120\n  ? do_error_trap+0x64/0xa0\n  ? exc_stack_segment+0x33/0x50\n  ? asm_exc_stack_segment+0x22/0x30\n  ? br_switchdev_event+0x2c/0x110 [bridge]\n  ? sched_balance_newidle.isra.149+0x248/0x390\n  notifier_call_chain+0x4b/0xa0\n  atomic_notifier_call_chain+0x16/0x20\n  mlx5_esw_bridge_update+0xec/0x170 [mlx5_core]\n  mlx5_esw_bridge_update_work+0x19/0x40 [mlx5_core]\n  process_scheduled_works+0x81/0x390\n  worker_thread+0x106/0x250\n  ? bh_worker+0x110/0x110\n  kthread+0xb7/0xe0\n  ? kthread_park+0x80/0x80\n  ret_from_fork+0x2d/0x50\n  ? kthread_park+0x80/0x80\n  ret_from_fork_asm+0x11/0x20\n  \u0026lt;/TASK\u0026gt;(CVE-2025-21970)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: Prevent creation of classes with TC_H_ROOT\n\nThe function qdisc_tree_reduce_backlog() uses TC_H_ROOT as a termination\ncondition when traversing up the qdisc tree to update parent backlog\ncounters. However, if a class is created with classid TC_H_ROOT, the\ntraversal terminates prematurely at this class instead of reaching the\nactual root qdisc, causing parent statistics to be incorrectly maintained.\nIn case of DRR, this could lead to a crash as reported by Mingi Cho.\n\nPrevent the creation of any Qdisc class with classid TC_H_ROOT\n(0xFFFFFFFF) across all qdisc types, as suggested by Jamal.(CVE-2025-21971)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsched: address a potential NULL pointer dereference in the GRED scheduler.\n\nIf kzalloc in gred_init returns a NULL pointer, the code follows the\nerror handling path, invoking gred_destroy. This, in turn, calls\ngred_offload, where memset could receive a NULL pointer as input,\npotentially leading to a kernel crash.\n\nWhen table-\u0026gt;opt is NULL in gred_init(), gred_change_table_def()\nis not called yet, so it is not necessary to call -\u0026gt;ndo_setup_tc()\nin gred_offload().(CVE-2025-21980)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nice: fix memory leak in aRFS after reset\n\nFix aRFS (accelerated Receive Flow Steering) structures memory leak by\nadding a checker to verify if aRFS memory is already allocated while\nconfiguring VSI. aRFS objects are allocated in two cases:\n- as part of VSI initialization (at probe), and\n- as part of reset handling\n\nHowever, VSI reconfiguration executed during reset involves memory\nallocation one more time, without prior releasing already allocated\nresources. This led to the memory leak with the following signature:\n\n[root@os-delivery ~]# cat /sys/kernel/debug/kmemleak\nunreferenced object 0xff3c1ca7252e6000 (size 8192):\n  comm \u0026quot;kworker/0:0\u0026quot;, pid 8, jiffies 4296833052\n  hex dump (first 32 bytes):\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace (crc 0):\n    [\u0026lt;ffffffff991ec485\u0026gt;] __kmalloc_cache_noprof+0x275/0x340\n    [\u0026lt;ffffffffc0a6e06a\u0026gt;] ice_init_arfs+0x3a/0xe0 [ice]\n    [\u0026lt;ffffffffc09f1027\u0026gt;] ice_vsi_cfg_def+0x607/0x850 [ice]\n    [\u0026lt;ffffffffc09f244b\u0026gt;] ice_vsi_setup+0x5b/0x130 [ice]\n    [\u0026lt;ffffffffc09c2131\u0026gt;] ice_init+0x1c1/0x460 [ice]\n    [\u0026lt;ffffffffc09c64af\u0026gt;] ice_probe+0x2af/0x520 [ice]\n    [\u0026lt;ffffffff994fbcd3\u0026gt;] local_pci_probe+0x43/0xa0\n    [\u0026lt;ffffffff98f07103\u0026gt;] work_for_cpu_fn+0x13/0x20\n    [\u0026lt;ffffffff98f0b6d9\u0026gt;] process_one_work+0x179/0x390\n    [\u0026lt;ffffffff98f0c1e9\u0026gt;] worker_thread+0x239/0x340\n    [\u0026lt;ffffffff98f14abc\u0026gt;] kthread+0xcc/0x100\n    [\u0026lt;ffffffff98e45a6d\u0026gt;] ret_from_fork+0x2d/0x50\n    [\u0026lt;ffffffff98e083ba\u0026gt;] ret_from_fork_asm+0x1a/0x30\n    ...(CVE-2025-21981)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: switchdev: Convert blocking notification chain to a raw one\n\nA blocking notification chain uses a read-write semaphore to protect the\nintegrity of the chain. The semaphore is acquired for writing when\nadding / removing notifiers to / from the chain and acquired for reading\nwhen traversing the chain and informing notifiers about an event.\n\nIn case of the blocking switchdev notification chain, recursive\nnotifications are possible which leads to the semaphore being acquired\ntwice for reading and to lockdep warnings being generated [1].\n\nSpecifically, this can happen when the bridge driver processes a\nSWITCHDEV_BRPORT_UNOFFLOADED event which causes it to emit notifications\nabout deferred events when calling switchdev_deferred_process().\n\nFix this by converting the notification chain to a raw notification\nchain in a similar fashion to the netdev notification chain. Protect\nthe chain using the RTNL mutex by acquiring it when modifying the chain.\nEvents are always informed under the RTNL mutex, but add an assertion in\ncall_switchdev_blocking_notifiers() to make sure this is not violated in\nthe future.\n\nMaintain the \u0026quot;blocking\u0026quot; prefix as events are always emitted from process\ncontext and listeners are allowed to block.\n\n[1]:\nWARNING: possible recursive locking detected\n6.14.0-rc4-custom-g079270089484 #1 Not tainted\n--------------------------------------------\nip/52731 is trying to acquire lock:\nffffffff850918d8 ((switchdev_blocking_notif_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x58/0xa0\n\nbut task is already holding lock:\nffffffff850918d8 ((switchdev_blocking_notif_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x58/0xa0\n\nother info that might help us debug this:\nPossible unsafe locking scenario:\nCPU0\n----\nlock((switchdev_blocking_notif_chain).rwsem);\nlock((switchdev_blocking_notif_chain).rwsem);\n\n*** DEADLOCK ***\nMay be due to missing lock nesting notation\n3 locks held by ip/52731:\n #0: ffffffff84f795b0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x727/0x1dc0\n #1: ffffffff8731f628 (\u0026amp;net-\u0026gt;rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x790/0x1dc0\n #2: ffffffff850918d8 ((switchdev_blocking_notif_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x58/0xa0\n\nstack backtrace:\n...\n? __pfx_down_read+0x10/0x10\n? __pfx_mark_lock+0x10/0x10\n? __pfx_switchdev_port_attr_set_deferred+0x10/0x10\nblocking_notifier_call_chain+0x58/0xa0\nswitchdev_port_attr_notify.constprop.0+0xb3/0x1b0\n? __pfx_switchdev_port_attr_notify.constprop.0+0x10/0x10\n? mark_held_locks+0x94/0xe0\n? switchdev_deferred_process+0x11a/0x340\nswitchdev_port_attr_set_deferred+0x27/0xd0\nswitchdev_deferred_process+0x164/0x340\nbr_switchdev_port_unoffload+0xc8/0x100 [bridge]\nbr_switchdev_blocking_event+0x29f/0x580 [bridge]\nnotifier_call_chain+0xa2/0x440\nblocking_notifier_call_chain+0x6e/0xa0\nswitchdev_bridge_port_unoffload+0xde/0x1a0\n...(CVE-2025-21986)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/sched: Fix fence reference count leak\n\nThe last_scheduled fence leaks when an entity is being killed and adding\nthe cleanup callback fails.\n\nDecrement the reference count of prev when dma_fence_add_callback()\nfails, ensuring proper balance.\n\n[phasta: add git tag info for stable kernel](CVE-2025-21995)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\naccel/qaic: Fix integer overflow in qaic_validate_req()\n\nThese are u64 variables that come from the user via\nqaic_attach_slice_bo_ioctl().  Use check_add_overflow() to ensure that\nthe math doesn\u0026apos;t have an integer wrapping bug.(CVE-2025-22001)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nregulator: dummy: force synchronous probing\n\nSometimes I get a NULL pointer dereference at boot time in kobject_get()\nwith the following call stack:\n\nanatop_regulator_probe()\n devm_regulator_register()\n  regulator_register()\n   regulator_resolve_supply()\n    kobject_get()\n\nBy placing some extra BUG_ON() statements I could verify that this is\nraised because probing of the \u0026apos;dummy\u0026apos; regulator driver is not completed\n(\u0026apos;dummy_regulator_rdev\u0026apos; is still NULL).\n\nIn the JTAG debugger I can see that dummy_regulator_probe() and\nanatop_regulator_probe() can be run by different kernel threads\n(kworker/u4:*).  I haven\u0026apos;t further investigated whether this can be\nchanged or if there are other possibilities to force synchronization\nbetween these two probe routines.  On the other hand I don\u0026apos;t expect much\nboot time penalty by probing the \u0026apos;dummy\u0026apos; regulator synchronously.(CVE-2025-22009)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nspufs: fix a leak in spufs_create_context()\n\nLeak fixes back in 2008 missed one case - if we are trying to set affinity\nand spufs_mkdir() fails, we need to drop the reference to neighbor.(CVE-2025-22071)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nRevert \u0026quot;smb: client: fix TCP timers deadlock after rmmod\u0026quot;\n\nThis reverts commit e9f2517a3e18a54a3943c098d2226b245d488801.\n\nCommit e9f2517a3e18 (\u0026quot;smb: client: fix TCP timers deadlock after\nrmmod\u0026quot;) is intended to fix a null-ptr-deref in LOCKDEP, which is\nmentioned as CVE-2024-54680, but is actually did not fix anything;\nThe issue can be reproduced on top of it. [0]\n\nAlso, it reverted the change by commit ef7134c7fc48 (\u0026quot;smb: client:\nFix use-after-free of network namespace.\u0026quot;) and introduced a real\nissue by reviving the kernel TCP socket.\n\nWhen a reconnect happens for a CIFS connection, the socket state\ntransitions to FIN_WAIT_1.  Then, inet_csk_clear_xmit_timers_sync()\nin tcp_close() stops all timers for the socket.\n\nIf an incoming FIN packet is lost, the socket will stay at FIN_WAIT_1\nforever, and such sockets could be leaked up to net.ipv4.tcp_max_orphans.\n\nUsually, FIN can be retransmitted by the peer, but if the peer aborts\nthe connection, the issue comes into reality.\n\nI warned about this privately by pointing out the exact report [1],\nbut the bogus fix was finally merged.\n\nSo, we should not stop the timers to finally kill the connection on\nour side in that case, meaning we must not use a kernel socket for\nTCP whose sk-\u0026gt;sk_net_refcnt is 0.\n\nThe kernel socket does not have a reference to its netns to make it\npossible to tear down netns without cleaning up every resource in it.\n\nFor example, tunnel devices use a UDP socket internally, but we can\ndestroy netns without removing such devices and let it complete\nduring exit.  Otherwise, netns would be leaked when the last application\ndied.\n\nHowever, this is problematic for TCP sockets because TCP has timers to\nclose the connection gracefully even after the socket is close()d.  The\nlifetime of the socket and its netns is different from the lifetime of\nthe underlying connection.\n\nIf the socket user does not maintain the netns lifetime, the timer could\nbe fired after the socket is close()d and its netns is freed up, resulting\nin use-after-free.\n\nActually, we have seen so many similar issues and converted such sockets\nto have a reference to netns.\n\nThat\u0026apos;s why I converted the CIFS client socket to have a reference to\nnetns (sk-\u0026gt;sk_net_refcnt == 1), which is somehow mentioned as out-of-scope\nof CIFS and technically wrong in e9f2517a3e18, but **is in-scope and right\nfix**.\n\nRegarding the LOCKDEP issue, we can prevent the module unload by\nbumping the module refcount when switching the LOCKDDEP key in\nsock_lock_init_class_and_name(). [2]\n\nFor a while, let\u0026apos;s revert the bogus fix.\n\nNote that now we can use sk_net_refcnt_upgrade() for the socket\nconversion, but I\u0026apos;ll do so later separately to make backport easy.(CVE-2025-22077)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwatch_queue: fix pipe accounting mismatch\n\nCurrently, watch_queue_set_size() modifies the pipe buffers charged to\nuser-\u0026gt;pipe_bufs without updating the pipe-\u0026gt;nr_accounted on the pipe\nitself, due to the if (!pipe_has_watch_queue()) test in\npipe_resize_ring(). This means that when the pipe is ultimately freed,\nwe decrement user-\u0026gt;pipe_bufs by something other than what than we had\ncharged to it, potentially leading to an underflow. This in turn can\ncause subsequent too_many_pipe_buffers_soft() tests to fail with -EPERM.\n\nTo remedy this, explicitly account for the pipe usage in\nwatch_queue_set_size() to match the number set via account_pipe_buffers()\n\n(It\u0026apos;s unclear why watch_queue_set_size() does not update nr_accounted;\nit may be due to intentional overprovisioning in watch_queue_set_size()?)(CVE-2025-23138)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmedia: venus: hfi_parser: add check to avoid out of bound access\n\nThere is a possibility that init_codecs is invoked multiple times during\nmanipulated payload from video firmware. In such case, if codecs_count\ncan get incremented to value more than MAX_CODEC_NUM, there can be OOB\naccess. Reset the count so that it always starts from beginning.(CVE-2025-23157)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\njfs: add sanity check for agwidth in dbMount\n\nThe width in dmapctl of the AG is zero, it trigger a divide error when\ncalculating the control page level in dbAllocAG.\n\nTo avoid this issue, add a check for agwidth in dbAllocAG.(CVE-2025-37740)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group\n\nCurrently, mtk_iommu calls during probe iommu_device_register before\nthe hw_list from driver data is initialized. Since iommu probing issue\nfix, it leads to NULL pointer dereference in mtk_iommu_device_group when\nhw_list is accessed with list_first_entry (not null safe).\n\nSo, change the call order to ensure iommu_device_register is called\nafter the driver data are initialized.(CVE-2025-37748)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: Prevent division by zero\n\nThe user can set any speed value.\nIf speed is greater than UINT_MAX/8, division by zero is possible.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2025-37766)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: Prevent division by zero\n\nThe user can set any speed value.\nIf speed is greater than UINT_MAX/8, division by zero is possible.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2025-37768)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: Prevent division by zero\n\nThe user can set any speed value.\nIf speed is greater than UINT_MAX/8, division by zero is possible.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2025-37770)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: Prevent division by zero\n\nThe user can set any speed value.\nIf speed is greater than UINT_MAX/8, division by zero is possible.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2025-37771)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: Fix dangling pointer in krb_authenticate\n\nkrb_authenticate frees sess-\u0026gt;user and does not set the pointer\nto NULL. It calls ksmbd_krb5_authenticate to reinitialise\nsess-\u0026gt;user but that function may return without doing so. If\nthat happens then smb2_sess_setup, which calls krb_authenticate,\nwill be accessing free\u0026apos;d memory when it later uses sess-\u0026gt;user.(CVE-2025-37778)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nASoC: Intel: avs: Fix null-ptr-deref in avs_component_probe()\n\ndevm_kasprintf() returns NULL when memory allocation fails. Currently,\navs_component_probe() does not check for this case, which results in a\nNULL pointer dereference.(CVE-2025-37793)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsound/virtio: Fix cancel_sync warnings on uninitialized work_structs\n\nBetty reported hitting the following warning:\n\n[    8.709131][  T221] WARNING: CPU: 2 PID: 221 at kernel/workqueue.c:4182\n...\n[    8.713282][  T221] Call trace:\n[    8.713365][  T221]  __flush_work+0x8d0/0x914\n[    8.713468][  T221]  __cancel_work_sync+0xac/0xfc\n[    8.713570][  T221]  cancel_work_sync+0x24/0x34\n[    8.713667][  T221]  virtsnd_remove+0xa8/0xf8 [virtio_snd ab15f34d0dd772f6d11327e08a81d46dc9c36276]\n[    8.713868][  T221]  virtsnd_probe+0x48c/0x664 [virtio_snd ab15f34d0dd772f6d11327e08a81d46dc9c36276]\n[    8.714035][  T221]  virtio_dev_probe+0x28c/0x390\n[    8.714139][  T221]  really_probe+0x1bc/0x4c8\n...\n\nIt seems we\u0026apos;re hitting the error path in virtsnd_probe(), which\ntriggers a virtsnd_remove() which iterates over the substreams\ncalling cancel_work_sync() on the elapsed_period work_struct.\n\nLooking at the code, from earlier in:\nvirtsnd_probe()-\u0026gt;virtsnd_build_devs()-\u0026gt;virtsnd_pcm_parse_cfg()\n\nWe set snd-\u0026gt;nsubstreams, allocate the snd-\u0026gt;substreams, and if\nwe then hit an error on the info allocation or something in\nvirtsnd_ctl_query_info() fails, we will exit without having\ninitialized the elapsed_period work_struct.\n\nWhen that error path unwinds we then call virtsnd_remove()\nwhich as long as the substreams array is allocated, will iterate\nthrough calling cancel_work_sync() on the uninitialized work\nstruct hitting this warning.\n\nTakashi Iwai suggested this fix, which initializes the substreams\nstructure right after allocation, so that if we hit the error\npaths we avoid trying to cleanup uninitialized data.\n\nNote: I have not yet managed to reproduce the issue myself, so\nthis patch has had limited testing.\n\nFeedback or thoughts would be appreciated!(CVE-2025-37805)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmisc: microchip: pci1xxxx: Fix Kernel panic during IRQ handler registration\n\nResolve kernel panic while accessing IRQ handler associated with the\ngenerated IRQ. This is done by acquiring the spinlock and storing the\ncurrent interrupt state before handling the interrupt request using\ngeneric_handle_irq.\n\nA previous fix patch was submitted where \u0026apos;generic_handle_irq\u0026apos; was\nreplaced with \u0026apos;handle_nested_irq\u0026apos;. However, this change also causes\nthe kernel panic where after determining which GPIO triggered the\ninterrupt and attempting to call handle_nested_irq with the mapped\nIRQ number, leads to a failure in locating the registered handler.(CVE-2025-37815)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate()\n\ncpufreq_cpu_get_raw() can return NULL when the target CPU is not present\nin the policy-\u0026gt;cpus mask. apple_soc_cpufreq_get_rate() does not check\nfor this case, which results in a NULL pointer dereference.(CVE-2025-37831)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncifs: avoid NULL pointer dereference in dbg call\n\ncifs_server_dbg() implies server to be non-NULL so\nmove call under condition to avoid NULL pointer dereference.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2025-37844)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: debugfs hang_hws skip GPU with MES\n\ndebugfs hang_hws is used by GPU reset test with HWS, for MES this crash\nthe kernel with NULL pointer access because dqm-\u0026gt;packet_mgr is not setup\nfor MES path.\n\nSkip GPU with MES for now, MES hang_hws debugfs interface will be\nsupported later.(CVE-2025-37853)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev()\n\nThe variable d-\u0026gt;name, returned by devm_kasprintf(), could be NULL.\nA pointer check is added to prevent potential NULL pointer dereference.\nThis is similar to the fix in commit 3027e7b15b02\n(\u0026quot;ice: Fix some null pointer dereference issues in ice_ptp.c\u0026quot;).\n\nThis issue is found by our static analysis tool(CVE-2025-37881)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nASoC: ops: Consistently treat platform_max as control value\n\nThis reverts commit 9bdd10d57a88 (\u0026quot;ASoC: ops: Shift tested values in\nsnd_soc_put_volsw() by +min\u0026quot;), and makes some additional related\nupdates.\n\nThere are two ways the platform_max could be interpreted; the maximum\nregister value, or the maximum value the control can be set to. The\npatch moved from treating the value as a control value to a register\none. When the patch was applied it was technically correct as\nsnd_soc_limit_volume() also used the register interpretation. However,\neven then most of the other usages treated platform_max as a\ncontrol value, and snd_soc_limit_volume() has since been updated to\nalso do so in commit fb9ad24485087 (\u0026quot;ASoC: ops: add correct range\ncheck for limiting volume\u0026quot;). That patch however, missed updating\nsnd_soc_put_volsw() back to the control interpretation, and fixing\nsnd_soc_info_volsw_range(). The control interpretation makes more\nsense as limiting is typically done from the machine driver, so it is\nappropriate to use the customer facing representation rather than the\ninternal codec representation. Update all the code to consistently use\nthis interpretation of platform_max.\n\nFinally, also add some comments to the soc_mixer_control struct to\nhopefully avoid further patches switching between the two approaches.(CVE-2025-37889)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scmi: Balance device refcount when destroying devices\n\nUsing device_find_child() to lookup the proper SCMI device to destroy\ncauses an unbalance in device refcount, since device_find_child() calls an\nimplicit get_device(): this, in turns, inhibits the call of the provided\nrelease methods upon devices destruction.\n\nAs a consequence, one of the structures that is not freed properly upon\ndestruction is the internal struct device_private dev-\u0026gt;p populated by the\ndrivers subsystem core.\n\nKMemleak detects this situation since loading/unloding some SCMI driver\ncauses related devices to be created/destroyed without calling any\ndevice_release method.\n\nunreferenced object 0xffff00000f583800 (size 512):\n  comm \u0026quot;insmod\u0026quot;, pid 227, jiffies 4294912190\n  hex dump (first 32 bytes):\n    00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00  .....N..........\n    ff ff ff ff ff ff ff ff 60 36 1d 8a 00 80 ff ff  ........`6......\n  backtrace (crc 114e2eed):\n    kmemleak_alloc+0xbc/0xd8\n    __kmalloc_cache_noprof+0x2dc/0x398\n    device_add+0x954/0x12d0\n    device_register+0x28/0x40\n    __scmi_device_create.part.0+0x1bc/0x380\n    scmi_device_create+0x2d0/0x390\n    scmi_create_protocol_devices+0x74/0xf8\n    scmi_device_request_notifier+0x1f8/0x2a8\n    notifier_call_chain+0x110/0x3b0\n    blocking_notifier_call_chain+0x70/0xb0\n    scmi_driver_register+0x350/0x7f0\n    0xffff80000a3b3038\n    do_one_initcall+0x12c/0x730\n    do_init_module+0x1dc/0x640\n    load_module+0x4b20/0x5b70\n    init_module_from_file+0xec/0x158\n\n$ ./scripts/faddr2line ./vmlinux device_add+0x954/0x12d0\ndevice_add+0x954/0x12d0:\nkmalloc_noprof at include/linux/slab.h:901\n(inlined by) kzalloc_noprof at include/linux/slab.h:1037\n(inlined by) device_private_init at drivers/base/core.c:3510\n(inlined by) device_add at drivers/base/core.c:3561\n\nBalance device refcount by issuing a put_device() on devices found via\ndevice_find_child().(CVE-2025-37905)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btusb: avoid NULL pointer dereference in skb_dequeue()\n\nA NULL pointer dereference can occur in skb_dequeue() when processing a\nQCA firmware crash dump on WCN7851 (0489:e0f3).\n\n[ 93.672166] Bluetooth: hci0: ACL memdump size(589824)\n\n[ 93.672475] BUG: kernel NULL pointer dereference, address: 0000000000000008\n[ 93.672517] Workqueue: hci0 hci_devcd_rx [bluetooth]\n[ 93.672598] RIP: 0010:skb_dequeue+0x50/0x80\n\nThe issue stems from handle_dump_pkt_qca() returning 0 even when a dump\npacket is successfully processed. This is because it incorrectly\nforwards the return value of hci_devcd_init() (which returns 0 on\nsuccess). As a result, the caller (btusb_recv_acl_qca() or\nbtusb_recv_evt_qca()) assumes the packet was not handled and passes it\nto hci_recv_frame(), leading to premature kfree() of the skb.\n\nLater, hci_devcd_rx() attempts to dequeue the same skb from the dump\nqueue, resulting in a NULL pointer dereference.\n\nFix this by:\n1. Making handle_dump_pkt_qca() return 0 on success and negative errno\n   on failure, consistent with kernel conventions.\n2. Splitting dump packet detection into separate functions for ACL\n   and event packets for better structure and readability.\n\nThis ensures dump packets are properly identified and consumed, avoiding\ndouble handling and preventing NULL pointer access.(CVE-2025-37918)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: prevent out-of-bounds stream writes by validating *pos\n\nksmbd_vfs_stream_write() did not validate whether the write offset\n(*pos) was within the bounds of the existing stream data length (v_len).\nIf *pos was greater than or equal to v_len, this could lead to an\nout-of-bounds memory write.\n\nThis patch adds a check to ensure *pos is less than v_len before\nproceeding. If the condition fails, -EINVAL is returned.(CVE-2025-37947)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: displayport: Fix deadlock\n\nThis patch introduces the ucsi_con_mutex_lock / ucsi_con_mutex_unlock\nfunctions to the UCSI driver. ucsi_con_mutex_lock ensures the connector\nmutex is only locked if a connection is established and the partner pointer\nis valid. This resolves a deadlock scenario where\nucsi_displayport_remove_partner holds con-\u0026gt;mutex waiting for\ndp_altmode_work to complete while dp_altmode_work attempts to acquire it.(CVE-2025-37967)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: Refactor remove call with idxd_cleanup() helper\n\nThe idxd_cleanup() helper cleans up perfmon, interrupts, internals and\nso on. Refactor remove call with the idxd_cleanup() helper to avoid code\nduplication. Note, this also fixes the missing put_device() for idxd\ngroups, enginces and wqs.(CVE-2025-38014)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: Annotate FDB data races\n\nThe \u0026apos;used\u0026apos; and \u0026apos;updated\u0026apos; fields in the FDB entry structure can be\naccessed concurrently by multiple threads, leading to reports such as\n[1]. Can be reproduced using [2].\n\nSuppress these reports by annotating these accesses using\nREAD_ONCE() / WRITE_ONCE().\n\n[1]\nBUG: KCSAN: data-race in vxlan_xmit / vxlan_xmit\n\nwrite to 0xffff942604d263a8 of 8 bytes by task 286 on cpu 0:\n vxlan_xmit+0xb29/0x2380\n dev_hard_start_xmit+0x84/0x2f0\n __dev_queue_xmit+0x45a/0x1650\n packet_xmit+0x100/0x150\n packet_sendmsg+0x2114/0x2ac0\n __sys_sendto+0x318/0x330\n __x64_sys_sendto+0x76/0x90\n x64_sys_call+0x14e8/0x1c00\n do_syscall_64+0x9e/0x1a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nread to 0xffff942604d263a8 of 8 bytes by task 287 on cpu 2:\n vxlan_xmit+0xadf/0x2380\n dev_hard_start_xmit+0x84/0x2f0\n __dev_queue_xmit+0x45a/0x1650\n packet_xmit+0x100/0x150\n packet_sendmsg+0x2114/0x2ac0\n __sys_sendto+0x318/0x330\n __x64_sys_sendto+0x76/0x90\n x64_sys_call+0x14e8/0x1c00\n do_syscall_64+0x9e/0x1a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nvalue changed: 0x00000000fffbac6e -\u0026gt; 0x00000000fffbac6f\n\nReported by Kernel Concurrency Sanitizer on:\nCPU: 2 UID: 0 PID: 287 Comm: mausezahn Not tainted 6.13.0-rc7-01544-gb4b270f11a02 #5\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014\n\n[2]\n #!/bin/bash\n\n set +H\n echo whitelist \u0026gt; /sys/kernel/debug/kcsan\n echo !vxlan_xmit \u0026gt; /sys/kernel/debug/kcsan\n\n ip link add name vx0 up type vxlan id 10010 dstport 4789 local 192.0.2.1\n bridge fdb add 00:11:22:33:44:55 dev vx0 self static dst 198.51.100.1\n taskset -c 0 mausezahn vx0 -a own -b 00:11:22:33:44:55 -c 0 -q \u0026amp;\n taskset -c 2 mausezahn vx0 -a own -b 00:11:22:33:44:55 -c 0 -q \u0026amp;(CVE-2025-38037)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_ffa: Set dma_mask for ffa devices\n\nSet dma_mask for FFA devices, otherwise DMA allocation using the device pointer\nlead to following warning:\n\nWARNING: CPU: 1 PID: 1 at kernel/dma/mapping.c:597 dma_alloc_attrs+0xe0/0x124(CVE-2025-38043)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: Fix use-after-free in cifs_fill_dirent\n\nThere is a race condition in the readdir concurrency process, which may\naccess the rsp buffer after it has been released, triggering the\nfollowing KASAN warning.\n\n ==================================================================\n BUG: KASAN: slab-use-after-free in cifs_fill_dirent+0xb03/0xb60 [cifs]\n Read of size 4 at addr ffff8880099b819c by task a.out/342975\n\n CPU: 2 UID: 0 PID: 342975 Comm: a.out Not tainted 6.15.0-rc6+ #240 PREEMPT(full)\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  dump_stack_lvl+0x53/0x70\n  print_report+0xce/0x640\n  kasan_report+0xb8/0xf0\n  cifs_fill_dirent+0xb03/0xb60 [cifs]\n  cifs_readdir+0x12cb/0x3190 [cifs]\n  iterate_dir+0x1a1/0x520\n  __x64_sys_getdents+0x134/0x220\n  do_syscall_64+0x4b/0x110\n  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n RIP: 0033:0x7f996f64b9f9\n Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89\n f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01\n f0 ff ff  0d f7 c3 0c 00 f7 d8 64 89 8\n RSP: 002b:00007f996f53de78 EFLAGS: 00000207 ORIG_RAX: 000000000000004e\n RAX: ffffffffffffffda RBX: 00007f996f53ecdc RCX: 00007f996f64b9f9\n RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003\n RBP: 00007f996f53dea0 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000207 R12: ffffffffffffff88\n R13: 0000000000000000 R14: 00007ffc8cd9a500 R15: 00007f996f51e000\n  \u0026lt;/TASK\u0026gt;\n\n Allocated by task 408:\n  kasan_save_stack+0x20/0x40\n  kasan_save_track+0x14/0x30\n  __kasan_slab_alloc+0x6e/0x70\n  kmem_cache_alloc_noprof+0x117/0x3d0\n  mempool_alloc_noprof+0xf2/0x2c0\n  cifs_buf_get+0x36/0x80 [cifs]\n  allocate_buffers+0x1d2/0x330 [cifs]\n  cifs_demultiplex_thread+0x22b/0x2690 [cifs]\n  kthread+0x394/0x720\n  ret_from_fork+0x34/0x70\n  ret_from_fork_asm+0x1a/0x30\n\n Freed by task 342979:\n  kasan_save_stack+0x20/0x40\n  kasan_save_track+0x14/0x30\n  kasan_save_free_info+0x3b/0x60\n  __kasan_slab_free+0x37/0x50\n  kmem_cache_free+0x2b8/0x500\n  cifs_buf_release+0x3c/0x70 [cifs]\n  cifs_readdir+0x1c97/0x3190 [cifs]\n  iterate_dir+0x1a1/0x520\n  __x64_sys_getdents64+0x134/0x220\n  do_syscall_64+0x4b/0x110\n  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\n The buggy address belongs to the object at ffff8880099b8000\n  which belongs to the cache cifs_request of size 16588\n The buggy address is located 412 bytes inside of\n  freed 16588-byte region [ffff8880099b8000, ffff8880099bc0cc)\n\n The buggy address belongs to the physical page:\n page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x99b8\n head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0\n anon flags: 0x80000000000040(head|node=0|zone=1)\n page_type: f5(slab)\n raw: 0080000000000040 ffff888001e03400 0000000000000000 dead000000000001\n raw: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000\n head: 0080000000000040 ffff888001e03400 0000000000000000 dead000000000001\n head: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000\n head: 0080000000000003 ffffea0000266e01 00000000ffffffff 00000000ffffffff\n head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008\n page dumped because: kasan: bad access detected\n\n Memory state around the buggy address:\n  ffff8880099b8080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n  ffff8880099b8100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n \u0026gt;ffff8880099b8180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n                             ^\n  ffff8880099b8200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n  ffff8880099b8280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ==================================================================\n\nPOC is available in the link [1].\n\nThe problem triggering process is as follows:\n\nProcess 1                       Process 2\n-----------------------------------\n---truncated---(CVE-2025-38051)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvirtio: break and reset virtio devices on device_shutdown()\n\nHongyu reported a hang on kexec in a VM. QEMU reported invalid memory\naccesses during the hang.\n\n\tInvalid read at addr 0x102877002, size 2, region \u0026apos;(null)\u0026apos;, reason: rejected\n\tInvalid write at addr 0x102877A44, size 2, region \u0026apos;(null)\u0026apos;, reason: rejected\n\t...\n\nIt was traced down to virtio-console. Kexec works fine if virtio-console\nis not in use.\n\nThe issue is that virtio-console continues to write to the MMIO even after\nunderlying virtio-pci device is reset.\n\nAdditionally, Eric noticed that IOMMUs are reset before devices, if\ndevices are not reset on shutdown they continue to poke at guest memory\nand get errors from the IOMMU. Some devices get wedged then.\n\nThe problem can be solved by breaking all virtio devices on virtio\nbus shutdown, then resetting them.(CVE-2025-38064)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nACPI: CPPC: Fix NULL pointer dereference when nosmp is used\n\nWith nosmp in cmdline, other CPUs are not brought up, leaving\ntheir cpc_desc_ptr NULL. CPU0\u0026apos;s iteration via for_each_possible_cpu()\ndereferences these NULL pointers, causing panic.\n\nPanic backtrace:\n\n[    0.401123] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000b8\n...\n[    0.403255] [\u0026lt;ffffffff809a5818\u0026gt;] cppc_allow_fast_switch+0x6a/0xd4\n...\nKernel panic - not syncing: Attempted to kill init!\n\n[ rjw: New subject ](CVE-2025-38113)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ngve: add missing NULL check for gve_alloc_pending_packet() in TX DQO\n\ngve_alloc_pending_packet() can return NULL, but gve_tx_add_skb_dqo()\ndid not check for this case before dereferencing the returned pointer.\n\nAdd a missing NULL check to prevent a potential NULL pointer\ndereference when allocation fails.\n\nThis improves robustness in low-memory scenarios.(CVE-2025-38122)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: wwan: t7xx: Fix napi rx poll issue\n\nWhen driver handles the napi rx polling requests, the netdev might\nhave been released by the dellink logic triggered by the disconnect\noperation on user plane. However, in the logic of processing skb in\npolling, an invalid netdev is still being used, which causes a panic.\n\nBUG: kernel NULL pointer dereference, address: 00000000000000f1\nOops: 0000 [#1] PREEMPT SMP NOPTI\nRIP: 0010:dev_gro_receive+0x3a/0x620\n[...]\nCall Trace:\n \u0026lt;IRQ\u0026gt;\n ? __die_body+0x68/0xb0\n ? page_fault_oops+0x379/0x3e0\n ? exc_page_fault+0x4f/0xa0\n ? asm_exc_page_fault+0x22/0x30\n ? __pfx_t7xx_ccmni_recv_skb+0x10/0x10 [mtk_t7xx (HASH:1400 7)]\n ? dev_gro_receive+0x3a/0x620\n napi_gro_receive+0xad/0x170\n t7xx_ccmni_recv_skb+0x48/0x70 [mtk_t7xx (HASH:1400 7)]\n t7xx_dpmaif_napi_rx_poll+0x590/0x800 [mtk_t7xx (HASH:1400 7)]\n net_rx_action+0x103/0x470\n irq_exit_rcu+0x13a/0x310\n sysvec_apic_timer_interrupt+0x56/0x90\n \u0026lt;/IRQ\u0026gt;(CVE-2025-38123)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncoresight: prevent deactivate active config while enabling the config\n\nWhile enable active config via cscfg_csdev_enable_active_config(),\nactive config could be deactivated via configfs\u0026apos; sysfs interface.\nThis could make UAF issue in below scenario:\n\nCPU0                                          CPU1\n(sysfs enable)                                load module\n                                              cscfg_load_config_sets()\n                                              activate config. // sysfs\n                                              (sys_active_cnt == 1)\n...\ncscfg_csdev_enable_active_config()\nlock(csdev-\u0026gt;cscfg_csdev_lock)\n// here load config activate by CPU1\nunlock(csdev-\u0026gt;cscfg_csdev_lock)\n\n                                              deactivate config // sysfs\n                                              (sys_activec_cnt == 0)\n                                              cscfg_unload_config_sets()\n                                              unload module\n\n// access to config_desc which freed\n// while unloading module.\ncscfg_csdev_enable_config\n\nTo address this, use cscfg_config_desc\u0026apos;s active_cnt as a reference count\n which will be holded when\n    - activate the config.\n    - enable the activated config.\nand put the module reference when config_active_cnt == 0.(CVE-2025-38131)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: phy: mscc: Fix memory leak when using one step timestamping\n\nFix memory leak when running one-step timestamping. When running\none-step sync timestamping, the HW is configured to insert the TX time\ninto the frame, so there is no reason to keep the skb anymore. As in\nthis case the HW will never generate an interrupt to say that the frame\nwas timestamped, then the frame will never released.\nFix this by freeing the frame in case of one-step timestamping.(CVE-2025-38148)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Fix error flow upon firmware failure for RQ destruction\n\nUpon RQ destruction if the firmware command fails which is the\nlast resource to be destroyed some SW resources were already cleaned\nregardless of the failure.\n\nNow properly rollback the object to its original state upon such failure.\n\nIn order to avoid a use-after free in case someone tries to destroy the\nobject again, which results in the following kernel trace:\nrefcount_t: underflow; use-after-free.\nWARNING: CPU: 0 PID: 37589 at lib/refcount.c:28 refcount_warn_saturate+0xf4/0x148\nModules linked in: rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) ib_umad(OE) mlx5_ib(OE) rfkill mlx5_core(OE) mlxdevm(OE) ib_uverbs(OE) ib_core(OE) psample mlxfw(OE) mlx_compat(OE) macsec tls pci_hyperv_intf sunrpc vfat fat virtio_net net_failover failover fuse loop nfnetlink vsock_loopback vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport vmw_vmci vsock xfs crct10dif_ce ghash_ce sha2_ce sha256_arm64 sha1_ce virtio_console virtio_gpu virtio_blk virtio_dma_buf virtio_mmio dm_mirror dm_region_hash dm_log dm_mod xpmem(OE)\nCPU: 0 UID: 0 PID: 37589 Comm: python3 Kdump: loaded Tainted: G           OE     -------  ---  6.12.0-54.el10.aarch64 #1\nTainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\nHardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015\npstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : refcount_warn_saturate+0xf4/0x148\nlr : refcount_warn_saturate+0xf4/0x148\nsp : ffff80008b81b7e0\nx29: ffff80008b81b7e0 x28: ffff000133d51600 x27: 0000000000000001\nx26: 0000000000000000 x25: 00000000ffffffea x24: ffff00010ae80f00\nx23: ffff00010ae80f80 x22: ffff0000c66e5d08 x21: 0000000000000000\nx20: ffff0000c66e0000 x19: ffff00010ae80340 x18: 0000000000000006\nx17: 0000000000000000 x16: 0000000000000020 x15: ffff80008b81b37f\nx14: 0000000000000000 x13: 2e656572662d7265 x12: ffff80008283ef78\nx11: ffff80008257efd0 x10: ffff80008283efd0 x9 : ffff80008021ed90\nx8 : 0000000000000001 x7 : 00000000000bffe8 x6 : c0000000ffff7fff\nx5 : ffff0001fb8e3408 x4 : 0000000000000000 x3 : ffff800179993000\nx2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000133d51600\nCall trace:\n refcount_warn_saturate+0xf4/0x148\n mlx5_core_put_rsc+0x88/0xa0 [mlx5_ib]\n mlx5_core_destroy_rq_tracked+0x64/0x98 [mlx5_ib]\n mlx5_ib_destroy_wq+0x34/0x80 [mlx5_ib]\n ib_destroy_wq_user+0x30/0xc0 [ib_core]\n uverbs_free_wq+0x28/0x58 [ib_uverbs]\n destroy_hw_idr_uobject+0x34/0x78 [ib_uverbs]\n uverbs_destroy_uobject+0x48/0x240 [ib_uverbs]\n __uverbs_cleanup_ufile+0xd4/0x1a8 [ib_uverbs]\n uverbs_destroy_ufile_hw+0x48/0x120 [ib_uverbs]\n ib_uverbs_close+0x2c/0x100 [ib_uverbs]\n __fput+0xd8/0x2f0\n __fput_sync+0x50/0x70\n __arm64_sys_close+0x40/0x90\n invoke_syscall.constprop.0+0x74/0xd0\n do_el0_svc+0x48/0xe8\n el0_svc+0x44/0x1d0\n el0t_64_sync_handler+0x120/0x130\n el0t_64_sync+0x1a4/0x1a8(CVE-2025-38161)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get()\n\nBefore calling lan743x_ptp_io_event_clock_get(), the \u0026apos;channel\u0026apos; value\nis checked against the maximum value of PCI11X1X_PTP_IO_MAX_CHANNELS(8).\nThis seems correct and aligns with the PTP interrupt status register\n(PTP_INT_STS) specifications.\n\nHowever, lan743x_ptp_io_event_clock_get() writes to ptp-\u0026gt;extts[] with\nonly LAN743X_PTP_N_EXTTS(4) elements, using channel as an index:\n\n    lan743x_ptp_io_event_clock_get(..., u8 channel,...)\n    {\n        ...\n        /* Update Local timestamp */\n        extts = \u0026amp;ptp-\u0026gt;extts[channel];\n        extts-\u0026gt;ts.tv_sec = sec;\n        ...\n    }\n\nTo avoid an out-of-bounds write and utilize all the supported GPIO\ninputs, set LAN743X_PTP_N_EXTTS to 8.\n\nDetected using the static analysis tool - Svace.(CVE-2025-38183)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: sch_sfq: reject invalid perturb period\n\nGerrard Tai reported that SFQ perturb_period has no range check yet,\nand this can be used to trigger a race condition fixed in a separate patch.\n\nWe want to make sure ctl-\u0026gt;perturb_period * HZ will not overflow\nand is positive.\n\n\ntc qd add dev lo root sfq perturb -10   # negative value : error\nError: sch_sfq: invalid perturb period.\n\ntc qd add dev lo root sfq perturb 1000000000 # too big : error\nError: sch_sfq: invalid perturb period.\n\ntc qd add dev lo root sfq perturb 2000000 # acceptable value\ntc -s -d qd sh dev lo\nqdisc sfq 8005: root refcnt 2 limit 127p quantum 64Kb depth 127 flows 128 divisor 1024 perturb 2000000sec\n Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0)\n backlog 0b 0p requeues 0(CVE-2025-38193)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\njffs2: check that raw node were preallocated before writing summary\n\nSyzkaller detected a kernel bug in jffs2_link_node_ref, caused by fault\ninjection in jffs2_prealloc_raw_node_refs. jffs2_sum_write_sumnode doesn\u0026apos;t\ncheck return value of jffs2_prealloc_raw_node_refs and simply lets any\nerror propagate into jffs2_sum_write_data, which eventually calls\njffs2_link_node_ref in order to link the summary to an expectedly allocated\nnode.\n\nkernel BUG at fs/jffs2/nodelist.c:592!\ninvalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI\nCPU: 1 PID: 31277 Comm: syz-executor.7 Not tainted 6.1.128-syzkaller-00139-ge10f83ca10a1 #0\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014\nRIP: 0010:jffs2_link_node_ref+0x570/0x690 fs/jffs2/nodelist.c:592\nCall Trace:\n \u0026lt;TASK\u0026gt;\n jffs2_sum_write_data fs/jffs2/summary.c:841 [inline]\n jffs2_sum_write_sumnode+0xd1a/0x1da0 fs/jffs2/summary.c:874\n jffs2_do_reserve_space+0xa18/0xd60 fs/jffs2/nodemgmt.c:388\n jffs2_reserve_space+0x55f/0xaa0 fs/jffs2/nodemgmt.c:197\n jffs2_write_inode_range+0x246/0xb50 fs/jffs2/write.c:362\n jffs2_write_end+0x726/0x15d0 fs/jffs2/file.c:301\n generic_perform_write+0x314/0x5d0 mm/filemap.c:3856\n __generic_file_write_iter+0x2ae/0x4d0 mm/filemap.c:3973\n generic_file_write_iter+0xe3/0x350 mm/filemap.c:4005\n call_write_iter include/linux/fs.h:2265 [inline]\n do_iter_readv_writev+0x20f/0x3c0 fs/read_write.c:735\n do_iter_write+0x186/0x710 fs/read_write.c:861\n vfs_iter_write+0x70/0xa0 fs/read_write.c:902\n iter_file_splice_write+0x73b/0xc90 fs/splice.c:685\n do_splice_from fs/splice.c:763 [inline]\n direct_splice_actor+0x10c/0x170 fs/splice.c:950\n splice_direct_to_actor+0x337/0xa10 fs/splice.c:896\n do_splice_direct+0x1a9/0x280 fs/splice.c:1002\n do_sendfile+0xb13/0x12c0 fs/read_write.c:1255\n __do_sys_sendfile64 fs/read_write.c:1323 [inline]\n __se_sys_sendfile64 fs/read_write.c:1309 [inline]\n __x64_sys_sendfile64+0x1cf/0x210 fs/read_write.c:1309\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81\n entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n\nFix this issue by checking return value of jffs2_prealloc_raw_node_refs\nbefore calling jffs2_sum_write_data.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.(CVE-2025-38194)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/shmem, swap: fix softlockup with mTHP swapin\n\nFollowing softlockup can be easily reproduced on my test machine with:\n\necho always \u0026gt; /sys/kernel/mm/transparent_hugepage/hugepages-64kB/enabled\nswapon /dev/zram0 # zram0 is a 48G swap device\nmkdir -p /sys/fs/cgroup/memory/test\necho 1G \u0026gt; /sys/fs/cgroup/test/memory.max\necho $BASHPID \u0026gt; /sys/fs/cgroup/test/cgroup.procs\nwhile true; do\n    dd if=/dev/zero of=/tmp/test.img bs=1M count=5120\n    cat /tmp/test.img \u0026gt; /dev/null\n    rm /tmp/test.img\ndone\n\nThen after a while:\nwatchdog: BUG: soft lockup - CPU#0 stuck for 763s! [cat:5787]\nModules linked in: zram virtiofs\nCPU: 0 UID: 0 PID: 5787 Comm: cat Kdump: loaded Tainted: G             L      6.15.0.orig-gf3021d9246bc-dirty #118 PREEMPT(voluntary)·\nTainted: [L]=SOFTLOCKUP\nHardware name: Red Hat KVM/RHEL-AV, BIOS 0.0.0 02/06/2015\nRIP: 0010:mpol_shared_policy_lookup+0xd/0x70\nCode: e9 b8 b4 ff ff 31 c0 c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 0f 1f 44 00 00 41 54 55 53 \u0026lt;48\u0026gt; 8b 1f 48 85 db 74 41 4c 8d 67 08 48 89 fb 48 89 f5 4c 89 e7 e8\nRSP: 0018:ffffc90002b1fc28 EFLAGS: 00000202\nRAX: 00000000001c20ca RBX: 0000000000724e1e RCX: 0000000000000001\nRDX: ffff888118e214c8 RSI: 0000000000057d42 RDI: ffff888118e21518\nRBP: 000000000002bec8 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000bf4 R11: 0000000000000000 R12: 0000000000000001\nR13: 00000000001c20ca R14: 00000000001c20ca R15: 0000000000000000\nFS:  00007f03f995c740(0000) GS:ffff88a07ad9a000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f03f98f1000 CR3: 0000000144626004 CR4: 0000000000770eb0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n \u0026lt;TASK\u0026gt;\n shmem_alloc_folio+0x31/0xc0\n shmem_swapin_folio+0x309/0xcf0\n ? filemap_get_entry+0x117/0x1e0\n ? xas_load+0xd/0xb0\n ? filemap_get_entry+0x101/0x1e0\n shmem_get_folio_gfp+0x2ed/0x5b0\n shmem_file_read_iter+0x7f/0x2e0\n vfs_read+0x252/0x330\n ksys_read+0x68/0xf0\n do_syscall_64+0x4c/0x1c0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\nRIP: 0033:0x7f03f9a46991\nCode: 00 48 8b 15 81 14 10 00 f7 d8 64 89 02 b8 ff ff ff ff eb bd e8 20 ad 01 00 f3 0f 1e fa 80 3d 35 97 10 00 00 74 13 31 c0 0f 05 \u0026lt;48\u0026gt; 3d 00 f0 ff ff 77 4f c3 66 0f 1f 44 00 00 55 48 89 e5 48 83 ec\nRSP: 002b:00007fff3c52bd28 EFLAGS: 00000246 ORIG_RAX: 0000000000000000\nRAX: ffffffffffffffda RBX: 0000000000040000 RCX: 00007f03f9a46991\nRDX: 0000000000040000 RSI: 00007f03f98ba000 RDI: 0000000000000003\nRBP: 00007fff3c52bd50 R08: 0000000000000000 R09: 00007f03f9b9a380\nR10: 0000000000000022 R11: 0000000000000246 R12: 0000000000040000\nR13: 00007f03f98ba000 R14: 0000000000000003 R15: 0000000000000000\n \u0026lt;/TASK\u0026gt;\n\nThe reason is simple, readahead brought some order 0 folio in swap cache,\nand the swapin mTHP folio being allocated is in conflict with it, so\nswapcache_prepare fails and causes shmem_swap_alloc_folio to return\n-EEXIST, and shmem simply retries again and again causing this loop.\n\nFix it by applying a similar fix for anon mTHP swapin.\n\nThe performance change is very slight, time of swapin 10g zero folios\nwith shmem (test for 12 times):\nBefore:  2.47s\nAfter:   2.48s\n\n[(CVE-2025-38241)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlib/group_cpus: fix NULL pointer dereference from group_cpus_evenly()\n\nWhile testing null_blk with configfs, echo 0 \u0026gt; poll_queues will trigger\nfollowing panic:\n\nBUG: kernel NULL pointer dereference, address: 0000000000000010\nOops: Oops: 0000 [#1] SMP NOPTI\nCPU: 27 UID: 0 PID: 920 Comm: bash Not tainted 6.15.0-02023-gadbdb95c8696-dirty #1238 PREEMPT(undef)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014\nRIP: 0010:__bitmap_or+0x48/0x70\nCall Trace:\n \u0026lt;TASK\u0026gt;\n __group_cpus_evenly+0x822/0x8c0\n group_cpus_evenly+0x2d9/0x490\n blk_mq_map_queues+0x1e/0x110\n null_map_queues+0xc9/0x170 [null_blk]\n blk_mq_update_queue_map+0xdb/0x160\n blk_mq_update_nr_hw_queues+0x22b/0x560\n nullb_update_nr_hw_queues+0x71/0xf0 [null_blk]\n nullb_device_poll_queues_store+0xa4/0x130 [null_blk]\n configfs_write_iter+0x109/0x1d0\n vfs_write+0x26e/0x6f0\n ksys_write+0x79/0x180\n __x64_sys_write+0x1d/0x30\n x64_sys_call+0x45c4/0x45f0\n do_syscall_64+0xa5/0x240\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nRoot cause is that numgrps is set to 0, and ZERO_SIZE_PTR is returned from\nkcalloc(), and later ZERO_SIZE_PTR will be deferenced.\n\nFix the problem by checking numgrps first in group_cpus_evenly(), and\nreturn NULL directly if numgrps is zero.\n\n[(CVE-2025-38255)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: Fix NULL pointer deference on eir_get_service_data\n\nThe len parameter is considered optional so it can be NULL so it cannot\nbe used for skipping to next entry of EIR_SERVICE_DATA.(CVE-2025-38304)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nASoC: Intel: avs: Verify content returned by parse_int_array()\n\nThe first element of the returned array stores its length. If it is 0,\nany manipulation beyond the element at index 0 ends with null-ptr-deref.(CVE-2025-38307)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: Log an error when close_all_cached_dirs fails\n\nUnder low-memory conditions, close_all_cached_dirs() can\u0026apos;t move the\ndentries to a separate list to dput() them once the locks are dropped.\nThis will result in a \u0026quot;Dentry still in use\u0026quot; error, so add an error\nmessage that makes it clear this is what happened:\n\n[  495.281119] CIFS: VFS: \\\\otters.example.com\\share Out of memory while dropping dentries\n[  495.281595] ------------[ cut here ]------------\n[  495.281887] BUG: Dentry ffff888115531138{i=78,n=/}  still in use (2) [unmount of cifs cifs]\n[  495.282391] WARNING: CPU: 1 PID: 2329 at fs/dcache.c:1536 umount_check+0xc8/0xf0\n\nAlso, bail out of looping through all tcons as soon as a single\nallocation fails, since we\u0026apos;re already in trouble, and kmalloc() attempts\nfor subseqeuent tcons are likely to fail just like the first one did.(CVE-2025-38321)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: fix acpi parse and parseext cache leaks\n\nACPICA commit 8829e70e1360c81e7a5a901b5d4f48330e021ea5\n\nI\u0026apos;m Seunghun Han, and I work for National Security Research Institute of\nSouth Korea.\n\nI have been doing a research on ACPI and found an ACPI cache leak in ACPI\nearly abort cases.\n\nBoot log of ACPI cache leak is as follows:\n[    0.352414] ACPI: Added _OSI(Module Device)\n[    0.353182] ACPI: Added _OSI(Processor Device)\n[    0.353182] ACPI: Added _OSI(3.0 _SCP Extensions)\n[    0.353182] ACPI: Added _OSI(Processor Aggregator Device)\n[    0.356028] ACPI: Unable to start the ACPI Interpreter\n[    0.356799] ACPI Error: Could not remove SCI handler (20170303/evmisc-281)\n[    0.360215] kmem_cache_destroy Acpi-State: Slab cache still has objects\n[    0.360648] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G        W\n4.12.0-rc4-next-20170608+ #10\n[    0.361273] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS\nvirtual_box 12/01/2006\n[    0.361873] Call Trace:\n[    0.362243]  ? dump_stack+0x5c/0x81\n[    0.362591]  ? kmem_cache_destroy+0x1aa/0x1c0\n[    0.362944]  ? acpi_sleep_proc_init+0x27/0x27\n[    0.363296]  ? acpi_os_delete_cache+0xa/0x10\n[    0.363646]  ? acpi_ut_delete_caches+0x6d/0x7b\n[    0.364000]  ? acpi_terminate+0xa/0x14\n[    0.364000]  ? acpi_init+0x2af/0x34f\n[    0.364000]  ? __class_create+0x4c/0x80\n[    0.364000]  ? video_setup+0x7f/0x7f\n[    0.364000]  ? acpi_sleep_proc_init+0x27/0x27\n[    0.364000]  ? do_one_initcall+0x4e/0x1a0\n[    0.364000]  ? kernel_init_freeable+0x189/0x20a\n[    0.364000]  ? rest_init+0xc0/0xc0\n[    0.364000]  ? kernel_init+0xa/0x100\n[    0.364000]  ? ret_from_fork+0x25/0x30\n\nI analyzed this memory leak in detail. I found that “Acpi-State” cache and\n“Acpi-Parse” cache were merged because the size of cache objects was same\nslab cache size.\n\nI finally found “Acpi-Parse” cache and “Acpi-parse_ext” cache were leaked\nusing SLAB_NEVER_MERGE flag in kmem_cache_create() function.\n\nReal ACPI cache leak point is as follows:\n[    0.360101] ACPI: Added _OSI(Module Device)\n[    0.360101] ACPI: Added _OSI(Processor Device)\n[    0.360101] ACPI: Added _OSI(3.0 _SCP Extensions)\n[    0.361043] ACPI: Added _OSI(Processor Aggregator Device)\n[    0.364016] ACPI: Unable to start the ACPI Interpreter\n[    0.365061] ACPI Error: Could not remove SCI handler (20170303/evmisc-281)\n[    0.368174] kmem_cache_destroy Acpi-Parse: Slab cache still has objects\n[    0.369332] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G        W\n4.12.0-rc4-next-20170608+ #8\n[    0.371256] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS\nvirtual_box 12/01/2006\n[    0.372000] Call Trace:\n[    0.372000]  ? dump_stack+0x5c/0x81\n[    0.372000]  ? kmem_cache_destroy+0x1aa/0x1c0\n[    0.372000]  ? acpi_sleep_proc_init+0x27/0x27\n[    0.372000]  ? acpi_os_delete_cache+0xa/0x10\n[    0.372000]  ? acpi_ut_delete_caches+0x56/0x7b\n[    0.372000]  ? acpi_terminate+0xa/0x14\n[    0.372000]  ? acpi_init+0x2af/0x34f\n[    0.372000]  ? __class_create+0x4c/0x80\n[    0.372000]  ? video_setup+0x7f/0x7f\n[    0.372000]  ? acpi_sleep_proc_init+0x27/0x27\n[    0.372000]  ? do_one_initcall+0x4e/0x1a0\n[    0.372000]  ? kernel_init_freeable+0x189/0x20a\n[    0.372000]  ? rest_init+0xc0/0xc0\n[    0.372000]  ? kernel_init+0xa/0x100\n[    0.372000]  ? ret_from_fork+0x25/0x30\n[    0.388039] kmem_cache_destroy Acpi-parse_ext: Slab cache still has objects\n[    0.389063] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G        W\n4.12.0-rc4-next-20170608+ #8\n[    0.390557] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS\nvirtual_box 12/01/2006\n[    0.392000] Call Trace:\n[    0.392000]  ? dump_stack+0x5c/0x81\n[    0.392000]  ? kmem_cache_destroy+0x1aa/0x1c0\n[    0.392000]  ? acpi_sleep_proc_init+0x27/0x27\n[    0.392000]  ? acpi_os_delete_cache+0xa/0x10\n[    0.392000]  ? acpi_ut_delete_caches+0x6d/0x7b\n[    0.392000]  ? acpi_terminate+0xa/0x14\n[    0.392000]  ? acpi_init+0x2af/0x3\n---truncated---(CVE-2025-38344)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmaple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate()\n\nTemporarily clear the preallocation flag when explicitly requesting\nallocations.  Pre-existing allocations are already counted against the\nrequest through mas_node_count_gfp(), but the allocations will not happen\nif the MA_STATE_PREALLOC flag is set.  This flag is meant to avoid\nre-allocating in bulk allocation mode, and to detect issues with\npreallocation calculations.\n\nThe MA_STATE_PREALLOC flag should also always be set on zero allocations\nso that detection of underflow allocations will print a WARN_ON() during\nconsumption.\n\nUser visible effect of this flaw is a WARN_ON() followed by a null pointer\ndereference when subsequent requests for larger number of nodes is\nignored, such as the vma merge retry in mmap_region() caused by drivers\naltering the vma flags (which happens in v6.6, at least)(CVE-2025-38364)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvsock: Fix transport_* TOCTOU\n\nTransport assignment may race with module unload. Protect new_transport\nfrom becoming a stale pointer.\n\nThis also takes care of an insecure call in vsock_use_local_transport();\nadd a lockdep assert.\n\nBUG: unable to handle page fault for address: fffffbfff8056000\nOops: Oops: 0000 [#1] SMP KASAN\nRIP: 0010:vsock_assign_transport+0x366/0x600\nCall Trace:\n vsock_connect+0x59c/0xc40\n __sys_connect+0xe8/0x100\n __x64_sys_connect+0x6e/0xc0\n do_syscall_64+0x92/0x1c0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53(CVE-2025-38461)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvsock: Fix transport_{g2h,h2g} TOCTOU\n\nvsock_find_cid() and vsock_dev_do_ioctl() may race with module unload.\ntransport_{g2h,h2g} may become NULL after the NULL check.\n\nIntroduce vsock_transport_local_cid() to protect from a potential\nnull-ptr-deref.\n\nKASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f]\nRIP: 0010:vsock_find_cid+0x47/0x90\nCall Trace:\n __vsock_bind+0x4b2/0x720\n vsock_bind+0x90/0xe0\n __sys_bind+0x14d/0x1e0\n __x64_sys_bind+0x6e/0xc0\n do_syscall_64+0x92/0x1c0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\nKASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f]\nRIP: 0010:vsock_dev_do_ioctl.isra.0+0x58/0xf0\nCall Trace:\n __x64_sys_ioctl+0x12d/0x190\n do_syscall_64+0x92/0x1c0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53(CVE-2025-38462)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix use-after-free in crypt_message when using async crypto\n\nThe CVE-2024-50047 fix removed asynchronous crypto handling from\ncrypt_message(), assuming all crypto operations are synchronous.\nHowever, when hardware crypto accelerators are used, this can cause\nuse-after-free crashes:\n\n  crypt_message()\n    // Allocate the creq buffer containing the req\n    creq = smb2_get_aead_req(..., \u0026amp;req);\n\n    // Async encryption returns -EINPROGRESS immediately\n    rc = enc ? crypto_aead_encrypt(req) : crypto_aead_decrypt(req);\n\n    // Free creq while async operation is still in progress\n    kvfree_sensitive(creq, ...);\n\nHardware crypto modules often implement async AEAD operations for\nperformance. When crypto_aead_encrypt/decrypt() returns -EINPROGRESS,\nthe operation completes asynchronously. Without crypto_wait_req(),\nthe function immediately frees the request buffer, leading to crashes\nwhen the driver later accesses the freed memory.\n\nThis results in a use-after-free condition when the hardware crypto\ndriver later accesses the freed request structure, leading to kernel\ncrashes with NULL pointer dereferences.\n\nThe issue occurs because crypto_alloc_aead() with mask=0 doesn\u0026apos;t\nguarantee synchronous operation. Even without CRYPTO_ALG_ASYNC in\nthe mask, async implementations can be selected.\n\nFix by restoring the async crypto handling:\n- DECLARE_CRYPTO_WAIT(wait) for completion tracking\n- aead_request_set_callback() for async completion notification\n- crypto_wait_req() to wait for operation completion\n\nThis ensures the request buffer isn\u0026apos;t freed until the crypto operation\ncompletes, whether synchronous or asynchronous, while preserving the\nCVE-2024-50047 fix.(CVE-2025-38488)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nclone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns\n\nWhat we want is to verify there is that clone won\u0026apos;t expose something\nhidden by a mount we wouldn\u0026apos;t be able to undo.  \u0026quot;Wouldn\u0026apos;t be able to undo\u0026quot;\nmay be a result of MNT_LOCKED on a child, but it may also come from\nlacking admin rights in the userns of the namespace mount belongs to.\n\nclone_private_mnt() checks the former, but not the latter.\n\nThere\u0026apos;s a number of rather confusing CAP_SYS_ADMIN checks in various\nuserns during the mount, especially with the new mount API; they serve\ndifferent purposes and in case of clone_private_mnt() they usually,\nbut not always end up covering the missing check mentioned above.(CVE-2025-38499)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: plug races between subflow fail and subflow creation\n\nWe have races similar to the one addressed by the previous patch between\nsubflow failing and additional subflow creation. They are just harder to\ntrigger.\n\nThe solution is similar. Use a separate flag to track the condition\n\u0026apos;socket state prevent any additional subflow creation\u0026apos; protected by the\nfallback lock.\n\nThe socket fallback makes such flag true, and also receiving or sending\nan MP_FAIL option.\n\nThe field \u0026apos;allow_infinite_fallback\u0026apos; is now always touched under the\nrelevant lock, we can drop the ONCE annotation on write.(CVE-2025-38552)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: use aead_request_free to match aead_request_alloc\n\nUse aead_request_free() instead of kfree() to properly free memory\nallocated by aead_request_alloc(). This ensures sensitive crypto data\nis zeroed before being freed.(CVE-2025-38575)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nPM / devfreq: Check governor before using governor-\u0026gt;name\n\nCommit 96ffcdf239de (\u0026quot;PM / devfreq: Remove redundant governor_name from\nstruct devfreq\u0026quot;) removes governor_name and uses governor-\u0026gt;name to replace\nit. But devfreq-\u0026gt;governor may be NULL and directly using\ndevfreq-\u0026gt;governor-\u0026gt;name may cause null pointer exception. Move the check of\ngovernor to before using governor-\u0026gt;name.(CVE-2025-38609)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ctnetlink: fix refcount leak on table dump\n\nThere is a reference count leak in ctnetlink_dump_table():\n      if (res \u0026lt; 0) {\n                nf_conntrack_get(\u0026amp;ct-\u0026gt;ct_general); // HERE\n                cb-\u0026gt;args[1] = (unsigned long)ct;\n                ...\n\nWhile its very unlikely, its possible that ct == last.\nIf this happens, then the refcount of ct was already incremented.\nThis 2nd increment is never undone.\n\nThis prevents the conntrack object from being released, which in turn\nkeeps prevents cnet-\u0026gt;count from dropping back to 0.\n\nThis will then block the netns dismantle (or conntrack rmmod) as\nnf_conntrack_cleanup_net_list() will wait forever.\n\nThis can be reproduced by running conntrack_resize.sh selftest in a loop.\nIt takes ~20 minutes for me on a preemptible kernel on average before\nI see a runaway kworker spinning in nf_conntrack_cleanup_net_list.\n\nOne fix would to change this to:\n        if (res \u0026lt; 0) {\n\t\tif (ct != last)\n\t                nf_conntrack_get(\u0026amp;ct-\u0026gt;ct_general);\n\nBut this reference counting isn\u0026apos;t needed in the first place.\nWe can just store a cookie value instead.\n\nA followup patch will do the same for ctnetlink_exp_dump_table,\nit looks to me as if this has the same problem and like\nctnetlink_dump_table, we only need a \u0026apos;skip hint\u0026apos;, not the actual\nobject so we can apply the same cookie strategy there as well.(CVE-2025-38721)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla4xxx: Prevent a potential error pointer dereference\n\nThe qla4xxx_get_ep_fwdb() function is supposed to return NULL on error,\nbut qla4xxx_ep_connect() returns error pointers.  Propagating the error\npointers will lead to an Oops in the caller, so change the error pointers\nto NULL.(CVE-2025-39676)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntls: fix handling of zero-length records on the rx_list\n\nEach recvmsg() call must process either\n - only contiguous DATA records (any number of them)\n - one non-DATA record\n\nIf the next record has different type than what has already been\nprocessed we break out of the main processing loop. If the record\nhas already been decrypted (which may be the case for TLS 1.3 where\nwe don\u0026apos;t know type until decryption) we queue the pending record\nto the rx_list. Next recvmsg() will pick it up from there.\n\nQueuing the skb to rx_list after zero-copy decrypt is not possible,\nsince in that case we decrypted directly to the user space buffer,\nand we don\u0026apos;t have an skb to queue (darg.skb points to the ciphertext\nskb for access to metadata like length).\n\nOnly data records are allowed zero-copy, and we break the processing\nloop after each non-data record. So we should never zero-copy and\nthen find out that the record type has changed. The corner case\nwe missed is when the initial record comes from rx_list, and it\u0026apos;s\nzero length.(CVE-2025-39682)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv6: sr: Fix MAC comparison to be constant-time\n\nTo prevent timing attacks, MACs need to be compared in constant time.\nUse the appropriate helper function for this.(CVE-2025-39702)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nclk: samsung: Fix UBSAN panic in samsung_clk_init()\n\nWith UBSAN_ARRAY_BOUNDS=y, I\u0026apos;m hitting the below panic due to\ndereferencing `ctx-\u0026gt;clk_data.hws` before setting\n`ctx-\u0026gt;clk_data.num = nr_clks`. Move that up to fix the crash.\n\n  UBSAN: array index out of bounds: 00000000f2005512 [#1] PREEMPT SMP\n  \u0026lt;snip\u0026gt;\n  Call trace:\n   samsung_clk_init+0x110/0x124 (P)\n   samsung_clk_init+0x48/0x124 (L)\n   samsung_cmu_register_one+0x3c/0xa0\n   exynos_arm64_register_cmu+0x54/0x64\n   __gs101_cmu_top_of_clk_init_declare+0x28/0x60\n   ...(CVE-2025-39728)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfs: Prevent file descriptor table allocations exceeding INT_MAX\n\nWhen sysctl_nr_open is set to a very high value (for example, 1073741816\nas set by systemd), processes attempting to use file descriptors near\nthe limit can trigger massive memory allocation attempts that exceed\nINT_MAX, resulting in a WARNING in mm/slub.c:\n\n  WARNING: CPU: 0 PID: 44 at mm/slub.c:5027 __kvmalloc_node_noprof+0x21a/0x288\n\nThis happens because kvmalloc_array() and kvmalloc() check if the\nrequested size exceeds INT_MAX and emit a warning when the allocation is\nnot flagged with __GFP_NOWARN.\n\nSpecifically, when nr_open is set to 1073741816 (0x3ffffff8) and a\nprocess calls dup2(oldfd, 1073741880), the kernel attempts to allocate:\n- File descriptor array: 1073741880 * 8 bytes = 8,589,935,040 bytes\n- Multiple bitmaps: ~400MB\n- Total allocation size: \u0026gt; 8GB (exceeding INT_MAX = 2,147,483,647)\n\nReproducer:\n1. Set /proc/sys/fs/nr_open to 1073741816:\n   # echo 1073741816 \u0026gt; /proc/sys/fs/nr_open\n\n2. Run a program that uses a high file descriptor:\n   #include \u0026lt;unistd.h\u0026gt;\n   #include \u0026lt;sys/resource.h\u0026gt;\n\n   int main() {\n       struct rlimit rlim = {1073741824, 1073741824};\n       setrlimit(RLIMIT_NOFILE, \u0026amp;rlim);\n       dup2(2, 1073741880);  // Triggers the warning\n       return 0;\n   }\n\n3. Observe WARNING in dmesg at mm/slub.c:5027\n\nsystemd commit a8b627a introduced automatic bumping of fs.nr_open to the\nmaximum possible value. The rationale was that systems with memory\ncontrol groups (memcg) no longer need separate file descriptor limits\nsince memory is properly accounted. However, this change overlooked\nthat:\n\n1. The kernel\u0026apos;s allocation functions still enforce INT_MAX as a maximum\n   size regardless of memcg accounting\n2. Programs and tests that legitimately test file descriptor limits can\n   inadvertently trigger massive allocations\n3. The resulting allocations (\u0026gt;8GB) are impractical and will always fail\n\nsystemd\u0026apos;s algorithm starts with INT_MAX and keeps halving the value\nuntil the kernel accepts it. On most systems, this results in nr_open\nbeing set to 1073741816 (0x3ffffff8), which is just under 1GB of file\ndescriptors.\n\nWhile processes rarely use file descriptors near this limit in normal\noperation, certain selftests (like\ntools/testing/selftests/core/unshare_test.c) and programs that test file\ndescriptor limits can trigger this issue.\n\nFix this by adding a check in alloc_fdtable() to ensure the requested\nallocation size does not exceed INT_MAX. This causes the operation to\nfail with -EMFILE instead of triggering a kernel warning and avoids the\nimpractical \u0026gt;8GB memory allocation request.(CVE-2025-39756)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM\n\nWhen performing Generic Segmentation Offload (GSO) on an IPv6 packet that\ncontains extension headers, the kernel incorrectly requests checksum offload\nif the egress device only advertises NETIF_F_IPV6_CSUM feature, which has\na strict contract: it supports checksum offload only for plain TCP or UDP\nover IPv6 and explicitly does not support packets with extension headers.\nThe current GSO logic violates this contract by failing to disable the feature\nfor packets with extension headers, such as those used in GREoIPv6 tunnels.\n\nThis violation results in the device being asked to perform an operation\nit cannot support, leading to a `skb_warn_bad_offload` warning and a collapse\nof network throughput. While device TSO/USO is correctly bypassed in favor\nof software GSO for these packets, the GSO stack must be explicitly told not\nto request checksum offload.\n\nMask NETIF_F_IPV6_CSUM, NETIF_F_TSO6 and NETIF_F_GSO_UDP_L4\nin gso_features_check if the IPv6 header contains extension headers to compute\nchecksum in software.\n\nThe exception is a BIG TCP extension, which, as stated in commit\n68e068cabd2c6c53 (\u0026quot;net: reenable NETIF_F_IPV6_CSUM offload for BIG TCP packets\u0026quot;):\n\u0026quot;The feature is only enabled on devices that support BIG TCP TSO.\nThe header is only present for PF_PACKET taps like tcpdump,\nand not transmitted by physical devices.\u0026quot;\n\nkernel log output (truncated):\nWARNING: CPU: 1 PID: 5273 at net/core/dev.c:3535 skb_warn_bad_offload+0x81/0x140\n...\nCall Trace:\n \u0026lt;TASK\u0026gt;\n skb_checksum_help+0x12a/0x1f0\n validate_xmit_skb+0x1a3/0x2d0\n validate_xmit_skb_list+0x4f/0x80\n sch_direct_xmit+0x1a2/0x380\n __dev_xmit_skb+0x242/0x670\n __dev_queue_xmit+0x3fc/0x7f0\n ip6_finish_output2+0x25e/0x5d0\n ip6_finish_output+0x1fc/0x3f0\n ip6_tnl_xmit+0x608/0xc00 [ip6_tunnel]\n ip6gre_tunnel_xmit+0x1c0/0x390 [ip6_gre]\n dev_hard_start_xmit+0x63/0x1c0\n __dev_queue_xmit+0x6d0/0x7f0\n ip6_finish_output2+0x214/0x5d0\n ip6_finish_output+0x1fc/0x3f0\n ip6_xmit+0x2ca/0x6f0\n ip6_finish_output+0x1fc/0x3f0\n ip6_xmit+0x2ca/0x6f0\n inet6_csk_xmit+0xeb/0x150\n __tcp_transmit_skb+0x555/0xa80\n tcp_write_xmit+0x32a/0xe90\n tcp_sendmsg_locked+0x437/0x1110\n tcp_sendmsg+0x2f/0x50\n...\nskb linear:   00000000: e4 3d 1a 7d ec 30 e4 3d 1a 7e 5d 90 86 dd 60 0e\nskb linear:   00000010: 00 0a 1b 34 3c 40 20 11 00 00 00 00 00 00 00 00\nskb linear:   00000020: 00 00 00 00 00 12 20 11 00 00 00 00 00 00 00 00\nskb linear:   00000030: 00 00 00 00 00 11 2f 00 04 01 04 01 01 00 00 00\nskb linear:   00000040: 86 dd 60 0e 00 0a 1b 00 06 40 20 23 00 00 00 00\nskb linear:   00000050: 00 00 00 00 00 00 00 00 00 12 20 23 00 00 00 00\nskb linear:   00000060: 00 00 00 00 00 00 00 00 00 11 bf 96 14 51 13 f9\nskb linear:   00000070: ae 27 a0 a8 2b e3 80 18 00 40 5b 6f 00 00 01 01\nskb linear:   00000080: 08 0a 42 d4 50 d5 4b 70 f8 1a(CVE-2025-39770)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsctp: initialize more fields in sctp_v6_from_sk()\n\nsyzbot found that sin6_scope_id was not properly initialized,\nleading to undefined behavior.\n\nClear sin6_scope_id and sin6_flowinfo.\n\nBUG: KMSAN: uninit-value in __sctp_v6_cmp_addr+0x887/0x8c0 net/sctp/ipv6.c:649\n  __sctp_v6_cmp_addr+0x887/0x8c0 net/sctp/ipv6.c:649\n  sctp_inet6_cmp_addr+0x4f2/0x510 net/sctp/ipv6.c:983\n  sctp_bind_addr_conflict+0x22a/0x3b0 net/sctp/bind_addr.c:390\n  sctp_get_port_local+0x21eb/0x2440 net/sctp/socket.c:8452\n  sctp_get_port net/sctp/socket.c:8523 [inline]\n  sctp_listen_start net/sctp/socket.c:8567 [inline]\n  sctp_inet_listen+0x710/0xfd0 net/sctp/socket.c:8636\n  __sys_listen_socket net/socket.c:1912 [inline]\n  __sys_listen net/socket.c:1927 [inline]\n  __do_sys_listen net/socket.c:1932 [inline]\n  __se_sys_listen net/socket.c:1930 [inline]\n  __x64_sys_listen+0x343/0x4c0 net/socket.c:1930\n  x64_sys_call+0x271d/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:51\n  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n  do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nLocal variable addr.i.i created at:\n  sctp_get_port net/sctp/socket.c:8515 [inline]\n  sctp_listen_start net/sctp/socket.c:8567 [inline]\n  sctp_inet_listen+0x650/0xfd0 net/sctp/socket.c:8636\n  __sys_listen_socket net/socket.c:1912 [inline]\n  __sys_listen net/socket.c:1927 [inline]\n  __do_sys_listen net/socket.c:1932 [inline]\n  __se_sys_listen net/socket.c:1930 [inline]\n  __x64_sys_listen+0x343/0x4c0 net/socket.c:1930(CVE-2025-39812)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Fix buffer free/clear order in deferred receive path\n\nFix a use-after-free window by correcting the buffer release sequence in\nthe deferred receive path. The code freed the RQ buffer first and only\nthen cleared the context pointer under the lock. Concurrent paths (e.g.,\nABTS and the repost path) also inspect and release the same pointer under\nthe lock, so the old order could lead to double-free/UAF.\n\nNote that the repost path already uses the correct pattern: detach the\npointer under the lock, then free it after dropping the lock. The\ndeferred path should do the same.(CVE-2025-39841)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm\n\nWhen send a broadcast packet to a tap device, which was added to a bridge,\nbr_nf_local_in() is called to confirm the conntrack. If another conntrack\nwith the same hash value is added to the hash table, which can be\ntriggered by a normal packet to a non-bridge device, the below warning\nmay happen.\n\n  ------------[ cut here ]------------\n  WARNING: CPU: 1 PID: 96 at net/bridge/br_netfilter_hooks.c:632 br_nf_local_in+0x168/0x200\n  CPU: 1 UID: 0 PID: 96 Comm: tap_send Not tainted 6.17.0-rc2-dirty #44 PREEMPT(voluntary)\n  RIP: 0010:br_nf_local_in+0x168/0x200\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   nf_hook_slow+0x3e/0xf0\n   br_pass_frame_up+0x103/0x180\n   br_handle_frame_finish+0x2de/0x5b0\n   br_nf_hook_thresh+0xc0/0x120\n   br_nf_pre_routing_finish+0x168/0x3a0\n   br_nf_pre_routing+0x237/0x5e0\n   br_handle_frame+0x1ec/0x3c0\n   __netif_receive_skb_core+0x225/0x1210\n   __netif_receive_skb_one_core+0x37/0xa0\n   netif_receive_skb+0x36/0x160\n   tun_get_user+0xa54/0x10c0\n   tun_chr_write_iter+0x65/0xb0\n   vfs_write+0x305/0x410\n   ksys_write+0x60/0xd0\n   do_syscall_64+0xa4/0x260\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n   \u0026lt;/TASK\u0026gt;\n  ---[ end trace 0000000000000000 ]---\n\nTo solve the hash conflict, nf_ct_resolve_clash() try to merge the\nconntracks, and update skb-\u0026gt;_nfct. However, br_nf_local_in() still use the\nold ct from local variable \u0026apos;nfct\u0026apos; after confirm(), which leads to this\nwarning.\n\nIf confirm() does not insert the conntrack entry and return NF_DROP, the\nwarning may also occur. There is no need to reserve the WARN_ON_ONCE, just\nremove it.(CVE-2025-39894)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer\n\nSince commit 7d5e9737efda (\u0026quot;net: rfkill: gpio: get the name and type from\ndevice property\u0026quot;) rfkill_find_type() gets called with the possibly\nuninitialized \u0026quot;const char *type_name;\u0026quot; local variable.\n\nOn x86 systems when rfkill-gpio binds to a \u0026quot;BCM4752\u0026quot; or \u0026quot;LNV4752\u0026quot;\nacpi_device, the rfkill-\u0026gt;type is set based on the ACPI acpi_device_id:\n\n        rfkill-\u0026gt;type = (unsigned)id-\u0026gt;driver_data;\n\nand there is no \u0026quot;type\u0026quot; property so device_property_read_string() will fail\nand leave type_name uninitialized, leading to a potential crash.\n\nrfkill_find_type() does accept a NULL pointer, fix the potential crash\nby initializing type_name to NULL.\n\nNote likely sofar this has not been caught because:\n\n1. Not many x86 machines actually have a \u0026quot;BCM4752\u0026quot;/\u0026quot;LNV4752\u0026quot; acpi_device\n2. The stack happened to contain NULL where type_name is stored(CVE-2025-39937)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Clear tcp_sk(sk)-\u0026gt;fastopen_rsk in tcp_disconnect().\n\nsyzbot reported the splat below where a socket had tcp_sk(sk)-\u0026gt;fastopen_rsk\nin the TCP_ESTABLISHED state. [0]\n\nsyzbot reused the server-side TCP Fast Open socket as a new client before\nthe TFO socket completes 3WHS:\n\n  1. accept()\n  2. connect(AF_UNSPEC)\n  3. connect() to another destination\n\nAs of accept(), sk-\u0026gt;sk_state is TCP_SYN_RECV, and tcp_disconnect() changes\nit to TCP_CLOSE and makes connect() possible, which restarts timers.\n\nSince tcp_disconnect() forgot to clear tcp_sk(sk)-\u0026gt;fastopen_rsk, the\nretransmit timer triggered the warning and the intended packet was not\nretransmitted.\n\nLet\u0026apos;s call reqsk_fastopen_remove() in tcp_disconnect().\n\n[0]:\nWARNING: CPU: 2 PID: 0 at net/ipv4/tcp_timer.c:542 tcp_retransmit_timer (net/ipv4/tcp_timer.c:542 (discriminator 7))\nModules linked in:\nCPU: 2 UID: 0 PID: 0 Comm: swapper/2 Not tainted 6.17.0-rc5-g201825fb4278 #62 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\nRIP: 0010:tcp_retransmit_timer (net/ipv4/tcp_timer.c:542 (discriminator 7))\nCode: 41 55 41 54 55 53 48 8b af b8 08 00 00 48 89 fb 48 85 ed 0f 84 55 01 00 00 0f b6 47 12 3c 03 74 0c 0f b6 47 12 3c 04 74 04 90 \u0026lt;0f\u0026gt; 0b 90 48 8b 85 c0 00 00 00 48 89 ef 48 8b 40 30 e8 6a 4f 06 3e\nRSP: 0018:ffffc900002f8d40 EFLAGS: 00010293\nRAX: 0000000000000002 RBX: ffff888106911400 RCX: 0000000000000017\nRDX: 0000000002517619 RSI: ffffffff83764080 RDI: ffff888106911400\nRBP: ffff888106d5c000 R08: 0000000000000001 R09: ffffc900002f8de8\nR10: 00000000000000c2 R11: ffffc900002f8ff8 R12: ffff888106911540\nR13: ffff888106911480 R14: ffff888106911840 R15: ffffc900002f8de0\nFS:  0000000000000000(0000) GS:ffff88907b768000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f8044d69d90 CR3: 0000000002c30003 CR4: 0000000000370ef0\nCall Trace:\n \u0026lt;IRQ\u0026gt;\n tcp_write_timer (net/ipv4/tcp_timer.c:738)\n call_timer_fn (kernel/time/timer.c:1747)\n __run_timers (kernel/time/timer.c:1799 kernel/time/timer.c:2372)\n timer_expire_remote (kernel/time/timer.c:2385 kernel/time/timer.c:2376 kernel/time/timer.c:2135)\n tmigr_handle_remote_up (kernel/time/timer_migration.c:944 kernel/time/timer_migration.c:1035)\n __walk_groups.isra.0 (kernel/time/timer_migration.c:533 (discriminator 1))\n tmigr_handle_remote (kernel/time/timer_migration.c:1096)\n handle_softirqs (./arch/x86/include/asm/jump_label.h:36 ./include/trace/events/irq.h:142 kernel/softirq.c:580)\n irq_exit_rcu (kernel/softirq.c:614 kernel/softirq.c:453 kernel/softirq.c:680 kernel/softirq.c:696)\n sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1050 (discriminator 35) arch/x86/kernel/apic/apic.c:1050 (discriminator 35))\n \u0026lt;/IRQ\u0026gt;(CVE-2025-39955)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnexthop: Forbid FDB status change while nexthop is in a group\n\nThe kernel forbids the creation of non-FDB nexthop groups with FDB\nnexthops:\n\n # ip nexthop add id 1 via 192.0.2.1 fdb\n # ip nexthop add id 2 group 1\n Error: Non FDB nexthop group cannot have fdb nexthops.\n\nAnd vice versa:\n\n # ip nexthop add id 3 via 192.0.2.2 dev dummy1\n # ip nexthop add id 4 group 3 fdb\n Error: FDB nexthop group can only have fdb nexthops.\n\nHowever, as long as no routes are pointing to a non-FDB nexthop group,\nthe kernel allows changing the type of a nexthop from FDB to non-FDB and\nvice versa:\n\n # ip nexthop add id 5 via 192.0.2.2 dev dummy1\n # ip nexthop add id 6 group 5\n # ip nexthop replace id 5 via 192.0.2.2 fdb\n # echo $?\n 0\n\nThis configuration is invalid and can result in a NPD [1] since FDB\nnexthops are not associated with a nexthop device:\n\n # ip route add 198.51.100.1/32 nhid 6\n # ping 198.51.100.1\n\nFix by preventing nexthop FDB status change while the nexthop is in a\ngroup:\n\n # ip nexthop add id 7 via 192.0.2.2 dev dummy1\n # ip nexthop add id 8 group 7\n # ip nexthop replace id 7 via 192.0.2.2 fdb\n Error: Cannot change nexthop FDB status while in a group.\n\n[1]\nBUG: kernel NULL pointer dereference, address: 00000000000003c0\n[...]\nOops: Oops: 0000 [#1] SMP\nCPU: 6 UID: 0 PID: 367 Comm: ping Not tainted 6.17.0-rc6-virtme-gb65678cacc03 #1 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014\nRIP: 0010:fib_lookup_good_nhc+0x1e/0x80\n[...]\nCall Trace:\n \u0026lt;TASK\u0026gt;\n fib_table_lookup+0x541/0x650\n ip_route_output_key_hash_rcu+0x2ea/0x970\n ip_route_output_key_hash+0x55/0x80\n __ip4_datagram_connect+0x250/0x330\n udp_connect+0x2b/0x60\n __sys_connect+0x9c/0xd0\n __x64_sys_connect+0x18/0x20\n do_syscall_64+0xa4/0x2a0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53(CVE-2025-39980)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipvs: Defer ip_vs_ftp unregister during netns cleanup\n\nOn the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp\nbefore connections with valid cp-\u0026gt;app pointers are flushed, leading to a\nuse-after-free.\n\nFix this by introducing a global `exiting_module` flag, set to true in\nip_vs_ftp_exit() before unregistering the pernet subsystem. In\n__ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns\ncleanup (when exiting_module is false) and defer it to\n__ip_vs_cleanup_batch(), which unregisters all apps after all connections\nare flushed. If called during module exit, unregister ip_vs_ftp\nimmediately.(CVE-2025-40018)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: hisilicon/qm - set NULL to qm-\u0026gt;debug.qm_diff_regs\n\nWhen the initialization of qm-\u0026gt;debug.acc_diff_reg fails,\nthe probe process does not exit. However, after qm-\u0026gt;debug.qm_diff_regs is\nfreed, it is not set to NULL. This can lead to a double free when the\nremove process attempts to free it again. Therefore, qm-\u0026gt;debug.qm_diff_regs\nshould be set to NULL after it is freed.(CVE-2025-40062)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Explicitly check accesses to bpf_sock_addr\n\nSyzkaller found a kernel warning on the following sock_addr program:\n\n    0: r0 = 0\n    1: r2 = *(u32 *)(r1 +60)\n    2: exit\n\nwhich triggers:\n\n    verifier bug: error during ctx access conversion (0)\n\nThis is happening because offset 60 in bpf_sock_addr corresponds to an\nimplicit padding of 4 bytes, right after msg_src_ip4. Access to this\npadding isn\u0026apos;t rejected in sock_addr_is_valid_access and it thus later\nfails to convert the access.\n\nThis patch fixes it by explicitly checking the various fields of\nbpf_sock_addr in sock_addr_is_valid_access.\n\nI checked the other ctx structures and is_valid_access functions and\ndidn\u0026apos;t find any other similar cases. Other cases of (properly handled)\npadding are covered in new tests in a subsequent patch.(CVE-2025-40078)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: hisilicon/qm - request reserved interrupt for virtual function\n\nThe device interrupt vector 3 is an error interrupt for\nphysical function and a reserved interrupt for virtual function.\nHowever, the driver has not registered the reserved interrupt for\nvirtual function. When allocating interrupts, the number of interrupts\nis allocated based on powers of two, which includes this interrupt.\nWhen the system enables GICv4 and the virtual function passthrough\nto the virtual machine, releasing the interrupt in the driver\ntriggers a warning.\n\nThe WARNING report is:\nWARNING: CPU: 62 PID: 14889 at arch/arm64/kvm/vgic/vgic-its.c:852 its_free_ite+0x94/0xb4\n\nTherefore, register a reserved interrupt for VF and set the\nIRQF_NO_AUTOEN flag to avoid that warning.(CVE-2025-40136)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsctp: avoid NULL dereference when chunk data buffer is missing\n\nchunk-\u0026gt;skb pointer is dereferenced in the if-block where it\u0026apos;s supposed\nto be NULL only.\n\nchunk-\u0026gt;skb can only be NULL if chunk-\u0026gt;head_skb is not. Check for frag_list\ninstead and do it just before replacing chunk-\u0026gt;skb. We\u0026apos;re sure that\notherwise chunk-\u0026gt;skb is non-NULL because of outer if() condition.(CVE-2025-40240)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: remove never-working support for setting nsh fields\n\nThe validation of the set(nsh(...)) action is completely wrong.\nIt runs through the nsh_key_put_from_nlattr() function that is the\nsame function that validates NSH keys for the flow match and the\npush_nsh() action.  However, the set(nsh(...)) has a very different\nmemory layout.  Nested attributes in there are doubled in size in\ncase of the masked set().  That makes proper validation impossible.\n\nThere is also confusion in the code between the \u0026apos;masked\u0026apos; flag, that\nsays that the nested attributes are doubled in size containing both\nthe value and the mask, and the \u0026apos;is_mask\u0026apos; that says that the value\nwe\u0026apos;re parsing is the mask.  This is causing kernel crash on trying to\nwrite into mask part of the match with SW_FLOW_KEY_PUT() during\nvalidation, while validate_nsh() doesn\u0026apos;t allocate any memory for it:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000018\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  PGD 1c2383067 P4D 1c2383067 PUD 20b703067 PMD 0\n  Oops: Oops: 0000 [#1] SMP NOPTI\n  CPU: 8 UID: 0 Kdump: loaded Not tainted 6.17.0-rc4+ #107 PREEMPT(voluntary)\n  RIP: 0010:nsh_key_put_from_nlattr+0x19d/0x610 [openvswitch]\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   validate_nsh+0x60/0x90 [openvswitch]\n   validate_set.constprop.0+0x270/0x3c0 [openvswitch]\n   __ovs_nla_copy_actions+0x477/0x860 [openvswitch]\n   ovs_nla_copy_actions+0x8d/0x100 [openvswitch]\n   ovs_packet_cmd_execute+0x1cc/0x310 [openvswitch]\n   genl_family_rcv_msg_doit+0xdb/0x130\n   genl_family_rcv_msg+0x14b/0x220\n   genl_rcv_msg+0x47/0xa0\n   netlink_rcv_skb+0x53/0x100\n   genl_rcv+0x24/0x40\n   netlink_unicast+0x280/0x3b0\n   netlink_sendmsg+0x1f7/0x430\n   ____sys_sendmsg+0x36b/0x3a0\n   ___sys_sendmsg+0x87/0xd0\n   __sys_sendmsg+0x6d/0xd0\n   do_syscall_64+0x7b/0x2c0\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nThe third issue with this process is that while trying to convert\nthe non-masked set into masked one, validate_set() copies and doubles\nthe size of the OVS_KEY_ATTR_NSH as if it didn\u0026apos;t have any nested\nattributes.  It should be copying each nested attribute and doubling\nthem in size independently.  And the process must be properly reversed\nduring the conversion back from masked to a non-masked variant during\nthe flow dump.\n\nIn the end, the only two outcomes of trying to use this action are\neither validation failure or a kernel crash.  And if somehow someone\nmanages to install a flow with such an action, it will most definitely\nnot do what it is supposed to, since all the keys and the masks are\nmixed up.\n\nFixing all the issues is a complex task as it requires re-writing\nmost of the validation code.\n\nGiven that and the fact that this functionality never worked since\nintroduction, let\u0026apos;s just remove it altogether.  It\u0026apos;s better to\nre-introduce it later with a proper implementation instead of trying\nto fix it in stable releases.(CVE-2025-40254)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntipc: Fix use-after-free in tipc_mon_reinit_self().\n\nsyzbot reported use-after-free of tipc_net(net)-\u0026gt;monitors[]\nin tipc_mon_reinit_self(). [0]\n\nThe array is protected by RTNL, but tipc_mon_reinit_self()\niterates over it without RTNL.\n\ntipc_mon_reinit_self() is called from tipc_net_finalize(),\nwhich is always under RTNL except for tipc_net_finalize_work().\n\nLet\u0026apos;s hold RTNL in tipc_net_finalize_work().\n\n[0]:\nBUG: KASAN: slab-use-after-free in __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]\nBUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162\nRead of size 1 at addr ffff88805eae1030 by task kworker/0:7/5989\n\nCPU: 0 UID: 0 PID: 5989 Comm: kworker/0:7 Not tainted syzkaller #0 PREEMPT_{RT,(full)}\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025\nWorkqueue: events tipc_net_finalize_work\nCall Trace:\n \u0026lt;TASK\u0026gt;\n dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xca/0x240 mm/kasan/report.c:482\n kasan_report+0x118/0x150 mm/kasan/report.c:595\n __kasan_check_byte+0x2a/0x40 mm/kasan/common.c:568\n kasan_check_byte include/linux/kasan.h:399 [inline]\n lock_acquire+0x8d/0x360 kernel/locking/lockdep.c:5842\n __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]\n _raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162\n rtlock_slowlock kernel/locking/rtmutex.c:1894 [inline]\n rwbase_rtmutex_lock_state kernel/locking/spinlock_rt.c:160 [inline]\n rwbase_write_lock+0xd3/0x7e0 kernel/locking/rwbase_rt.c:244\n rt_write_lock+0x76/0x110 kernel/locking/spinlock_rt.c:243\n write_lock_bh include/linux/rwlock_rt.h:99 [inline]\n tipc_mon_reinit_self+0x79/0x430 net/tipc/monitor.c:718\n tipc_net_finalize+0x115/0x190 net/tipc/net.c:140\n process_one_work kernel/workqueue.c:3236 [inline]\n process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3319\n worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400\n kthread+0x70e/0x8a0 kernel/kthread.c:463\n ret_from_fork+0x439/0x7d0 arch/x86/kernel/process.c:148\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n \u0026lt;/TASK\u0026gt;\n\nAllocated by task 6089:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x3e/0x80 mm/kasan/common.c:68\n poison_kmalloc_redzone mm/kasan/common.c:388 [inline]\n __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:405\n kasan_kmalloc include/linux/kasan.h:260 [inline]\n __kmalloc_cache_noprof+0x1a8/0x320 mm/slub.c:4407\n kmalloc_noprof include/linux/slab.h:905 [inline]\n kzalloc_noprof include/linux/slab.h:1039 [inline]\n tipc_mon_create+0xc3/0x4d0 net/tipc/monitor.c:657\n tipc_enable_bearer net/tipc/bearer.c:357 [inline]\n __tipc_nl_bearer_enable+0xe16/0x13f0 net/tipc/bearer.c:1047\n __tipc_nl_compat_doit net/tipc/netlink_compat.c:371 [inline]\n tipc_nl_compat_doit+0x3bc/0x5f0 net/tipc/netlink_compat.c:393\n tipc_nl_compat_handle net/tipc/netlink_compat.c:-1 [inline]\n tipc_nl_compat_recv+0x83c/0xbe0 net/tipc/netlink_compat.c:1321\n genl_family_rcv_msg_doit+0x215/0x300 net/netlink/genetlink.c:1115\n genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]\n genl_rcv_msg+0x60e/0x790 net/netlink/genetlink.c:1210\n netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552\n genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219\n netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]\n netlink_unicast+0x846/0xa10 net/netlink/af_netlink.c:1346\n netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896\n sock_sendmsg_nosec net/socket.c:714 [inline]\n __sock_sendmsg+0x21c/0x270 net/socket.c:729\n ____sys_sendmsg+0x508/0x820 net/socket.c:2614\n ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668\n __sys_sendmsg net/socket.c:2700 [inline]\n __do_sys_sendmsg net/socket.c:2705 [inline]\n __se_sys_sendmsg net/socket.c:2703 [inline]\n __x64_sys_sendmsg+0x1a1/0x260 net/socket.c:2703\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xfa/0x3b0 arch/\n---truncated---(CVE-2025-40280)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto\n\nsyzbot reported a possible shift-out-of-bounds [1]\n\nBlamed commit added rto_alpha_max and rto_beta_max set to 1000.\n\nIt is unclear if some sctp users are setting very large rto_alpha\nand/or rto_beta.\n\nIn order to prevent user regression, perform the test at run time.\n\nAlso add READ_ONCE() annotations as sysctl values can change under us.\n\n[1]\n\nUBSAN: shift-out-of-bounds in net/sctp/transport.c:509:41\nshift exponent 64 is too large for 32-bit type \u0026apos;unsigned int\u0026apos;\nCPU: 0 UID: 0 PID: 16704 Comm: syz.2.2320 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025\nCall Trace:\n \u0026lt;TASK\u0026gt;\n  __dump_stack lib/dump_stack.c:94 [inline]\n  dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120\n  ubsan_epilogue lib/ubsan.c:233 [inline]\n  __ubsan_handle_shift_out_of_bounds+0x27f/0x420 lib/ubsan.c:494\n  sctp_transport_update_rto.cold+0x1c/0x34b net/sctp/transport.c:509\n  sctp_check_transmitted+0x11c4/0x1c30 net/sctp/outqueue.c:1502\n  sctp_outq_sack+0x4ef/0x1b20 net/sctp/outqueue.c:1338\n  sctp_cmd_process_sack net/sctp/sm_sideeffect.c:840 [inline]\n  sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1372 [inline](CVE-2025-40281)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsctp: Prevent TOCTOU out-of-bounds write\n\nFor the following path not holding the sock lock,\n\n  sctp_diag_dump() -\u0026gt; sctp_for_each_endpoint() -\u0026gt; sctp_ep_dump()\n\nmake sure not to exceed bounds in case the address list has grown\nbetween buffer allocation (time-of-check) and write (time-of-use).(CVE-2025-40331)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: replace BUG_ON with bounds check for map-\u0026gt;max_osd\n\nOSD indexes come from untrusted network packets. Boundary checks are\nadded to validate these against map-\u0026gt;max_osd.\n\n[ idryomov: drop BUG_ON in ceph_get_primary_affinity(), minor cosmetic\n  edits ](CVE-2025-68283)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: prevent potential out-of-bounds writes in handle_auth_session_key()\n\nThe len field originates from untrusted network packets. Boundary\nchecks have been added to prevent potential out-of-bounds writes when\ndecrypting the connection secret or processing service tickets.\n\n[ idryomov: changelog ](CVE-2025-68284)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: fix potential use-after-free in have_mon_and_osd_map()\n\nThe wait loop in __ceph_open_session() can race with the client\nreceiving a new monmap or osdmap shortly after the initial map is\nreceived.  Both ceph_monc_handle_map() and handle_one_map() install\na new map immediately after freeing the old one\n\n    kfree(monc-\u0026gt;monmap);\n    monc-\u0026gt;monmap = monmap;\n\n    ceph_osdmap_destroy(osdc-\u0026gt;osdmap);\n    osdc-\u0026gt;osdmap = newmap;\n\nunder client-\u0026gt;monc.mutex and client-\u0026gt;osdc.lock respectively, but\nbecause neither is taken in have_mon_and_osd_map() it\u0026apos;s possible for\nclient-\u0026gt;monc.monmap-\u0026gt;epoch and client-\u0026gt;osdc.osdmap-\u0026gt;epoch arms in\n\n    client-\u0026gt;monc.monmap \u0026amp;\u0026amp; client-\u0026gt;monc.monmap-\u0026gt;epoch \u0026amp;\u0026amp;\n        client-\u0026gt;osdc.osdmap \u0026amp;\u0026amp; client-\u0026gt;osdc.osdmap-\u0026gt;epoch;\n\ncondition to dereference an already freed map.  This happens to be\nreproducible with generic/395 and generic/397 with KASAN enabled:\n\n    BUG: KASAN: slab-use-after-free in have_mon_and_osd_map+0x56/0x70\n    Read of size 4 at addr ffff88811012d810 by task mount.ceph/13305\n    CPU: 2 UID: 0 PID: 13305 Comm: mount.ceph Not tainted 6.14.0-rc2-build2+ #1266\n    ...\n    Call Trace:\n    \u0026lt;TASK\u0026gt;\n    have_mon_and_osd_map+0x56/0x70\n    ceph_open_session+0x182/0x290\n    ceph_get_tree+0x333/0x680\n    vfs_get_tree+0x49/0x180\n    do_new_mount+0x1a3/0x2d0\n    path_mount+0x6dd/0x730\n    do_mount+0x99/0xe0\n    __do_sys_mount+0x141/0x180\n    do_syscall_64+0x9f/0x100\n    entry_SYSCALL_64_after_hwframe+0x76/0x7e\n    \u0026lt;/TASK\u0026gt;\n\n    Allocated by task 13305:\n    ceph_osdmap_alloc+0x16/0x130\n    ceph_osdc_init+0x27a/0x4c0\n    ceph_create_client+0x153/0x190\n    create_fs_client+0x50/0x2a0\n    ceph_get_tree+0xff/0x680\n    vfs_get_tree+0x49/0x180\n    do_new_mount+0x1a3/0x2d0\n    path_mount+0x6dd/0x730\n    do_mount+0x99/0xe0\n    __do_sys_mount+0x141/0x180\n    do_syscall_64+0x9f/0x100\n    entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\n    Freed by task 9475:\n    kfree+0x212/0x290\n    handle_one_map+0x23c/0x3b0\n    ceph_osdc_handle_map+0x3c9/0x590\n    mon_dispatch+0x655/0x6f0\n    ceph_con_process_message+0xc3/0xe0\n    ceph_con_v1_try_read+0x614/0x760\n    ceph_con_workfn+0x2de/0x650\n    process_one_work+0x486/0x7c0\n    process_scheduled_works+0x73/0x90\n    worker_thread+0x1c8/0x2a0\n    kthread+0x2ec/0x300\n    ret_from_fork+0x24/0x40\n    ret_from_fork_asm+0x1a/0x30\n\nRewrite the wait loop to check the above condition directly with\nclient-\u0026gt;monc.mutex and client-\u0026gt;osdc.lock taken as appropriate.  While\nat it, improve the timeout handling (previously mount_timeout could be\nexceeded in case wait_event_interruptible_timeout() slept more than\nonce) and access client-\u0026gt;auth_err under client-\u0026gt;monc.mutex to match\nhow it\u0026apos;s set in finish_auth().\n\nmonmap_show() and osdmap_show() now take the respective lock before\naccessing the map as well.(CVE-2025-68285)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_core: lookup hci_conn on RX path on protocol side\n\nThe hdev lock/lookup/unlock/use pattern in the packet RX path doesn\u0026apos;t\nensure hci_conn* is not concurrently modified/deleted. This locking\nappears to be leftover from before conn_hash started using RCU\ncommit bf4c63252490b (\u0026quot;Bluetooth: convert conn hash to RCU\u0026quot;)\nand not clear if it had purpose since then.\n\nCurrently, there are code paths that delete hci_conn* from elsewhere\nthan the ordered hdev-\u0026gt;workqueue where the RX work runs in. E.g.\ncommit 5af1f84ed13a (\u0026quot;Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync\u0026quot;)\nintroduced some of these, and there probably were a few others before\nit.  It\u0026apos;s better to do the locking so that even if these run\nconcurrently no UAF is possible.\n\nMove the lookup of hci_conn and associated socket-specific conn to\nprotocol recv handlers, and do them within a single critical section\nto cover hci_conn* usage and lookup.\n\nsyzkaller has reported a crash that appears to be this issue:\n\n    [Task hdev-\u0026gt;workqueue]          [Task 2]\n                                    hci_disconnect_all_sync\n    l2cap_recv_acldata(hcon)\n                                      hci_conn_get(hcon)\n                                      hci_abort_conn_sync(hcon)\n                                        hci_dev_lock\n      hci_dev_lock\n                                        hci_conn_del(hcon)\n      v-------------------------------- hci_dev_unlock\n                                      hci_conn_put(hcon)\n      conn = hcon-\u0026gt;l2cap_data (UAF)(CVE-2025-68304)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nima: Handle error code returned by ima_filter_rule_match()\n\nIn ima_match_rules(), if ima_filter_rule_match() returns -ENOENT due to\nthe rule being NULL, the function incorrectly skips the \u0026apos;if (!rc)\u0026apos; check\nand sets \u0026apos;result = true\u0026apos;. The LSM rule is considered a match, causing\nextra files to be measured by IMA.\n\nThis issue can be reproduced in the following scenario:\nAfter unloading the SELinux policy module via \u0026apos;semodule -d\u0026apos;, if an IMA\nmeasurement is triggered before ima_lsm_rules is updated,\nin ima_match_rules(), the first call to ima_filter_rule_match() returns\n-ESTALE. This causes the code to enter the \u0026apos;if (rc == -ESTALE \u0026amp;\u0026amp;\n!rule_reinitialized)\u0026apos; block, perform ima_lsm_copy_rule() and retry. In\nima_lsm_copy_rule(), since the SELinux module has been removed, the rule\nbecomes NULL, and the second call to ima_filter_rule_match() returns\n-ENOENT. This bypasses the \u0026apos;if (!rc)\u0026apos; check and results in a false match.\n\nCall trace:\n  selinux_audit_rule_match+0x310/0x3b8\n  security_audit_rule_match+0x60/0xa0\n  ima_match_rules+0x2e4/0x4a0\n  ima_match_policy+0x9c/0x1e8\n  ima_get_action+0x48/0x60\n  process_measurement+0xf8/0xa98\n  ima_bprm_check+0x98/0xd8\n  security_bprm_check+0x5c/0x78\n  search_binary_handler+0x6c/0x318\n  exec_binprm+0x58/0x1b8\n  bprm_execve+0xb8/0x130\n  do_execveat_common.isra.0+0x1a8/0x258\n  __arm64_sys_execve+0x48/0x68\n  invoke_syscall+0x50/0x128\n  el0_svc_common.constprop.0+0xc8/0xf0\n  do_el0_svc+0x24/0x38\n  el0_svc+0x44/0x200\n  el0t_64_sync_handler+0x100/0x130\n  el0t_64_sync+0x3c8/0x3d0\n\nFix this by changing \u0026apos;if (!rc)\u0026apos; to \u0026apos;if (rc \u0026lt;= 0)\u0026apos; to ensure that error\ncodes like -ENOENT do not bypass the check and accidentally result in a\nsuccessful match.(CVE-2025-68740)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix invalid prog-\u0026gt;stats access when update_effective_progs fails\n\nSyzkaller triggers an invalid memory access issue following fault\ninjection in update_effective_progs. The issue can be described as\nfollows:\n\n__cgroup_bpf_detach\n  update_effective_progs\n    compute_effective_progs\n      bpf_prog_array_alloc \u0026lt;-- fault inject\n  purge_effective_progs\n    /* change to dummy_bpf_prog */\n    array-\u0026gt;items[index] = \u0026amp;dummy_bpf_prog.prog\n\n---softirq start---\n__do_softirq\n  ...\n    __cgroup_bpf_run_filter_skb\n      __bpf_prog_run_save_cb\n        bpf_prog_run\n          stats = this_cpu_ptr(prog-\u0026gt;stats)\n          /* invalid memory access */\n          flags = u64_stats_update_begin_irqsave(\u0026amp;stats-\u0026gt;syncp)\n---softirq end---\n\n  static_branch_dec(\u0026amp;cgroup_bpf_enabled_key[atype])\n\nThe reason is that fault injection caused update_effective_progs to fail\nand then changed the original prog into dummy_bpf_prog.prog in\npurge_effective_progs. Then a softirq came, and accessing the members of\ndummy_bpf_prog.prog in the softirq triggers invalid mem access.\n\nTo fix it, skip updating stats when stats is NULL.(CVE-2025-68742)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nethtool: Avoid overflowing userspace buffer on stats query\n\nThe ethtool -S command operates across three ioctl calls:\nETHTOOL_GSSET_INFO for the size, ETHTOOL_GSTRINGS for the names, and\nETHTOOL_GSTATS for the values.\n\nIf the number of stats changes between these calls (e.g., due to device\nreconfiguration), userspace\u0026apos;s buffer allocation will be incorrect,\npotentially leading to buffer overflow.\n\nDrivers are generally expected to maintain stable stat counts, but some\ndrivers (e.g., mlx5, bnx2x, bna, ksz884x) use dynamic counters, making\nthis scenario possible.\n\nSome drivers try to handle this internally:\n- bnad_get_ethtool_stats() returns early in case stats.n_stats is not\n  equal to the driver\u0026apos;s stats count.\n- micrel/ksz884x also makes sure not to write anything beyond\n  stats.n_stats and overflow the buffer.\n\nHowever, both use stats.n_stats which is already assigned with the value\nreturned from get_sset_count(), hence won\u0026apos;t solve the issue described\nhere.\n\nChange ethtool_get_strings(), ethtool_get_stats(),\nethtool_get_phy_stats() to not return anything in case of a mismatch\nbetween userspace\u0026apos;s size and get_sset_size(), to prevent buffer\noverflow.\nThe returned n_stats value will be equal to zero, to reflect that\nnothing has been returned.\n\nThis could result in one of two cases when using upstream ethtool,\ndepending on when the size change is detected:\n1. When detected in ethtool_get_strings():\n    # ethtool -S eth2\n    no stats available\n\n2. When detected in get stats, all stats will be reported as zero.\n\nBoth cases are presumably transient, and a subsequent ethtool call\nshould succeed.\n\nOther than the overflow avoidance, these two cases are very evident (no\noutput/cleared stats), which is arguably better than presenting\nincorrect/shifted stats.\nI also considered returning an error instead of a \u0026quot;silent\u0026quot; response, but\nthat seems more destructive towards userspace apps.\n\nNotes:\n- This patch does not claim to fix the inherent race, it only makes sure\n  that we do not overflow the userspace buffer, and makes for a more\n  predictable behavior.\n\n- RTNL lock is held during each ioctl, the race window exists between\n  the separate ioctl calls when the lock is released.\n\n- Userspace ethtool always fills stats.n_stats, but it is likely that\n  these stats ioctls are implemented in other userspace applications\n  which might not fill it. The added code checks that it\u0026apos;s not zero,\n  to prevent any regressions.(CVE-2025-68795)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\next4: xattr: fix null pointer deref in ext4_raw_inode()\n\nIf ext4_get_inode_loc() fails (e.g. if it returns -EFSCORRUPTED),\niloc.bh will remain set to NULL. Since ext4_xattr_inode_dec_ref_all()\nlacks error checking, this will lead to a null pointer dereference\nin ext4_raw_inode(), called right after ext4_get_inode_loc().\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2025-68820)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: hns3: using the num_tqps in the vf driver to apply for resources\n\nCurrently, hdev-\u0026gt;htqp is allocated using hdev-\u0026gt;num_tqps, and kinfo-\u0026gt;tqp\nis allocated using kinfo-\u0026gt;num_tqps. However, kinfo-\u0026gt;num_tqps is set to\nmin(new_tqps, hdev-\u0026gt;num_tqps);  Therefore, kinfo-\u0026gt;num_tqps may be smaller\nthan hdev-\u0026gt;num_tqps, which causes some hdev-\u0026gt;htqp[i] to remain\nuninitialized in hclgevf_knic_setup().\n\nThus, this patch allocates hdev-\u0026gt;htqp and kinfo-\u0026gt;tqp using hdev-\u0026gt;num_tqps,\nensuring that the lengths of hdev-\u0026gt;htqp and kinfo-\u0026gt;tqp are consistent\nand that all elements are properly initialized.(CVE-2025-71064)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset\n\n`qfq_class-\u0026gt;leaf_qdisc-\u0026gt;q.qlen \u0026gt; 0` does not imply that the class\nitself is active.\n\nTwo qfq_class objects may point to the same leaf_qdisc. This happens\nwhen:\n\n1. one QFQ qdisc is attached to the dev as the root qdisc, and\n\n2. another QFQ qdisc is temporarily referenced (e.g., via qdisc_get()\n/ qdisc_put()) and is pending to be destroyed, as in function\ntc_new_tfilter.\n\nWhen packets are enqueued through the root QFQ qdisc, the shared\nleaf_qdisc-\u0026gt;q.qlen increases. At the same time, the second QFQ\nqdisc triggers qdisc_put and qdisc_destroy: the qdisc enters\nqfq_reset() with its own q-\u0026gt;q.qlen == 0, but its class\u0026apos;s leaf\nqdisc-\u0026gt;q.qlen \u0026gt; 0. Therefore, the qfq_reset would wrongly deactivate\nan inactive aggregate and trigger a null-deref in qfq_deactivate_agg:\n\n[    0.903172] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[    0.903571] #PF: supervisor write access in kernel mode\n[    0.903860] #PF: error_code(0x0002) - not-present page\n[    0.904177] PGD 10299b067 P4D 10299b067 PUD 10299c067 PMD 0\n[    0.904502] Oops: Oops: 0002 [#1] SMP NOPTI\n[    0.904737] CPU: 0 UID: 0 PID: 135 Comm: exploit Not tainted 6.19.0-rc3+ #2 NONE\n[    0.905157] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014\n[    0.905754] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:992 (discriminator 2) include/linux/list.h:1006 (discriminator 2) net/sched/sch_qfq.c:1367 (discriminator 2) net/sched/sch_qfq.c:1393 (discriminator 2))\n[    0.906046] Code: 0f 84 4d 01 00 00 48 89 70 18 8b 4b 10 48 c7 c2 ff ff ff ff 48 8b 78 08 48 d3 e2 48 21 f2 48 2b 13 48 8b 30 48 d3 ea 8b 4b 18 0\n\nCode starting with the faulting instruction\n===========================================\n   0:\t0f 84 4d 01 00 00    \tje     0x153\n   6:\t48 89 70 18          \tmov    %rsi,0x18(%rax)\n   a:\t8b 4b 10             \tmov    0x10(%rbx),%ecx\n   d:\t48 c7 c2 ff ff ff ff \tmov    $0xffffffffffffffff,%rdx\n  14:\t48 8b 78 08          \tmov    0x8(%rax),%rdi\n  18:\t48 d3 e2             \tshl    %cl,%rdx\n  1b:\t48 21 f2             \tand    %rsi,%rdx\n  1e:\t48 2b 13             \tsub    (%rbx),%rdx\n  21:\t48 8b 30             \tmov    (%rax),%rsi\n  24:\t48 d3 ea             \tshr    %cl,%rdx\n  27:\t8b 4b 18             \tmov    0x18(%rbx),%ecx\n\t...\n[    0.907095] RSP: 0018:ffffc900004a39a0 EFLAGS: 00010246\n[    0.907368] RAX: ffff8881043a0880 RBX: ffff888102953340 RCX: 0000000000000000\n[    0.907723] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\n[    0.908100] RBP: ffff888102952180 R08: 0000000000000000 R09: 0000000000000000\n[    0.908451] R10: ffff8881043a0000 R11: 0000000000000000 R12: ffff888102952000\n[    0.908804] R13: ffff888102952180 R14: ffff8881043a0ad8 R15: ffff8881043a0880\n[    0.909179] FS:  000000002a1a0380(0000) GS:ffff888196d8d000(0000) knlGS:0000000000000000\n[    0.909572] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[    0.909857] CR2: 0000000000000000 CR3: 0000000102993002 CR4: 0000000000772ef0\n[    0.910247] PKRU: 55555554\n[    0.910391] Call Trace:\n[    0.910527]  \u0026lt;TASK\u0026gt;\n[    0.910638]  qfq_reset_qdisc (net/sched/sch_qfq.c:357 net/sched/sch_qfq.c:1485)\n[    0.910826]  qdisc_reset (include/linux/skbuff.h:2195 include/linux/skbuff.h:2501 include/linux/skbuff.h:3424 include/linux/skbuff.h:3430 net/sched/sch_generic.c:1036)\n[    0.911040]  __qdisc_destroy (net/sched/sch_generic.c:1076)\n[    0.911236]  tc_new_tfilter (net/sched/cls_api.c:2447)\n[    0.911447]  rtnetlink_rcv_msg (net/core/rtnetlink.c:6958)\n[    0.911663]  ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6861)\n[    0.911894]  netlink_rcv_skb (net/netlink/af_netlink.c:2550)\n[    0.912100]  netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)\n[    0.912296]  ? __alloc_skb (net/core/skbuff.c:706)\n[    0.912484]  netlink_sendmsg (net/netlink/af\n---truncated---(CVE-2026-22976)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix reference count leak in bpf_prog_test_run_xdp()\n\nsyzbot is reporting\n\n  unregister_netdevice: waiting for sit0 to become free. Usage count = 2\n\nproblem. A debug printk() patch found that a refcount is obtained at\nxdp_convert_md_to_buff() from bpf_prog_test_run_xdp().\n\nAccording to commit ec94670fcb3b (\u0026quot;bpf: Support specifying ingress via\nxdp_md context in BPF_PROG_TEST_RUN\u0026quot;), the refcount obtained by\nxdp_convert_md_to_buff() will be released by xdp_convert_buff_to_md().\n\nTherefore, we can consider that the error handling path introduced by\ncommit 1c1949982524 (\u0026quot;bpf: introduce frags support to\nbpf_prog_test_run_xdp()\u0026quot;) forgot to call xdp_convert_buff_to_md().(CVE-2026-22994)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Fix a deadlock involving nfs_release_folio()\n\nWang Zhaolong reports a deadlock involving NFSv4.1 state recovery\nwaiting on kthreadd, which is attempting to reclaim memory by calling\nnfs_release_folio(). The latter cannot make progress due to state\nrecovery being needed.\n\nIt seems that the only safe thing to do here is to kick off a writeback\nof the folio, without waiting for completion, or else kicking off an\nasynchronous commit.(CVE-2026-23053)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nuacce: implement mremap in uacce_vm_ops to return -EPERM\n\nThe current uacce_vm_ops does not support the mremap operation of\nvm_operations_struct. Implement .mremap to return -EPERM to remind\nusers.\n\nThe reason we need to explicitly disable mremap is that when the\ndriver does not implement .mremap, it uses the default mremap\nmethod. This could lead to a risk scenario:\n\nAn application might first mmap address p1, then mremap to p2,\nfollowed by munmap(p1), and finally munmap(p2). Since the default\nmremap copies the original vma\u0026apos;s vm_private_data (i.e., q) to the\nnew vma, both munmap operations would trigger vma_close, causing\nq-\u0026gt;qfr to be freed twice(qfr will be set to null here, so repeated\nrelease is ok).(CVE-2026-23056)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nuacce: ensure safe queue release with state management\n\nDirectly calling `put_queue` carries risks since it cannot\nguarantee that resources of `uacce_queue` have been fully released\nbeforehand. So adding a `stop_queue` operation for the\nUACCE_CMD_PUT_Q command and leaving the `put_queue` operation to\nthe final resource release ensures safety.\n\nQueue states are defined as follows:\n- UACCE_Q_ZOMBIE: Initial state\n- UACCE_Q_INIT: After opening `uacce`\n- UACCE_Q_STARTED: After `start` is issued via `ioctl`\n\nWhen executing `poweroff -f` in virt while accelerator are still\nworking, `uacce_fops_release` and `uacce_remove` may execute\nconcurrently. This can cause `uacce_put_queue` within\n`uacce_fops_release` to access a NULL `ops` pointer. Therefore, add\nstate checks to prevent accessing freed pointers.(CVE-2026-23063)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmedia: dvb-core: fix wrong reinitialization of ringbuffer on reopen\n\ndvb_dvr_open() calls dvb_ringbuffer_init() when a new reader opens the\nDVR device.  dvb_ringbuffer_init() calls init_waitqueue_head(), which\nreinitializes the waitqueue list head to empty.\n\nSince dmxdev-\u0026gt;dvr_buffer.queue is a shared waitqueue (all opens of the\nsame DVR device share it), this orphans any existing waitqueue entries\nfrom io_uring poll or epoll, leaving them with stale prev/next pointers\nwhile the list head is reset to {self, self}.\n\nThe waitqueue and spinlock in dvr_buffer are already properly\ninitialized once in dvb_dmxdev_init().  The open path only needs to\nreset the buffer data pointer, size, and read/write positions.\n\nReplace the dvb_ringbuffer_init() call in dvb_dvr_open() with direct\nassignment of data/size and a call to dvb_ringbuffer_reset(), which\nproperly resets pread, pwrite, and error with correct memory ordering\nwithout touching the waitqueue or spinlock.(CVE-2026-23253)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nregmap: maple: free entry on mas_store_gfp() failure\n\nregcache_maple_write() allocates a new block (\u0026apos;entry\u0026apos;) to merge\nadjacent ranges and then stores it with mas_store_gfp().\nWhen mas_store_gfp() fails, the new \u0026apos;entry\u0026apos; remains allocated and\nis never freed, leaking memory.\n\nFree \u0026apos;entry\u0026apos; on the failure path; on success continue freeing the\nreplaced neighbor blocks (\u0026apos;lower\u0026apos;, \u0026apos;upper\u0026apos;).(CVE-2026-23260)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix unprivileged local user can do privileged policy management\n\nAn unprivileged local user can load, replace, and remove profiles by\nopening the apparmorfs interfaces, via a confused deputy attack, by\npassing the opened fd to a privileged process, and getting the\nprivileged process to write to the interface.\n\nThis does require a privileged target that can be manipulated to do\nthe write for the unprivileged process, but once such access is\nachieved full policy management is possible and all the possible\nimplications that implies: removing confinement, DoS of system or\ntarget applications by denying all execution, by-passing the\nunprivileged user namespace restriction, to exploiting kernel bugs for\na local privilege escalation.\n\nThe policy management interface can not have its permissions simply\nchanged from 0666 to 0600 because non-root processes need to be able\nto load policy to different policy namespaces.\n\nInstead ensure the task writing the interface has privileges that\nare a subset of the task that opened the interface. This is already\ndone via policy for confined processes, but unconfined can delegate\naccess to the opened fd, by-passing the usual policy check.(CVE-2026-23268)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nperf: Fix __perf_event_overflow() vs perf_remove_from_context() race\n\nMake sure that __perf_event_overflow() runs with IRQs disabled for all\npossible callchains. Specifically the software events can end up running\nit with only preemption disabled.\n\nThis opens up a race vs perf_event_exit_event() and friends that will go\nand free various things the overflow path expects to be present, like\nthe BPF program.(CVE-2026-23271)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmacvlan: observe an RCU grace period in macvlan_common_newlink() error path\n\nvalis reported that a race condition still happens after my prior patch.\n\nmacvlan_common_newlink() might have made @dev visible before\ndetecting an error, and its caller will directly call free_netdev(dev).\n\nWe must respect an RCU period, either in macvlan or the core networking\nstack.\n\nAfter adding a temporary mdelay(1000) in macvlan_forward_source_one()\nto open the race window, valis repro was:\n\nip link add p1 type veth peer p2\nip link set address 00:00:00:00:00:20 dev p1\nip link set up dev p1\nip link set up dev p2\nip link add mv0 link p2 type macvlan mode source\n\n(ip link add invalid% link p2 type macvlan mode source macaddr add\n00:00:00:00:00:20 \u0026amp;) ; sleep 0.5 ; ping -c1 -I p1 1.2.3.4\nPING 1.2.3.4 (1.2.3.4): 56 data bytes\nRTNETLINK answers: Invalid argument\n\nBUG: KASAN: slab-use-after-free in macvlan_forward_source\n(drivers/net/macvlan.c:408 drivers/net/macvlan.c:444)\nRead of size 8 at addr ffff888016bb89c0 by task e/175\n\nCPU: 1 UID: 1000 PID: 175 Comm: e Not tainted 6.19.0-rc8+ #33 NONE\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014\nCall Trace:\n\u0026lt;IRQ\u0026gt;\ndump_stack_lvl (lib/dump_stack.c:123)\nprint_report (mm/kasan/report.c:379 mm/kasan/report.c:482)\n? macvlan_forward_source (drivers/net/macvlan.c:408 drivers/net/macvlan.c:444)\nkasan_report (mm/kasan/report.c:597)\n? macvlan_forward_source (drivers/net/macvlan.c:408 drivers/net/macvlan.c:444)\nmacvlan_forward_source (drivers/net/macvlan.c:408 drivers/net/macvlan.c:444)\n? tasklet_init (kernel/softirq.c:983)\nmacvlan_handle_frame (drivers/net/macvlan.c:501)\n\nAllocated by task 169:\nkasan_save_stack (mm/kasan/common.c:58)\nkasan_save_track (./arch/x86/include/asm/current.h:25\nmm/kasan/common.c:70 mm/kasan/common.c:79)\n__kasan_kmalloc (mm/kasan/common.c:419)\n__kvmalloc_node_noprof (./include/linux/kasan.h:263 mm/slub.c:5657\nmm/slub.c:7140)\nalloc_netdev_mqs (net/core/dev.c:12012)\nrtnl_create_link (net/core/rtnetlink.c:3648)\nrtnl_newlink (net/core/rtnetlink.c:3830 net/core/rtnetlink.c:3957\nnet/core/rtnetlink.c:4072)\nrtnetlink_rcv_msg (net/core/rtnetlink.c:6958)\nnetlink_rcv_skb (net/netlink/af_netlink.c:2550)\nnetlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)\nnetlink_sendmsg (net/netlink/af_netlink.c:1894)\n__sys_sendto (net/socket.c:727 net/socket.c:742 net/socket.c:2206)\n__x64_sys_sendto (net/socket.c:2209)\ndo_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)\nentry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:131)\n\nFreed by task 169:\nkasan_save_stack (mm/kasan/common.c:58)\nkasan_save_track (./arch/x86/include/asm/current.h:25\nmm/kasan/common.c:70 mm/kasan/common.c:79)\nkasan_save_free_info (mm/kasan/generic.c:587)\n__kasan_slab_free (mm/kasan/common.c:287)\nkfree (mm/slub.c:6674 mm/slub.c:6882)\nrtnl_newlink (net/core/rtnetlink.c:3845 net/core/rtnetlink.c:3957\nnet/core/rtnetlink.c:4072)\nrtnetlink_rcv_msg (net/core/rtnetlink.c:6958)\nnetlink_rcv_skb (net/netlink/af_netlink.c:2550)\nnetlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)\nnetlink_sendmsg (net/netlink/af_netlink.c:1894)\n__sys_sendto (net/socket.c:727 net/socket.c:742 net/socket.c:2206)\n__x64_sys_sendto (net/socket.c:2209)\ndo_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)\nentry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:131)(CVE-2026-23273)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\next4: reject mount if bigalloc with s_first_data_block != 0\n\nbigalloc with s_first_data_block != 0 is not supported, reject mounting\nit.(CVE-2026-31447)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nHID: multitouch: Check to ensure report responses match the request\n\nIt is possible for a malicious (or clumsy) device to respond to a\nspecific report\u0026apos;s feature request using a completely different report\nID.  This can cause confusion in the HID core resulting in nasty\nside-effects such as OOB writes.\n\nAdd a check to ensure that the report ID in the response, matches the\none that was requested.  If it doesn\u0026apos;t, omit reporting the raw event and\nreturn early.(CVE-2026-43047)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: Mitigate potential OOB by removing bogus memset()\n\nThe memset() in hid_report_raw_event() has the good intention of\nclearing out bogus data by zeroing the area from the end of the incoming\ndata string to the assumed end of the buffer.  However, as we have\npreviously seen, doing so can easily result in OOB reads and writes in\nthe subsequent thread of execution.\n\nThe current suggestion from one of the HID maintainers is to remove the\nmemset() and simply return if the incoming event buffer size is not\nlarge enough to fill the associated report.\n\nSuggested-by Benjamin Tissoires \u0026lt;(CVE-2026-43048)\n\nIn the Linux kernel, there is a potential out-of-bounds access vulnerability in the ceph_handle_auth_reply() function of the libceph component. When processing messages of type CEPH_MSG_AUTH_REPLY, the value of the payload_len field is stored in a variable of type int. A value greater than INT_MAX leads to integer overflow and is interpreted as a negative value, which causes the pointer address to be decremented and subsequently accessed because ceph_decode_need() only checks that the memory access does not exceed the end address of the allocation. The vulnerability is fixed by changing the data type of payload_len to u32 and introducing additional sanity checks.(CVE-2026-43407)","status":"published","published":"2026-05-22T11:11:22Z","modified":"2026-08-18T01:20:03.128754584Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2418","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\n\nIn the Linux kernel, the following vulnerability has been resolved:mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MMWe currently assume that there is at least one VMA in a MM, which isn ttrue.So we might end up having find_vma() return NULL, to then de-referenceNULL.  So properly handle find_vma() returning NULL.This fixes the report:Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTIKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]CPU: 1 UID: 0 PID: 6021 Comm: syz-executor284 Not tainted 6.12.0-rc7-syzkaller-00187-gf868cd251776 #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024RIP: 0010:migrate_to_node mm/mempolicy.c:1090 [inline]RIP: 0010:do_migrate_pages+0x403/0x6f0 mm/mempolicy.c:1194Code: ...RSP: 0018:ffffc9000375fd08 EFLAGS: 00010246RAX: 0000000000000000 RBX: ffffc9000375fd78 RCX: 0000000000000000RDX: ffff88807e171300 RSI: dffffc0000000000 RDI: ffff88803390c044RBP: ffff88807e171428 R08: 0000000000000014 R09: fffffbfff2039ef1R10: ffffffff901cf78f R11: 0000000000000000 R12: 0000000000000003R13: ffffc9000375fe90 R14: ffffc9000375fe98 R15: ffffc9000375fdf8FS:  00005555919e1380(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033CR2: 00005555919e1ca8 CR3: 000000007f12a000 CR4: 00000000003526f0DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400Call Trace: \u0026lt;TASK\u0026gt; kernel_migrate_pages+0x5b2/0x750 mm/mempolicy.c:1709 __do_sys_migrate_pages mm/mempolicy.c:1727 [inline] __se_sys_migrate_pages mm/mempolicy.c:1723 [inline] __x64_sys_migrate_pages+0x96/0x100 mm/mempolicy.c:1723 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f[akpm@linux-foundation.org: add unlikely()](CVE-2024-56611)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nPCI/MSI: Handle lack of irqdomain gracefully\n\nAlexandre observed a warning emitted from pci_msi_setup_msi_irqs() on a\nRISCV platform which does not provide PCI/MSI support:\n\n WARNING: CPU: 1 PID: 1 at drivers/pci/msi/msi.h:121 pci_msi_setup_msi_irqs+0x2c/0x32\n __pci_enable_msix_range+0x30c/0x596\n pci_msi_setup_msi_irqs+0x2c/0x32\n pci_alloc_irq_vectors_affinity+0xb8/0xe2\n\nRISCV uses hierarchical interrupt domains and correctly does not implement\nthe legacy fallback. The warning triggers from the legacy fallback stub.\n\nThat warning is bogus as the PCI/MSI layer knows whether a PCI/MSI parent\ndomain is associated with the device or not. There is a check for MSI-X,\nwhich has a legacy assumption. But that legacy fallback assumption is only\nvalid when legacy support is enabled, but otherwise the check should simply\nreturn -ENOTSUPP.\n\nLoongarch tripped over the same problem and blindly enabled legacy support\nwithout implementing the legacy fallbacks. There are weak implementations\nwhich return an error, so the problem was papered over.\n\nCorrect pci_msi_domain_supports() to evaluate the legacy mode and add\nthe missing supported check into the MSI enable path to complete it.(CVE-2024-56760)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFS: fix nfs_release_folio() to not deadlock via kcompactd writeback\n\nAdd PF_KCOMPACTD flag and current_is_kcompactd() helper to check for it so\nnfs_release_folio() can skip calling nfs_wb_folio() from kcompactd.\n\nOtherwise NFS can deadlock waiting for kcompactd enduced writeback which\nrecurses back to NFS (which triggers writeback to NFSD via NFS loopback\nmount on the same host, NFSD blocks waiting for XFS\u0026apos;s call to\n__filemap_get_folio):\n\n6070.550357] INFO: task kcompactd0:58 blocked for more than 4435 seconds.\n\n{---\n[58] \u0026quot;kcompactd0\u0026quot;\n[\u0026lt;0\u0026gt;] folio_wait_bit+0xe8/0x200\n[\u0026lt;0\u0026gt;] folio_wait_writeback+0x2b/0x80\n[\u0026lt;0\u0026gt;] nfs_wb_folio+0x80/0x1b0 [nfs]\n[\u0026lt;0\u0026gt;] nfs_release_folio+0x68/0x130 [nfs]\n[\u0026lt;0\u0026gt;] split_huge_page_to_list_to_order+0x362/0x840\n[\u0026lt;0\u0026gt;] migrate_pages_batch+0x43d/0xb90\n[\u0026lt;0\u0026gt;] migrate_pages_sync+0x9a/0x240\n[\u0026lt;0\u0026gt;] migrate_pages+0x93c/0x9f0\n[\u0026lt;0\u0026gt;] compact_zone+0x8e2/0x1030\n[\u0026lt;0\u0026gt;] compact_node+0xdb/0x120\n[\u0026lt;0\u0026gt;] kcompactd+0x121/0x2e0\n[\u0026lt;0\u0026gt;] kthread+0xcf/0x100\n[\u0026lt;0\u0026gt;] ret_from_fork+0x31/0x40\n[\u0026lt;0\u0026gt;] ret_from_fork_asm+0x1a/0x30\n---}\n\n[(CVE-2025-21908)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nhwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio\n\nCommit b15c87263a69 (\u0026quot;hwpoison, memory_hotplug: allow hwpoisoned pages to\nbe offlined) add page poison checks in do_migrate_range in order to make\noffline hwpoisoned page possible by introducing isolate_lru_page and\ntry_to_unmap for hwpoisoned page.  However folio lock must be held before\ncalling try_to_unmap.  Add it to fix this problem.\n\nWarning will be produced if folio is not locked during unmap:\n\n  ------------[ cut here ]------------\n  kernel BUG at ./include/linux/swapops.h:400!\n  Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP\n  Modules linked in:\n  CPU: 4 UID: 0 PID: 411 Comm: bash Tainted: G        W          6.13.0-rc1-00016-g3c434c7ee82a-dirty #41\n  Tainted: [W]=WARN\n  Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0 02/06/2015\n  pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n  pc : try_to_unmap_one+0xb08/0xd3c\n  lr : try_to_unmap_one+0x3dc/0xd3c\n  Call trace:\n   try_to_unmap_one+0xb08/0xd3c (P)\n   try_to_unmap_one+0x3dc/0xd3c (L)\n   rmap_walk_anon+0xdc/0x1f8\n   rmap_walk+0x3c/0x58\n   try_to_unmap+0x88/0x90\n   unmap_poisoned_folio+0x30/0xa8\n   do_migrate_range+0x4a0/0x568\n   offline_pages+0x5a4/0x670\n   memory_block_action+0x17c/0x374\n   memory_subsys_offline+0x3c/0x78\n   device_offline+0xa4/0xd0\n   state_store+0x8c/0xf0\n   dev_attr_store+0x18/0x2c\n   sysfs_kf_write+0x44/0x54\n   kernfs_fop_write_iter+0x118/0x1a8\n   vfs_write+0x3a8/0x4bc\n   ksys_write+0x6c/0xf8\n   __arm64_sys_write+0x1c/0x28\n   invoke_syscall+0x44/0x100\n   el0_svc_common.constprop.0+0x40/0xe0\n   do_el0_svc+0x1c/0x28\n   el0_svc+0x30/0xd0\n   el0t_64_sync_handler+0xc8/0xcc\n   el0t_64_sync+0x198/0x19c\n  Code: f9407be0 b5fff320 d4210000 17ffff97 (d4210000)\n  ---[ end trace 0000000000000000 ]---(CVE-2025-21931)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Bridge, fix the crash caused by LAG state check\n\nWhen removing LAG device from bridge, NETDEV_CHANGEUPPER event is\ntriggered. Driver finds the lower devices (PFs) to flush all the\noffloaded entries. And mlx5_lag_is_shared_fdb is checked, it returns\nfalse if one of PF is unloaded. In such case,\nmlx5_esw_bridge_lag_rep_get() and its caller return NULL, instead of\nthe alive PF, and the flush is skipped.\n\nBesides, the bridge fdb entry\u0026apos;s lastuse is updated in mlx5 bridge\nevent handler. But this SWITCHDEV_FDB_ADD_TO_BRIDGE event can be\nignored in this case because the upper interface for bond is deleted,\nand the entry will never be aged because lastuse is never updated.\n\nTo make things worse, as the entry is alive, mlx5 bridge workqueue\nkeeps sending that event, which is then handled by kernel bridge\nnotifier. It causes the following crash when accessing the passed bond\nnetdev which is already destroyed.\n\nTo fix this issue, remove such checks. LAG state is already checked in\ncommit 15f8f168952f (\u0026quot;net/mlx5: Bridge, verify LAG state when adding\nbond to bridge\u0026quot;), driver still need to skip offload if LAG becomes\ninvalid state after initialization.\n\n Oops: stack segment: 0000 [#1] SMP\n CPU: 3 UID: 0 PID: 23695 Comm: kworker/u40:3 Tainted: G           OE      6.11.0_mlnx #1\n Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n Workqueue: mlx5_bridge_wq mlx5_esw_bridge_update_work [mlx5_core]\n RIP: 0010:br_switchdev_event+0x2c/0x110 [bridge]\n Code: 44 00 00 48 8b 02 48 f7 00 00 02 00 00 74 69 41 54 55 53 48 83 ec 08 48 8b a8 08 01 00 00 48 85 ed 74 4a 48 83 fe 02 48 89 d3 \u0026lt;4c\u0026gt; 8b 65 00 74 23 76 49 48 83 fe 05 74 7e 48 83 fe 06 75 2f 0f b7\n RSP: 0018:ffffc900092cfda0 EFLAGS: 00010297\n RAX: ffff888123bfe000 RBX: ffffc900092cfe08 RCX: 00000000ffffffff\n RDX: ffffc900092cfe08 RSI: 0000000000000001 RDI: ffffffffa0c585f0\n RBP: 6669746f6e690a30 R08: 0000000000000000 R09: ffff888123ae92c8\n R10: 0000000000000000 R11: fefefefefefefeff R12: ffff888123ae9c60\n R13: 0000000000000001 R14: ffffc900092cfe08 R15: 0000000000000000\n FS:  0000000000000000(0000) GS:ffff88852c980000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007f15914c8734 CR3: 0000000002830005 CR4: 0000000000770ef0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n PKRU: 55555554\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  ? __die_body+0x1a/0x60\n  ? die+0x38/0x60\n  ? do_trap+0x10b/0x120\n  ? do_error_trap+0x64/0xa0\n  ? exc_stack_segment+0x33/0x50\n  ? asm_exc_stack_segment+0x22/0x30\n  ? br_switchdev_event+0x2c/0x110 [bridge]\n  ? sched_balance_newidle.isra.149+0x248/0x390\n  notifier_call_chain+0x4b/0xa0\n  atomic_notifier_call_chain+0x16/0x20\n  mlx5_esw_bridge_update+0xec/0x170 [mlx5_core]\n  mlx5_esw_bridge_update_work+0x19/0x40 [mlx5_core]\n  process_scheduled_works+0x81/0x390\n  worker_thread+0x106/0x250\n  ? bh_worker+0x110/0x110\n  kthread+0xb7/0xe0\n  ? kthread_park+0x80/0x80\n  ret_from_fork+0x2d/0x50\n  ? kthread_park+0x80/0x80\n  ret_from_fork_asm+0x11/0x20\n  \u0026lt;/TASK\u0026gt;(CVE-2025-21970)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: Prevent creation of classes with TC_H_ROOT\n\nThe function qdisc_tree_reduce_backlog() uses TC_H_ROOT as a termination\ncondition when traversing up the qdisc tree to update parent backlog\ncounters. However, if a class is created with classid TC_H_ROOT, the\ntraversal terminates prematurely at this class instead of reaching the\nactual root qdisc, causing parent statistics to be incorrectly maintained.\nIn case of DRR, this could lead to a crash as reported by Mingi Cho.\n\nPrevent the creation of any Qdisc class with classid TC_H_ROOT\n(0xFFFFFFFF) across all qdisc types, as suggested by Jamal.(CVE-2025-21971)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsched: address a potential NULL pointer dereference in the GRED scheduler.\n\nIf kzalloc in gred_init returns a NULL pointer, the code follows the\nerror handling path, invoking gred_destroy. This, in turn, calls\ngred_offload, where memset could receive a NULL pointer as input,\npotentially leading to a kernel crash.\n\nWhen table-\u0026gt;opt is NULL in gred_init(), gred_change_table_def()\nis not called yet, so it is not necessary to call -\u0026gt;ndo_setup_tc()\nin gred_offload().(CVE-2025-21980)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nice: fix memory leak in aRFS after reset\n\nFix aRFS (accelerated Receive Flow Steering) structures memory leak by\nadding a checker to verify if aRFS memory is already allocated while\nconfiguring VSI. aRFS objects are allocated in two cases:\n- as part of VSI initialization (at probe), and\n- as part of reset handling\n\nHowever, VSI reconfiguration executed during reset involves memory\nallocation one more time, without prior releasing already allocated\nresources. This led to the memory leak with the following signature:\n\n[root@os-delivery ~]# cat /sys/kernel/debug/kmemleak\nunreferenced object 0xff3c1ca7252e6000 (size 8192):\n  comm \u0026quot;kworker/0:0\u0026quot;, pid 8, jiffies 4296833052\n  hex dump (first 32 bytes):\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  backtrace (crc 0):\n    [\u0026lt;ffffffff991ec485\u0026gt;] __kmalloc_cache_noprof+0x275/0x340\n    [\u0026lt;ffffffffc0a6e06a\u0026gt;] ice_init_arfs+0x3a/0xe0 [ice]\n    [\u0026lt;ffffffffc09f1027\u0026gt;] ice_vsi_cfg_def+0x607/0x850 [ice]\n    [\u0026lt;ffffffffc09f244b\u0026gt;] ice_vsi_setup+0x5b/0x130 [ice]\n    [\u0026lt;ffffffffc09c2131\u0026gt;] ice_init+0x1c1/0x460 [ice]\n    [\u0026lt;ffffffffc09c64af\u0026gt;] ice_probe+0x2af/0x520 [ice]\n    [\u0026lt;ffffffff994fbcd3\u0026gt;] local_pci_probe+0x43/0xa0\n    [\u0026lt;ffffffff98f07103\u0026gt;] work_for_cpu_fn+0x13/0x20\n    [\u0026lt;ffffffff98f0b6d9\u0026gt;] process_one_work+0x179/0x390\n    [\u0026lt;ffffffff98f0c1e9\u0026gt;] worker_thread+0x239/0x340\n    [\u0026lt;ffffffff98f14abc\u0026gt;] kthread+0xcc/0x100\n    [\u0026lt;ffffffff98e45a6d\u0026gt;] ret_from_fork+0x2d/0x50\n    [\u0026lt;ffffffff98e083ba\u0026gt;] ret_from_fork_asm+0x1a/0x30\n    ...(CVE-2025-21981)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: switchdev: Convert blocking notification chain to a raw one\n\nA blocking notification chain uses a read-write semaphore to protect the\nintegrity of the chain. The semaphore is acquired for writing when\nadding / removing notifiers to / from the chain and acquired for reading\nwhen traversing the chain and informing notifiers about an event.\n\nIn case of the blocking switchdev notification chain, recursive\nnotifications are possible which leads to the semaphore being acquired\ntwice for reading and to lockdep warnings being generated [1].\n\nSpecifically, this can happen when the bridge driver processes a\nSWITCHDEV_BRPORT_UNOFFLOADED event which causes it to emit notifications\nabout deferred events when calling switchdev_deferred_process().\n\nFix this by converting the notification chain to a raw notification\nchain in a similar fashion to the netdev notification chain. Protect\nthe chain using the RTNL mutex by acquiring it when modifying the chain.\nEvents are always informed under the RTNL mutex, but add an assertion in\ncall_switchdev_blocking_notifiers() to make sure this is not violated in\nthe future.\n\nMaintain the \u0026quot;blocking\u0026quot; prefix as events are always emitted from process\ncontext and listeners are allowed to block.\n\n[1]:\nWARNING: possible recursive locking detected\n6.14.0-rc4-custom-g079270089484 #1 Not tainted\n--------------------------------------------\nip/52731 is trying to acquire lock:\nffffffff850918d8 ((switchdev_blocking_notif_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x58/0xa0\n\nbut task is already holding lock:\nffffffff850918d8 ((switchdev_blocking_notif_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x58/0xa0\n\nother info that might help us debug this:\nPossible unsafe locking scenario:\nCPU0\n----\nlock((switchdev_blocking_notif_chain).rwsem);\nlock((switchdev_blocking_notif_chain).rwsem);\n\n*** DEADLOCK ***\nMay be due to missing lock nesting notation\n3 locks held by ip/52731:\n #0: ffffffff84f795b0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x727/0x1dc0\n #1: ffffffff8731f628 (\u0026amp;net-\u0026gt;rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x790/0x1dc0\n #2: ffffffff850918d8 ((switchdev_blocking_notif_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x58/0xa0\n\nstack backtrace:\n...\n? __pfx_down_read+0x10/0x10\n? __pfx_mark_lock+0x10/0x10\n? __pfx_switchdev_port_attr_set_deferred+0x10/0x10\nblocking_notifier_call_chain+0x58/0xa0\nswitchdev_port_attr_notify.constprop.0+0xb3/0x1b0\n? __pfx_switchdev_port_attr_notify.constprop.0+0x10/0x10\n? mark_held_locks+0x94/0xe0\n? switchdev_deferred_process+0x11a/0x340\nswitchdev_port_attr_set_deferred+0x27/0xd0\nswitchdev_deferred_process+0x164/0x340\nbr_switchdev_port_unoffload+0xc8/0x100 [bridge]\nbr_switchdev_blocking_event+0x29f/0x580 [bridge]\nnotifier_call_chain+0xa2/0x440\nblocking_notifier_call_chain+0x6e/0xa0\nswitchdev_bridge_port_unoffload+0xde/0x1a0\n...(CVE-2025-21986)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/sched: Fix fence reference count leak\n\nThe last_scheduled fence leaks when an entity is being killed and adding\nthe cleanup callback fails.\n\nDecrement the reference count of prev when dma_fence_add_callback()\nfails, ensuring proper balance.\n\n[phasta: add git tag info for stable kernel](CVE-2025-21995)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\naccel/qaic: Fix integer overflow in qaic_validate_req()\n\nThese are u64 variables that come from the user via\nqaic_attach_slice_bo_ioctl().  Use check_add_overflow() to ensure that\nthe math doesn\u0026apos;t have an integer wrapping bug.(CVE-2025-22001)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nregulator: dummy: force synchronous probing\n\nSometimes I get a NULL pointer dereference at boot time in kobject_get()\nwith the following call stack:\n\nanatop_regulator_probe()\n devm_regulator_register()\n  regulator_register()\n   regulator_resolve_supply()\n    kobject_get()\n\nBy placing some extra BUG_ON() statements I could verify that this is\nraised because probing of the \u0026apos;dummy\u0026apos; regulator driver is not completed\n(\u0026apos;dummy_regulator_rdev\u0026apos; is still NULL).\n\nIn the JTAG debugger I can see that dummy_regulator_probe() and\nanatop_regulator_probe() can be run by different kernel threads\n(kworker/u4:*).  I haven\u0026apos;t further investigated whether this can be\nchanged or if there are other possibilities to force synchronization\nbetween these two probe routines.  On the other hand I don\u0026apos;t expect much\nboot time penalty by probing the \u0026apos;dummy\u0026apos; regulator synchronously.(CVE-2025-22009)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nspufs: fix a leak in spufs_create_context()\n\nLeak fixes back in 2008 missed one case - if we are trying to set affinity\nand spufs_mkdir() fails, we need to drop the reference to neighbor.(CVE-2025-22071)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nRevert \u0026quot;smb: client: fix TCP timers deadlock after rmmod\u0026quot;\n\nThis reverts commit e9f2517a3e18a54a3943c098d2226b245d488801.\n\nCommit e9f2517a3e18 (\u0026quot;smb: client: fix TCP timers deadlock after\nrmmod\u0026quot;) is intended to fix a null-ptr-deref in LOCKDEP, which is\nmentioned as CVE-2024-54680, but is actually did not fix anything;\nThe issue can be reproduced on top of it. [0]\n\nAlso, it reverted the change by commit ef7134c7fc48 (\u0026quot;smb: client:\nFix use-after-free of network namespace.\u0026quot;) and introduced a real\nissue by reviving the kernel TCP socket.\n\nWhen a reconnect happens for a CIFS connection, the socket state\ntransitions to FIN_WAIT_1.  Then, inet_csk_clear_xmit_timers_sync()\nin tcp_close() stops all timers for the socket.\n\nIf an incoming FIN packet is lost, the socket will stay at FIN_WAIT_1\nforever, and such sockets could be leaked up to net.ipv4.tcp_max_orphans.\n\nUsually, FIN can be retransmitted by the peer, but if the peer aborts\nthe connection, the issue comes into reality.\n\nI warned about this privately by pointing out the exact report [1],\nbut the bogus fix was finally merged.\n\nSo, we should not stop the timers to finally kill the connection on\nour side in that case, meaning we must not use a kernel socket for\nTCP whose sk-\u0026gt;sk_net_refcnt is 0.\n\nThe kernel socket does not have a reference to its netns to make it\npossible to tear down netns without cleaning up every resource in it.\n\nFor example, tunnel devices use a UDP socket internally, but we can\ndestroy netns without removing such devices and let it complete\nduring exit.  Otherwise, netns would be leaked when the last application\ndied.\n\nHowever, this is problematic for TCP sockets because TCP has timers to\nclose the connection gracefully even after the socket is close()d.  The\nlifetime of the socket and its netns is different from the lifetime of\nthe underlying connection.\n\nIf the socket user does not maintain the netns lifetime, the timer could\nbe fired after the socket is close()d and its netns is freed up, resulting\nin use-after-free.\n\nActually, we have seen so many similar issues and converted such sockets\nto have a reference to netns.\n\nThat\u0026apos;s why I converted the CIFS client socket to have a reference to\nnetns (sk-\u0026gt;sk_net_refcnt == 1), which is somehow mentioned as out-of-scope\nof CIFS and technically wrong in e9f2517a3e18, but **is in-scope and right\nfix**.\n\nRegarding the LOCKDEP issue, we can prevent the module unload by\nbumping the module refcount when switching the LOCKDDEP key in\nsock_lock_init_class_and_name(). [2]\n\nFor a while, let\u0026apos;s revert the bogus fix.\n\nNote that now we can use sk_net_refcnt_upgrade() for the socket\nconversion, but I\u0026apos;ll do so later separately to make backport easy.(CVE-2025-22077)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwatch_queue: fix pipe accounting mismatch\n\nCurrently, watch_queue_set_size() modifies the pipe buffers charged to\nuser-\u0026gt;pipe_bufs without updating the pipe-\u0026gt;nr_accounted on the pipe\nitself, due to the if (!pipe_has_watch_queue()) test in\npipe_resize_ring(). This means that when the pipe is ultimately freed,\nwe decrement user-\u0026gt;pipe_bufs by something other than what than we had\ncharged to it, potentially leading to an underflow. This in turn can\ncause subsequent too_many_pipe_buffers_soft() tests to fail with -EPERM.\n\nTo remedy this, explicitly account for the pipe usage in\nwatch_queue_set_size() to match the number set via account_pipe_buffers()\n\n(It\u0026apos;s unclear why watch_queue_set_size() does not update nr_accounted;\nit may be due to intentional overprovisioning in watch_queue_set_size()?)(CVE-2025-23138)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmedia: venus: hfi_parser: add check to avoid out of bound access\n\nThere is a possibility that init_codecs is invoked multiple times during\nmanipulated payload from video firmware. In such case, if codecs_count\ncan get incremented to value more than MAX_CODEC_NUM, there can be OOB\naccess. Reset the count so that it always starts from beginning.(CVE-2025-23157)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\njfs: add sanity check for agwidth in dbMount\n\nThe width in dmapctl of the AG is zero, it trigger a divide error when\ncalculating the control page level in dbAllocAG.\n\nTo avoid this issue, add a check for agwidth in dbAllocAG.(CVE-2025-37740)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group\n\nCurrently, mtk_iommu calls during probe iommu_device_register before\nthe hw_list from driver data is initialized. Since iommu probing issue\nfix, it leads to NULL pointer dereference in mtk_iommu_device_group when\nhw_list is accessed with list_first_entry (not null safe).\n\nSo, change the call order to ensure iommu_device_register is called\nafter the driver data are initialized.(CVE-2025-37748)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: Prevent division by zero\n\nThe user can set any speed value.\nIf speed is greater than UINT_MAX/8, division by zero is possible.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2025-37766)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: Prevent division by zero\n\nThe user can set any speed value.\nIf speed is greater than UINT_MAX/8, division by zero is possible.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2025-37768)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: Prevent division by zero\n\nThe user can set any speed value.\nIf speed is greater than UINT_MAX/8, division by zero is possible.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2025-37770)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: Prevent division by zero\n\nThe user can set any speed value.\nIf speed is greater than UINT_MAX/8, division by zero is possible.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2025-37771)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: Fix dangling pointer in krb_authenticate\n\nkrb_authenticate frees sess-\u0026gt;user and does not set the pointer\nto NULL. It calls ksmbd_krb5_authenticate to reinitialise\nsess-\u0026gt;user but that function may return without doing so. If\nthat happens then smb2_sess_setup, which calls krb_authenticate,\nwill be accessing free\u0026apos;d memory when it later uses sess-\u0026gt;user.(CVE-2025-37778)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nASoC: Intel: avs: Fix null-ptr-deref in avs_component_probe()\n\ndevm_kasprintf() returns NULL when memory allocation fails. Currently,\navs_component_probe() does not check for this case, which results in a\nNULL pointer dereference.(CVE-2025-37793)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsound/virtio: Fix cancel_sync warnings on uninitialized work_structs\n\nBetty reported hitting the following warning:\n\n[    8.709131][  T221] WARNING: CPU: 2 PID: 221 at kernel/workqueue.c:4182\n...\n[    8.713282][  T221] Call trace:\n[    8.713365][  T221]  __flush_work+0x8d0/0x914\n[    8.713468][  T221]  __cancel_work_sync+0xac/0xfc\n[    8.713570][  T221]  cancel_work_sync+0x24/0x34\n[    8.713667][  T221]  virtsnd_remove+0xa8/0xf8 [virtio_snd ab15f34d0dd772f6d11327e08a81d46dc9c36276]\n[    8.713868][  T221]  virtsnd_probe+0x48c/0x664 [virtio_snd ab15f34d0dd772f6d11327e08a81d46dc9c36276]\n[    8.714035][  T221]  virtio_dev_probe+0x28c/0x390\n[    8.714139][  T221]  really_probe+0x1bc/0x4c8\n...\n\nIt seems we\u0026apos;re hitting the error path in virtsnd_probe(), which\ntriggers a virtsnd_remove() which iterates over the substreams\ncalling cancel_work_sync() on the elapsed_period work_struct.\n\nLooking at the code, from earlier in:\nvirtsnd_probe()-\u0026gt;virtsnd_build_devs()-\u0026gt;virtsnd_pcm_parse_cfg()\n\nWe set snd-\u0026gt;nsubstreams, allocate the snd-\u0026gt;substreams, and if\nwe then hit an error on the info allocation or something in\nvirtsnd_ctl_query_info() fails, we will exit without having\ninitialized the elapsed_period work_struct.\n\nWhen that error path unwinds we then call virtsnd_remove()\nwhich as long as the substreams array is allocated, will iterate\nthrough calling cancel_work_sync() on the uninitialized work\nstruct hitting this warning.\n\nTakashi Iwai suggested this fix, which initializes the substreams\nstructure right after allocation, so that if we hit the error\npaths we avoid trying to cleanup uninitialized data.\n\nNote: I have not yet managed to reproduce the issue myself, so\nthis patch has had limited testing.\n\nFeedback or thoughts would be appreciated!(CVE-2025-37805)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmisc: microchip: pci1xxxx: Fix Kernel panic during IRQ handler registration\n\nResolve kernel panic while accessing IRQ handler associated with the\ngenerated IRQ. This is done by acquiring the spinlock and storing the\ncurrent interrupt state before handling the interrupt request using\ngeneric_handle_irq.\n\nA previous fix patch was submitted where \u0026apos;generic_handle_irq\u0026apos; was\nreplaced with \u0026apos;handle_nested_irq\u0026apos;. However, this change also causes\nthe kernel panic where after determining which GPIO triggered the\ninterrupt and attempting to call handle_nested_irq with the mapped\nIRQ number, leads to a failure in locating the registered handler.(CVE-2025-37815)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate()\n\ncpufreq_cpu_get_raw() can return NULL when the target CPU is not present\nin the policy-\u0026gt;cpus mask. apple_soc_cpufreq_get_rate() does not check\nfor this case, which results in a NULL pointer dereference.(CVE-2025-37831)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncifs: avoid NULL pointer dereference in dbg call\n\ncifs_server_dbg() implies server to be non-NULL so\nmove call under condition to avoid NULL pointer dereference.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2025-37844)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: debugfs hang_hws skip GPU with MES\n\ndebugfs hang_hws is used by GPU reset test with HWS, for MES this crash\nthe kernel with NULL pointer access because dqm-\u0026gt;packet_mgr is not setup\nfor MES path.\n\nSkip GPU with MES for now, MES hang_hws debugfs interface will be\nsupported later.(CVE-2025-37853)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev()\n\nThe variable d-\u0026gt;name, returned by devm_kasprintf(), could be NULL.\nA pointer check is added to prevent potential NULL pointer dereference.\nThis is similar to the fix in commit 3027e7b15b02\n(\u0026quot;ice: Fix some null pointer dereference issues in ice_ptp.c\u0026quot;).\n\nThis issue is found by our static analysis tool(CVE-2025-37881)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nASoC: ops: Consistently treat platform_max as control value\n\nThis reverts commit 9bdd10d57a88 (\u0026quot;ASoC: ops: Shift tested values in\nsnd_soc_put_volsw() by +min\u0026quot;), and makes some additional related\nupdates.\n\nThere are two ways the platform_max could be interpreted; the maximum\nregister value, or the maximum value the control can be set to. The\npatch moved from treating the value as a control value to a register\none. When the patch was applied it was technically correct as\nsnd_soc_limit_volume() also used the register interpretation. However,\neven then most of the other usages treated platform_max as a\ncontrol value, and snd_soc_limit_volume() has since been updated to\nalso do so in commit fb9ad24485087 (\u0026quot;ASoC: ops: add correct range\ncheck for limiting volume\u0026quot;). That patch however, missed updating\nsnd_soc_put_volsw() back to the control interpretation, and fixing\nsnd_soc_info_volsw_range(). The control interpretation makes more\nsense as limiting is typically done from the machine driver, so it is\nappropriate to use the customer facing representation rather than the\ninternal codec representation. Update all the code to consistently use\nthis interpretation of platform_max.\n\nFinally, also add some comments to the soc_mixer_control struct to\nhopefully avoid further patches switching between the two approaches.(CVE-2025-37889)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scmi: Balance device refcount when destroying devices\n\nUsing device_find_child() to lookup the proper SCMI device to destroy\ncauses an unbalance in device refcount, since device_find_child() calls an\nimplicit get_device(): this, in turns, inhibits the call of the provided\nrelease methods upon devices destruction.\n\nAs a consequence, one of the structures that is not freed properly upon\ndestruction is the internal struct device_private dev-\u0026gt;p populated by the\ndrivers subsystem core.\n\nKMemleak detects this situation since loading/unloding some SCMI driver\ncauses related devices to be created/destroyed without calling any\ndevice_release method.\n\nunreferenced object 0xffff00000f583800 (size 512):\n  comm \u0026quot;insmod\u0026quot;, pid 227, jiffies 4294912190\n  hex dump (first 32 bytes):\n    00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00  .....N..........\n    ff ff ff ff ff ff ff ff 60 36 1d 8a 00 80 ff ff  ........`6......\n  backtrace (crc 114e2eed):\n    kmemleak_alloc+0xbc/0xd8\n    __kmalloc_cache_noprof+0x2dc/0x398\n    device_add+0x954/0x12d0\n    device_register+0x28/0x40\n    __scmi_device_create.part.0+0x1bc/0x380\n    scmi_device_create+0x2d0/0x390\n    scmi_create_protocol_devices+0x74/0xf8\n    scmi_device_request_notifier+0x1f8/0x2a8\n    notifier_call_chain+0x110/0x3b0\n    blocking_notifier_call_chain+0x70/0xb0\n    scmi_driver_register+0x350/0x7f0\n    0xffff80000a3b3038\n    do_one_initcall+0x12c/0x730\n    do_init_module+0x1dc/0x640\n    load_module+0x4b20/0x5b70\n    init_module_from_file+0xec/0x158\n\n$ ./scripts/faddr2line ./vmlinux device_add+0x954/0x12d0\ndevice_add+0x954/0x12d0:\nkmalloc_noprof at include/linux/slab.h:901\n(inlined by) kzalloc_noprof at include/linux/slab.h:1037\n(inlined by) device_private_init at drivers/base/core.c:3510\n(inlined by) device_add at drivers/base/core.c:3561\n\nBalance device refcount by issuing a put_device() on devices found via\ndevice_find_child().(CVE-2025-37905)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btusb: avoid NULL pointer dereference in skb_dequeue()\n\nA NULL pointer dereference can occur in skb_dequeue() when processing a\nQCA firmware crash dump on WCN7851 (0489:e0f3).\n\n[ 93.672166] Bluetooth: hci0: ACL memdump size(589824)\n\n[ 93.672475] BUG: kernel NULL pointer dereference, address: 0000000000000008\n[ 93.672517] Workqueue: hci0 hci_devcd_rx [bluetooth]\n[ 93.672598] RIP: 0010:skb_dequeue+0x50/0x80\n\nThe issue stems from handle_dump_pkt_qca() returning 0 even when a dump\npacket is successfully processed. This is because it incorrectly\nforwards the return value of hci_devcd_init() (which returns 0 on\nsuccess). As a result, the caller (btusb_recv_acl_qca() or\nbtusb_recv_evt_qca()) assumes the packet was not handled and passes it\nto hci_recv_frame(), leading to premature kfree() of the skb.\n\nLater, hci_devcd_rx() attempts to dequeue the same skb from the dump\nqueue, resulting in a NULL pointer dereference.\n\nFix this by:\n1. Making handle_dump_pkt_qca() return 0 on success and negative errno\n   on failure, consistent with kernel conventions.\n2. Splitting dump packet detection into separate functions for ACL\n   and event packets for better structure and readability.\n\nThis ensures dump packets are properly identified and consumed, avoiding\ndouble handling and preventing NULL pointer access.(CVE-2025-37918)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: prevent out-of-bounds stream writes by validating *pos\n\nksmbd_vfs_stream_write() did not validate whether the write offset\n(*pos) was within the bounds of the existing stream data length (v_len).\nIf *pos was greater than or equal to v_len, this could lead to an\nout-of-bounds memory write.\n\nThis patch adds a check to ensure *pos is less than v_len before\nproceeding. If the condition fails, -EINVAL is returned.(CVE-2025-37947)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: displayport: Fix deadlock\n\nThis patch introduces the ucsi_con_mutex_lock / ucsi_con_mutex_unlock\nfunctions to the UCSI driver. ucsi_con_mutex_lock ensures the connector\nmutex is only locked if a connection is established and the partner pointer\nis valid. This resolves a deadlock scenario where\nucsi_displayport_remove_partner holds con-\u0026gt;mutex waiting for\ndp_altmode_work to complete while dp_altmode_work attempts to acquire it.(CVE-2025-37967)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: Refactor remove call with idxd_cleanup() helper\n\nThe idxd_cleanup() helper cleans up perfmon, interrupts, internals and\nso on. Refactor remove call with the idxd_cleanup() helper to avoid code\nduplication. Note, this also fixes the missing put_device() for idxd\ngroups, enginces and wqs.(CVE-2025-38014)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: Annotate FDB data races\n\nThe \u0026apos;used\u0026apos; and \u0026apos;updated\u0026apos; fields in the FDB entry structure can be\naccessed concurrently by multiple threads, leading to reports such as\n[1]. Can be reproduced using [2].\n\nSuppress these reports by annotating these accesses using\nREAD_ONCE() / WRITE_ONCE().\n\n[1]\nBUG: KCSAN: data-race in vxlan_xmit / vxlan_xmit\n\nwrite to 0xffff942604d263a8 of 8 bytes by task 286 on cpu 0:\n vxlan_xmit+0xb29/0x2380\n dev_hard_start_xmit+0x84/0x2f0\n __dev_queue_xmit+0x45a/0x1650\n packet_xmit+0x100/0x150\n packet_sendmsg+0x2114/0x2ac0\n __sys_sendto+0x318/0x330\n __x64_sys_sendto+0x76/0x90\n x64_sys_call+0x14e8/0x1c00\n do_syscall_64+0x9e/0x1a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nread to 0xffff942604d263a8 of 8 bytes by task 287 on cpu 2:\n vxlan_xmit+0xadf/0x2380\n dev_hard_start_xmit+0x84/0x2f0\n __dev_queue_xmit+0x45a/0x1650\n packet_xmit+0x100/0x150\n packet_sendmsg+0x2114/0x2ac0\n __sys_sendto+0x318/0x330\n __x64_sys_sendto+0x76/0x90\n x64_sys_call+0x14e8/0x1c00\n do_syscall_64+0x9e/0x1a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nvalue changed: 0x00000000fffbac6e -\u0026gt; 0x00000000fffbac6f\n\nReported by Kernel Concurrency Sanitizer on:\nCPU: 2 UID: 0 PID: 287 Comm: mausezahn Not tainted 6.13.0-rc7-01544-gb4b270f11a02 #5\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014\n\n[2]\n #!/bin/bash\n\n set +H\n echo whitelist \u0026gt; /sys/kernel/debug/kcsan\n echo !vxlan_xmit \u0026gt; /sys/kernel/debug/kcsan\n\n ip link add name vx0 up type vxlan id 10010 dstport 4789 local 192.0.2.1\n bridge fdb add 00:11:22:33:44:55 dev vx0 self static dst 198.51.100.1\n taskset -c 0 mausezahn vx0 -a own -b 00:11:22:33:44:55 -c 0 -q \u0026amp;\n taskset -c 2 mausezahn vx0 -a own -b 00:11:22:33:44:55 -c 0 -q \u0026amp;(CVE-2025-38037)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_ffa: Set dma_mask for ffa devices\n\nSet dma_mask for FFA devices, otherwise DMA allocation using the device pointer\nlead to following warning:\n\nWARNING: CPU: 1 PID: 1 at kernel/dma/mapping.c:597 dma_alloc_attrs+0xe0/0x124(CVE-2025-38043)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: Fix use-after-free in cifs_fill_dirent\n\nThere is a race condition in the readdir concurrency process, which may\naccess the rsp buffer after it has been released, triggering the\nfollowing KASAN warning.\n\n ==================================================================\n BUG: KASAN: slab-use-after-free in cifs_fill_dirent+0xb03/0xb60 [cifs]\n Read of size 4 at addr ffff8880099b819c by task a.out/342975\n\n CPU: 2 UID: 0 PID: 342975 Comm: a.out Not tainted 6.15.0-rc6+ #240 PREEMPT(full)\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  dump_stack_lvl+0x53/0x70\n  print_report+0xce/0x640\n  kasan_report+0xb8/0xf0\n  cifs_fill_dirent+0xb03/0xb60 [cifs]\n  cifs_readdir+0x12cb/0x3190 [cifs]\n  iterate_dir+0x1a1/0x520\n  __x64_sys_getdents+0x134/0x220\n  do_syscall_64+0x4b/0x110\n  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n RIP: 0033:0x7f996f64b9f9\n Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89\n f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01\n f0 ff ff  0d f7 c3 0c 00 f7 d8 64 89 8\n RSP: 002b:00007f996f53de78 EFLAGS: 00000207 ORIG_RAX: 000000000000004e\n RAX: ffffffffffffffda RBX: 00007f996f53ecdc RCX: 00007f996f64b9f9\n RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003\n RBP: 00007f996f53dea0 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000207 R12: ffffffffffffff88\n R13: 0000000000000000 R14: 00007ffc8cd9a500 R15: 00007f996f51e000\n  \u0026lt;/TASK\u0026gt;\n\n Allocated by task 408:\n  kasan_save_stack+0x20/0x40\n  kasan_save_track+0x14/0x30\n  __kasan_slab_alloc+0x6e/0x70\n  kmem_cache_alloc_noprof+0x117/0x3d0\n  mempool_alloc_noprof+0xf2/0x2c0\n  cifs_buf_get+0x36/0x80 [cifs]\n  allocate_buffers+0x1d2/0x330 [cifs]\n  cifs_demultiplex_thread+0x22b/0x2690 [cifs]\n  kthread+0x394/0x720\n  ret_from_fork+0x34/0x70\n  ret_from_fork_asm+0x1a/0x30\n\n Freed by task 342979:\n  kasan_save_stack+0x20/0x40\n  kasan_save_track+0x14/0x30\n  kasan_save_free_info+0x3b/0x60\n  __kasan_slab_free+0x37/0x50\n  kmem_cache_free+0x2b8/0x500\n  cifs_buf_release+0x3c/0x70 [cifs]\n  cifs_readdir+0x1c97/0x3190 [cifs]\n  iterate_dir+0x1a1/0x520\n  __x64_sys_getdents64+0x134/0x220\n  do_syscall_64+0x4b/0x110\n  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\n The buggy address belongs to the object at ffff8880099b8000\n  which belongs to the cache cifs_request of size 16588\n The buggy address is located 412 bytes inside of\n  freed 16588-byte region [ffff8880099b8000, ffff8880099bc0cc)\n\n The buggy address belongs to the physical page:\n page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x99b8\n head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0\n anon flags: 0x80000000000040(head|node=0|zone=1)\n page_type: f5(slab)\n raw: 0080000000000040 ffff888001e03400 0000000000000000 dead000000000001\n raw: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000\n head: 0080000000000040 ffff888001e03400 0000000000000000 dead000000000001\n head: 0000000000000000 0000000000010001 00000000f5000000 0000000000000000\n head: 0080000000000003 ffffea0000266e01 00000000ffffffff 00000000ffffffff\n head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008\n page dumped because: kasan: bad access detected\n\n Memory state around the buggy address:\n  ffff8880099b8080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n  ffff8880099b8100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n \u0026gt;ffff8880099b8180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n                             ^\n  ffff8880099b8200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n  ffff8880099b8280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ==================================================================\n\nPOC is available in the link [1].\n\nThe problem triggering process is as follows:\n\nProcess 1                       Process 2\n-----------------------------------\n---truncated---(CVE-2025-38051)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvirtio: break and reset virtio devices on device_shutdown()\n\nHongyu reported a hang on kexec in a VM. QEMU reported invalid memory\naccesses during the hang.\n\n\tInvalid read at addr 0x102877002, size 2, region \u0026apos;(null)\u0026apos;, reason: rejected\n\tInvalid write at addr 0x102877A44, size 2, region \u0026apos;(null)\u0026apos;, reason: rejected\n\t...\n\nIt was traced down to virtio-console. Kexec works fine if virtio-console\nis not in use.\n\nThe issue is that virtio-console continues to write to the MMIO even after\nunderlying virtio-pci device is reset.\n\nAdditionally, Eric noticed that IOMMUs are reset before devices, if\ndevices are not reset on shutdown they continue to poke at guest memory\nand get errors from the IOMMU. Some devices get wedged then.\n\nThe problem can be solved by breaking all virtio devices on virtio\nbus shutdown, then resetting them.(CVE-2025-38064)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nACPI: CPPC: Fix NULL pointer dereference when nosmp is used\n\nWith nosmp in cmdline, other CPUs are not brought up, leaving\ntheir cpc_desc_ptr NULL. CPU0\u0026apos;s iteration via for_each_possible_cpu()\ndereferences these NULL pointers, causing panic.\n\nPanic backtrace:\n\n[    0.401123] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000b8\n...\n[    0.403255] [\u0026lt;ffffffff809a5818\u0026gt;] cppc_allow_fast_switch+0x6a/0xd4\n...\nKernel panic - not syncing: Attempted to kill init!\n\n[ rjw: New subject ](CVE-2025-38113)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ngve: add missing NULL check for gve_alloc_pending_packet() in TX DQO\n\ngve_alloc_pending_packet() can return NULL, but gve_tx_add_skb_dqo()\ndid not check for this case before dereferencing the returned pointer.\n\nAdd a missing NULL check to prevent a potential NULL pointer\ndereference when allocation fails.\n\nThis improves robustness in low-memory scenarios.(CVE-2025-38122)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: wwan: t7xx: Fix napi rx poll issue\n\nWhen driver handles the napi rx polling requests, the netdev might\nhave been released by the dellink logic triggered by the disconnect\noperation on user plane. However, in the logic of processing skb in\npolling, an invalid netdev is still being used, which causes a panic.\n\nBUG: kernel NULL pointer dereference, address: 00000000000000f1\nOops: 0000 [#1] PREEMPT SMP NOPTI\nRIP: 0010:dev_gro_receive+0x3a/0x620\n[...]\nCall Trace:\n \u0026lt;IRQ\u0026gt;\n ? __die_body+0x68/0xb0\n ? page_fault_oops+0x379/0x3e0\n ? exc_page_fault+0x4f/0xa0\n ? asm_exc_page_fault+0x22/0x30\n ? __pfx_t7xx_ccmni_recv_skb+0x10/0x10 [mtk_t7xx (HASH:1400 7)]\n ? dev_gro_receive+0x3a/0x620\n napi_gro_receive+0xad/0x170\n t7xx_ccmni_recv_skb+0x48/0x70 [mtk_t7xx (HASH:1400 7)]\n t7xx_dpmaif_napi_rx_poll+0x590/0x800 [mtk_t7xx (HASH:1400 7)]\n net_rx_action+0x103/0x470\n irq_exit_rcu+0x13a/0x310\n sysvec_apic_timer_interrupt+0x56/0x90\n \u0026lt;/IRQ\u0026gt;(CVE-2025-38123)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncoresight: prevent deactivate active config while enabling the config\n\nWhile enable active config via cscfg_csdev_enable_active_config(),\nactive config could be deactivated via configfs\u0026apos; sysfs interface.\nThis could make UAF issue in below scenario:\n\nCPU0                                          CPU1\n(sysfs enable)                                load module\n                                              cscfg_load_config_sets()\n                                              activate config. // sysfs\n                                              (sys_active_cnt == 1)\n...\ncscfg_csdev_enable_active_config()\nlock(csdev-\u0026gt;cscfg_csdev_lock)\n// here load config activate by CPU1\nunlock(csdev-\u0026gt;cscfg_csdev_lock)\n\n                                              deactivate config // sysfs\n                                              (sys_activec_cnt == 0)\n                                              cscfg_unload_config_sets()\n                                              unload module\n\n// access to config_desc which freed\n// while unloading module.\ncscfg_csdev_enable_config\n\nTo address this, use cscfg_config_desc\u0026apos;s active_cnt as a reference count\n which will be holded when\n    - activate the config.\n    - enable the activated config.\nand put the module reference when config_active_cnt == 0.(CVE-2025-38131)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: phy: mscc: Fix memory leak when using one step timestamping\n\nFix memory leak when running one-step timestamping. When running\none-step sync timestamping, the HW is configured to insert the TX time\ninto the frame, so there is no reason to keep the skb anymore. As in\nthis case the HW will never generate an interrupt to say that the frame\nwas timestamped, then the frame will never released.\nFix this by freeing the frame in case of one-step timestamping.(CVE-2025-38148)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Fix error flow upon firmware failure for RQ destruction\n\nUpon RQ destruction if the firmware command fails which is the\nlast resource to be destroyed some SW resources were already cleaned\nregardless of the failure.\n\nNow properly rollback the object to its original state upon such failure.\n\nIn order to avoid a use-after free in case someone tries to destroy the\nobject again, which results in the following kernel trace:\nrefcount_t: underflow; use-after-free.\nWARNING: CPU: 0 PID: 37589 at lib/refcount.c:28 refcount_warn_saturate+0xf4/0x148\nModules linked in: rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) ib_umad(OE) mlx5_ib(OE) rfkill mlx5_core(OE) mlxdevm(OE) ib_uverbs(OE) ib_core(OE) psample mlxfw(OE) mlx_compat(OE) macsec tls pci_hyperv_intf sunrpc vfat fat virtio_net net_failover failover fuse loop nfnetlink vsock_loopback vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport vmw_vmci vsock xfs crct10dif_ce ghash_ce sha2_ce sha256_arm64 sha1_ce virtio_console virtio_gpu virtio_blk virtio_dma_buf virtio_mmio dm_mirror dm_region_hash dm_log dm_mod xpmem(OE)\nCPU: 0 UID: 0 PID: 37589 Comm: python3 Kdump: loaded Tainted: G           OE     -------  ---  6.12.0-54.el10.aarch64 #1\nTainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\nHardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015\npstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : refcount_warn_saturate+0xf4/0x148\nlr : refcount_warn_saturate+0xf4/0x148\nsp : ffff80008b81b7e0\nx29: ffff80008b81b7e0 x28: ffff000133d51600 x27: 0000000000000001\nx26: 0000000000000000 x25: 00000000ffffffea x24: ffff00010ae80f00\nx23: ffff00010ae80f80 x22: ffff0000c66e5d08 x21: 0000000000000000\nx20: ffff0000c66e0000 x19: ffff00010ae80340 x18: 0000000000000006\nx17: 0000000000000000 x16: 0000000000000020 x15: ffff80008b81b37f\nx14: 0000000000000000 x13: 2e656572662d7265 x12: ffff80008283ef78\nx11: ffff80008257efd0 x10: ffff80008283efd0 x9 : ffff80008021ed90\nx8 : 0000000000000001 x7 : 00000000000bffe8 x6 : c0000000ffff7fff\nx5 : ffff0001fb8e3408 x4 : 0000000000000000 x3 : ffff800179993000\nx2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000133d51600\nCall trace:\n refcount_warn_saturate+0xf4/0x148\n mlx5_core_put_rsc+0x88/0xa0 [mlx5_ib]\n mlx5_core_destroy_rq_tracked+0x64/0x98 [mlx5_ib]\n mlx5_ib_destroy_wq+0x34/0x80 [mlx5_ib]\n ib_destroy_wq_user+0x30/0xc0 [ib_core]\n uverbs_free_wq+0x28/0x58 [ib_uverbs]\n destroy_hw_idr_uobject+0x34/0x78 [ib_uverbs]\n uverbs_destroy_uobject+0x48/0x240 [ib_uverbs]\n __uverbs_cleanup_ufile+0xd4/0x1a8 [ib_uverbs]\n uverbs_destroy_ufile_hw+0x48/0x120 [ib_uverbs]\n ib_uverbs_close+0x2c/0x100 [ib_uverbs]\n __fput+0xd8/0x2f0\n __fput_sync+0x50/0x70\n __arm64_sys_close+0x40/0x90\n invoke_syscall.constprop.0+0x74/0xd0\n do_el0_svc+0x48/0xe8\n el0_svc+0x44/0x1d0\n el0t_64_sync_handler+0x120/0x130\n el0t_64_sync+0x1a4/0x1a8(CVE-2025-38161)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get()\n\nBefore calling lan743x_ptp_io_event_clock_get(), the \u0026apos;channel\u0026apos; value\nis checked against the maximum value of PCI11X1X_PTP_IO_MAX_CHANNELS(8).\nThis seems correct and aligns with the PTP interrupt status register\n(PTP_INT_STS) specifications.\n\nHowever, lan743x_ptp_io_event_clock_get() writes to ptp-\u0026gt;extts[] with\nonly LAN743X_PTP_N_EXTTS(4) elements, using channel as an index:\n\n    lan743x_ptp_io_event_clock_get(..., u8 channel,...)\n    {\n        ...\n        /* Update Local timestamp */\n        extts = \u0026amp;ptp-\u0026gt;extts[channel];\n        extts-\u0026gt;ts.tv_sec = sec;\n        ...\n    }\n\nTo avoid an out-of-bounds write and utilize all the supported GPIO\ninputs, set LAN743X_PTP_N_EXTTS to 8.\n\nDetected using the static analysis tool - Svace.(CVE-2025-38183)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: sch_sfq: reject invalid perturb period\n\nGerrard Tai reported that SFQ perturb_period has no range check yet,\nand this can be used to trigger a race condition fixed in a separate patch.\n\nWe want to make sure ctl-\u0026gt;perturb_period * HZ will not overflow\nand is positive.\n\n\ntc qd add dev lo root sfq perturb -10   # negative value : error\nError: sch_sfq: invalid perturb period.\n\ntc qd add dev lo root sfq perturb 1000000000 # too big : error\nError: sch_sfq: invalid perturb period.\n\ntc qd add dev lo root sfq perturb 2000000 # acceptable value\ntc -s -d qd sh dev lo\nqdisc sfq 8005: root refcnt 2 limit 127p quantum 64Kb depth 127 flows 128 divisor 1024 perturb 2000000sec\n Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0)\n backlog 0b 0p requeues 0(CVE-2025-38193)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\njffs2: check that raw node were preallocated before writing summary\n\nSyzkaller detected a kernel bug in jffs2_link_node_ref, caused by fault\ninjection in jffs2_prealloc_raw_node_refs. jffs2_sum_write_sumnode doesn\u0026apos;t\ncheck return value of jffs2_prealloc_raw_node_refs and simply lets any\nerror propagate into jffs2_sum_write_data, which eventually calls\njffs2_link_node_ref in order to link the summary to an expectedly allocated\nnode.\n\nkernel BUG at fs/jffs2/nodelist.c:592!\ninvalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI\nCPU: 1 PID: 31277 Comm: syz-executor.7 Not tainted 6.1.128-syzkaller-00139-ge10f83ca10a1 #0\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014\nRIP: 0010:jffs2_link_node_ref+0x570/0x690 fs/jffs2/nodelist.c:592\nCall Trace:\n \u0026lt;TASK\u0026gt;\n jffs2_sum_write_data fs/jffs2/summary.c:841 [inline]\n jffs2_sum_write_sumnode+0xd1a/0x1da0 fs/jffs2/summary.c:874\n jffs2_do_reserve_space+0xa18/0xd60 fs/jffs2/nodemgmt.c:388\n jffs2_reserve_space+0x55f/0xaa0 fs/jffs2/nodemgmt.c:197\n jffs2_write_inode_range+0x246/0xb50 fs/jffs2/write.c:362\n jffs2_write_end+0x726/0x15d0 fs/jffs2/file.c:301\n generic_perform_write+0x314/0x5d0 mm/filemap.c:3856\n __generic_file_write_iter+0x2ae/0x4d0 mm/filemap.c:3973\n generic_file_write_iter+0xe3/0x350 mm/filemap.c:4005\n call_write_iter include/linux/fs.h:2265 [inline]\n do_iter_readv_writev+0x20f/0x3c0 fs/read_write.c:735\n do_iter_write+0x186/0x710 fs/read_write.c:861\n vfs_iter_write+0x70/0xa0 fs/read_write.c:902\n iter_file_splice_write+0x73b/0xc90 fs/splice.c:685\n do_splice_from fs/splice.c:763 [inline]\n direct_splice_actor+0x10c/0x170 fs/splice.c:950\n splice_direct_to_actor+0x337/0xa10 fs/splice.c:896\n do_splice_direct+0x1a9/0x280 fs/splice.c:1002\n do_sendfile+0xb13/0x12c0 fs/read_write.c:1255\n __do_sys_sendfile64 fs/read_write.c:1323 [inline]\n __se_sys_sendfile64 fs/read_write.c:1309 [inline]\n __x64_sys_sendfile64+0x1cf/0x210 fs/read_write.c:1309\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81\n entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n\nFix this issue by checking return value of jffs2_prealloc_raw_node_refs\nbefore calling jffs2_sum_write_data.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.(CVE-2025-38194)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/shmem, swap: fix softlockup with mTHP swapin\n\nFollowing softlockup can be easily reproduced on my test machine with:\n\necho always \u0026gt; /sys/kernel/mm/transparent_hugepage/hugepages-64kB/enabled\nswapon /dev/zram0 # zram0 is a 48G swap device\nmkdir -p /sys/fs/cgroup/memory/test\necho 1G \u0026gt; /sys/fs/cgroup/test/memory.max\necho $BASHPID \u0026gt; /sys/fs/cgroup/test/cgroup.procs\nwhile true; do\n    dd if=/dev/zero of=/tmp/test.img bs=1M count=5120\n    cat /tmp/test.img \u0026gt; /dev/null\n    rm /tmp/test.img\ndone\n\nThen after a while:\nwatchdog: BUG: soft lockup - CPU#0 stuck for 763s! [cat:5787]\nModules linked in: zram virtiofs\nCPU: 0 UID: 0 PID: 5787 Comm: cat Kdump: loaded Tainted: G             L      6.15.0.orig-gf3021d9246bc-dirty #118 PREEMPT(voluntary)·\nTainted: [L]=SOFTLOCKUP\nHardware name: Red Hat KVM/RHEL-AV, BIOS 0.0.0 02/06/2015\nRIP: 0010:mpol_shared_policy_lookup+0xd/0x70\nCode: e9 b8 b4 ff ff 31 c0 c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 0f 1f 44 00 00 41 54 55 53 \u0026lt;48\u0026gt; 8b 1f 48 85 db 74 41 4c 8d 67 08 48 89 fb 48 89 f5 4c 89 e7 e8\nRSP: 0018:ffffc90002b1fc28 EFLAGS: 00000202\nRAX: 00000000001c20ca RBX: 0000000000724e1e RCX: 0000000000000001\nRDX: ffff888118e214c8 RSI: 0000000000057d42 RDI: ffff888118e21518\nRBP: 000000000002bec8 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000bf4 R11: 0000000000000000 R12: 0000000000000001\nR13: 00000000001c20ca R14: 00000000001c20ca R15: 0000000000000000\nFS:  00007f03f995c740(0000) GS:ffff88a07ad9a000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f03f98f1000 CR3: 0000000144626004 CR4: 0000000000770eb0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n \u0026lt;TASK\u0026gt;\n shmem_alloc_folio+0x31/0xc0\n shmem_swapin_folio+0x309/0xcf0\n ? filemap_get_entry+0x117/0x1e0\n ? xas_load+0xd/0xb0\n ? filemap_get_entry+0x101/0x1e0\n shmem_get_folio_gfp+0x2ed/0x5b0\n shmem_file_read_iter+0x7f/0x2e0\n vfs_read+0x252/0x330\n ksys_read+0x68/0xf0\n do_syscall_64+0x4c/0x1c0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\nRIP: 0033:0x7f03f9a46991\nCode: 00 48 8b 15 81 14 10 00 f7 d8 64 89 02 b8 ff ff ff ff eb bd e8 20 ad 01 00 f3 0f 1e fa 80 3d 35 97 10 00 00 74 13 31 c0 0f 05 \u0026lt;48\u0026gt; 3d 00 f0 ff ff 77 4f c3 66 0f 1f 44 00 00 55 48 89 e5 48 83 ec\nRSP: 002b:00007fff3c52bd28 EFLAGS: 00000246 ORIG_RAX: 0000000000000000\nRAX: ffffffffffffffda RBX: 0000000000040000 RCX: 00007f03f9a46991\nRDX: 0000000000040000 RSI: 00007f03f98ba000 RDI: 0000000000000003\nRBP: 00007fff3c52bd50 R08: 0000000000000000 R09: 00007f03f9b9a380\nR10: 0000000000000022 R11: 0000000000000246 R12: 0000000000040000\nR13: 00007f03f98ba000 R14: 0000000000000003 R15: 0000000000000000\n \u0026lt;/TASK\u0026gt;\n\nThe reason is simple, readahead brought some order 0 folio in swap cache,\nand the swapin mTHP folio being allocated is in conflict with it, so\nswapcache_prepare fails and causes shmem_swap_alloc_folio to return\n-EEXIST, and shmem simply retries again and again causing this loop.\n\nFix it by applying a similar fix for anon mTHP swapin.\n\nThe performance change is very slight, time of swapin 10g zero folios\nwith shmem (test for 12 times):\nBefore:  2.47s\nAfter:   2.48s\n\n[(CVE-2025-38241)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlib/group_cpus: fix NULL pointer dereference from group_cpus_evenly()\n\nWhile testing null_blk with configfs, echo 0 \u0026gt; poll_queues will trigger\nfollowing panic:\n\nBUG: kernel NULL pointer dereference, address: 0000000000000010\nOops: Oops: 0000 [#1] SMP NOPTI\nCPU: 27 UID: 0 PID: 920 Comm: bash Not tainted 6.15.0-02023-gadbdb95c8696-dirty #1238 PREEMPT(undef)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014\nRIP: 0010:__bitmap_or+0x48/0x70\nCall Trace:\n \u0026lt;TASK\u0026gt;\n __group_cpus_evenly+0x822/0x8c0\n group_cpus_evenly+0x2d9/0x490\n blk_mq_map_queues+0x1e/0x110\n null_map_queues+0xc9/0x170 [null_blk]\n blk_mq_update_queue_map+0xdb/0x160\n blk_mq_update_nr_hw_queues+0x22b/0x560\n nullb_update_nr_hw_queues+0x71/0xf0 [null_blk]\n nullb_device_poll_queues_store+0xa4/0x130 [null_blk]\n configfs_write_iter+0x109/0x1d0\n vfs_write+0x26e/0x6f0\n ksys_write+0x79/0x180\n __x64_sys_write+0x1d/0x30\n x64_sys_call+0x45c4/0x45f0\n do_syscall_64+0xa5/0x240\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nRoot cause is that numgrps is set to 0, and ZERO_SIZE_PTR is returned from\nkcalloc(), and later ZERO_SIZE_PTR will be deferenced.\n\nFix the problem by checking numgrps first in group_cpus_evenly(), and\nreturn NULL directly if numgrps is zero.\n\n[(CVE-2025-38255)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: Fix NULL pointer deference on eir_get_service_data\n\nThe len parameter is considered optional so it can be NULL so it cannot\nbe used for skipping to next entry of EIR_SERVICE_DATA.(CVE-2025-38304)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nASoC: Intel: avs: Verify content returned by parse_int_array()\n\nThe first element of the returned array stores its length. If it is 0,\nany manipulation beyond the element at index 0 ends with null-ptr-deref.(CVE-2025-38307)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: Log an error when close_all_cached_dirs fails\n\nUnder low-memory conditions, close_all_cached_dirs() can\u0026apos;t move the\ndentries to a separate list to dput() them once the locks are dropped.\nThis will result in a \u0026quot;Dentry still in use\u0026quot; error, so add an error\nmessage that makes it clear this is what happened:\n\n[  495.281119] CIFS: VFS: \\\\otters.example.com\\share Out of memory while dropping dentries\n[  495.281595] ------------[ cut here ]------------\n[  495.281887] BUG: Dentry ffff888115531138{i=78,n=/}  still in use (2) [unmount of cifs cifs]\n[  495.282391] WARNING: CPU: 1 PID: 2329 at fs/dcache.c:1536 umount_check+0xc8/0xf0\n\nAlso, bail out of looping through all tcons as soon as a single\nallocation fails, since we\u0026apos;re already in trouble, and kmalloc() attempts\nfor subseqeuent tcons are likely to fail just like the first one did.(CVE-2025-38321)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: fix acpi parse and parseext cache leaks\n\nACPICA commit 8829e70e1360c81e7a5a901b5d4f48330e021ea5\n\nI\u0026apos;m Seunghun Han, and I work for National Security Research Institute of\nSouth Korea.\n\nI have been doing a research on ACPI and found an ACPI cache leak in ACPI\nearly abort cases.\n\nBoot log of ACPI cache leak is as follows:\n[    0.352414] ACPI: Added _OSI(Module Device)\n[    0.353182] ACPI: Added _OSI(Processor Device)\n[    0.353182] ACPI: Added _OSI(3.0 _SCP Extensions)\n[    0.353182] ACPI: Added _OSI(Processor Aggregator Device)\n[    0.356028] ACPI: Unable to start the ACPI Interpreter\n[    0.356799] ACPI Error: Could not remove SCI handler (20170303/evmisc-281)\n[    0.360215] kmem_cache_destroy Acpi-State: Slab cache still has objects\n[    0.360648] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G        W\n4.12.0-rc4-next-20170608+ #10\n[    0.361273] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS\nvirtual_box 12/01/2006\n[    0.361873] Call Trace:\n[    0.362243]  ? dump_stack+0x5c/0x81\n[    0.362591]  ? kmem_cache_destroy+0x1aa/0x1c0\n[    0.362944]  ? acpi_sleep_proc_init+0x27/0x27\n[    0.363296]  ? acpi_os_delete_cache+0xa/0x10\n[    0.363646]  ? acpi_ut_delete_caches+0x6d/0x7b\n[    0.364000]  ? acpi_terminate+0xa/0x14\n[    0.364000]  ? acpi_init+0x2af/0x34f\n[    0.364000]  ? __class_create+0x4c/0x80\n[    0.364000]  ? video_setup+0x7f/0x7f\n[    0.364000]  ? acpi_sleep_proc_init+0x27/0x27\n[    0.364000]  ? do_one_initcall+0x4e/0x1a0\n[    0.364000]  ? kernel_init_freeable+0x189/0x20a\n[    0.364000]  ? rest_init+0xc0/0xc0\n[    0.364000]  ? kernel_init+0xa/0x100\n[    0.364000]  ? ret_from_fork+0x25/0x30\n\nI analyzed this memory leak in detail. I found that “Acpi-State” cache and\n“Acpi-Parse” cache were merged because the size of cache objects was same\nslab cache size.\n\nI finally found “Acpi-Parse” cache and “Acpi-parse_ext” cache were leaked\nusing SLAB_NEVER_MERGE flag in kmem_cache_create() function.\n\nReal ACPI cache leak point is as follows:\n[    0.360101] ACPI: Added _OSI(Module Device)\n[    0.360101] ACPI: Added _OSI(Processor Device)\n[    0.360101] ACPI: Added _OSI(3.0 _SCP Extensions)\n[    0.361043] ACPI: Added _OSI(Processor Aggregator Device)\n[    0.364016] ACPI: Unable to start the ACPI Interpreter\n[    0.365061] ACPI Error: Could not remove SCI handler (20170303/evmisc-281)\n[    0.368174] kmem_cache_destroy Acpi-Parse: Slab cache still has objects\n[    0.369332] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G        W\n4.12.0-rc4-next-20170608+ #8\n[    0.371256] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS\nvirtual_box 12/01/2006\n[    0.372000] Call Trace:\n[    0.372000]  ? dump_stack+0x5c/0x81\n[    0.372000]  ? kmem_cache_destroy+0x1aa/0x1c0\n[    0.372000]  ? acpi_sleep_proc_init+0x27/0x27\n[    0.372000]  ? acpi_os_delete_cache+0xa/0x10\n[    0.372000]  ? acpi_ut_delete_caches+0x56/0x7b\n[    0.372000]  ? acpi_terminate+0xa/0x14\n[    0.372000]  ? acpi_init+0x2af/0x34f\n[    0.372000]  ? __class_create+0x4c/0x80\n[    0.372000]  ? video_setup+0x7f/0x7f\n[    0.372000]  ? acpi_sleep_proc_init+0x27/0x27\n[    0.372000]  ? do_one_initcall+0x4e/0x1a0\n[    0.372000]  ? kernel_init_freeable+0x189/0x20a\n[    0.372000]  ? rest_init+0xc0/0xc0\n[    0.372000]  ? kernel_init+0xa/0x100\n[    0.372000]  ? ret_from_fork+0x25/0x30\n[    0.388039] kmem_cache_destroy Acpi-parse_ext: Slab cache still has objects\n[    0.389063] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G        W\n4.12.0-rc4-next-20170608+ #8\n[    0.390557] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS\nvirtual_box 12/01/2006\n[    0.392000] Call Trace:\n[    0.392000]  ? dump_stack+0x5c/0x81\n[    0.392000]  ? kmem_cache_destroy+0x1aa/0x1c0\n[    0.392000]  ? acpi_sleep_proc_init+0x27/0x27\n[    0.392000]  ? acpi_os_delete_cache+0xa/0x10\n[    0.392000]  ? acpi_ut_delete_caches+0x6d/0x7b\n[    0.392000]  ? acpi_terminate+0xa/0x14\n[    0.392000]  ? acpi_init+0x2af/0x3\n---truncated---(CVE-2025-38344)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmaple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate()\n\nTemporarily clear the preallocation flag when explicitly requesting\nallocations.  Pre-existing allocations are already counted against the\nrequest through mas_node_count_gfp(), but the allocations will not happen\nif the MA_STATE_PREALLOC flag is set.  This flag is meant to avoid\nre-allocating in bulk allocation mode, and to detect issues with\npreallocation calculations.\n\nThe MA_STATE_PREALLOC flag should also always be set on zero allocations\nso that detection of underflow allocations will print a WARN_ON() during\nconsumption.\n\nUser visible effect of this flaw is a WARN_ON() followed by a null pointer\ndereference when subsequent requests for larger number of nodes is\nignored, such as the vma merge retry in mmap_region() caused by drivers\naltering the vma flags (which happens in v6.6, at least)(CVE-2025-38364)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvsock: Fix transport_* TOCTOU\n\nTransport assignment may race with module unload. Protect new_transport\nfrom becoming a stale pointer.\n\nThis also takes care of an insecure call in vsock_use_local_transport();\nadd a lockdep assert.\n\nBUG: unable to handle page fault for address: fffffbfff8056000\nOops: Oops: 0000 [#1] SMP KASAN\nRIP: 0010:vsock_assign_transport+0x366/0x600\nCall Trace:\n vsock_connect+0x59c/0xc40\n __sys_connect+0xe8/0x100\n __x64_sys_connect+0x6e/0xc0\n do_syscall_64+0x92/0x1c0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53(CVE-2025-38461)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvsock: Fix transport_{g2h,h2g} TOCTOU\n\nvsock_find_cid() and vsock_dev_do_ioctl() may race with module unload.\ntransport_{g2h,h2g} may become NULL after the NULL check.\n\nIntroduce vsock_transport_local_cid() to protect from a potential\nnull-ptr-deref.\n\nKASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f]\nRIP: 0010:vsock_find_cid+0x47/0x90\nCall Trace:\n __vsock_bind+0x4b2/0x720\n vsock_bind+0x90/0xe0\n __sys_bind+0x14d/0x1e0\n __x64_sys_bind+0x6e/0xc0\n do_syscall_64+0x92/0x1c0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\nKASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f]\nRIP: 0010:vsock_dev_do_ioctl.isra.0+0x58/0xf0\nCall Trace:\n __x64_sys_ioctl+0x12d/0x190\n do_syscall_64+0x92/0x1c0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53(CVE-2025-38462)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix use-after-free in crypt_message when using async crypto\n\nThe CVE-2024-50047 fix removed asynchronous crypto handling from\ncrypt_message(), assuming all crypto operations are synchronous.\nHowever, when hardware crypto accelerators are used, this can cause\nuse-after-free crashes:\n\n  crypt_message()\n    // Allocate the creq buffer containing the req\n    creq = smb2_get_aead_req(..., \u0026amp;req);\n\n    // Async encryption returns -EINPROGRESS immediately\n    rc = enc ? crypto_aead_encrypt(req) : crypto_aead_decrypt(req);\n\n    // Free creq while async operation is still in progress\n    kvfree_sensitive(creq, ...);\n\nHardware crypto modules often implement async AEAD operations for\nperformance. When crypto_aead_encrypt/decrypt() returns -EINPROGRESS,\nthe operation completes asynchronously. Without crypto_wait_req(),\nthe function immediately frees the request buffer, leading to crashes\nwhen the driver later accesses the freed memory.\n\nThis results in a use-after-free condition when the hardware crypto\ndriver later accesses the freed request structure, leading to kernel\ncrashes with NULL pointer dereferences.\n\nThe issue occurs because crypto_alloc_aead() with mask=0 doesn\u0026apos;t\nguarantee synchronous operation. Even without CRYPTO_ALG_ASYNC in\nthe mask, async implementations can be selected.\n\nFix by restoring the async crypto handling:\n- DECLARE_CRYPTO_WAIT(wait) for completion tracking\n- aead_request_set_callback() for async completion notification\n- crypto_wait_req() to wait for operation completion\n\nThis ensures the request buffer isn\u0026apos;t freed until the crypto operation\ncompletes, whether synchronous or asynchronous, while preserving the\nCVE-2024-50047 fix.(CVE-2025-38488)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nclone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns\n\nWhat we want is to verify there is that clone won\u0026apos;t expose something\nhidden by a mount we wouldn\u0026apos;t be able to undo.  \u0026quot;Wouldn\u0026apos;t be able to undo\u0026quot;\nmay be a result of MNT_LOCKED on a child, but it may also come from\nlacking admin rights in the userns of the namespace mount belongs to.\n\nclone_private_mnt() checks the former, but not the latter.\n\nThere\u0026apos;s a number of rather confusing CAP_SYS_ADMIN checks in various\nuserns during the mount, especially with the new mount API; they serve\ndifferent purposes and in case of clone_private_mnt() they usually,\nbut not always end up covering the missing check mentioned above.(CVE-2025-38499)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: plug races between subflow fail and subflow creation\n\nWe have races similar to the one addressed by the previous patch between\nsubflow failing and additional subflow creation. They are just harder to\ntrigger.\n\nThe solution is similar. Use a separate flag to track the condition\n\u0026apos;socket state prevent any additional subflow creation\u0026apos; protected by the\nfallback lock.\n\nThe socket fallback makes such flag true, and also receiving or sending\nan MP_FAIL option.\n\nThe field \u0026apos;allow_infinite_fallback\u0026apos; is now always touched under the\nrelevant lock, we can drop the ONCE annotation on write.(CVE-2025-38552)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: use aead_request_free to match aead_request_alloc\n\nUse aead_request_free() instead of kfree() to properly free memory\nallocated by aead_request_alloc(). This ensures sensitive crypto data\nis zeroed before being freed.(CVE-2025-38575)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nPM / devfreq: Check governor before using governor-\u0026gt;name\n\nCommit 96ffcdf239de (\u0026quot;PM / devfreq: Remove redundant governor_name from\nstruct devfreq\u0026quot;) removes governor_name and uses governor-\u0026gt;name to replace\nit. But devfreq-\u0026gt;governor may be NULL and directly using\ndevfreq-\u0026gt;governor-\u0026gt;name may cause null pointer exception. Move the check of\ngovernor to before using governor-\u0026gt;name.(CVE-2025-38609)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ctnetlink: fix refcount leak on table dump\n\nThere is a reference count leak in ctnetlink_dump_table():\n      if (res \u0026lt; 0) {\n                nf_conntrack_get(\u0026amp;ct-\u0026gt;ct_general); // HERE\n                cb-\u0026gt;args[1] = (unsigned long)ct;\n                ...\n\nWhile its very unlikely, its possible that ct == last.\nIf this happens, then the refcount of ct was already incremented.\nThis 2nd increment is never undone.\n\nThis prevents the conntrack object from being released, which in turn\nkeeps prevents cnet-\u0026gt;count from dropping back to 0.\n\nThis will then block the netns dismantle (or conntrack rmmod) as\nnf_conntrack_cleanup_net_list() will wait forever.\n\nThis can be reproduced by running conntrack_resize.sh selftest in a loop.\nIt takes ~20 minutes for me on a preemptible kernel on average before\nI see a runaway kworker spinning in nf_conntrack_cleanup_net_list.\n\nOne fix would to change this to:\n        if (res \u0026lt; 0) {\n\t\tif (ct != last)\n\t                nf_conntrack_get(\u0026amp;ct-\u0026gt;ct_general);\n\nBut this reference counting isn\u0026apos;t needed in the first place.\nWe can just store a cookie value instead.\n\nA followup patch will do the same for ctnetlink_exp_dump_table,\nit looks to me as if this has the same problem and like\nctnetlink_dump_table, we only need a \u0026apos;skip hint\u0026apos;, not the actual\nobject so we can apply the same cookie strategy there as well.(CVE-2025-38721)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla4xxx: Prevent a potential error pointer dereference\n\nThe qla4xxx_get_ep_fwdb() function is supposed to return NULL on error,\nbut qla4xxx_ep_connect() returns error pointers.  Propagating the error\npointers will lead to an Oops in the caller, so change the error pointers\nto NULL.(CVE-2025-39676)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntls: fix handling of zero-length records on the rx_list\n\nEach recvmsg() call must process either\n - only contiguous DATA records (any number of them)\n - one non-DATA record\n\nIf the next record has different type than what has already been\nprocessed we break out of the main processing loop. If the record\nhas already been decrypted (which may be the case for TLS 1.3 where\nwe don\u0026apos;t know type until decryption) we queue the pending record\nto the rx_list. Next recvmsg() will pick it up from there.\n\nQueuing the skb to rx_list after zero-copy decrypt is not possible,\nsince in that case we decrypted directly to the user space buffer,\nand we don\u0026apos;t have an skb to queue (darg.skb points to the ciphertext\nskb for access to metadata like length).\n\nOnly data records are allowed zero-copy, and we break the processing\nloop after each non-data record. So we should never zero-copy and\nthen find out that the record type has changed. The corner case\nwe missed is when the initial record comes from rx_list, and it\u0026apos;s\nzero length.(CVE-2025-39682)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv6: sr: Fix MAC comparison to be constant-time\n\nTo prevent timing attacks, MACs need to be compared in constant time.\nUse the appropriate helper function for this.(CVE-2025-39702)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nclk: samsung: Fix UBSAN panic in samsung_clk_init()\n\nWith UBSAN_ARRAY_BOUNDS=y, I\u0026apos;m hitting the below panic due to\ndereferencing `ctx-\u0026gt;clk_data.hws` before setting\n`ctx-\u0026gt;clk_data.num = nr_clks`. Move that up to fix the crash.\n\n  UBSAN: array index out of bounds: 00000000f2005512 [#1] PREEMPT SMP\n  \u0026lt;snip\u0026gt;\n  Call trace:\n   samsung_clk_init+0x110/0x124 (P)\n   samsung_clk_init+0x48/0x124 (L)\n   samsung_cmu_register_one+0x3c/0xa0\n   exynos_arm64_register_cmu+0x54/0x64\n   __gs101_cmu_top_of_clk_init_declare+0x28/0x60\n   ...(CVE-2025-39728)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfs: Prevent file descriptor table allocations exceeding INT_MAX\n\nWhen sysctl_nr_open is set to a very high value (for example, 1073741816\nas set by systemd), processes attempting to use file descriptors near\nthe limit can trigger massive memory allocation attempts that exceed\nINT_MAX, resulting in a WARNING in mm/slub.c:\n\n  WARNING: CPU: 0 PID: 44 at mm/slub.c:5027 __kvmalloc_node_noprof+0x21a/0x288\n\nThis happens because kvmalloc_array() and kvmalloc() check if the\nrequested size exceeds INT_MAX and emit a warning when the allocation is\nnot flagged with __GFP_NOWARN.\n\nSpecifically, when nr_open is set to 1073741816 (0x3ffffff8) and a\nprocess calls dup2(oldfd, 1073741880), the kernel attempts to allocate:\n- File descriptor array: 1073741880 * 8 bytes = 8,589,935,040 bytes\n- Multiple bitmaps: ~400MB\n- Total allocation size: \u0026gt; 8GB (exceeding INT_MAX = 2,147,483,647)\n\nReproducer:\n1. Set /proc/sys/fs/nr_open to 1073741816:\n   # echo 1073741816 \u0026gt; /proc/sys/fs/nr_open\n\n2. Run a program that uses a high file descriptor:\n   #include \u0026lt;unistd.h\u0026gt;\n   #include \u0026lt;sys/resource.h\u0026gt;\n\n   int main() {\n       struct rlimit rlim = {1073741824, 1073741824};\n       setrlimit(RLIMIT_NOFILE, \u0026amp;rlim);\n       dup2(2, 1073741880);  // Triggers the warning\n       return 0;\n   }\n\n3. Observe WARNING in dmesg at mm/slub.c:5027\n\nsystemd commit a8b627a introduced automatic bumping of fs.nr_open to the\nmaximum possible value. The rationale was that systems with memory\ncontrol groups (memcg) no longer need separate file descriptor limits\nsince memory is properly accounted. However, this change overlooked\nthat:\n\n1. The kernel\u0026apos;s allocation functions still enforce INT_MAX as a maximum\n   size regardless of memcg accounting\n2. Programs and tests that legitimately test file descriptor limits can\n   inadvertently trigger massive allocations\n3. The resulting allocations (\u0026gt;8GB) are impractical and will always fail\n\nsystemd\u0026apos;s algorithm starts with INT_MAX and keeps halving the value\nuntil the kernel accepts it. On most systems, this results in nr_open\nbeing set to 1073741816 (0x3ffffff8), which is just under 1GB of file\ndescriptors.\n\nWhile processes rarely use file descriptors near this limit in normal\noperation, certain selftests (like\ntools/testing/selftests/core/unshare_test.c) and programs that test file\ndescriptor limits can trigger this issue.\n\nFix this by adding a check in alloc_fdtable() to ensure the requested\nallocation size does not exceed INT_MAX. This causes the operation to\nfail with -EMFILE instead of triggering a kernel warning and avoids the\nimpractical \u0026gt;8GB memory allocation request.(CVE-2025-39756)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM\n\nWhen performing Generic Segmentation Offload (GSO) on an IPv6 packet that\ncontains extension headers, the kernel incorrectly requests checksum offload\nif the egress device only advertises NETIF_F_IPV6_CSUM feature, which has\na strict contract: it supports checksum offload only for plain TCP or UDP\nover IPv6 and explicitly does not support packets with extension headers.\nThe current GSO logic violates this contract by failing to disable the feature\nfor packets with extension headers, such as those used in GREoIPv6 tunnels.\n\nThis violation results in the device being asked to perform an operation\nit cannot support, leading to a `skb_warn_bad_offload` warning and a collapse\nof network throughput. While device TSO/USO is correctly bypassed in favor\nof software GSO for these packets, the GSO stack must be explicitly told not\nto request checksum offload.\n\nMask NETIF_F_IPV6_CSUM, NETIF_F_TSO6 and NETIF_F_GSO_UDP_L4\nin gso_features_check if the IPv6 header contains extension headers to compute\nchecksum in software.\n\nThe exception is a BIG TCP extension, which, as stated in commit\n68e068cabd2c6c53 (\u0026quot;net: reenable NETIF_F_IPV6_CSUM offload for BIG TCP packets\u0026quot;):\n\u0026quot;The feature is only enabled on devices that support BIG TCP TSO.\nThe header is only present for PF_PACKET taps like tcpdump,\nand not transmitted by physical devices.\u0026quot;\n\nkernel log output (truncated):\nWARNING: CPU: 1 PID: 5273 at net/core/dev.c:3535 skb_warn_bad_offload+0x81/0x140\n...\nCall Trace:\n \u0026lt;TASK\u0026gt;\n skb_checksum_help+0x12a/0x1f0\n validate_xmit_skb+0x1a3/0x2d0\n validate_xmit_skb_list+0x4f/0x80\n sch_direct_xmit+0x1a2/0x380\n __dev_xmit_skb+0x242/0x670\n __dev_queue_xmit+0x3fc/0x7f0\n ip6_finish_output2+0x25e/0x5d0\n ip6_finish_output+0x1fc/0x3f0\n ip6_tnl_xmit+0x608/0xc00 [ip6_tunnel]\n ip6gre_tunnel_xmit+0x1c0/0x390 [ip6_gre]\n dev_hard_start_xmit+0x63/0x1c0\n __dev_queue_xmit+0x6d0/0x7f0\n ip6_finish_output2+0x214/0x5d0\n ip6_finish_output+0x1fc/0x3f0\n ip6_xmit+0x2ca/0x6f0\n ip6_finish_output+0x1fc/0x3f0\n ip6_xmit+0x2ca/0x6f0\n inet6_csk_xmit+0xeb/0x150\n __tcp_transmit_skb+0x555/0xa80\n tcp_write_xmit+0x32a/0xe90\n tcp_sendmsg_locked+0x437/0x1110\n tcp_sendmsg+0x2f/0x50\n...\nskb linear:   00000000: e4 3d 1a 7d ec 30 e4 3d 1a 7e 5d 90 86 dd 60 0e\nskb linear:   00000010: 00 0a 1b 34 3c 40 20 11 00 00 00 00 00 00 00 00\nskb linear:   00000020: 00 00 00 00 00 12 20 11 00 00 00 00 00 00 00 00\nskb linear:   00000030: 00 00 00 00 00 11 2f 00 04 01 04 01 01 00 00 00\nskb linear:   00000040: 86 dd 60 0e 00 0a 1b 00 06 40 20 23 00 00 00 00\nskb linear:   00000050: 00 00 00 00 00 00 00 00 00 12 20 23 00 00 00 00\nskb linear:   00000060: 00 00 00 00 00 00 00 00 00 11 bf 96 14 51 13 f9\nskb linear:   00000070: ae 27 a0 a8 2b e3 80 18 00 40 5b 6f 00 00 01 01\nskb linear:   00000080: 08 0a 42 d4 50 d5 4b 70 f8 1a(CVE-2025-39770)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsctp: initialize more fields in sctp_v6_from_sk()\n\nsyzbot found that sin6_scope_id was not properly initialized,\nleading to undefined behavior.\n\nClear sin6_scope_id and sin6_flowinfo.\n\nBUG: KMSAN: uninit-value in __sctp_v6_cmp_addr+0x887/0x8c0 net/sctp/ipv6.c:649\n  __sctp_v6_cmp_addr+0x887/0x8c0 net/sctp/ipv6.c:649\n  sctp_inet6_cmp_addr+0x4f2/0x510 net/sctp/ipv6.c:983\n  sctp_bind_addr_conflict+0x22a/0x3b0 net/sctp/bind_addr.c:390\n  sctp_get_port_local+0x21eb/0x2440 net/sctp/socket.c:8452\n  sctp_get_port net/sctp/socket.c:8523 [inline]\n  sctp_listen_start net/sctp/socket.c:8567 [inline]\n  sctp_inet_listen+0x710/0xfd0 net/sctp/socket.c:8636\n  __sys_listen_socket net/socket.c:1912 [inline]\n  __sys_listen net/socket.c:1927 [inline]\n  __do_sys_listen net/socket.c:1932 [inline]\n  __se_sys_listen net/socket.c:1930 [inline]\n  __x64_sys_listen+0x343/0x4c0 net/socket.c:1930\n  x64_sys_call+0x271d/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:51\n  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n  do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nLocal variable addr.i.i created at:\n  sctp_get_port net/sctp/socket.c:8515 [inline]\n  sctp_listen_start net/sctp/socket.c:8567 [inline]\n  sctp_inet_listen+0x650/0xfd0 net/sctp/socket.c:8636\n  __sys_listen_socket net/socket.c:1912 [inline]\n  __sys_listen net/socket.c:1927 [inline]\n  __do_sys_listen net/socket.c:1932 [inline]\n  __se_sys_listen net/socket.c:1930 [inline]\n  __x64_sys_listen+0x343/0x4c0 net/socket.c:1930(CVE-2025-39812)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Fix buffer free/clear order in deferred receive path\n\nFix a use-after-free window by correcting the buffer release sequence in\nthe deferred receive path. The code freed the RQ buffer first and only\nthen cleared the context pointer under the lock. Concurrent paths (e.g.,\nABTS and the repost path) also inspect and release the same pointer under\nthe lock, so the old order could lead to double-free/UAF.\n\nNote that the repost path already uses the correct pattern: detach the\npointer under the lock, then free it after dropping the lock. The\ndeferred path should do the same.(CVE-2025-39841)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm\n\nWhen send a broadcast packet to a tap device, which was added to a bridge,\nbr_nf_local_in() is called to confirm the conntrack. If another conntrack\nwith the same hash value is added to the hash table, which can be\ntriggered by a normal packet to a non-bridge device, the below warning\nmay happen.\n\n  ------------[ cut here ]------------\n  WARNING: CPU: 1 PID: 96 at net/bridge/br_netfilter_hooks.c:632 br_nf_local_in+0x168/0x200\n  CPU: 1 UID: 0 PID: 96 Comm: tap_send Not tainted 6.17.0-rc2-dirty #44 PREEMPT(voluntary)\n  RIP: 0010:br_nf_local_in+0x168/0x200\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   nf_hook_slow+0x3e/0xf0\n   br_pass_frame_up+0x103/0x180\n   br_handle_frame_finish+0x2de/0x5b0\n   br_nf_hook_thresh+0xc0/0x120\n   br_nf_pre_routing_finish+0x168/0x3a0\n   br_nf_pre_routing+0x237/0x5e0\n   br_handle_frame+0x1ec/0x3c0\n   __netif_receive_skb_core+0x225/0x1210\n   __netif_receive_skb_one_core+0x37/0xa0\n   netif_receive_skb+0x36/0x160\n   tun_get_user+0xa54/0x10c0\n   tun_chr_write_iter+0x65/0xb0\n   vfs_write+0x305/0x410\n   ksys_write+0x60/0xd0\n   do_syscall_64+0xa4/0x260\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n   \u0026lt;/TASK\u0026gt;\n  ---[ end trace 0000000000000000 ]---\n\nTo solve the hash conflict, nf_ct_resolve_clash() try to merge the\nconntracks, and update skb-\u0026gt;_nfct. However, br_nf_local_in() still use the\nold ct from local variable \u0026apos;nfct\u0026apos; after confirm(), which leads to this\nwarning.\n\nIf confirm() does not insert the conntrack entry and return NF_DROP, the\nwarning may also occur. There is no need to reserve the WARN_ON_ONCE, just\nremove it.(CVE-2025-39894)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer\n\nSince commit 7d5e9737efda (\u0026quot;net: rfkill: gpio: get the name and type from\ndevice property\u0026quot;) rfkill_find_type() gets called with the possibly\nuninitialized \u0026quot;const char *type_name;\u0026quot; local variable.\n\nOn x86 systems when rfkill-gpio binds to a \u0026quot;BCM4752\u0026quot; or \u0026quot;LNV4752\u0026quot;\nacpi_device, the rfkill-\u0026gt;type is set based on the ACPI acpi_device_id:\n\n        rfkill-\u0026gt;type = (unsigned)id-\u0026gt;driver_data;\n\nand there is no \u0026quot;type\u0026quot; property so device_property_read_string() will fail\nand leave type_name uninitialized, leading to a potential crash.\n\nrfkill_find_type() does accept a NULL pointer, fix the potential crash\nby initializing type_name to NULL.\n\nNote likely sofar this has not been caught because:\n\n1. Not many x86 machines actually have a \u0026quot;BCM4752\u0026quot;/\u0026quot;LNV4752\u0026quot; acpi_device\n2. The stack happened to contain NULL where type_name is stored(CVE-2025-39937)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Clear tcp_sk(sk)-\u0026gt;fastopen_rsk in tcp_disconnect().\n\nsyzbot reported the splat below where a socket had tcp_sk(sk)-\u0026gt;fastopen_rsk\nin the TCP_ESTABLISHED state. [0]\n\nsyzbot reused the server-side TCP Fast Open socket as a new client before\nthe TFO socket completes 3WHS:\n\n  1. accept()\n  2. connect(AF_UNSPEC)\n  3. connect() to another destination\n\nAs of accept(), sk-\u0026gt;sk_state is TCP_SYN_RECV, and tcp_disconnect() changes\nit to TCP_CLOSE and makes connect() possible, which restarts timers.\n\nSince tcp_disconnect() forgot to clear tcp_sk(sk)-\u0026gt;fastopen_rsk, the\nretransmit timer triggered the warning and the intended packet was not\nretransmitted.\n\nLet\u0026apos;s call reqsk_fastopen_remove() in tcp_disconnect().\n\n[0]:\nWARNING: CPU: 2 PID: 0 at net/ipv4/tcp_timer.c:542 tcp_retransmit_timer (net/ipv4/tcp_timer.c:542 (discriminator 7))\nModules linked in:\nCPU: 2 UID: 0 PID: 0 Comm: swapper/2 Not tainted 6.17.0-rc5-g201825fb4278 #62 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\nRIP: 0010:tcp_retransmit_timer (net/ipv4/tcp_timer.c:542 (discriminator 7))\nCode: 41 55 41 54 55 53 48 8b af b8 08 00 00 48 89 fb 48 85 ed 0f 84 55 01 00 00 0f b6 47 12 3c 03 74 0c 0f b6 47 12 3c 04 74 04 90 \u0026lt;0f\u0026gt; 0b 90 48 8b 85 c0 00 00 00 48 89 ef 48 8b 40 30 e8 6a 4f 06 3e\nRSP: 0018:ffffc900002f8d40 EFLAGS: 00010293\nRAX: 0000000000000002 RBX: ffff888106911400 RCX: 0000000000000017\nRDX: 0000000002517619 RSI: ffffffff83764080 RDI: ffff888106911400\nRBP: ffff888106d5c000 R08: 0000000000000001 R09: ffffc900002f8de8\nR10: 00000000000000c2 R11: ffffc900002f8ff8 R12: ffff888106911540\nR13: ffff888106911480 R14: ffff888106911840 R15: ffffc900002f8de0\nFS:  0000000000000000(0000) GS:ffff88907b768000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f8044d69d90 CR3: 0000000002c30003 CR4: 0000000000370ef0\nCall Trace:\n \u0026lt;IRQ\u0026gt;\n tcp_write_timer (net/ipv4/tcp_timer.c:738)\n call_timer_fn (kernel/time/timer.c:1747)\n __run_timers (kernel/time/timer.c:1799 kernel/time/timer.c:2372)\n timer_expire_remote (kernel/time/timer.c:2385 kernel/time/timer.c:2376 kernel/time/timer.c:2135)\n tmigr_handle_remote_up (kernel/time/timer_migration.c:944 kernel/time/timer_migration.c:1035)\n __walk_groups.isra.0 (kernel/time/timer_migration.c:533 (discriminator 1))\n tmigr_handle_remote (kernel/time/timer_migration.c:1096)\n handle_softirqs (./arch/x86/include/asm/jump_label.h:36 ./include/trace/events/irq.h:142 kernel/softirq.c:580)\n irq_exit_rcu (kernel/softirq.c:614 kernel/softirq.c:453 kernel/softirq.c:680 kernel/softirq.c:696)\n sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1050 (discriminator 35) arch/x86/kernel/apic/apic.c:1050 (discriminator 35))\n \u0026lt;/IRQ\u0026gt;(CVE-2025-39955)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnexthop: Forbid FDB status change while nexthop is in a group\n\nThe kernel forbids the creation of non-FDB nexthop groups with FDB\nnexthops:\n\n # ip nexthop add id 1 via 192.0.2.1 fdb\n # ip nexthop add id 2 group 1\n Error: Non FDB nexthop group cannot have fdb nexthops.\n\nAnd vice versa:\n\n # ip nexthop add id 3 via 192.0.2.2 dev dummy1\n # ip nexthop add id 4 group 3 fdb\n Error: FDB nexthop group can only have fdb nexthops.\n\nHowever, as long as no routes are pointing to a non-FDB nexthop group,\nthe kernel allows changing the type of a nexthop from FDB to non-FDB and\nvice versa:\n\n # ip nexthop add id 5 via 192.0.2.2 dev dummy1\n # ip nexthop add id 6 group 5\n # ip nexthop replace id 5 via 192.0.2.2 fdb\n # echo $?\n 0\n\nThis configuration is invalid and can result in a NPD [1] since FDB\nnexthops are not associated with a nexthop device:\n\n # ip route add 198.51.100.1/32 nhid 6\n # ping 198.51.100.1\n\nFix by preventing nexthop FDB status change while the nexthop is in a\ngroup:\n\n # ip nexthop add id 7 via 192.0.2.2 dev dummy1\n # ip nexthop add id 8 group 7\n # ip nexthop replace id 7 via 192.0.2.2 fdb\n Error: Cannot change nexthop FDB status while in a group.\n\n[1]\nBUG: kernel NULL pointer dereference, address: 00000000000003c0\n[...]\nOops: Oops: 0000 [#1] SMP\nCPU: 6 UID: 0 PID: 367 Comm: ping Not tainted 6.17.0-rc6-virtme-gb65678cacc03 #1 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014\nRIP: 0010:fib_lookup_good_nhc+0x1e/0x80\n[...]\nCall Trace:\n \u0026lt;TASK\u0026gt;\n fib_table_lookup+0x541/0x650\n ip_route_output_key_hash_rcu+0x2ea/0x970\n ip_route_output_key_hash+0x55/0x80\n __ip4_datagram_connect+0x250/0x330\n udp_connect+0x2b/0x60\n __sys_connect+0x9c/0xd0\n __x64_sys_connect+0x18/0x20\n do_syscall_64+0xa4/0x2a0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53(CVE-2025-39980)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipvs: Defer ip_vs_ftp unregister during netns cleanup\n\nOn the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp\nbefore connections with valid cp-\u0026gt;app pointers are flushed, leading to a\nuse-after-free.\n\nFix this by introducing a global `exiting_module` flag, set to true in\nip_vs_ftp_exit() before unregistering the pernet subsystem. In\n__ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns\ncleanup (when exiting_module is false) and defer it to\n__ip_vs_cleanup_batch(), which unregisters all apps after all connections\nare flushed. If called during module exit, unregister ip_vs_ftp\nimmediately.(CVE-2025-40018)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: hisilicon/qm - set NULL to qm-\u0026gt;debug.qm_diff_regs\n\nWhen the initialization of qm-\u0026gt;debug.acc_diff_reg fails,\nthe probe process does not exit. However, after qm-\u0026gt;debug.qm_diff_regs is\nfreed, it is not set to NULL. This can lead to a double free when the\nremove process attempts to free it again. Therefore, qm-\u0026gt;debug.qm_diff_regs\nshould be set to NULL after it is freed.(CVE-2025-40062)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Explicitly check accesses to bpf_sock_addr\n\nSyzkaller found a kernel warning on the following sock_addr program:\n\n    0: r0 = 0\n    1: r2 = *(u32 *)(r1 +60)\n    2: exit\n\nwhich triggers:\n\n    verifier bug: error during ctx access conversion (0)\n\nThis is happening because offset 60 in bpf_sock_addr corresponds to an\nimplicit padding of 4 bytes, right after msg_src_ip4. Access to this\npadding isn\u0026apos;t rejected in sock_addr_is_valid_access and it thus later\nfails to convert the access.\n\nThis patch fixes it by explicitly checking the various fields of\nbpf_sock_addr in sock_addr_is_valid_access.\n\nI checked the other ctx structures and is_valid_access functions and\ndidn\u0026apos;t find any other similar cases. Other cases of (properly handled)\npadding are covered in new tests in a subsequent patch.(CVE-2025-40078)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: hisilicon/qm - request reserved interrupt for virtual function\n\nThe device interrupt vector 3 is an error interrupt for\nphysical function and a reserved interrupt for virtual function.\nHowever, the driver has not registered the reserved interrupt for\nvirtual function. When allocating interrupts, the number of interrupts\nis allocated based on powers of two, which includes this interrupt.\nWhen the system enables GICv4 and the virtual function passthrough\nto the virtual machine, releasing the interrupt in the driver\ntriggers a warning.\n\nThe WARNING report is:\nWARNING: CPU: 62 PID: 14889 at arch/arm64/kvm/vgic/vgic-its.c:852 its_free_ite+0x94/0xb4\n\nTherefore, register a reserved interrupt for VF and set the\nIRQF_NO_AUTOEN flag to avoid that warning.(CVE-2025-40136)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsctp: avoid NULL dereference when chunk data buffer is missing\n\nchunk-\u0026gt;skb pointer is dereferenced in the if-block where it\u0026apos;s supposed\nto be NULL only.\n\nchunk-\u0026gt;skb can only be NULL if chunk-\u0026gt;head_skb is not. Check for frag_list\ninstead and do it just before replacing chunk-\u0026gt;skb. We\u0026apos;re sure that\notherwise chunk-\u0026gt;skb is non-NULL because of outer if() condition.(CVE-2025-40240)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: remove never-working support for setting nsh fields\n\nThe validation of the set(nsh(...)) action is completely wrong.\nIt runs through the nsh_key_put_from_nlattr() function that is the\nsame function that validates NSH keys for the flow match and the\npush_nsh() action.  However, the set(nsh(...)) has a very different\nmemory layout.  Nested attributes in there are doubled in size in\ncase of the masked set().  That makes proper validation impossible.\n\nThere is also confusion in the code between the \u0026apos;masked\u0026apos; flag, that\nsays that the nested attributes are doubled in size containing both\nthe value and the mask, and the \u0026apos;is_mask\u0026apos; that says that the value\nwe\u0026apos;re parsing is the mask.  This is causing kernel crash on trying to\nwrite into mask part of the match with SW_FLOW_KEY_PUT() during\nvalidation, while validate_nsh() doesn\u0026apos;t allocate any memory for it:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000018\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  PGD 1c2383067 P4D 1c2383067 PUD 20b703067 PMD 0\n  Oops: Oops: 0000 [#1] SMP NOPTI\n  CPU: 8 UID: 0 Kdump: loaded Not tainted 6.17.0-rc4+ #107 PREEMPT(voluntary)\n  RIP: 0010:nsh_key_put_from_nlattr+0x19d/0x610 [openvswitch]\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   validate_nsh+0x60/0x90 [openvswitch]\n   validate_set.constprop.0+0x270/0x3c0 [openvswitch]\n   __ovs_nla_copy_actions+0x477/0x860 [openvswitch]\n   ovs_nla_copy_actions+0x8d/0x100 [openvswitch]\n   ovs_packet_cmd_execute+0x1cc/0x310 [openvswitch]\n   genl_family_rcv_msg_doit+0xdb/0x130\n   genl_family_rcv_msg+0x14b/0x220\n   genl_rcv_msg+0x47/0xa0\n   netlink_rcv_skb+0x53/0x100\n   genl_rcv+0x24/0x40\n   netlink_unicast+0x280/0x3b0\n   netlink_sendmsg+0x1f7/0x430\n   ____sys_sendmsg+0x36b/0x3a0\n   ___sys_sendmsg+0x87/0xd0\n   __sys_sendmsg+0x6d/0xd0\n   do_syscall_64+0x7b/0x2c0\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nThe third issue with this process is that while trying to convert\nthe non-masked set into masked one, validate_set() copies and doubles\nthe size of the OVS_KEY_ATTR_NSH as if it didn\u0026apos;t have any nested\nattributes.  It should be copying each nested attribute and doubling\nthem in size independently.  And the process must be properly reversed\nduring the conversion back from masked to a non-masked variant during\nthe flow dump.\n\nIn the end, the only two outcomes of trying to use this action are\neither validation failure or a kernel crash.  And if somehow someone\nmanages to install a flow with such an action, it will most definitely\nnot do what it is supposed to, since all the keys and the masks are\nmixed up.\n\nFixing all the issues is a complex task as it requires re-writing\nmost of the validation code.\n\nGiven that and the fact that this functionality never worked since\nintroduction, let\u0026apos;s just remove it altogether.  It\u0026apos;s better to\nre-introduce it later with a proper implementation instead of trying\nto fix it in stable releases.(CVE-2025-40254)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntipc: Fix use-after-free in tipc_mon_reinit_self().\n\nsyzbot reported use-after-free of tipc_net(net)-\u0026gt;monitors[]\nin tipc_mon_reinit_self(). [0]\n\nThe array is protected by RTNL, but tipc_mon_reinit_self()\niterates over it without RTNL.\n\ntipc_mon_reinit_self() is called from tipc_net_finalize(),\nwhich is always under RTNL except for tipc_net_finalize_work().\n\nLet\u0026apos;s hold RTNL in tipc_net_finalize_work().\n\n[0]:\nBUG: KASAN: slab-use-after-free in __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]\nBUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162\nRead of size 1 at addr ffff88805eae1030 by task kworker/0:7/5989\n\nCPU: 0 UID: 0 PID: 5989 Comm: kworker/0:7 Not tainted syzkaller #0 PREEMPT_{RT,(full)}\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025\nWorkqueue: events tipc_net_finalize_work\nCall Trace:\n \u0026lt;TASK\u0026gt;\n dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xca/0x240 mm/kasan/report.c:482\n kasan_report+0x118/0x150 mm/kasan/report.c:595\n __kasan_check_byte+0x2a/0x40 mm/kasan/common.c:568\n kasan_check_byte include/linux/kasan.h:399 [inline]\n lock_acquire+0x8d/0x360 kernel/locking/lockdep.c:5842\n __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]\n _raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162\n rtlock_slowlock kernel/locking/rtmutex.c:1894 [inline]\n rwbase_rtmutex_lock_state kernel/locking/spinlock_rt.c:160 [inline]\n rwbase_write_lock+0xd3/0x7e0 kernel/locking/rwbase_rt.c:244\n rt_write_lock+0x76/0x110 kernel/locking/spinlock_rt.c:243\n write_lock_bh include/linux/rwlock_rt.h:99 [inline]\n tipc_mon_reinit_self+0x79/0x430 net/tipc/monitor.c:718\n tipc_net_finalize+0x115/0x190 net/tipc/net.c:140\n process_one_work kernel/workqueue.c:3236 [inline]\n process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3319\n worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400\n kthread+0x70e/0x8a0 kernel/kthread.c:463\n ret_from_fork+0x439/0x7d0 arch/x86/kernel/process.c:148\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n \u0026lt;/TASK\u0026gt;\n\nAllocated by task 6089:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x3e/0x80 mm/kasan/common.c:68\n poison_kmalloc_redzone mm/kasan/common.c:388 [inline]\n __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:405\n kasan_kmalloc include/linux/kasan.h:260 [inline]\n __kmalloc_cache_noprof+0x1a8/0x320 mm/slub.c:4407\n kmalloc_noprof include/linux/slab.h:905 [inline]\n kzalloc_noprof include/linux/slab.h:1039 [inline]\n tipc_mon_create+0xc3/0x4d0 net/tipc/monitor.c:657\n tipc_enable_bearer net/tipc/bearer.c:357 [inline]\n __tipc_nl_bearer_enable+0xe16/0x13f0 net/tipc/bearer.c:1047\n __tipc_nl_compat_doit net/tipc/netlink_compat.c:371 [inline]\n tipc_nl_compat_doit+0x3bc/0x5f0 net/tipc/netlink_compat.c:393\n tipc_nl_compat_handle net/tipc/netlink_compat.c:-1 [inline]\n tipc_nl_compat_recv+0x83c/0xbe0 net/tipc/netlink_compat.c:1321\n genl_family_rcv_msg_doit+0x215/0x300 net/netlink/genetlink.c:1115\n genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]\n genl_rcv_msg+0x60e/0x790 net/netlink/genetlink.c:1210\n netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552\n genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219\n netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]\n netlink_unicast+0x846/0xa10 net/netlink/af_netlink.c:1346\n netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896\n sock_sendmsg_nosec net/socket.c:714 [inline]\n __sock_sendmsg+0x21c/0x270 net/socket.c:729\n ____sys_sendmsg+0x508/0x820 net/socket.c:2614\n ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668\n __sys_sendmsg net/socket.c:2700 [inline]\n __do_sys_sendmsg net/socket.c:2705 [inline]\n __se_sys_sendmsg net/socket.c:2703 [inline]\n __x64_sys_sendmsg+0x1a1/0x260 net/socket.c:2703\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xfa/0x3b0 arch/\n---truncated---(CVE-2025-40280)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto\n\nsyzbot reported a possible shift-out-of-bounds [1]\n\nBlamed commit added rto_alpha_max and rto_beta_max set to 1000.\n\nIt is unclear if some sctp users are setting very large rto_alpha\nand/or rto_beta.\n\nIn order to prevent user regression, perform the test at run time.\n\nAlso add READ_ONCE() annotations as sysctl values can change under us.\n\n[1]\n\nUBSAN: shift-out-of-bounds in net/sctp/transport.c:509:41\nshift exponent 64 is too large for 32-bit type \u0026apos;unsigned int\u0026apos;\nCPU: 0 UID: 0 PID: 16704 Comm: syz.2.2320 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025\nCall Trace:\n \u0026lt;TASK\u0026gt;\n  __dump_stack lib/dump_stack.c:94 [inline]\n  dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120\n  ubsan_epilogue lib/ubsan.c:233 [inline]\n  __ubsan_handle_shift_out_of_bounds+0x27f/0x420 lib/ubsan.c:494\n  sctp_transport_update_rto.cold+0x1c/0x34b net/sctp/transport.c:509\n  sctp_check_transmitted+0x11c4/0x1c30 net/sctp/outqueue.c:1502\n  sctp_outq_sack+0x4ef/0x1b20 net/sctp/outqueue.c:1338\n  sctp_cmd_process_sack net/sctp/sm_sideeffect.c:840 [inline]\n  sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1372 [inline](CVE-2025-40281)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsctp: Prevent TOCTOU out-of-bounds write\n\nFor the following path not holding the sock lock,\n\n  sctp_diag_dump() -\u0026gt; sctp_for_each_endpoint() -\u0026gt; sctp_ep_dump()\n\nmake sure not to exceed bounds in case the address list has grown\nbetween buffer allocation (time-of-check) and write (time-of-use).(CVE-2025-40331)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: replace BUG_ON with bounds check for map-\u0026gt;max_osd\n\nOSD indexes come from untrusted network packets. Boundary checks are\nadded to validate these against map-\u0026gt;max_osd.\n\n[ idryomov: drop BUG_ON in ceph_get_primary_affinity(), minor cosmetic\n  edits ](CVE-2025-68283)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: prevent potential out-of-bounds writes in handle_auth_session_key()\n\nThe len field originates from untrusted network packets. Boundary\nchecks have been added to prevent potential out-of-bounds writes when\ndecrypting the connection secret or processing service tickets.\n\n[ idryomov: changelog ](CVE-2025-68284)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: fix potential use-after-free in have_mon_and_osd_map()\n\nThe wait loop in __ceph_open_session() can race with the client\nreceiving a new monmap or osdmap shortly after the initial map is\nreceived.  Both ceph_monc_handle_map() and handle_one_map() install\na new map immediately after freeing the old one\n\n    kfree(monc-\u0026gt;monmap);\n    monc-\u0026gt;monmap = monmap;\n\n    ceph_osdmap_destroy(osdc-\u0026gt;osdmap);\n    osdc-\u0026gt;osdmap = newmap;\n\nunder client-\u0026gt;monc.mutex and client-\u0026gt;osdc.lock respectively, but\nbecause neither is taken in have_mon_and_osd_map() it\u0026apos;s possible for\nclient-\u0026gt;monc.monmap-\u0026gt;epoch and client-\u0026gt;osdc.osdmap-\u0026gt;epoch arms in\n\n    client-\u0026gt;monc.monmap \u0026amp;\u0026amp; client-\u0026gt;monc.monmap-\u0026gt;epoch \u0026amp;\u0026amp;\n        client-\u0026gt;osdc.osdmap \u0026amp;\u0026amp; client-\u0026gt;osdc.osdmap-\u0026gt;epoch;\n\ncondition to dereference an already freed map.  This happens to be\nreproducible with generic/395 and generic/397 with KASAN enabled:\n\n    BUG: KASAN: slab-use-after-free in have_mon_and_osd_map+0x56/0x70\n    Read of size 4 at addr ffff88811012d810 by task mount.ceph/13305\n    CPU: 2 UID: 0 PID: 13305 Comm: mount.ceph Not tainted 6.14.0-rc2-build2+ #1266\n    ...\n    Call Trace:\n    \u0026lt;TASK\u0026gt;\n    have_mon_and_osd_map+0x56/0x70\n    ceph_open_session+0x182/0x290\n    ceph_get_tree+0x333/0x680\n    vfs_get_tree+0x49/0x180\n    do_new_mount+0x1a3/0x2d0\n    path_mount+0x6dd/0x730\n    do_mount+0x99/0xe0\n    __do_sys_mount+0x141/0x180\n    do_syscall_64+0x9f/0x100\n    entry_SYSCALL_64_after_hwframe+0x76/0x7e\n    \u0026lt;/TASK\u0026gt;\n\n    Allocated by task 13305:\n    ceph_osdmap_alloc+0x16/0x130\n    ceph_osdc_init+0x27a/0x4c0\n    ceph_create_client+0x153/0x190\n    create_fs_client+0x50/0x2a0\n    ceph_get_tree+0xff/0x680\n    vfs_get_tree+0x49/0x180\n    do_new_mount+0x1a3/0x2d0\n    path_mount+0x6dd/0x730\n    do_mount+0x99/0xe0\n    __do_sys_mount+0x141/0x180\n    do_syscall_64+0x9f/0x100\n    entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\n    Freed by task 9475:\n    kfree+0x212/0x290\n    handle_one_map+0x23c/0x3b0\n    ceph_osdc_handle_map+0x3c9/0x590\n    mon_dispatch+0x655/0x6f0\n    ceph_con_process_message+0xc3/0xe0\n    ceph_con_v1_try_read+0x614/0x760\n    ceph_con_workfn+0x2de/0x650\n    process_one_work+0x486/0x7c0\n    process_scheduled_works+0x73/0x90\n    worker_thread+0x1c8/0x2a0\n    kthread+0x2ec/0x300\n    ret_from_fork+0x24/0x40\n    ret_from_fork_asm+0x1a/0x30\n\nRewrite the wait loop to check the above condition directly with\nclient-\u0026gt;monc.mutex and client-\u0026gt;osdc.lock taken as appropriate.  While\nat it, improve the timeout handling (previously mount_timeout could be\nexceeded in case wait_event_interruptible_timeout() slept more than\nonce) and access client-\u0026gt;auth_err under client-\u0026gt;monc.mutex to match\nhow it\u0026apos;s set in finish_auth().\n\nmonmap_show() and osdmap_show() now take the respective lock before\naccessing the map as well.(CVE-2025-68285)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_core: lookup hci_conn on RX path on protocol side\n\nThe hdev lock/lookup/unlock/use pattern in the packet RX path doesn\u0026apos;t\nensure hci_conn* is not concurrently modified/deleted. This locking\nappears to be leftover from before conn_hash started using RCU\ncommit bf4c63252490b (\u0026quot;Bluetooth: convert conn hash to RCU\u0026quot;)\nand not clear if it had purpose since then.\n\nCurrently, there are code paths that delete hci_conn* from elsewhere\nthan the ordered hdev-\u0026gt;workqueue where the RX work runs in. E.g.\ncommit 5af1f84ed13a (\u0026quot;Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync\u0026quot;)\nintroduced some of these, and there probably were a few others before\nit.  It\u0026apos;s better to do the locking so that even if these run\nconcurrently no UAF is possible.\n\nMove the lookup of hci_conn and associated socket-specific conn to\nprotocol recv handlers, and do them within a single critical section\nto cover hci_conn* usage and lookup.\n\nsyzkaller has reported a crash that appears to be this issue:\n\n    [Task hdev-\u0026gt;workqueue]          [Task 2]\n                                    hci_disconnect_all_sync\n    l2cap_recv_acldata(hcon)\n                                      hci_conn_get(hcon)\n                                      hci_abort_conn_sync(hcon)\n                                        hci_dev_lock\n      hci_dev_lock\n                                        hci_conn_del(hcon)\n      v-------------------------------- hci_dev_unlock\n                                      hci_conn_put(hcon)\n      conn = hcon-\u0026gt;l2cap_data (UAF)(CVE-2025-68304)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nima: Handle error code returned by ima_filter_rule_match()\n\nIn ima_match_rules(), if ima_filter_rule_match() returns -ENOENT due to\nthe rule being NULL, the function incorrectly skips the \u0026apos;if (!rc)\u0026apos; check\nand sets \u0026apos;result = true\u0026apos;. The LSM rule is considered a match, causing\nextra files to be measured by IMA.\n\nThis issue can be reproduced in the following scenario:\nAfter unloading the SELinux policy module via \u0026apos;semodule -d\u0026apos;, if an IMA\nmeasurement is triggered before ima_lsm_rules is updated,\nin ima_match_rules(), the first call to ima_filter_rule_match() returns\n-ESTALE. This causes the code to enter the \u0026apos;if (rc == -ESTALE \u0026amp;\u0026amp;\n!rule_reinitialized)\u0026apos; block, perform ima_lsm_copy_rule() and retry. In\nima_lsm_copy_rule(), since the SELinux module has been removed, the rule\nbecomes NULL, and the second call to ima_filter_rule_match() returns\n-ENOENT. This bypasses the \u0026apos;if (!rc)\u0026apos; check and results in a false match.\n\nCall trace:\n  selinux_audit_rule_match+0x310/0x3b8\n  security_audit_rule_match+0x60/0xa0\n  ima_match_rules+0x2e4/0x4a0\n  ima_match_policy+0x9c/0x1e8\n  ima_get_action+0x48/0x60\n  process_measurement+0xf8/0xa98\n  ima_bprm_check+0x98/0xd8\n  security_bprm_check+0x5c/0x78\n  search_binary_handler+0x6c/0x318\n  exec_binprm+0x58/0x1b8\n  bprm_execve+0xb8/0x130\n  do_execveat_common.isra.0+0x1a8/0x258\n  __arm64_sys_execve+0x48/0x68\n  invoke_syscall+0x50/0x128\n  el0_svc_common.constprop.0+0xc8/0xf0\n  do_el0_svc+0x24/0x38\n  el0_svc+0x44/0x200\n  el0t_64_sync_handler+0x100/0x130\n  el0t_64_sync+0x3c8/0x3d0\n\nFix this by changing \u0026apos;if (!rc)\u0026apos; to \u0026apos;if (rc \u0026lt;= 0)\u0026apos; to ensure that error\ncodes like -ENOENT do not bypass the check and accidentally result in a\nsuccessful match.(CVE-2025-68740)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix invalid prog-\u0026gt;stats access when update_effective_progs fails\n\nSyzkaller triggers an invalid memory access issue following fault\ninjection in update_effective_progs. The issue can be described as\nfollows:\n\n__cgroup_bpf_detach\n  update_effective_progs\n    compute_effective_progs\n      bpf_prog_array_alloc \u0026lt;-- fault inject\n  purge_effective_progs\n    /* change to dummy_bpf_prog */\n    array-\u0026gt;items[index] = \u0026amp;dummy_bpf_prog.prog\n\n---softirq start---\n__do_softirq\n  ...\n    __cgroup_bpf_run_filter_skb\n      __bpf_prog_run_save_cb\n        bpf_prog_run\n          stats = this_cpu_ptr(prog-\u0026gt;stats)\n          /* invalid memory access */\n          flags = u64_stats_update_begin_irqsave(\u0026amp;stats-\u0026gt;syncp)\n---softirq end---\n\n  static_branch_dec(\u0026amp;cgroup_bpf_enabled_key[atype])\n\nThe reason is that fault injection caused update_effective_progs to fail\nand then changed the original prog into dummy_bpf_prog.prog in\npurge_effective_progs. Then a softirq came, and accessing the members of\ndummy_bpf_prog.prog in the softirq triggers invalid mem access.\n\nTo fix it, skip updating stats when stats is NULL.(CVE-2025-68742)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nethtool: Avoid overflowing userspace buffer on stats query\n\nThe ethtool -S command operates across three ioctl calls:\nETHTOOL_GSSET_INFO for the size, ETHTOOL_GSTRINGS for the names, and\nETHTOOL_GSTATS for the values.\n\nIf the number of stats changes between these calls (e.g., due to device\nreconfiguration), userspace\u0026apos;s buffer allocation will be incorrect,\npotentially leading to buffer overflow.\n\nDrivers are generally expected to maintain stable stat counts, but some\ndrivers (e.g., mlx5, bnx2x, bna, ksz884x) use dynamic counters, making\nthis scenario possible.\n\nSome drivers try to handle this internally:\n- bnad_get_ethtool_stats() returns early in case stats.n_stats is not\n  equal to the driver\u0026apos;s stats count.\n- micrel/ksz884x also makes sure not to write anything beyond\n  stats.n_stats and overflow the buffer.\n\nHowever, both use stats.n_stats which is already assigned with the value\nreturned from get_sset_count(), hence won\u0026apos;t solve the issue described\nhere.\n\nChange ethtool_get_strings(), ethtool_get_stats(),\nethtool_get_phy_stats() to not return anything in case of a mismatch\nbetween userspace\u0026apos;s size and get_sset_size(), to prevent buffer\noverflow.\nThe returned n_stats value will be equal to zero, to reflect that\nnothing has been returned.\n\nThis could result in one of two cases when using upstream ethtool,\ndepending on when the size change is detected:\n1. When detected in ethtool_get_strings():\n    # ethtool -S eth2\n    no stats available\n\n2. When detected in get stats, all stats will be reported as zero.\n\nBoth cases are presumably transient, and a subsequent ethtool call\nshould succeed.\n\nOther than the overflow avoidance, these two cases are very evident (no\noutput/cleared stats), which is arguably better than presenting\nincorrect/shifted stats.\nI also considered returning an error instead of a \u0026quot;silent\u0026quot; response, but\nthat seems more destructive towards userspace apps.\n\nNotes:\n- This patch does not claim to fix the inherent race, it only makes sure\n  that we do not overflow the userspace buffer, and makes for a more\n  predictable behavior.\n\n- RTNL lock is held during each ioctl, the race window exists between\n  the separate ioctl calls when the lock is released.\n\n- Userspace ethtool always fills stats.n_stats, but it is likely that\n  these stats ioctls are implemented in other userspace applications\n  which might not fill it. The added code checks that it\u0026apos;s not zero,\n  to prevent any regressions.(CVE-2025-68795)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\next4: xattr: fix null pointer deref in ext4_raw_inode()\n\nIf ext4_get_inode_loc() fails (e.g. if it returns -EFSCORRUPTED),\niloc.bh will remain set to NULL. Since ext4_xattr_inode_dec_ref_all()\nlacks error checking, this will lead to a null pointer dereference\nin ext4_raw_inode(), called right after ext4_get_inode_loc().\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2025-68820)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: hns3: using the num_tqps in the vf driver to apply for resources\n\nCurrently, hdev-\u0026gt;htqp is allocated using hdev-\u0026gt;num_tqps, and kinfo-\u0026gt;tqp\nis allocated using kinfo-\u0026gt;num_tqps. However, kinfo-\u0026gt;num_tqps is set to\nmin(new_tqps, hdev-\u0026gt;num_tqps);  Therefore, kinfo-\u0026gt;num_tqps may be smaller\nthan hdev-\u0026gt;num_tqps, which causes some hdev-\u0026gt;htqp[i] to remain\nuninitialized in hclgevf_knic_setup().\n\nThus, this patch allocates hdev-\u0026gt;htqp and kinfo-\u0026gt;tqp using hdev-\u0026gt;num_tqps,\nensuring that the lengths of hdev-\u0026gt;htqp and kinfo-\u0026gt;tqp are consistent\nand that all elements are properly initialized.(CVE-2025-71064)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset\n\n`qfq_class-\u0026gt;leaf_qdisc-\u0026gt;q.qlen \u0026gt; 0` does not imply that the class\nitself is active.\n\nTwo qfq_class objects may point to the same leaf_qdisc. This happens\nwhen:\n\n1. one QFQ qdisc is attached to the dev as the root qdisc, and\n\n2. another QFQ qdisc is temporarily referenced (e.g., via qdisc_get()\n/ qdisc_put()) and is pending to be destroyed, as in function\ntc_new_tfilter.\n\nWhen packets are enqueued through the root QFQ qdisc, the shared\nleaf_qdisc-\u0026gt;q.qlen increases. At the same time, the second QFQ\nqdisc triggers qdisc_put and qdisc_destroy: the qdisc enters\nqfq_reset() with its own q-\u0026gt;q.qlen == 0, but its class\u0026apos;s leaf\nqdisc-\u0026gt;q.qlen \u0026gt; 0. Therefore, the qfq_reset would wrongly deactivate\nan inactive aggregate and trigger a null-deref in qfq_deactivate_agg:\n\n[    0.903172] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[    0.903571] #PF: supervisor write access in kernel mode\n[    0.903860] #PF: error_code(0x0002) - not-present page\n[    0.904177] PGD 10299b067 P4D 10299b067 PUD 10299c067 PMD 0\n[    0.904502] Oops: Oops: 0002 [#1] SMP NOPTI\n[    0.904737] CPU: 0 UID: 0 PID: 135 Comm: exploit Not tainted 6.19.0-rc3+ #2 NONE\n[    0.905157] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014\n[    0.905754] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:992 (discriminator 2) include/linux/list.h:1006 (discriminator 2) net/sched/sch_qfq.c:1367 (discriminator 2) net/sched/sch_qfq.c:1393 (discriminator 2))\n[    0.906046] Code: 0f 84 4d 01 00 00 48 89 70 18 8b 4b 10 48 c7 c2 ff ff ff ff 48 8b 78 08 48 d3 e2 48 21 f2 48 2b 13 48 8b 30 48 d3 ea 8b 4b 18 0\n\nCode starting with the faulting instruction\n===========================================\n   0:\t0f 84 4d 01 00 00    \tje     0x153\n   6:\t48 89 70 18          \tmov    %rsi,0x18(%rax)\n   a:\t8b 4b 10             \tmov    0x10(%rbx),%ecx\n   d:\t48 c7 c2 ff ff ff ff \tmov    $0xffffffffffffffff,%rdx\n  14:\t48 8b 78 08          \tmov    0x8(%rax),%rdi\n  18:\t48 d3 e2             \tshl    %cl,%rdx\n  1b:\t48 21 f2             \tand    %rsi,%rdx\n  1e:\t48 2b 13             \tsub    (%rbx),%rdx\n  21:\t48 8b 30             \tmov    (%rax),%rsi\n  24:\t48 d3 ea             \tshr    %cl,%rdx\n  27:\t8b 4b 18             \tmov    0x18(%rbx),%ecx\n\t...\n[    0.907095] RSP: 0018:ffffc900004a39a0 EFLAGS: 00010246\n[    0.907368] RAX: ffff8881043a0880 RBX: ffff888102953340 RCX: 0000000000000000\n[    0.907723] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\n[    0.908100] RBP: ffff888102952180 R08: 0000000000000000 R09: 0000000000000000\n[    0.908451] R10: ffff8881043a0000 R11: 0000000000000000 R12: ffff888102952000\n[    0.908804] R13: ffff888102952180 R14: ffff8881043a0ad8 R15: ffff8881043a0880\n[    0.909179] FS:  000000002a1a0380(0000) GS:ffff888196d8d000(0000) knlGS:0000000000000000\n[    0.909572] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[    0.909857] CR2: 0000000000000000 CR3: 0000000102993002 CR4: 0000000000772ef0\n[    0.910247] PKRU: 55555554\n[    0.910391] Call Trace:\n[    0.910527]  \u0026lt;TASK\u0026gt;\n[    0.910638]  qfq_reset_qdisc (net/sched/sch_qfq.c:357 net/sched/sch_qfq.c:1485)\n[    0.910826]  qdisc_reset (include/linux/skbuff.h:2195 include/linux/skbuff.h:2501 include/linux/skbuff.h:3424 include/linux/skbuff.h:3430 net/sched/sch_generic.c:1036)\n[    0.911040]  __qdisc_destroy (net/sched/sch_generic.c:1076)\n[    0.911236]  tc_new_tfilter (net/sched/cls_api.c:2447)\n[    0.911447]  rtnetlink_rcv_msg (net/core/rtnetlink.c:6958)\n[    0.911663]  ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6861)\n[    0.911894]  netlink_rcv_skb (net/netlink/af_netlink.c:2550)\n[    0.912100]  netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)\n[    0.912296]  ? __alloc_skb (net/core/skbuff.c:706)\n[    0.912484]  netlink_sendmsg (net/netlink/af\n---truncated---(CVE-2026-22976)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix reference count leak in bpf_prog_test_run_xdp()\n\nsyzbot is reporting\n\n  unregister_netdevice: waiting for sit0 to become free. Usage count = 2\n\nproblem. A debug printk() patch found that a refcount is obtained at\nxdp_convert_md_to_buff() from bpf_prog_test_run_xdp().\n\nAccording to commit ec94670fcb3b (\u0026quot;bpf: Support specifying ingress via\nxdp_md context in BPF_PROG_TEST_RUN\u0026quot;), the refcount obtained by\nxdp_convert_md_to_buff() will be released by xdp_convert_buff_to_md().\n\nTherefore, we can consider that the error handling path introduced by\ncommit 1c1949982524 (\u0026quot;bpf: introduce frags support to\nbpf_prog_test_run_xdp()\u0026quot;) forgot to call xdp_convert_buff_to_md().(CVE-2026-22994)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Fix a deadlock involving nfs_release_folio()\n\nWang Zhaolong reports a deadlock involving NFSv4.1 state recovery\nwaiting on kthreadd, which is attempting to reclaim memory by calling\nnfs_release_folio(). The latter cannot make progress due to state\nrecovery being needed.\n\nIt seems that the only safe thing to do here is to kick off a writeback\nof the folio, without waiting for completion, or else kicking off an\nasynchronous commit.(CVE-2026-23053)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmedia: dvb-core: fix wrong reinitialization of ringbuffer on reopen\n\ndvb_dvr_open() calls dvb_ringbuffer_init() when a new reader opens the\nDVR device.  dvb_ringbuffer_init() calls init_waitqueue_head(), which\nreinitializes the waitqueue list head to empty.\n\nSince dmxdev-\u0026gt;dvr_buffer.queue is a shared waitqueue (all opens of the\nsame DVR device share it), this orphans any existing waitqueue entries\nfrom io_uring poll or epoll, leaving them with stale prev/next pointers\nwhile the list head is reset to {self, self}.\n\nThe waitqueue and spinlock in dvr_buffer are already properly\ninitialized once in dvb_dmxdev_init().  The open path only needs to\nreset the buffer data pointer, size, and read/write positions.\n\nReplace the dvb_ringbuffer_init() call in dvb_dvr_open() with direct\nassignment of data/size and a call to dvb_ringbuffer_reset(), which\nproperly resets pread, pwrite, and error with correct memory ordering\nwithout touching the waitqueue or spinlock.(CVE-2026-23253)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nregmap: maple: free entry on mas_store_gfp() failure\n\nregcache_maple_write() allocates a new block (\u0026apos;entry\u0026apos;) to merge\nadjacent ranges and then stores it with mas_store_gfp().\nWhen mas_store_gfp() fails, the new \u0026apos;entry\u0026apos; remains allocated and\nis never freed, leaking memory.\n\nFree \u0026apos;entry\u0026apos; on the failure path; on success continue freeing the\nreplaced neighbor blocks (\u0026apos;lower\u0026apos;, \u0026apos;upper\u0026apos;).(CVE-2026-23260)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix unprivileged local user can do privileged policy management\n\nAn unprivileged local user can load, replace, and remove profiles by\nopening the apparmorfs interfaces, via a confused deputy attack, by\npassing the opened fd to a privileged process, and getting the\nprivileged process to write to the interface.\n\nThis does require a privileged target that can be manipulated to do\nthe write for the unprivileged process, but once such access is\nachieved full policy management is possible and all the possible\nimplications that implies: removing confinement, DoS of system or\ntarget applications by denying all execution, by-passing the\nunprivileged user namespace restriction, to exploiting kernel bugs for\na local privilege escalation.\n\nThe policy management interface can not have its permissions simply\nchanged from 0666 to 0600 because non-root processes need to be able\nto load policy to different policy namespaces.\n\nInstead ensure the task writing the interface has privileges that\nare a subset of the task that opened the interface. This is already\ndone via policy for confined processes, but unconfined can delegate\naccess to the opened fd, by-passing the usual policy check.(CVE-2026-23268)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nperf: Fix __perf_event_overflow() vs perf_remove_from_context() race\n\nMake sure that __perf_event_overflow() runs with IRQs disabled for all\npossible callchains. Specifically the software events can end up running\nit with only preemption disabled.\n\nThis opens up a race vs perf_event_exit_event() and friends that will go\nand free various things the overflow path expects to be present, like\nthe BPF program.(CVE-2026-23271)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmacvlan: observe an RCU grace period in macvlan_common_newlink() error path\n\nvalis reported that a race condition still happens after my prior patch.\n\nmacvlan_common_newlink() might have made @dev visible before\ndetecting an error, and its caller will directly call free_netdev(dev).\n\nWe must respect an RCU period, either in macvlan or the core networking\nstack.\n\nAfter adding a temporary mdelay(1000) in macvlan_forward_source_one()\nto open the race window, valis repro was:\n\nip link add p1 type veth peer p2\nip link set address 00:00:00:00:00:20 dev p1\nip link set up dev p1\nip link set up dev p2\nip link add mv0 link p2 type macvlan mode source\n\n(ip link add invalid% link p2 type macvlan mode source macaddr add\n00:00:00:00:00:20 \u0026amp;) ; sleep 0.5 ; ping -c1 -I p1 1.2.3.4\nPING 1.2.3.4 (1.2.3.4): 56 data bytes\nRTNETLINK answers: Invalid argument\n\nBUG: KASAN: slab-use-after-free in macvlan_forward_source\n(drivers/net/macvlan.c:408 drivers/net/macvlan.c:444)\nRead of size 8 at addr ffff888016bb89c0 by task e/175\n\nCPU: 1 UID: 1000 PID: 175 Comm: e Not tainted 6.19.0-rc8+ #33 NONE\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014\nCall Trace:\n\u0026lt;IRQ\u0026gt;\ndump_stack_lvl (lib/dump_stack.c:123)\nprint_report (mm/kasan/report.c:379 mm/kasan/report.c:482)\n? macvlan_forward_source (drivers/net/macvlan.c:408 drivers/net/macvlan.c:444)\nkasan_report (mm/kasan/report.c:597)\n? macvlan_forward_source (drivers/net/macvlan.c:408 drivers/net/macvlan.c:444)\nmacvlan_forward_source (drivers/net/macvlan.c:408 drivers/net/macvlan.c:444)\n? tasklet_init (kernel/softirq.c:983)\nmacvlan_handle_frame (drivers/net/macvlan.c:501)\n\nAllocated by task 169:\nkasan_save_stack (mm/kasan/common.c:58)\nkasan_save_track (./arch/x86/include/asm/current.h:25\nmm/kasan/common.c:70 mm/kasan/common.c:79)\n__kasan_kmalloc (mm/kasan/common.c:419)\n__kvmalloc_node_noprof (./include/linux/kasan.h:263 mm/slub.c:5657\nmm/slub.c:7140)\nalloc_netdev_mqs (net/core/dev.c:12012)\nrtnl_create_link (net/core/rtnetlink.c:3648)\nrtnl_newlink (net/core/rtnetlink.c:3830 net/core/rtnetlink.c:3957\nnet/core/rtnetlink.c:4072)\nrtnetlink_rcv_msg (net/core/rtnetlink.c:6958)\nnetlink_rcv_skb (net/netlink/af_netlink.c:2550)\nnetlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)\nnetlink_sendmsg (net/netlink/af_netlink.c:1894)\n__sys_sendto (net/socket.c:727 net/socket.c:742 net/socket.c:2206)\n__x64_sys_sendto (net/socket.c:2209)\ndo_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)\nentry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:131)\n\nFreed by task 169:\nkasan_save_stack (mm/kasan/common.c:58)\nkasan_save_track (./arch/x86/include/asm/current.h:25\nmm/kasan/common.c:70 mm/kasan/common.c:79)\nkasan_save_free_info (mm/kasan/generic.c:587)\n__kasan_slab_free (mm/kasan/common.c:287)\nkfree (mm/slub.c:6674 mm/slub.c:6882)\nrtnl_newlink (net/core/rtnetlink.c:3845 net/core/rtnetlink.c:3957\nnet/core/rtnetlink.c:4072)\nrtnetlink_rcv_msg (net/core/rtnetlink.c:6958)\nnetlink_rcv_skb (net/netlink/af_netlink.c:2550)\nnetlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)\nnetlink_sendmsg (net/netlink/af_netlink.c:1894)\n__sys_sendto (net/socket.c:727 net/socket.c:742 net/socket.c:2206)\n__x64_sys_sendto (net/socket.c:2209)\ndo_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)\nentry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:131)(CVE-2026-23273)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: Fix recursive locking in __configfs_open_file()\n\nIn flush_write_buffer, \u0026amp;p-\u0026gt;frag_sem is acquired and then the loaded store\nfunction is called, which, here, is target_core_item_dbroot_store().  This\nfunction called filp_open(), following which these functions were called\n(in reverse order), according to the call trace:\n\n  down_read\n  __configfs_open_file\n  do_dentry_open\n  vfs_open\n  do_open\n  path_openat\n  do_filp_open\n  file_open_name\n  filp_open\n  target_core_item_dbroot_store\n  flush_write_buffer\n  configfs_write_iter\n\ntarget_core_item_dbroot_store() tries to validate the new file path by\ntrying to open the file path provided to it; however, in this case, the bug\nreport shows:\n\ndb_root: not a directory: /sys/kernel/config/target/dbroot\n\nindicating that the same configfs file was tried to be opened, on which it\nis currently working on. Thus, it is trying to acquire frag_sem semaphore\nof the same file of which it already holds the semaphore obtained in\nflush_write_buffer(), leading to acquiring the semaphore in a nested manner\nand a possibility of recursive locking.\n\nFix this by modifying target_core_item_dbroot_store() to use kern_path()\ninstead of filp_open() to avoid opening the file using filesystem-specific\nfunction __configfs_open_file(), and further modifying it to make this fix\ncompatible.(CVE-2026-23292)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: core: Fix refcount leak for tagset_refcnt\n\nThis leak will cause a hang when tearing down the SCSI host. For example,\niscsid hangs with the following call trace:\n\n[130120.652718] scsi_alloc_sdev: Allocation failure during SCSI scanning, some SCSI devices might not be configured\n\nPID: 2528     TASK: ffff9d0408974e00  CPU: 3    COMMAND: \u0026quot;iscsid\u0026quot;\n #0 [ffffb5b9c134b9e0] __schedule at ffffffff860657d4\n #1 [ffffb5b9c134ba28] schedule at ffffffff86065c6f\n #2 [ffffb5b9c134ba40] schedule_timeout at ffffffff86069fb0\n #3 [ffffb5b9c134bab0] __wait_for_common at ffffffff8606674f\n #4 [ffffb5b9c134bb10] scsi_remove_host at ffffffff85bfe84b\n #5 [ffffb5b9c134bb30] iscsi_sw_tcp_session_destroy at ffffffffc03031c4 [iscsi_tcp]\n #6 [ffffb5b9c134bb48] iscsi_if_recv_msg at ffffffffc0292692 [scsi_transport_iscsi]\n #7 [ffffb5b9c134bb98] iscsi_if_rx at ffffffffc02929c2 [scsi_transport_iscsi]\n #8 [ffffb5b9c134bbf0] netlink_unicast at ffffffff85e551d6\n #9 [ffffb5b9c134bc38] netlink_sendmsg at ffffffff85e554ef(CVE-2026-23296)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ni40e: Fix preempt count leak in napi poll tracepoint\n\nUsing get_cpu() in the tracepoint assignment causes an obvious preempt\ncount leak because nothing invokes put_cpu() to undo it:\n\n  softirq: huh, entered softirq 3 NET_RX with preempt_count 00000100, exited with 00000101?\n\nThis clearly has seen a lot of testing in the last 3+ years...\n\nUse smp_processor_id() instead.(CVE-2026-23313)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Return the correct value in vmw_translate_ptr functions\n\nBefore the referenced fixes these functions used a lookup function that\nreturned a pointer. This was changed to another lookup function that\nreturned an error code with the pointer becoming an out parameter.\n\nThe error path when the lookup failed was not changed to reflect this\nchange and the code continued to return the PTR_ERR of the now\nuninitialized pointer. This could cause the vmw_translate_ptr functions\nto return success when they actually failed causing further uninitialized\nand OOB accesses.(CVE-2026-23317)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim\n\nThe root cause of this bug is that when \u0026apos;bpf_link_put\u0026apos; reduces the\nrefcount of \u0026apos;shim_link-\u0026gt;link.link\u0026apos; to zero, the resource is considered\nreleased but may still be referenced via \u0026apos;tr-\u0026gt;progs_hlist\u0026apos; in\n\u0026apos;cgroup_shim_find\u0026apos;. The actual cleanup of \u0026apos;tr-\u0026gt;progs_hlist\u0026apos; in\n\u0026apos;bpf_shim_tramp_link_release\u0026apos; is deferred. During this window, another\nprocess can cause a use-after-free via \u0026apos;bpf_trampoline_link_cgroup_shim\u0026apos;.\n\nBased on Martin KaFai Lau\u0026apos;s suggestions, I have created a simple patch.\n\nTo fix this:\n   Add an atomic non-zero check in \u0026apos;bpf_trampoline_link_cgroup_shim\u0026apos;.\n   Only increment the refcount if it is not already zero.\n\nTesting:\n   I verified the fix by adding a delay in\n   \u0026apos;bpf_shim_tramp_link_release\u0026apos; to make the bug easier to trigger:\n\nstatic void bpf_shim_tramp_link_release(struct bpf_link *link)\n{\n\t/* ... */\n\tif (!shim_link-\u0026gt;trampoline)\n\t\treturn;\n\n+\tmsleep(100);\n\tWARN_ON_ONCE(bpf_trampoline_unlink_prog(\u0026amp;shim_link-\u0026gt;link,\n\t\tshim_link-\u0026gt;trampoline, NULL));\n\tbpf_trampoline_put(shim_link-\u0026gt;trampoline);\n}\n\nBefore the patch, running a PoC easily reproduced the crash(almost 100%)\nwith a call trace similar to KaiyanM\u0026apos;s report.\nAfter the patch, the bug no longer occurs even after millions of\niterations.(CVE-2026-23319)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nx86/efi: defer freeing of boot services memory\n\nefi_free_boot_services() frees memory occupied by EFI_BOOT_SERVICES_CODE\nand EFI_BOOT_SERVICES_DATA using memblock_free_late().\n\nThere are two issue with that: memblock_free_late() should be used for\nmemory allocated with memblock_alloc() while the memory reserved with\nmemblock_reserve() should be freed with free_reserved_area().\n\nMore acutely, with CONFIG_DEFERRED_STRUCT_PAGE_INIT=y\nefi_free_boot_services() is called before deferred initialization of the\nmemory map is complete.\n\nBenjamin Herrenschmidt reports that this causes a leak of ~140MB of\nRAM on EC2 t3a.nano instances which only have 512MB or RAM.\n\nIf the freed memory resides in the areas that memory map for them is\nstill uninitialized, they won\u0026apos;t be actually freed because\nmemblock_free_late() calls memblock_free_pages() and the latter skips\nuninitialized pages.\n\nUsing free_reserved_area() at this point is also problematic because\n__free_page() accesses the buddy of the freed page and that again might\nend up in uninitialized part of the memory map.\n\nDelaying the entire efi_free_boot_services() could be problematic\nbecause in addition to freeing boot services memory it updates\nefi.memmap without any synchronization and that\u0026apos;s undesirable late in\nboot when there is concurrency.\n\nMore robust approach is to only defer freeing of the EFI boot services\nmemory.\n\nSplit efi_free_boot_services() in two. First efi_unmap_boot_services()\ncollects ranges that should be freed into an array then\nefi_free_boot_services() later frees them after deferred init is complete.(CVE-2026-23352)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix stack-out-of-bounds write in devmap\n\nget_upper_ifindexes() iterates over all upper devices and writes their\nindices into an array without checking bounds.\n\nAlso the callers assume that the max number of upper devices is\nMAX_NEST_DEV and allocate excluded_devices[1+MAX_NEST_DEV] on the stack,\nbut that assumption is not correct and the number of upper devices could\nbe larger than MAX_NEST_DEV (e.g., many macvlans), causing a\nstack-out-of-bounds write.\n\nAdd a max parameter to get_upper_ifindexes() to avoid the issue.\nWhen there are too many upper devices, return -EOVERFLOW and abort the\nredirect.\n\nTo reproduce, create more than MAX_NEST_DEV(8) macvlans on a device with\nan XDP program attached using BPF_F_BROADCAST | BPF_F_EXCLUDE_INGRESS.\nThen send a packet to the device to trigger the XDP redirect path.(CVE-2026-23359)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvme: fix admin queue leak on controller reset\n\nWhen nvme_alloc_admin_tag_set() is called during a controller reset,\na previous admin queue may still exist. Release it properly before\nallocating a new one to avoid orphaning the old queue.\n\nThis fixes a regression introduced by commit 03b3bcd319b3 (\u0026quot;nvme: fix\nadmin request_queue lifetime\u0026quot;).(CVE-2026-23360)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nblktrace: fix __this_cpu_read/write in preemptible context\n\ntracing_record_cmdline() internally uses __this_cpu_read() and\n__this_cpu_write() on the per-CPU variable trace_cmdline_save, and\ntrace_save_cmdline() explicitly asserts preemption is disabled via\nlockdep_assert_preemption_disabled(). These operations are only safe\nwhen preemption is off, as they were designed to be called from the\nscheduler context (probe_wakeup_sched_switch() / probe_wakeup()).\n\n__blk_add_trace() was calling tracing_record_cmdline(current) early in\nthe blk_tracer path, before ring buffer reservation, from process\ncontext where preemption is fully enabled. This triggers the following\nusing blktests/blktrace/002:\n\nblktrace/002 (blktrace ftrace corruption with sysfs trace)   [failed]\n    runtime  0.367s  ...  0.437s\n    something found in dmesg:\n    [   81.211018] run blktests blktrace/002 at 2026-02-25 22:24:33\n    [   81.239580] null_blk: disk nullb1 created\n    [   81.357294] BUG: using __this_cpu_read() in preemptible [00000000] code: dd/2516\n    [   81.362842] caller is tracing_record_cmdline+0x10/0x40\n    [   81.362872] CPU: 16 UID: 0 PID: 2516 Comm: dd Tainted: G                 N  7.0.0-rc1lblk+ #84 PREEMPT(full)\n    [   81.362877] Tainted: [N]=TEST\n    [   81.362878] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014\n    [   81.362881] Call Trace:\n    [   81.362884]  \u0026lt;TASK\u0026gt;\n    [   81.362886]  dump_stack_lvl+0x8d/0xb0\n    ...\n    (See \u0026apos;/mnt/sda/blktests/results/nodev/blktrace/002.dmesg\u0026apos; for the entire message)\n\n[   81.211018] run blktests blktrace/002 at 2026-02-25 22:24:33\n[   81.239580] null_blk: disk nullb1 created\n[   81.357294] BUG: using __this_cpu_read() in preemptible [00000000] code: dd/2516\n[   81.362842] caller is tracing_record_cmdline+0x10/0x40\n[   81.362872] CPU: 16 UID: 0 PID: 2516 Comm: dd Tainted: G                 N  7.0.0-rc1lblk+ #84 PREEMPT(full)\n[   81.362877] Tainted: [N]=TEST\n[   81.362878] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014\n[   81.362881] Call Trace:\n[   81.362884]  \u0026lt;TASK\u0026gt;\n[   81.362886]  dump_stack_lvl+0x8d/0xb0\n[   81.362895]  check_preemption_disabled+0xce/0xe0\n[   81.362902]  tracing_record_cmdline+0x10/0x40\n[   81.362923]  __blk_add_trace+0x307/0x5d0\n[   81.362934]  ? lock_acquire+0xe0/0x300\n[   81.362940]  ? iov_iter_extract_pages+0x101/0xa30\n[   81.362959]  blk_add_trace_bio+0x106/0x1e0\n[   81.362968]  submit_bio_noacct_nocheck+0x24b/0x3a0\n[   81.362979]  ? lockdep_init_map_type+0x58/0x260\n[   81.362988]  submit_bio_wait+0x56/0x90\n[   81.363009]  __blkdev_direct_IO_simple+0x16c/0x250\n[   81.363026]  ? __pfx_submit_bio_wait_endio+0x10/0x10\n[   81.363038]  ? rcu_read_lock_any_held+0x73/0xa0\n[   81.363051]  blkdev_read_iter+0xc1/0x140\n[   81.363059]  vfs_read+0x20b/0x330\n[   81.363083]  ksys_read+0x67/0xe0\n[   81.363090]  do_syscall_64+0xbf/0xf00\n[   81.363102]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[   81.363106] RIP: 0033:0x7f281906029d\n[   81.363111] Code: 31 c0 e9 c6 fe ff ff 50 48 8d 3d 66 63 0a 00 e8 59 ff 01 00 66 0f 1f 84 00 00 00 00 00 80 3d 41 33 0e 00 00 74 17 31 c0 0f 05 \u0026lt;48\u0026gt; 3d 00 f0 ff ff 77 5b c3 66 2e 0f 1f 84 00 00 00 00 00 48 83 ec\n[   81.363113] RSP: 002b:00007ffca127dd48 EFLAGS: 00000246 ORIG_RAX: 0000000000000000\n[   81.363120] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f281906029d\n[   81.363122] RDX: 0000000000001000 RSI: 0000559f8bfae000 RDI: 0000000000000000\n[   81.363123] RBP: 0000000000001000 R08: 0000002863a10a81 R09: 00007f281915f000\n[   81.363124] R10: 00007f2818f77b60 R11: 0000000000000246 R12: 0000559f8bfae000\n[   81.363126] R13: 0000000000000000 R14: 0000000000000000 R15: 000000000000000a\n[   81.363142]  \u0026lt;/TASK\u0026gt;\n\nThe same BUG fires from blk_add_trace_plug(), blk_add_trace_unplug(),\nand blk_add_trace_rq() paths as well.\n\nThe purpose of tracin\n---truncated---(CVE-2026-23374)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing\n\nstruct bpf_plt contains a u64 target field. Currently, the BPF JIT\nallocator requests an alignment of 4 bytes (sizeof(u32)) for the JIT\nbuffer.\n\nBecause the base address of the JIT buffer can be 4-byte aligned (e.g.,\nending in 0x4 or 0xc), the relative padding logic in build_plt() fails\nto ensure that target lands on an 8-byte boundary.\n\nThis leads to two issues:\n1. UBSAN reports misaligned-access warnings when dereferencing the\n   structure.\n2. More critically, target is updated concurrently via WRITE_ONCE() in\n   bpf_arch_text_poke() while the JIT\u0026apos;d code executes ldr. On arm64,\n   64-bit loads/stores are only guaranteed to be single-copy atomic if\n   they are 64-bit aligned. A misaligned target risks a torn read,\n   causing the JIT to jump to a corrupted address.\n\nFix this by increasing the allocation alignment requirement to 8 bytes\n(sizeof(u64)) in bpf_jit_binary_pack_alloc(). This anchors the base of\nthe JIT buffer to an 8-byte boundary, allowing the relative padding math\nin build_plt() to correctly align the target field.(CVE-2026-23383)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nSquashfs: check metadata block offset is within range\n\nSyzkaller reports a \u0026quot;general protection fault in squashfs_copy_data\u0026quot;\n\nThis is ultimately caused by a corrupted index look-up table, which\nproduces a negative metadata block offset.\n\nThis is subsequently passed to squashfs_copy_data (via\nsquashfs_read_metadata) where the negative offset causes an out of bounds\naccess.\n\nThe fix is to check that the offset is within range in\nsquashfs_read_metadata.  This will trap this and other cases.(CVE-2026-23388)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\next4: reject mount if bigalloc with s_first_data_block != 0\n\nbigalloc with s_first_data_block != 0 is not supported, reject mounting\nit.(CVE-2026-31447)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nHID: multitouch: Check to ensure report responses match the request\n\nIt is possible for a malicious (or clumsy) device to respond to a\nspecific report\u0026apos;s feature request using a completely different report\nID.  This can cause confusion in the HID core resulting in nasty\nside-effects such as OOB writes.\n\nAdd a check to ensure that the report ID in the response, matches the\none that was requested.  If it doesn\u0026apos;t, omit reporting the raw event and\nreturn early.(CVE-2026-43047)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: Mitigate potential OOB by removing bogus memset()\n\nThe memset() in hid_report_raw_event() has the good intention of\nclearing out bogus data by zeroing the area from the end of the incoming\ndata string to the assumed end of the buffer.  However, as we have\npreviously seen, doing so can easily result in OOB reads and writes in\nthe subsequent thread of execution.\n\nThe current suggestion from one of the HID maintainers is to remove the\nmemset() and simply return if the incoming event buffer size is not\nlarge enough to fill the associated report.\n\nSuggested-by Benjamin Tissoires \u0026lt;(CVE-2026-43048)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nxfs: close crash window in attr dabtree inactivation\n\nWhen inactivating an inode with node-format extended attributes,\nxfs_attr3_node_inactive() invalidates all child leaf/node blocks via\nxfs_trans_binval(), but intentionally does not remove the corresponding\nentries from their parent node blocks.  The implicit assumption is that\nxfs_attr_inactive() will truncate the entire attr fork to zero extents\nafterwards, so log recovery will never reach the root node and follow\nthose stale pointers.\n\nHowever, if a log shutdown occurs after the leaf/node block cancellations\ncommit but before the attr bmap truncation commits, this assumption\nbreaks.  Recovery replays the attr bmap intact (the inode still has\nattr fork extents), but suppresses replay of all cancelled leaf/node\nblocks, maybe leaving them as stale data on disk.  On the next mount,\nxlog_recover_process_iunlinks() retries inactivation and attempts to\nread the root node via the attr bmap. If the root node was not replayed,\nreading the unreplayed root block triggers a metadata verification\nfailure immediately; if it was replayed, following its child pointers\nto unreplayed child blocks triggers the same failure:\n\n XFS (pmem0): Metadata corruption detected at\n xfs_da3_node_read_verify+0x53/0x220, xfs_da3_node block 0x78\n XFS (pmem0): Unmount and run xfs_repair\n XFS (pmem0): First 128 bytes of corrupted metadata buffer:\n 00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n 00000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n 00000040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n 00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n 00000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n 00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n XFS (pmem0): metadata I/O error in \u0026quot;xfs_da_read_buf+0x104/0x190\u0026quot; at daddr 0x78 len 8 error 117\n\nFix this in two places:\n\nIn xfs_attr3_node_inactive(), after calling xfs_trans_binval() on a\nchild block, immediately remove the entry that references it from the\nparent node in the same transaction.  This eliminates the window where\nthe parent holds a pointer to a cancelled block.  Once all children are\nremoved, the now-empty root node is converted to a leaf block within the\nsame transaction. This node-to-leaf conversion is necessary for crash\nsafety. If the system shutdown after the empty node is written to the\nlog but before the second-phase bmap truncation commits, log recovery\nwill attempt to verify the root block on disk. xfs_da3_node_verify()\ndoes not permit a node block with count == 0; such a block will fail\nverification and trigger a metadata corruption shutdown. on the other\nhand, leaf blocks are allowed to have this transient state.\n\nIn xfs_attr_inactive(), split the attr fork truncation into two explicit\nphases.  First, truncate all extents beyond the root block (the child\nextents whose parent references have already been removed above).\nSecond, invalidate the root block and truncate the attr bmap to zero in\na single transaction.  The two operations in the second phase must be\natomic: as long as the attr bmap has any non-zero length, recovery can\nfollow it to the root block, so the root block invalidation must commit\ntogether with the bmap-to-zero truncation.(CVE-2026-43053)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nRevert \u0026quot;PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV\u0026quot;\n\nThis reverts commit 05703271c3cd (\u0026quot;PCI/IOV: Add PCI rescan-remove locking\nwhen enabling/disabling SR-IOV\u0026quot;), which causes a deadlock by recursively\ntaking pci_rescan_remove_lock when sriov_del_vfs() is called as part of\npci_stop_and_remove_bus_device(). For example with the following sequence\nof commands:\n\n  $ echo \u0026lt;NUM\u0026gt; \u0026gt; /sys/bus/pci/devices/\u0026lt;pf\u0026gt;/sriov_numvfs\n  $ echo 1 \u0026gt; /sys/bus/pci/devices/\u0026lt;pf\u0026gt;/remove\n\nA trimmed trace of the deadlock on a mlx5 device is as below:\n\n  zsh/5715 is trying to acquire lock:\n  000002597926ef50 (pci_rescan_remove_lock){+.+.}-{3:3}, at: sriov_disable+0x34/0x140\n\n  but task is already holding lock:\n  000002597926ef50 (pci_rescan_remove_lock){+.+.}-{3:3}, at: pci_stop_and_remove_bus_device_locked+0x24/0x80\n  ...\n  Call Trace:\n   [\u0026lt;00000259778c4f90\u0026gt;] dump_stack_lvl+0xc0/0x110\n   [\u0026lt;00000259779c844e\u0026gt;] print_deadlock_bug+0x31e/0x330\n   [\u0026lt;00000259779c1908\u0026gt;] __lock_acquire+0x16c8/0x32f0\n   [\u0026lt;00000259779bffac\u0026gt;] lock_acquire+0x14c/0x350\n   [\u0026lt;00000259789643a6\u0026gt;] __mutex_lock_common+0xe6/0x1520\n   [\u0026lt;000002597896413c\u0026gt;] mutex_lock_nested+0x3c/0x50\n   [\u0026lt;00000259784a07e4\u0026gt;] sriov_disable+0x34/0x140\n   [\u0026lt;00000258f7d6dd80\u0026gt;] mlx5_sriov_disable+0x50/0x80 [mlx5_core]\n   [\u0026lt;00000258f7d5745e\u0026gt;] remove_one+0x5e/0xf0 [mlx5_core]\n   [\u0026lt;00000259784857fc\u0026gt;] pci_device_remove+0x3c/0xa0\n   [\u0026lt;000002597851012e\u0026gt;] device_release_driver_internal+0x18e/0x280\n   [\u0026lt;000002597847ae22\u0026gt;] pci_stop_bus_device+0x82/0xa0\n   [\u0026lt;000002597847afce\u0026gt;] pci_stop_and_remove_bus_device_locked+0x5e/0x80\n   [\u0026lt;00000259784972c2\u0026gt;] remove_store+0x72/0x90\n   [\u0026lt;0000025977e6661a\u0026gt;] kernfs_fop_write_iter+0x15a/0x200\n   [\u0026lt;0000025977d7241c\u0026gt;] vfs_write+0x24c/0x300\n   [\u0026lt;0000025977d72696\u0026gt;] ksys_write+0x86/0x110\n   [\u0026lt;000002597895b61c\u0026gt;] __do_syscall+0x14c/0x400\n   [\u0026lt;000002597896e0ee\u0026gt;] system_call+0x6e/0x90\n\nThis alone is not a complete fix as it restores the issue the cited commit\ntried to solve. A new fix will be provided as a follow on.(CVE-2026-43147)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\narm64: Add support for TSV110 Spectre-BHB mitigation\n\nThe TSV110 processor is vulnerable to the Spectre-BHB (Branch History\nBuffer) attack, which can be exploited to leak information through\nbranch prediction side channels. This commit adds the MIDR of TSV110\nto the list for software mitigation.(CVE-2026-43261)\n\nIn the Linux kernel, the kexec_load_purgatory() function derives image-\u0026gt;start by locating e_entry inside an SHF_EXECINSTR section. If the purgatory object contains multiple executable sections with overlapping sh_addr, the entrypoint check can match more than once and trigger a WARN. Derive the entry section from the purgatory_start symbol when present and compute image-\u0026gt;start from its final placement. Keep the existing e_entry fallback for purgatories that do not expose the symbol.(CVE-2026-43289)\n\nIn the Linux kernel, there is a potential out-of-bounds access vulnerability in the ceph_handle_auth_reply() function of the libceph component. When processing messages of type CEPH_MSG_AUTH_REPLY, the value of the payload_len field is stored in a variable of type int. A value greater than INT_MAX leads to integer overflow and is interpreted as a negative value, which causes the pointer address to be decremented and subsequently accessed because ceph_decode_need() only checks that the memory access does not exceed the end address of the allocation. The vulnerability is fixed by changing the data type of payload_len to u32 and introducing additional sanity checks.(CVE-2026-43407)\n\nIn the Linux kernel, when an alias is found through d_splice_alias in the nfs3_proc_create function, if the alias happens to be a directory dentry, the system does not return any error but simply forgets about this alias, leaving the original dentry to be added as negative. This later causes a system crash in nfs_atomic_open_v23/finish_open since a negative dentry is supplied to do_dentry_open. This issue was observed running lustre-racer, where directories and files are created/removed concurrently with the same name and O_EXCL is not used to open files.(CVE-2026-43470)","status":"published","published":"2026-05-22T11:11:22Z","modified":"2026-08-18T01:20:02.121651445Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"BELL-CVE-2025-40136","status":"published","published":"2025-11-14T06:05:03.728065Z","modified":"2026-11-04T07:15:53.535751256Z","updated_at":"2026-11-04T07:32:10.855619Z"},{"id":"CVE-2025-40136","title":"crypto: hisilicon/qm - request reserved interrupt for virtual function","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: hisilicon/qm - request reserved interrupt for virtual function\n\nThe device interrupt vector 3 is an error interrupt for\nphysical function and a reserved interrupt for virtual function.\nHowever, the driver has not registered the reserved interrupt for\nvirtual function. When allocating interrupts, the number of interrupts\nis allocated based on powers of two, which includes this interrupt.\nWhen the system enables GICv4 and the virtual function passthrough\nto the virtual machine, releasing the interrupt in the driver\ntriggers a warning.\n\nThe WARNING report is:\nWARNING: CPU: 62 PID: 14889 at arch/arm64/kvm/vgic/vgic-its.c:852 its_free_ite+0x94/0xb4\n\nTherefore, register a reserved interrupt for VF and set the\nIRQF_NO_AUTOEN flag to avoid that warning.","status":"published","published":"2025-11-12T10:23:23.33Z","modified":"2026-11-01T02:30:56.36358083Z","updated_at":"2026-11-02T15:44:49.394967Z"},{"id":"DEBIAN-CVE-2025-40136","description":"In the Linux kernel, the following vulnerability has been resolved:  crypto: hisilicon/qm - request reserved interrupt for virtual function  The device interrupt vector 3 is an error interrupt for physical function and a reserved interrupt for virtual function. However, the driver has not registered the reserved interrupt for virtual function. When allocating interrupts, the number of interrupts is allocated based on powers of two, which includes this interrupt. When the system enables GICv4 and the virtual function passthrough to the virtual machine, releasing the interrupt in the driver triggers a warning.  The WARNING report is: WARNING: CPU: 62 PID: 14889 at arch/arm64/kvm/vgic/vgic-its.c:852 its_free_ite+0x94/0xb4  Therefore, register a reserved interrupt for VF and set the IRQF_NO_AUTOEN flag to avoid that warning.","status":"published","published":"2025-11-12T11:15:43.327Z","modified":"2026-11-02T18:00:17.364343878Z","updated_at":"2026-11-02T19:03:29.459611Z"},{"id":"openSUSE-SU-2026:22091-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2025-40136: crypto: hisilicon/qm - request reserved interrupt for virtual function (bsc#1253340).\n- CVE-2026-23199: procfs: avoid fetching build ID while holding VMA lock (bsc#1258335).\n- CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).\n- CVE-2026-43210: tracing: ring-buffer: Fix to check event length before using (bsc#1264330).\n- CVE-2026-43272: ring-buffer: Fix possible dereference of uninitialized pointer (bsc#1264607).\n- CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).\n- CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).\n- CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).\n- CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).\n- CVE-2026-46272: coresight: tmc-etr: Fix race condition between sysfs and perf mode (bsc#1267672).\n- CVE-2026-53377: drm/msm: always recover the gpu (bsc#1271901).\n- CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).\n- CVE-2026-63838: ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] (bsc#1272388).\n- CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).\n- CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check\n  (bsc#1272890).\n- CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).\n- CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).\n- CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).\n- CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).\n- CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).\n- CVE-2026-64132: ipv6: ioam: refresh hdr pointer before ioam6_event() (bsc#1272347).\n- CVE-2026-64154: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() (bsc#1271950).\n- CVE-2026-64173: tracing: Do not call map-\u003eops-\u003eelt_free() if elt_alloc() fails (bsc#1272145).\n- CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).\n- CVE-2026-64216: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() (bsc#1272802).\n- CVE-2026-64235: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines (bsc#1272803).\n- CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).\n- CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).\n- CVE-2026-64324: udf: validate free block extents against the partition length (bsc#1273970).\n- CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).\n- CVE-2026-64377: cpufreq: qcom-cpufreq-hw: Fix possible double free (bsc#1273297).\n- CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).\n- CVE-2026-64402: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (bsc#1273258).\n- CVE-2026-64405: Bluetooth: separate CIS_LINK and BIS_LINK link types (bsc#1273512).\n- CVE-2026-64414: netfilter: handle unreadable frags (bsc#1273275).\n- CVE-2026-64418: mm: shrinker: fix shrinker_info teardown race with expansion (bsc#1273784).\n- CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).\n- CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).\n- CVE-2026-64457: virtio_pci: fix vq info pointer lookup via wrong index (bsc#1273491).\n- CVE-2026-64473: vfio: Remove device debugfs before releasing devres (bsc#1273320).\n- CVE-2026-64474: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (bsc#1274316).\n- CVE-2026-64475: vfio/pci: Release the VGA arbiter client on register_device() failure (bsc#1274319).\n- CVE-2026-64476: vfio/pci: Latch disable_idle_d3 per device (bsc#1274245).\n- CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037).\n- CVE-2026-64594: usb: gadget: f_fs: initialize reset_work at allocation time (bsc#1274538).\n- CVE-2026-64597: smb: client: fix double-free in SMB2_close() replay (bsc#1274297).\n- CVE-2026-64598: smb/client: Fix error code in smb2_aead_req_alloc() (bsc#1274298).\n- CVE-2026-68146: ftrace: Add global mutex to serialize trace_parser access (bsc#1274890).\n- CVE-2026-68264: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (bsc#1275142).\n- CVE-2026-68266: drm/xe: Hold a dma-buf reference for imported BOs (bsc#1275137).\n- CVE-2026-68290: rds: tcp: unregister sysctl before tearing down listen socket (bsc#1275977).\n- CVE-2026-68312: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (bsc#1274663).\n- CVE-2026-68343: smb: client: validate DFS referral PathConsumed (bsc#1274629).\n- CVE-2026-68367: usb: gadget: f_tcm: synchronize delayed set_alt with teardown (bsc#1275170).\n- CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).\n- CVE-2026-68382: drm/xe/guc: Hold device ref until queue teardown completes (bsc#1274824).\n- CVE-2026-68385: s390/checksum: Fix csum_partial() without vector facility (bsc#1274818).\n- CVE-2026-68400: KVM: arm64: Mask response to FFA_FEATURE call (bsc#1274912).\n- CVE-2026-68441: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains (bsc#1274776).\n- CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests (bsc#1276287).\n- CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests (bsc#1276295).\n- CVE-2026-68454: KVM: s390: pci: Fix handling of AIF enable without AISB (bsc#1276388).\n- CVE-2026-68471: wifi: ieee80211: validate MLE common info length (bsc#1276504).\n- CVE-2026-68477: ipvs: fix more places with wrong ipv6 transport offsets (bsc#1275495).\n- CVE-2026-72012: tracing/osnoise: Call synchronize_rcu() when unregistering (bsc#1276783).\n- CVE-2026-72018: dibs: loopback: validate offset and size in move_data() (bsc#1276852).\n- CVE-2026-72025: s390/monwriter: Reject buffer reuse with different data length (bsc#1276923).\n- CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).\n- CVE-2026-72070: wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() (bsc#1277153).\n- CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).\n- CVE-2026-72102: dm_early_create: fix freeing used table on dm_resume failure (bsc#1277314).\n- CVE-2026-72128: nvmet: fix refcount leak in nvmet_sq_create() (bsc#1277101).\n- CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).\n- CVE-2026-72130: nvmet-auth: reject short AUTH_RECEIVE buffers (bsc#1275549).\n- CVE-2026-72147: dmaengine: dw-edma-pcie: Reject devices without driver data (bsc#1277234).\n- CVE-2026-72166: net/9p: fix infinite loop in p9_client_rpc on fatal signal (bsc#1277556).\n- CVE-2026-72218: lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure (bsc#1277218).\n- CVE-2026-72219: lockd: Plug nlm_file leak when nlm_do_fopen() fails (bsc#1277217).\n- CVE-2026-72224: nvdimm/btt: Free arenas on btt_init() error paths (bsc#1277215).\n- CVE-2026-72237: perf/x86/amd/brs: Fix kernel address leakage (bsc#1277615).\n- CVE-2026-72247: netfilter: nf_conncount: fix zone comparison in tuple dedup (bsc#1277662).\n- CVE-2026-72256: netfilter: xt_cluster: reject template conntracks in hash match (bsc#1277674).\n- CVE-2026-72299: tipc: restrict socket queue dumps in enqueue tracepoints (bsc#1275924).\n- CVE-2026-72321: ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() (bsc#1277143).\n- CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).\n- CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).\n- CVE-2026-72349: netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() (bsc#1277784).\n- CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).\n- CVE-2026-72352: HID: bpf: Fix hid_bpf_get_data() range check (bsc#1277823).\n- CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).\n- CVE-2026-72392: ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump (bsc#1277128).\n- CVE-2026-72404: tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() (bsc#1278031).\n- CVE-2026-72406: net: sungem: fix probe error cleanup (bsc#1278035).\n- CVE-2026-72413: sctp: fix err_chunk memory leaks in INIT handling (bsc#1277122).\n- CVE-2026-72433: netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (bsc#1278053).\n- CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped (bsc#1278054).\n- CVE-2026-72435: netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() (bsc#1278056).\n- CVE-2026-72436: netfilter: ipset: Fix data race between add and dump in all hash types (bsc#1277245).\n- CVE-2026-72444: flow_dissector: check device type before reading ETH_ADDRS (bsc#1278100).\n- CVE-2026-72447: sctp: hold socket lock when dumping endpoints in sctp_diag (bsc#1277109).\n- CVE-2026-72491: net/9p: fix race condition on rdma-\u003estate in trans_rdma.c (bsc#1276947).\n- CVE-2026-74256: bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check (bsc#1276535).\n- CVE-2026-74257: sockmap: Fix use-after-free in udp_bpf_recvmsg() (bsc#1276532).\n- CVE-2026-74258: bpf: Guard __get_user acesss with access_ok for uprobe_multi data (bsc#1276538).\n- CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen\n  (bsc#1276519).\n- CVE-2026-74268: tcp: clear sock_ops cb flags before force-closing a child socket (bsc#1276508).\n- CVE-2026-74281: tipc: reject inverted service ranges from peer bindings (bsc#1276474).\n- CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators (bsc#1276475).\n- CVE-2026-74288: net: fib_rules: Don't dump dying fib_rule in fib_rules_dump() (bsc#1276460).\n- CVE-2026-74289: ipv4: fib: Don't dump dying fib_info in fib_leaf_notify() (bsc#1276461).\n- CVE-2026-74290: net/sched: cls_flow: Dont expose folded kernel pointers (bsc#1276462).\n- CVE-2026-74330: configfs: fix lockless traversals of -\u003es_children (bsc#1277129).\n- CVE-2026-74356: vhost: fix vhost_get_avail_idx for a non empty ring (bsc#1278063).\n- CVE-2026-74359: configfs_lookup(): don't leave -\u003es_dentry dangling on failure (bsc#1278067).\n- CVE-2026-74365: nvdimm/btt: Handle preemption in BTT lane acquisition (bsc#1278225).\n- CVE-2026-74376: md/raid10: reset read_slot when reusing r10bio for discard (bsc#1277401).\n- CVE-2026-74384: nvme-multipath: fix flex array size in struct nvme_ns_head (bsc#1277405).\n- CVE-2026-74385: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock (bsc#1278255).\n- CVE-2026-74386: nvmet-tcp: fix page fragment cache leak in error path (bsc#1277098).\n- CVE-2026-74389: RDMA/hns: Fix log flood after cmd_mbox failure (bsc#1278087).\n- CVE-2026-74391: tracing: Bound synthetic-field strings with seq_buf (bsc#1278091).\n- CVE-2026-74398: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (bsc#1277410).\n- CVE-2026-74440: drm/xe: Wait on external BO kernel fences in exec IOCTL (bsc#1261564).\n- CVE-2026-74449: drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport (bsc#1278215).\n- CVE-2026-74450: drm/amd/pm: fix pptable use-after-free (bsc#1278216).\n- CVE-2026-74465: net: openvswitch: fix potential UAF on meter attach failure (bsc#1277801).\n- CVE-2026-74467: s390/qeth: Check CAP_NET_ADMIN for private ioctls (bsc#1277805).\n- CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1277792).\n- CVE-2026-74471: tracing: Check return value of __register_event() in trace_module_add_events() (bsc#1277781).\n- CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() (bsc#1276340).\n- CVE-2026-74480: net: bridge: stop fast-leave after deleting a port group (bsc#1276353).\n- CVE-2026-74483: binfmt_misc: don't leak the user namespace when the mount fails (bsc#1276347).\n- CVE-2026-74484: binfmt_misc: don't let an 'F' entry pin its own instance (bsc#1276345).\n- CVE-2026-74485: binfmt_misc: reject a flag character as the field delimiter (bsc#1277892).\n- CVE-2026-74487: binfmt_misc: restore write access when removing an entry (bsc#1276349).\n- CVE-2026-74490: tipc: avoid use-after-free in poll trace queue dumps (bsc#1276352).\n- CVE-2026-74492: netfilter: ipset: do not update comments from kernel-side hash adds (bsc#1276337).\n- CVE-2026-74493: net/smc: fix socket use-after-free during link group termination (bsc#1276338).\n- CVE-2026-74515: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (bsc#1275953).\n- CVE-2026-74538: Bluetooth: ISO: lock sk in iso_connect_ind (bsc#1275682).\n- CVE-2026-74564: netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH (bsc#1275567).\n- CVE-2026-74579: netfilter: nft_payload: fix mask build for partial field offload (bsc#1275559).\n- CVE-2026-74580: vhost: reset the vring metadata cache on vring reconfiguration (bsc#1277885).\n- CVE-2026-74586: sctp: clear new_transport when removing a peer (bsc#1277820).\n- CVE-2026-74588: sctp: keep chunk-\u003etransport in step with the list it is queued on (bsc#1277766).\n- CVE-2026-74589: bpf, sockmap: Fix sk_redir use-after-free in send verdict (bsc#1277904).\n- CVE-2026-74590: fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions (bsc#1277824).\n- CVE-2026-74592: ima: Instantiate file_truncate and path_truncate hooks (bsc#1277900).\n- CVE-2026-74594: sched/psi: Shut down rtpoll_timer in psi_cgroup_free() (bsc#1277843).\n- CVE-2026-74595: fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() (bsc#1277910).\n- CVE-2026-74597: ip6_tunnel: clear skb2-\u003ecb in ip6ip6_err() (bsc#1277493).\n- CVE-2026-74600: mm/page_table_check: skip special zero mappings (bsc#1277640).\n- CVE-2026-74601: ring-buffer: Use current_context for safe per-CPU buffer swap (bsc#1277896).\n- CVE-2026-74602: ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer() (bsc#1277895).\n- CVE-2026-74603: ptp: ocp: Fix board ID over-read (bsc#1277915).\n- CVE-2026-74605: eventfs: Use children field for rcu head and add memory barriers (bsc#1277913).\n- CVE-2026-74606: eventfs: Fix use-after-free in eventfs_remove_rec() (bsc#1277864).\n- CVE-2026-74609: tipc: read le-\u003elink under the node lock in tipc_node_link_down() (bsc#1277906).\n- CVE-2026-74625: netfilter: bridge: release template ct on non-IP path (bsc#1277036).\n- CVE-2026-74628: net/x25: fix use-after-free of the socket by its timers (bsc#1277844).\n- CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191).\n- CVE-2026-74631: net: smc: fix splice entry lifetime imbalance in smc_rx_splice (bsc#1278195).\n- CVE-2026-74632: mm/huge_memory: fix huge_zero_pfn race (bsc#1278199).\n- CVE-2026-74634: ring-buffer: Prevent subbuf order change when resizing is disabled (bsc#1277379).\n- CVE-2026-74636: tracing: Fix race between update_event_fields and, event_define_fields (bsc#1277371).\n- CVE-2026-74637: perf/core: Fix group leader use-after-free after sibling detach (bsc#1277372).\n- CVE-2026-74638: drm/v3d: Serialize the scheduler timeout handlers (bsc#1277374).\n- CVE-2026-74659: net: bridge: mrp: fix uninitialised bytes on the wire (bsc#1277296).\n- CVE-2026-74660: netfilter: ebt_nflog: pin the NFLOG backend (bsc#1277272).\n- CVE-2026-74662: inet: frags: add inet_frag_putn() helper (bsc#1277277).\n- CVE-2026-74663: net/sched: reject overly deep qdisc hierarchies (bsc#1278311).\n- CVE-2026-74666: packet: synchronize pressure clearing with ring reconfiguration (bsc#1277032).\n- CVE-2026-74667: net/packet: reset the MAC header on the packet-socket transmit path (bsc#1277396).\n- CVE-2026-74671: ima: fix out-of-bounds read in xattr_verify() (bsc#1277392).\n- CVE-2026-74688: sctp: clear control chunk transport if it is being removed (bsc#1277489).\n- CVE-2026-74689: net/atm: fix slab-out-of-bounds read in vcc_setsockopt() (bsc#1278314).\n- CVE-2026-74692: net/smc: fix TOCTOU race between smc_listen_out() and listener close (bsc#1276927).\n- CVE-2026-74694: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length (bsc#1277625).\n- CVE-2026-74696: tcp: fix TFO max_qlen accounting across reuseport migration (bsc#1276930).\n- CVE-2026-74697: bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips (bsc#1277897).\n- CVE-2026-74700: net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers (bsc#1277626).\n- CVE-2026-74701: net/openvswitch: check Ethernet header length in key_extract() (bsc#1276921).\n- CVE-2026-74710: xsk: require at least 16 bytes of TX metadata (bsc#1276579).\n- CVE-2026-74713: vhost_iotlb: bound map allocation in add_range (bsc#1276570).\n- CVE-2026-74718: devlink: fix net namespace reference leak in reload (bsc#1276573).\n- CVE-2026-74725: enic: fix tx_hang_reset use-after-free on device removal (bsc#1276563).\n- CVE-2026-74726: bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor (bsc#1276565).\n- CVE-2026-74735: l2tp: fix tunnel and session refcount leak on seq_file release (bsc#1277030).\n- CVE-2026-74739: net/sched: cls_u32: skip hash tables in u32_bind_class() (bsc#1278247).\n- CVE-2026-74745: eth: bnxt: decrease indent in bnxt_request_irq() (bsc#1277382).\n- CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315).\n- CVE-2026-80521: af_unix: Unlink scc_entry in unix_del_edge() (bsc#1277568).\n- CVE-2026-80585: mptcp: fastopen: only mark MPTFO subflows with SYN data (bsc#1277342).\n- CVE-2026-80613: veth: fix NAPI leak in XDP enable error path (bsc#1278205).\n- CVE-2026-80631: btrfs: lzo: reject compressed segment that overflows the compressed input (bsc#1277558).\n- CVE-2026-80664: netfilter: xt_nat: reject unsupported target families (bsc#1277555).\n- CVE-2026-80679: s390/dasd: Fix potential NULL pointer dereference (bsc#1277557).\n- CVE-2026-80686: mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE (bsc#1278245).\n- CVE-2026-80694: net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller (bsc#1278363).\n- CVE-2026-80715: igc: remove napi_synchronize() in igc_down() (bsc#1277840).\n- CVE-2026-80725: net: gro: properly validate BIG TCP aggregation criteria (bsc#1277452).\n- CVE-2026-80747: drm/amdkfd: Add bounds check for CRAT subtype length (bsc#1279536).\n- CVE-2026-80756: selinux: do not cancel a policy conversion that never started (bsc#1278708).\n- CVE-2026-80779: net/ionic: avoid OOB TX partner lookup for hwstamp RXQ (bsc#1279590).\n- CVE-2026-80789: nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621).\n- CVE-2026-80793: ipv4: reject undersized MTUs in ip_do_fragment() (bsc#1279799).\n- CVE-2026-80836: crypto: virtio - bound the akcipher result length (bsc#1279819).\n- CVE-2026-80840: ipv6: seg6: clear IPv4 control block on IPIP decapsulation (bsc#1279875).\n- CVE-2026-80841: net/packet: defer vmalloc TX_RING free until skbs finish (bsc#1279835).\n- CVE-2026-80842: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context (bsc#1279888).\n- CVE-2026-80844: xfrm: ah6: validate routing header segments_left (bsc#1279786).\n- CVE-2026-80846: xfrm: drop ESP-in-TCP packets with no ingress device (bsc#1279878).\n- CVE-2026-80847: tcp: clamp route advmss to TCP_MIN_MSS (bsc#1279850).\n- CVE-2026-80848: xfrm: espintcp: fix UAF during close (bsc#1279581).\n- CVE-2026-80851: gtp: serialize PDP context updates (bsc#1279569).\n- CVE-2026-80852: tls: device: fix out-of-bounds write in tls_append_frag() (bsc#1279532).\n- CVE-2026-80863: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (bsc#1279535).\n- CVE-2026-80864: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (bsc#1279525).\n- CVE-2026-80865: bpf: Add missing access_ok call to copy_user_syms (bsc#1279527).\n- CVE-2026-80880: IB/mlx5: Properly support implicit ODP rereg_mr (bsc#1279497).\n- CVE-2026-80895: mshv: Order pt_vp_array publish against irqfd assertion path (bsc#1279702).\n- CVE-2026-80932: vsock/virtio: flush works in dependency order (bsc#1280143).\n- CVE-2026-80976: seg6: reset IP6CB after IPv6 decapsulation (bsc#1280298).\n- CVE-2026-80979: net/smc: unregister the connection before draining the rx tasklet (bsc#1280299).\n- CVE-2026-80980: net/smc: Address spelling errors (bsc#1280303).\n- CVE-2026-80983: net/smc: fix socket refcount leak in smc_switch_conns() (bsc#1280296).\n- CVE-2026-80984: net/smc: do not dereference an unset send buffer on the SMC-D teardown path (bsc#1280309).\n- CVE-2026-81000: net: tun: bound receive headroom (bsc#1280263).\n- CVE-2026-81001: slip: fix use-after-free in sl_sync() (bsc#1280375).\n- CVE-2026-89448: iommu/vt-d: Force requesting ACS when tboot is enabled (bsc#1280379).\n- CVE-2026-89451: iommu/sva: Set handle-\u003edev before the SVA handle is visible (bsc#1280383).\n- CVE-2026-89453: iommu/amd: Put PCI device after handling PPR faults (bsc#1280384).\n- CVE-2026-89477: sctp: fix NULL deref on untransmitted RECONF completion (bsc#1280338).\n- CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786).\n- CVE-2026-89480: nvme-tcp: reject a read that transferred too few bytes (bsc#1280449).\n- CVE-2026-89481: nvme-tcp: fix host memory disclosure on R2T for a read command (bsc#1280451).\n- CVE-2026-89482: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (bsc#1280350).\n- CVE-2026-89485: lockd: pin next file across nlm_inspect_file lock-drop (bsc#1280456).\n- CVE-2026-89500: ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page (bsc#1280333).\n- CVE-2026-89501: ring-buffer: Hold cpu_buffer::lock when resizing a subbuf (bsc#1280335).\n- CVE-2026-89502: ring-buffer: Free cpu_buffer::free_page with subbuf_order (bsc#1280336).\n- CVE-2026-89503: ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() (bsc#1280334).\n- CVE-2026-89508: RDMA/ucma: Lock the handler in ucma_set_ib_path() (bsc#1280544).\n- CVE-2026-89510: RDMA/cxgb4: Cancel reg_work before freeing device on remove (bsc#1280551).\n- CVE-2026-89511: qede: Fix NULL pointer dereference in TPA fragment processing (bsc#1280508).\n- CVE-2026-89525: udf: reject VAT indexes equal to the entry count (bsc#1282288).\n- CVE-2026-89526: svcrdma: Validate Read chunk positions before reconstruction (bsc#1280901).\n- CVE-2026-89527: svcrdma: Use svc_xprt_put to free listener on create failure (bsc#1281754).\n- CVE-2026-89530: svcrdma: Reject inline replies that overflow the pull-up buffer (bsc#1280920).\n- CVE-2026-89531: svcrdma: Reject connection when transport allocation fails (bsc#1281738).\n- CVE-2026-89532: svcrdma: Fix pcl_for_each_segment for empty chunks (bsc#1280985).\n- CVE-2026-89533: svcrdma: Fix offset arithmetic in read_chunk_range (bsc#1280993).\n- CVE-2026-89534: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails (bsc#1280766).\n- CVE-2026-89535: svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id (bsc#1280761).\n- CVE-2026-89536: SUNRPC: wait for in-flight client TLS handshake callback (bsc#1280711).\n- CVE-2026-89538: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field (bsc#1280716).\n- CVE-2026-89539: SUNRPC: reject duplicate CREDS_VALUE options (bsc#1280717).\n- CVE-2026-89540: sunrpc: init gssp_lock before publishing proc entry (bsc#1280719).\n- CVE-2026-89541: SUNRPC: harden gss_unwrap_resp_priv length checks (bsc#1280388).\n- CVE-2026-89542: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (bsc#1280387).\n- CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280758).\n- CVE-2026-89545: sunrpc: defer rq_argp and rq_resp free until after RCU grace period (bsc#1280720).\n- CVE-2026-89547: SUNRPC: Check svc pool percpu counter allocation (bsc#1280548).\n- CVE-2026-89548: SUNRPC: always drain cache_cleaner before destroying a cache_detail (bsc#1280546).\n- CVE-2026-89550: SUNRPC: svcauth_gss: enforce krb5 token minimum length (bsc#1280726).\n- CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow (bsc#1280727).\n- CVE-2026-89564: ip: orphan prefetched skbs before multicast forwarding (bsc#1280797).\n- CVE-2026-89580: bpf: Disable preemption in __bpf_get_stack (bsc#1280577).\n- CVE-2026-89603: entry: Fix seccomp bypass after ptrace with TSYNC (bsc#1280923).\n- CVE-2026-89644: btrfs: fix extent map leak in NOCOW direct I/O write (bsc#1281054).\n- CVE-2026-89658: NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup (bsc#1280576).\n- CVE-2026-89660: NFSD: Prevent client use-after-free during admin state revocation (bsc#1280525).\n- CVE-2026-89662: NFSD: Prevent lock owner use-after-free during client teardown (bsc#1280509).\n- CVE-2026-89663: nfsd: revoke copy-notify stateids before dropping their reference (bsc#1280518).\n- CVE-2026-89665: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE (bsc#1281057).\n- CVE-2026-89669: nfsd: initialize copy-notify stateid before publishing it (bsc#1280251).\n- CVE-2026-89671: nfsd: gate nfs3 setacl by argp-\u003emask (bsc#1280252).\n- CVE-2026-89672: nfsd: gate nfs2 setacl by argp-\u003emask (bsc#1280235).\n- CVE-2026-89673: nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo (bsc#1280237).\n- CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280243).\n- CVE-2026-89680: nfsd: fix nfsd_file leak on inter-server COPY setup failure (bsc#1280206).\n- CVE-2026-89683: nfsd: fix dentry ref leak on V4ROOT export filehandle lookup (bsc#1280193).\n- CVE-2026-89684: nfsd: fix cpntf publish race in nfs4_init_cp_state (bsc#1280178).\n- CVE-2026-89685: nfsd: fix clock domain mismatch in clients_still_reclaiming() (bsc#1280179).\n- CVE-2026-89686: nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke (bsc#1280184).\n- CVE-2026-89688: nfsd: drop the stateid, not the stateowner, on seqid_op replay retry (bsc#1280171).\n- CVE-2026-89690: nfsd: defer vfree of compound ops to fix rpc_status UAF (bsc#1280166).\n- CVE-2026-89691: nfsd: clear opcnt on compound arg release to prevent OOB read (bsc#1280163).\n- CVE-2026-89694: nfsd: check client ownership when cancelling a copy-notify stateid (bsc#1280151).\n- CVE-2026-89696: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref (bsc#1280146).\n- CVE-2026-89697: nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() (bsc#1280148).\n- CVE-2026-89698: nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage (bsc#1280494).\n- CVE-2026-89699: nfsd: validate symlink target length in NFSv4 CREATE (bsc#1281077).\n- CVE-2026-89702: nfsd: size fh_verify server sockaddr slot by xpt_locallen (bsc#1280487).\n- CVE-2026-89703: nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations (bsc#1280488).\n- CVE-2026-89704: nfsd: sample writeback error cursor before async COPY loop (bsc#1280490).\n- CVE-2026-89705: nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths (bsc#1280464).\n- CVE-2026-89706: nfsd: Reset write verifier when async COPY writeback fails (bsc#1280477).\n- CVE-2026-89707: nfsd: release path refs on follow_down() error (bsc#1280468).\n- CVE-2026-89710: NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path (bsc#1280455).\n- CVE-2026-89712: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock (bsc#1280870).\n- CVE-2026-89713: NFSD: check truncate permission under inode lock (bsc#1280872).\n- CVE-2026-89747: tracing: Fix use-after-free in trace_pipe read on sub-buffer order change (bsc#1281025).\n- CVE-2026-89780: net: qualcomm: rmnet: restore skb-\u003edev on deaggregated frames (bsc#1280969).\n- CVE-2026-89784: SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 (bsc#1281224).\n- CVE-2026-89789: gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free (bsc#1281226).\n- CVE-2026-89791: perf: Fix use-after-free when perf mmap() revival races with the last munmap() (bsc#1281228).\n- CVE-2026-89798: svcrdma: Fix unmatched rn_unregister on failed accept (bsc#1281136).\n- CVE-2026-89912: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save (bsc#1281201).\n- CVE-2026-89913: KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables (bsc#1281202).\n- CVE-2026-89968: nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229).\n- CVE-2026-89970: nvmet: add a helper function for cqid checking (bsc#1281231).\n- CVE-2026-89984: perf/x86/intel: Fix kernel address leakages in LBR stack (bsc#1281273).\n- CVE-2026-90003: futex: Prevent rcuwait use-after-free during requeue PI (bsc#1281295).\n- CVE-2026-90065: net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure (bsc#1281660).\n- CVE-2026-90074: net/sched: fq_pie: clamp default quantum to avoid signed overflow (bsc#1281496).\n- CVE-2026-90097: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition (bsc#1281514).\n- CVE-2026-90101: bnxt_en: Fix call to hardware monitoring event handler (bsc#1281525 bsc#1283517).\n- CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546).\n- CVE-2026-90142: virtio_net: Fix resize of the RX ring (bsc#1281597).\n- CVE-2026-90149: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers (bsc#1281955).\n- CVE-2026-90150: pnfs/blocklayout: Fix device leaks on parse failure (bsc#1281956).\n- CVE-2026-90151: NFSv4: remove callback IDR entry on client allocation failure (bsc#1281599).\n- CVE-2026-90177: bpf: Check pointer type for all atomic RMW paths (bsc#1281645).\n- CVE-2026-90182: blk-iocost: clear delay state when freeing policy data (bsc#1281644).\n- CVE-2026-90183: blk-iolatency: clear delay state when freeing policy data (bsc#1281964).\n- CVE-2026-90203: Squashfs: check block offset is not negative (bsc#1281808).\n- CVE-2026-90218: RDMA/cma: Fix WARNING in res_to_rt (bsc#1281795).\n- CVE-2026-90228: nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() (bsc#1281717).\n- CVE-2026-90240: iommu/vt-d: Flush context cache with correct SID when tearing down aliases (bsc#1281683).\n- CVE-2026-90241: iommu/vt-d: Tear down scalable-mode context on probe failure (bsc#1281682).\n- CVE-2026-90243: iommu/vt-d: Clear Present bit before tearing down copied context entry (bsc#1281845).\n- CVE-2026-90259: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() (bsc#1281680).\n- CVE-2026-90263: btrfs: check if root is readonly when setting posix acl (bsc#1281922).\n- CVE-2026-90265: btrfs: defrag: fix deadlock between defrag and delalloc space reservation (bsc#1282054).\n- CVE-2026-90292: RDMA/siw: Fix use-after-free in siw_accept() (bsc#1281777).\n- CVE-2026-90293: IB/isert: post the full-feature receive buffers after session registration (bsc#1281778).\n- CVE-2026-90294: IB/isert: delay the final Login Response until the session is registered (bsc#1281732).\n- CVE-2026-90307: RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ (bsc#1282050).\n- CVE-2026-90308: RDMA/erdma: Hold QP references for AE and CM processing (bsc#1281786).\n- CVE-2026-90309: RDMA/erdma: Hold CQ references when processing EQ events (bsc#1281789).\n- CVE-2026-90358: bpf, x86: Fix trampoline stack size for 128-bit arguments (bsc#1281825).\n- CVE-2026-90388: iommu/dma: Check atomic pool allocation result directly (bsc#1282197).\n- CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received (bsc#1282113).\n- CVE-2026-90414: IB/isert: reject PDUs declaring more data than (bsc#1282110).\n- CVE-2026-90415: RDMA/cxgb4: free STAG index when TPT entry write fails (bsc#1282143).\n- CVE-2026-90417: RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() (bsc#1281973).\n- CVE-2026-90426: iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs (bsc#1282013).\n- CVE-2026-90428: iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs (bsc#1282003).\n- CVE-2026-90430: iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized (bsc#1281991).\n- CVE-2026-92495: RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap (bsc#1282072).\n- CVE-2026-92523: RDMA/nldev: validate dynamic counter attribute length (bsc#1282271).\n- CVE-2026-92525: RDMA/rxe: Validate num_sge/cur_sge before indexing wqe-\u003edma.sge[] (bsc#1282270).\n- CVE-2026-93037: RDMA/hfi1: Propagate sdma_txinit_ahg() errors (bsc#1282020).\n- CVE-2026-93107: RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state (bsc#1281399).\n- CVE-2026-93108: RDMA/ipoib: Drain RCU callbacks during module teardown (bsc#1281408).\n- CVE-2026-93109: RDMA/mlx5: Drain RCU callbacks during module teardown (bsc#1281379).\n- CVE-2026-93110: RDMA/core: Wait for RCU callbacks before unloading ib_core (bsc#1281387).\n- CVE-2026-93154: RDMA/irdma: Add refcounting to user ring MRs (bsc#1282104).\n- CVE-2026-93160: crypto: atmel-ecc - reject hardware ECDH without a public key (bsc#1282147).\n- CVE-2026-93207: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (bsc#1282672).\n- CVE-2026-93212: nfsd: guard nfsd_serv deref in nfsd_file_net_dispose (bsc#1282774).\n- CVE-2026-93264: RDMA/efa: Fix PBL chunk length computation (bsc#1282812).\n- CVE-2026-93782: vhost-scsi: flush backend after device ioctls (bsc#1282906).\n- CVE-2026-93794: smb/client: flush dirty data before punching a hole (bsc#1283154).\n- CVE-2026-93800: btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol() (bsc#1282808).\n- CVE-2026-93810: cachefiles: Fix double fput (bsc#1283213).\n- CVE-2026-93814: spi: core: Abort active target transfer on controller suspend.\n- CVE-2026-93825: spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data().\n- CVE-2026-93826: HID: hidpp: fix potential UAF in hidpp_connect_event() (bsc#1282891).\n- CVE-2026-93827: virtio-fs: avoid double-free on failed queue setup (bsc#1282747).\n- CVE-2026-93829: smb: client: fix races in cifsd thread creation (bsc#1282803).\n- CVE-2026-97413: RDMA/rtrs-srv: Fix integer underflow in process_read and process_write (bsc#1282975).\n- CVE-2026-97421: RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() (bsc#1283176).\n- CVE-2026-97477: RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() (bsc#1283230).\n- CVE-2026-97520: gfs2: move quota_init qc iterator increment (bsc#1283479).\n- CVE-2026-97521: gfs2: fix quota init duplicate scan (bsc#1283475).\n- CVE-2026-97543: xfs: destroy seen inode bitmap when we fail to add a dirpath (bsc#1283450).\n- CVE-2026-97544: xfs: don't leak dqacct if rhashtable insertion fails (bsc#1283149).\n- CVE-2026-97545: xfs: don't leak new_bp if xfs_btree_bload_drop_buf fails (bsc#1283205).\n- CVE-2026-97546: xfs: don't spin forever on zero-length dirents when salvaging them (bsc#1283203).\n- CVE-2026-97552: xfs: initialise error in xfs_defer_finish_one() (bsc#1283328).\n- CVE-2026-97557: smb: client: avoid leaking refcount in cifs_queue_oplock_break() (bsc#1283201).\n- CVE-2026-97571: bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc() (bsc#1283517 bsc#1283945).\n- CVE-2026-97572: bnxt_en: Propagate RX ring init failures in bnxt_init_nic() (bsc#1283517 bsc#1283794).\n- CVE-2026-97573: bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset() (bsc#1283517 bsc#1283880).\n- CVE-2026-97574: bnxt_en: Don't free the live ring's TPA state on queue restart failure (bsc#1283517 bsc#1283795).\n- CVE-2026-97605: erofs: preserve LZMA decoders on resize failure (bsc#1283173).\n- CVE-2026-97902: fs: don't return -EINVAL for successful nested thaw (bsc#1283166).\n- CVE-2026-97934: tracing: Fix memory corruption from a \"STACKTRACE\" histogram key (bsc#1282997).\n- CVE-2026-97940: ipv6: fix fib6 walker UAF on seq stop (bsc#1283163).\n- CVE-2026-97947: x86/amd_node: Avoid divide by zero on virtualized systems (bsc#1283130).\n- CVE-2026-97957: net: hinic: fix mailbox segment buffer overflow (bsc#1283119).\n- CVE-2026-98003: iommu/amd: Do not reallocate GA log buffers on resume (bsc#1283312).\n- CVE-2026-98028: eth: nfp: drop the replaced rule from the list when reprogramming fails (bsc#1283739).\n- CVE-2026-98029: eth: nfp: bound the ntuple rule dump by the caller's buffer size (bsc#1283490).\n- CVE-2026-98030: net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size (bsc#1283489).\n- CVE-2026-98091: btrfs: detach failed sprout device from transaction update list (bsc#1283805).\n- CVE-2026-100075: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (bsc#1282881).\n\nThe following non security issues were fixed:\n\n- ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach (stable-fixes).\n- ACPI: scan: Honor _DEP for ACPI0016 PCI/CXL host bridge (stable-fixes).\n- ACPICA: add boundary checks in acpi_ps_get_next_field() (stable-fixes).\n- ACPICA: add boundary checks in two places (stable-fixes).\n- ACPICA: Add package limit checks in parser functions (stable-fixes).\n- ACPICA: Add validation for node in acpi_ns_build_normalized_path() (stable-fixes).\n- ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() (stable-fixes).\n- ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() (stable-fixes).\n- ACPICA: Fix condition check in acpi_ps_parse_loop() (stable-fixes).\n- ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) (stable-fixes).\n- ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() (stable-fixes).\n- ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() (stable-fixes).\n- ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg() (stable-fixes).\n- ACPICA: Prevent adding invalid references (stable-fixes).\n- ACPICA: validate byte_count in acpi_ps_get_next_package_length() (stable-fixes).\n- ACPICA: validate handler object type in two places (stable-fixes).\n- ALSA: 6fire: Clean ups with guard() (stable-fixes).\n- ALSA: 6fire: fix OOB write from device-reported iso length (git-fixes).\n- ALSA: aloop: Check card index validity at probe (stable-fixes).\n- ALSA: bcd2000: Fix race between rawmidi and disconnect (git-fixes).\n- ALSA: caiaq: unregister the input device when probe fails (git-fixes).\n- ALSA: core: Add scoped cleanup helper for card references (stable-fixes).\n- ALSA: core: Define auto-cleanup for snd_card_free() (stable-fixes).\n- ALSA: core: Fix potential UAF after asynchronous card release (stable-fixes).\n- ALSA: es18xx: check control allocation before private data setup (stable-fixes).\n- ALSA: hda/common: Use cleanup macros for PM controls (stable-fixes).\n- ALSA: hda/common: Use guard() for mutex locks (stable-fixes).\n- ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10 (stable-fixes).\n- ALSA: hda/core: Use guard() for mutex locks (stable-fixes).\n- ALSA: hda/realtek - Add quirk for HP Victus 15-fa0xxx (MB 8A50) (stable-fixes).\n- ALSA: hda/realtek: Add HDA_CODEC_QUIRK for Samsung 750XBE/730XBE (stable-fixes).\n- ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx (stable-fixes).\n- ALSA: hda/realtek: Add mute LED quirk for HP Victus 16-e0xxx (MB 88ED) (stable-fixes).\n- ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP EliteBook 830 G8 (8AB8) to enable mute LEDs (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP Pavilion x360 (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP Victus 16-e0xxx (88EE) to enable mute LED (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Xiaoxin 14 GT (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Yoga 7 16IAP7 (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IRH8 (stable-fixes).\n- ALSA: hda/realtek: Add StarFighter HDA SSID (stable-fixes).\n- ALSA: hda/realtek: Fix speakers on MECHREVO WUJIE Series (stable-fixes).\n- ALSA: hda/realtek: Limit Star Labs internal mic boost (stable-fixes).\n- ALSA: hda/tegra: Re-enable SDO workaround for Tegra194 (git-fixes).\n- ALSA: hda: Add Lenovo Legion 7i 16IAX7 17AA3874 quirk (stable-fixes).\n- ALSA: hda: cs35l56: Fail if wmfw file is missing (stable-fixes).\n- ALSA: hda: ext: Clean up links if their initialization fails (stable-fixes).\n- ALSA: hda: Introduce auto cleanup macros for PM (stable-fixes).\n- ALSA: hda: trace PCM open only after assigning a stream (git-fixes).\n- ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup (git-fixes).\n- ALSA: ice1712: Fix the error handling via auto-cleanup at probe (git-fixes).\n- ALSA: line6: reject oversized playback packets (git-fixes).\n- ALSA: mpu401: Check card index validity at probe (stable-fixes).\n- ALSA: mts64: Check card index validity at probe (stable-fixes).\n- ALSA: pcm: Fix race between non-atomic ops and trigger-start (stable-fixes).\n- ALSA: pcm: set timer-\u003eprivate_data before registering the PCM timer (git-fixes).\n- ALSA: portman2x4: Check card index validity at probe (stable-fixes).\n- ALSA: seq: oss: Reject reads that cannot fit the next event (stable-fixes).\n- ALSA: seq: Remove arbitrary prioq insertion limit (stable-fixes).\n- ALSA: seq: Serialize compat port-info ioctls (git-fixes).\n- ALSA: serial-u16550: Check card index validity at probe (stable-fixes).\n- ALSA: ua101: reject mismatched capture/playback packet sizes (git-fixes).\n- ALSA: ump: Copy FB name string more safely (stable-fixes).\n- ALSA: ump: Copy safe string name to rawmidi (stable-fixes).\n- ALSA: ump: Update rawmidi name per EP name update (stable-fixes).\n- ALSA: usb-audio: Add dB map quirk for Razer Barracuda X 2.4 (stable-fixes).\n- ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless (stable-fixes).\n- ALSA: usb-audio: Add quirk flags for SC13A (stable-fixes).\n- ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision) (stable-fixes).\n- ALSA: usb-audio: Add quirk for Novation Mininova (stable-fixes).\n- ALSA: usb-audio: Add quirk for YAMAHA CDS3000 (stable-fixes).\n- ALSA: usb-audio: caiaq: validate EP1 reply lengths (stable-fixes).\n- ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity (git-fixes).\n- ALSA: usb-audio: Optimize the copy of packet sizes for implicit fb handling (stable-fixes).\n- ALSA: usb: 6fire: Avoid embedded URBs (stable-fixes).\n- ALSA: usx2y: Drain pending US-428 pipe-4 output commands (stable-fixes).\n- ALSA: virmidi: Check card index validity at probe (stable-fixes).\n- ALSA: virtio: reset device before deleting virtqueues (git-fixes).\n- arm64: fixmap: Allow 256K early_ioremap() at any offset (git-fixes).\n- arm64: hibernate: clone only the linear map that exists at runtime (git-fixes).\n- arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc (git-fixes).\n- arm64: kprobes: Allow reentering kprobes while single-stepping (git-fixes).\n- arm64: mte: Fix PTRACE_{PEEK,POKE}MTETAGS error documentation (git-fixes).\n- arm64: percpu: Fix LSE operations on {8,16}-bit types (git-fixes).\n- arm64: percpu: Fix this_cpu_and() mask generation (git-fixes).\n- arm64: percpu: Fix this_cpu_write() casting (git-fixes).\n- arm64: Use load LSE atomics for the non-return per-CPU atomic operations (git-fixes).\n- ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for HyperX OMEN Gaming Laptop 16-ap1xxx (stable-fixes).\n- ASoC: codecs: aw88261: only check PLL and clock state at power-up (git-fixes).\n- ASoC: codecs: aw88261: reduce log spam (stable-fixes).\n- ASoC: codecs: max98363: fix uninitialized stream_config-\u003etype (git-fixes).\n- ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive (stable-fixes).\n- ASoC: codecs: rk3328: Use managed GPIO and clock helpers (stable-fixes).\n- ASoC: codecs: rt274: Fix format setting for 44100 rate (git-fixes).\n- ASoC: codecs: rt286: Revert delay value for jack setup (git-fixes).\n- ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config-\u003etype (git-fixes).\n- ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config-\u003etype (git-fixes).\n- ASoC: fsl-asoc-card: reduce WM8904 PLL ratio to meet frequency limit (stable-fixes).\n- ASoC: hdmi-codec: Report a change when the channel status moves (git-fixes).\n- ASoC: Intel: catpt: Complete coredump handling (stable-fixes).\n- ASoC: Intel: sof_sdw: Add quirks for new Dell laptops (stable-fixes).\n- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (stable-fixes).\n- ASoC: mediatek: mt8365-afe-pcm: fix possible NULL-pointer dereferences in mt8365_afe_suspend() (stable-fixes).\n- ASoC: qcom: lpass-cpu: use DAI table index for playback constraints (git-fixes).\n- ASoC: qcom: q6apm: return error code to consumers on failures (stable-fixes).\n- ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt (stable-fixes).\n- ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence (stable-fixes).\n- ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure (stable-fixes).\n- ASoC: rt712-sdca: reset codec at io_init to fix silent headphone (stable-fixes).\n- ASoC: rt5645: Perform the initial jack detect at probe (stable-fixes).\n- ASoC: tas2781: Update default register address to TAS2563 (stable-fixes).\n- ASoC: tegra: Fix ASRC Stream6 input threshold control (git-fixes).\n- ASoC: ti: omap3pandora: update board check to use DT compatible (stable-fixes).\n- ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments (git-fixes).\n- ASoC: wm8903: Move the DRC QR threshold to the register that holds it (git-fixes).\n- Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough (git-fixes).\n- Bluetooth: btintel_pcie: Add 50 ms delay before MAC init on BlazarIW (stable-fixes).\n- Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit (git-fixes).\n- Bluetooth: btintel_pcie: validate device-supplied DMA indices (git-fixes).\n- Bluetooth: btmtk: add MT7902 MCU support (stable-fixes).\n- Bluetooth: btmtk: Disable remote wakeup for MT7922/MT7925 (stable-fixes).\n- Bluetooth: btmtk: fix wrong status for short WMT FUNC_CTRL events (git-fixes).\n- Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access (git-fixes).\n- Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown (git-fixes).\n- Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU (stable-fixes).\n- Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU (stable-fixes).\n- Bluetooth: btusb: Add Mercusys MA530 for Realtek RTL8761BUV (stable-fixes).\n- Bluetooth: btusb: Add Realtek RTL8922AE VID/PID 0bda/d922 (stable-fixes).\n- Bluetooth: btusb: Add Realtek RTL8922AE VID/PID 0bda/d923 (stable-fixes).\n- Bluetooth: btusb: Add support for Intel Lizard Peak 2 (0x8087:0x0040) (stable-fixes).\n- Bluetooth: btusb: Add support for TP-Link TL-UB250 (stable-fixes).\n- Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV (stable-fixes).\n- Bluetooth: btusb: fix NXP IW610 composite device handling (stable-fixes).\n- Bluetooth: btusb: MT7922: Add VID/PID 0e8d/223c (stable-fixes).\n- Bluetooth: btusb: MT7925: Add VID/PID 0e8d/8c38 (stable-fixes).\n- Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices (git-fixes).\n- Bluetooth: btusb: Record matched usb_device_id into btusb_data (stable-fixes).\n- Bluetooth: btusb: refactor endpoint lookup (stable-fixes).\n- Bluetooth: coredump: Quiesce dump work on unregister (git-fixes).\n- Bluetooth: eir: validate service data length before reading UUID (git-fixes).\n- Bluetooth: hci_codec: validate vendor codec count length (git-fixes).\n- Bluetooth: hci_conn: fix CIS hold ownership on reuse (git-fixes).\n- Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (git-fixes).\n- Bluetooth: hci_core: Print number of packets in conn-\u003edata_q (stable-fixes).\n- Bluetooth: hci_sock: reject out-of-range OCF values (git-fixes).\n- Bluetooth: hci_sock: validate event length before filtering (git-fixes).\n- Bluetooth: hci_sync: Serialize local codec list cleanup (git-fixes).\n- Bluetooth: ISO: balance the parent hold in hci_bind_bis() (git-fixes).\n- Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() (git-fixes).\n- Bluetooth: ISO: release unused CIS holds after channel attach (git-fixes).\n- Bluetooth: ISO: set BT_LISTEN before requesting a BIG sync (git-fixes).\n- Bluetooth: L2CAP: validate connectionless PSM length (stable-fixes).\n- Bluetooth: L2CAP: validate frame length before control and FCS access (git-fixes).\n- Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel (git-fixes).\n- Bluetooth: mgmt: fix race in read_unconf_index_list() (git-fixes).\n- Bluetooth: Properly disable remote wakeup for MT7922/MT7925 on Ryzen platform (git-fixes).\n- Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup (git-fixes).\n- Bluetooth: RFCOMM: fix NULL dereference of dlc-\u003esession in RFCOMM_CONNINFO (git-fixes).\n- Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() (git-fixes).\n- Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (stable-fixes).\n- Bluetooth: SMP: reject Security Request over BR/EDR (git-fixes).\n- bnxt_en: Bound SW TPA IDs to prevent crashes (git-fixes).\n- bnxt_en: Fix potential data corruption with HW GRO/LRO (git-fixes).\n- bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (bsc#1283517).\n- bnxt_en: Only restore LRO if the device supports TPA (bsc#1283517).\n- bnxt_en: Write doorbell when linearizing skb fails (bsc#1283517).\n- bonding: crypto offload enabled, non-offload slave failover, rekey failed (bsc#1282823).\n- btrfs: do not force reloc root creation during qgroup_account_snapshot() (bsc#1275740).\n- btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag (bsc#1279116).\n- btrfs: tree-checker: validate INODE_REF's namelen (git-fixes).\n- config: cleanup azure and kvmsmall Cleanup azure and kvmsmall configs after following comments updated default\n  configs: 4229ca50b2b3 Disable CONFIG_BATMAN_ADV (jsc#PED-16892).\n- dmaengine: Add devm_dma_request_chan() (stable-fixes).\n- dmaengine: altera-msgdma: Use memcpy_toio for descriptor FIFO writes (stable-fixes).\n- dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc (stable-fixes).\n- dmaengine: Fix device kref underflow in dma_chan_put() (git-fixes).\n- dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() (git-fixes).\n- dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() (git-fixes).\n- dmaengine: sprd: Fix runtime PM reference leak in probe (git-fixes).\n- dmaengine: sun6i: fix non-atomic read of DMA position registers (git-fixes).\n- dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status (git-fixes).\n- dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() (git-fixes).\n- dmaengine: wait for RCU readers before releasing dma_device (git-fixes).\n- dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA (git-fixes).\n- dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order (git-fixes).\n- driver core: Export get_dev_from_fwnode() (stable-fixes).\n- drm/amd/display: Bump frame warning limit for clang builds of dml (stable-fixes).\n- drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend (git-fixes).\n- drm/amd/display: Check for sharpening case when calculating max vtaps for scaler (stable-fixes).\n- drm/amd/display: clean-up dead code in dml2_mall_phantom (stable-fixes).\n- drm/amd/display: Find link encoder for flexible DIG mapping cases (stable-fixes).\n- drm/amd/display: Fix CRC open failure during active rendering (stable-fixes).\n- drm/amd/display: Fix dc stream excess put in dm_update_crtc_state() (git-fixes).\n- drm/amd/display: Fix DPMS using partially updated pipe context (stable-fixes).\n- drm/amd/display: Initialize dsc_caps to 0 (stable-fixes).\n- drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC (git-fixes).\n- drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized (stable-fixes).\n- drm/amd/pm/si: Fix updating clock limits from power states (stable-fixes).\n- drm/amd/pm/si: Fix updating clock limits on AC/DC (git-fixes).\n- drm/amd/pm: bound pp_dpm_set_pp_table() memcpy (stable-fixes).\n- drm/amd/pm: Check SMUv13.0.6/12 metrics integrity (stable-fixes).\n- drm/amd/pm: hide pp_table sysfs on APUs (git-fixes).\n- drm/amdgpu: add a helper to calculate ring distance (stable-fixes).\n- drm/amdgpu: check ras and obj before dereference (git-fixes).\n- drm/amdgpu: check thunderbolt before switcheroo registration (stable-fixes).\n- drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages (bsc#1284146).\n- drm/amdgpu: Failed to check various return code (stable-fixes).\n- drm/amdgpu: fix ACP MFD device leak on init failure (git-fixes).\n- drm/amdgpu: fix buffer overflow during vBIOS update (stable-fixes).\n- drm/amdgpu: fix IP instance memory leak on kobject add failure (git-fixes).\n- drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init() (git-fixes).\n- drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show() (git-fixes).\n- drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init() (git-fixes).\n- drm/amdgpu: flush pending RCU callbacks on module unload (stable-fixes).\n- drm/amdgpu: harden FRU PIA parsing with bounded helpers (stable-fixes).\n- drm/amdgpu: Prefer ROM BAR for default VGA device (stable-fixes).\n- drm/amdgpu: Skip accessing psp rum time db for APUs (stable-fixes).\n- drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT (stable-fixes).\n- drm/amdgpu: Use system unbound workqueue for soft IH ring (stable-fixes).\n- drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw (stable-fixes).\n- drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id (stable-fixes).\n- drm/amdkfd: Check bounds on allocate_doorbell (stable-fixes).\n- drm/amdkfd: check find_first_zero_bit before __set_bit on kfd-\u003edoorbell_bitmap (stable-fixes).\n- drm/amdkfd: fix UAF race in destroy_queue_cpsch (stable-fixes).\n- drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl (stable-fixes).\n- drm/amdkfd: Reject zero-sized AQL queue allocations after size halving (stable-fixes).\n- drm/amdkfd: Unwind debug trap enable on copy_to_user failure (stable-fixes).\n- drm/arm/komeda: fix error handling for clk_prepare_enable() and callers (stable-fixes).\n- drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend (stable-fixes).\n- drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach (git-fixes).\n- drm/bridge: tc358768: Set pre_enable_prev_first for reverse order (stable-fixes).\n- drm/cirrus: Use video aperture helpers (stable-fixes).\n- drm/dp: Add DSC virtual DPCD quirk for Realtek MST branch device (stable-fixes).\n- drm/gem: Consider GEM object reclaimable if shrinking fails (stable-fixes).\n- drm/gma500: return errors from Oaktrail HDMI I2C reads (stable-fixes).\n- drm/gud: Add RCade Display Adapter VID/PID pair (stable-fixes).\n- drm/gud: fix out-of-bounds write in gud_plane_atomic_check() (git-fixes).\n- drm/i915/psr: Add new SU area calculation helper to apply workarounds (stable-fixes).\n- drm/i915/psr: Clear stale sel fetch enable bits on sel fetch disable (git-fixes).\n- drm/i915: fix incorrect RCU teardown order (git-fixes).\n- drm/i915: Guard against NULL driver_data in i915_pci_probe() (stable-fixes).\n- drm/imagination: clamp freelist reconstruction requests (git-fixes).\n- drm/imagination: Fix page count for page table for map() interface (git-fixes).\n- drm/imagination: Populate FW common context ID before passing to the FW (stable-fixes).\n- drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl() (git-fixes).\n- drm/logicvc: Drop the select of the nonexistent CONFIG_DRM_KMS_DMA_HELPER (git-fixes).\n- drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device (git-fixes).\n- drm/mediatek: dsi: Add compatible for mt8167-dsi (stable-fixes).\n- drm/mediatek: Fix ovl adaptor platform device leak (git-fixes).\n- drm/mediatek: Fix pdev reference leak in mtk_drm_bind() (git-fixes).\n- drm/msm/adreno: fix autosuspend cleanup during teardown (git-fixes).\n- drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL (git-fixes).\n- drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure (git-fixes).\n- drm/msm: Recover HW before retire hung submit (git-fixes).\n- drm/nouveau/bios: skip the IFR header if present (stable-fixes).\n- drm/nouveau/clk: don't clobber reclock status when restoring volt/fan (git-fixes).\n- drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update (git-fixes).\n- drm/nouveau/disp: don't reject HDMI config on cards without SCDC (git-fixes).\n- drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM (git-fixes).\n- drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() (git-fixes).\n- drm/nouveau: fix autosuspend cleanup during teardown (git-fixes).\n- drm/nouveau: Fix bridge reference leak in nv1a_ram_new() (git-fixes).\n- drm/nouveau: fix double-free in nvif_vmm_dtor (git-fixes).\n- drm/nouveau: Fix gem reference leak in validate_init() (git-fixes).\n- drm/nouveau: Fix runtime PM leak in nouveau_connector_detect() (git-fixes).\n- drm/nouveau: RCU-free the scheduler-containing nouveau_sched (git-fixes).\n- drm/omap: dsi: Do not copy isr table (git-fixes).\n- drm/panel: Enable GPIOLIB for panels which uses functions from it (stable-fixes).\n- drm/panel: jadard-jd9365da-h3: set prepare_prev_first (stable-fixes).\n- drm/panel: simple: Add AM-1280800W8TZQW-T00H (stable-fixes).\n- drm/radeon: Read the VRAM VBIOS signature with readb() (git-fixes).\n- drm/vc4: Use managed KMS polling to fix UAF on unbind (git-fixes).\n- drm/virtio: fix memory leak of fence event on execbuffer failure (git-fixes).\n- drm/virtio: fix NULL pointer dereference on fence allocation failure (git-fixes).\n- drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() (git-fixes).\n- drm/virtio: fix object leak when drm_gem_handle_create() fails (git-fixes).\n- drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() (git-fixes).\n- drm/virtio: release the GEM object on virtio_gpu_vram_create() errors (git-fixes).\n- drm/xe: Limit sg segment size to PAGE_SIZE on Xen PV (git-fixes).\n- drm/xe: Wait on external BO kernel fences in exec IOCTL (CVE-2026-74440 bsc#1261564).\n- drm: add drm_memory_stats_is_zero (stable-fixes).\n- drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr (git-fixes).\n- fbcon: don't suspend/resume when vc is graphics mode (stable-fixes).\n- fbdev: pm2fb: unwind WC setup on probe failure (stable-fixes).\n- fbdev: pvr2fb: correct user pointer annotation and sentinel initializer (stable-fixes).\n- firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size (stable-fixes).\n- firmware: arm_scmi: Validate SENSOR_UPDATE payload size (stable-fixes).\n- firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS (git-fixes).\n- firmware: qcom_scm: Rename peripheral as pas_id (stable-fixes).\n- firmware: stratix10-svc: change get provision data to async SMC call (stable-fixes).\n- firmware: stratix10-svc: fix FCS SMC call kernel-doc (git-fixes).\n- firmware: sysfb: Move bpp-depth calculation into screen_info helper (stable-fixes).\n- gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() (git-fixes).\n- gpio: dwapb: Mask interrupts at hardware initialization (stable-fixes).\n- gpio: pisosr: Read \"ngpios\" as u32 (stable-fixes).\n- gpio: tps65219: Fix GPIO input value reads (git-fixes).\n- gpio: virtuser: skip free_irq when no IRQ is installed (git-fixes).\n- gpio: zynq: fix runtime PM leak on request error path (git-fixes).\n- HID: alps: fix use-after-free on input2 registration failure (git-fixes).\n- HID: alps: unregister DualPoint Stick input device on remove (git-fixes).\n- HID: amd_sfh: Validate PCI BAR size before mapping (git-fixes).\n- HID: asus: fortify keyboard handshake (stable-fixes).\n- HID: bpf: Add Huion Inspiroy Frego M button quirk (stable-fixes).\n- HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request (git-fixes).\n- HID: bpf: fix __hid_bpf_hw_check_params report length (git-fixes).\n- HID: core: quiesce input in hid_hw_stop() to prevent use-after-free (stable-fixes).\n- HID: elecom: fix bus type for M-XGL20DLBK (git-fixes).\n- HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM (stable-fixes).\n- HID: hidpp: fix potential UAF in hidpp_connect_event() (stable-fixes).\n- HID: logitech-hidpp: fix race condition when accessing stale stack pointer (stable-fixes).\n- HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes (git-fixes).\n- HID: mcp2221: fix OOB write in mcp2221_raw_event() (stable-fixes).\n- HID: mcp2221: stop device IO before hid_hw_stop (git-fixes).\n- HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard (stable-fixes).\n- HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() (git-fixes).\n- host1x: bus: Fix missing ops null check in error teardown (stable-fixes).\n- hwmon: (adt7462) Add of_match_table to support devicetree (stable-fixes).\n- hwmon: (corsair-psu) Fix linear11 calculation (stable-fixes).\n- hwmon: (dell-smm) Add Dell Latitude 7530 to fan control whitelist (stable-fixes).\n- hwmon: (emc1403) Drop hysteresis for low limit temperature (git-fixes).\n- hwmon: (emc1403) Rely on subsystem locking (stable-fixes).\n- hwmon: (gpio-fan) return IRQ_HANDLED from the shared alarm IRQ handler (git-fixes).\n- hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show() (git-fixes).\n- hwmon: (hp-wmi-sensors) Improve raw WMI string handling (git-fixes).\n- hwmon: (ina2xx) Parameterize ina2xx_data in ina226_alert_read() (stable-fixes).\n- hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i (stable-fixes).\n- hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding (git-fixes).\n- hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676 (git-fixes).\n- hwmon: (raspberrypi) Fix delayed-work teardown race (stable-fixes).\n- hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove (git-fixes).\n- hwmon: (w83793) release probe data through kref (git-fixes).\n- i2c: at91: release DMA channels on remove and probe error (git-fixes).\n- i2c: atr: fix dangling adapter pointer on add failure (git-fixes).\n- i2c: imx: disable autosuspend on remove (git-fixes).\n- i2c: imx: release DMA channels on probe error (git-fixes).\n- i2c: mxs: fix DMA channel leak on probe error (git-fixes).\n- i2c: qcom-cci: fix device_node refcount leak in cci_probe()/cci_remove() (git-fixes).\n- i2c: qcom-cci: Remove the unused variable cci_clk_rate (git-fixes).\n- i2c: qcom-cci: Stop complaining about DT set clock rate (stable-fixes).\n- i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode (git-fixes).\n- i3c: mipi-i3c-hci: Quieten initialization messages (stable-fixes).\n- i3c: mipi-i3c-hci: Refactor PIO register initialization (stable-fixes).\n- i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc() (stable-fixes).\n- ibmveth: Add multi buffers rx replenishment hcall support (jsc#PED-16852).\n- ibmvnic: Increase max subcrq indirect entries with fallback (jsc#PED-16854).\n- ibmvnic: Use ndo_get_stats64 to fix inaccurate SAR reporting (jsc#PED-16854).\n- iio: accel: kionix-kx022a: Fix array boundary check (git-fixes).\n- iio: accel: kxcjk-1013: reject duplicate event disable (git-fixes).\n- iio: accel: mma8452: switch to non-devm request_threaded_irq() (stable-fixes).\n- iio: accel: sca3000: fix frequency divider condition check (git-fixes).\n- iio: adc: pac1934: check ACPI label duplication (git-fixes).\n- iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind (stable-fixes).\n- iio: adc: rtq6056: add i2c_device_id support (stable-fixes).\n- iio: adc: stm32-adc: fix check on internal channel availability (git-fixes).\n- iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure (git-fixes).\n- iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls (git-fixes).\n- iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind (git-fixes).\n- iio: admv1013: initialize callback mutex before registering notifier (git-fixes).\n- iio: buffer: Ensure bounce buffer used for unaligned case is zeroed (git-fixes).\n- iio: buffer: serialize buffer teardown with mode claims (git-fixes).\n- iio: frequency: admv1013: fix wrong channel field used in admv1013_read_raw() (git-fixes).\n- iio: gyro: adis16136: fix unprotected debugfs reads (git-fixes).\n- iio: health: max30102: fix NULL dereference in interrupt handler (git-fixes).\n- iio: imu: adis16400: fix unprotected debugfs reads (git-fixes).\n- iio: light: gp2ap020a00f: drain irq_work after free_irq (git-fixes).\n- iio: light: stk3310: Deal with the ps interrupt issue in PM (stable-fixes).\n- iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup (git-fixes).\n- iio: proximity: aw96103: validate firmware data length (git-fixes).\n- iio: proximity: isl29501: Fix return type of isl29501_register_write (git-fixes).\n- iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure (git-fixes).\n- iio: proximity: sx9324: Correct proximity channel resolution (git-fixes).\n- iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler (git-fixes).\n- iio: trigger: cancel reenable_work before freeing trigger (git-fixes).\n- Input: adp5588-keys - cache GPIO state before registering the gpiochip (git-fixes).\n- Input: aiptek - validate raw macro indices before updating state (stable-fixes).\n- Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 (git-fixes).\n- Input: cyttsp5 - clamp the HID report size before memcpy (git-fixes).\n- Input: eeti_ts - publish the OF module alias (git-fixes).\n- Input: evdev - zero absinfo before partial copy in EVIOCSABS (git-fixes).\n- Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P (stable-fixes).\n- Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() (git-fixes).\n- Input: s6sy761 - fix resume ordering and restore sensing (git-fixes).\n- Input: soc_button_array - check btns_desc-\u003epackage.count (git-fixes).\n- Input: soc_button_array - fix MS Surface Pro 11 probe failure (git-fixes).\n- Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) (stable-fixes).\n- Input: synaptics - limit T440p InterTouch quirk to LEN0036 (git-fixes).\n- Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound (git-fixes).\n- Input: trackpoint - fix the inertia attribute name in the ABI document (git-fixes).\n- Input: xpad - add support for Azeron devices (stable-fixes).\n- Input: xpad - add support for Victrix Pro BFG Controller (stable-fixes).\n- Input: xpad - fix PDP Marvel Xbox 360 controller (git-fixes).\n- Input: zero ff_effect before compat copy in input_ff_effect_from_user (git-fixes).\n- kernel-binary.spec.in: Emulate kabi.pl error when suse-kabi-tools is used.\n- kernel-binary.spec.in: Fix syntax error.\n- KEYS: encrypted: fix integer overflow of datablob_len (git-fixes).\n- keys: fix lost wakeup when reaping a dead key type (git-fixes).\n- keys: translate request_key_auth pid for the reading procfs instance (git-fixes).\n- KEYS: trusted: Fix tpm2_load_cmd() boundary check (git-fixes).\n- KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure (git-fixes).\n- KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve() (git-fixes).\n- KVM: arm64: vgic: Don't leak the SPI array when init is retried (git-fixes).\n- KVM: arm64: vgic: Prevent speculative SPI array underflow (git-fixes).\n- KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU (git-fixes).\n- KVM: nVMX: Always flush vpid02 on first use (git-fixes).\n- KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02 (git-fixes).\n- KVM: nVMX: Synthesize SHUTDOWN on RSM if L2 requires emulation (git-fixes).\n- KVM: VMX: Handle bad values on proxied writes to LBR MSRs (git-fixes).\n- KVM: VMX: Reject KVM_RUN if userspace forces emulation during nested VM-Enter (git-fixes).\n- KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy (git-fixes).\n- KVM: x86/pmu: Move Intel PMU global MSRs to intel_is_valid_msr() (git-fixes).\n- KVM: x86: Extract VMX's unhandleable emulation check to common x86 (git-fixes).\n- KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails (git-fixes).\n- leds: pca9532: Don't stop blinking for non-zero brightness (stable-fixes).\n- leds: trigger: gpio: Use GPIOD_FLAGS_BIT_NONEXCLUSIVE (stable-fixes).\n- leds: uleds: Return -EFAULT on copy_to_user() failure (stable-fixes).\n- media: chips-media: wave5: Add range checks for dec_output_info (stable-fixes).\n- media: chips-media: wave5: Fix Reports from Kernel Lock Validator (stable-fixes).\n- media: dm1105: fix missing error check for dma_alloc_coherent (stable-fixes).\n- media: em28xx-video: fix missing res_free() on init_usb_xfer failure (stable-fixes).\n- media: i2c: imx355: Replace client-\u003edev usage (stable-fixes).\n- media: imon: Add iMON VFD HID OEM v1.2 key mappings (stable-fixes).\n- media: imx355: Avoid calling imx355_power_off twice in error path (git-fixes).\n- media: qcom: camss: avoid format string warning (stable-fixes).\n- media: rc: mceusb: Add support for 04eb:e033 (stable-fixes).\n- media: video-i2c: fix buffer queue ordering (stable-fixes).\n- media: video-i2c: use vb2_video_unregister_device on driver removal (stable-fixes).\n- memstick: ms_block: destroy io_queue workqueue on removal (git-fixes).\n- mfd: db8500-prcmu: Fold dbx500 header into db8500 (git-fixes).\n- mfd: rsmu: Add 8a34002 support (stable-fixes).\n- mfd: tps65219: Make poweroff handler conditional on system-power-controller (stable-fixes).\n- mmc: core: Add validation for host-provided max_segs (stable-fixes).\n- mmc: core: Cancel SDIO IRQ work before freeing host (git-fixes).\n- mmc: core: Fix OF node reference leak on card add failure (git-fixes).\n- mmc: davinci: avoid NULL deref of host-\u003edata in IRQ handler (stable-fixes).\n- mmc: davinci: fix mmc_add_host order in probe (stable-fixes).\n- mmc: hsq: Fix use-after-free in retry work (git-fixes).\n- mmc: mmci: Fix use-after-free in busy-timeout work (git-fixes).\n- mmc: mxcmmc: cancel data work and watchdog on remove (git-fixes).\n- mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC (stable-fixes).\n- mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC (stable-fixes).\n- mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260 (stable-fixes).\n- mmc: sdhci-of-aspeed: Remove children before releasing SDC resources (git-fixes).\n- mmc: sdhci_am654: Clear ITAPDLY on tuning failure (git-fixes).\n- mmc: sdhci_am654: Fallback to DT-provided itap delay on DDR50 tuning failure (git-fixes).\n- mmc: sdhci_am654: Move tuning_loop to local variable (git-fixes).\n- mmc: sdhci_am654: Reset command and data lines on failed tuning (git-fixes).\n- mmc: sdio_uart: fix xmit_fifo leak when the port table is full (git-fixes).\n- mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt (git-fixes).\n- mmc: spi: reset bytes_xfered before retrying CRC failures (git-fixes).\n- mtd: block2mtd: Fix divide error when erase_size is zero (git-fixes).\n- mtd: core: avoid double-free of OTP NVMEM device (git-fixes).\n- mtd: core: call _get_device() with the master MTD (git-fixes).\n- mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ (git-fixes).\n- mtd: rawnand: pl353: Add message about ECC mode (stable-fixes).\n- mtd: rawnand: pl353: Fix debug prints (git-fixes).\n- mtd: rawnand: pl353: Make sure we use the monolithic helpers for raw accesses (git-fixes).\n- mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB (git-fixes).\n- mtd: spinand: fix zero oobavail when no ECC engine is used (git-fixes).\n- net/ibmveth: fix comment typos in ibmveth.c (jsc#PED-16852).\n- net: mana: Clear RDMA teardown and suspend state in mana_rdma_probe() (git-fixes).\n- net: mana: Reserve extra CQ slot for the fence completion CQE (git-fixes).\n- net: mana: restore the XDP program pointer when pre-allocation fails (git-fixes).\n- net: page_pool: Remove zone/policy GFP flags when allocating XArray entries (git-fixes).\n- net: usb: catc: bound the RX packet length in catc_rx_done() (git-fixes).\n- net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist (stable-fixes).\n- net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs() (git-fixes).\n- net: usb: pegasus: don't rely on id table pointer arithmetic (stable-fixes).\n- net: usb: qmi_wwan: add MeiG SRM813Q (stable-fixes).\n- net: usb: sr9700: include receive overhead in the length check (git-fixes).\n- net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value (git-fixes).\n- net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain (git-fixes).\n- net: wwan: t7xx: Add delay between MD and SAP suspend (stable-fixes).\n- net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() (git-fixes).\n- nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() (git-fixes).\n- nfc: llcp: fix -ENOMEM on connect with zero-length service name (git-fixes).\n- nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() (git-fixes).\n- nfc: llcp: Fix race condition in accept_queue lifecycle (git-fixes).\n- nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure (git-fixes).\n- nfc: llcp: fix slab-out-of-bounds reads when logging service names (git-fixes).\n- nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() (git-fixes).\n- nfc: nfcmrvl: validate helper command length before pull (git-fixes).\n- nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() (git-fixes).\n- nfc: port100: reject frames whose declared length exceeds the received data (git-fixes).\n- nfc: st21nfca: validate ISO15693 inventory length (git-fixes).\n- nfc: st21nfca: validate received frame size (git-fixes).\n- nfc: virtual_ncidev: Add missing ioctl compat handler (git-fixes).\n- PCI/MSI: Enable memory decoding before restoring MSI-X messages (git-fixes).\n- PCI/proc: Fix race between pci_proc_init() and pci_bus_add_device() (stable-fixes).\n- PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store() (stable-fixes).\n- PCI: Accept AtomicOps already enabled by the hypervisor (git-fixes).\n- PCI: altera: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: Avoid FLR for MediaTek MT7925 WiFi (stable-fixes).\n- PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems (stable-fixes).\n- PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk (git-fixes).\n- PCI: iproc: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: mediatek: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: of_property: Omit bus properties without a subordinate bus (git-fixes).\n- PCI: plda: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: rockchip: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: Stop setting cached power state to 'unknown' on unbind (stable-fixes).\n- PCI: switchtec: Add Gen6 Device IDs (stable-fixes).\n- PCI: Wait for device readiness after D3hot -\u003e D0uninitialized transition (stable-fixes).\n- PCI: xgene: Drop unnecessary OF node reference (git-fixes).\n- PCI: xgene: Drop XGENE_PCIE_IP_VER_UNKN (stable-fixes).\n- phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow (git-fixes).\n- phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting (git-fixes).\n- pinctrl: meson: Fix typo in s4 group name (git-fixes).\n- pinctrl: single: free the IRQ on domain creation failure (git-fixes).\n- pinctrl: sunxi: keep a shadow copy of the data register output latches (git-fixes).\n- platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table (stable-fixes).\n- platform/x86: hp-bioscfg: bound ordered-list parsing by the package count (stable-fixes).\n- platform/x86: hp-bioscfg: pass validated element count to package parsers (stable-fixes).\n- platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table (stable-fixes).\n- platform/x86: ISST: Check for admin capability for write commands (stable-fixes).\n- platform/x86: ISST: Validate max level for set feature (git-fixes).\n- platform/x86: msi-ec: Add support for MSI Pulse GL66 12th Gen (stable-fixes).\n- platform/x86: sel3350-platform: Retain LED state on load and unload (stable-fixes).\n- platform/x86: think-lmi: improve check if BIOS account security enabled (stable-fixes).\n- power: sequencing: don't call .post_enable() if pwrseq_unit_enable() failed (git-fixes).\n- power: sequencing: fix NULL-pointer dereference in pwrseq_device_register() (git-fixes).\n- power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new() (git-fixes).\n- power: supply: ab8500_fg: fix use-after-free on remove (git-fixes).\n- power: supply: ab8500_fg: Remove redundant dev_err()/dev_err_probe() (stable-fixes).\n- powerpc/crash: stop watchdogs before booting kdump kernel (bsc#1277705 ltc#220979).\n- powerpc/perf: Add power12 Base Performance Monitoring support (jsc#PED-16906).\n- powerpc/pseries: Handle and log pseries-wdt registration failures (bsc#1277705 ltc#220979).\n- powerpc/pseries: Limit PVR list to 16 entries for CAS negotiation (jsc#PED-16906).\n- powerpc/pseries: Move H_WATCHDOG definitions to a common header (bsc#1277705 ltc#220979).\n- powerpc: Add Power12 architected mode (jsc#PED-16906).\n- powerpc: Add Power12 raw mode (jsc#PED-16906).\n- procfs: fix possible double mmput() in do_procmap_query() (git-fixes).\n- RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations (git-fixes).\n- RDMA/core: Fix potential use after free in counter_release() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_dealloc_pd_user() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_destroy_cq_user() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_destroy_srq_user() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_free_cq() (git-fixes).\n- RDMA/core: Fix use after free in ib_query_qp() (git-fixes).\n- RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup (git-fixes).\n- RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables (git-fixes).\n- RDMA/hfi1: Align probe error unwinding with device removal (git-fixes).\n- RDMA/hfi1: Allocate device data after PCI initialization (git-fixes).\n- RDMA/hfi1: Create workqueues before device initialization (git-fixes).\n- RDMA/hfi1: Defer device creation until probe succeeds (git-fixes).\n- RDMA/hfi1: Drop device data from hfi1_validate_rcvhdrcnt() (git-fixes).\n- RDMA/hfi1: Free RX data on late probe failure (git-fixes).\n- RDMA/hfi1: Initialize debugfs after probe completes (git-fixes).\n- RDMA/hfi1: Pass PCI device to hfi1_pcie_init() (git-fixes).\n- RDMA/hfi1: Preserve unit 0 on (git-fixes).\n- RDMA/hfi1: Remove redundant NULL checks in create_workqueues() (git-fixes).\n- RDMA/hfi1: Remove redundant PCI device ID validation (git-fixes).\n- RDMA/hfi1: Stop flushing the global IB workqueue (git-fixes).\n- RDMA/irdma: Add a refcount to track user ring MR associations (git-fixes).\n- RDMA/irdma: Add irdma_cq fields to track pbl allocations (git-fixes).\n- RDMA/irdma: Deduplicate the irdma_del_memlist logic (git-fixes).\n- RDMA/rvt: Return NULL after port allocation failure (git-fixes).\n- regulator: core: clamp voltage constraints before applying apply_uV (stable-fixes).\n- regulator: da9121: Use subvariant ids in the I2C table (stable-fixes).\n- ring-buffer: Add helper functions for allocations (bsc#1277895 bsc#1280334).\n- ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() (bsc#1277896).\n- ring-buffer: Simplify functions with __free(kfree) to free allocations (bsc#1277895 bsc#1280334).\n- rtc: ac100: Assign .num before accessing .hws (git-fixes).\n- rtc: aspeed: add AST2700 compatible (stable-fixes).\n- rtc: bq32000: add delay between RTC reads (stable-fixes).\n- rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak (git-fixes).\n- rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe() (git-fixes).\n- rtc: mv: add suspend/resume support for wakeup (stable-fixes).\n- rtc: spear: initialize IRQ state before requesting alarm IRQ (git-fixes).\n- selftests: fib_nexthops: do not mark skipped tests as failed (bsc#1283296).\n- serial: 8250: fix possible ISR soft lockup (stable-fixes).\n- serial: 8250_bcm7271: fix use-after-free in brcmuart_remove() (git-fixes).\n- serial: fix TIOCMIWAIT race (git-fixes).\n- serial: ma35d1: Fix clock reference leak in ma35d1serial_probe() (git-fixes).\n- serial: sc16is7xx: fix TX gap caused by kfifo circular buffer wrap-around (git-fixes).\n- serial: sc16is7xx: refill TX FIFO below trigger using fresh TXLVL (git-fixes).\n- serial: tegra: don't clear the Tx FIFO on an Rx-only reset (git-fixes).\n- serial: vt8500: Fix clock reference leak in vt8500_serial_probe() (git-fixes).\n- smb: client: reject overlapping data areas in SMB2 responses (git-fixes).\n- soc: qcom: geni-se: Correct QUP Core ICC vote constants (git-fixes).\n- soundwire: cadence_master: wait and cancel cdns-\u003ework before clock stop (git-fixes).\n- soundwire: dmi-quirks: Disable ghost Realtek devices (stable-fixes).\n- soundwire: intel: Move suspend tracking from trigger to pm suspend (stable-fixes).\n- soundwire: intel_auxdevice: Add cs42l43b to wake_capable_list (stable-fixes).\n- soundwire: only handle alert events when the peripheral is attached (stable-fixes).\n- soundwire: validate DT compatible before parsing it (stable-fixes).\n- spi: dw-dma: Wait for controller idle before completing Tx (git-fixes).\n- spi: dw-mmio: Add ACPI ID LECA0002 for LECARC SoCs (stable-fixes).\n- spi: dw: fix wrong RX_SAMPLE_DLY setting after resume (git-fixes).\n- spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM (stable-fixes).\n- spi: xilinx: let transfers timeout in case of no IRQ (stable-fixes).\n- thermal/drivers/qcom/tsens: Atomic temperature read with hardware-guided retries (stable-fixes).\n- thermal/drivers/tegra/soctherma: Switch to devm cooling device registration (stable-fixes).\n- thermal: gov_step_wise: Fix stale mitigation vote with non-zero lower bounds (git-fixes).\n- thunderbolt: Avoid reserved fields in path config space for USB4 routers (stable-fixes).\n- thunderbolt: Don't access path config space on Lane 1 adapters in tb_switch_reset_host() (stable-fixes).\n- thunderbolt: Don't disable lane adapter if XDomain lane bonding isn't possible (stable-fixes).\n- thunderbolt: Fix KASAN reported use-after-free when request is canceled (git-fixes).\n- thunderbolt: Improve multi-display DisplayPort tunnel allocation (stable-fixes).\n- thunderbolt: Increase timeout for Configuration Ready bit (stable-fixes).\n- thunderbolt: Keep the domain reference while processing hotplug (stable-fixes).\n- thunderbolt: Keep XDomain reference during the lifetime of a service (stable-fixes).\n- thunderbolt: Reject oversized XDomain properties responses (git-fixes).\n- thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() (stable-fixes).\n- thunderbolt: Set tb-\u003eroot_switch to NULL when domain is stopped (stable-fixes).\n- thunderbolt: Verify Router Ready bit is set after router enumeration (stable-fixes).\n- tpm: Disable TPM on null key name mismatch (git-fixes).\n- tty: serial: max3100: shut down timer before freeing port (git-fixes).\n- tty: serial: qcom_geni_serial: Keep console RX functional after deep idle (git-fixes).\n- tty: vt: fix memory leak in vc_allocate() (git-fixes).\n- usb-storage: ene_ub6250: fix race between scan work and probe (stable-fixes).\n- USB: cdc-acm: fix racy TIOCMIWAIT implementation (git-fixes).\n- USB: cdc-acm: skip URB restart in port_shutdown if disconnected (git-fixes).\n- USB: cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set (stable-fixes).\n- usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe (git-fixes).\n- usb: cdns3: fix use-after-free in cdns3_gadget_exit() (git-fixes).\n- usb: cdns3: rename hibernated argument of role-\u003eresume() to lost_power (stable-fixes).\n- usb: chipidea: tegra: disable runtime PM on resume failure (git-fixes).\n- usb: core: clear both ep_in and ep_out for non-ep0 control endpoints (git-fixes).\n- usb: core: hcd: fix possible deadlock in rh control transfers (stable-fixes).\n- usb: dwc3: am62: Fix runtime PM usage count leak on probe error path (git-fixes).\n- usb: gadget: aspeed-vhub: cancel wake work on device removal (git-fixes).\n- usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue (stable-fixes).\n- USB: gadget: dummy-hcd: Fix wait for outstanding request completions (git-fixes).\n- usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC (git-fixes).\n- usb: gadget: f_fs: Fix Use-After-Free in AIO error path (git-fixes).\n- usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd (git-fixes).\n- USB: gadget: ffs: fix mm lifetime handling (stable-fixes).\n- USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() (stable-fixes).\n- usb: gadget: goku_udc: avoid NULL deref of dev-\u003edriver in INT_USBRESET log (stable-fixes).\n- usb: gadget: midi2: Fix the jack descriptor array sizes (git-fixes).\n- usb: gadget: udc: skip pullup() if already connected (stable-fixes).\n- usb: host: add ARCH_AIROHA in XHCI MTK dependency (stable-fixes).\n- usb: hub: use shorter 120ms post resume hold for SS root hubs (git-fixes).\n- usb: image: mdc800: change kmalloc() to kzalloc() (stable-fixes).\n- usb: octeon-hcd: fix the FIFO-flush timeout computation (git-fixes).\n- usb: ohci-da8xx: disable controller wakeup on cleanup (git-fixes).\n- usb: ohci-s3c2410: disable controller wakeup on removal (git-fixes).\n- usb: ohci-st: disable controller wakeup on removal (git-fixes).\n- USB: serial: fix driver deregistration order (git-fixes).\n- USB: serial: fix dynamic id driver deregistration race (git-fixes).\n- USB: serial: fix ioctl hangup race (git-fixes).\n- USB: serial: fix port tear down use-after-free (git-fixes).\n- USB: serial: quatech2: fix baud rate overflow (git-fixes).\n- usb: serial: spcp8x5: don't store usb_device_id (stable-fixes).\n- USB: serial: ssu100: fix baud rate overflow (git-fixes).\n- usb: storage: sierra_ms: reject short SWoC info transfers (git-fixes).\n- usb: typec: anx7411 - stop the IRQ before destroying the workqueue (git-fixes).\n- usb: typec: tcpm: recover after failure to start the frs ams (git-fixes).\n- usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() (git-fixes).\n- usb: typec: ucsi: displayport: Current CAM OOB index fixup (git-fixes).\n- usb: typec: ucsi: Get the connector fwnode based on reg value (git-fixes).\n- usb: typec: ucsi: glink: fix use-after-free of ucsi on remove (git-fixes).\n- usb: usbtmc: don't store usb_device_id (stable-fixes).\n- usb: xhci: Improve Soft Retries after short transfers (stable-fixes).\n- usb: xhci: use cached HCSPARAMS1 value (stable-fixes).\n- usb: xusbatm: don't rely on id table pointer arithmetic (stable-fixes).\n- usbip: vhci_hcd: fix NULL deref in status_show_vhci (stable-fixes).\n- vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF (git-fixes).\n- vt: skip screen update for DEC alignment test on backgroup consoles (git-fixes).\n- watchdog: da9062: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes).\n- watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes).\n- watchdog: digicolor: Avoid division by zero (git-fixes).\n- watchdog: imx7ulp_wdt: Keep WDOG running until A55 enters WFI on i.MX94 (stable-fixes).\n- watchdog: lenovo_se10_wdt: Add support for SE10 Gen 2 platform (stable-fixes).\n- watchdog: lenovo_se10_wdt: Fix use-after-free and resource leak risk (stable-fixes).\n- watchdog: msc313e: Fix premature reset during timeout update (git-fixes).\n- watchdog: msc313e: Propagate error code in resume() (git-fixes).\n- watchdog: rtd119x: Avoid division by zero (git-fixes).\n- watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init() (git-fixes).\n- watchdog: starfive-wdt: Fix runtime PM leak in starfive_wdt_pm_start() (git-fixes).\n- wifi: ath9k_htc: don't store usb_device_id (stable-fixes).\n- wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all() (git-fixes).\n- wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi (stable-fixes).\n- wifi: ath11k: fix stride mismatch in mac_phy_caps_parse() (git-fixes).\n- wifi: ath12k: fix stride mismatch in mac_phy_caps_parse() (git-fixes).\n- wifi: brcmfmac: fix lost 802.1x TX completion wakeup (git-fixes).\n- wifi: brcmsmac: fix UAF in brcms_free_timer() (git-fixes).\n- wifi: cfg80211: check IP header size in cfg80211_classify8021d() (git-fixes).\n- wifi: cfg80211: don't filter by BSS type when removing stale entries (git-fixes).\n- wifi: cfg80211: don't get the radio mask for netdev-less wdevs (git-fixes).\n- wifi: cfg80211: expose cfg80211_chandef_get_width() (stable-fixes).\n- wifi: cfg80211: fix width unit in cfg80211_radio_chandef_valid() (git-fixes).\n- wifi: cfg80211: only group hidden BSSes with beacon entries (git-fixes).\n- wifi: cfg80211: reject duplicate wiphy cipher suite entries (stable-fixes).\n- wifi: cfg80211: skip regulatory for punctured subchannels (stable-fixes).\n- wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() (stable-fixes).\n- wifi: cfg80211: validate rx/tx MLME callback frame lengths before access (stable-fixes).\n- wifi: iwlegacy: fix broadcast stations deallocation (git-fixes).\n- wifi: iwlwifi: acpi: validate WGDS table revision index (stable-fixes).\n- wifi: iwlwifi: bound aligned TLV advance in FW parser (stable-fixes).\n- wifi: iwlwifi: mvm: add a check on the tid coming from the firmware (stable-fixes).\n- wifi: iwlwifi: mvm: fix a possible underflow (stable-fixes).\n- wifi: iwlwifi: mvm: fix an off-by-1 boundary check (stable-fixes).\n- wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif (stable-fixes).\n- wifi: iwlwifi: mvm: fix sched scan IE sizing (stable-fixes).\n- wifi: iwlwifi: mvm: parse beacon notif per layout (stable-fixes).\n- wifi: iwlwifi: mvm: validate mac_link_id in session protect notif (stable-fixes).\n- wifi: iwlwifi: mvm: validate sta_id in BA window status notif (stable-fixes).\n- wifi: iwlwifi: mvm: validate TX_CMD response layout (stable-fixes).\n- wifi: libertas: reject short monitor TX frames (stable-fixes).\n- wifi: libipw: fix key index receive bound checks (stable-fixes).\n- wifi: libipw: reject too-short association responses (git-fixes).\n- wifi: libipw: reject too-short beacon and probe responses (git-fixes).\n- wifi: mac80211: abort chanswitch when leaving a mesh (git-fixes).\n- wifi: mac80211: add HE 6 GHz capability in the scan elems len (git-fixes).\n- wifi: mac80211: always allow transmitting null-data on TXQs (stable-fixes).\n- wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver (git-fixes).\n- wifi: mac80211: don't access the TSF of a down interface (git-fixes).\n- wifi: mac80211: don't allow injecting frames wider than the chanctx (git-fixes).\n- wifi: mac80211: don't allow link changes when iface is down (git-fixes).\n- wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed (stable-fixes).\n- wifi: mac80211: don't offload TC setup on AP_VLAN interfaces (git-fixes).\n- wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set (git-fixes).\n- wifi: mac80211: don't start a ROC while scanning (git-fixes).\n- wifi: mac80211: explicitly disable FTM responder on AP stop (stable-fixes).\n- wifi: mac80211: ibss: wait for in-flight TX on disconnect (stable-fixes).\n- wifi: mac80211: mesh: release the channel if start fails (git-fixes).\n- wifi: mac80211: mesh: reset the CSA state when leaving (git-fixes).\n- wifi: mac80211: only operate on TDLS peers in the TDLS code (git-fixes).\n- wifi: mac80211: require a peer station for TDLS setup confirm (git-fixes).\n- wifi: mac80211: reset state when starting AP fails (git-fixes).\n- wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown (git-fixes).\n- wifi: mac80211: set up the TX info early to fix failure paths (git-fixes).\n- wifi: mac80211: suppress chanctx warning for debugfs reset (git-fixes).\n- wifi: mac80211: unlist vifs when their netdev is unregistered (git-fixes).\n- wifi: mac80211: validate deauth frame length before reason access (stable-fixes).\n- wifi: mt76: add init_wiphy callback (stable-fixes).\n- wifi: mt76: mt7915: set correct background radar capability (stable-fixes).\n- wifi: mt76: mt7925: add 320MHz bandwidth to bss_rlm_tlv (stable-fixes).\n- wifi: mt76: mt7925: add Netgear A8500 USB device ID (stable-fixes).\n- wifi: mt76: mt7925: advertise EHT 320MHz capabilities for 6GHz band (stable-fixes).\n- wifi: mt76: mt7925: Fix EHT Beamformee SS subfields to meet 802.11be minimum (git-fixes).\n- wifi: mt76: mt7925: handle 320MHz bandwidth in RXV and TXS (stable-fixes).\n- wifi: mt76: mt7925: populate EHT 320MHz MCS map in sta_rec (stable-fixes).\n- wifi: mt76: transform aspm_conf for pci_disable_link_state (stable-fixes).\n- wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length (git-fixes).\n- wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path (git-fixes).\n- wifi: mwifiex: prevent authentication frame length truncation (git-fixes).\n- wifi: mwifiex: replace one-element arrays with flexible array members (stable-fixes).\n- wifi: mwifiex: validate action frame fixed fields (git-fixes).\n- wifi: mwifiex: validate scan response extents (git-fixes).\n- wifi: nl80211: reject beacons with bad HE operation (stable-fixes).\n- wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST (git-fixes).\n- wifi: p54: validate curve data length in the calibration curve converters (git-fixes).\n- wifi: ralink: RT2X00: init EEPROM properly (stable-fixes).\n- wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers (stable-fixes).\n- wifi: rsi: fix heap OOB write on key removal (git-fixes).\n- wifi: rsi: validate beacon length before fixed buffer copy (stable-fixes).\n- wifi: rtw88: Add NULL check for chip-\u003eedcca_th in rtw_fw_adaptivity_result() (stable-fixes).\n- wifi: rtw88: Fix the random \"error beacon valid\" messages for USB (stable-fixes).\n- wifi: rtw88: TX QOS Null data the same way as Null data (stable-fixes).\n- wifi: rtw89: cleanup unused rtwdev::roc_work (stable-fixes).\n- wifi: rtw89: disable CSI STBC for VHT 160MHz (stable-fixes).\n- wifi: rtw89: Hide some errors when the device is unplugged (stable-fixes).\n- wifi: rtw89: pci: enable LTR based on pcie control register (stable-fixes).\n- wifi: rtw89: phy: check length before parsing PHY status IE (stable-fixes).\n- wifi: virt_wifi: don't transfer operstate before register (git-fixes).\n- wifi: virt_wifi: free skb when disconnected (git-fixes).\n- wifi: wilc1000: fix out-of-bounds read in P2P public action frames (git-fixes).\n- wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() (git-fixes).\n- wifi: wlcore: release runtime PM ref on regdomain config failure (git-fixes).\n- xhci: Prevent queuing new commands if xhci is inaccessible (stable-fixes).\n","status":"published","published":"2026-10-12T15:44:43Z","modified":"2026-10-19T17:23:14.488875612Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2025-40136","title":"CVE-2025-40136 in linux - Patched by Root","description":"Root has patched CVE-2025-40136 in the linux package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-10-18T03:18:11Z","modified":"2026-10-18T04:15:19.916719816Z","updated_at":"2026-11-02T15:53:31.514195Z"},{"id":"ROOT-OS-UBUNTU-2404-CVE-2025-40136","title":"CVE-2025-40136 in linux - Patched by Root","description":"Root has patched CVE-2025-40136 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.","status":"published","published":"2026-11-06T15:54:27Z","modified":"2026-11-06T16:17:50.481645939Z","updated_at":"2026-11-06T16:59:12.925458Z"},{"id":"SUSE-SU-2026:0447-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2023-54013: interconnect: Fix locking for runpm vs reclaim (bsc#1256280).\n- CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).\n- CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).\n- CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).\n- CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).\n- CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).\n- CVE-2025-40261: nvme: nvme-fc: Ensure -\u003eioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).\n- CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).\n- CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid() (bsc#1254624).\n- CVE-2025-40350: net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (bsc#1255260).\n- CVE-2025-40355: sysfs: check visibility before changing group attribute ownership (bsc#1255261).\n- CVE-2025-40363: net: ipv6: fix field-spanning memcpy warning in AH output (bsc#1255102).\n- CVE-2025-68171: x86/fpu: Ensure XFD state on signal delivery (bsc#1255255).\n- CVE-2025-68174: amd/amdkfd: enhance kfd process check in switch partition (bsc#1255327).\n- CVE-2025-68178: blk-cgroup: fix possible deadlock while configuring policy (bsc#1255266).\n- CVE-2025-68188: tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (bsc#1255269).\n- CVE-2025-68200: bpf: Add bpf_prog_run_data_pointers() (bsc#1255241).\n- CVE-2025-68215: ice: fix PTP cleanup on driver removal in error path (bsc#1255226).\n- CVE-2025-68227: mptcp: Fix proto fallback detection with BPF (bsc#1255216).\n- CVE-2025-68241: ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (bsc#1255157).\n- CVE-2025-68245: net: netpoll: fix incorrect refcount handling causing incorrect cleanup (bsc#1255268).\n- CVE-2025-68261: ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (bsc#1255164).\n- CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (bsc#1255377).\n- CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255401).\n- CVE-2025-68296: drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (bsc#1255128).\n- CVE-2025-68297: ceph: fix crash in process_v2_sparse_read() for encrypted directories (bsc#1255403).\n- CVE-2025-68301: net: atlantic: fix fragment overflow handling in RX path (bsc#1255120).\n- CVE-2025-68320: lan966x: Fix sleeping in atomic context (bsc#1255172).\n- CVE-2025-68325: net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (bsc#1255417).\n- CVE-2025-68327: usb: renesas_usbhs: Fix synchronous external abort on unbind (bsc#1255488).\n- CVE-2025-68337: jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (bsc#1255482).\n- CVE-2025-68349: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (bsc#1255544).\n- CVE-2025-68363: bpf: Check skb-\u003etransport_header is set in bpf_skb_check_mtu (bsc#1255552).\n- CVE-2025-68365: fs/ntfs3: Initialize allocated memory before use (bsc#1255548).\n- CVE-2025-68366: nbd: defer config unlock in nbd_genl_connect (bsc#1255622).\n- CVE-2025-68367: macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (bsc#1255547).\n- CVE-2025-68372: nbd: defer config put in recv_work (bsc#1255537).\n- CVE-2025-68379: RDMA/rxe: Fix null deref on srq-\u003erq.queue after resize failure (bsc#1255695).\n- CVE-2025-68727: ntfs3: Fix uninit buffer allocated by __getname() (bsc#1255568).\n- CVE-2025-68728: ntfs3: fix uninit memory after failed mi_read in mi_format_new (bsc#1255539).\n- CVE-2025-68733: smack: fix bug: unprivileged task can create labels (bsc#1255615).\n- CVE-2025-68764: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (bsc#1255930).\n- CVE-2025-68768: inet: frags: add inet_frag_queue_flush() (bsc#1256579).\n- CVE-2025-68770: bnxt_en: Fix XDP_TX path (bsc#1256584).\n- CVE-2025-68771: ocfs2: fix kernel BUG in ocfs2_find_victim_chain (bsc#1256582).\n- CVE-2025-68775: net/handshake: duplicate handshake cancellations leak socket (bsc#1256665).\n- CVE-2025-68776: net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (bsc#1256659).\n- CVE-2025-68788: fsnotify: do not generate ACCESS/MODIFY events on child for special files (bsc#1256638).\n- CVE-2025-68795: ethtool: Avoid overflowing userspace buffer on stats query (bsc#1256688).\n- CVE-2025-68798: perf/x86/amd: Check event before enable to avoid GPF (bsc#1256689).\n- CVE-2025-68800: mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (bsc#1256646).\n- CVE-2025-68801: mlxsw: spectrum_router: Fix neighbour use-after-free (bsc#1256653).\n- CVE-2025-68803: nfsd: set security label during create operations (bsc#1256770).\n- CVE-2025-68813: ipvs: fix ipv4 null-ptr-deref in route error path (bsc#1256641).\n- CVE-2025-68814: io_uring: fix filename leak in __io_openat_prep() (bsc#1256651).\n- CVE-2025-68815: net/sched: ets: Remove drr class from the active list if it changes to strict (bsc#1256680).\n- CVE-2025-68816: net/mlx5: fw_tracer, Validate format string parameters (bsc#1256674).\n- CVE-2025-68820: ext4: xattr: fix null pointer deref in ext4_raw_inode() (bsc#1256754).\n- CVE-2025-71064: net: hns3: using the num_tqps in the vf driver to apply for resources (bsc#1256654).\n- CVE-2025-71066: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (bsc#1256645).\n- CVE-2025-71077: tpm: Cap the number of PCR banks (bsc#1256613).\n- CVE-2025-71080: ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT (bsc#1256608).\n- CVE-2025-71084: RDMA/cm: Fix leaking the multicast GID table reference (bsc#1256622).\n- CVE-2025-71085: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (bsc#1256623).\n- CVE-2025-71087: iavf: fix off-by-one issues in iavf_config_rss_reg() (bsc#1256628).\n- CVE-2025-71088: mptcp: fallback earlier on simult connection (bsc#1256630).\n- CVE-2025-71089: iommu: disable SVA when CONFIG_X86 is set (bsc#1256612).\n- CVE-2025-71091: team: fix check for port enabled in team_queue_override_port_prio_changed() (bsc#1256773).\n- CVE-2025-71093: e1000: fix OOB in e1000_tbi_should_accept() (bsc#1256777).\n- CVE-2025-71094: net: usb: asix: ax88772: Increase phy_name size (bsc#1256597).\n- CVE-2025-71095: net: stmmac: fix the crash issue for zero copy XDP_TX action (bsc#1256605).\n- CVE-2025-71096: RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly (bsc#1256606).\n- CVE-2025-71097: ipv4: Fix reference count leak when using error routes with nexthop objects (bsc#1256607).\n- CVE-2025-71098: ip6_gre: make ip6gre_header() robust (bsc#1256591).\n- CVE-2025-71112: net: hns3: add VLAN id validation before using (bsc#1256726).\n- CVE-2025-71116: libceph: make decode_pool() more resilient against corrupted osdmaps (bsc#1256744).\n- CVE-2025-71120: SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (bsc#1256779).\n- CVE-2025-71123: ext4: fix string copying in parse_apply_sb_mount_options() (bsc#1256757).\n- CVE-2025-71133: RDMA/irdma: avoid invalid read in irdma_net_event (bsc#1256733).\n- CVE-2025-71135: md/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt() (bsc#1256761).\n- CVE-2025-71137: octeontx2-pf: fix 'UBSAN: shift-out-of-bounds error' (bsc#1256760).\n- CVE-2025-71149: io_uring/poll: correctly handle io_poll_add() return value on update (bsc#1257164).\n- CVE-2025-71156: gve: defer interrupt enabling until NAPI registration (bsc#1257167).\n- CVE-2025-71157: RDMA/core: always drop device refcount in ib_del_sub_device_and_put() (bsc#1257168).\n- CVE-2026-22976: net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (bsc#1257035).\n- CVE-2026-22977: net: sock: fix hardened usercopy panic in sock_recv_errqueue (bsc#1257053).\n- CVE-2026-22984: libceph: prevent potential out-of-bounds reads in handle_auth_done() (bsc#1257217).\n- CVE-2026-22990: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (bsc#1257221).\n- CVE-2026-22991: libceph: make free_choose_arg_map() resilient to partial allocation (bsc#1257220).\n- CVE-2026-22992: libceph: return the handler error from mon_handle_auth_done() (bsc#1257218).\n- CVE-2026-22993: idpf: Fix RSS LUT NULL pointer crash on early ethtool operations (bsc#1257180).\n- CVE-2026-22996: net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv.\n- CVE-2026-22999: net/sched: sch_qfq: do not free existing class in qfq_change_class() (bsc#1257236).\n- CVE-2026-23000: net/mlx5e: Fix crash on profile change rollback failure (bsc#1257234).\n- CVE-2026-23001: macvlan: fix possible UAF in macvlan_forward_source() (bsc#1257232).\n- CVE-2026-23005: x86/fpu: Clear XSTATE_BV in guest XSAVE state whenever XFD[i]=1 (bsc#1257245).\n- CVE-2026-23011: ipv4: ip_gre: make ipgre_header() robust (bsc#1257207).\n\nThe following non security issues were fixed:\n\n- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (stable-fixes).\n- ALSA: scarlett2: Fix buffer overflow in config retrieval (git-fixes).\n- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (git-fixes).\n- ALSA: usb-audio: Update for native DSD support quirks (stable-fixes).\n- ALSA: usb: Increase volume range that triggers a warning (git-fixes).\n- ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 (stable-fixes).\n- ASoC: codecs: wsa881x: Drop unused version readout (stable-fixes).\n- ASoC: codecs: wsa881x: fix unnecessary initialisation (git-fixes).\n- ASoC: codecs: wsa883x: fix unnecessary initialisation (git-fixes).\n- ASoC: codecs: wsa884x: fix codec initialisation (git-fixes).\n- ASoC: fsl_sai: Add missing registers to cache default (stable-fixes).\n- ASoC: fsl: imx-card: Do not force slot width to sample width (git-fixes).\n- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (git-fixes).\n- ASoC: tlv320adcx140: fix null pointer (git-fixes).\n- ASoC: tlv320adcx140: fix word length (git-fixes).\n- ata: libata: Add cpr_log to ata_dev_print_features() early return (git-fixes).\n- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (git-fixes).\n- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (git-fixes).\n- bpf: Do not let BPF test infra emit invalid GSO types to stack (bsc#1255569).\n- bpf/selftests: test_select_reuseport_kern: Remove unused header (bsc#1257603).\n- bs-upload-kernel: Fix cve branch uploads.\n- btrfs: do not strictly require dirty metadata threshold for metadata writepages (stable-fixes).\n- can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit (git-fixes).\n- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (git-fixes).\n- can: etas_es58x: allow partial RX URB allocation to succeed (git-fixes).\n- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (git-fixes).\n- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (git-fixes).\n- can: j1939: make j1939_session_activate() fail if device is no longer registered (stable-fixes).\n- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (git-fixes).\n- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (git-fixes).\n- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (git-fixes).\n- cifs: add new field to track the last access time of cfid (git-fixes).\n- cifs: after disabling multichannel, mark tcon for reconnect (git-fixes).\n- cifs: avoid redundant calls to disable multichannel (git-fixes).\n- cifs: cifs_pick_channel should try selecting active channels (git-fixes).\n- cifs: deal with the channel loading lag while picking channels (git-fixes).\n- cifs: dns resolution is needed only for primary channel (git-fixes).\n- cifs: do not disable interface polling on failure (git-fixes).\n- cifs: do not search for channel if server is terminating (git-fixes).\n- cifs: fix a pending undercount of srv_count (git-fixes).\n- cifs: Fix copy offload to flush destination region (bsc#1252511).\n- cifs: Fix flushing, invalidation and file size with copy_file_range() (bsc#1252511).\n- cifs: fix lock ordering while disabling multichannel (git-fixes).\n- cifs: fix stray unlock in cifs_chan_skip_or_disable (git-fixes).\n- cifs: fix use after free for iface while disabling secondary channels (git-fixes).\n- cifs: handle servers that still advertise multichannel after disabling (git-fixes).\n- cifs: handle when server starts supporting multichannel (git-fixes).\n- cifs: handle when server stops supporting multichannel (git-fixes).\n- cifs: make cifs_chan_update_iface() a void function (git-fixes).\n- cifs: make sure server interfaces are requested only for SMB3+ (git-fixes).\n- cifs: make sure that channel scaling is done only once (git-fixes).\n- cifs: reconnect worker should take reference on server struct unconditionally (git-fixes).\n- cifs: reset connections for all channels when reconnect requested (git-fixes).\n- cifs: reset iface weights when we cannot find a candidate (git-fixes).\n- cifs: serialize other channels when query server interfaces is pending (git-fixes).\n- cifs: update dstaddr whenever channel iface is updated (git-fixes).\n- comedi: dmm32at: serialize use of paged registers (git-fixes).\n- comedi: fix divide-by-zero in comedi_buf_munge() (stable-fixes).\n- comedi: Fix getting range information for subdevices 16 to 255 (git-fixes).\n- cpuset: fix warning when disabling remote partition (bsc#1256794).\n- crypto: authencesn - reject too-short AAD (assoclen\u003c8) to match ESP/ESN spec (git-fixes).\n- dmaengine: apple-admac: Add 'apple,t8103-admac' compatible (git-fixes).\n- dmaengine: at_hdmac: fix device leak on of_dma_xlate() (git-fixes).\n- dmaengine: bcm-sba-raid: fix device leak on probe (git-fixes).\n- dmaengine: dw: dmamux: fix OF node leak on route allocation failure (git-fixes).\n- dmaengine: idxd: fix device leaks on compat bind and unbind (git-fixes).\n- dmaengine: lpc18xx-dmamux: fix device leak on route allocation (git-fixes).\n- dmaengine: omap-dma: fix dma_pool resource leak in error paths (git-fixes).\n- dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (git-fixes).\n- dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() (git-fixes).\n- dmaengine: tegra-adma: Fix use-after-free (git-fixes).\n- dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (git-fixes).\n- dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation (git-fixes).\n- dmaengine: ti: k3-udma: fix device leak on udma lookup (git-fixes).\n- dmaengine: xilinx_dma: Fix uninitialized addr_width when 'xlnx,addrwidth' property is missing (git-fixes).\n- dmaengine: xilinx: xdma: Fix regmap max_register (git-fixes).\n- dpll: fix device-id-get and pin-id-get to return errors properly (git-fixes).\n- dpll: fix return value check for kmemdup (git-fixes).\n- dpll: indent DPLL option type by a tab (git-fixes).\n- dpll: Prevent duplicate registrations (git-fixes).\n- dpll: spec: add missing module-name and clock-id to pin-get reply (git-fixes).\n- drm/amd: Clean up kfd node on surprise disconnect (stable-fixes).\n- drm/amd/display: Apply e4479aecf658 to dml (stable-fixes).\n- drm/amd/display: Bump the HDMI clock to 340MHz (stable-fixes).\n- drm/amd/display: Fix DP no audio issue (stable-fixes).\n- drm/amd/display: Initialise backlight level values from hw (git-fixes).\n- drm/amd/display: Respect user's CONFIG_FRAME_WARN more for dml files (stable-fixes).\n- drm/amd/display: shrink struct members (stable-fixes).\n- drm/amd/pm: Don't clear SI SMC table when setting power limit (git-fixes).\n- drm/amd/pm: fix race in power state check before mutex lock (git-fixes).\n- drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2 (git-fixes).\n- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (git-fixes).\n- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (git-fixes).\n- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (git-fixes).\n- drm/amdgpu: Fix query for VPE block_type and ip_count (stable-fixes).\n- drm/amdgpu: remove frame cntl for gfx v12 (stable-fixes).\n- drm/amdkfd: fix a memory leak in device_queue_manager_init() (git-fixes).\n- drm/amdkfd: Fix improper NULL termination of queue restore SMI event string (stable-fixes).\n- drm/imagination: Wait for FW trace update command completion (git-fixes).\n- drm/imx/tve: fix probe device leak (git-fixes).\n- drm/msm/a6xx: fix bogus hwcg register updates (git-fixes).\n- drm/nouveau: add missing DCB connector types (git-fixes).\n- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (git-fixes).\n- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (stable-fixes).\n- drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare (git-fixes).\n- drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (git-fixes).\n- drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] (stable-fixes).\n- drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() (git-fixes).\n- drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions (git-fixes).\n- exfat: check return value of sb_min_blocksize in exfat_read_boot_sector (git-fixes).\n- exfat: fix remount failure in different process environments (git-fixes).\n- gpio: omap: do not register driver in probe() (git-fixes).\n- gpio: pca953x: Add support for level-triggered interrupts (stable-fixes).\n- gpio: pca953x: fix wrong error probe return value (git-fixes).\n- gpio: pca953x: handle short interrupt pulses on PCAL devices (git-fixes).\n- gpio: pca953x: Utilise dev_err_probe() where it makes sense (stable-fixes).\n- gpio: pca953x: Utilise temporary variable for struct device (stable-fixes).\n- gpio: rockchip: Stop calling pinctrl for set_direction (git-fixes).\n- HID: usbhid: paper over wrong bNumDescriptor field (stable-fixes).\n- ice: use netif_get_num_default_rss_queues() (bsc#1247712).\n- iio: accel: iis328dq: fix gain values (git-fixes).\n- iio: adc: ad7280a: handle spi_setup() errors in probe() (git-fixes).\n- iio: adc: ad9467: fix ad9434 vref mask (git-fixes).\n- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (git-fixes).\n- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (git-fixes).\n- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (git-fixes).\n- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (stable-fixes).\n- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (stable-fixes).\n- intel_th: fix device leak on output open() (git-fixes).\n- leds: led-class: Only Add LED to leds_list when it is fully ready (git-fixes).\n- lib/crypto: aes: Fix missing MMU protection for AES S-box (git-fixes).\n- mei: me: add nova lake point S DID (stable-fixes).\n- mei: me: add wildcat lake P DID (stable-fixes).\n- mISDN: annotate data-race around dev-\u003ework (git-fixes).\n- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (bsc#1253087).\n- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (git-fixes).\n- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (git-fixes).\n- net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts (git-fixes).\n- net: hv_netvsc: reject RSS hash key programming without RX indirection table (bsc#1257473).\n- net: mana: Add metadata support for xdp mode (git-fixes).\n- net: mana: Add standard counter rx_missed_errors (git-fixes).\n- net: mana: Add support for auxiliary device servicing events (git-fixes).\n- net: mana: Change the function signature of mana_get_primary_netdev_rcu (bsc#1256690).\n- net: mana: Drop TX skb on post_work_request failure and unmap resources (git-fixes).\n- net: mana: fix spelling for mana_gd_deregiser_irq() (git-fixes).\n- net: mana: Fix use-after-free in reset service rescan path (git-fixes).\n- net: mana: Fix warnings for missing export.h header inclusion (git-fixes).\n- net: mana: Handle hardware recovery events when probing the device (git-fixes).\n- net: mana: Handle Reset Request from MANA NIC (git-fixes).\n- net: mana: Handle SKB if TX SGEs exceed hardware limit (git-fixes).\n- net: mana: Handle unsupported HWC commands (git-fixes).\n- net: mana: Move hardware counter stats from per-port to per-VF context (git-fixes).\n- net: mana: Probe rdma device in mana driver (git-fixes).\n- net: mana: Reduce waiting time if HWC not responding (git-fixes).\n- net: tcp: allow zero-window ACK update the window (bsc#1254767).\n- net: usb: dm9601: remove broken SR9700 support (git-fixes).\n- net: wwan: t7xx: fix potential skb-\u003efrags overflow in RX path (git-fixes).\n- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame() (git-fixes).\n- nfc: nci: Fix race between rfkill and nci_unregister_device() (git-fixes).\n- NFS: Fix up the automount fs_context to use the correct cred (git-fixes).\n- nfsd: Drop the client reference in client_states_open() (git-fixes).\n- NFSD: Fix permission check for read access to executable-only files (git-fixes).\n- NFSD: use correct reservation type in nfsd4_scsi_fence_client (git-fixes).\n- NFSD/blocklayout: Fix minlength check in proc_layoutget (git-fixes).\n- NFSv4: ensure the open stateid seqid doesn't go backwards (git-fixes).\n- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (git-fixes).\n- nvmet-auth: update sc_c in host response (git-fixes).\n- nvmet-auth: update sc_c in target host hash calculation (git-fixes).\n- of: fix reference count leak in of_alias_scan() (git-fixes).\n- of: platform: Use default match table for /firmware (git-fixes).\n- phy: freescale: imx8m-pcie: assert phy reset during power on (stable-fixes).\n- phy: rockchip: inno-usb2: fix communication disruption in gadget mode (git-fixes).\n- phy: rockchip: inno-usb2: fix disconnection in gadget mode (git-fixes).\n- phy: stm32-usphyc: Fix off by one in probe() (git-fixes).\n- phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 (git-fixes).\n- platform/x86: hp-bioscfg: Fix automatic module loading (git-fixes).\n- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (git-fixes).\n- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (git-fixes).\n- platform/x86/amd: Fix memory leak in wbrf_record() (git-fixes).\n- pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (git-fixes).\n- powercap: fix race condition in register_control_type() (stable-fixes).\n- powercap: fix sscanf() error return value handling (stable-fixes).\n- powerpc/addnote: Fix overflow on 32-bit builds (bsc#1215199).\n- RDMA/mana_ib: Access remote atomic for MRs (git-fixes).\n- RDMA/mana_ib: add additional port counters (git-fixes).\n- RDMA/mana_ib: Add device statistics support (git-fixes).\n- RDMA/mana_ib: Add port statistics support (git-fixes).\n- RDMA/mana_ib: Add support of 4M, 1G, and 2G pages (git-fixes).\n- RDMA/mana_ib: Add support of mana_ib for RNIC and ETH nic (git-fixes).\n- RDMA/mana_ib: add support of multiple ports (git-fixes).\n- RDMA/mana_ib: Allow registration of DMA-mapped memory in PDs (git-fixes).\n- RDMA/mana_ib: check cqe length for kernel CQs (git-fixes).\n- RDMA/mana_ib: Create and destroy UD/GSI QP (git-fixes).\n- RDMA/mana_ib: create kernel-level CQs (git-fixes).\n- RDMA/mana_ib: create/destroy AH (git-fixes).\n- RDMA/mana_ib: Drain send wrs of GSI QP (git-fixes).\n- RDMA/mana_ib: extend mana QP table (git-fixes).\n- RDMA/mana_ib: Extend modify QP (git-fixes).\n- RDMA/mana_ib: Fix error code in probe() (git-fixes).\n- RDMA/mana_ib: Fix integer overflow during queue creation (git-fixes).\n- RDMA/mana_ib: Handle net event for pointing to the current netdev (bsc#1256690).\n- RDMA/mana_ib: helpers to allocate kernel queues (git-fixes).\n- RDMA/mana_ib: Implement DMABUF MR support (git-fixes).\n- RDMA/mana_ib: implement get_dma_mr (git-fixes).\n- RDMA/mana_ib: implement req_notify_cq (git-fixes).\n- RDMA/mana_ib: indicate CM support (git-fixes).\n- RDMA/mana_ib: polling of CQs for GSI/UD (git-fixes).\n- RDMA/mana_ib: Query feature_flags bitmask from FW (git-fixes).\n- RDMA/mana_ib: request error CQEs when supported (git-fixes).\n- RDMA/mana_ib: support of the zero based MRs (git-fixes).\n- RDMA/mana_ib: UD/GSI QP creation for kernel (git-fixes).\n- RDMA/mana_ib: UD/GSI work requests (git-fixes).\n- RDMA/mana_ib: unify mana_ib functions to support any gdma device (git-fixes).\n- RDMA/mana_ib: Use safer allocation function() (git-fixes).\n- regmap: Fix race condition in hwspinlock irqsave routine (git-fixes).\n- sched: Increase sched_tick_remote timeout (bsc#1254510).\n- sched/rt: Skip group schedulable check with rt_group_sched=0 (bsc#1256568).\n- scripts: obsapi: Support URL trailing / in oscrc.\n- scripts: teaapi: Add paging.\n- scripts: uploader: Fix no change condition for _maintainership.json.\n- scripts: uploader: Handle missing upstream in is_pr_open.\n- scripts/python/git_sort/git_sort.yaml: add cifs for-next repository.\n- scrits: teaapi: Add list_repos.\n- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (bsc#1256861).\n- scsi: lpfc: Update lpfc version to 14.4.0.13 (bsc#1256861).\n- scsi: qla2xxx: Add bsg interface to support firmware img validation (bsc#1256863).\n- scsi: qla2xxx: Add load flash firmware mailbox support for 28xxx (bsc#1256863).\n- scsi: qla2xxx: Add Speed in SFP print information (bsc#1256863).\n- scsi: qla2xxx: Add support for 64G SFP speed (bsc#1256863).\n- scsi: qla2xxx: Allow recovery for tape devices (bsc#1256863).\n- scsi: qla2xxx: Delay module unload while fabric scan in progress (bsc#1256863).\n- scsi: qla2xxx: Fix bsg_done() causing double free (bsc#1256863).\n- scsi: qla2xxx: Free sp in error path to fix system crash (bsc#1256863).\n- scsi: qla2xxx: Query FW again before proceeding with login (bsc#1256863).\n- scsi: qla2xxx: Update version to 10.02.10.100-k (bsc#1256863).\n- scsi: qla2xxx: Validate MCU signature before executing MBC 03h (bsc#1256863).\n- scsi: qla2xxx: Validate sp before freeing associated memory (bsc#1256863).\n- scsi: storvsc: Process unsupported MODE_SENSE_10 (bsc#1257296).\n- selftests: net: fib-onlink-tests: Convert to use namespaces by default (bsc#1255346).\n- selftests/bpf: Fix flaky bpf_cookie selftest (git-fixes).\n- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (git-fixes).\n- slimbus: core: fix device reference leak on report present (git-fixes).\n- slimbus: core: fix OF node leak on registration failure (git-fixes).\n- slimbus: core: fix of_slim_get_device() kernel doc (git-fixes).\n- slimbus: core: fix runtime PM imbalance on report present (git-fixes).\n- smb: change return type of cached_dir_lease_break() to bool (git-fixes).\n- smb: client: ensure open_cached_dir_by_dentry() only returns valid cfid (git-fixes).\n- smb: client: fix cifs_pick_channel when channel needs reconnect (git-fixes).\n- smb: client: fix warning when reconnecting channel (git-fixes).\n- smb: client: introduce close_cached_dir_locked() (git-fixes).\n- smb: client: remove unused fid_lock (git-fixes).\n- smb: client: short-circuit in open_cached_dir_by_dentry() if !dentry (git-fixes).\n- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (bsc#1250748).\n- smb: client: update cfid-\u003elast_access_time in open_cached_dir_by_dentry() (git-fixes).\n- smb: improve directory cache reuse for readdir operations (bsc#1252712).\n- smb3: add missing null server pointer check (git-fixes).\n- spi: spi-sprd-adi: Fix double free in probe error path (git-fixes).\n- spi: sprd-adi: switch to use spi_alloc_host() (stable-fixes).\n- spi: sprd: adi: Use devm_register_restart_handler() (stable-fixes).\n- svcrdma: return 0 on success from svc_rdma_copy_inline_range (git-fixes).\n- uacce: ensure safe queue release with state management (git-fixes).\n- uacce: fix cdev handling in the cleanup path (git-fixes).\n- uacce: fix isolate sysfs check condition (git-fixes).\n- uacce: implement mremap in uacce_vm_ops to return -EPERM (git-fixes).\n- usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor (stable-fixes).\n- usb: dwc3: Check for USB4 IP_NAME (stable-fixes).\n- USB: OHCI/UHCI: Add soft dependencies on ehci_platform (stable-fixes).\n- USB: serial: ftdi_sio: add support for PICAXE AXE027 cable (stable-fixes).\n- USB: serial: option: add Telit LE910 MBIM composition (stable-fixes).\n- usbnet: limit max_mtu based on device's hard_mtu (git-fixes).\n- w1: fix redundant counter decrement in w1_attach_slave_device() (git-fixes).\n- w1: therm: Fix off-by-one buffer overflow in alarms_store (git-fixes).\n- wifi: ath10k: fix dma_free_coherent() pointer (git-fixes).\n- wifi: ath12k: fix dma_free_coherent() pointer (git-fixes).\n- wifi: mac80211: correctly decode TTLM with default link map (git-fixes).\n- wifi: mac80211: don't perform DA check on S1G beacon (git-fixes).\n- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (git-fixes).\n- wifi: rsi: Fix memory corruption due to not set vif driver data size (git-fixes).\n- x86: make page fault handling disable interrupts properly (git-fixes).\n- x86/microcode: Fix Entrysign revision check for Zen1/Naples (bsc#1256528).\n- x86/microcode/AMD: Add more known models to entry sign checking (bsc#1256528).\n- x86/microcode/AMD: Add some forgotten models to the SHA check (bsc#1256528).\n- x86/microcode/AMD: Add TSA microcode SHAs (bsc#1256528).\n- x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (bsc#1256528).\n- x86/microcode/AMD: Clean the cache if update did not load microcode (bsc#1256528).\n- x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (bsc#1256528).\n- x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (bsc#1256528).\n- x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (bsc#1256528).\n- x86/microcode/AMD: Limit Entrysign signature checking to known generations (bsc#1256528).\n- x86/microcode/AMD: Load only SHA256-checksummed patches (bsc#1256528).\n- x86/microcode/AMD: Use sha256() instead of init/update/final (bsc#1256528).\n","status":"published","published":"2026-02-11T14:05:07Z","modified":"2026-03-23T04:52:15.717412Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0472-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP7 Azure kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2023-54013: interconnect: Fix locking for runpm vs reclaim (bsc#1256280).\n- CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).\n- CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).\n- CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).\n- CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).\n- CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).\n- CVE-2025-40261: nvme: nvme-fc: Ensure -\u003eioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).\n- CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).\n- CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid() (bsc#1254624).\n- CVE-2025-40350: net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (bsc#1255260).\n- CVE-2025-40355: sysfs: check visibility before changing group attribute ownership (bsc#1255261).\n- CVE-2025-40363: net: ipv6: fix field-spanning memcpy warning in AH output (bsc#1255102).\n- CVE-2025-68171: x86/fpu: Ensure XFD state on signal delivery (bsc#1255255).\n- CVE-2025-68174: amd/amdkfd: enhance kfd process check in switch partition (bsc#1255327).\n- CVE-2025-68178: blk-cgroup: fix possible deadlock while configuring policy (bsc#1255266).\n- CVE-2025-68188: tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (bsc#1255269).\n- CVE-2025-68200: bpf: Add bpf_prog_run_data_pointers() (bsc#1255241).\n- CVE-2025-68215: ice: fix PTP cleanup on driver removal in error path (bsc#1255226).\n- CVE-2025-68227: mptcp: Fix proto fallback detection with BPF (bsc#1255216).\n- CVE-2025-68241: ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (bsc#1255157).\n- CVE-2025-68245: net: netpoll: fix incorrect refcount handling causing incorrect cleanup (bsc#1255268).\n- CVE-2025-68261: ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (bsc#1255164).\n- CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (bsc#1255377).\n- CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255401).\n- CVE-2025-68296: drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (bsc#1255128).\n- CVE-2025-68297: ceph: fix crash in process_v2_sparse_read() for encrypted directories (bsc#1255403).\n- CVE-2025-68301: net: atlantic: fix fragment overflow handling in RX path (bsc#1255120).\n- CVE-2025-68320: lan966x: Fix sleeping in atomic context (bsc#1255172).\n- CVE-2025-68325: net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (bsc#1255417).\n- CVE-2025-68327: usb: renesas_usbhs: Fix synchronous external abort on unbind (bsc#1255488).\n- CVE-2025-68337: jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (bsc#1255482).\n- CVE-2025-68349: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (bsc#1255544).\n- CVE-2025-68363: bpf: Check skb-\u003etransport_header is set in bpf_skb_check_mtu (bsc#1255552).\n- CVE-2025-68365: fs/ntfs3: Initialize allocated memory before use (bsc#1255548).\n- CVE-2025-68366: nbd: defer config unlock in nbd_genl_connect (bsc#1255622).\n- CVE-2025-68367: macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (bsc#1255547).\n- CVE-2025-68372: nbd: defer config put in recv_work (bsc#1255537).\n- CVE-2025-68379: RDMA/rxe: Fix null deref on srq-\u003erq.queue after resize failure (bsc#1255695).\n- CVE-2025-68727: ntfs3: Fix uninit buffer allocated by __getname() (bsc#1255568).\n- CVE-2025-68728: ntfs3: fix uninit memory after failed mi_read in mi_format_new (bsc#1255539).\n- CVE-2025-68733: smack: fix bug: unprivileged task can create labels (bsc#1255615).\n- CVE-2025-68764: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (bsc#1255930).\n- CVE-2025-68768: inet: frags: add inet_frag_queue_flush() (bsc#1256579).\n- CVE-2025-68770: bnxt_en: Fix XDP_TX path (bsc#1256584).\n- CVE-2025-68771: ocfs2: fix kernel BUG in ocfs2_find_victim_chain (bsc#1256582).\n- CVE-2025-68775: net/handshake: duplicate handshake cancellations leak socket (bsc#1256665).\n- CVE-2025-68776: net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (bsc#1256659).\n- CVE-2025-68788: fsnotify: do not generate ACCESS/MODIFY events on child for special files (bsc#1256638).\n- CVE-2025-68795: ethtool: Avoid overflowing userspace buffer on stats query (bsc#1256688).\n- CVE-2025-68798: perf/x86/amd: Check event before enable to avoid GPF (bsc#1256689).\n- CVE-2025-68800: mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (bsc#1256646).\n- CVE-2025-68801: mlxsw: spectrum_router: Fix neighbour use-after-free (bsc#1256653).\n- CVE-2025-68803: nfsd: set security label during create operations (bsc#1256770).\n- CVE-2025-68813: ipvs: fix ipv4 null-ptr-deref in route error path (bsc#1256641).\n- CVE-2025-68814: io_uring: fix filename leak in __io_openat_prep() (bsc#1256651).\n- CVE-2025-68815: net/sched: ets: Remove drr class from the active list if it changes to strict (bsc#1256680).\n- CVE-2025-68816: net/mlx5: fw_tracer, Validate format string parameters (bsc#1256674).\n- CVE-2025-68820: ext4: xattr: fix null pointer deref in ext4_raw_inode() (bsc#1256754).\n- CVE-2025-71064: net: hns3: using the num_tqps in the vf driver to apply for resources (bsc#1256654).\n- CVE-2025-71066: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (bsc#1256645).\n- CVE-2025-71077: tpm: Cap the number of PCR banks (bsc#1256613).\n- CVE-2025-71080: ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT (bsc#1256608).\n- CVE-2025-71084: RDMA/cm: Fix leaking the multicast GID table reference (bsc#1256622).\n- CVE-2025-71085: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (bsc#1256623).\n- CVE-2025-71087: iavf: fix off-by-one issues in iavf_config_rss_reg() (bsc#1256628).\n- CVE-2025-71088: mptcp: fallback earlier on simult connection (bsc#1256630).\n- CVE-2025-71089: iommu: disable SVA when CONFIG_X86 is set (bsc#1256612).\n- CVE-2025-71091: team: fix check for port enabled in team_queue_override_port_prio_changed() (bsc#1256773).\n- CVE-2025-71093: e1000: fix OOB in e1000_tbi_should_accept() (bsc#1256777).\n- CVE-2025-71094: net: usb: asix: ax88772: Increase phy_name size (bsc#1256597).\n- CVE-2025-71095: net: stmmac: fix the crash issue for zero copy XDP_TX action (bsc#1256605).\n- CVE-2025-71096: RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly (bsc#1256606).\n- CVE-2025-71097: ipv4: Fix reference count leak when using error routes with nexthop objects (bsc#1256607).\n- CVE-2025-71098: ip6_gre: make ip6gre_header() robust (bsc#1256591).\n- CVE-2025-71112: net: hns3: add VLAN id validation before using (bsc#1256726).\n- CVE-2025-71116: libceph: make decode_pool() more resilient against corrupted osdmaps (bsc#1256744).\n- CVE-2025-71120: SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (bsc#1256779).\n- CVE-2025-71123: ext4: fix string copying in parse_apply_sb_mount_options() (bsc#1256757).\n- CVE-2025-71133: RDMA/irdma: avoid invalid read in irdma_net_event (bsc#1256733).\n- CVE-2025-71135: md/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt() (bsc#1256761).\n- CVE-2025-71137: octeontx2-pf: fix 'UBSAN: shift-out-of-bounds error' (bsc#1256760).\n- CVE-2025-71149: io_uring/poll: correctly handle io_poll_add() return value on update (bsc#1257164).\n- CVE-2025-71156: gve: defer interrupt enabling until NAPI registration (bsc#1257167).\n- CVE-2025-71157: RDMA/core: always drop device refcount in ib_del_sub_device_and_put() (bsc#1257168).\n- CVE-2026-22976: net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (bsc#1257035).\n- CVE-2026-22977: net: sock: fix hardened usercopy panic in sock_recv_errqueue (bsc#1257053).\n- CVE-2026-22984: libceph: prevent potential out-of-bounds reads in handle_auth_done() (bsc#1257217).\n- CVE-2026-22990: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (bsc#1257221).\n- CVE-2026-22991: libceph: make free_choose_arg_map() resilient to partial allocation (bsc#1257220).\n- CVE-2026-22992: libceph: return the handler error from mon_handle_auth_done() (bsc#1257218).\n- CVE-2026-22993: idpf: Fix RSS LUT NULL pointer crash on early ethtool operations (bsc#1257180).\n- CVE-2026-22996: net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv.\n- CVE-2026-22999: net/sched: sch_qfq: do not free existing class in qfq_change_class() (bsc#1257236).\n- CVE-2026-23000: net/mlx5e: Fix crash on profile change rollback failure (bsc#1257234).\n- CVE-2026-23001: macvlan: fix possible UAF in macvlan_forward_source() (bsc#1257232).\n- CVE-2026-23005: x86/fpu: Clear XSTATE_BV in guest XSAVE state whenever XFD[i]=1 (bsc#1257245).\n- CVE-2026-23010: ipv6: Fix use-after-free in inet6_addr_del() (bsc#1257332).\n- CVE-2026-23011: ipv4: ip_gre: make ipgre_header() robust (bsc#1257207).\n\nThe following non security issues were fixed:\n\n- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (stable-fixes).\n- ALSA: scarlett2: Fix buffer overflow in config retrieval (git-fixes).\n- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (git-fixes).\n- ALSA: usb-audio: Update for native DSD support quirks (stable-fixes).\n- ALSA: usb: Increase volume range that triggers a warning (git-fixes).\n- ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 (stable-fixes).\n- ASoC: codecs: wsa881x: Drop unused version readout (stable-fixes).\n- ASoC: codecs: wsa881x: fix unnecessary initialisation (git-fixes).\n- ASoC: codecs: wsa883x: fix unnecessary initialisation (git-fixes).\n- ASoC: codecs: wsa884x: fix codec initialisation (git-fixes).\n- ASoC: fsl_sai: Add missing registers to cache default (stable-fixes).\n- ASoC: fsl: imx-card: Do not force slot width to sample width (git-fixes).\n- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (git-fixes).\n- ASoC: tlv320adcx140: fix null pointer (git-fixes).\n- ASoC: tlv320adcx140: fix word length (git-fixes).\n- ata: libata: Add cpr_log to ata_dev_print_features() early return (git-fixes).\n- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (git-fixes).\n- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (git-fixes).\n- bpf: Do not let BPF test infra emit invalid GSO types to stack (bsc#1255569).\n- bpf/selftests: test_select_reuseport_kern: Remove unused header (bsc#1257603).\n- bs-upload-kernel: Fix cve branch uploads.\n- btrfs: do not strictly require dirty metadata threshold for metadata writepages (stable-fixes).\n- can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit (git-fixes).\n- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (git-fixes).\n- can: etas_es58x: allow partial RX URB allocation to succeed (git-fixes).\n- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (git-fixes).\n- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (git-fixes).\n- can: j1939: make j1939_session_activate() fail if device is no longer registered (stable-fixes).\n- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (git-fixes).\n- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (git-fixes).\n- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (git-fixes).\n- cifs: add new field to track the last access time of cfid (git-fixes).\n- cifs: after disabling multichannel, mark tcon for reconnect (git-fixes).\n- cifs: avoid redundant calls to disable multichannel (git-fixes).\n- cifs: cifs_pick_channel should try selecting active channels (git-fixes).\n- cifs: deal with the channel loading lag while picking channels (git-fixes).\n- cifs: dns resolution is needed only for primary channel (git-fixes).\n- cifs: do not disable interface polling on failure (git-fixes).\n- cifs: do not search for channel if server is terminating (git-fixes).\n- cifs: fix a pending undercount of srv_count (git-fixes).\n- cifs: Fix copy offload to flush destination region (bsc#1252511).\n- cifs: Fix flushing, invalidation and file size with copy_file_range() (bsc#1252511).\n- cifs: fix lock ordering while disabling multichannel (git-fixes).\n- cifs: fix stray unlock in cifs_chan_skip_or_disable (git-fixes).\n- cifs: fix use after free for iface while disabling secondary channels (git-fixes).\n- cifs: handle servers that still advertise multichannel after disabling (git-fixes).\n- cifs: handle when server starts supporting multichannel (git-fixes).\n- cifs: handle when server stops supporting multichannel (git-fixes).\n- cifs: make cifs_chan_update_iface() a void function (git-fixes).\n- cifs: make sure server interfaces are requested only for SMB3+ (git-fixes).\n- cifs: make sure that channel scaling is done only once (git-fixes).\n- cifs: reconnect worker should take reference on server struct unconditionally (git-fixes).\n- cifs: reset connections for all channels when reconnect requested (git-fixes).\n- cifs: reset iface weights when we cannot find a candidate (git-fixes).\n- cifs: serialize other channels when query server interfaces is pending (git-fixes).\n- cifs: update dstaddr whenever channel iface is updated (git-fixes).\n- comedi: dmm32at: serialize use of paged registers (git-fixes).\n- comedi: fix divide-by-zero in comedi_buf_munge() (stable-fixes).\n- comedi: Fix getting range information for subdevices 16 to 255 (git-fixes).\n- cpuset: fix warning when disabling remote partition (bsc#1256794).\n- crypto: authencesn - reject too-short AAD (assoclen\u003c8) to match ESP/ESN spec (git-fixes).\n- dmaengine: apple-admac: Add 'apple,t8103-admac' compatible (git-fixes).\n- dmaengine: at_hdmac: fix device leak on of_dma_xlate() (git-fixes).\n- dmaengine: bcm-sba-raid: fix device leak on probe (git-fixes).\n- dmaengine: dw: dmamux: fix OF node leak on route allocation failure (git-fixes).\n- dmaengine: idxd: fix device leaks on compat bind and unbind (git-fixes).\n- dmaengine: lpc18xx-dmamux: fix device leak on route allocation (git-fixes).\n- dmaengine: omap-dma: fix dma_pool resource leak in error paths (git-fixes).\n- dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (git-fixes).\n- dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() (git-fixes).\n- dmaengine: tegra-adma: Fix use-after-free (git-fixes).\n- dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (git-fixes).\n- dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation (git-fixes).\n- dmaengine: ti: k3-udma: fix device leak on udma lookup (git-fixes).\n- dmaengine: xilinx_dma: Fix uninitialized addr_width when 'xlnx,addrwidth' property is missing (git-fixes).\n- dmaengine: xilinx: xdma: Fix regmap max_register (git-fixes).\n- dpll: fix device-id-get and pin-id-get to return errors properly (git-fixes).\n- dpll: fix return value check for kmemdup (git-fixes).\n- dpll: indent DPLL option type by a tab (git-fixes).\n- dpll: Prevent duplicate registrations (git-fixes).\n- dpll: spec: add missing module-name and clock-id to pin-get reply (git-fixes).\n- drm/amd: Clean up kfd node on surprise disconnect (stable-fixes).\n- drm/amd/display: Apply e4479aecf658 to dml (stable-fixes).\n- drm/amd/display: Bump the HDMI clock to 340MHz (stable-fixes).\n- drm/amd/display: Fix DP no audio issue (stable-fixes).\n- drm/amd/display: Initialise backlight level values from hw (git-fixes).\n- drm/amd/display: Respect user's CONFIG_FRAME_WARN more for dml files (stable-fixes).\n- drm/amd/display: shrink struct members (stable-fixes).\n- drm/amd/pm: Don't clear SI SMC table when setting power limit (git-fixes).\n- drm/amd/pm: fix race in power state check before mutex lock (git-fixes).\n- drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2 (git-fixes).\n- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (git-fixes).\n- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (git-fixes).\n- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (git-fixes).\n- drm/amdgpu: Fix query for VPE block_type and ip_count (stable-fixes).\n- drm/amdgpu: remove frame cntl for gfx v12 (stable-fixes).\n- drm/amdkfd: fix a memory leak in device_queue_manager_init() (git-fixes).\n- drm/amdkfd: Fix improper NULL termination of queue restore SMI event string (stable-fixes).\n- drm/imagination: Wait for FW trace update command completion (git-fixes).\n- drm/imx/tve: fix probe device leak (git-fixes).\n- drm/msm/a6xx: fix bogus hwcg register updates (git-fixes).\n- drm/nouveau: add missing DCB connector types (git-fixes).\n- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (git-fixes).\n- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (stable-fixes).\n- drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare (git-fixes).\n- drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (git-fixes).\n- drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] (stable-fixes).\n- drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() (git-fixes).\n- drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions (git-fixes).\n- exfat: check return value of sb_min_blocksize in exfat_read_boot_sector (git-fixes).\n- exfat: fix remount failure in different process environments (git-fixes).\n- gpio: omap: do not register driver in probe() (git-fixes).\n- gpio: pca953x: Add support for level-triggered interrupts (stable-fixes).\n- gpio: pca953x: fix wrong error probe return value (git-fixes).\n- gpio: pca953x: handle short interrupt pulses on PCAL devices (git-fixes).\n- gpio: pca953x: Utilise dev_err_probe() where it makes sense (stable-fixes).\n- gpio: pca953x: Utilise temporary variable for struct device (stable-fixes).\n- gpio: rockchip: Stop calling pinctrl for set_direction (git-fixes).\n- HID: usbhid: paper over wrong bNumDescriptor field (stable-fixes).\n- ice: use netif_get_num_default_rss_queues() (bsc#1247712).\n- iio: accel: iis328dq: fix gain values (git-fixes).\n- iio: adc: ad7280a: handle spi_setup() errors in probe() (git-fixes).\n- iio: adc: ad9467: fix ad9434 vref mask (git-fixes).\n- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (git-fixes).\n- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (git-fixes).\n- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (git-fixes).\n- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (stable-fixes).\n- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (stable-fixes).\n- intel_th: fix device leak on output open() (git-fixes).\n- leds: led-class: Only Add LED to leds_list when it is fully ready (git-fixes).\n- lib/crypto: aes: Fix missing MMU protection for AES S-box (git-fixes).\n- mei: me: add nova lake point S DID (stable-fixes).\n- mei: me: add wildcat lake P DID (stable-fixes).\n- mISDN: annotate data-race around dev-\u003ework (git-fixes).\n- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (bsc#1253087).\n- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (git-fixes).\n- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (git-fixes).\n- net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts (git-fixes).\n- net: hv_netvsc: reject RSS hash key programming without RX indirection table (bsc#1257473).\n- net: mana: Add metadata support for xdp mode (git-fixes).\n- net: mana: Add standard counter rx_missed_errors (git-fixes).\n- net: mana: Add support for auxiliary device servicing events (git-fixes).\n- net: mana: Change the function signature of mana_get_primary_netdev_rcu (bsc#1256690).\n- net: mana: Drop TX skb on post_work_request failure and unmap resources (git-fixes).\n- net: mana: fix spelling for mana_gd_deregiser_irq() (git-fixes).\n- net: mana: Fix use-after-free in reset service rescan path (git-fixes).\n- net: mana: Fix warnings for missing export.h header inclusion (git-fixes).\n- net: mana: Handle hardware recovery events when probing the device (git-fixes).\n- net: mana: Handle Reset Request from MANA NIC (git-fixes).\n- net: mana: Handle SKB if TX SGEs exceed hardware limit (git-fixes).\n- net: mana: Handle unsupported HWC commands (git-fixes).\n- net: mana: Move hardware counter stats from per-port to per-VF context (git-fixes).\n- net: mana: Probe rdma device in mana driver (git-fixes).\n- net: mana: Reduce waiting time if HWC not responding (git-fixes).\n- net: tcp: allow zero-window ACK update the window (bsc#1254767).\n- net: usb: dm9601: remove broken SR9700 support (git-fixes).\n- net: wwan: t7xx: fix potential skb-\u003efrags overflow in RX path (git-fixes).\n- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame() (git-fixes).\n- nfc: nci: Fix race between rfkill and nci_unregister_device() (git-fixes).\n- NFS: Fix up the automount fs_context to use the correct cred (git-fixes).\n- nfsd: Drop the client reference in client_states_open() (git-fixes).\n- NFSD: Fix permission check for read access to executable-only files (git-fixes).\n- NFSD: use correct reservation type in nfsd4_scsi_fence_client (git-fixes).\n- NFSD/blocklayout: Fix minlength check in proc_layoutget (git-fixes).\n- NFSv4: ensure the open stateid seqid doesn't go backwards (git-fixes).\n- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (git-fixes).\n- nvmet-auth: update sc_c in host response (git-fixes).\n- nvmet-auth: update sc_c in target host hash calculation (git-fixes).\n- of: fix reference count leak in of_alias_scan() (git-fixes).\n- of: platform: Use default match table for /firmware (git-fixes).\n- phy: freescale: imx8m-pcie: assert phy reset during power on (stable-fixes).\n- phy: rockchip: inno-usb2: fix communication disruption in gadget mode (git-fixes).\n- phy: rockchip: inno-usb2: fix disconnection in gadget mode (git-fixes).\n- phy: stm32-usphyc: Fix off by one in probe() (git-fixes).\n- phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 (git-fixes).\n- platform/x86: hp-bioscfg: Fix automatic module loading (git-fixes).\n- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (git-fixes).\n- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (git-fixes).\n- platform/x86/amd: Fix memory leak in wbrf_record() (git-fixes).\n- pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (git-fixes).\n- powercap: fix race condition in register_control_type() (stable-fixes).\n- powercap: fix sscanf() error return value handling (stable-fixes).\n- powerpc/addnote: Fix overflow on 32-bit builds (bsc#1215199).\n- RDMA/mana_ib: Access remote atomic for MRs (git-fixes).\n- RDMA/mana_ib: add additional port counters (git-fixes).\n- RDMA/mana_ib: Add device statistics support (git-fixes).\n- RDMA/mana_ib: Add port statistics support (git-fixes).\n- RDMA/mana_ib: Add support of 4M, 1G, and 2G pages (git-fixes).\n- RDMA/mana_ib: Add support of mana_ib for RNIC and ETH nic (git-fixes).\n- RDMA/mana_ib: add support of multiple ports (git-fixes).\n- RDMA/mana_ib: Allow registration of DMA-mapped memory in PDs (git-fixes).\n- RDMA/mana_ib: check cqe length for kernel CQs (git-fixes).\n- RDMA/mana_ib: Create and destroy UD/GSI QP (git-fixes).\n- RDMA/mana_ib: create kernel-level CQs (git-fixes).\n- RDMA/mana_ib: create/destroy AH (git-fixes).\n- RDMA/mana_ib: Drain send wrs of GSI QP (git-fixes).\n- RDMA/mana_ib: extend mana QP table (git-fixes).\n- RDMA/mana_ib: Extend modify QP (git-fixes).\n- RDMA/mana_ib: Fix error code in probe() (git-fixes).\n- RDMA/mana_ib: Fix integer overflow during queue creation (git-fixes).\n- RDMA/mana_ib: Handle net event for pointing to the current netdev (bsc#1256690).\n- RDMA/mana_ib: helpers to allocate kernel queues (git-fixes).\n- RDMA/mana_ib: Implement DMABUF MR support (git-fixes).\n- RDMA/mana_ib: implement get_dma_mr (git-fixes).\n- RDMA/mana_ib: implement req_notify_cq (git-fixes).\n- RDMA/mana_ib: indicate CM support (git-fixes).\n- RDMA/mana_ib: polling of CQs for GSI/UD (git-fixes).\n- RDMA/mana_ib: Query feature_flags bitmask from FW (git-fixes).\n- RDMA/mana_ib: request error CQEs when supported (git-fixes).\n- RDMA/mana_ib: support of the zero based MRs (git-fixes).\n- RDMA/mana_ib: UD/GSI QP creation for kernel (git-fixes).\n- RDMA/mana_ib: UD/GSI work requests (git-fixes).\n- RDMA/mana_ib: unify mana_ib functions to support any gdma device (git-fixes).\n- RDMA/mana_ib: Use safer allocation function() (git-fixes).\n- regmap: Fix race condition in hwspinlock irqsave routine (git-fixes).\n- sched: Increase sched_tick_remote timeout (bsc#1254510).\n- sched/rt: Skip group schedulable check with rt_group_sched=0 (bsc#1256568).\n- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (bsc#1256861).\n- scsi: lpfc: Update lpfc version to 14.4.0.13 (bsc#1256861).\n- scsi: qla2xxx: Add bsg interface to support firmware img validation (bsc#1256863).\n- scsi: qla2xxx: Add load flash firmware mailbox support for 28xxx (bsc#1256863).\n- scsi: qla2xxx: Add Speed in SFP print information (bsc#1256863).\n- scsi: qla2xxx: Add support for 64G SFP speed (bsc#1256863).\n- scsi: qla2xxx: Allow recovery for tape devices (bsc#1256863).\n- scsi: qla2xxx: Delay module unload while fabric scan in progress (bsc#1256863).\n- scsi: qla2xxx: Fix bsg_done() causing double free (bsc#1256863).\n- scsi: qla2xxx: Free sp in error path to fix system crash (bsc#1256863).\n- scsi: qla2xxx: Query FW again before proceeding with login (bsc#1256863).\n- scsi: qla2xxx: Update version to 10.02.10.100-k (bsc#1256863).\n- scsi: qla2xxx: Validate MCU signature before executing MBC 03h (bsc#1256863).\n- scsi: qla2xxx: Validate sp before freeing associated memory (bsc#1256863).\n- scsi: storvsc: Process unsupported MODE_SENSE_10 (bsc#1257296).\n- selftests: net: fib-onlink-tests: Convert to use namespaces by default (bsc#1255346).\n- selftests/bpf: Fix flaky bpf_cookie selftest (git-fixes).\n- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (git-fixes).\n- slimbus: core: fix device reference leak on report present (git-fixes).\n- slimbus: core: fix OF node leak on registration failure (git-fixes).\n- slimbus: core: fix of_slim_get_device() kernel doc (git-fixes).\n- slimbus: core: fix runtime PM imbalance on report present (git-fixes).\n- smb: change return type of cached_dir_lease_break() to bool (git-fixes).\n- smb: client: ensure open_cached_dir_by_dentry() only returns valid cfid (git-fixes).\n- smb: client: fix cifs_pick_channel when channel needs reconnect (git-fixes).\n- smb: client: fix warning when reconnecting channel (git-fixes).\n- smb: client: introduce close_cached_dir_locked() (git-fixes).\n- smb: client: remove unused fid_lock (git-fixes).\n- smb: client: short-circuit in open_cached_dir_by_dentry() if !dentry (git-fixes).\n- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (bsc#1250748).\n- smb: client: update cfid-\u003elast_access_time in open_cached_dir_by_dentry() (git-fixes).\n- smb: improve directory cache reuse for readdir operations (bsc#1252712).\n- smb3: add missing null server pointer check (git-fixes).\n- spi: spi-sprd-adi: Fix double free in probe error path (git-fixes).\n- spi: sprd-adi: switch to use spi_alloc_host() (stable-fixes).\n- spi: sprd: adi: Use devm_register_restart_handler() (stable-fixes).\n- svcrdma: return 0 on success from svc_rdma_copy_inline_range (git-fixes).\n- uacce: ensure safe queue release with state management (git-fixes).\n- uacce: fix cdev handling in the cleanup path (git-fixes).\n- uacce: fix isolate sysfs check condition (git-fixes).\n- uacce: implement mremap in uacce_vm_ops to return -EPERM (git-fixes).\n- usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor (stable-fixes).\n- usb: dwc3: Check for USB4 IP_NAME (stable-fixes).\n- USB: OHCI/UHCI: Add soft dependencies on ehci_platform (stable-fixes).\n- USB: serial: ftdi_sio: add support for PICAXE AXE027 cable (stable-fixes).\n- USB: serial: option: add Telit LE910 MBIM composition (stable-fixes).\n- usbnet: limit max_mtu based on device's hard_mtu (git-fixes).\n- w1: fix redundant counter decrement in w1_attach_slave_device() (git-fixes).\n- w1: therm: Fix off-by-one buffer overflow in alarms_store (git-fixes).\n- wifi: ath10k: fix dma_free_coherent() pointer (git-fixes).\n- wifi: ath12k: fix dma_free_coherent() pointer (git-fixes).\n- wifi: mac80211: correctly decode TTLM with default link map (git-fixes).\n- wifi: mac80211: don't perform DA check on S1G beacon (git-fixes).\n- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (git-fixes).\n- wifi: rsi: Fix memory corruption due to not set vif driver data size (git-fixes).\n- x86: make page fault handling disable interrupts properly (git-fixes).\n- x86/microcode: Fix Entrysign revision check for Zen1/Naples (bsc#1256528).\n- x86/microcode/AMD: Add more known models to entry sign checking (bsc#1256528).\n- x86/microcode/AMD: Add some forgotten models to the SHA check (bsc#1256528).\n- x86/microcode/AMD: Add TSA microcode SHAs (bsc#1256528).\n- x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (bsc#1256528).\n- x86/microcode/AMD: Clean the cache if update did not load microcode (bsc#1256528).\n- x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches (bsc#1256528).\n- x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (bsc#1256528).\n- x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (bsc#1256528).\n- x86/microcode/AMD: Limit Entrysign signature checking to known generations (bsc#1256528).\n- x86/microcode/AMD: Load only SHA256-checksummed patches (bsc#1256528).\n- x86/microcode/AMD: Use sha256() instead of init/update/final (bsc#1256528).\n","status":"published","published":"2026-02-12T11:26:05Z","modified":"2026-03-23T04:52:16.396939Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0587-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2023-54013: interconnect: Fix locking for runpm vs reclaim (bsc#1256280).\n- CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).\n- CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).\n- CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).\n- CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).\n- CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).\n- CVE-2025-40261: nvme: nvme-fc: Ensure -\u003eioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).\n- CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).\n- CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid() (bsc#1254624).\n- CVE-2025-40350: net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (bsc#1255260).\n- CVE-2025-40355: sysfs: check visibility before changing group attribute ownership (bsc#1255261).\n- CVE-2025-40363: net: ipv6: fix field-spanning memcpy warning in AH output (bsc#1255102).\n- CVE-2025-68171: x86/fpu: Ensure XFD state on signal delivery (bsc#1255255).\n- CVE-2025-68174: amd/amdkfd: enhance kfd process check in switch partition (bsc#1255327).\n- CVE-2025-68178: blk-cgroup: fix possible deadlock while configuring policy (bsc#1255266).\n- CVE-2025-68188: tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (bsc#1255269).\n- CVE-2025-68200: bpf: Add bpf_prog_run_data_pointers() (bsc#1255241).\n- CVE-2025-68215: ice: fix PTP cleanup on driver removal in error path (bsc#1255226).\n- CVE-2025-68227: mptcp: Fix proto fallback detection with BPF (bsc#1255216).\n- CVE-2025-68241: ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (bsc#1255157).\n- CVE-2025-68245: net: netpoll: fix incorrect refcount handling causing incorrect cleanup (bsc#1255268).\n- CVE-2025-68261: ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (bsc#1255164).\n- CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (bsc#1255377).\n- CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255401).\n- CVE-2025-68296: drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (bsc#1255128).\n- CVE-2025-68297: ceph: fix crash in process_v2_sparse_read() for encrypted directories (bsc#1255403).\n- CVE-2025-68301: net: atlantic: fix fragment overflow handling in RX path (bsc#1255120).\n- CVE-2025-68320: lan966x: Fix sleeping in atomic context (bsc#1255172).\n- CVE-2025-68325: net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (bsc#1255417).\n- CVE-2025-68327: usb: renesas_usbhs: Fix synchronous external abort on unbind (bsc#1255488).\n- CVE-2025-68337: jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (bsc#1255482).\n- CVE-2025-68349: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (bsc#1255544).\n- CVE-2025-68363: bpf: Check skb-\u003etransport_header is set in bpf_skb_check_mtu (bsc#1255552).\n- CVE-2025-68365: fs/ntfs3: Initialize allocated memory before use (bsc#1255548).\n- CVE-2025-68366: nbd: defer config unlock in nbd_genl_connect (bsc#1255622).\n- CVE-2025-68367: macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (bsc#1255547).\n- CVE-2025-68372: nbd: defer config put in recv_work (bsc#1255537).\n- CVE-2025-68379: RDMA/rxe: Fix null deref on srq-\u003erq.queue after resize failure (bsc#1255695).\n- CVE-2025-68727: ntfs3: Fix uninit buffer allocated by __getname() (bsc#1255568).\n- CVE-2025-68728: ntfs3: fix uninit memory after failed mi_read in mi_format_new (bsc#1255539).\n- CVE-2025-68733: smack: fix bug: unprivileged task can create labels (bsc#1255615).\n- CVE-2025-68764: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (bsc#1255930).\n- CVE-2025-68768: inet: frags: add inet_frag_queue_flush() (bsc#1256579).\n- CVE-2025-68770: bnxt_en: Fix XDP_TX path (bsc#1256584).\n- CVE-2025-68771: ocfs2: fix kernel BUG in ocfs2_find_victim_chain (bsc#1256582).\n- CVE-2025-68775: net/handshake: duplicate handshake cancellations leak socket (bsc#1256665).\n- CVE-2025-68776: net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (bsc#1256659).\n- CVE-2025-68788: fsnotify: do not generate ACCESS/MODIFY events on child for special files (bsc#1256638).\n- CVE-2025-68795: ethtool: Avoid overflowing userspace buffer on stats query (bsc#1256688).\n- CVE-2025-68798: perf/x86/amd: Check event before enable to avoid GPF (bsc#1256689).\n- CVE-2025-68800: mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (bsc#1256646).\n- CVE-2025-68801: mlxsw: spectrum_router: Fix neighbour use-after-free (bsc#1256653).\n- CVE-2025-68803: nfsd: set security label during create operations (bsc#1256770).\n- CVE-2025-68813: ipvs: fix ipv4 null-ptr-deref in route error path (bsc#1256641).\n- CVE-2025-68814: io_uring: fix filename leak in __io_openat_prep() (bsc#1256651).\n- CVE-2025-68815: net/sched: ets: Remove drr class from the active list if it changes to strict (bsc#1256680).\n- CVE-2025-68816: net/mlx5: fw_tracer, Validate format string parameters (bsc#1256674).\n- CVE-2025-68820: ext4: xattr: fix null pointer deref in ext4_raw_inode() (bsc#1256754).\n- CVE-2025-71064: net: hns3: using the num_tqps in the vf driver to apply for resources (bsc#1256654).\n- CVE-2025-71066: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change\n  (bsc#1256645).\n- CVE-2025-71077: tpm: Cap the number of PCR banks (bsc#1256613).\n- CVE-2025-71080: ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT (bsc#1256608).\n- CVE-2025-71084: RDMA/cm: Fix leaking the multicast GID table reference (bsc#1256622).\n- CVE-2025-71085: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (bsc#1256623).\n- CVE-2025-71087: iavf: fix off-by-one issues in iavf_config_rss_reg() (bsc#1256628).\n- CVE-2025-71088: mptcp: fallback earlier on simult connection (bsc#1256630).\n- CVE-2025-71089: iommu: disable SVA when CONFIG_X86 is set (bsc#1256612).\n- CVE-2025-71091: team: fix check for port enabled in team_queue_override_port_prio_changed() (bsc#1256773).\n- CVE-2025-71093: e1000: fix OOB in e1000_tbi_should_accept() (bsc#1256777).\n- CVE-2025-71094: net: usb: asix: ax88772: Increase phy_name size (bsc#1256597).\n- CVE-2025-71095: net: stmmac: fix the crash issue for zero copy XDP_TX action (bsc#1256605).\n- CVE-2025-71096: RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly (bsc#1256606).\n- CVE-2025-71097: ipv4: Fix reference count leak when using error routes with nexthop objects (bsc#1256607).\n- CVE-2025-71098: ip6_gre: make ip6gre_header() robust (bsc#1256591).\n- CVE-2025-71112: net: hns3: add VLAN id validation before using (bsc#1256726).\n- CVE-2025-71116: libceph: make decode_pool() more resilient against corrupted osdmaps (bsc#1256744).\n- CVE-2025-71120: SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (bsc#1256779).\n- CVE-2025-71123: ext4: fix string copying in parse_apply_sb_mount_options() (bsc#1256757).\n- CVE-2025-71133: RDMA/irdma: avoid invalid read in irdma_net_event (bsc#1256733).\n- CVE-2025-71135: md/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt() (bsc#1256761).\n- CVE-2025-71137: octeontx2-pf: fix 'UBSAN: shift-out-of-bounds error' (bsc#1256760).\n- CVE-2025-71149: io_uring/poll: correctly handle io_poll_add() return value on update (bsc#1257164).\n- CVE-2025-71156: gve: defer interrupt enabling until NAPI registration (bsc#1257167).\n- CVE-2025-71157: RDMA/core: always drop device refcount in ib_del_sub_device_and_put() (bsc#1257168).\n- CVE-2026-22976: net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (bsc#1257035).\n- CVE-2026-22977: net: sock: fix hardened usercopy panic in sock_recv_errqueue (bsc#1257053).\n- CVE-2026-22984: libceph: prevent potential out-of-bounds reads in handle_auth_done() (bsc#1257217).\n- CVE-2026-22990: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (bsc#1257221).\n- CVE-2026-22991: libceph: make free_choose_arg_map() resilient to partial allocation (bsc#1257220).\n- CVE-2026-22992: libceph: return the handler error from mon_handle_auth_done() (bsc#1257218).\n- CVE-2026-22993: idpf: Fix RSS LUT NULL pointer crash on early ethtool operations (bsc#1257180).\n- CVE-2026-22996: net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv.\n- CVE-2026-22999: net/sched: sch_qfq: do not free existing class in qfq_change_class() (bsc#1257236).\n- CVE-2026-23000: net/mlx5e: Fix crash on profile change rollback failure (bsc#1257234).\n- CVE-2026-23001: macvlan: fix possible UAF in macvlan_forward_source() (bsc#1257232).\n- CVE-2026-23005: x86/fpu: Clear XSTATE_BV in guest XSAVE state whenever XFD[i]=1 (bsc#1257245).\n- CVE-2026-23011: ipv4: ip_gre: make ipgre_header() robust (bsc#1257207).\n\nThe following non security issues were fixed:\n\n- ALSA: ctxfi: Fix potential OOB access in audio mixer handling (stable-fixes).\n- ALSA: scarlett2: Fix buffer overflow in config retrieval (git-fixes).\n- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (git-fixes).\n- ALSA: usb-audio: Update for native DSD support quirks (stable-fixes).\n- ALSA: usb: Increase volume range that triggers a warning (git-fixes).\n- ASoC: Intel: sof_es8336: fix headphone GPIO logic inversion (git-fixes).\n- ASoC: amd: yc: Add quirk for Honor MagicBook X16 2025 (stable-fixes).\n- ASoC: codecs: wsa881x: Drop unused version readout (stable-fixes).\n- ASoC: codecs: wsa881x: fix unnecessary initialisation (git-fixes).\n- ASoC: codecs: wsa883x: fix unnecessary initialisation (git-fixes).\n- ASoC: codecs: wsa884x: fix codec initialisation (git-fixes).\n- ASoC: fsl: imx-card: Do not force slot width to sample width (git-fixes).\n- ASoC: fsl_sai: Add missing registers to cache default (stable-fixes).\n- ASoC: tlv320adcx140: fix null pointer (git-fixes).\n- ASoC: tlv320adcx140: fix word length (git-fixes).\n- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (git-fixes).\n- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (git-fixes).\n- HID: usbhid: paper over wrong bNumDescriptor field (stable-fixes).\n- Input: i8042 - add quirk for ASUS Zenbook UX425QA_UM425QA (stable-fixes).\n- Input: i8042 - add quirks for MECHREVO Wujie 15X Pro (stable-fixes).\n- NFS: Fix up the automount fs_context to use the correct cred (git-fixes).\n- NFSD/blocklayout: Fix minlength check in proc_layoutget (git-fixes).\n- NFSD: Fix permission check for read access to executable-only files (git-fixes).\n- NFSD: use correct reservation type in nfsd4_scsi_fence_client (git-fixes).\n- NFSv4: ensure the open stateid seqid doesn't go backwards (git-fixes).\n- RDMA/mana_ib: Access remote atomic for MRs (git-fixes).\n- RDMA/mana_ib: Add device statistics support (git-fixes).\n- RDMA/mana_ib: Add port statistics support (git-fixes).\n- RDMA/mana_ib: Add support of 4M, 1G, and 2G pages (git-fixes).\n- RDMA/mana_ib: Add support of mana_ib for RNIC and ETH nic (git-fixes).\n- RDMA/mana_ib: Allow registration of DMA-mapped memory in PDs (git-fixes).\n- RDMA/mana_ib: Create and destroy UD/GSI QP (git-fixes).\n- RDMA/mana_ib: Drain send wrs of GSI QP (git-fixes).\n- RDMA/mana_ib: Extend modify QP (git-fixes).\n- RDMA/mana_ib: Fix error code in probe() (git-fixes).\n- RDMA/mana_ib: Fix integer overflow during queue creation (git-fixes).\n- RDMA/mana_ib: Handle net event for pointing to the current netdev (bsc#1256690).\n- RDMA/mana_ib: Implement DMABUF MR support (git-fixes).\n- RDMA/mana_ib: Query feature_flags bitmask from FW (git-fixes).\n- RDMA/mana_ib: UD/GSI QP creation for kernel (git-fixes).\n- RDMA/mana_ib: UD/GSI work requests (git-fixes).\n- RDMA/mana_ib: Use safer allocation function() (git-fixes).\n- RDMA/mana_ib: add additional port counters (git-fixes).\n- RDMA/mana_ib: add support of multiple ports (git-fixes).\n- RDMA/mana_ib: check cqe length for kernel CQs (git-fixes).\n- RDMA/mana_ib: create kernel-level CQs (git-fixes).\n- RDMA/mana_ib: create/destroy AH (git-fixes).\n- RDMA/mana_ib: extend mana QP table (git-fixes).\n- RDMA/mana_ib: helpers to allocate kernel queues (git-fixes).\n- RDMA/mana_ib: implement get_dma_mr (git-fixes).\n- RDMA/mana_ib: implement req_notify_cq (git-fixes).\n- RDMA/mana_ib: indicate CM support (git-fixes).\n- RDMA/mana_ib: polling of CQs for GSI/UD (git-fixes).\n- RDMA/mana_ib: request error CQEs when supported (git-fixes).\n- RDMA/mana_ib: support of the zero based MRs (git-fixes).\n- RDMA/mana_ib: unify mana_ib functions to support any gdma device (git-fixes).\n- Revert 'nfc/nci: Add the inconsistency check between the input data length and count' (git-fixes).\n- USB: OHCI/UHCI: Add soft dependencies on ehci_platform (stable-fixes).\n- USB: serial: ftdi_sio: add support for PICAXE AXE027 cable (stable-fixes).\n- USB: serial: option: add Telit LE910 MBIM composition (stable-fixes).\n- ata: libata: Add cpr_log to ata_dev_print_features() early return (git-fixes).\n- bpf/selftests: test_select_reuseport_kern: Remove unused header (bsc#1257603).\n- bpf: Do not let BPF test infra emit invalid GSO types to stack (bsc#1255569).\n- bs-upload-kernel: Fix cve branch uploads.\n- btrfs: do not strictly require dirty metadata threshold for metadata writepages (stable-fixes).\n- can: ctucanfd: fix SSP_SRC in cases when bit-rate is higher than 1 MBit (git-fixes).\n- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (git-fixes).\n- can: etas_es58x: allow partial RX URB allocation to succeed (git-fixes).\n- can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (git-fixes).\n- can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (git-fixes).\n- can: j1939: make j1939_session_activate() fail if device is no longer registered (stable-fixes).\n- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (git-fixes).\n- can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (git-fixes).\n- can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (git-fixes).\n- cifs: Fix copy offload to flush destination region (bsc#1252511).\n- cifs: Fix flushing, invalidation and file size with copy_file_range() (bsc#1252511).\n- cifs: add new field to track the last access time of cfid (git-fixes).\n- cifs: after disabling multichannel, mark tcon for reconnect (git-fixes).\n- cifs: avoid redundant calls to disable multichannel (git-fixes).\n- cifs: cifs_pick_channel should try selecting active channels (git-fixes).\n- cifs: deal with the channel loading lag while picking channels (git-fixes).\n- cifs: dns resolution is needed only for primary channel (git-fixes).\n- cifs: do not disable interface polling on failure (git-fixes).\n- cifs: do not search for channel if server is terminating (git-fixes).\n- cifs: fix a pending undercount of srv_count (git-fixes).\n- cifs: fix lock ordering while disabling multichannel (git-fixes).\n- cifs: fix stray unlock in cifs_chan_skip_or_disable (git-fixes).\n- cifs: fix use after free for iface while disabling secondary channels (git-fixes).\n- cifs: handle servers that still advertise multichannel after disabling (git-fixes).\n- cifs: handle when server starts supporting multichannel (git-fixes).\n- cifs: handle when server stops supporting multichannel (git-fixes).\n- cifs: make cifs_chan_update_iface() a void function (git-fixes).\n- cifs: make sure server interfaces are requested only for SMB3+ (git-fixes).\n- cifs: make sure that channel scaling is done only once (git-fixes).\n- cifs: reconnect worker should take reference on server struct unconditionally (git-fixes).\n- cifs: reset connections for all channels when reconnect requested (git-fixes).\n- cifs: reset iface weights when we cannot find a candidate (git-fixes).\n- cifs: serialize other channels when query server interfaces is pending (git-fixes).\n- cifs: update dstaddr whenever channel iface is updated (git-fixes).\n- comedi: Fix getting range information for subdevices 16 to 255 (git-fixes).\n- comedi: dmm32at: serialize use of paged registers (git-fixes).\n- comedi: fix divide-by-zero in comedi_buf_munge() (stable-fixes).\n- cpuset: fix warning when disabling remote partition (bsc#1256794).\n- crypto: authencesn - reject too-short AAD (assoclen\u003c8) to match ESP/ESN spec (git-fixes).\n- dmaengine: apple-admac: Add 'apple,t8103-admac' compatible (git-fixes).\n- dmaengine: at_hdmac: fix device leak on of_dma_xlate() (git-fixes).\n- dmaengine: bcm-sba-raid: fix device leak on probe (git-fixes).\n- dmaengine: dw: dmamux: fix OF node leak on route allocation failure (git-fixes).\n- dmaengine: idxd: fix device leaks on compat bind and unbind (git-fixes).\n- dmaengine: lpc18xx-dmamux: fix device leak on route allocation (git-fixes).\n- dmaengine: omap-dma: fix dma_pool resource leak in error paths (git-fixes).\n- dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (git-fixes).\n- dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() (git-fixes).\n- dmaengine: tegra-adma: Fix use-after-free (git-fixes).\n- dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (git-fixes).\n- dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation (git-fixes).\n- dmaengine: ti: k3-udma: fix device leak on udma lookup (git-fixes).\n- dmaengine: xilinx: xdma: Fix regmap max_register (git-fixes).\n- dmaengine: xilinx_dma: Fix uninitialized addr_width when 'xlnx,addrwidth' property is missing (git-fixes).\n- dpll: Prevent duplicate registrations (git-fixes).\n- dpll: fix device-id-get and pin-id-get to return errors properly (git-fixes).\n- dpll: fix return value check for kmemdup (git-fixes).\n- dpll: indent DPLL option type by a tab (git-fixes).\n- dpll: spec: add missing module-name and clock-id to pin-get reply (git-fixes).\n- drm/amd/display: Apply e4479aecf658 to dml (stable-fixes).\n- drm/amd/display: Bump the HDMI clock to 340MHz (stable-fixes).\n- drm/amd/display: Fix DP no audio issue (stable-fixes).\n- drm/amd/display: Initialise backlight level values from hw (git-fixes).\n- drm/amd/display: Respect user's CONFIG_FRAME_WARN more for dml files (stable-fixes).\n- drm/amd/display: shrink struct members (stable-fixes).\n- drm/amd/pm: Don't clear SI SMC table when setting power limit (git-fixes).\n- drm/amd/pm: Workaround SI powertune issue on Radeon 430 (v2) (git-fixes).\n- drm/amd/pm: fix race in power state check before mutex lock (git-fixes).\n- drm/amd/pm: fix smu overdrive data type wrong issue on smu 14.0.2 (git-fixes).\n- drm/amd: Clean up kfd node on surprise disconnect (stable-fixes).\n- drm/amdgpu: Fix cond_exec handling in amdgpu_ib_schedule() (git-fixes).\n- drm/amdgpu: Fix query for VPE block_type and ip_count (stable-fixes).\n- drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (git-fixes).\n- drm/amdgpu: remove frame cntl for gfx v12 (stable-fixes).\n- drm/amdkfd: Fix improper NULL termination of queue restore SMI event string (stable-fixes).\n- drm/amdkfd: fix a memory leak in device_queue_manager_init() (git-fixes).\n- drm/imagination: Wait for FW trace update command completion (git-fixes).\n- drm/imx/tve: fix probe device leak (git-fixes).\n- drm/msm/a6xx: fix bogus hwcg register updates (git-fixes).\n- drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare (git-fixes).\n- drm/nouveau/disp: Set drm_mode_config_funcs.atomic_(check|commit) (stable-fixes).\n- drm/nouveau: add missing DCB connector types (git-fixes).\n- drm/nouveau: implement missing DCB connector types; gracefully handle unknown connectors (git-fixes).\n- drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (git-fixes).\n- drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] (stable-fixes).\n- drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() (git-fixes).\n- drm/vmwgfx: Merge vmw_bo_release and vmw_bo_free functions (git-fixes).\n- exfat: check return value of sb_min_blocksize in exfat_read_boot_sector (git-fixes).\n- exfat: fix remount failure in different process environments (git-fixes).\n- gpio: omap: do not register driver in probe() (git-fixes).\n- gpio: pca953x: Add support for level-triggered interrupts (stable-fixes).\n- gpio: pca953x: Utilise dev_err_probe() where it makes sense (stable-fixes).\n- gpio: pca953x: Utilise temporary variable for struct device (stable-fixes).\n- gpio: pca953x: fix wrong error probe return value (git-fixes).\n- gpio: pca953x: handle short interrupt pulses on PCAL devices (git-fixes).\n- gpio: rockchip: Stop calling pinctrl for set_direction (git-fixes).\n- ice: use netif_get_num_default_rss_queues() (bsc#1247712).\n- iio: accel: iis328dq: fix gain values (git-fixes).\n- iio: adc: ad7280a: handle spi_setup() errors in probe() (git-fixes).\n- iio: adc: ad9467: fix ad9434 vref mask (git-fixes).\n- iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver (git-fixes).\n- iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl (git-fixes).\n- iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection (git-fixes).\n- intel_th: fix device leak on output open() (git-fixes).\n- leds: led-class: Only Add LED to leds_list when it is fully ready (git-fixes).\n- lib/crypto: aes: Fix missing MMU protection for AES S-box (git-fixes).\n- mISDN: annotate data-race around dev-\u003ework (git-fixes).\n- mei: me: add nova lake point S DID (stable-fixes).\n- mei: me: add wildcat lake P DID (stable-fixes).\n- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (bsc#1253087 bsc#1254447).\n- mmc: rtsx_pci_sdmmc: implement sdmmc_card_busy function (git-fixes).\n- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode (git-fixes).\n- net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts (git-fixes).\n- net: hv_netvsc: reject RSS hash key programming without RX indirection table (bsc#1257473).\n- net: mana: Add metadata support for xdp mode (git-fixes).\n- net: mana: Add standard counter rx_missed_errors (git-fixes).\n- net: mana: Add support for auxiliary device servicing events (git-fixes).\n- net: mana: Change the function signature of mana_get_primary_netdev_rcu (bsc#1256690).\n- net: mana: Drop TX skb on post_work_request failure and unmap resources (git-fixes).\n- net: mana: Fix use-after-free in reset service rescan path (git-fixes).\n- net: mana: Fix warnings for missing export.h header inclusion (git-fixes).\n- net: mana: Handle Reset Request from MANA NIC (git-fixes).\n- net: mana: Handle SKB if TX SGEs exceed hardware limit (git-fixes).\n- net: mana: Handle hardware recovery events when probing the device (git-fixes).\n- net: mana: Handle unsupported HWC commands (git-fixes).\n- net: mana: Move hardware counter stats from per-port to per-VF context (git-fixes).\n- net: mana: Probe rdma device in mana driver (git-fixes).\n- net: mana: Reduce waiting time if HWC not responding (git-fixes).\n- net: mana: fix spelling for mana_gd_deregiser_irq() (git-fixes).\n- net: tcp: allow zero-window ACK update the window (bsc#1254767).\n- net: usb: dm9601: remove broken SR9700 support (git-fixes).\n- net: wwan: t7xx: fix potential skb-\u003efrags overflow in RX path (git-fixes).\n- nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame() (git-fixes).\n- nfc: nci: Fix race between rfkill and nci_unregister_device() (git-fixes).\n- nfsd: Drop the client reference in client_states_open() (git-fixes).\n- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (git-fixes).\n- nvmet-auth: update sc_c in host response (git-fixes).\n- nvmet-auth: update sc_c in target host hash calculation (git-fixes).\n- of: fix reference count leak in of_alias_scan() (git-fixes).\n- of: platform: Use default match table for /firmware (git-fixes).\n- phy: freescale: imx8m-pcie: assert phy reset during power on (stable-fixes).\n- phy: rockchip: inno-usb2: fix communication disruption in gadget mode (git-fixes).\n- phy: rockchip: inno-usb2: fix disconnection in gadget mode (git-fixes).\n- phy: stm32-usphyc: Fix off by one in probe() (git-fixes).\n- phy: tegra: xusb: Explicitly configure HS_DISCON_LEVEL to 0x7 (git-fixes).\n- platform/x86/amd: Fix memory leak in wbrf_record() (git-fixes).\n- platform/x86: hp-bioscfg: Fix automatic module loading (git-fixes).\n- platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (git-fixes).\n- platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (git-fixes).\n- pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (git-fixes).\n- powercap: fix race condition in register_control_type() (stable-fixes).\n- powercap: fix sscanf() error return value handling (stable-fixes).\n- powerpc/addnote: Fix overflow on 32-bit builds (bsc#1215199).\n- regmap: Fix race condition in hwspinlock irqsave routine (git-fixes).\n- sched/rt: Skip group schedulable check with rt_group_sched=0 (bsc#1256568).\n- sched: Increase sched_tick_remote timeout (bsc#1254510).\n- scripts/python/git_sort/git_sort.yaml: add cifs for-next repository.\n- scripts: obsapi: Support URL trailing / in oscrc.\n- scripts: teaapi: Add paging.\n- scripts: uploader: Fix no change condition for _maintainership.json.\n- scripts: uploader: Handle missing upstream in is_pr_open.\n- scrits: teaapi: Add list_repos.\n- scsi: lpfc: Rework lpfc_sli4_fcf_rr_next_index_get() (bsc#1256861).\n- scsi: lpfc: Update lpfc version to 14.4.0.13 (bsc#1256861).\n- scsi: qla2xxx: Add Speed in SFP print information (bsc#1256863).\n- scsi: qla2xxx: Add bsg interface to support firmware img validation (bsc#1256863).\n- scsi: qla2xxx: Add load flash firmware mailbox support for 28xxx (bsc#1256863).\n- scsi: qla2xxx: Add support for 64G SFP speed (bsc#1256863).\n- scsi: qla2xxx: Allow recovery for tape devices (bsc#1256863).\n- scsi: qla2xxx: Delay module unload while fabric scan in progress (bsc#1256863).\n- scsi: qla2xxx: Fix bsg_done() causing double free (bsc#1256863).\n- scsi: qla2xxx: Free sp in error path to fix system crash (bsc#1256863).\n- scsi: qla2xxx: Query FW again before proceeding with login (bsc#1256863).\n- scsi: qla2xxx: Update version to 10.02.10.100-k (bsc#1256863).\n- scsi: qla2xxx: Validate MCU signature before executing MBC 03h (bsc#1256863).\n- scsi: qla2xxx: Validate sp before freeing associated memory (bsc#1256863).\n- scsi: storvsc: Process unsupported MODE_SENSE_10 (bsc#1257296).\n- selftests/bpf: Fix flaky bpf_cookie selftest (git-fixes).\n- selftests: net: fib-onlink-tests: Convert to use namespaces by default (bsc#1255346).\n- serial: 8250_pci: Fix broken RS485 for F81504/508/512 (git-fixes).\n- slimbus: core: fix OF node leak on registration failure (git-fixes).\n- slimbus: core: fix device reference leak on report present (git-fixes).\n- slimbus: core: fix of_slim_get_device() kernel doc (git-fixes).\n- slimbus: core: fix runtime PM imbalance on report present (git-fixes).\n- smb3: add missing null server pointer check (git-fixes).\n- smb: change return type of cached_dir_lease_break() to bool (git-fixes).\n- smb: client: ensure open_cached_dir_by_dentry() only returns valid cfid (git-fixes).\n- smb: client: fix cifs_pick_channel when channel needs reconnect (git-fixes).\n- smb: client: fix warning when reconnecting channel (git-fixes).\n- smb: client: introduce close_cached_dir_locked() (git-fixes).\n- smb: client: remove unused fid_lock (git-fixes).\n- smb: client: short-circuit in open_cached_dir_by_dentry() if !dentry (git-fixes).\n- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (bsc#1250748 bsc#1257154).\n- smb: client: update cfid-\u003elast_access_time in open_cached_dir_by_dentry() (git-fixes).\n- smb: improve directory cache reuse for readdir operations (bsc#1252712).\n- spi: spi-sprd-adi: Fix double free in probe error path (git-fixes).\n- spi: sprd-adi: switch to use spi_alloc_host() (stable-fixes).\n- spi: sprd: adi: Use devm_register_restart_handler() (stable-fixes).\n- svcrdma: return 0 on success from svc_rdma_copy_inline_range (git-fixes).\n- uacce: ensure safe queue release with state management (git-fixes).\n- uacce: fix cdev handling in the cleanup path (git-fixes).\n- uacce: fix isolate sysfs check condition (git-fixes).\n- uacce: implement mremap in uacce_vm_ops to return -EPERM (git-fixes).\n- usb: core: add USB_QUIRK_NO_BOS for devices that hang on BOS descriptor (stable-fixes).\n- usb: dwc3: Check for USB4 IP_NAME (stable-fixes).\n- usbnet: limit max_mtu based on device's hard_mtu (git-fixes).\n- w1: fix redundant counter decrement in w1_attach_slave_device() (git-fixes).\n- w1: therm: Fix off-by-one buffer overflow in alarms_store (git-fixes).\n- wifi: ath10k: fix dma_free_coherent() pointer (git-fixes).\n- wifi: ath12k: fix dma_free_coherent() pointer (git-fixes).\n- wifi: mac80211: correctly decode TTLM with default link map (git-fixes).\n- wifi: mac80211: don't perform DA check on S1G beacon (git-fixes).\n- wifi: mwifiex: Fix a loop in mwifiex_update_ampdu_rxwinsize() (git-fixes).\n- wifi: rsi: Fix memory corruption due to not set vif driver data size (git-fixes).\n- x86/microcode/AMD: Add TSA microcode SHAs (bsc#1256528).\n- x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev (bsc#1256528).\n- x86/microcode/AMD: Add more known models to entry sign checking (bsc#1256528).\n- x86/microcode/AMD: Add some forgotten models to the SHA check (bsc#1256528).\n- x86/microcode/AMD: Clean the cache if update did not load microcode (bsc#1256528).\n- x86/microcode/AMD: Extend the SHA check to Zen5, block loading of any unreleased standalone Zen5 microcode patches\n  (bsc#1256528).\n- x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo (bsc#1256528).\n- x86/microcode/AMD: Fix __apply_microcode_amd()'s return value (bsc#1256528).\n- x86/microcode/AMD: Limit Entrysign signature checking to known generations (bsc#1256528).\n- x86/microcode/AMD: Load only SHA256-checksummed patches (bsc#1256528).\n- x86/microcode/AMD: Use sha256() instead of init/update/final (bsc#1256528).\n- x86/microcode: Fix Entrysign revision check for Zen1/Naples (bsc#1256528).\n- x86: make page fault handling disable interrupts properly (git-fixes).\n","status":"published","published":"2026-02-20T10:04:28Z","modified":"2026-03-23T04:52:23.385245Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:24179-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2025-40136: crypto: hisilicon/qm - request reserved interrupt for virtual function (bsc#1253340).\n- CVE-2026-23199: procfs: avoid fetching build ID while holding VMA lock (bsc#1258335).\n- CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).\n- CVE-2026-43210: tracing: ring-buffer: Fix to check event length before using (bsc#1264330).\n- CVE-2026-43272: ring-buffer: Fix possible dereference of uninitialized pointer (bsc#1264607).\n- CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).\n- CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).\n- CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).\n- CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).\n- CVE-2026-46272: coresight: tmc-etr: Fix race condition between sysfs and perf mode (bsc#1267672).\n- CVE-2026-53377: drm/msm: always recover the gpu (bsc#1271901).\n- CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).\n- CVE-2026-63838: ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] (bsc#1272388).\n- CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).\n- CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check\n  (bsc#1272890).\n- CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).\n- CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).\n- CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).\n- CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).\n- CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).\n- CVE-2026-64132: ipv6: ioam: refresh hdr pointer before ioam6_event() (bsc#1272347).\n- CVE-2026-64154: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() (bsc#1271950).\n- CVE-2026-64173: tracing: Do not call map-\u003eops-\u003eelt_free() if elt_alloc() fails (bsc#1272145).\n- CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).\n- CVE-2026-64216: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() (bsc#1272802).\n- CVE-2026-64235: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines (bsc#1272803).\n- CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).\n- CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).\n- CVE-2026-64324: udf: validate free block extents against the partition length (bsc#1273970).\n- CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).\n- CVE-2026-64377: cpufreq: qcom-cpufreq-hw: Fix possible double free (bsc#1273297).\n- CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).\n- CVE-2026-64402: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (bsc#1273258).\n- CVE-2026-64405: Bluetooth: separate CIS_LINK and BIS_LINK link types (bsc#1273512).\n- CVE-2026-64414: netfilter: handle unreadable frags (bsc#1273275).\n- CVE-2026-64418: mm: shrinker: fix shrinker_info teardown race with expansion (bsc#1273784).\n- CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).\n- CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).\n- CVE-2026-64457: virtio_pci: fix vq info pointer lookup via wrong index (bsc#1273491).\n- CVE-2026-64473: vfio: Remove device debugfs before releasing devres (bsc#1273320).\n- CVE-2026-64474: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (bsc#1274316).\n- CVE-2026-64475: vfio/pci: Release the VGA arbiter client on register_device() failure (bsc#1274319).\n- CVE-2026-64476: vfio/pci: Latch disable_idle_d3 per device (bsc#1274245).\n- CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037).\n- CVE-2026-64594: usb: gadget: f_fs: initialize reset_work at allocation time (bsc#1274538).\n- CVE-2026-64597: smb: client: fix double-free in SMB2_close() replay (bsc#1274297).\n- CVE-2026-64598: smb/client: Fix error code in smb2_aead_req_alloc() (bsc#1274298).\n- CVE-2026-68146: ftrace: Add global mutex to serialize trace_parser access (bsc#1274890).\n- CVE-2026-68264: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (bsc#1275142).\n- CVE-2026-68266: drm/xe: Hold a dma-buf reference for imported BOs (bsc#1275137).\n- CVE-2026-68290: rds: tcp: unregister sysctl before tearing down listen socket (bsc#1275977).\n- CVE-2026-68312: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (bsc#1274663).\n- CVE-2026-68343: smb: client: validate DFS referral PathConsumed (bsc#1274629).\n- CVE-2026-68367: usb: gadget: f_tcm: synchronize delayed set_alt with teardown (bsc#1275170).\n- CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).\n- CVE-2026-68382: drm/xe/guc: Hold device ref until queue teardown completes (bsc#1274824).\n- CVE-2026-68385: s390/checksum: Fix csum_partial() without vector facility (bsc#1274818).\n- CVE-2026-68400: KVM: arm64: Mask response to FFA_FEATURE call (bsc#1274912).\n- CVE-2026-68441: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains (bsc#1274776).\n- CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests (bsc#1276287).\n- CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests (bsc#1276295).\n- CVE-2026-68454: KVM: s390: pci: Fix handling of AIF enable without AISB (bsc#1276388).\n- CVE-2026-68471: wifi: ieee80211: validate MLE common info length (bsc#1276504).\n- CVE-2026-68477: ipvs: fix more places with wrong ipv6 transport offsets (bsc#1275495).\n- CVE-2026-72012: tracing/osnoise: Call synchronize_rcu() when unregistering (bsc#1276783).\n- CVE-2026-72018: dibs: loopback: validate offset and size in move_data() (bsc#1276852).\n- CVE-2026-72025: s390/monwriter: Reject buffer reuse with different data length (bsc#1276923).\n- CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).\n- CVE-2026-72070: wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() (bsc#1277153).\n- CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).\n- CVE-2026-72102: dm_early_create: fix freeing used table on dm_resume failure (bsc#1277314).\n- CVE-2026-72128: nvmet: fix refcount leak in nvmet_sq_create() (bsc#1277101).\n- CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).\n- CVE-2026-72130: nvmet-auth: reject short AUTH_RECEIVE buffers (bsc#1275549).\n- CVE-2026-72147: dmaengine: dw-edma-pcie: Reject devices without driver data (bsc#1277234).\n- CVE-2026-72166: net/9p: fix infinite loop in p9_client_rpc on fatal signal (bsc#1277556).\n- CVE-2026-72218: lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure (bsc#1277218).\n- CVE-2026-72219: lockd: Plug nlm_file leak when nlm_do_fopen() fails (bsc#1277217).\n- CVE-2026-72224: nvdimm/btt: Free arenas on btt_init() error paths (bsc#1277215).\n- CVE-2026-72237: perf/x86/amd/brs: Fix kernel address leakage (bsc#1277615).\n- CVE-2026-72247: netfilter: nf_conncount: fix zone comparison in tuple dedup (bsc#1277662).\n- CVE-2026-72256: netfilter: xt_cluster: reject template conntracks in hash match (bsc#1277674).\n- CVE-2026-72299: tipc: restrict socket queue dumps in enqueue tracepoints (bsc#1275924).\n- CVE-2026-72321: ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() (bsc#1277143).\n- CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).\n- CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).\n- CVE-2026-72349: netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() (bsc#1277784).\n- CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).\n- CVE-2026-72352: HID: bpf: Fix hid_bpf_get_data() range check (bsc#1277823).\n- CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).\n- CVE-2026-72392: ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump (bsc#1277128).\n- CVE-2026-72404: tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() (bsc#1278031).\n- CVE-2026-72406: net: sungem: fix probe error cleanup (bsc#1278035).\n- CVE-2026-72413: sctp: fix err_chunk memory leaks in INIT handling (bsc#1277122).\n- CVE-2026-72433: netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (bsc#1278053).\n- CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped (bsc#1278054).\n- CVE-2026-72435: netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() (bsc#1278056).\n- CVE-2026-72436: netfilter: ipset: Fix data race between add and dump in all hash types (bsc#1277245).\n- CVE-2026-72444: flow_dissector: check device type before reading ETH_ADDRS (bsc#1278100).\n- CVE-2026-72447: sctp: hold socket lock when dumping endpoints in sctp_diag (bsc#1277109).\n- CVE-2026-72491: net/9p: fix race condition on rdma-\u003estate in trans_rdma.c (bsc#1276947).\n- CVE-2026-74256: bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check (bsc#1276535).\n- CVE-2026-74257: sockmap: Fix use-after-free in udp_bpf_recvmsg() (bsc#1276532).\n- CVE-2026-74258: bpf: Guard __get_user acesss with access_ok for uprobe_multi data (bsc#1276538).\n- CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen\n  (bsc#1276519).\n- CVE-2026-74268: tcp: clear sock_ops cb flags before force-closing a child socket (bsc#1276508).\n- CVE-2026-74281: tipc: reject inverted service ranges from peer bindings (bsc#1276474).\n- CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators (bsc#1276475).\n- CVE-2026-74288: net: fib_rules: Don't dump dying fib_rule in fib_rules_dump() (bsc#1276460).\n- CVE-2026-74289: ipv4: fib: Don't dump dying fib_info in fib_leaf_notify() (bsc#1276461).\n- CVE-2026-74290: net/sched: cls_flow: Dont expose folded kernel pointers (bsc#1276462).\n- CVE-2026-74330: configfs: fix lockless traversals of -\u003es_children (bsc#1277129).\n- CVE-2026-74356: vhost: fix vhost_get_avail_idx for a non empty ring (bsc#1278063).\n- CVE-2026-74359: configfs_lookup(): don't leave -\u003es_dentry dangling on failure (bsc#1278067).\n- CVE-2026-74365: nvdimm/btt: Handle preemption in BTT lane acquisition (bsc#1278225).\n- CVE-2026-74376: md/raid10: reset read_slot when reusing r10bio for discard (bsc#1277401).\n- CVE-2026-74384: nvme-multipath: fix flex array size in struct nvme_ns_head (bsc#1277405).\n- CVE-2026-74385: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock (bsc#1278255).\n- CVE-2026-74386: nvmet-tcp: fix page fragment cache leak in error path (bsc#1277098).\n- CVE-2026-74389: RDMA/hns: Fix log flood after cmd_mbox failure (bsc#1278087).\n- CVE-2026-74391: tracing: Bound synthetic-field strings with seq_buf (bsc#1278091).\n- CVE-2026-74398: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (bsc#1277410).\n- CVE-2026-74440: drm/xe: Wait on external BO kernel fences in exec IOCTL (bsc#1261564).\n- CVE-2026-74449: drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport (bsc#1278215).\n- CVE-2026-74450: drm/amd/pm: fix pptable use-after-free (bsc#1278216).\n- CVE-2026-74465: net: openvswitch: fix potential UAF on meter attach failure (bsc#1277801).\n- CVE-2026-74467: s390/qeth: Check CAP_NET_ADMIN for private ioctls (bsc#1277805).\n- CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1277792).\n- CVE-2026-74471: tracing: Check return value of __register_event() in trace_module_add_events() (bsc#1277781).\n- CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() (bsc#1276340).\n- CVE-2026-74480: net: bridge: stop fast-leave after deleting a port group (bsc#1276353).\n- CVE-2026-74483: binfmt_misc: don't leak the user namespace when the mount fails (bsc#1276347).\n- CVE-2026-74484: binfmt_misc: don't let an 'F' entry pin its own instance (bsc#1276345).\n- CVE-2026-74485: binfmt_misc: reject a flag character as the field delimiter (bsc#1277892).\n- CVE-2026-74487: binfmt_misc: restore write access when removing an entry (bsc#1276349).\n- CVE-2026-74490: tipc: avoid use-after-free in poll trace queue dumps (bsc#1276352).\n- CVE-2026-74492: netfilter: ipset: do not update comments from kernel-side hash adds (bsc#1276337).\n- CVE-2026-74493: net/smc: fix socket use-after-free during link group termination (bsc#1276338).\n- CVE-2026-74515: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (bsc#1275953).\n- CVE-2026-74538: Bluetooth: ISO: lock sk in iso_connect_ind (bsc#1275682).\n- CVE-2026-74564: netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH (bsc#1275567).\n- CVE-2026-74579: netfilter: nft_payload: fix mask build for partial field offload (bsc#1275559).\n- CVE-2026-74580: vhost: reset the vring metadata cache on vring reconfiguration (bsc#1277885).\n- CVE-2026-74586: sctp: clear new_transport when removing a peer (bsc#1277820).\n- CVE-2026-74588: sctp: keep chunk-\u003etransport in step with the list it is queued on (bsc#1277766).\n- CVE-2026-74589: bpf, sockmap: Fix sk_redir use-after-free in send verdict (bsc#1277904).\n- CVE-2026-74590: fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions (bsc#1277824).\n- CVE-2026-74592: ima: Instantiate file_truncate and path_truncate hooks (bsc#1277900).\n- CVE-2026-74594: sched/psi: Shut down rtpoll_timer in psi_cgroup_free() (bsc#1277843).\n- CVE-2026-74595: fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() (bsc#1277910).\n- CVE-2026-74597: ip6_tunnel: clear skb2-\u003ecb in ip6ip6_err() (bsc#1277493).\n- CVE-2026-74600: mm/page_table_check: skip special zero mappings (bsc#1277640).\n- CVE-2026-74601: ring-buffer: Use current_context for safe per-CPU buffer swap (bsc#1277896).\n- CVE-2026-74602: ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer() (bsc#1277895).\n- CVE-2026-74603: ptp: ocp: Fix board ID over-read (bsc#1277915).\n- CVE-2026-74605: eventfs: Use children field for rcu head and add memory barriers (bsc#1277913).\n- CVE-2026-74606: eventfs: Fix use-after-free in eventfs_remove_rec() (bsc#1277864).\n- CVE-2026-74609: tipc: read le-\u003elink under the node lock in tipc_node_link_down() (bsc#1277906).\n- CVE-2026-74625: netfilter: bridge: release template ct on non-IP path (bsc#1277036).\n- CVE-2026-74628: net/x25: fix use-after-free of the socket by its timers (bsc#1277844).\n- CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191).\n- CVE-2026-74631: net: smc: fix splice entry lifetime imbalance in smc_rx_splice (bsc#1278195).\n- CVE-2026-74632: mm/huge_memory: fix huge_zero_pfn race (bsc#1278199).\n- CVE-2026-74634: ring-buffer: Prevent subbuf order change when resizing is disabled (bsc#1277379).\n- CVE-2026-74636: tracing: Fix race between update_event_fields and, event_define_fields (bsc#1277371).\n- CVE-2026-74637: perf/core: Fix group leader use-after-free after sibling detach (bsc#1277372).\n- CVE-2026-74638: drm/v3d: Serialize the scheduler timeout handlers (bsc#1277374).\n- CVE-2026-74659: net: bridge: mrp: fix uninitialised bytes on the wire (bsc#1277296).\n- CVE-2026-74660: netfilter: ebt_nflog: pin the NFLOG backend (bsc#1277272).\n- CVE-2026-74662: inet: frags: add inet_frag_putn() helper (bsc#1277277).\n- CVE-2026-74663: net/sched: reject overly deep qdisc hierarchies (bsc#1278311).\n- CVE-2026-74666: packet: synchronize pressure clearing with ring reconfiguration (bsc#1277032).\n- CVE-2026-74667: net/packet: reset the MAC header on the packet-socket transmit path (bsc#1277396).\n- CVE-2026-74671: ima: fix out-of-bounds read in xattr_verify() (bsc#1277392).\n- CVE-2026-74688: sctp: clear control chunk transport if it is being removed (bsc#1277489).\n- CVE-2026-74689: net/atm: fix slab-out-of-bounds read in vcc_setsockopt() (bsc#1278314).\n- CVE-2026-74692: net/smc: fix TOCTOU race between smc_listen_out() and listener close (bsc#1276927).\n- CVE-2026-74694: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length (bsc#1277625).\n- CVE-2026-74696: tcp: fix TFO max_qlen accounting across reuseport migration (bsc#1276930).\n- CVE-2026-74697: bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips (bsc#1277897).\n- CVE-2026-74700: net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers (bsc#1277626).\n- CVE-2026-74701: net/openvswitch: check Ethernet header length in key_extract() (bsc#1276921).\n- CVE-2026-74710: xsk: require at least 16 bytes of TX metadata (bsc#1276579).\n- CVE-2026-74713: vhost_iotlb: bound map allocation in add_range (bsc#1276570).\n- CVE-2026-74718: devlink: fix net namespace reference leak in reload (bsc#1276573).\n- CVE-2026-74725: enic: fix tx_hang_reset use-after-free on device removal (bsc#1276563).\n- CVE-2026-74726: bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor (bsc#1276565).\n- CVE-2026-74735: l2tp: fix tunnel and session refcount leak on seq_file release (bsc#1277030).\n- CVE-2026-74739: net/sched: cls_u32: skip hash tables in u32_bind_class() (bsc#1278247).\n- CVE-2026-74745: eth: bnxt: decrease indent in bnxt_request_irq() (bsc#1277382).\n- CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315).\n- CVE-2026-80521: af_unix: Unlink scc_entry in unix_del_edge() (bsc#1277568).\n- CVE-2026-80585: mptcp: fastopen: only mark MPTFO subflows with SYN data (bsc#1277342).\n- CVE-2026-80613: veth: fix NAPI leak in XDP enable error path (bsc#1278205).\n- CVE-2026-80631: btrfs: lzo: reject compressed segment that overflows the compressed input (bsc#1277558).\n- CVE-2026-80664: netfilter: xt_nat: reject unsupported target families (bsc#1277555).\n- CVE-2026-80679: s390/dasd: Fix potential NULL pointer dereference (bsc#1277557).\n- CVE-2026-80686: mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE (bsc#1278245).\n- CVE-2026-80694: net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller (bsc#1278363).\n- CVE-2026-80715: igc: remove napi_synchronize() in igc_down() (bsc#1277840).\n- CVE-2026-80725: net: gro: properly validate BIG TCP aggregation criteria (bsc#1277452).\n- CVE-2026-80747: drm/amdkfd: Add bounds check for CRAT subtype length (bsc#1279536).\n- CVE-2026-80756: selinux: do not cancel a policy conversion that never started (bsc#1278708).\n- CVE-2026-80779: net/ionic: avoid OOB TX partner lookup for hwstamp RXQ (bsc#1279590).\n- CVE-2026-80789: nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621).\n- CVE-2026-80793: ipv4: reject undersized MTUs in ip_do_fragment() (bsc#1279799).\n- CVE-2026-80836: crypto: virtio - bound the akcipher result length (bsc#1279819).\n- CVE-2026-80840: ipv6: seg6: clear IPv4 control block on IPIP decapsulation (bsc#1279875).\n- CVE-2026-80841: net/packet: defer vmalloc TX_RING free until skbs finish (bsc#1279835).\n- CVE-2026-80842: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context (bsc#1279888).\n- CVE-2026-80844: xfrm: ah6: validate routing header segments_left (bsc#1279786).\n- CVE-2026-80846: xfrm: drop ESP-in-TCP packets with no ingress device (bsc#1279878).\n- CVE-2026-80847: tcp: clamp route advmss to TCP_MIN_MSS (bsc#1279850).\n- CVE-2026-80848: xfrm: espintcp: fix UAF during close (bsc#1279581).\n- CVE-2026-80851: gtp: serialize PDP context updates (bsc#1279569).\n- CVE-2026-80852: tls: device: fix out-of-bounds write in tls_append_frag() (bsc#1279532).\n- CVE-2026-80863: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (bsc#1279535).\n- CVE-2026-80864: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (bsc#1279525).\n- CVE-2026-80865: bpf: Add missing access_ok call to copy_user_syms (bsc#1279527).\n- CVE-2026-80880: IB/mlx5: Properly support implicit ODP rereg_mr (bsc#1279497).\n- CVE-2026-80895: mshv: Order pt_vp_array publish against irqfd assertion path (bsc#1279702).\n- CVE-2026-80932: vsock/virtio: flush works in dependency order (bsc#1280143).\n- CVE-2026-80976: seg6: reset IP6CB after IPv6 decapsulation (bsc#1280298).\n- CVE-2026-80979: net/smc: unregister the connection before draining the rx tasklet (bsc#1280299).\n- CVE-2026-80980: net/smc: Address spelling errors (bsc#1280303).\n- CVE-2026-80983: net/smc: fix socket refcount leak in smc_switch_conns() (bsc#1280296).\n- CVE-2026-80984: net/smc: do not dereference an unset send buffer on the SMC-D teardown path (bsc#1280309).\n- CVE-2026-81000: net: tun: bound receive headroom (bsc#1280263).\n- CVE-2026-81001: slip: fix use-after-free in sl_sync() (bsc#1280375).\n- CVE-2026-89448: iommu/vt-d: Force requesting ACS when tboot is enabled (bsc#1280379).\n- CVE-2026-89451: iommu/sva: Set handle-\u003edev before the SVA handle is visible (bsc#1280383).\n- CVE-2026-89453: iommu/amd: Put PCI device after handling PPR faults (bsc#1280384).\n- CVE-2026-89477: sctp: fix NULL deref on untransmitted RECONF completion (bsc#1280338).\n- CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786).\n- CVE-2026-89480: nvme-tcp: reject a read that transferred too few bytes (bsc#1280449).\n- CVE-2026-89481: nvme-tcp: fix host memory disclosure on R2T for a read command (bsc#1280451).\n- CVE-2026-89482: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (bsc#1280350).\n- CVE-2026-89485: lockd: pin next file across nlm_inspect_file lock-drop (bsc#1280456).\n- CVE-2026-89500: ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page (bsc#1280333).\n- CVE-2026-89501: ring-buffer: Hold cpu_buffer::lock when resizing a subbuf (bsc#1280335).\n- CVE-2026-89502: ring-buffer: Free cpu_buffer::free_page with subbuf_order (bsc#1280336).\n- CVE-2026-89503: ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() (bsc#1280334).\n- CVE-2026-89508: RDMA/ucma: Lock the handler in ucma_set_ib_path() (bsc#1280544).\n- CVE-2026-89510: RDMA/cxgb4: Cancel reg_work before freeing device on remove (bsc#1280551).\n- CVE-2026-89511: qede: Fix NULL pointer dereference in TPA fragment processing (bsc#1280508).\n- CVE-2026-89525: udf: reject VAT indexes equal to the entry count (bsc#1282288).\n- CVE-2026-89526: svcrdma: Validate Read chunk positions before reconstruction (bsc#1280901).\n- CVE-2026-89527: svcrdma: Use svc_xprt_put to free listener on create failure (bsc#1281754).\n- CVE-2026-89530: svcrdma: Reject inline replies that overflow the pull-up buffer (bsc#1280920).\n- CVE-2026-89531: svcrdma: Reject connection when transport allocation fails (bsc#1281738).\n- CVE-2026-89532: svcrdma: Fix pcl_for_each_segment for empty chunks (bsc#1280985).\n- CVE-2026-89533: svcrdma: Fix offset arithmetic in read_chunk_range (bsc#1280993).\n- CVE-2026-89534: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails (bsc#1280766).\n- CVE-2026-89535: svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id (bsc#1280761).\n- CVE-2026-89536: SUNRPC: wait for in-flight client TLS handshake callback (bsc#1280711).\n- CVE-2026-89538: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field (bsc#1280716).\n- CVE-2026-89539: SUNRPC: reject duplicate CREDS_VALUE options (bsc#1280717).\n- CVE-2026-89540: sunrpc: init gssp_lock before publishing proc entry (bsc#1280719).\n- CVE-2026-89541: SUNRPC: harden gss_unwrap_resp_priv length checks (bsc#1280388).\n- CVE-2026-89542: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (bsc#1280387).\n- CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280758).\n- CVE-2026-89545: sunrpc: defer rq_argp and rq_resp free until after RCU grace period (bsc#1280720).\n- CVE-2026-89547: SUNRPC: Check svc pool percpu counter allocation (bsc#1280548).\n- CVE-2026-89548: SUNRPC: always drain cache_cleaner before destroying a cache_detail (bsc#1280546).\n- CVE-2026-89550: SUNRPC: svcauth_gss: enforce krb5 token minimum length (bsc#1280726).\n- CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow (bsc#1280727).\n- CVE-2026-89564: ip: orphan prefetched skbs before multicast forwarding (bsc#1280797).\n- CVE-2026-89580: bpf: Disable preemption in __bpf_get_stack (bsc#1280577).\n- CVE-2026-89603: entry: Fix seccomp bypass after ptrace with TSYNC (bsc#1280923).\n- CVE-2026-89644: btrfs: fix extent map leak in NOCOW direct I/O write (bsc#1281054).\n- CVE-2026-89658: NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup (bsc#1280576).\n- CVE-2026-89660: NFSD: Prevent client use-after-free during admin state revocation (bsc#1280525).\n- CVE-2026-89662: NFSD: Prevent lock owner use-after-free during client teardown (bsc#1280509).\n- CVE-2026-89663: nfsd: revoke copy-notify stateids before dropping their reference (bsc#1280518).\n- CVE-2026-89665: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE (bsc#1281057).\n- CVE-2026-89669: nfsd: initialize copy-notify stateid before publishing it (bsc#1280251).\n- CVE-2026-89671: nfsd: gate nfs3 setacl by argp-\u003emask (bsc#1280252).\n- CVE-2026-89672: nfsd: gate nfs2 setacl by argp-\u003emask (bsc#1280235).\n- CVE-2026-89673: nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo (bsc#1280237).\n- CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280243).\n- CVE-2026-89680: nfsd: fix nfsd_file leak on inter-server COPY setup failure (bsc#1280206).\n- CVE-2026-89683: nfsd: fix dentry ref leak on V4ROOT export filehandle lookup (bsc#1280193).\n- CVE-2026-89684: nfsd: fix cpntf publish race in nfs4_init_cp_state (bsc#1280178).\n- CVE-2026-89685: nfsd: fix clock domain mismatch in clients_still_reclaiming() (bsc#1280179).\n- CVE-2026-89686: nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke (bsc#1280184).\n- CVE-2026-89688: nfsd: drop the stateid, not the stateowner, on seqid_op replay retry (bsc#1280171).\n- CVE-2026-89690: nfsd: defer vfree of compound ops to fix rpc_status UAF (bsc#1280166).\n- CVE-2026-89691: nfsd: clear opcnt on compound arg release to prevent OOB read (bsc#1280163).\n- CVE-2026-89694: nfsd: check client ownership when cancelling a copy-notify stateid (bsc#1280151).\n- CVE-2026-89696: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref (bsc#1280146).\n- CVE-2026-89697: nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() (bsc#1280148).\n- CVE-2026-89698: nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage (bsc#1280494).\n- CVE-2026-89699: nfsd: validate symlink target length in NFSv4 CREATE (bsc#1281077).\n- CVE-2026-89702: nfsd: size fh_verify server sockaddr slot by xpt_locallen (bsc#1280487).\n- CVE-2026-89703: nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations (bsc#1280488).\n- CVE-2026-89704: nfsd: sample writeback error cursor before async COPY loop (bsc#1280490).\n- CVE-2026-89705: nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths (bsc#1280464).\n- CVE-2026-89706: nfsd: Reset write verifier when async COPY writeback fails (bsc#1280477).\n- CVE-2026-89707: nfsd: release path refs on follow_down() error (bsc#1280468).\n- CVE-2026-89710: NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path (bsc#1280455).\n- CVE-2026-89712: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock (bsc#1280870).\n- CVE-2026-89713: NFSD: check truncate permission under inode lock (bsc#1280872).\n- CVE-2026-89747: tracing: Fix use-after-free in trace_pipe read on sub-buffer order change (bsc#1281025).\n- CVE-2026-89780: net: qualcomm: rmnet: restore skb-\u003edev on deaggregated frames (bsc#1280969).\n- CVE-2026-89784: SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 (bsc#1281224).\n- CVE-2026-89789: gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free (bsc#1281226).\n- CVE-2026-89791: perf: Fix use-after-free when perf mmap() revival races with the last munmap() (bsc#1281228).\n- CVE-2026-89798: svcrdma: Fix unmatched rn_unregister on failed accept (bsc#1281136).\n- CVE-2026-89912: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save (bsc#1281201).\n- CVE-2026-89913: KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables (bsc#1281202).\n- CVE-2026-89968: nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229).\n- CVE-2026-89970: nvmet: add a helper function for cqid checking (bsc#1281231).\n- CVE-2026-89984: perf/x86/intel: Fix kernel address leakages in LBR stack (bsc#1281273).\n- CVE-2026-90003: futex: Prevent rcuwait use-after-free during requeue PI (bsc#1281295).\n- CVE-2026-90065: net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure (bsc#1281660).\n- CVE-2026-90074: net/sched: fq_pie: clamp default quantum to avoid signed overflow (bsc#1281496).\n- CVE-2026-90097: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition (bsc#1281514).\n- CVE-2026-90101: bnxt_en: Fix call to hardware monitoring event handler (bsc#1281525 bsc#1283517).\n- CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546).\n- CVE-2026-90142: virtio_net: Fix resize of the RX ring (bsc#1281597).\n- CVE-2026-90149: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers (bsc#1281955).\n- CVE-2026-90150: pnfs/blocklayout: Fix device leaks on parse failure (bsc#1281956).\n- CVE-2026-90151: NFSv4: remove callback IDR entry on client allocation failure (bsc#1281599).\n- CVE-2026-90177: bpf: Check pointer type for all atomic RMW paths (bsc#1281645).\n- CVE-2026-90182: blk-iocost: clear delay state when freeing policy data (bsc#1281644).\n- CVE-2026-90183: blk-iolatency: clear delay state when freeing policy data (bsc#1281964).\n- CVE-2026-90203: Squashfs: check block offset is not negative (bsc#1281808).\n- CVE-2026-90218: RDMA/cma: Fix WARNING in res_to_rt (bsc#1281795).\n- CVE-2026-90228: nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() (bsc#1281717).\n- CVE-2026-90240: iommu/vt-d: Flush context cache with correct SID when tearing down aliases (bsc#1281683).\n- CVE-2026-90241: iommu/vt-d: Tear down scalable-mode context on probe failure (bsc#1281682).\n- CVE-2026-90243: iommu/vt-d: Clear Present bit before tearing down copied context entry (bsc#1281845).\n- CVE-2026-90259: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() (bsc#1281680).\n- CVE-2026-90263: btrfs: check if root is readonly when setting posix acl (bsc#1281922).\n- CVE-2026-90265: btrfs: defrag: fix deadlock between defrag and delalloc space reservation (bsc#1282054).\n- CVE-2026-90292: RDMA/siw: Fix use-after-free in siw_accept() (bsc#1281777).\n- CVE-2026-90293: IB/isert: post the full-feature receive buffers after session registration (bsc#1281778).\n- CVE-2026-90294: IB/isert: delay the final Login Response until the session is registered (bsc#1281732).\n- CVE-2026-90307: RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ (bsc#1282050).\n- CVE-2026-90308: RDMA/erdma: Hold QP references for AE and CM processing (bsc#1281786).\n- CVE-2026-90309: RDMA/erdma: Hold CQ references when processing EQ events (bsc#1281789).\n- CVE-2026-90358: bpf, x86: Fix trampoline stack size for 128-bit arguments (bsc#1281825).\n- CVE-2026-90388: iommu/dma: Check atomic pool allocation result directly (bsc#1282197).\n- CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received (bsc#1282113).\n- CVE-2026-90414: IB/isert: reject PDUs declaring more data than (bsc#1282110).\n- CVE-2026-90415: RDMA/cxgb4: free STAG index when TPT entry write fails (bsc#1282143).\n- CVE-2026-90417: RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() (bsc#1281973).\n- CVE-2026-90426: iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs (bsc#1282013).\n- CVE-2026-90428: iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs (bsc#1282003).\n- CVE-2026-90430: iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized (bsc#1281991).\n- CVE-2026-92495: RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap (bsc#1282072).\n- CVE-2026-92523: RDMA/nldev: validate dynamic counter attribute length (bsc#1282271).\n- CVE-2026-92525: RDMA/rxe: Validate num_sge/cur_sge before indexing wqe-\u003edma.sge[] (bsc#1282270).\n- CVE-2026-93037: RDMA/hfi1: Propagate sdma_txinit_ahg() errors (bsc#1282020).\n- CVE-2026-93107: RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state (bsc#1281399).\n- CVE-2026-93108: RDMA/ipoib: Drain RCU callbacks during module teardown (bsc#1281408).\n- CVE-2026-93109: RDMA/mlx5: Drain RCU callbacks during module teardown (bsc#1281379).\n- CVE-2026-93110: RDMA/core: Wait for RCU callbacks before unloading ib_core (bsc#1281387).\n- CVE-2026-93154: RDMA/irdma: Add refcounting to user ring MRs (bsc#1282104).\n- CVE-2026-93160: crypto: atmel-ecc - reject hardware ECDH without a public key (bsc#1282147).\n- CVE-2026-93207: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (bsc#1282672).\n- CVE-2026-93212: nfsd: guard nfsd_serv deref in nfsd_file_net_dispose (bsc#1282774).\n- CVE-2026-93264: RDMA/efa: Fix PBL chunk length computation (bsc#1282812).\n- CVE-2026-93782: vhost-scsi: flush backend after device ioctls (bsc#1282906).\n- CVE-2026-93794: smb/client: flush dirty data before punching a hole (bsc#1283154).\n- CVE-2026-93800: btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol() (bsc#1282808).\n- CVE-2026-93810: cachefiles: Fix double fput (bsc#1283213).\n- CVE-2026-93814: spi: core: Abort active target transfer on controller suspend.\n- CVE-2026-93825: spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data().\n- CVE-2026-93826: HID: hidpp: fix potential UAF in hidpp_connect_event() (bsc#1282891).\n- CVE-2026-93827: virtio-fs: avoid double-free on failed queue setup (bsc#1282747).\n- CVE-2026-93829: smb: client: fix races in cifsd thread creation (bsc#1282803).\n- CVE-2026-97413: RDMA/rtrs-srv: Fix integer underflow in process_read and process_write (bsc#1282975).\n- CVE-2026-97421: RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() (bsc#1283176).\n- CVE-2026-97477: RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() (bsc#1283230).\n- CVE-2026-97520: gfs2: move quota_init qc iterator increment (bsc#1283479).\n- CVE-2026-97521: gfs2: fix quota init duplicate scan (bsc#1283475).\n- CVE-2026-97543: xfs: destroy seen inode bitmap when we fail to add a dirpath (bsc#1283450).\n- CVE-2026-97544: xfs: don't leak dqacct if rhashtable insertion fails (bsc#1283149).\n- CVE-2026-97545: xfs: don't leak new_bp if xfs_btree_bload_drop_buf fails (bsc#1283205).\n- CVE-2026-97546: xfs: don't spin forever on zero-length dirents when salvaging them (bsc#1283203).\n- CVE-2026-97552: xfs: initialise error in xfs_defer_finish_one() (bsc#1283328).\n- CVE-2026-97557: smb: client: avoid leaking refcount in cifs_queue_oplock_break() (bsc#1283201).\n- CVE-2026-97571: bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc() (bsc#1283517 bsc#1283945).\n- CVE-2026-97572: bnxt_en: Propagate RX ring init failures in bnxt_init_nic() (bsc#1283517 bsc#1283794).\n- CVE-2026-97573: bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset() (bsc#1283517 bsc#1283880).\n- CVE-2026-97574: bnxt_en: Don't free the live ring's TPA state on queue restart failure (bsc#1283517 bsc#1283795).\n- CVE-2026-97605: erofs: preserve LZMA decoders on resize failure (bsc#1283173).\n- CVE-2026-97902: fs: don't return -EINVAL for successful nested thaw (bsc#1283166).\n- CVE-2026-97934: tracing: Fix memory corruption from a \"STACKTRACE\" histogram key (bsc#1282997).\n- CVE-2026-97940: ipv6: fix fib6 walker UAF on seq stop (bsc#1283163).\n- CVE-2026-97947: x86/amd_node: Avoid divide by zero on virtualized systems (bsc#1283130).\n- CVE-2026-97957: net: hinic: fix mailbox segment buffer overflow (bsc#1283119).\n- CVE-2026-98003: iommu/amd: Do not reallocate GA log buffers on resume (bsc#1283312).\n- CVE-2026-98028: eth: nfp: drop the replaced rule from the list when reprogramming fails (bsc#1283739).\n- CVE-2026-98029: eth: nfp: bound the ntuple rule dump by the caller's buffer size (bsc#1283490).\n- CVE-2026-98030: net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size (bsc#1283489).\n- CVE-2026-98091: btrfs: detach failed sprout device from transaction update list (bsc#1283805).\n- CVE-2026-100075: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (bsc#1282881).\n\nThe following non security issues were fixed:\n\n- ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach (stable-fixes).\n- ACPI: scan: Honor _DEP for ACPI0016 PCI/CXL host bridge (stable-fixes).\n- ACPICA: add boundary checks in acpi_ps_get_next_field() (stable-fixes).\n- ACPICA: add boundary checks in two places (stable-fixes).\n- ACPICA: Add package limit checks in parser functions (stable-fixes).\n- ACPICA: Add validation for node in acpi_ns_build_normalized_path() (stable-fixes).\n- ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() (stable-fixes).\n- ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() (stable-fixes).\n- ACPICA: Fix condition check in acpi_ps_parse_loop() (stable-fixes).\n- ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) (stable-fixes).\n- ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() (stable-fixes).\n- ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() (stable-fixes).\n- ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg() (stable-fixes).\n- ACPICA: Prevent adding invalid references (stable-fixes).\n- ACPICA: validate byte_count in acpi_ps_get_next_package_length() (stable-fixes).\n- ACPICA: validate handler object type in two places (stable-fixes).\n- ALSA: 6fire: Clean ups with guard() (stable-fixes).\n- ALSA: 6fire: fix OOB write from device-reported iso length (git-fixes).\n- ALSA: aloop: Check card index validity at probe (stable-fixes).\n- ALSA: bcd2000: Fix race between rawmidi and disconnect (git-fixes).\n- ALSA: caiaq: unregister the input device when probe fails (git-fixes).\n- ALSA: core: Add scoped cleanup helper for card references (stable-fixes).\n- ALSA: core: Define auto-cleanup for snd_card_free() (stable-fixes).\n- ALSA: core: Fix potential UAF after asynchronous card release (stable-fixes).\n- ALSA: es18xx: check control allocation before private data setup (stable-fixes).\n- ALSA: hda/common: Use cleanup macros for PM controls (stable-fixes).\n- ALSA: hda/common: Use guard() for mutex locks (stable-fixes).\n- ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10 (stable-fixes).\n- ALSA: hda/core: Use guard() for mutex locks (stable-fixes).\n- ALSA: hda/realtek - Add quirk for HP Victus 15-fa0xxx (MB 8A50) (stable-fixes).\n- ALSA: hda/realtek: Add HDA_CODEC_QUIRK for Samsung 750XBE/730XBE (stable-fixes).\n- ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx (stable-fixes).\n- ALSA: hda/realtek: Add mute LED quirk for HP Victus 16-e0xxx (MB 88ED) (stable-fixes).\n- ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP EliteBook 830 G8 (8AB8) to enable mute LEDs (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP Pavilion x360 (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP Victus 16-e0xxx (88EE) to enable mute LED (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Xiaoxin 14 GT (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Yoga 7 16IAP7 (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IRH8 (stable-fixes).\n- ALSA: hda/realtek: Add StarFighter HDA SSID (stable-fixes).\n- ALSA: hda/realtek: Fix speakers on MECHREVO WUJIE Series (stable-fixes).\n- ALSA: hda/realtek: Limit Star Labs internal mic boost (stable-fixes).\n- ALSA: hda/tegra: Re-enable SDO workaround for Tegra194 (git-fixes).\n- ALSA: hda: Add Lenovo Legion 7i 16IAX7 17AA3874 quirk (stable-fixes).\n- ALSA: hda: cs35l56: Fail if wmfw file is missing (stable-fixes).\n- ALSA: hda: ext: Clean up links if their initialization fails (stable-fixes).\n- ALSA: hda: Introduce auto cleanup macros for PM (stable-fixes).\n- ALSA: hda: trace PCM open only after assigning a stream (git-fixes).\n- ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup (git-fixes).\n- ALSA: ice1712: Fix the error handling via auto-cleanup at probe (git-fixes).\n- ALSA: line6: reject oversized playback packets (git-fixes).\n- ALSA: mpu401: Check card index validity at probe (stable-fixes).\n- ALSA: mts64: Check card index validity at probe (stable-fixes).\n- ALSA: pcm: Fix race between non-atomic ops and trigger-start (stable-fixes).\n- ALSA: pcm: set timer-\u003eprivate_data before registering the PCM timer (git-fixes).\n- ALSA: portman2x4: Check card index validity at probe (stable-fixes).\n- ALSA: seq: oss: Reject reads that cannot fit the next event (stable-fixes).\n- ALSA: seq: Remove arbitrary prioq insertion limit (stable-fixes).\n- ALSA: seq: Serialize compat port-info ioctls (git-fixes).\n- ALSA: serial-u16550: Check card index validity at probe (stable-fixes).\n- ALSA: ua101: reject mismatched capture/playback packet sizes (git-fixes).\n- ALSA: ump: Copy FB name string more safely (stable-fixes).\n- ALSA: ump: Copy safe string name to rawmidi (stable-fixes).\n- ALSA: ump: Update rawmidi name per EP name update (stable-fixes).\n- ALSA: usb-audio: Add dB map quirk for Razer Barracuda X 2.4 (stable-fixes).\n- ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless (stable-fixes).\n- ALSA: usb-audio: Add quirk flags for SC13A (stable-fixes).\n- ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision) (stable-fixes).\n- ALSA: usb-audio: Add quirk for Novation Mininova (stable-fixes).\n- ALSA: usb-audio: Add quirk for YAMAHA CDS3000 (stable-fixes).\n- ALSA: usb-audio: caiaq: validate EP1 reply lengths (stable-fixes).\n- ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity (git-fixes).\n- ALSA: usb-audio: Optimize the copy of packet sizes for implicit fb handling (stable-fixes).\n- ALSA: usb: 6fire: Avoid embedded URBs (stable-fixes).\n- ALSA: usx2y: Drain pending US-428 pipe-4 output commands (stable-fixes).\n- ALSA: virmidi: Check card index validity at probe (stable-fixes).\n- ALSA: virtio: reset device before deleting virtqueues (git-fixes).\n- arm64: fixmap: Allow 256K early_ioremap() at any offset (git-fixes).\n- arm64: hibernate: clone only the linear map that exists at runtime (git-fixes).\n- arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc (git-fixes).\n- arm64: kprobes: Allow reentering kprobes while single-stepping (git-fixes).\n- arm64: mte: Fix PTRACE_{PEEK,POKE}MTETAGS error documentation (git-fixes).\n- arm64: percpu: Fix LSE operations on {8,16}-bit types (git-fixes).\n- arm64: percpu: Fix this_cpu_and() mask generation (git-fixes).\n- arm64: percpu: Fix this_cpu_write() casting (git-fixes).\n- arm64: Use load LSE atomics for the non-return per-CPU atomic operations (git-fixes).\n- ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for HyperX OMEN Gaming Laptop 16-ap1xxx (stable-fixes).\n- ASoC: codecs: aw88261: only check PLL and clock state at power-up (git-fixes).\n- ASoC: codecs: aw88261: reduce log spam (stable-fixes).\n- ASoC: codecs: max98363: fix uninitialized stream_config-\u003etype (git-fixes).\n- ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive (stable-fixes).\n- ASoC: codecs: rk3328: Use managed GPIO and clock helpers (stable-fixes).\n- ASoC: codecs: rt274: Fix format setting for 44100 rate (git-fixes).\n- ASoC: codecs: rt286: Revert delay value for jack setup (git-fixes).\n- ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config-\u003etype (git-fixes).\n- ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config-\u003etype (git-fixes).\n- ASoC: fsl-asoc-card: reduce WM8904 PLL ratio to meet frequency limit (stable-fixes).\n- ASoC: hdmi-codec: Report a change when the channel status moves (git-fixes).\n- ASoC: Intel: catpt: Complete coredump handling (stable-fixes).\n- ASoC: Intel: sof_sdw: Add quirks for new Dell laptops (stable-fixes).\n- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (stable-fixes).\n- ASoC: mediatek: mt8365-afe-pcm: fix possible NULL-pointer dereferences in mt8365_afe_suspend() (stable-fixes).\n- ASoC: qcom: lpass-cpu: use DAI table index for playback constraints (git-fixes).\n- ASoC: qcom: q6apm: return error code to consumers on failures (stable-fixes).\n- ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt (stable-fixes).\n- ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence (stable-fixes).\n- ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure (stable-fixes).\n- ASoC: rt712-sdca: reset codec at io_init to fix silent headphone (stable-fixes).\n- ASoC: rt5645: Perform the initial jack detect at probe (stable-fixes).\n- ASoC: tas2781: Update default register address to TAS2563 (stable-fixes).\n- ASoC: tegra: Fix ASRC Stream6 input threshold control (git-fixes).\n- ASoC: ti: omap3pandora: update board check to use DT compatible (stable-fixes).\n- ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments (git-fixes).\n- ASoC: wm8903: Move the DRC QR threshold to the register that holds it (git-fixes).\n- Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough (git-fixes).\n- Bluetooth: btintel_pcie: Add 50 ms delay before MAC init on BlazarIW (stable-fixes).\n- Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit (git-fixes).\n- Bluetooth: btintel_pcie: validate device-supplied DMA indices (git-fixes).\n- Bluetooth: btmtk: add MT7902 MCU support (stable-fixes).\n- Bluetooth: btmtk: Disable remote wakeup for MT7922/MT7925 (stable-fixes).\n- Bluetooth: btmtk: fix wrong status for short WMT FUNC_CTRL events (git-fixes).\n- Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access (git-fixes).\n- Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown (git-fixes).\n- Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU (stable-fixes).\n- Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU (stable-fixes).\n- Bluetooth: btusb: Add Mercusys MA530 for Realtek RTL8761BUV (stable-fixes).\n- Bluetooth: btusb: Add Realtek RTL8922AE VID/PID 0bda/d922 (stable-fixes).\n- Bluetooth: btusb: Add Realtek RTL8922AE VID/PID 0bda/d923 (stable-fixes).\n- Bluetooth: btusb: Add support for Intel Lizard Peak 2 (0x8087:0x0040) (stable-fixes).\n- Bluetooth: btusb: Add support for TP-Link TL-UB250 (stable-fixes).\n- Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV (stable-fixes).\n- Bluetooth: btusb: fix NXP IW610 composite device handling (stable-fixes).\n- Bluetooth: btusb: MT7922: Add VID/PID 0e8d/223c (stable-fixes).\n- Bluetooth: btusb: MT7925: Add VID/PID 0e8d/8c38 (stable-fixes).\n- Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices (git-fixes).\n- Bluetooth: btusb: Record matched usb_device_id into btusb_data (stable-fixes).\n- Bluetooth: btusb: refactor endpoint lookup (stable-fixes).\n- Bluetooth: coredump: Quiesce dump work on unregister (git-fixes).\n- Bluetooth: eir: validate service data length before reading UUID (git-fixes).\n- Bluetooth: hci_codec: validate vendor codec count length (git-fixes).\n- Bluetooth: hci_conn: fix CIS hold ownership on reuse (git-fixes).\n- Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (git-fixes).\n- Bluetooth: hci_core: Print number of packets in conn-\u003edata_q (stable-fixes).\n- Bluetooth: hci_sock: reject out-of-range OCF values (git-fixes).\n- Bluetooth: hci_sock: validate event length before filtering (git-fixes).\n- Bluetooth: hci_sync: Serialize local codec list cleanup (git-fixes).\n- Bluetooth: ISO: balance the parent hold in hci_bind_bis() (git-fixes).\n- Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() (git-fixes).\n- Bluetooth: ISO: release unused CIS holds after channel attach (git-fixes).\n- Bluetooth: ISO: set BT_LISTEN before requesting a BIG sync (git-fixes).\n- Bluetooth: L2CAP: validate connectionless PSM length (stable-fixes).\n- Bluetooth: L2CAP: validate frame length before control and FCS access (git-fixes).\n- Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel (git-fixes).\n- Bluetooth: mgmt: fix race in read_unconf_index_list() (git-fixes).\n- Bluetooth: Properly disable remote wakeup for MT7922/MT7925 on Ryzen platform (git-fixes).\n- Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup (git-fixes).\n- Bluetooth: RFCOMM: fix NULL dereference of dlc-\u003esession in RFCOMM_CONNINFO (git-fixes).\n- Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() (git-fixes).\n- Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (stable-fixes).\n- Bluetooth: SMP: reject Security Request over BR/EDR (git-fixes).\n- bnxt_en: Bound SW TPA IDs to prevent crashes (git-fixes).\n- bnxt_en: Fix potential data corruption with HW GRO/LRO (git-fixes).\n- bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (bsc#1283517).\n- bnxt_en: Only restore LRO if the device supports TPA (bsc#1283517).\n- bnxt_en: Write doorbell when linearizing skb fails (bsc#1283517).\n- bonding: crypto offload enabled, non-offload slave failover, rekey failed (bsc#1282823).\n- btrfs: do not force reloc root creation during qgroup_account_snapshot() (bsc#1275740).\n- btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag (bsc#1279116).\n- btrfs: tree-checker: validate INODE_REF's namelen (git-fixes).\n- config: cleanup azure and kvmsmall Cleanup azure and kvmsmall configs after following comments updated default\n  configs: 4229ca50b2b3 Disable CONFIG_BATMAN_ADV (jsc#PED-16892).\n- dmaengine: Add devm_dma_request_chan() (stable-fixes).\n- dmaengine: altera-msgdma: Use memcpy_toio for descriptor FIFO writes (stable-fixes).\n- dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc (stable-fixes).\n- dmaengine: Fix device kref underflow in dma_chan_put() (git-fixes).\n- dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() (git-fixes).\n- dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() (git-fixes).\n- dmaengine: sprd: Fix runtime PM reference leak in probe (git-fixes).\n- dmaengine: sun6i: fix non-atomic read of DMA position registers (git-fixes).\n- dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status (git-fixes).\n- dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() (git-fixes).\n- dmaengine: wait for RCU readers before releasing dma_device (git-fixes).\n- dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA (git-fixes).\n- dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order (git-fixes).\n- driver core: Export get_dev_from_fwnode() (stable-fixes).\n- drm/amd/display: Bump frame warning limit for clang builds of dml (stable-fixes).\n- drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend (git-fixes).\n- drm/amd/display: Check for sharpening case when calculating max vtaps for scaler (stable-fixes).\n- drm/amd/display: clean-up dead code in dml2_mall_phantom (stable-fixes).\n- drm/amd/display: Find link encoder for flexible DIG mapping cases (stable-fixes).\n- drm/amd/display: Fix CRC open failure during active rendering (stable-fixes).\n- drm/amd/display: Fix dc stream excess put in dm_update_crtc_state() (git-fixes).\n- drm/amd/display: Fix DPMS using partially updated pipe context (stable-fixes).\n- drm/amd/display: Initialize dsc_caps to 0 (stable-fixes).\n- drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC (git-fixes).\n- drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized (stable-fixes).\n- drm/amd/pm/si: Fix updating clock limits from power states (stable-fixes).\n- drm/amd/pm/si: Fix updating clock limits on AC/DC (git-fixes).\n- drm/amd/pm: bound pp_dpm_set_pp_table() memcpy (stable-fixes).\n- drm/amd/pm: Check SMUv13.0.6/12 metrics integrity (stable-fixes).\n- drm/amd/pm: hide pp_table sysfs on APUs (git-fixes).\n- drm/amdgpu: add a helper to calculate ring distance (stable-fixes).\n- drm/amdgpu: check ras and obj before dereference (git-fixes).\n- drm/amdgpu: check thunderbolt before switcheroo registration (stable-fixes).\n- drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages (bsc#1284146).\n- drm/amdgpu: Failed to check various return code (stable-fixes).\n- drm/amdgpu: fix ACP MFD device leak on init failure (git-fixes).\n- drm/amdgpu: fix buffer overflow during vBIOS update (stable-fixes).\n- drm/amdgpu: fix IP instance memory leak on kobject add failure (git-fixes).\n- drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init() (git-fixes).\n- drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show() (git-fixes).\n- drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init() (git-fixes).\n- drm/amdgpu: flush pending RCU callbacks on module unload (stable-fixes).\n- drm/amdgpu: harden FRU PIA parsing with bounded helpers (stable-fixes).\n- drm/amdgpu: Prefer ROM BAR for default VGA device (stable-fixes).\n- drm/amdgpu: Skip accessing psp rum time db for APUs (stable-fixes).\n- drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT (stable-fixes).\n- drm/amdgpu: Use system unbound workqueue for soft IH ring (stable-fixes).\n- drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw (stable-fixes).\n- drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id (stable-fixes).\n- drm/amdkfd: Check bounds on allocate_doorbell (stable-fixes).\n- drm/amdkfd: check find_first_zero_bit before __set_bit on kfd-\u003edoorbell_bitmap (stable-fixes).\n- drm/amdkfd: fix UAF race in destroy_queue_cpsch (stable-fixes).\n- drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl (stable-fixes).\n- drm/amdkfd: Reject zero-sized AQL queue allocations after size halving (stable-fixes).\n- drm/amdkfd: Unwind debug trap enable on copy_to_user failure (stable-fixes).\n- drm/arm/komeda: fix error handling for clk_prepare_enable() and callers (stable-fixes).\n- drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend (stable-fixes).\n- drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach (git-fixes).\n- drm/bridge: tc358768: Set pre_enable_prev_first for reverse order (stable-fixes).\n- drm/cirrus: Use video aperture helpers (stable-fixes).\n- drm/dp: Add DSC virtual DPCD quirk for Realtek MST branch device (stable-fixes).\n- drm/gem: Consider GEM object reclaimable if shrinking fails (stable-fixes).\n- drm/gma500: return errors from Oaktrail HDMI I2C reads (stable-fixes).\n- drm/gud: Add RCade Display Adapter VID/PID pair (stable-fixes).\n- drm/gud: fix out-of-bounds write in gud_plane_atomic_check() (git-fixes).\n- drm/i915/psr: Add new SU area calculation helper to apply workarounds (stable-fixes).\n- drm/i915/psr: Clear stale sel fetch enable bits on sel fetch disable (git-fixes).\n- drm/i915: fix incorrect RCU teardown order (git-fixes).\n- drm/i915: Guard against NULL driver_data in i915_pci_probe() (stable-fixes).\n- drm/imagination: clamp freelist reconstruction requests (git-fixes).\n- drm/imagination: Fix page count for page table for map() interface (git-fixes).\n- drm/imagination: Populate FW common context ID before passing to the FW (stable-fixes).\n- drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl() (git-fixes).\n- drm/logicvc: Drop the select of the nonexistent CONFIG_DRM_KMS_DMA_HELPER (git-fixes).\n- drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device (git-fixes).\n- drm/mediatek: dsi: Add compatible for mt8167-dsi (stable-fixes).\n- drm/mediatek: Fix ovl adaptor platform device leak (git-fixes).\n- drm/mediatek: Fix pdev reference leak in mtk_drm_bind() (git-fixes).\n- drm/msm/adreno: fix autosuspend cleanup during teardown (git-fixes).\n- drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL (git-fixes).\n- drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure (git-fixes).\n- drm/msm: Recover HW before retire hung submit (git-fixes).\n- drm/nouveau/bios: skip the IFR header if present (stable-fixes).\n- drm/nouveau/clk: don't clobber reclock status when restoring volt/fan (git-fixes).\n- drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update (git-fixes).\n- drm/nouveau/disp: don't reject HDMI config on cards without SCDC (git-fixes).\n- drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM (git-fixes).\n- drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() (git-fixes).\n- drm/nouveau: fix autosuspend cleanup during teardown (git-fixes).\n- drm/nouveau: Fix bridge reference leak in nv1a_ram_new() (git-fixes).\n- drm/nouveau: fix double-free in nvif_vmm_dtor (git-fixes).\n- drm/nouveau: Fix gem reference leak in validate_init() (git-fixes).\n- drm/nouveau: Fix runtime PM leak in nouveau_connector_detect() (git-fixes).\n- drm/nouveau: RCU-free the scheduler-containing nouveau_sched (git-fixes).\n- drm/omap: dsi: Do not copy isr table (git-fixes).\n- drm/panel: Enable GPIOLIB for panels which uses functions from it (stable-fixes).\n- drm/panel: jadard-jd9365da-h3: set prepare_prev_first (stable-fixes).\n- drm/panel: simple: Add AM-1280800W8TZQW-T00H (stable-fixes).\n- drm/radeon: Read the VRAM VBIOS signature with readb() (git-fixes).\n- drm/vc4: Use managed KMS polling to fix UAF on unbind (git-fixes).\n- drm/virtio: fix memory leak of fence event on execbuffer failure (git-fixes).\n- drm/virtio: fix NULL pointer dereference on fence allocation failure (git-fixes).\n- drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() (git-fixes).\n- drm/virtio: fix object leak when drm_gem_handle_create() fails (git-fixes).\n- drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() (git-fixes).\n- drm/virtio: release the GEM object on virtio_gpu_vram_create() errors (git-fixes).\n- drm/xe: Limit sg segment size to PAGE_SIZE on Xen PV (git-fixes).\n- drm/xe: Wait on external BO kernel fences in exec IOCTL (CVE-2026-74440 bsc#1261564).\n- drm: add drm_memory_stats_is_zero (stable-fixes).\n- drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr (git-fixes).\n- fbcon: don't suspend/resume when vc is graphics mode (stable-fixes).\n- fbdev: pm2fb: unwind WC setup on probe failure (stable-fixes).\n- fbdev: pvr2fb: correct user pointer annotation and sentinel initializer (stable-fixes).\n- firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size (stable-fixes).\n- firmware: arm_scmi: Validate SENSOR_UPDATE payload size (stable-fixes).\n- firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS (git-fixes).\n- firmware: qcom_scm: Rename peripheral as pas_id (stable-fixes).\n- firmware: stratix10-svc: change get provision data to async SMC call (stable-fixes).\n- firmware: stratix10-svc: fix FCS SMC call kernel-doc (git-fixes).\n- firmware: sysfb: Move bpp-depth calculation into screen_info helper (stable-fixes).\n- gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() (git-fixes).\n- gpio: dwapb: Mask interrupts at hardware initialization (stable-fixes).\n- gpio: pisosr: Read \"ngpios\" as u32 (stable-fixes).\n- gpio: tps65219: Fix GPIO input value reads (git-fixes).\n- gpio: virtuser: skip free_irq when no IRQ is installed (git-fixes).\n- gpio: zynq: fix runtime PM leak on request error path (git-fixes).\n- HID: alps: fix use-after-free on input2 registration failure (git-fixes).\n- HID: alps: unregister DualPoint Stick input device on remove (git-fixes).\n- HID: amd_sfh: Validate PCI BAR size before mapping (git-fixes).\n- HID: asus: fortify keyboard handshake (stable-fixes).\n- HID: bpf: Add Huion Inspiroy Frego M button quirk (stable-fixes).\n- HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request (git-fixes).\n- HID: bpf: fix __hid_bpf_hw_check_params report length (git-fixes).\n- HID: core: quiesce input in hid_hw_stop() to prevent use-after-free (stable-fixes).\n- HID: elecom: fix bus type for M-XGL20DLBK (git-fixes).\n- HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM (stable-fixes).\n- HID: hidpp: fix potential UAF in hidpp_connect_event() (stable-fixes).\n- HID: logitech-hidpp: fix race condition when accessing stale stack pointer (stable-fixes).\n- HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes (git-fixes).\n- HID: mcp2221: fix OOB write in mcp2221_raw_event() (stable-fixes).\n- HID: mcp2221: stop device IO before hid_hw_stop (git-fixes).\n- HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard (stable-fixes).\n- HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() (git-fixes).\n- host1x: bus: Fix missing ops null check in error teardown (stable-fixes).\n- hwmon: (adt7462) Add of_match_table to support devicetree (stable-fixes).\n- hwmon: (corsair-psu) Fix linear11 calculation (stable-fixes).\n- hwmon: (dell-smm) Add Dell Latitude 7530 to fan control whitelist (stable-fixes).\n- hwmon: (emc1403) Drop hysteresis for low limit temperature (git-fixes).\n- hwmon: (emc1403) Rely on subsystem locking (stable-fixes).\n- hwmon: (gpio-fan) return IRQ_HANDLED from the shared alarm IRQ handler (git-fixes).\n- hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show() (git-fixes).\n- hwmon: (hp-wmi-sensors) Improve raw WMI string handling (git-fixes).\n- hwmon: (ina2xx) Parameterize ina2xx_data in ina226_alert_read() (stable-fixes).\n- hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i (stable-fixes).\n- hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding (git-fixes).\n- hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676 (git-fixes).\n- hwmon: (raspberrypi) Fix delayed-work teardown race (stable-fixes).\n- hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove (git-fixes).\n- hwmon: (w83793) release probe data through kref (git-fixes).\n- i2c: at91: release DMA channels on remove and probe error (git-fixes).\n- i2c: atr: fix dangling adapter pointer on add failure (git-fixes).\n- i2c: imx: disable autosuspend on remove (git-fixes).\n- i2c: imx: release DMA channels on probe error (git-fixes).\n- i2c: mxs: fix DMA channel leak on probe error (git-fixes).\n- i2c: qcom-cci: fix device_node refcount leak in cci_probe()/cci_remove() (git-fixes).\n- i2c: qcom-cci: Remove the unused variable cci_clk_rate (git-fixes).\n- i2c: qcom-cci: Stop complaining about DT set clock rate (stable-fixes).\n- i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode (git-fixes).\n- i3c: mipi-i3c-hci: Quieten initialization messages (stable-fixes).\n- i3c: mipi-i3c-hci: Refactor PIO register initialization (stable-fixes).\n- i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc() (stable-fixes).\n- ibmveth: Add multi buffers rx replenishment hcall support (jsc#PED-16852).\n- ibmvnic: Increase max subcrq indirect entries with fallback (jsc#PED-16854).\n- ibmvnic: Use ndo_get_stats64 to fix inaccurate SAR reporting (jsc#PED-16854).\n- iio: accel: kionix-kx022a: Fix array boundary check (git-fixes).\n- iio: accel: kxcjk-1013: reject duplicate event disable (git-fixes).\n- iio: accel: mma8452: switch to non-devm request_threaded_irq() (stable-fixes).\n- iio: accel: sca3000: fix frequency divider condition check (git-fixes).\n- iio: adc: pac1934: check ACPI label duplication (git-fixes).\n- iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind (stable-fixes).\n- iio: adc: rtq6056: add i2c_device_id support (stable-fixes).\n- iio: adc: stm32-adc: fix check on internal channel availability (git-fixes).\n- iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure (git-fixes).\n- iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls (git-fixes).\n- iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind (git-fixes).\n- iio: admv1013: initialize callback mutex before registering notifier (git-fixes).\n- iio: buffer: Ensure bounce buffer used for unaligned case is zeroed (git-fixes).\n- iio: buffer: serialize buffer teardown with mode claims (git-fixes).\n- iio: frequency: admv1013: fix wrong channel field used in admv1013_read_raw() (git-fixes).\n- iio: gyro: adis16136: fix unprotected debugfs reads (git-fixes).\n- iio: health: max30102: fix NULL dereference in interrupt handler (git-fixes).\n- iio: imu: adis16400: fix unprotected debugfs reads (git-fixes).\n- iio: light: gp2ap020a00f: drain irq_work after free_irq (git-fixes).\n- iio: light: stk3310: Deal with the ps interrupt issue in PM (stable-fixes).\n- iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup (git-fixes).\n- iio: proximity: aw96103: validate firmware data length (git-fixes).\n- iio: proximity: isl29501: Fix return type of isl29501_register_write (git-fixes).\n- iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure (git-fixes).\n- iio: proximity: sx9324: Correct proximity channel resolution (git-fixes).\n- iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler (git-fixes).\n- iio: trigger: cancel reenable_work before freeing trigger (git-fixes).\n- Input: adp5588-keys - cache GPIO state before registering the gpiochip (git-fixes).\n- Input: aiptek - validate raw macro indices before updating state (stable-fixes).\n- Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 (git-fixes).\n- Input: cyttsp5 - clamp the HID report size before memcpy (git-fixes).\n- Input: eeti_ts - publish the OF module alias (git-fixes).\n- Input: evdev - zero absinfo before partial copy in EVIOCSABS (git-fixes).\n- Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P (stable-fixes).\n- Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() (git-fixes).\n- Input: s6sy761 - fix resume ordering and restore sensing (git-fixes).\n- Input: soc_button_array - check btns_desc-\u003epackage.count (git-fixes).\n- Input: soc_button_array - fix MS Surface Pro 11 probe failure (git-fixes).\n- Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) (stable-fixes).\n- Input: synaptics - limit T440p InterTouch quirk to LEN0036 (git-fixes).\n- Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound (git-fixes).\n- Input: trackpoint - fix the inertia attribute name in the ABI document (git-fixes).\n- Input: xpad - add support for Azeron devices (stable-fixes).\n- Input: xpad - add support for Victrix Pro BFG Controller (stable-fixes).\n- Input: xpad - fix PDP Marvel Xbox 360 controller (git-fixes).\n- Input: zero ff_effect before compat copy in input_ff_effect_from_user (git-fixes).\n- kernel-binary.spec.in: Emulate kabi.pl error when suse-kabi-tools is used.\n- kernel-binary.spec.in: Fix syntax error.\n- KEYS: encrypted: fix integer overflow of datablob_len (git-fixes).\n- keys: fix lost wakeup when reaping a dead key type (git-fixes).\n- keys: translate request_key_auth pid for the reading procfs instance (git-fixes).\n- KEYS: trusted: Fix tpm2_load_cmd() boundary check (git-fixes).\n- KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure (git-fixes).\n- KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve() (git-fixes).\n- KVM: arm64: vgic: Don't leak the SPI array when init is retried (git-fixes).\n- KVM: arm64: vgic: Prevent speculative SPI array underflow (git-fixes).\n- KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU (git-fixes).\n- KVM: nVMX: Always flush vpid02 on first use (git-fixes).\n- KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02 (git-fixes).\n- KVM: nVMX: Synthesize SHUTDOWN on RSM if L2 requires emulation (git-fixes).\n- KVM: VMX: Handle bad values on proxied writes to LBR MSRs (git-fixes).\n- KVM: VMX: Reject KVM_RUN if userspace forces emulation during nested VM-Enter (git-fixes).\n- KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy (git-fixes).\n- KVM: x86/pmu: Move Intel PMU global MSRs to intel_is_valid_msr() (git-fixes).\n- KVM: x86: Extract VMX's unhandleable emulation check to common x86 (git-fixes).\n- KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails (git-fixes).\n- leds: pca9532: Don't stop blinking for non-zero brightness (stable-fixes).\n- leds: trigger: gpio: Use GPIOD_FLAGS_BIT_NONEXCLUSIVE (stable-fixes).\n- leds: uleds: Return -EFAULT on copy_to_user() failure (stable-fixes).\n- media: chips-media: wave5: Add range checks for dec_output_info (stable-fixes).\n- media: chips-media: wave5: Fix Reports from Kernel Lock Validator (stable-fixes).\n- media: dm1105: fix missing error check for dma_alloc_coherent (stable-fixes).\n- media: em28xx-video: fix missing res_free() on init_usb_xfer failure (stable-fixes).\n- media: i2c: imx355: Replace client-\u003edev usage (stable-fixes).\n- media: imon: Add iMON VFD HID OEM v1.2 key mappings (stable-fixes).\n- media: imx355: Avoid calling imx355_power_off twice in error path (git-fixes).\n- media: qcom: camss: avoid format string warning (stable-fixes).\n- media: rc: mceusb: Add support for 04eb:e033 (stable-fixes).\n- media: video-i2c: fix buffer queue ordering (stable-fixes).\n- media: video-i2c: use vb2_video_unregister_device on driver removal (stable-fixes).\n- memstick: ms_block: destroy io_queue workqueue on removal (git-fixes).\n- mfd: db8500-prcmu: Fold dbx500 header into db8500 (git-fixes).\n- mfd: rsmu: Add 8a34002 support (stable-fixes).\n- mfd: tps65219: Make poweroff handler conditional on system-power-controller (stable-fixes).\n- mmc: core: Add validation for host-provided max_segs (stable-fixes).\n- mmc: core: Cancel SDIO IRQ work before freeing host (git-fixes).\n- mmc: core: Fix OF node reference leak on card add failure (git-fixes).\n- mmc: davinci: avoid NULL deref of host-\u003edata in IRQ handler (stable-fixes).\n- mmc: davinci: fix mmc_add_host order in probe (stable-fixes).\n- mmc: hsq: Fix use-after-free in retry work (git-fixes).\n- mmc: mmci: Fix use-after-free in busy-timeout work (git-fixes).\n- mmc: mxcmmc: cancel data work and watchdog on remove (git-fixes).\n- mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC (stable-fixes).\n- mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC (stable-fixes).\n- mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260 (stable-fixes).\n- mmc: sdhci-of-aspeed: Remove children before releasing SDC resources (git-fixes).\n- mmc: sdhci_am654: Clear ITAPDLY on tuning failure (git-fixes).\n- mmc: sdhci_am654: Fallback to DT-provided itap delay on DDR50 tuning failure (git-fixes).\n- mmc: sdhci_am654: Move tuning_loop to local variable (git-fixes).\n- mmc: sdhci_am654: Reset command and data lines on failed tuning (git-fixes).\n- mmc: sdio_uart: fix xmit_fifo leak when the port table is full (git-fixes).\n- mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt (git-fixes).\n- mmc: spi: reset bytes_xfered before retrying CRC failures (git-fixes).\n- mtd: block2mtd: Fix divide error when erase_size is zero (git-fixes).\n- mtd: core: avoid double-free of OTP NVMEM device (git-fixes).\n- mtd: core: call _get_device() with the master MTD (git-fixes).\n- mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ (git-fixes).\n- mtd: rawnand: pl353: Add message about ECC mode (stable-fixes).\n- mtd: rawnand: pl353: Fix debug prints (git-fixes).\n- mtd: rawnand: pl353: Make sure we use the monolithic helpers for raw accesses (git-fixes).\n- mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB (git-fixes).\n- mtd: spinand: fix zero oobavail when no ECC engine is used (git-fixes).\n- net/ibmveth: fix comment typos in ibmveth.c (jsc#PED-16852).\n- net: mana: Clear RDMA teardown and suspend state in mana_rdma_probe() (git-fixes).\n- net: mana: Reserve extra CQ slot for the fence completion CQE (git-fixes).\n- net: mana: restore the XDP program pointer when pre-allocation fails (git-fixes).\n- net: page_pool: Remove zone/policy GFP flags when allocating XArray entries (git-fixes).\n- net: usb: catc: bound the RX packet length in catc_rx_done() (git-fixes).\n- net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist (stable-fixes).\n- net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs() (git-fixes).\n- net: usb: pegasus: don't rely on id table pointer arithmetic (stable-fixes).\n- net: usb: qmi_wwan: add MeiG SRM813Q (stable-fixes).\n- net: usb: sr9700: include receive overhead in the length check (git-fixes).\n- net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value (git-fixes).\n- net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain (git-fixes).\n- net: wwan: t7xx: Add delay between MD and SAP suspend (stable-fixes).\n- net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() (git-fixes).\n- nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() (git-fixes).\n- nfc: llcp: fix -ENOMEM on connect with zero-length service name (git-fixes).\n- nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() (git-fixes).\n- nfc: llcp: Fix race condition in accept_queue lifecycle (git-fixes).\n- nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure (git-fixes).\n- nfc: llcp: fix slab-out-of-bounds reads when logging service names (git-fixes).\n- nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() (git-fixes).\n- nfc: nfcmrvl: validate helper command length before pull (git-fixes).\n- nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() (git-fixes).\n- nfc: port100: reject frames whose declared length exceeds the received data (git-fixes).\n- nfc: st21nfca: validate ISO15693 inventory length (git-fixes).\n- nfc: st21nfca: validate received frame size (git-fixes).\n- nfc: virtual_ncidev: Add missing ioctl compat handler (git-fixes).\n- PCI/MSI: Enable memory decoding before restoring MSI-X messages (git-fixes).\n- PCI/proc: Fix race between pci_proc_init() and pci_bus_add_device() (stable-fixes).\n- PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store() (stable-fixes).\n- PCI: Accept AtomicOps already enabled by the hypervisor (git-fixes).\n- PCI: altera: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: Avoid FLR for MediaTek MT7925 WiFi (stable-fixes).\n- PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems (stable-fixes).\n- PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk (git-fixes).\n- PCI: iproc: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: mediatek: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: of_property: Omit bus properties without a subordinate bus (git-fixes).\n- PCI: plda: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: rockchip: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: Stop setting cached power state to 'unknown' on unbind (stable-fixes).\n- PCI: switchtec: Add Gen6 Device IDs (stable-fixes).\n- PCI: Wait for device readiness after D3hot -\u003e D0uninitialized transition (stable-fixes).\n- PCI: xgene: Drop unnecessary OF node reference (git-fixes).\n- PCI: xgene: Drop XGENE_PCIE_IP_VER_UNKN (stable-fixes).\n- phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow (git-fixes).\n- phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting (git-fixes).\n- pinctrl: meson: Fix typo in s4 group name (git-fixes).\n- pinctrl: single: free the IRQ on domain creation failure (git-fixes).\n- pinctrl: sunxi: keep a shadow copy of the data register output latches (git-fixes).\n- platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table (stable-fixes).\n- platform/x86: hp-bioscfg: bound ordered-list parsing by the package count (stable-fixes).\n- platform/x86: hp-bioscfg: pass validated element count to package parsers (stable-fixes).\n- platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table (stable-fixes).\n- platform/x86: ISST: Check for admin capability for write commands (stable-fixes).\n- platform/x86: ISST: Validate max level for set feature (git-fixes).\n- platform/x86: msi-ec: Add support for MSI Pulse GL66 12th Gen (stable-fixes).\n- platform/x86: sel3350-platform: Retain LED state on load and unload (stable-fixes).\n- platform/x86: think-lmi: improve check if BIOS account security enabled (stable-fixes).\n- power: sequencing: don't call .post_enable() if pwrseq_unit_enable() failed (git-fixes).\n- power: sequencing: fix NULL-pointer dereference in pwrseq_device_register() (git-fixes).\n- power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new() (git-fixes).\n- power: supply: ab8500_fg: fix use-after-free on remove (git-fixes).\n- power: supply: ab8500_fg: Remove redundant dev_err()/dev_err_probe() (stable-fixes).\n- powerpc/crash: stop watchdogs before booting kdump kernel (bsc#1277705 ltc#220979).\n- powerpc/perf: Add power12 Base Performance Monitoring support (jsc#PED-16906).\n- powerpc/pseries: Handle and log pseries-wdt registration failures (bsc#1277705 ltc#220979).\n- powerpc/pseries: Limit PVR list to 16 entries for CAS negotiation (jsc#PED-16906).\n- powerpc/pseries: Move H_WATCHDOG definitions to a common header (bsc#1277705 ltc#220979).\n- powerpc: Add Power12 architected mode (jsc#PED-16906).\n- powerpc: Add Power12 raw mode (jsc#PED-16906).\n- procfs: fix possible double mmput() in do_procmap_query() (git-fixes).\n- RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations (git-fixes).\n- RDMA/core: Fix potential use after free in counter_release() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_dealloc_pd_user() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_destroy_cq_user() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_destroy_srq_user() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_free_cq() (git-fixes).\n- RDMA/core: Fix use after free in ib_query_qp() (git-fixes).\n- RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup (git-fixes).\n- RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables (git-fixes).\n- RDMA/hfi1: Align probe error unwinding with device removal (git-fixes).\n- RDMA/hfi1: Allocate device data after PCI initialization (git-fixes).\n- RDMA/hfi1: Create workqueues before device initialization (git-fixes).\n- RDMA/hfi1: Defer device creation until probe succeeds (git-fixes).\n- RDMA/hfi1: Drop device data from hfi1_validate_rcvhdrcnt() (git-fixes).\n- RDMA/hfi1: Free RX data on late probe failure (git-fixes).\n- RDMA/hfi1: Initialize debugfs after probe completes (git-fixes).\n- RDMA/hfi1: Pass PCI device to hfi1_pcie_init() (git-fixes).\n- RDMA/hfi1: Preserve unit 0 on (git-fixes).\n- RDMA/hfi1: Remove redundant NULL checks in create_workqueues() (git-fixes).\n- RDMA/hfi1: Remove redundant PCI device ID validation (git-fixes).\n- RDMA/hfi1: Stop flushing the global IB workqueue (git-fixes).\n- RDMA/irdma: Add a refcount to track user ring MR associations (git-fixes).\n- RDMA/irdma: Add irdma_cq fields to track pbl allocations (git-fixes).\n- RDMA/irdma: Deduplicate the irdma_del_memlist logic (git-fixes).\n- RDMA/rvt: Return NULL after port allocation failure (git-fixes).\n- regulator: core: clamp voltage constraints before applying apply_uV (stable-fixes).\n- regulator: da9121: Use subvariant ids in the I2C table (stable-fixes).\n- ring-buffer: Add helper functions for allocations (bsc#1277895 bsc#1280334).\n- ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() (bsc#1277896).\n- ring-buffer: Simplify functions with __free(kfree) to free allocations (bsc#1277895 bsc#1280334).\n- rtc: ac100: Assign .num before accessing .hws (git-fixes).\n- rtc: aspeed: add AST2700 compatible (stable-fixes).\n- rtc: bq32000: add delay between RTC reads (stable-fixes).\n- rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak (git-fixes).\n- rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe() (git-fixes).\n- rtc: mv: add suspend/resume support for wakeup (stable-fixes).\n- rtc: spear: initialize IRQ state before requesting alarm IRQ (git-fixes).\n- selftests: fib_nexthops: do not mark skipped tests as failed (bsc#1283296).\n- serial: 8250: fix possible ISR soft lockup (stable-fixes).\n- serial: 8250_bcm7271: fix use-after-free in brcmuart_remove() (git-fixes).\n- serial: fix TIOCMIWAIT race (git-fixes).\n- serial: ma35d1: Fix clock reference leak in ma35d1serial_probe() (git-fixes).\n- serial: sc16is7xx: fix TX gap caused by kfifo circular buffer wrap-around (git-fixes).\n- serial: sc16is7xx: refill TX FIFO below trigger using fresh TXLVL (git-fixes).\n- serial: tegra: don't clear the Tx FIFO on an Rx-only reset (git-fixes).\n- serial: vt8500: Fix clock reference leak in vt8500_serial_probe() (git-fixes).\n- smb: client: reject overlapping data areas in SMB2 responses (git-fixes).\n- soc: qcom: geni-se: Correct QUP Core ICC vote constants (git-fixes).\n- soundwire: cadence_master: wait and cancel cdns-\u003ework before clock stop (git-fixes).\n- soundwire: dmi-quirks: Disable ghost Realtek devices (stable-fixes).\n- soundwire: intel: Move suspend tracking from trigger to pm suspend (stable-fixes).\n- soundwire: intel_auxdevice: Add cs42l43b to wake_capable_list (stable-fixes).\n- soundwire: only handle alert events when the peripheral is attached (stable-fixes).\n- soundwire: validate DT compatible before parsing it (stable-fixes).\n- spi: dw-dma: Wait for controller idle before completing Tx (git-fixes).\n- spi: dw-mmio: Add ACPI ID LECA0002 for LECARC SoCs (stable-fixes).\n- spi: dw: fix wrong RX_SAMPLE_DLY setting after resume (git-fixes).\n- spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM (stable-fixes).\n- spi: xilinx: let transfers timeout in case of no IRQ (stable-fixes).\n- thermal/drivers/qcom/tsens: Atomic temperature read with hardware-guided retries (stable-fixes).\n- thermal/drivers/tegra/soctherma: Switch to devm cooling device registration (stable-fixes).\n- thermal: gov_step_wise: Fix stale mitigation vote with non-zero lower bounds (git-fixes).\n- thunderbolt: Avoid reserved fields in path config space for USB4 routers (stable-fixes).\n- thunderbolt: Don't access path config space on Lane 1 adapters in tb_switch_reset_host() (stable-fixes).\n- thunderbolt: Don't disable lane adapter if XDomain lane bonding isn't possible (stable-fixes).\n- thunderbolt: Fix KASAN reported use-after-free when request is canceled (git-fixes).\n- thunderbolt: Improve multi-display DisplayPort tunnel allocation (stable-fixes).\n- thunderbolt: Increase timeout for Configuration Ready bit (stable-fixes).\n- thunderbolt: Keep the domain reference while processing hotplug (stable-fixes).\n- thunderbolt: Keep XDomain reference during the lifetime of a service (stable-fixes).\n- thunderbolt: Reject oversized XDomain properties responses (git-fixes).\n- thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() (stable-fixes).\n- thunderbolt: Set tb-\u003eroot_switch to NULL when domain is stopped (stable-fixes).\n- thunderbolt: Verify Router Ready bit is set after router enumeration (stable-fixes).\n- tpm: Disable TPM on null key name mismatch (git-fixes).\n- tty: serial: max3100: shut down timer before freeing port (git-fixes).\n- tty: serial: qcom_geni_serial: Keep console RX functional after deep idle (git-fixes).\n- tty: vt: fix memory leak in vc_allocate() (git-fixes).\n- usb-storage: ene_ub6250: fix race between scan work and probe (stable-fixes).\n- USB: cdc-acm: fix racy TIOCMIWAIT implementation (git-fixes).\n- USB: cdc-acm: skip URB restart in port_shutdown if disconnected (git-fixes).\n- USB: cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set (stable-fixes).\n- usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe (git-fixes).\n- usb: cdns3: fix use-after-free in cdns3_gadget_exit() (git-fixes).\n- usb: cdns3: rename hibernated argument of role-\u003eresume() to lost_power (stable-fixes).\n- usb: chipidea: tegra: disable runtime PM on resume failure (git-fixes).\n- usb: core: clear both ep_in and ep_out for non-ep0 control endpoints (git-fixes).\n- usb: core: hcd: fix possible deadlock in rh control transfers (stable-fixes).\n- usb: dwc3: am62: Fix runtime PM usage count leak on probe error path (git-fixes).\n- usb: gadget: aspeed-vhub: cancel wake work on device removal (git-fixes).\n- usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue (stable-fixes).\n- USB: gadget: dummy-hcd: Fix wait for outstanding request completions (git-fixes).\n- usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC (git-fixes).\n- usb: gadget: f_fs: Fix Use-After-Free in AIO error path (git-fixes).\n- usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd (git-fixes).\n- USB: gadget: ffs: fix mm lifetime handling (stable-fixes).\n- USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() (stable-fixes).\n- usb: gadget: goku_udc: avoid NULL deref of dev-\u003edriver in INT_USBRESET log (stable-fixes).\n- usb: gadget: midi2: Fix the jack descriptor array sizes (git-fixes).\n- usb: gadget: udc: skip pullup() if already connected (stable-fixes).\n- usb: host: add ARCH_AIROHA in XHCI MTK dependency (stable-fixes).\n- usb: hub: use shorter 120ms post resume hold for SS root hubs (git-fixes).\n- usb: image: mdc800: change kmalloc() to kzalloc() (stable-fixes).\n- usb: octeon-hcd: fix the FIFO-flush timeout computation (git-fixes).\n- usb: ohci-da8xx: disable controller wakeup on cleanup (git-fixes).\n- usb: ohci-s3c2410: disable controller wakeup on removal (git-fixes).\n- usb: ohci-st: disable controller wakeup on removal (git-fixes).\n- USB: serial: fix driver deregistration order (git-fixes).\n- USB: serial: fix dynamic id driver deregistration race (git-fixes).\n- USB: serial: fix ioctl hangup race (git-fixes).\n- USB: serial: fix port tear down use-after-free (git-fixes).\n- USB: serial: quatech2: fix baud rate overflow (git-fixes).\n- usb: serial: spcp8x5: don't store usb_device_id (stable-fixes).\n- USB: serial: ssu100: fix baud rate overflow (git-fixes).\n- usb: storage: sierra_ms: reject short SWoC info transfers (git-fixes).\n- usb: typec: anx7411 - stop the IRQ before destroying the workqueue (git-fixes).\n- usb: typec: tcpm: recover after failure to start the frs ams (git-fixes).\n- usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() (git-fixes).\n- usb: typec: ucsi: displayport: Current CAM OOB index fixup (git-fixes).\n- usb: typec: ucsi: Get the connector fwnode based on reg value (git-fixes).\n- usb: typec: ucsi: glink: fix use-after-free of ucsi on remove (git-fixes).\n- usb: usbtmc: don't store usb_device_id (stable-fixes).\n- usb: xhci: Improve Soft Retries after short transfers (stable-fixes).\n- usb: xhci: use cached HCSPARAMS1 value (stable-fixes).\n- usb: xusbatm: don't rely on id table pointer arithmetic (stable-fixes).\n- usbip: vhci_hcd: fix NULL deref in status_show_vhci (stable-fixes).\n- vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF (git-fixes).\n- vt: skip screen update for DEC alignment test on backgroup consoles (git-fixes).\n- watchdog: da9062: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes).\n- watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes).\n- watchdog: digicolor: Avoid division by zero (git-fixes).\n- watchdog: imx7ulp_wdt: Keep WDOG running until A55 enters WFI on i.MX94 (stable-fixes).\n- watchdog: lenovo_se10_wdt: Add support for SE10 Gen 2 platform (stable-fixes).\n- watchdog: lenovo_se10_wdt: Fix use-after-free and resource leak risk (stable-fixes).\n- watchdog: msc313e: Fix premature reset during timeout update (git-fixes).\n- watchdog: msc313e: Propagate error code in resume() (git-fixes).\n- watchdog: rtd119x: Avoid division by zero (git-fixes).\n- watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init() (git-fixes).\n- watchdog: starfive-wdt: Fix runtime PM leak in starfive_wdt_pm_start() (git-fixes).\n- wifi: ath9k_htc: don't store usb_device_id (stable-fixes).\n- wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all() (git-fixes).\n- wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi (stable-fixes).\n- wifi: ath11k: fix stride mismatch in mac_phy_caps_parse() (git-fixes).\n- wifi: ath12k: fix stride mismatch in mac_phy_caps_parse() (git-fixes).\n- wifi: brcmfmac: fix lost 802.1x TX completion wakeup (git-fixes).\n- wifi: brcmsmac: fix UAF in brcms_free_timer() (git-fixes).\n- wifi: cfg80211: check IP header size in cfg80211_classify8021d() (git-fixes).\n- wifi: cfg80211: don't filter by BSS type when removing stale entries (git-fixes).\n- wifi: cfg80211: don't get the radio mask for netdev-less wdevs (git-fixes).\n- wifi: cfg80211: expose cfg80211_chandef_get_width() (stable-fixes).\n- wifi: cfg80211: fix width unit in cfg80211_radio_chandef_valid() (git-fixes).\n- wifi: cfg80211: only group hidden BSSes with beacon entries (git-fixes).\n- wifi: cfg80211: reject duplicate wiphy cipher suite entries (stable-fixes).\n- wifi: cfg80211: skip regulatory for punctured subchannels (stable-fixes).\n- wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() (stable-fixes).\n- wifi: cfg80211: validate rx/tx MLME callback frame lengths before access (stable-fixes).\n- wifi: iwlegacy: fix broadcast stations deallocation (git-fixes).\n- wifi: iwlwifi: acpi: validate WGDS table revision index (stable-fixes).\n- wifi: iwlwifi: bound aligned TLV advance in FW parser (stable-fixes).\n- wifi: iwlwifi: mvm: add a check on the tid coming from the firmware (stable-fixes).\n- wifi: iwlwifi: mvm: fix a possible underflow (stable-fixes).\n- wifi: iwlwifi: mvm: fix an off-by-1 boundary check (stable-fixes).\n- wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif (stable-fixes).\n- wifi: iwlwifi: mvm: fix sched scan IE sizing (stable-fixes).\n- wifi: iwlwifi: mvm: parse beacon notif per layout (stable-fixes).\n- wifi: iwlwifi: mvm: validate mac_link_id in session protect notif (stable-fixes).\n- wifi: iwlwifi: mvm: validate sta_id in BA window status notif (stable-fixes).\n- wifi: iwlwifi: mvm: validate TX_CMD response layout (stable-fixes).\n- wifi: libertas: reject short monitor TX frames (stable-fixes).\n- wifi: libipw: fix key index receive bound checks (stable-fixes).\n- wifi: libipw: reject too-short association responses (git-fixes).\n- wifi: libipw: reject too-short beacon and probe responses (git-fixes).\n- wifi: mac80211: abort chanswitch when leaving a mesh (git-fixes).\n- wifi: mac80211: add HE 6 GHz capability in the scan elems len (git-fixes).\n- wifi: mac80211: always allow transmitting null-data on TXQs (stable-fixes).\n- wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver (git-fixes).\n- wifi: mac80211: don't access the TSF of a down interface (git-fixes).\n- wifi: mac80211: don't allow injecting frames wider than the chanctx (git-fixes).\n- wifi: mac80211: don't allow link changes when iface is down (git-fixes).\n- wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed (stable-fixes).\n- wifi: mac80211: don't offload TC setup on AP_VLAN interfaces (git-fixes).\n- wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set (git-fixes).\n- wifi: mac80211: don't start a ROC while scanning (git-fixes).\n- wifi: mac80211: explicitly disable FTM responder on AP stop (stable-fixes).\n- wifi: mac80211: ibss: wait for in-flight TX on disconnect (stable-fixes).\n- wifi: mac80211: mesh: release the channel if start fails (git-fixes).\n- wifi: mac80211: mesh: reset the CSA state when leaving (git-fixes).\n- wifi: mac80211: only operate on TDLS peers in the TDLS code (git-fixes).\n- wifi: mac80211: require a peer station for TDLS setup confirm (git-fixes).\n- wifi: mac80211: reset state when starting AP fails (git-fixes).\n- wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown (git-fixes).\n- wifi: mac80211: set up the TX info early to fix failure paths (git-fixes).\n- wifi: mac80211: suppress chanctx warning for debugfs reset (git-fixes).\n- wifi: mac80211: unlist vifs when their netdev is unregistered (git-fixes).\n- wifi: mac80211: validate deauth frame length before reason access (stable-fixes).\n- wifi: mt76: add init_wiphy callback (stable-fixes).\n- wifi: mt76: mt7915: set correct background radar capability (stable-fixes).\n- wifi: mt76: mt7925: add 320MHz bandwidth to bss_rlm_tlv (stable-fixes).\n- wifi: mt76: mt7925: add Netgear A8500 USB device ID (stable-fixes).\n- wifi: mt76: mt7925: advertise EHT 320MHz capabilities for 6GHz band (stable-fixes).\n- wifi: mt76: mt7925: Fix EHT Beamformee SS subfields to meet 802.11be minimum (git-fixes).\n- wifi: mt76: mt7925: handle 320MHz bandwidth in RXV and TXS (stable-fixes).\n- wifi: mt76: mt7925: populate EHT 320MHz MCS map in sta_rec (stable-fixes).\n- wifi: mt76: transform aspm_conf for pci_disable_link_state (stable-fixes).\n- wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length (git-fixes).\n- wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path (git-fixes).\n- wifi: mwifiex: prevent authentication frame length truncation (git-fixes).\n- wifi: mwifiex: replace one-element arrays with flexible array members (stable-fixes).\n- wifi: mwifiex: validate action frame fixed fields (git-fixes).\n- wifi: mwifiex: validate scan response extents (git-fixes).\n- wifi: nl80211: reject beacons with bad HE operation (stable-fixes).\n- wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST (git-fixes).\n- wifi: p54: validate curve data length in the calibration curve converters (git-fixes).\n- wifi: ralink: RT2X00: init EEPROM properly (stable-fixes).\n- wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers (stable-fixes).\n- wifi: rsi: fix heap OOB write on key removal (git-fixes).\n- wifi: rsi: validate beacon length before fixed buffer copy (stable-fixes).\n- wifi: rtw88: Add NULL check for chip-\u003eedcca_th in rtw_fw_adaptivity_result() (stable-fixes).\n- wifi: rtw88: Fix the random \"error beacon valid\" messages for USB (stable-fixes).\n- wifi: rtw88: TX QOS Null data the same way as Null data (stable-fixes).\n- wifi: rtw89: cleanup unused rtwdev::roc_work (stable-fixes).\n- wifi: rtw89: disable CSI STBC for VHT 160MHz (stable-fixes).\n- wifi: rtw89: Hide some errors when the device is unplugged (stable-fixes).\n- wifi: rtw89: pci: enable LTR based on pcie control register (stable-fixes).\n- wifi: rtw89: phy: check length before parsing PHY status IE (stable-fixes).\n- wifi: virt_wifi: don't transfer operstate before register (git-fixes).\n- wifi: virt_wifi: free skb when disconnected (git-fixes).\n- wifi: wilc1000: fix out-of-bounds read in P2P public action frames (git-fixes).\n- wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() (git-fixes).\n- wifi: wlcore: release runtime PM ref on regdomain config failure (git-fixes).\n- xhci: Prevent queuing new commands if xhci is inaccessible (stable-fixes).\n","status":"published","published":"2026-10-12T13:24:33Z","modified":"2026-10-20T17:23:58.081470941Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24184-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2025-40136: crypto: hisilicon/qm - request reserved interrupt for virtual function (bsc#1253340).\n- CVE-2026-23199: procfs: avoid fetching build ID while holding VMA lock (bsc#1258335).\n- CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).\n- CVE-2026-43210: tracing: ring-buffer: Fix to check event length before using (bsc#1264330).\n- CVE-2026-43272: ring-buffer: Fix possible dereference of uninitialized pointer (bsc#1264607).\n- CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).\n- CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).\n- CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).\n- CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).\n- CVE-2026-46272: coresight: tmc-etr: Fix race condition between sysfs and perf mode (bsc#1267672).\n- CVE-2026-53377: drm/msm: always recover the gpu (bsc#1271901).\n- CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).\n- CVE-2026-63838: ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] (bsc#1272388).\n- CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).\n- CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check\n  (bsc#1272890).\n- CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).\n- CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).\n- CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).\n- CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).\n- CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).\n- CVE-2026-64132: ipv6: ioam: refresh hdr pointer before ioam6_event() (bsc#1272347).\n- CVE-2026-64154: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() (bsc#1271950).\n- CVE-2026-64173: tracing: Do not call map-\u003eops-\u003eelt_free() if elt_alloc() fails (bsc#1272145).\n- CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).\n- CVE-2026-64216: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() (bsc#1272802).\n- CVE-2026-64235: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines (bsc#1272803).\n- CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).\n- CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).\n- CVE-2026-64324: udf: validate free block extents against the partition length (bsc#1273970).\n- CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).\n- CVE-2026-64377: cpufreq: qcom-cpufreq-hw: Fix possible double free (bsc#1273297).\n- CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).\n- CVE-2026-64402: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (bsc#1273258).\n- CVE-2026-64405: Bluetooth: separate CIS_LINK and BIS_LINK link types (bsc#1273512).\n- CVE-2026-64414: netfilter: handle unreadable frags (bsc#1273275).\n- CVE-2026-64418: mm: shrinker: fix shrinker_info teardown race with expansion (bsc#1273784).\n- CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).\n- CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).\n- CVE-2026-64457: virtio_pci: fix vq info pointer lookup via wrong index (bsc#1273491).\n- CVE-2026-64473: vfio: Remove device debugfs before releasing devres (bsc#1273320).\n- CVE-2026-64474: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (bsc#1274316).\n- CVE-2026-64475: vfio/pci: Release the VGA arbiter client on register_device() failure (bsc#1274319).\n- CVE-2026-64476: vfio/pci: Latch disable_idle_d3 per device (bsc#1274245).\n- CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037).\n- CVE-2026-64594: usb: gadget: f_fs: initialize reset_work at allocation time (bsc#1274538).\n- CVE-2026-64597: smb: client: fix double-free in SMB2_close() replay (bsc#1274297).\n- CVE-2026-64598: smb/client: Fix error code in smb2_aead_req_alloc() (bsc#1274298).\n- CVE-2026-68146: ftrace: Add global mutex to serialize trace_parser access (bsc#1274890).\n- CVE-2026-68264: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (bsc#1275142).\n- CVE-2026-68266: drm/xe: Hold a dma-buf reference for imported BOs (bsc#1275137).\n- CVE-2026-68290: rds: tcp: unregister sysctl before tearing down listen socket (bsc#1275977).\n- CVE-2026-68312: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (bsc#1274663).\n- CVE-2026-68343: smb: client: validate DFS referral PathConsumed (bsc#1274629).\n- CVE-2026-68367: usb: gadget: f_tcm: synchronize delayed set_alt with teardown (bsc#1275170).\n- CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).\n- CVE-2026-68382: drm/xe/guc: Hold device ref until queue teardown completes (bsc#1274824).\n- CVE-2026-68385: s390/checksum: Fix csum_partial() without vector facility (bsc#1274818).\n- CVE-2026-68400: KVM: arm64: Mask response to FFA_FEATURE call (bsc#1274912).\n- CVE-2026-68441: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains (bsc#1274776).\n- CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests (bsc#1276287).\n- CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests (bsc#1276295).\n- CVE-2026-68454: KVM: s390: pci: Fix handling of AIF enable without AISB (bsc#1276388).\n- CVE-2026-68471: wifi: ieee80211: validate MLE common info length (bsc#1276504).\n- CVE-2026-68477: ipvs: fix more places with wrong ipv6 transport offsets (bsc#1275495).\n- CVE-2026-72012: tracing/osnoise: Call synchronize_rcu() when unregistering (bsc#1276783).\n- CVE-2026-72018: dibs: loopback: validate offset and size in move_data() (bsc#1276852).\n- CVE-2026-72025: s390/monwriter: Reject buffer reuse with different data length (bsc#1276923).\n- CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).\n- CVE-2026-72070: wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() (bsc#1277153).\n- CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).\n- CVE-2026-72102: dm_early_create: fix freeing used table on dm_resume failure (bsc#1277314).\n- CVE-2026-72128: nvmet: fix refcount leak in nvmet_sq_create() (bsc#1277101).\n- CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).\n- CVE-2026-72130: nvmet-auth: reject short AUTH_RECEIVE buffers (bsc#1275549).\n- CVE-2026-72147: dmaengine: dw-edma-pcie: Reject devices without driver data (bsc#1277234).\n- CVE-2026-72166: net/9p: fix infinite loop in p9_client_rpc on fatal signal (bsc#1277556).\n- CVE-2026-72218: lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure (bsc#1277218).\n- CVE-2026-72219: lockd: Plug nlm_file leak when nlm_do_fopen() fails (bsc#1277217).\n- CVE-2026-72224: nvdimm/btt: Free arenas on btt_init() error paths (bsc#1277215).\n- CVE-2026-72237: perf/x86/amd/brs: Fix kernel address leakage (bsc#1277615).\n- CVE-2026-72247: netfilter: nf_conncount: fix zone comparison in tuple dedup (bsc#1277662).\n- CVE-2026-72256: netfilter: xt_cluster: reject template conntracks in hash match (bsc#1277674).\n- CVE-2026-72299: tipc: restrict socket queue dumps in enqueue tracepoints (bsc#1275924).\n- CVE-2026-72321: ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() (bsc#1277143).\n- CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).\n- CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).\n- CVE-2026-72349: netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() (bsc#1277784).\n- CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).\n- CVE-2026-72352: HID: bpf: Fix hid_bpf_get_data() range check (bsc#1277823).\n- CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).\n- CVE-2026-72392: ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump (bsc#1277128).\n- CVE-2026-72404: tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() (bsc#1278031).\n- CVE-2026-72406: net: sungem: fix probe error cleanup (bsc#1278035).\n- CVE-2026-72413: sctp: fix err_chunk memory leaks in INIT handling (bsc#1277122).\n- CVE-2026-72433: netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (bsc#1278053).\n- CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped (bsc#1278054).\n- CVE-2026-72435: netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() (bsc#1278056).\n- CVE-2026-72436: netfilter: ipset: Fix data race between add and dump in all hash types (bsc#1277245).\n- CVE-2026-72444: flow_dissector: check device type before reading ETH_ADDRS (bsc#1278100).\n- CVE-2026-72447: sctp: hold socket lock when dumping endpoints in sctp_diag (bsc#1277109).\n- CVE-2026-72491: net/9p: fix race condition on rdma-\u003estate in trans_rdma.c (bsc#1276947).\n- CVE-2026-74256: bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check (bsc#1276535).\n- CVE-2026-74257: sockmap: Fix use-after-free in udp_bpf_recvmsg() (bsc#1276532).\n- CVE-2026-74258: bpf: Guard __get_user acesss with access_ok for uprobe_multi data (bsc#1276538).\n- CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen\n  (bsc#1276519).\n- CVE-2026-74268: tcp: clear sock_ops cb flags before force-closing a child socket (bsc#1276508).\n- CVE-2026-74281: tipc: reject inverted service ranges from peer bindings (bsc#1276474).\n- CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators (bsc#1276475).\n- CVE-2026-74288: net: fib_rules: Don't dump dying fib_rule in fib_rules_dump() (bsc#1276460).\n- CVE-2026-74289: ipv4: fib: Don't dump dying fib_info in fib_leaf_notify() (bsc#1276461).\n- CVE-2026-74290: net/sched: cls_flow: Dont expose folded kernel pointers (bsc#1276462).\n- CVE-2026-74330: configfs: fix lockless traversals of -\u003es_children (bsc#1277129).\n- CVE-2026-74356: vhost: fix vhost_get_avail_idx for a non empty ring (bsc#1278063).\n- CVE-2026-74359: configfs_lookup(): don't leave -\u003es_dentry dangling on failure (bsc#1278067).\n- CVE-2026-74365: nvdimm/btt: Handle preemption in BTT lane acquisition (bsc#1278225).\n- CVE-2026-74376: md/raid10: reset read_slot when reusing r10bio for discard (bsc#1277401).\n- CVE-2026-74384: nvme-multipath: fix flex array size in struct nvme_ns_head (bsc#1277405).\n- CVE-2026-74385: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock (bsc#1278255).\n- CVE-2026-74386: nvmet-tcp: fix page fragment cache leak in error path (bsc#1277098).\n- CVE-2026-74389: RDMA/hns: Fix log flood after cmd_mbox failure (bsc#1278087).\n- CVE-2026-74391: tracing: Bound synthetic-field strings with seq_buf (bsc#1278091).\n- CVE-2026-74398: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (bsc#1277410).\n- CVE-2026-74440: drm/xe: Wait on external BO kernel fences in exec IOCTL (bsc#1261564).\n- CVE-2026-74449: drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport (bsc#1278215).\n- CVE-2026-74450: drm/amd/pm: fix pptable use-after-free (bsc#1278216).\n- CVE-2026-74465: net: openvswitch: fix potential UAF on meter attach failure (bsc#1277801).\n- CVE-2026-74467: s390/qeth: Check CAP_NET_ADMIN for private ioctls (bsc#1277805).\n- CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1277792).\n- CVE-2026-74471: tracing: Check return value of __register_event() in trace_module_add_events() (bsc#1277781).\n- CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() (bsc#1276340).\n- CVE-2026-74480: net: bridge: stop fast-leave after deleting a port group (bsc#1276353).\n- CVE-2026-74483: binfmt_misc: don't leak the user namespace when the mount fails (bsc#1276347).\n- CVE-2026-74484: binfmt_misc: don't let an 'F' entry pin its own instance (bsc#1276345).\n- CVE-2026-74485: binfmt_misc: reject a flag character as the field delimiter (bsc#1277892).\n- CVE-2026-74487: binfmt_misc: restore write access when removing an entry (bsc#1276349).\n- CVE-2026-74490: tipc: avoid use-after-free in poll trace queue dumps (bsc#1276352).\n- CVE-2026-74492: netfilter: ipset: do not update comments from kernel-side hash adds (bsc#1276337).\n- CVE-2026-74493: net/smc: fix socket use-after-free during link group termination (bsc#1276338).\n- CVE-2026-74515: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (bsc#1275953).\n- CVE-2026-74538: Bluetooth: ISO: lock sk in iso_connect_ind (bsc#1275682).\n- CVE-2026-74564: netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH (bsc#1275567).\n- CVE-2026-74579: netfilter: nft_payload: fix mask build for partial field offload (bsc#1275559).\n- CVE-2026-74580: vhost: reset the vring metadata cache on vring reconfiguration (bsc#1277885).\n- CVE-2026-74586: sctp: clear new_transport when removing a peer (bsc#1277820).\n- CVE-2026-74588: sctp: keep chunk-\u003etransport in step with the list it is queued on (bsc#1277766).\n- CVE-2026-74589: bpf, sockmap: Fix sk_redir use-after-free in send verdict (bsc#1277904).\n- CVE-2026-74590: fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions (bsc#1277824).\n- CVE-2026-74592: ima: Instantiate file_truncate and path_truncate hooks (bsc#1277900).\n- CVE-2026-74594: sched/psi: Shut down rtpoll_timer in psi_cgroup_free() (bsc#1277843).\n- CVE-2026-74595: fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() (bsc#1277910).\n- CVE-2026-74597: ip6_tunnel: clear skb2-\u003ecb in ip6ip6_err() (bsc#1277493).\n- CVE-2026-74600: mm/page_table_check: skip special zero mappings (bsc#1277640).\n- CVE-2026-74601: ring-buffer: Use current_context for safe per-CPU buffer swap (bsc#1277896).\n- CVE-2026-74602: ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer() (bsc#1277895).\n- CVE-2026-74603: ptp: ocp: Fix board ID over-read (bsc#1277915).\n- CVE-2026-74605: eventfs: Use children field for rcu head and add memory barriers (bsc#1277913).\n- CVE-2026-74606: eventfs: Fix use-after-free in eventfs_remove_rec() (bsc#1277864).\n- CVE-2026-74609: tipc: read le-\u003elink under the node lock in tipc_node_link_down() (bsc#1277906).\n- CVE-2026-74625: netfilter: bridge: release template ct on non-IP path (bsc#1277036).\n- CVE-2026-74628: net/x25: fix use-after-free of the socket by its timers (bsc#1277844).\n- CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191).\n- CVE-2026-74631: net: smc: fix splice entry lifetime imbalance in smc_rx_splice (bsc#1278195).\n- CVE-2026-74632: mm/huge_memory: fix huge_zero_pfn race (bsc#1278199).\n- CVE-2026-74634: ring-buffer: Prevent subbuf order change when resizing is disabled (bsc#1277379).\n- CVE-2026-74636: tracing: Fix race between update_event_fields and, event_define_fields (bsc#1277371).\n- CVE-2026-74637: perf/core: Fix group leader use-after-free after sibling detach (bsc#1277372).\n- CVE-2026-74638: drm/v3d: Serialize the scheduler timeout handlers (bsc#1277374).\n- CVE-2026-74659: net: bridge: mrp: fix uninitialised bytes on the wire (bsc#1277296).\n- CVE-2026-74660: netfilter: ebt_nflog: pin the NFLOG backend (bsc#1277272).\n- CVE-2026-74662: inet: frags: add inet_frag_putn() helper (bsc#1277277).\n- CVE-2026-74663: net/sched: reject overly deep qdisc hierarchies (bsc#1278311).\n- CVE-2026-74666: packet: synchronize pressure clearing with ring reconfiguration (bsc#1277032).\n- CVE-2026-74667: net/packet: reset the MAC header on the packet-socket transmit path (bsc#1277396).\n- CVE-2026-74671: ima: fix out-of-bounds read in xattr_verify() (bsc#1277392).\n- CVE-2026-74688: sctp: clear control chunk transport if it is being removed (bsc#1277489).\n- CVE-2026-74689: net/atm: fix slab-out-of-bounds read in vcc_setsockopt() (bsc#1278314).\n- CVE-2026-74692: net/smc: fix TOCTOU race between smc_listen_out() and listener close (bsc#1276927).\n- CVE-2026-74694: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length (bsc#1277625).\n- CVE-2026-74696: tcp: fix TFO max_qlen accounting across reuseport migration (bsc#1276930).\n- CVE-2026-74697: bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips (bsc#1277897).\n- CVE-2026-74700: net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers (bsc#1277626).\n- CVE-2026-74701: net/openvswitch: check Ethernet header length in key_extract() (bsc#1276921).\n- CVE-2026-74710: xsk: require at least 16 bytes of TX metadata (bsc#1276579).\n- CVE-2026-74713: vhost_iotlb: bound map allocation in add_range (bsc#1276570).\n- CVE-2026-74718: devlink: fix net namespace reference leak in reload (bsc#1276573).\n- CVE-2026-74725: enic: fix tx_hang_reset use-after-free on device removal (bsc#1276563).\n- CVE-2026-74726: bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor (bsc#1276565).\n- CVE-2026-74735: l2tp: fix tunnel and session refcount leak on seq_file release (bsc#1277030).\n- CVE-2026-74739: net/sched: cls_u32: skip hash tables in u32_bind_class() (bsc#1278247).\n- CVE-2026-74745: eth: bnxt: decrease indent in bnxt_request_irq() (bsc#1277382).\n- CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315).\n- CVE-2026-80521: af_unix: Unlink scc_entry in unix_del_edge() (bsc#1277568).\n- CVE-2026-80585: mptcp: fastopen: only mark MPTFO subflows with SYN data (bsc#1277342).\n- CVE-2026-80613: veth: fix NAPI leak in XDP enable error path (bsc#1278205).\n- CVE-2026-80631: btrfs: lzo: reject compressed segment that overflows the compressed input (bsc#1277558).\n- CVE-2026-80664: netfilter: xt_nat: reject unsupported target families (bsc#1277555).\n- CVE-2026-80679: s390/dasd: Fix potential NULL pointer dereference (bsc#1277557).\n- CVE-2026-80686: mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE (bsc#1278245).\n- CVE-2026-80694: net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller (bsc#1278363).\n- CVE-2026-80715: igc: remove napi_synchronize() in igc_down() (bsc#1277840).\n- CVE-2026-80725: net: gro: properly validate BIG TCP aggregation criteria (bsc#1277452).\n- CVE-2026-80747: drm/amdkfd: Add bounds check for CRAT subtype length (bsc#1279536).\n- CVE-2026-80756: selinux: do not cancel a policy conversion that never started (bsc#1278708).\n- CVE-2026-80779: net/ionic: avoid OOB TX partner lookup for hwstamp RXQ (bsc#1279590).\n- CVE-2026-80789: nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621).\n- CVE-2026-80793: ipv4: reject undersized MTUs in ip_do_fragment() (bsc#1279799).\n- CVE-2026-80836: crypto: virtio - bound the akcipher result length (bsc#1279819).\n- CVE-2026-80840: ipv6: seg6: clear IPv4 control block on IPIP decapsulation (bsc#1279875).\n- CVE-2026-80841: net/packet: defer vmalloc TX_RING free until skbs finish (bsc#1279835).\n- CVE-2026-80842: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context (bsc#1279888).\n- CVE-2026-80844: xfrm: ah6: validate routing header segments_left (bsc#1279786).\n- CVE-2026-80846: xfrm: drop ESP-in-TCP packets with no ingress device (bsc#1279878).\n- CVE-2026-80847: tcp: clamp route advmss to TCP_MIN_MSS (bsc#1279850).\n- CVE-2026-80848: xfrm: espintcp: fix UAF during close (bsc#1279581).\n- CVE-2026-80851: gtp: serialize PDP context updates (bsc#1279569).\n- CVE-2026-80852: tls: device: fix out-of-bounds write in tls_append_frag() (bsc#1279532).\n- CVE-2026-80863: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (bsc#1279535).\n- CVE-2026-80864: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (bsc#1279525).\n- CVE-2026-80865: bpf: Add missing access_ok call to copy_user_syms (bsc#1279527).\n- CVE-2026-80880: IB/mlx5: Properly support implicit ODP rereg_mr (bsc#1279497).\n- CVE-2026-80895: mshv: Order pt_vp_array publish against irqfd assertion path (bsc#1279702).\n- CVE-2026-80932: vsock/virtio: flush works in dependency order (bsc#1280143).\n- CVE-2026-80976: seg6: reset IP6CB after IPv6 decapsulation (bsc#1280298).\n- CVE-2026-80979: net/smc: unregister the connection before draining the rx tasklet (bsc#1280299).\n- CVE-2026-80980: net/smc: Address spelling errors (bsc#1280303).\n- CVE-2026-80983: net/smc: fix socket refcount leak in smc_switch_conns() (bsc#1280296).\n- CVE-2026-80984: net/smc: do not dereference an unset send buffer on the SMC-D teardown path (bsc#1280309).\n- CVE-2026-81000: net: tun: bound receive headroom (bsc#1280263).\n- CVE-2026-81001: slip: fix use-after-free in sl_sync() (bsc#1280375).\n- CVE-2026-89448: iommu/vt-d: Force requesting ACS when tboot is enabled (bsc#1280379).\n- CVE-2026-89451: iommu/sva: Set handle-\u003edev before the SVA handle is visible (bsc#1280383).\n- CVE-2026-89453: iommu/amd: Put PCI device after handling PPR faults (bsc#1280384).\n- CVE-2026-89477: sctp: fix NULL deref on untransmitted RECONF completion (bsc#1280338).\n- CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786).\n- CVE-2026-89480: nvme-tcp: reject a read that transferred too few bytes (bsc#1280449).\n- CVE-2026-89481: nvme-tcp: fix host memory disclosure on R2T for a read command (bsc#1280451).\n- CVE-2026-89482: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (bsc#1280350).\n- CVE-2026-89485: lockd: pin next file across nlm_inspect_file lock-drop (bsc#1280456).\n- CVE-2026-89500: ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page (bsc#1280333).\n- CVE-2026-89501: ring-buffer: Hold cpu_buffer::lock when resizing a subbuf (bsc#1280335).\n- CVE-2026-89502: ring-buffer: Free cpu_buffer::free_page with subbuf_order (bsc#1280336).\n- CVE-2026-89503: ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() (bsc#1280334).\n- CVE-2026-89508: RDMA/ucma: Lock the handler in ucma_set_ib_path() (bsc#1280544).\n- CVE-2026-89510: RDMA/cxgb4: Cancel reg_work before freeing device on remove (bsc#1280551).\n- CVE-2026-89511: qede: Fix NULL pointer dereference in TPA fragment processing (bsc#1280508).\n- CVE-2026-89525: udf: reject VAT indexes equal to the entry count (bsc#1282288).\n- CVE-2026-89526: svcrdma: Validate Read chunk positions before reconstruction (bsc#1280901).\n- CVE-2026-89527: svcrdma: Use svc_xprt_put to free listener on create failure (bsc#1281754).\n- CVE-2026-89530: svcrdma: Reject inline replies that overflow the pull-up buffer (bsc#1280920).\n- CVE-2026-89531: svcrdma: Reject connection when transport allocation fails (bsc#1281738).\n- CVE-2026-89532: svcrdma: Fix pcl_for_each_segment for empty chunks (bsc#1280985).\n- CVE-2026-89533: svcrdma: Fix offset arithmetic in read_chunk_range (bsc#1280993).\n- CVE-2026-89534: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails (bsc#1280766).\n- CVE-2026-89535: svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id (bsc#1280761).\n- CVE-2026-89536: SUNRPC: wait for in-flight client TLS handshake callback (bsc#1280711).\n- CVE-2026-89538: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field (bsc#1280716).\n- CVE-2026-89539: SUNRPC: reject duplicate CREDS_VALUE options (bsc#1280717).\n- CVE-2026-89540: sunrpc: init gssp_lock before publishing proc entry (bsc#1280719).\n- CVE-2026-89541: SUNRPC: harden gss_unwrap_resp_priv length checks (bsc#1280388).\n- CVE-2026-89542: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (bsc#1280387).\n- CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280758).\n- CVE-2026-89545: sunrpc: defer rq_argp and rq_resp free until after RCU grace period (bsc#1280720).\n- CVE-2026-89547: SUNRPC: Check svc pool percpu counter allocation (bsc#1280548).\n- CVE-2026-89548: SUNRPC: always drain cache_cleaner before destroying a cache_detail (bsc#1280546).\n- CVE-2026-89550: SUNRPC: svcauth_gss: enforce krb5 token minimum length (bsc#1280726).\n- CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow (bsc#1280727).\n- CVE-2026-89564: ip: orphan prefetched skbs before multicast forwarding (bsc#1280797).\n- CVE-2026-89580: bpf: Disable preemption in __bpf_get_stack (bsc#1280577).\n- CVE-2026-89603: entry: Fix seccomp bypass after ptrace with TSYNC (bsc#1280923).\n- CVE-2026-89644: btrfs: fix extent map leak in NOCOW direct I/O write (bsc#1281054).\n- CVE-2026-89658: NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup (bsc#1280576).\n- CVE-2026-89660: NFSD: Prevent client use-after-free during admin state revocation (bsc#1280525).\n- CVE-2026-89662: NFSD: Prevent lock owner use-after-free during client teardown (bsc#1280509).\n- CVE-2026-89663: nfsd: revoke copy-notify stateids before dropping their reference (bsc#1280518).\n- CVE-2026-89665: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE (bsc#1281057).\n- CVE-2026-89669: nfsd: initialize copy-notify stateid before publishing it (bsc#1280251).\n- CVE-2026-89671: nfsd: gate nfs3 setacl by argp-\u003emask (bsc#1280252).\n- CVE-2026-89672: nfsd: gate nfs2 setacl by argp-\u003emask (bsc#1280235).\n- CVE-2026-89673: nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo (bsc#1280237).\n- CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280243).\n- CVE-2026-89680: nfsd: fix nfsd_file leak on inter-server COPY setup failure (bsc#1280206).\n- CVE-2026-89683: nfsd: fix dentry ref leak on V4ROOT export filehandle lookup (bsc#1280193).\n- CVE-2026-89684: nfsd: fix cpntf publish race in nfs4_init_cp_state (bsc#1280178).\n- CVE-2026-89685: nfsd: fix clock domain mismatch in clients_still_reclaiming() (bsc#1280179).\n- CVE-2026-89686: nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke (bsc#1280184).\n- CVE-2026-89688: nfsd: drop the stateid, not the stateowner, on seqid_op replay retry (bsc#1280171).\n- CVE-2026-89690: nfsd: defer vfree of compound ops to fix rpc_status UAF (bsc#1280166).\n- CVE-2026-89691: nfsd: clear opcnt on compound arg release to prevent OOB read (bsc#1280163).\n- CVE-2026-89694: nfsd: check client ownership when cancelling a copy-notify stateid (bsc#1280151).\n- CVE-2026-89696: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref (bsc#1280146).\n- CVE-2026-89697: nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() (bsc#1280148).\n- CVE-2026-89698: nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage (bsc#1280494).\n- CVE-2026-89699: nfsd: validate symlink target length in NFSv4 CREATE (bsc#1281077).\n- CVE-2026-89702: nfsd: size fh_verify server sockaddr slot by xpt_locallen (bsc#1280487).\n- CVE-2026-89703: nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations (bsc#1280488).\n- CVE-2026-89704: nfsd: sample writeback error cursor before async COPY loop (bsc#1280490).\n- CVE-2026-89705: nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths (bsc#1280464).\n- CVE-2026-89706: nfsd: Reset write verifier when async COPY writeback fails (bsc#1280477).\n- CVE-2026-89707: nfsd: release path refs on follow_down() error (bsc#1280468).\n- CVE-2026-89710: NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path (bsc#1280455).\n- CVE-2026-89712: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock (bsc#1280870).\n- CVE-2026-89713: NFSD: check truncate permission under inode lock (bsc#1280872).\n- CVE-2026-89747: tracing: Fix use-after-free in trace_pipe read on sub-buffer order change (bsc#1281025).\n- CVE-2026-89780: net: qualcomm: rmnet: restore skb-\u003edev on deaggregated frames (bsc#1280969).\n- CVE-2026-89784: SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 (bsc#1281224).\n- CVE-2026-89789: gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free (bsc#1281226).\n- CVE-2026-89791: perf: Fix use-after-free when perf mmap() revival races with the last munmap() (bsc#1281228).\n- CVE-2026-89798: svcrdma: Fix unmatched rn_unregister on failed accept (bsc#1281136).\n- CVE-2026-89912: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save (bsc#1281201).\n- CVE-2026-89913: KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables (bsc#1281202).\n- CVE-2026-89968: nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229).\n- CVE-2026-89970: nvmet: add a helper function for cqid checking (bsc#1281231).\n- CVE-2026-89984: perf/x86/intel: Fix kernel address leakages in LBR stack (bsc#1281273).\n- CVE-2026-90003: futex: Prevent rcuwait use-after-free during requeue PI (bsc#1281295).\n- CVE-2026-90065: net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure (bsc#1281660).\n- CVE-2026-90074: net/sched: fq_pie: clamp default quantum to avoid signed overflow (bsc#1281496).\n- CVE-2026-90097: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition (bsc#1281514).\n- CVE-2026-90101: bnxt_en: Fix call to hardware monitoring event handler (bsc#1281525 bsc#1283517).\n- CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546).\n- CVE-2026-90142: virtio_net: Fix resize of the RX ring (bsc#1281597).\n- CVE-2026-90149: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers (bsc#1281955).\n- CVE-2026-90150: pnfs/blocklayout: Fix device leaks on parse failure (bsc#1281956).\n- CVE-2026-90151: NFSv4: remove callback IDR entry on client allocation failure (bsc#1281599).\n- CVE-2026-90177: bpf: Check pointer type for all atomic RMW paths (bsc#1281645).\n- CVE-2026-90182: blk-iocost: clear delay state when freeing policy data (bsc#1281644).\n- CVE-2026-90183: blk-iolatency: clear delay state when freeing policy data (bsc#1281964).\n- CVE-2026-90203: Squashfs: check block offset is not negative (bsc#1281808).\n- CVE-2026-90218: RDMA/cma: Fix WARNING in res_to_rt (bsc#1281795).\n- CVE-2026-90228: nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() (bsc#1281717).\n- CVE-2026-90240: iommu/vt-d: Flush context cache with correct SID when tearing down aliases (bsc#1281683).\n- CVE-2026-90241: iommu/vt-d: Tear down scalable-mode context on probe failure (bsc#1281682).\n- CVE-2026-90243: iommu/vt-d: Clear Present bit before tearing down copied context entry (bsc#1281845).\n- CVE-2026-90259: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() (bsc#1281680).\n- CVE-2026-90263: btrfs: check if root is readonly when setting posix acl (bsc#1281922).\n- CVE-2026-90265: btrfs: defrag: fix deadlock between defrag and delalloc space reservation (bsc#1282054).\n- CVE-2026-90292: RDMA/siw: Fix use-after-free in siw_accept() (bsc#1281777).\n- CVE-2026-90293: IB/isert: post the full-feature receive buffers after session registration (bsc#1281778).\n- CVE-2026-90294: IB/isert: delay the final Login Response until the session is registered (bsc#1281732).\n- CVE-2026-90307: RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ (bsc#1282050).\n- CVE-2026-90308: RDMA/erdma: Hold QP references for AE and CM processing (bsc#1281786).\n- CVE-2026-90309: RDMA/erdma: Hold CQ references when processing EQ events (bsc#1281789).\n- CVE-2026-90358: bpf, x86: Fix trampoline stack size for 128-bit arguments (bsc#1281825).\n- CVE-2026-90388: iommu/dma: Check atomic pool allocation result directly (bsc#1282197).\n- CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received (bsc#1282113).\n- CVE-2026-90414: IB/isert: reject PDUs declaring more data than (bsc#1282110).\n- CVE-2026-90415: RDMA/cxgb4: free STAG index when TPT entry write fails (bsc#1282143).\n- CVE-2026-90417: RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() (bsc#1281973).\n- CVE-2026-90426: iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs (bsc#1282013).\n- CVE-2026-90428: iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs (bsc#1282003).\n- CVE-2026-90430: iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized (bsc#1281991).\n- CVE-2026-92495: RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap (bsc#1282072).\n- CVE-2026-92523: RDMA/nldev: validate dynamic counter attribute length (bsc#1282271).\n- CVE-2026-92525: RDMA/rxe: Validate num_sge/cur_sge before indexing wqe-\u003edma.sge[] (bsc#1282270).\n- CVE-2026-93037: RDMA/hfi1: Propagate sdma_txinit_ahg() errors (bsc#1282020).\n- CVE-2026-93107: RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state (bsc#1281399).\n- CVE-2026-93108: RDMA/ipoib: Drain RCU callbacks during module teardown (bsc#1281408).\n- CVE-2026-93109: RDMA/mlx5: Drain RCU callbacks during module teardown (bsc#1281379).\n- CVE-2026-93110: RDMA/core: Wait for RCU callbacks before unloading ib_core (bsc#1281387).\n- CVE-2026-93154: RDMA/irdma: Add refcounting to user ring MRs (bsc#1282104).\n- CVE-2026-93160: crypto: atmel-ecc - reject hardware ECDH without a public key (bsc#1282147).\n- CVE-2026-93207: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (bsc#1282672).\n- CVE-2026-93212: nfsd: guard nfsd_serv deref in nfsd_file_net_dispose (bsc#1282774).\n- CVE-2026-93264: RDMA/efa: Fix PBL chunk length computation (bsc#1282812).\n- CVE-2026-93782: vhost-scsi: flush backend after device ioctls (bsc#1282906).\n- CVE-2026-93794: smb/client: flush dirty data before punching a hole (bsc#1283154).\n- CVE-2026-93800: btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol() (bsc#1282808).\n- CVE-2026-93810: cachefiles: Fix double fput (bsc#1283213).\n- CVE-2026-93814: spi: core: Abort active target transfer on controller suspend.\n- CVE-2026-93825: spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data().\n- CVE-2026-93826: HID: hidpp: fix potential UAF in hidpp_connect_event() (bsc#1282891).\n- CVE-2026-93827: virtio-fs: avoid double-free on failed queue setup (bsc#1282747).\n- CVE-2026-93829: smb: client: fix races in cifsd thread creation (bsc#1282803).\n- CVE-2026-97413: RDMA/rtrs-srv: Fix integer underflow in process_read and process_write (bsc#1282975).\n- CVE-2026-97421: RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() (bsc#1283176).\n- CVE-2026-97477: RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() (bsc#1283230).\n- CVE-2026-97520: gfs2: move quota_init qc iterator increment (bsc#1283479).\n- CVE-2026-97521: gfs2: fix quota init duplicate scan (bsc#1283475).\n- CVE-2026-97543: xfs: destroy seen inode bitmap when we fail to add a dirpath (bsc#1283450).\n- CVE-2026-97544: xfs: don't leak dqacct if rhashtable insertion fails (bsc#1283149).\n- CVE-2026-97545: xfs: don't leak new_bp if xfs_btree_bload_drop_buf fails (bsc#1283205).\n- CVE-2026-97546: xfs: don't spin forever on zero-length dirents when salvaging them (bsc#1283203).\n- CVE-2026-97552: xfs: initialise error in xfs_defer_finish_one() (bsc#1283328).\n- CVE-2026-97557: smb: client: avoid leaking refcount in cifs_queue_oplock_break() (bsc#1283201).\n- CVE-2026-97571: bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc() (bsc#1283517 bsc#1283945).\n- CVE-2026-97572: bnxt_en: Propagate RX ring init failures in bnxt_init_nic() (bsc#1283517 bsc#1283794).\n- CVE-2026-97573: bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset() (bsc#1283517 bsc#1283880).\n- CVE-2026-97574: bnxt_en: Don't free the live ring's TPA state on queue restart failure (bsc#1283517 bsc#1283795).\n- CVE-2026-97605: erofs: preserve LZMA decoders on resize failure (bsc#1283173).\n- CVE-2026-97902: fs: don't return -EINVAL for successful nested thaw (bsc#1283166).\n- CVE-2026-97934: tracing: Fix memory corruption from a \"STACKTRACE\" histogram key (bsc#1282997).\n- CVE-2026-97940: ipv6: fix fib6 walker UAF on seq stop (bsc#1283163).\n- CVE-2026-97947: x86/amd_node: Avoid divide by zero on virtualized systems (bsc#1283130).\n- CVE-2026-97957: net: hinic: fix mailbox segment buffer overflow (bsc#1283119).\n- CVE-2026-98003: iommu/amd: Do not reallocate GA log buffers on resume (bsc#1283312).\n- CVE-2026-98028: eth: nfp: drop the replaced rule from the list when reprogramming fails (bsc#1283739).\n- CVE-2026-98029: eth: nfp: bound the ntuple rule dump by the caller's buffer size (bsc#1283490).\n- CVE-2026-98030: net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size (bsc#1283489).\n- CVE-2026-98091: btrfs: detach failed sprout device from transaction update list (bsc#1283805).\n- CVE-2026-100075: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (bsc#1282881).\n\nThe following non security issues were fixed:\n\n- ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach (stable-fixes).\n- ACPI: scan: Honor _DEP for ACPI0016 PCI/CXL host bridge (stable-fixes).\n- ACPICA: add boundary checks in acpi_ps_get_next_field() (stable-fixes).\n- ACPICA: add boundary checks in two places (stable-fixes).\n- ACPICA: Add package limit checks in parser functions (stable-fixes).\n- ACPICA: Add validation for node in acpi_ns_build_normalized_path() (stable-fixes).\n- ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() (stable-fixes).\n- ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() (stable-fixes).\n- ACPICA: Fix condition check in acpi_ps_parse_loop() (stable-fixes).\n- ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) (stable-fixes).\n- ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() (stable-fixes).\n- ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() (stable-fixes).\n- ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg() (stable-fixes).\n- ACPICA: Prevent adding invalid references (stable-fixes).\n- ACPICA: validate byte_count in acpi_ps_get_next_package_length() (stable-fixes).\n- ACPICA: validate handler object type in two places (stable-fixes).\n- ALSA: 6fire: Clean ups with guard() (stable-fixes).\n- ALSA: 6fire: fix OOB write from device-reported iso length (git-fixes).\n- ALSA: aloop: Check card index validity at probe (stable-fixes).\n- ALSA: bcd2000: Fix race between rawmidi and disconnect (git-fixes).\n- ALSA: caiaq: unregister the input device when probe fails (git-fixes).\n- ALSA: core: Add scoped cleanup helper for card references (stable-fixes).\n- ALSA: core: Define auto-cleanup for snd_card_free() (stable-fixes).\n- ALSA: core: Fix potential UAF after asynchronous card release (stable-fixes).\n- ALSA: es18xx: check control allocation before private data setup (stable-fixes).\n- ALSA: hda/common: Use cleanup macros for PM controls (stable-fixes).\n- ALSA: hda/common: Use guard() for mutex locks (stable-fixes).\n- ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10 (stable-fixes).\n- ALSA: hda/core: Use guard() for mutex locks (stable-fixes).\n- ALSA: hda/realtek - Add quirk for HP Victus 15-fa0xxx (MB 8A50) (stable-fixes).\n- ALSA: hda/realtek: Add HDA_CODEC_QUIRK for Samsung 750XBE/730XBE (stable-fixes).\n- ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx (stable-fixes).\n- ALSA: hda/realtek: Add mute LED quirk for HP Victus 16-e0xxx (MB 88ED) (stable-fixes).\n- ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP EliteBook 830 G8 (8AB8) to enable mute LEDs (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP Pavilion x360 (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP Victus 16-e0xxx (88EE) to enable mute LED (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Xiaoxin 14 GT (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Yoga 7 16IAP7 (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IRH8 (stable-fixes).\n- ALSA: hda/realtek: Add StarFighter HDA SSID (stable-fixes).\n- ALSA: hda/realtek: Fix speakers on MECHREVO WUJIE Series (stable-fixes).\n- ALSA: hda/realtek: Limit Star Labs internal mic boost (stable-fixes).\n- ALSA: hda/tegra: Re-enable SDO workaround for Tegra194 (git-fixes).\n- ALSA: hda: Add Lenovo Legion 7i 16IAX7 17AA3874 quirk (stable-fixes).\n- ALSA: hda: cs35l56: Fail if wmfw file is missing (stable-fixes).\n- ALSA: hda: ext: Clean up links if their initialization fails (stable-fixes).\n- ALSA: hda: Introduce auto cleanup macros for PM (stable-fixes).\n- ALSA: hda: trace PCM open only after assigning a stream (git-fixes).\n- ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup (git-fixes).\n- ALSA: ice1712: Fix the error handling via auto-cleanup at probe (git-fixes).\n- ALSA: line6: reject oversized playback packets (git-fixes).\n- ALSA: mpu401: Check card index validity at probe (stable-fixes).\n- ALSA: mts64: Check card index validity at probe (stable-fixes).\n- ALSA: pcm: Fix race between non-atomic ops and trigger-start (stable-fixes).\n- ALSA: pcm: set timer-\u003eprivate_data before registering the PCM timer (git-fixes).\n- ALSA: portman2x4: Check card index validity at probe (stable-fixes).\n- ALSA: seq: oss: Reject reads that cannot fit the next event (stable-fixes).\n- ALSA: seq: Remove arbitrary prioq insertion limit (stable-fixes).\n- ALSA: seq: Serialize compat port-info ioctls (git-fixes).\n- ALSA: serial-u16550: Check card index validity at probe (stable-fixes).\n- ALSA: ua101: reject mismatched capture/playback packet sizes (git-fixes).\n- ALSA: ump: Copy FB name string more safely (stable-fixes).\n- ALSA: ump: Copy safe string name to rawmidi (stable-fixes).\n- ALSA: ump: Update rawmidi name per EP name update (stable-fixes).\n- ALSA: usb-audio: Add dB map quirk for Razer Barracuda X 2.4 (stable-fixes).\n- ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless (stable-fixes).\n- ALSA: usb-audio: Add quirk flags for SC13A (stable-fixes).\n- ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision) (stable-fixes).\n- ALSA: usb-audio: Add quirk for Novation Mininova (stable-fixes).\n- ALSA: usb-audio: Add quirk for YAMAHA CDS3000 (stable-fixes).\n- ALSA: usb-audio: caiaq: validate EP1 reply lengths (stable-fixes).\n- ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity (git-fixes).\n- ALSA: usb-audio: Optimize the copy of packet sizes for implicit fb handling (stable-fixes).\n- ALSA: usb: 6fire: Avoid embedded URBs (stable-fixes).\n- ALSA: usx2y: Drain pending US-428 pipe-4 output commands (stable-fixes).\n- ALSA: virmidi: Check card index validity at probe (stable-fixes).\n- ALSA: virtio: reset device before deleting virtqueues (git-fixes).\n- arm64: fixmap: Allow 256K early_ioremap() at any offset (git-fixes).\n- arm64: hibernate: clone only the linear map that exists at runtime (git-fixes).\n- arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc (git-fixes).\n- arm64: kprobes: Allow reentering kprobes while single-stepping (git-fixes).\n- arm64: mte: Fix PTRACE_{PEEK,POKE}MTETAGS error documentation (git-fixes).\n- arm64: percpu: Fix LSE operations on {8,16}-bit types (git-fixes).\n- arm64: percpu: Fix this_cpu_and() mask generation (git-fixes).\n- arm64: percpu: Fix this_cpu_write() casting (git-fixes).\n- arm64: Use load LSE atomics for the non-return per-CPU atomic operations (git-fixes).\n- ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for HyperX OMEN Gaming Laptop 16-ap1xxx (stable-fixes).\n- ASoC: codecs: aw88261: only check PLL and clock state at power-up (git-fixes).\n- ASoC: codecs: aw88261: reduce log spam (stable-fixes).\n- ASoC: codecs: max98363: fix uninitialized stream_config-\u003etype (git-fixes).\n- ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive (stable-fixes).\n- ASoC: codecs: rk3328: Use managed GPIO and clock helpers (stable-fixes).\n- ASoC: codecs: rt274: Fix format setting for 44100 rate (git-fixes).\n- ASoC: codecs: rt286: Revert delay value for jack setup (git-fixes).\n- ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config-\u003etype (git-fixes).\n- ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config-\u003etype (git-fixes).\n- ASoC: fsl-asoc-card: reduce WM8904 PLL ratio to meet frequency limit (stable-fixes).\n- ASoC: hdmi-codec: Report a change when the channel status moves (git-fixes).\n- ASoC: Intel: catpt: Complete coredump handling (stable-fixes).\n- ASoC: Intel: sof_sdw: Add quirks for new Dell laptops (stable-fixes).\n- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (stable-fixes).\n- ASoC: mediatek: mt8365-afe-pcm: fix possible NULL-pointer dereferences in mt8365_afe_suspend() (stable-fixes).\n- ASoC: qcom: lpass-cpu: use DAI table index for playback constraints (git-fixes).\n- ASoC: qcom: q6apm: return error code to consumers on failures (stable-fixes).\n- ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt (stable-fixes).\n- ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence (stable-fixes).\n- ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure (stable-fixes).\n- ASoC: rt712-sdca: reset codec at io_init to fix silent headphone (stable-fixes).\n- ASoC: rt5645: Perform the initial jack detect at probe (stable-fixes).\n- ASoC: tas2781: Update default register address to TAS2563 (stable-fixes).\n- ASoC: tegra: Fix ASRC Stream6 input threshold control (git-fixes).\n- ASoC: ti: omap3pandora: update board check to use DT compatible (stable-fixes).\n- ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments (git-fixes).\n- ASoC: wm8903: Move the DRC QR threshold to the register that holds it (git-fixes).\n- Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough (git-fixes).\n- Bluetooth: btintel_pcie: Add 50 ms delay before MAC init on BlazarIW (stable-fixes).\n- Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit (git-fixes).\n- Bluetooth: btintel_pcie: validate device-supplied DMA indices (git-fixes).\n- Bluetooth: btmtk: add MT7902 MCU support (stable-fixes).\n- Bluetooth: btmtk: Disable remote wakeup for MT7922/MT7925 (stable-fixes).\n- Bluetooth: btmtk: fix wrong status for short WMT FUNC_CTRL events (git-fixes).\n- Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access (git-fixes).\n- Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown (git-fixes).\n- Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU (stable-fixes).\n- Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU (stable-fixes).\n- Bluetooth: btusb: Add Mercusys MA530 for Realtek RTL8761BUV (stable-fixes).\n- Bluetooth: btusb: Add Realtek RTL8922AE VID/PID 0bda/d922 (stable-fixes).\n- Bluetooth: btusb: Add Realtek RTL8922AE VID/PID 0bda/d923 (stable-fixes).\n- Bluetooth: btusb: Add support for Intel Lizard Peak 2 (0x8087:0x0040) (stable-fixes).\n- Bluetooth: btusb: Add support for TP-Link TL-UB250 (stable-fixes).\n- Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV (stable-fixes).\n- Bluetooth: btusb: fix NXP IW610 composite device handling (stable-fixes).\n- Bluetooth: btusb: MT7922: Add VID/PID 0e8d/223c (stable-fixes).\n- Bluetooth: btusb: MT7925: Add VID/PID 0e8d/8c38 (stable-fixes).\n- Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices (git-fixes).\n- Bluetooth: btusb: Record matched usb_device_id into btusb_data (stable-fixes).\n- Bluetooth: btusb: refactor endpoint lookup (stable-fixes).\n- Bluetooth: coredump: Quiesce dump work on unregister (git-fixes).\n- Bluetooth: eir: validate service data length before reading UUID (git-fixes).\n- Bluetooth: hci_codec: validate vendor codec count length (git-fixes).\n- Bluetooth: hci_conn: fix CIS hold ownership on reuse (git-fixes).\n- Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (git-fixes).\n- Bluetooth: hci_core: Print number of packets in conn-\u003edata_q (stable-fixes).\n- Bluetooth: hci_sock: reject out-of-range OCF values (git-fixes).\n- Bluetooth: hci_sock: validate event length before filtering (git-fixes).\n- Bluetooth: hci_sync: Serialize local codec list cleanup (git-fixes).\n- Bluetooth: ISO: balance the parent hold in hci_bind_bis() (git-fixes).\n- Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() (git-fixes).\n- Bluetooth: ISO: release unused CIS holds after channel attach (git-fixes).\n- Bluetooth: ISO: set BT_LISTEN before requesting a BIG sync (git-fixes).\n- Bluetooth: L2CAP: validate connectionless PSM length (stable-fixes).\n- Bluetooth: L2CAP: validate frame length before control and FCS access (git-fixes).\n- Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel (git-fixes).\n- Bluetooth: mgmt: fix race in read_unconf_index_list() (git-fixes).\n- Bluetooth: Properly disable remote wakeup for MT7922/MT7925 on Ryzen platform (git-fixes).\n- Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup (git-fixes).\n- Bluetooth: RFCOMM: fix NULL dereference of dlc-\u003esession in RFCOMM_CONNINFO (git-fixes).\n- Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() (git-fixes).\n- Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (stable-fixes).\n- Bluetooth: SMP: reject Security Request over BR/EDR (git-fixes).\n- bnxt_en: Bound SW TPA IDs to prevent crashes (git-fixes).\n- bnxt_en: Fix potential data corruption with HW GRO/LRO (git-fixes).\n- bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (bsc#1283517).\n- bnxt_en: Only restore LRO if the device supports TPA (bsc#1283517).\n- bnxt_en: Write doorbell when linearizing skb fails (bsc#1283517).\n- bonding: crypto offload enabled, non-offload slave failover, rekey failed (bsc#1282823).\n- btrfs: do not force reloc root creation during qgroup_account_snapshot() (bsc#1275740).\n- btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag (bsc#1279116).\n- btrfs: tree-checker: validate INODE_REF's namelen (git-fixes).\n- config: cleanup azure and kvmsmall Cleanup azure and kvmsmall configs after following comments updated default\n  configs: 4229ca50b2b3 Disable CONFIG_BATMAN_ADV (jsc#PED-16892).\n- dmaengine: Add devm_dma_request_chan() (stable-fixes).\n- dmaengine: altera-msgdma: Use memcpy_toio for descriptor FIFO writes (stable-fixes).\n- dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc (stable-fixes).\n- dmaengine: Fix device kref underflow in dma_chan_put() (git-fixes).\n- dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() (git-fixes).\n- dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() (git-fixes).\n- dmaengine: sprd: Fix runtime PM reference leak in probe (git-fixes).\n- dmaengine: sun6i: fix non-atomic read of DMA position registers (git-fixes).\n- dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status (git-fixes).\n- dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() (git-fixes).\n- dmaengine: wait for RCU readers before releasing dma_device (git-fixes).\n- dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA (git-fixes).\n- dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order (git-fixes).\n- driver core: Export get_dev_from_fwnode() (stable-fixes).\n- drm/amd/display: Bump frame warning limit for clang builds of dml (stable-fixes).\n- drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend (git-fixes).\n- drm/amd/display: Check for sharpening case when calculating max vtaps for scaler (stable-fixes).\n- drm/amd/display: clean-up dead code in dml2_mall_phantom (stable-fixes).\n- drm/amd/display: Find link encoder for flexible DIG mapping cases (stable-fixes).\n- drm/amd/display: Fix CRC open failure during active rendering (stable-fixes).\n- drm/amd/display: Fix dc stream excess put in dm_update_crtc_state() (git-fixes).\n- drm/amd/display: Fix DPMS using partially updated pipe context (stable-fixes).\n- drm/amd/display: Initialize dsc_caps to 0 (stable-fixes).\n- drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC (git-fixes).\n- drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized (stable-fixes).\n- drm/amd/pm/si: Fix updating clock limits from power states (stable-fixes).\n- drm/amd/pm/si: Fix updating clock limits on AC/DC (git-fixes).\n- drm/amd/pm: bound pp_dpm_set_pp_table() memcpy (stable-fixes).\n- drm/amd/pm: Check SMUv13.0.6/12 metrics integrity (stable-fixes).\n- drm/amd/pm: hide pp_table sysfs on APUs (git-fixes).\n- drm/amdgpu: add a helper to calculate ring distance (stable-fixes).\n- drm/amdgpu: check ras and obj before dereference (git-fixes).\n- drm/amdgpu: check thunderbolt before switcheroo registration (stable-fixes).\n- drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages (bsc#1284146).\n- drm/amdgpu: Failed to check various return code (stable-fixes).\n- drm/amdgpu: fix ACP MFD device leak on init failure (git-fixes).\n- drm/amdgpu: fix buffer overflow during vBIOS update (stable-fixes).\n- drm/amdgpu: fix IP instance memory leak on kobject add failure (git-fixes).\n- drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init() (git-fixes).\n- drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show() (git-fixes).\n- drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init() (git-fixes).\n- drm/amdgpu: flush pending RCU callbacks on module unload (stable-fixes).\n- drm/amdgpu: harden FRU PIA parsing with bounded helpers (stable-fixes).\n- drm/amdgpu: Prefer ROM BAR for default VGA device (stable-fixes).\n- drm/amdgpu: Skip accessing psp rum time db for APUs (stable-fixes).\n- drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT (stable-fixes).\n- drm/amdgpu: Use system unbound workqueue for soft IH ring (stable-fixes).\n- drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw (stable-fixes).\n- drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id (stable-fixes).\n- drm/amdkfd: Check bounds on allocate_doorbell (stable-fixes).\n- drm/amdkfd: check find_first_zero_bit before __set_bit on kfd-\u003edoorbell_bitmap (stable-fixes).\n- drm/amdkfd: fix UAF race in destroy_queue_cpsch (stable-fixes).\n- drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl (stable-fixes).\n- drm/amdkfd: Reject zero-sized AQL queue allocations after size halving (stable-fixes).\n- drm/amdkfd: Unwind debug trap enable on copy_to_user failure (stable-fixes).\n- drm/arm/komeda: fix error handling for clk_prepare_enable() and callers (stable-fixes).\n- drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend (stable-fixes).\n- drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach (git-fixes).\n- drm/bridge: tc358768: Set pre_enable_prev_first for reverse order (stable-fixes).\n- drm/cirrus: Use video aperture helpers (stable-fixes).\n- drm/dp: Add DSC virtual DPCD quirk for Realtek MST branch device (stable-fixes).\n- drm/gem: Consider GEM object reclaimable if shrinking fails (stable-fixes).\n- drm/gma500: return errors from Oaktrail HDMI I2C reads (stable-fixes).\n- drm/gud: Add RCade Display Adapter VID/PID pair (stable-fixes).\n- drm/gud: fix out-of-bounds write in gud_plane_atomic_check() (git-fixes).\n- drm/i915/psr: Add new SU area calculation helper to apply workarounds (stable-fixes).\n- drm/i915/psr: Clear stale sel fetch enable bits on sel fetch disable (git-fixes).\n- drm/i915: fix incorrect RCU teardown order (git-fixes).\n- drm/i915: Guard against NULL driver_data in i915_pci_probe() (stable-fixes).\n- drm/imagination: clamp freelist reconstruction requests (git-fixes).\n- drm/imagination: Fix page count for page table for map() interface (git-fixes).\n- drm/imagination: Populate FW common context ID before passing to the FW (stable-fixes).\n- drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl() (git-fixes).\n- drm/logicvc: Drop the select of the nonexistent CONFIG_DRM_KMS_DMA_HELPER (git-fixes).\n- drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device (git-fixes).\n- drm/mediatek: dsi: Add compatible for mt8167-dsi (stable-fixes).\n- drm/mediatek: Fix ovl adaptor platform device leak (git-fixes).\n- drm/mediatek: Fix pdev reference leak in mtk_drm_bind() (git-fixes).\n- drm/msm/adreno: fix autosuspend cleanup during teardown (git-fixes).\n- drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL (git-fixes).\n- drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure (git-fixes).\n- drm/msm: Recover HW before retire hung submit (git-fixes).\n- drm/nouveau/bios: skip the IFR header if present (stable-fixes).\n- drm/nouveau/clk: don't clobber reclock status when restoring volt/fan (git-fixes).\n- drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update (git-fixes).\n- drm/nouveau/disp: don't reject HDMI config on cards without SCDC (git-fixes).\n- drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM (git-fixes).\n- drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() (git-fixes).\n- drm/nouveau: fix autosuspend cleanup during teardown (git-fixes).\n- drm/nouveau: Fix bridge reference leak in nv1a_ram_new() (git-fixes).\n- drm/nouveau: fix double-free in nvif_vmm_dtor (git-fixes).\n- drm/nouveau: Fix gem reference leak in validate_init() (git-fixes).\n- drm/nouveau: Fix runtime PM leak in nouveau_connector_detect() (git-fixes).\n- drm/nouveau: RCU-free the scheduler-containing nouveau_sched (git-fixes).\n- drm/omap: dsi: Do not copy isr table (git-fixes).\n- drm/panel: Enable GPIOLIB for panels which uses functions from it (stable-fixes).\n- drm/panel: jadard-jd9365da-h3: set prepare_prev_first (stable-fixes).\n- drm/panel: simple: Add AM-1280800W8TZQW-T00H (stable-fixes).\n- drm/radeon: Read the VRAM VBIOS signature with readb() (git-fixes).\n- drm/vc4: Use managed KMS polling to fix UAF on unbind (git-fixes).\n- drm/virtio: fix memory leak of fence event on execbuffer failure (git-fixes).\n- drm/virtio: fix NULL pointer dereference on fence allocation failure (git-fixes).\n- drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() (git-fixes).\n- drm/virtio: fix object leak when drm_gem_handle_create() fails (git-fixes).\n- drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() (git-fixes).\n- drm/virtio: release the GEM object on virtio_gpu_vram_create() errors (git-fixes).\n- drm/xe: Limit sg segment size to PAGE_SIZE on Xen PV (git-fixes).\n- drm/xe: Wait on external BO kernel fences in exec IOCTL (CVE-2026-74440 bsc#1261564).\n- drm: add drm_memory_stats_is_zero (stable-fixes).\n- drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr (git-fixes).\n- fbcon: don't suspend/resume when vc is graphics mode (stable-fixes).\n- fbdev: pm2fb: unwind WC setup on probe failure (stable-fixes).\n- fbdev: pvr2fb: correct user pointer annotation and sentinel initializer (stable-fixes).\n- firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size (stable-fixes).\n- firmware: arm_scmi: Validate SENSOR_UPDATE payload size (stable-fixes).\n- firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS (git-fixes).\n- firmware: qcom_scm: Rename peripheral as pas_id (stable-fixes).\n- firmware: stratix10-svc: change get provision data to async SMC call (stable-fixes).\n- firmware: stratix10-svc: fix FCS SMC call kernel-doc (git-fixes).\n- firmware: sysfb: Move bpp-depth calculation into screen_info helper (stable-fixes).\n- gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() (git-fixes).\n- gpio: dwapb: Mask interrupts at hardware initialization (stable-fixes).\n- gpio: pisosr: Read \"ngpios\" as u32 (stable-fixes).\n- gpio: tps65219: Fix GPIO input value reads (git-fixes).\n- gpio: virtuser: skip free_irq when no IRQ is installed (git-fixes).\n- gpio: zynq: fix runtime PM leak on request error path (git-fixes).\n- HID: alps: fix use-after-free on input2 registration failure (git-fixes).\n- HID: alps: unregister DualPoint Stick input device on remove (git-fixes).\n- HID: amd_sfh: Validate PCI BAR size before mapping (git-fixes).\n- HID: asus: fortify keyboard handshake (stable-fixes).\n- HID: bpf: Add Huion Inspiroy Frego M button quirk (stable-fixes).\n- HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request (git-fixes).\n- HID: bpf: fix __hid_bpf_hw_check_params report length (git-fixes).\n- HID: core: quiesce input in hid_hw_stop() to prevent use-after-free (stable-fixes).\n- HID: elecom: fix bus type for M-XGL20DLBK (git-fixes).\n- HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM (stable-fixes).\n- HID: hidpp: fix potential UAF in hidpp_connect_event() (stable-fixes).\n- HID: logitech-hidpp: fix race condition when accessing stale stack pointer (stable-fixes).\n- HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes (git-fixes).\n- HID: mcp2221: fix OOB write in mcp2221_raw_event() (stable-fixes).\n- HID: mcp2221: stop device IO before hid_hw_stop (git-fixes).\n- HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard (stable-fixes).\n- HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() (git-fixes).\n- host1x: bus: Fix missing ops null check in error teardown (stable-fixes).\n- hwmon: (adt7462) Add of_match_table to support devicetree (stable-fixes).\n- hwmon: (corsair-psu) Fix linear11 calculation (stable-fixes).\n- hwmon: (dell-smm) Add Dell Latitude 7530 to fan control whitelist (stable-fixes).\n- hwmon: (emc1403) Drop hysteresis for low limit temperature (git-fixes).\n- hwmon: (emc1403) Rely on subsystem locking (stable-fixes).\n- hwmon: (gpio-fan) return IRQ_HANDLED from the shared alarm IRQ handler (git-fixes).\n- hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show() (git-fixes).\n- hwmon: (hp-wmi-sensors) Improve raw WMI string handling (git-fixes).\n- hwmon: (ina2xx) Parameterize ina2xx_data in ina226_alert_read() (stable-fixes).\n- hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i (stable-fixes).\n- hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding (git-fixes).\n- hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676 (git-fixes).\n- hwmon: (raspberrypi) Fix delayed-work teardown race (stable-fixes).\n- hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove (git-fixes).\n- hwmon: (w83793) release probe data through kref (git-fixes).\n- i2c: at91: release DMA channels on remove and probe error (git-fixes).\n- i2c: atr: fix dangling adapter pointer on add failure (git-fixes).\n- i2c: imx: disable autosuspend on remove (git-fixes).\n- i2c: imx: release DMA channels on probe error (git-fixes).\n- i2c: mxs: fix DMA channel leak on probe error (git-fixes).\n- i2c: qcom-cci: fix device_node refcount leak in cci_probe()/cci_remove() (git-fixes).\n- i2c: qcom-cci: Remove the unused variable cci_clk_rate (git-fixes).\n- i2c: qcom-cci: Stop complaining about DT set clock rate (stable-fixes).\n- i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode (git-fixes).\n- i3c: mipi-i3c-hci: Quieten initialization messages (stable-fixes).\n- i3c: mipi-i3c-hci: Refactor PIO register initialization (stable-fixes).\n- i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc() (stable-fixes).\n- ibmveth: Add multi buffers rx replenishment hcall support (jsc#PED-16852).\n- ibmvnic: Increase max subcrq indirect entries with fallback (jsc#PED-16854).\n- ibmvnic: Use ndo_get_stats64 to fix inaccurate SAR reporting (jsc#PED-16854).\n- iio: accel: kionix-kx022a: Fix array boundary check (git-fixes).\n- iio: accel: kxcjk-1013: reject duplicate event disable (git-fixes).\n- iio: accel: mma8452: switch to non-devm request_threaded_irq() (stable-fixes).\n- iio: accel: sca3000: fix frequency divider condition check (git-fixes).\n- iio: adc: pac1934: check ACPI label duplication (git-fixes).\n- iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind (stable-fixes).\n- iio: adc: rtq6056: add i2c_device_id support (stable-fixes).\n- iio: adc: stm32-adc: fix check on internal channel availability (git-fixes).\n- iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure (git-fixes).\n- iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls (git-fixes).\n- iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind (git-fixes).\n- iio: admv1013: initialize callback mutex before registering notifier (git-fixes).\n- iio: buffer: Ensure bounce buffer used for unaligned case is zeroed (git-fixes).\n- iio: buffer: serialize buffer teardown with mode claims (git-fixes).\n- iio: frequency: admv1013: fix wrong channel field used in admv1013_read_raw() (git-fixes).\n- iio: gyro: adis16136: fix unprotected debugfs reads (git-fixes).\n- iio: health: max30102: fix NULL dereference in interrupt handler (git-fixes).\n- iio: imu: adis16400: fix unprotected debugfs reads (git-fixes).\n- iio: light: gp2ap020a00f: drain irq_work after free_irq (git-fixes).\n- iio: light: stk3310: Deal with the ps interrupt issue in PM (stable-fixes).\n- iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup (git-fixes).\n- iio: proximity: aw96103: validate firmware data length (git-fixes).\n- iio: proximity: isl29501: Fix return type of isl29501_register_write (git-fixes).\n- iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure (git-fixes).\n- iio: proximity: sx9324: Correct proximity channel resolution (git-fixes).\n- iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler (git-fixes).\n- iio: trigger: cancel reenable_work before freeing trigger (git-fixes).\n- Input: adp5588-keys - cache GPIO state before registering the gpiochip (git-fixes).\n- Input: aiptek - validate raw macro indices before updating state (stable-fixes).\n- Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 (git-fixes).\n- Input: cyttsp5 - clamp the HID report size before memcpy (git-fixes).\n- Input: eeti_ts - publish the OF module alias (git-fixes).\n- Input: evdev - zero absinfo before partial copy in EVIOCSABS (git-fixes).\n- Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P (stable-fixes).\n- Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() (git-fixes).\n- Input: s6sy761 - fix resume ordering and restore sensing (git-fixes).\n- Input: soc_button_array - check btns_desc-\u003epackage.count (git-fixes).\n- Input: soc_button_array - fix MS Surface Pro 11 probe failure (git-fixes).\n- Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) (stable-fixes).\n- Input: synaptics - limit T440p InterTouch quirk to LEN0036 (git-fixes).\n- Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound (git-fixes).\n- Input: trackpoint - fix the inertia attribute name in the ABI document (git-fixes).\n- Input: xpad - add support for Azeron devices (stable-fixes).\n- Input: xpad - add support for Victrix Pro BFG Controller (stable-fixes).\n- Input: xpad - fix PDP Marvel Xbox 360 controller (git-fixes).\n- Input: zero ff_effect before compat copy in input_ff_effect_from_user (git-fixes).\n- kernel-binary.spec.in: Emulate kabi.pl error when suse-kabi-tools is used.\n- kernel-binary.spec.in: Fix syntax error.\n- KEYS: encrypted: fix integer overflow of datablob_len (git-fixes).\n- keys: fix lost wakeup when reaping a dead key type (git-fixes).\n- keys: translate request_key_auth pid for the reading procfs instance (git-fixes).\n- KEYS: trusted: Fix tpm2_load_cmd() boundary check (git-fixes).\n- KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure (git-fixes).\n- KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve() (git-fixes).\n- KVM: arm64: vgic: Don't leak the SPI array when init is retried (git-fixes).\n- KVM: arm64: vgic: Prevent speculative SPI array underflow (git-fixes).\n- KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU (git-fixes).\n- KVM: nVMX: Always flush vpid02 on first use (git-fixes).\n- KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02 (git-fixes).\n- KVM: nVMX: Synthesize SHUTDOWN on RSM if L2 requires emulation (git-fixes).\n- KVM: VMX: Handle bad values on proxied writes to LBR MSRs (git-fixes).\n- KVM: VMX: Reject KVM_RUN if userspace forces emulation during nested VM-Enter (git-fixes).\n- KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy (git-fixes).\n- KVM: x86/pmu: Move Intel PMU global MSRs to intel_is_valid_msr() (git-fixes).\n- KVM: x86: Extract VMX's unhandleable emulation check to common x86 (git-fixes).\n- KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails (git-fixes).\n- leds: pca9532: Don't stop blinking for non-zero brightness (stable-fixes).\n- leds: trigger: gpio: Use GPIOD_FLAGS_BIT_NONEXCLUSIVE (stable-fixes).\n- leds: uleds: Return -EFAULT on copy_to_user() failure (stable-fixes).\n- media: chips-media: wave5: Add range checks for dec_output_info (stable-fixes).\n- media: chips-media: wave5: Fix Reports from Kernel Lock Validator (stable-fixes).\n- media: dm1105: fix missing error check for dma_alloc_coherent (stable-fixes).\n- media: em28xx-video: fix missing res_free() on init_usb_xfer failure (stable-fixes).\n- media: i2c: imx355: Replace client-\u003edev usage (stable-fixes).\n- media: imon: Add iMON VFD HID OEM v1.2 key mappings (stable-fixes).\n- media: imx355: Avoid calling imx355_power_off twice in error path (git-fixes).\n- media: qcom: camss: avoid format string warning (stable-fixes).\n- media: rc: mceusb: Add support for 04eb:e033 (stable-fixes).\n- media: video-i2c: fix buffer queue ordering (stable-fixes).\n- media: video-i2c: use vb2_video_unregister_device on driver removal (stable-fixes).\n- memstick: ms_block: destroy io_queue workqueue on removal (git-fixes).\n- mfd: db8500-prcmu: Fold dbx500 header into db8500 (git-fixes).\n- mfd: rsmu: Add 8a34002 support (stable-fixes).\n- mfd: tps65219: Make poweroff handler conditional on system-power-controller (stable-fixes).\n- mmc: core: Add validation for host-provided max_segs (stable-fixes).\n- mmc: core: Cancel SDIO IRQ work before freeing host (git-fixes).\n- mmc: core: Fix OF node reference leak on card add failure (git-fixes).\n- mmc: davinci: avoid NULL deref of host-\u003edata in IRQ handler (stable-fixes).\n- mmc: davinci: fix mmc_add_host order in probe (stable-fixes).\n- mmc: hsq: Fix use-after-free in retry work (git-fixes).\n- mmc: mmci: Fix use-after-free in busy-timeout work (git-fixes).\n- mmc: mxcmmc: cancel data work and watchdog on remove (git-fixes).\n- mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC (stable-fixes).\n- mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC (stable-fixes).\n- mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260 (stable-fixes).\n- mmc: sdhci-of-aspeed: Remove children before releasing SDC resources (git-fixes).\n- mmc: sdhci_am654: Clear ITAPDLY on tuning failure (git-fixes).\n- mmc: sdhci_am654: Fallback to DT-provided itap delay on DDR50 tuning failure (git-fixes).\n- mmc: sdhci_am654: Move tuning_loop to local variable (git-fixes).\n- mmc: sdhci_am654: Reset command and data lines on failed tuning (git-fixes).\n- mmc: sdio_uart: fix xmit_fifo leak when the port table is full (git-fixes).\n- mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt (git-fixes).\n- mmc: spi: reset bytes_xfered before retrying CRC failures (git-fixes).\n- mtd: block2mtd: Fix divide error when erase_size is zero (git-fixes).\n- mtd: core: avoid double-free of OTP NVMEM device (git-fixes).\n- mtd: core: call _get_device() with the master MTD (git-fixes).\n- mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ (git-fixes).\n- mtd: rawnand: pl353: Add message about ECC mode (stable-fixes).\n- mtd: rawnand: pl353: Fix debug prints (git-fixes).\n- mtd: rawnand: pl353: Make sure we use the monolithic helpers for raw accesses (git-fixes).\n- mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB (git-fixes).\n- mtd: spinand: fix zero oobavail when no ECC engine is used (git-fixes).\n- net/ibmveth: fix comment typos in ibmveth.c (jsc#PED-16852).\n- net: mana: Clear RDMA teardown and suspend state in mana_rdma_probe() (git-fixes).\n- net: mana: Reserve extra CQ slot for the fence completion CQE (git-fixes).\n- net: mana: restore the XDP program pointer when pre-allocation fails (git-fixes).\n- net: page_pool: Remove zone/policy GFP flags when allocating XArray entries (git-fixes).\n- net: usb: catc: bound the RX packet length in catc_rx_done() (git-fixes).\n- net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist (stable-fixes).\n- net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs() (git-fixes).\n- net: usb: pegasus: don't rely on id table pointer arithmetic (stable-fixes).\n- net: usb: qmi_wwan: add MeiG SRM813Q (stable-fixes).\n- net: usb: sr9700: include receive overhead in the length check (git-fixes).\n- net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value (git-fixes).\n- net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain (git-fixes).\n- net: wwan: t7xx: Add delay between MD and SAP suspend (stable-fixes).\n- net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() (git-fixes).\n- nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() (git-fixes).\n- nfc: llcp: fix -ENOMEM on connect with zero-length service name (git-fixes).\n- nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() (git-fixes).\n- nfc: llcp: Fix race condition in accept_queue lifecycle (git-fixes).\n- nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure (git-fixes).\n- nfc: llcp: fix slab-out-of-bounds reads when logging service names (git-fixes).\n- nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() (git-fixes).\n- nfc: nfcmrvl: validate helper command length before pull (git-fixes).\n- nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() (git-fixes).\n- nfc: port100: reject frames whose declared length exceeds the received data (git-fixes).\n- nfc: st21nfca: validate ISO15693 inventory length (git-fixes).\n- nfc: st21nfca: validate received frame size (git-fixes).\n- nfc: virtual_ncidev: Add missing ioctl compat handler (git-fixes).\n- PCI/MSI: Enable memory decoding before restoring MSI-X messages (git-fixes).\n- PCI/proc: Fix race between pci_proc_init() and pci_bus_add_device() (stable-fixes).\n- PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store() (stable-fixes).\n- PCI: Accept AtomicOps already enabled by the hypervisor (git-fixes).\n- PCI: altera: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: Avoid FLR for MediaTek MT7925 WiFi (stable-fixes).\n- PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems (stable-fixes).\n- PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk (git-fixes).\n- PCI: iproc: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: mediatek: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: of_property: Omit bus properties without a subordinate bus (git-fixes).\n- PCI: plda: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: rockchip: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: Stop setting cached power state to 'unknown' on unbind (stable-fixes).\n- PCI: switchtec: Add Gen6 Device IDs (stable-fixes).\n- PCI: Wait for device readiness after D3hot -\u003e D0uninitialized transition (stable-fixes).\n- PCI: xgene: Drop unnecessary OF node reference (git-fixes).\n- PCI: xgene: Drop XGENE_PCIE_IP_VER_UNKN (stable-fixes).\n- phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow (git-fixes).\n- phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting (git-fixes).\n- pinctrl: meson: Fix typo in s4 group name (git-fixes).\n- pinctrl: single: free the IRQ on domain creation failure (git-fixes).\n- pinctrl: sunxi: keep a shadow copy of the data register output latches (git-fixes).\n- platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table (stable-fixes).\n- platform/x86: hp-bioscfg: bound ordered-list parsing by the package count (stable-fixes).\n- platform/x86: hp-bioscfg: pass validated element count to package parsers (stable-fixes).\n- platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table (stable-fixes).\n- platform/x86: ISST: Check for admin capability for write commands (stable-fixes).\n- platform/x86: ISST: Validate max level for set feature (git-fixes).\n- platform/x86: msi-ec: Add support for MSI Pulse GL66 12th Gen (stable-fixes).\n- platform/x86: sel3350-platform: Retain LED state on load and unload (stable-fixes).\n- platform/x86: think-lmi: improve check if BIOS account security enabled (stable-fixes).\n- power: sequencing: don't call .post_enable() if pwrseq_unit_enable() failed (git-fixes).\n- power: sequencing: fix NULL-pointer dereference in pwrseq_device_register() (git-fixes).\n- power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new() (git-fixes).\n- power: supply: ab8500_fg: fix use-after-free on remove (git-fixes).\n- power: supply: ab8500_fg: Remove redundant dev_err()/dev_err_probe() (stable-fixes).\n- powerpc/crash: stop watchdogs before booting kdump kernel (bsc#1277705 ltc#220979).\n- powerpc/perf: Add power12 Base Performance Monitoring support (jsc#PED-16906).\n- powerpc/pseries: Handle and log pseries-wdt registration failures (bsc#1277705 ltc#220979).\n- powerpc/pseries: Limit PVR list to 16 entries for CAS negotiation (jsc#PED-16906).\n- powerpc/pseries: Move H_WATCHDOG definitions to a common header (bsc#1277705 ltc#220979).\n- powerpc: Add Power12 architected mode (jsc#PED-16906).\n- powerpc: Add Power12 raw mode (jsc#PED-16906).\n- procfs: fix possible double mmput() in do_procmap_query() (git-fixes).\n- RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations (git-fixes).\n- RDMA/core: Fix potential use after free in counter_release() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_dealloc_pd_user() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_destroy_cq_user() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_destroy_srq_user() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_free_cq() (git-fixes).\n- RDMA/core: Fix use after free in ib_query_qp() (git-fixes).\n- RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup (git-fixes).\n- RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables (git-fixes).\n- RDMA/hfi1: Align probe error unwinding with device removal (git-fixes).\n- RDMA/hfi1: Allocate device data after PCI initialization (git-fixes).\n- RDMA/hfi1: Create workqueues before device initialization (git-fixes).\n- RDMA/hfi1: Defer device creation until probe succeeds (git-fixes).\n- RDMA/hfi1: Drop device data from hfi1_validate_rcvhdrcnt() (git-fixes).\n- RDMA/hfi1: Free RX data on late probe failure (git-fixes).\n- RDMA/hfi1: Initialize debugfs after probe completes (git-fixes).\n- RDMA/hfi1: Pass PCI device to hfi1_pcie_init() (git-fixes).\n- RDMA/hfi1: Preserve unit 0 on (git-fixes).\n- RDMA/hfi1: Remove redundant NULL checks in create_workqueues() (git-fixes).\n- RDMA/hfi1: Remove redundant PCI device ID validation (git-fixes).\n- RDMA/hfi1: Stop flushing the global IB workqueue (git-fixes).\n- RDMA/irdma: Add a refcount to track user ring MR associations (git-fixes).\n- RDMA/irdma: Add irdma_cq fields to track pbl allocations (git-fixes).\n- RDMA/irdma: Deduplicate the irdma_del_memlist logic (git-fixes).\n- RDMA/rvt: Return NULL after port allocation failure (git-fixes).\n- regulator: core: clamp voltage constraints before applying apply_uV (stable-fixes).\n- regulator: da9121: Use subvariant ids in the I2C table (stable-fixes).\n- ring-buffer: Add helper functions for allocations (bsc#1277895 bsc#1280334).\n- ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() (bsc#1277896).\n- ring-buffer: Simplify functions with __free(kfree) to free allocations (bsc#1277895 bsc#1280334).\n- rtc: ac100: Assign .num before accessing .hws (git-fixes).\n- rtc: aspeed: add AST2700 compatible (stable-fixes).\n- rtc: bq32000: add delay between RTC reads (stable-fixes).\n- rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak (git-fixes).\n- rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe() (git-fixes).\n- rtc: mv: add suspend/resume support for wakeup (stable-fixes).\n- rtc: spear: initialize IRQ state before requesting alarm IRQ (git-fixes).\n- selftests: fib_nexthops: do not mark skipped tests as failed (bsc#1283296).\n- serial: 8250: fix possible ISR soft lockup (stable-fixes).\n- serial: 8250_bcm7271: fix use-after-free in brcmuart_remove() (git-fixes).\n- serial: fix TIOCMIWAIT race (git-fixes).\n- serial: ma35d1: Fix clock reference leak in ma35d1serial_probe() (git-fixes).\n- serial: sc16is7xx: fix TX gap caused by kfifo circular buffer wrap-around (git-fixes).\n- serial: sc16is7xx: refill TX FIFO below trigger using fresh TXLVL (git-fixes).\n- serial: tegra: don't clear the Tx FIFO on an Rx-only reset (git-fixes).\n- serial: vt8500: Fix clock reference leak in vt8500_serial_probe() (git-fixes).\n- smb: client: reject overlapping data areas in SMB2 responses (git-fixes).\n- soc: qcom: geni-se: Correct QUP Core ICC vote constants (git-fixes).\n- soundwire: cadence_master: wait and cancel cdns-\u003ework before clock stop (git-fixes).\n- soundwire: dmi-quirks: Disable ghost Realtek devices (stable-fixes).\n- soundwire: intel: Move suspend tracking from trigger to pm suspend (stable-fixes).\n- soundwire: intel_auxdevice: Add cs42l43b to wake_capable_list (stable-fixes).\n- soundwire: only handle alert events when the peripheral is attached (stable-fixes).\n- soundwire: validate DT compatible before parsing it (stable-fixes).\n- spi: dw-dma: Wait for controller idle before completing Tx (git-fixes).\n- spi: dw-mmio: Add ACPI ID LECA0002 for LECARC SoCs (stable-fixes).\n- spi: dw: fix wrong RX_SAMPLE_DLY setting after resume (git-fixes).\n- spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM (stable-fixes).\n- spi: xilinx: let transfers timeout in case of no IRQ (stable-fixes).\n- thermal/drivers/qcom/tsens: Atomic temperature read with hardware-guided retries (stable-fixes).\n- thermal/drivers/tegra/soctherma: Switch to devm cooling device registration (stable-fixes).\n- thermal: gov_step_wise: Fix stale mitigation vote with non-zero lower bounds (git-fixes).\n- thunderbolt: Avoid reserved fields in path config space for USB4 routers (stable-fixes).\n- thunderbolt: Don't access path config space on Lane 1 adapters in tb_switch_reset_host() (stable-fixes).\n- thunderbolt: Don't disable lane adapter if XDomain lane bonding isn't possible (stable-fixes).\n- thunderbolt: Fix KASAN reported use-after-free when request is canceled (git-fixes).\n- thunderbolt: Improve multi-display DisplayPort tunnel allocation (stable-fixes).\n- thunderbolt: Increase timeout for Configuration Ready bit (stable-fixes).\n- thunderbolt: Keep the domain reference while processing hotplug (stable-fixes).\n- thunderbolt: Keep XDomain reference during the lifetime of a service (stable-fixes).\n- thunderbolt: Reject oversized XDomain properties responses (git-fixes).\n- thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() (stable-fixes).\n- thunderbolt: Set tb-\u003eroot_switch to NULL when domain is stopped (stable-fixes).\n- thunderbolt: Verify Router Ready bit is set after router enumeration (stable-fixes).\n- tpm: Disable TPM on null key name mismatch (git-fixes).\n- tty: serial: max3100: shut down timer before freeing port (git-fixes).\n- tty: serial: qcom_geni_serial: Keep console RX functional after deep idle (git-fixes).\n- tty: vt: fix memory leak in vc_allocate() (git-fixes).\n- usb-storage: ene_ub6250: fix race between scan work and probe (stable-fixes).\n- USB: cdc-acm: fix racy TIOCMIWAIT implementation (git-fixes).\n- USB: cdc-acm: skip URB restart in port_shutdown if disconnected (git-fixes).\n- USB: cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set (stable-fixes).\n- usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe (git-fixes).\n- usb: cdns3: fix use-after-free in cdns3_gadget_exit() (git-fixes).\n- usb: cdns3: rename hibernated argument of role-\u003eresume() to lost_power (stable-fixes).\n- usb: chipidea: tegra: disable runtime PM on resume failure (git-fixes).\n- usb: core: clear both ep_in and ep_out for non-ep0 control endpoints (git-fixes).\n- usb: core: hcd: fix possible deadlock in rh control transfers (stable-fixes).\n- usb: dwc3: am62: Fix runtime PM usage count leak on probe error path (git-fixes).\n- usb: gadget: aspeed-vhub: cancel wake work on device removal (git-fixes).\n- usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue (stable-fixes).\n- USB: gadget: dummy-hcd: Fix wait for outstanding request completions (git-fixes).\n- usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC (git-fixes).\n- usb: gadget: f_fs: Fix Use-After-Free in AIO error path (git-fixes).\n- usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd (git-fixes).\n- USB: gadget: ffs: fix mm lifetime handling (stable-fixes).\n- USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() (stable-fixes).\n- usb: gadget: goku_udc: avoid NULL deref of dev-\u003edriver in INT_USBRESET log (stable-fixes).\n- usb: gadget: midi2: Fix the jack descriptor array sizes (git-fixes).\n- usb: gadget: udc: skip pullup() if already connected (stable-fixes).\n- usb: host: add ARCH_AIROHA in XHCI MTK dependency (stable-fixes).\n- usb: hub: use shorter 120ms post resume hold for SS root hubs (git-fixes).\n- usb: image: mdc800: change kmalloc() to kzalloc() (stable-fixes).\n- usb: octeon-hcd: fix the FIFO-flush timeout computation (git-fixes).\n- usb: ohci-da8xx: disable controller wakeup on cleanup (git-fixes).\n- usb: ohci-s3c2410: disable controller wakeup on removal (git-fixes).\n- usb: ohci-st: disable controller wakeup on removal (git-fixes).\n- USB: serial: fix driver deregistration order (git-fixes).\n- USB: serial: fix dynamic id driver deregistration race (git-fixes).\n- USB: serial: fix ioctl hangup race (git-fixes).\n- USB: serial: fix port tear down use-after-free (git-fixes).\n- USB: serial: quatech2: fix baud rate overflow (git-fixes).\n- usb: serial: spcp8x5: don't store usb_device_id (stable-fixes).\n- USB: serial: ssu100: fix baud rate overflow (git-fixes).\n- usb: storage: sierra_ms: reject short SWoC info transfers (git-fixes).\n- usb: typec: anx7411 - stop the IRQ before destroying the workqueue (git-fixes).\n- usb: typec: tcpm: recover after failure to start the frs ams (git-fixes).\n- usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() (git-fixes).\n- usb: typec: ucsi: displayport: Current CAM OOB index fixup (git-fixes).\n- usb: typec: ucsi: Get the connector fwnode based on reg value (git-fixes).\n- usb: typec: ucsi: glink: fix use-after-free of ucsi on remove (git-fixes).\n- usb: usbtmc: don't store usb_device_id (stable-fixes).\n- usb: xhci: Improve Soft Retries after short transfers (stable-fixes).\n- usb: xhci: use cached HCSPARAMS1 value (stable-fixes).\n- usb: xusbatm: don't rely on id table pointer arithmetic (stable-fixes).\n- usbip: vhci_hcd: fix NULL deref in status_show_vhci (stable-fixes).\n- vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF (git-fixes).\n- vt: skip screen update for DEC alignment test on backgroup consoles (git-fixes).\n- watchdog: da9062: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes).\n- watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes).\n- watchdog: digicolor: Avoid division by zero (git-fixes).\n- watchdog: imx7ulp_wdt: Keep WDOG running until A55 enters WFI on i.MX94 (stable-fixes).\n- watchdog: lenovo_se10_wdt: Add support for SE10 Gen 2 platform (stable-fixes).\n- watchdog: lenovo_se10_wdt: Fix use-after-free and resource leak risk (stable-fixes).\n- watchdog: msc313e: Fix premature reset during timeout update (git-fixes).\n- watchdog: msc313e: Propagate error code in resume() (git-fixes).\n- watchdog: rtd119x: Avoid division by zero (git-fixes).\n- watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init() (git-fixes).\n- watchdog: starfive-wdt: Fix runtime PM leak in starfive_wdt_pm_start() (git-fixes).\n- wifi: ath9k_htc: don't store usb_device_id (stable-fixes).\n- wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all() (git-fixes).\n- wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi (stable-fixes).\n- wifi: ath11k: fix stride mismatch in mac_phy_caps_parse() (git-fixes).\n- wifi: ath12k: fix stride mismatch in mac_phy_caps_parse() (git-fixes).\n- wifi: brcmfmac: fix lost 802.1x TX completion wakeup (git-fixes).\n- wifi: brcmsmac: fix UAF in brcms_free_timer() (git-fixes).\n- wifi: cfg80211: check IP header size in cfg80211_classify8021d() (git-fixes).\n- wifi: cfg80211: don't filter by BSS type when removing stale entries (git-fixes).\n- wifi: cfg80211: don't get the radio mask for netdev-less wdevs (git-fixes).\n- wifi: cfg80211: expose cfg80211_chandef_get_width() (stable-fixes).\n- wifi: cfg80211: fix width unit in cfg80211_radio_chandef_valid() (git-fixes).\n- wifi: cfg80211: only group hidden BSSes with beacon entries (git-fixes).\n- wifi: cfg80211: reject duplicate wiphy cipher suite entries (stable-fixes).\n- wifi: cfg80211: skip regulatory for punctured subchannels (stable-fixes).\n- wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() (stable-fixes).\n- wifi: cfg80211: validate rx/tx MLME callback frame lengths before access (stable-fixes).\n- wifi: iwlegacy: fix broadcast stations deallocation (git-fixes).\n- wifi: iwlwifi: acpi: validate WGDS table revision index (stable-fixes).\n- wifi: iwlwifi: bound aligned TLV advance in FW parser (stable-fixes).\n- wifi: iwlwifi: mvm: add a check on the tid coming from the firmware (stable-fixes).\n- wifi: iwlwifi: mvm: fix a possible underflow (stable-fixes).\n- wifi: iwlwifi: mvm: fix an off-by-1 boundary check (stable-fixes).\n- wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif (stable-fixes).\n- wifi: iwlwifi: mvm: fix sched scan IE sizing (stable-fixes).\n- wifi: iwlwifi: mvm: parse beacon notif per layout (stable-fixes).\n- wifi: iwlwifi: mvm: validate mac_link_id in session protect notif (stable-fixes).\n- wifi: iwlwifi: mvm: validate sta_id in BA window status notif (stable-fixes).\n- wifi: iwlwifi: mvm: validate TX_CMD response layout (stable-fixes).\n- wifi: libertas: reject short monitor TX frames (stable-fixes).\n- wifi: libipw: fix key index receive bound checks (stable-fixes).\n- wifi: libipw: reject too-short association responses (git-fixes).\n- wifi: libipw: reject too-short beacon and probe responses (git-fixes).\n- wifi: mac80211: abort chanswitch when leaving a mesh (git-fixes).\n- wifi: mac80211: add HE 6 GHz capability in the scan elems len (git-fixes).\n- wifi: mac80211: always allow transmitting null-data on TXQs (stable-fixes).\n- wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver (git-fixes).\n- wifi: mac80211: don't access the TSF of a down interface (git-fixes).\n- wifi: mac80211: don't allow injecting frames wider than the chanctx (git-fixes).\n- wifi: mac80211: don't allow link changes when iface is down (git-fixes).\n- wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed (stable-fixes).\n- wifi: mac80211: don't offload TC setup on AP_VLAN interfaces (git-fixes).\n- wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set (git-fixes).\n- wifi: mac80211: don't start a ROC while scanning (git-fixes).\n- wifi: mac80211: explicitly disable FTM responder on AP stop (stable-fixes).\n- wifi: mac80211: ibss: wait for in-flight TX on disconnect (stable-fixes).\n- wifi: mac80211: mesh: release the channel if start fails (git-fixes).\n- wifi: mac80211: mesh: reset the CSA state when leaving (git-fixes).\n- wifi: mac80211: only operate on TDLS peers in the TDLS code (git-fixes).\n- wifi: mac80211: require a peer station for TDLS setup confirm (git-fixes).\n- wifi: mac80211: reset state when starting AP fails (git-fixes).\n- wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown (git-fixes).\n- wifi: mac80211: set up the TX info early to fix failure paths (git-fixes).\n- wifi: mac80211: suppress chanctx warning for debugfs reset (git-fixes).\n- wifi: mac80211: unlist vifs when their netdev is unregistered (git-fixes).\n- wifi: mac80211: validate deauth frame length before reason access (stable-fixes).\n- wifi: mt76: add init_wiphy callback (stable-fixes).\n- wifi: mt76: mt7915: set correct background radar capability (stable-fixes).\n- wifi: mt76: mt7925: add 320MHz bandwidth to bss_rlm_tlv (stable-fixes).\n- wifi: mt76: mt7925: add Netgear A8500 USB device ID (stable-fixes).\n- wifi: mt76: mt7925: advertise EHT 320MHz capabilities for 6GHz band (stable-fixes).\n- wifi: mt76: mt7925: Fix EHT Beamformee SS subfields to meet 802.11be minimum (git-fixes).\n- wifi: mt76: mt7925: handle 320MHz bandwidth in RXV and TXS (stable-fixes).\n- wifi: mt76: mt7925: populate EHT 320MHz MCS map in sta_rec (stable-fixes).\n- wifi: mt76: transform aspm_conf for pci_disable_link_state (stable-fixes).\n- wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length (git-fixes).\n- wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path (git-fixes).\n- wifi: mwifiex: prevent authentication frame length truncation (git-fixes).\n- wifi: mwifiex: replace one-element arrays with flexible array members (stable-fixes).\n- wifi: mwifiex: validate action frame fixed fields (git-fixes).\n- wifi: mwifiex: validate scan response extents (git-fixes).\n- wifi: nl80211: reject beacons with bad HE operation (stable-fixes).\n- wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST (git-fixes).\n- wifi: p54: validate curve data length in the calibration curve converters (git-fixes).\n- wifi: ralink: RT2X00: init EEPROM properly (stable-fixes).\n- wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers (stable-fixes).\n- wifi: rsi: fix heap OOB write on key removal (git-fixes).\n- wifi: rsi: validate beacon length before fixed buffer copy (stable-fixes).\n- wifi: rtw88: Add NULL check for chip-\u003eedcca_th in rtw_fw_adaptivity_result() (stable-fixes).\n- wifi: rtw88: Fix the random \"error beacon valid\" messages for USB (stable-fixes).\n- wifi: rtw88: TX QOS Null data the same way as Null data (stable-fixes).\n- wifi: rtw89: cleanup unused rtwdev::roc_work (stable-fixes).\n- wifi: rtw89: disable CSI STBC for VHT 160MHz (stable-fixes).\n- wifi: rtw89: Hide some errors when the device is unplugged (stable-fixes).\n- wifi: rtw89: pci: enable LTR based on pcie control register (stable-fixes).\n- wifi: rtw89: phy: check length before parsing PHY status IE (stable-fixes).\n- wifi: virt_wifi: don't transfer operstate before register (git-fixes).\n- wifi: virt_wifi: free skb when disconnected (git-fixes).\n- wifi: wilc1000: fix out-of-bounds read in P2P public action frames (git-fixes).\n- wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() (git-fixes).\n- wifi: wlcore: release runtime PM ref on regdomain config failure (git-fixes).\n- xhci: Prevent queuing new commands if xhci is inaccessible (stable-fixes).\n","status":"published","published":"2026-10-12T13:51:59Z","modified":"2026-10-20T17:24:00.253930144Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24197-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2025-40136: crypto: hisilicon/qm - request reserved interrupt for virtual function (bsc#1253340).\n- CVE-2026-23199: procfs: avoid fetching build ID while holding VMA lock (bsc#1258335).\n- CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).\n- CVE-2026-43210: tracing: ring-buffer: Fix to check event length before using (bsc#1264330).\n- CVE-2026-43272: ring-buffer: Fix possible dereference of uninitialized pointer (bsc#1264607).\n- CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).\n- CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).\n- CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).\n- CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).\n- CVE-2026-46272: coresight: tmc-etr: Fix race condition between sysfs and perf mode (bsc#1267672).\n- CVE-2026-53377: drm/msm: always recover the gpu (bsc#1271901).\n- CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).\n- CVE-2026-63838: ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] (bsc#1272388).\n- CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).\n- CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check\n  (bsc#1272890).\n- CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).\n- CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).\n- CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).\n- CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).\n- CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).\n- CVE-2026-64132: ipv6: ioam: refresh hdr pointer before ioam6_event() (bsc#1272347).\n- CVE-2026-64154: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() (bsc#1271950).\n- CVE-2026-64173: tracing: Do not call map-\u003eops-\u003eelt_free() if elt_alloc() fails (bsc#1272145).\n- CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).\n- CVE-2026-64216: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() (bsc#1272802).\n- CVE-2026-64235: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines (bsc#1272803).\n- CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).\n- CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).\n- CVE-2026-64324: udf: validate free block extents against the partition length (bsc#1273970).\n- CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).\n- CVE-2026-64377: cpufreq: qcom-cpufreq-hw: Fix possible double free (bsc#1273297).\n- CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).\n- CVE-2026-64402: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (bsc#1273258).\n- CVE-2026-64405: Bluetooth: separate CIS_LINK and BIS_LINK link types (bsc#1273512).\n- CVE-2026-64414: netfilter: handle unreadable frags (bsc#1273275).\n- CVE-2026-64418: mm: shrinker: fix shrinker_info teardown race with expansion (bsc#1273784).\n- CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).\n- CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).\n- CVE-2026-64457: virtio_pci: fix vq info pointer lookup via wrong index (bsc#1273491).\n- CVE-2026-64473: vfio: Remove device debugfs before releasing devres (bsc#1273320).\n- CVE-2026-64474: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (bsc#1274316).\n- CVE-2026-64475: vfio/pci: Release the VGA arbiter client on register_device() failure (bsc#1274319).\n- CVE-2026-64476: vfio/pci: Latch disable_idle_d3 per device (bsc#1274245).\n- CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037).\n- CVE-2026-64594: usb: gadget: f_fs: initialize reset_work at allocation time (bsc#1274538).\n- CVE-2026-64597: smb: client: fix double-free in SMB2_close() replay (bsc#1274297).\n- CVE-2026-64598: smb/client: Fix error code in smb2_aead_req_alloc() (bsc#1274298).\n- CVE-2026-68146: ftrace: Add global mutex to serialize trace_parser access (bsc#1274890).\n- CVE-2026-68264: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (bsc#1275142).\n- CVE-2026-68266: drm/xe: Hold a dma-buf reference for imported BOs (bsc#1275137).\n- CVE-2026-68290: rds: tcp: unregister sysctl before tearing down listen socket (bsc#1275977).\n- CVE-2026-68312: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (bsc#1274663).\n- CVE-2026-68343: smb: client: validate DFS referral PathConsumed (bsc#1274629).\n- CVE-2026-68367: usb: gadget: f_tcm: synchronize delayed set_alt with teardown (bsc#1275170).\n- CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).\n- CVE-2026-68382: drm/xe/guc: Hold device ref until queue teardown completes (bsc#1274824).\n- CVE-2026-68385: s390/checksum: Fix csum_partial() without vector facility (bsc#1274818).\n- CVE-2026-68400: KVM: arm64: Mask response to FFA_FEATURE call (bsc#1274912).\n- CVE-2026-68441: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains (bsc#1274776).\n- CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests (bsc#1276287).\n- CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests (bsc#1276295).\n- CVE-2026-68454: KVM: s390: pci: Fix handling of AIF enable without AISB (bsc#1276388).\n- CVE-2026-68471: wifi: ieee80211: validate MLE common info length (bsc#1276504).\n- CVE-2026-68477: ipvs: fix more places with wrong ipv6 transport offsets (bsc#1275495).\n- CVE-2026-72012: tracing/osnoise: Call synchronize_rcu() when unregistering (bsc#1276783).\n- CVE-2026-72018: dibs: loopback: validate offset and size in move_data() (bsc#1276852).\n- CVE-2026-72025: s390/monwriter: Reject buffer reuse with different data length (bsc#1276923).\n- CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).\n- CVE-2026-72070: wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() (bsc#1277153).\n- CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).\n- CVE-2026-72102: dm_early_create: fix freeing used table on dm_resume failure (bsc#1277314).\n- CVE-2026-72128: nvmet: fix refcount leak in nvmet_sq_create() (bsc#1277101).\n- CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).\n- CVE-2026-72130: nvmet-auth: reject short AUTH_RECEIVE buffers (bsc#1275549).\n- CVE-2026-72147: dmaengine: dw-edma-pcie: Reject devices without driver data (bsc#1277234).\n- CVE-2026-72166: net/9p: fix infinite loop in p9_client_rpc on fatal signal (bsc#1277556).\n- CVE-2026-72218: lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure (bsc#1277218).\n- CVE-2026-72219: lockd: Plug nlm_file leak when nlm_do_fopen() fails (bsc#1277217).\n- CVE-2026-72224: nvdimm/btt: Free arenas on btt_init() error paths (bsc#1277215).\n- CVE-2026-72237: perf/x86/amd/brs: Fix kernel address leakage (bsc#1277615).\n- CVE-2026-72247: netfilter: nf_conncount: fix zone comparison in tuple dedup (bsc#1277662).\n- CVE-2026-72256: netfilter: xt_cluster: reject template conntracks in hash match (bsc#1277674).\n- CVE-2026-72299: tipc: restrict socket queue dumps in enqueue tracepoints (bsc#1275924).\n- CVE-2026-72321: ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() (bsc#1277143).\n- CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).\n- CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).\n- CVE-2026-72349: netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() (bsc#1277784).\n- CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).\n- CVE-2026-72352: HID: bpf: Fix hid_bpf_get_data() range check (bsc#1277823).\n- CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).\n- CVE-2026-72392: ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump (bsc#1277128).\n- CVE-2026-72404: tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() (bsc#1278031).\n- CVE-2026-72406: net: sungem: fix probe error cleanup (bsc#1278035).\n- CVE-2026-72413: sctp: fix err_chunk memory leaks in INIT handling (bsc#1277122).\n- CVE-2026-72433: netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (bsc#1278053).\n- CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped (bsc#1278054).\n- CVE-2026-72435: netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() (bsc#1278056).\n- CVE-2026-72436: netfilter: ipset: Fix data race between add and dump in all hash types (bsc#1277245).\n- CVE-2026-72444: flow_dissector: check device type before reading ETH_ADDRS (bsc#1278100).\n- CVE-2026-72447: sctp: hold socket lock when dumping endpoints in sctp_diag (bsc#1277109).\n- CVE-2026-72491: net/9p: fix race condition on rdma-\u003estate in trans_rdma.c (bsc#1276947).\n- CVE-2026-74256: bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check (bsc#1276535).\n- CVE-2026-74257: sockmap: Fix use-after-free in udp_bpf_recvmsg() (bsc#1276532).\n- CVE-2026-74258: bpf: Guard __get_user acesss with access_ok for uprobe_multi data (bsc#1276538).\n- CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen\n  (bsc#1276519).\n- CVE-2026-74268: tcp: clear sock_ops cb flags before force-closing a child socket (bsc#1276508).\n- CVE-2026-74281: tipc: reject inverted service ranges from peer bindings (bsc#1276474).\n- CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators (bsc#1276475).\n- CVE-2026-74288: net: fib_rules: Don't dump dying fib_rule in fib_rules_dump() (bsc#1276460).\n- CVE-2026-74289: ipv4: fib: Don't dump dying fib_info in fib_leaf_notify() (bsc#1276461).\n- CVE-2026-74290: net/sched: cls_flow: Dont expose folded kernel pointers (bsc#1276462).\n- CVE-2026-74330: configfs: fix lockless traversals of -\u003es_children (bsc#1277129).\n- CVE-2026-74356: vhost: fix vhost_get_avail_idx for a non empty ring (bsc#1278063).\n- CVE-2026-74359: configfs_lookup(): don't leave -\u003es_dentry dangling on failure (bsc#1278067).\n- CVE-2026-74365: nvdimm/btt: Handle preemption in BTT lane acquisition (bsc#1278225).\n- CVE-2026-74376: md/raid10: reset read_slot when reusing r10bio for discard (bsc#1277401).\n- CVE-2026-74384: nvme-multipath: fix flex array size in struct nvme_ns_head (bsc#1277405).\n- CVE-2026-74385: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock (bsc#1278255).\n- CVE-2026-74386: nvmet-tcp: fix page fragment cache leak in error path (bsc#1277098).\n- CVE-2026-74389: RDMA/hns: Fix log flood after cmd_mbox failure (bsc#1278087).\n- CVE-2026-74391: tracing: Bound synthetic-field strings with seq_buf (bsc#1278091).\n- CVE-2026-74398: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (bsc#1277410).\n- CVE-2026-74440: drm/xe: Wait on external BO kernel fences in exec IOCTL (bsc#1261564).\n- CVE-2026-74449: drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport (bsc#1278215).\n- CVE-2026-74450: drm/amd/pm: fix pptable use-after-free (bsc#1278216).\n- CVE-2026-74465: net: openvswitch: fix potential UAF on meter attach failure (bsc#1277801).\n- CVE-2026-74467: s390/qeth: Check CAP_NET_ADMIN for private ioctls (bsc#1277805).\n- CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1277792).\n- CVE-2026-74471: tracing: Check return value of __register_event() in trace_module_add_events() (bsc#1277781).\n- CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() (bsc#1276340).\n- CVE-2026-74480: net: bridge: stop fast-leave after deleting a port group (bsc#1276353).\n- CVE-2026-74483: binfmt_misc: don't leak the user namespace when the mount fails (bsc#1276347).\n- CVE-2026-74484: binfmt_misc: don't let an 'F' entry pin its own instance (bsc#1276345).\n- CVE-2026-74485: binfmt_misc: reject a flag character as the field delimiter (bsc#1277892).\n- CVE-2026-74487: binfmt_misc: restore write access when removing an entry (bsc#1276349).\n- CVE-2026-74490: tipc: avoid use-after-free in poll trace queue dumps (bsc#1276352).\n- CVE-2026-74492: netfilter: ipset: do not update comments from kernel-side hash adds (bsc#1276337).\n- CVE-2026-74493: net/smc: fix socket use-after-free during link group termination (bsc#1276338).\n- CVE-2026-74515: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (bsc#1275953).\n- CVE-2026-74538: Bluetooth: ISO: lock sk in iso_connect_ind (bsc#1275682).\n- CVE-2026-74564: netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH (bsc#1275567).\n- CVE-2026-74579: netfilter: nft_payload: fix mask build for partial field offload (bsc#1275559).\n- CVE-2026-74580: vhost: reset the vring metadata cache on vring reconfiguration (bsc#1277885).\n- CVE-2026-74586: sctp: clear new_transport when removing a peer (bsc#1277820).\n- CVE-2026-74588: sctp: keep chunk-\u003etransport in step with the list it is queued on (bsc#1277766).\n- CVE-2026-74589: bpf, sockmap: Fix sk_redir use-after-free in send verdict (bsc#1277904).\n- CVE-2026-74590: fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions (bsc#1277824).\n- CVE-2026-74592: ima: Instantiate file_truncate and path_truncate hooks (bsc#1277900).\n- CVE-2026-74594: sched/psi: Shut down rtpoll_timer in psi_cgroup_free() (bsc#1277843).\n- CVE-2026-74595: fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() (bsc#1277910).\n- CVE-2026-74597: ip6_tunnel: clear skb2-\u003ecb in ip6ip6_err() (bsc#1277493).\n- CVE-2026-74600: mm/page_table_check: skip special zero mappings (bsc#1277640).\n- CVE-2026-74601: ring-buffer: Use current_context for safe per-CPU buffer swap (bsc#1277896).\n- CVE-2026-74602: ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer() (bsc#1277895).\n- CVE-2026-74603: ptp: ocp: Fix board ID over-read (bsc#1277915).\n- CVE-2026-74605: eventfs: Use children field for rcu head and add memory barriers (bsc#1277913).\n- CVE-2026-74606: eventfs: Fix use-after-free in eventfs_remove_rec() (bsc#1277864).\n- CVE-2026-74609: tipc: read le-\u003elink under the node lock in tipc_node_link_down() (bsc#1277906).\n- CVE-2026-74625: netfilter: bridge: release template ct on non-IP path (bsc#1277036).\n- CVE-2026-74628: net/x25: fix use-after-free of the socket by its timers (bsc#1277844).\n- CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191).\n- CVE-2026-74631: net: smc: fix splice entry lifetime imbalance in smc_rx_splice (bsc#1278195).\n- CVE-2026-74632: mm/huge_memory: fix huge_zero_pfn race (bsc#1278199).\n- CVE-2026-74634: ring-buffer: Prevent subbuf order change when resizing is disabled (bsc#1277379).\n- CVE-2026-74636: tracing: Fix race between update_event_fields and, event_define_fields (bsc#1277371).\n- CVE-2026-74637: perf/core: Fix group leader use-after-free after sibling detach (bsc#1277372).\n- CVE-2026-74638: drm/v3d: Serialize the scheduler timeout handlers (bsc#1277374).\n- CVE-2026-74659: net: bridge: mrp: fix uninitialised bytes on the wire (bsc#1277296).\n- CVE-2026-74660: netfilter: ebt_nflog: pin the NFLOG backend (bsc#1277272).\n- CVE-2026-74662: inet: frags: add inet_frag_putn() helper (bsc#1277277).\n- CVE-2026-74663: net/sched: reject overly deep qdisc hierarchies (bsc#1278311).\n- CVE-2026-74666: packet: synchronize pressure clearing with ring reconfiguration (bsc#1277032).\n- CVE-2026-74667: net/packet: reset the MAC header on the packet-socket transmit path (bsc#1277396).\n- CVE-2026-74671: ima: fix out-of-bounds read in xattr_verify() (bsc#1277392).\n- CVE-2026-74688: sctp: clear control chunk transport if it is being removed (bsc#1277489).\n- CVE-2026-74689: net/atm: fix slab-out-of-bounds read in vcc_setsockopt() (bsc#1278314).\n- CVE-2026-74692: net/smc: fix TOCTOU race between smc_listen_out() and listener close (bsc#1276927).\n- CVE-2026-74694: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length (bsc#1277625).\n- CVE-2026-74696: tcp: fix TFO max_qlen accounting across reuseport migration (bsc#1276930).\n- CVE-2026-74697: bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips (bsc#1277897).\n- CVE-2026-74700: net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers (bsc#1277626).\n- CVE-2026-74701: net/openvswitch: check Ethernet header length in key_extract() (bsc#1276921).\n- CVE-2026-74710: xsk: require at least 16 bytes of TX metadata (bsc#1276579).\n- CVE-2026-74713: vhost_iotlb: bound map allocation in add_range (bsc#1276570).\n- CVE-2026-74718: devlink: fix net namespace reference leak in reload (bsc#1276573).\n- CVE-2026-74725: enic: fix tx_hang_reset use-after-free on device removal (bsc#1276563).\n- CVE-2026-74726: bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor (bsc#1276565).\n- CVE-2026-74735: l2tp: fix tunnel and session refcount leak on seq_file release (bsc#1277030).\n- CVE-2026-74739: net/sched: cls_u32: skip hash tables in u32_bind_class() (bsc#1278247).\n- CVE-2026-74745: eth: bnxt: decrease indent in bnxt_request_irq() (bsc#1277382).\n- CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315).\n- CVE-2026-80521: af_unix: Unlink scc_entry in unix_del_edge() (bsc#1277568).\n- CVE-2026-80585: mptcp: fastopen: only mark MPTFO subflows with SYN data (bsc#1277342).\n- CVE-2026-80613: veth: fix NAPI leak in XDP enable error path (bsc#1278205).\n- CVE-2026-80631: btrfs: lzo: reject compressed segment that overflows the compressed input (bsc#1277558).\n- CVE-2026-80664: netfilter: xt_nat: reject unsupported target families (bsc#1277555).\n- CVE-2026-80679: s390/dasd: Fix potential NULL pointer dereference (bsc#1277557).\n- CVE-2026-80686: mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE (bsc#1278245).\n- CVE-2026-80694: net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller (bsc#1278363).\n- CVE-2026-80715: igc: remove napi_synchronize() in igc_down() (bsc#1277840).\n- CVE-2026-80725: net: gro: properly validate BIG TCP aggregation criteria (bsc#1277452).\n- CVE-2026-80747: drm/amdkfd: Add bounds check for CRAT subtype length (bsc#1279536).\n- CVE-2026-80756: selinux: do not cancel a policy conversion that never started (bsc#1278708).\n- CVE-2026-80779: net/ionic: avoid OOB TX partner lookup for hwstamp RXQ (bsc#1279590).\n- CVE-2026-80789: nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621).\n- CVE-2026-80793: ipv4: reject undersized MTUs in ip_do_fragment() (bsc#1279799).\n- CVE-2026-80836: crypto: virtio - bound the akcipher result length (bsc#1279819).\n- CVE-2026-80840: ipv6: seg6: clear IPv4 control block on IPIP decapsulation (bsc#1279875).\n- CVE-2026-80841: net/packet: defer vmalloc TX_RING free until skbs finish (bsc#1279835).\n- CVE-2026-80842: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context (bsc#1279888).\n- CVE-2026-80844: xfrm: ah6: validate routing header segments_left (bsc#1279786).\n- CVE-2026-80846: xfrm: drop ESP-in-TCP packets with no ingress device (bsc#1279878).\n- CVE-2026-80847: tcp: clamp route advmss to TCP_MIN_MSS (bsc#1279850).\n- CVE-2026-80848: xfrm: espintcp: fix UAF during close (bsc#1279581).\n- CVE-2026-80851: gtp: serialize PDP context updates (bsc#1279569).\n- CVE-2026-80852: tls: device: fix out-of-bounds write in tls_append_frag() (bsc#1279532).\n- CVE-2026-80863: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (bsc#1279535).\n- CVE-2026-80864: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (bsc#1279525).\n- CVE-2026-80865: bpf: Add missing access_ok call to copy_user_syms (bsc#1279527).\n- CVE-2026-80880: IB/mlx5: Properly support implicit ODP rereg_mr (bsc#1279497).\n- CVE-2026-80895: mshv: Order pt_vp_array publish against irqfd assertion path (bsc#1279702).\n- CVE-2026-80932: vsock/virtio: flush works in dependency order (bsc#1280143).\n- CVE-2026-80976: seg6: reset IP6CB after IPv6 decapsulation (bsc#1280298).\n- CVE-2026-80979: net/smc: unregister the connection before draining the rx tasklet (bsc#1280299).\n- CVE-2026-80980: net/smc: Address spelling errors (bsc#1280303).\n- CVE-2026-80983: net/smc: fix socket refcount leak in smc_switch_conns() (bsc#1280296).\n- CVE-2026-80984: net/smc: do not dereference an unset send buffer on the SMC-D teardown path (bsc#1280309).\n- CVE-2026-81000: net: tun: bound receive headroom (bsc#1280263).\n- CVE-2026-81001: slip: fix use-after-free in sl_sync() (bsc#1280375).\n- CVE-2026-89448: iommu/vt-d: Force requesting ACS when tboot is enabled (bsc#1280379).\n- CVE-2026-89451: iommu/sva: Set handle-\u003edev before the SVA handle is visible (bsc#1280383).\n- CVE-2026-89453: iommu/amd: Put PCI device after handling PPR faults (bsc#1280384).\n- CVE-2026-89477: sctp: fix NULL deref on untransmitted RECONF completion (bsc#1280338).\n- CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786).\n- CVE-2026-89480: nvme-tcp: reject a read that transferred too few bytes (bsc#1280449).\n- CVE-2026-89481: nvme-tcp: fix host memory disclosure on R2T for a read command (bsc#1280451).\n- CVE-2026-89482: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (bsc#1280350).\n- CVE-2026-89485: lockd: pin next file across nlm_inspect_file lock-drop (bsc#1280456).\n- CVE-2026-89500: ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page (bsc#1280333).\n- CVE-2026-89501: ring-buffer: Hold cpu_buffer::lock when resizing a subbuf (bsc#1280335).\n- CVE-2026-89502: ring-buffer: Free cpu_buffer::free_page with subbuf_order (bsc#1280336).\n- CVE-2026-89503: ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() (bsc#1280334).\n- CVE-2026-89508: RDMA/ucma: Lock the handler in ucma_set_ib_path() (bsc#1280544).\n- CVE-2026-89510: RDMA/cxgb4: Cancel reg_work before freeing device on remove (bsc#1280551).\n- CVE-2026-89511: qede: Fix NULL pointer dereference in TPA fragment processing (bsc#1280508).\n- CVE-2026-89525: udf: reject VAT indexes equal to the entry count (bsc#1282288).\n- CVE-2026-89526: svcrdma: Validate Read chunk positions before reconstruction (bsc#1280901).\n- CVE-2026-89527: svcrdma: Use svc_xprt_put to free listener on create failure (bsc#1281754).\n- CVE-2026-89530: svcrdma: Reject inline replies that overflow the pull-up buffer (bsc#1280920).\n- CVE-2026-89531: svcrdma: Reject connection when transport allocation fails (bsc#1281738).\n- CVE-2026-89532: svcrdma: Fix pcl_for_each_segment for empty chunks (bsc#1280985).\n- CVE-2026-89533: svcrdma: Fix offset arithmetic in read_chunk_range (bsc#1280993).\n- CVE-2026-89534: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails (bsc#1280766).\n- CVE-2026-89535: svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id (bsc#1280761).\n- CVE-2026-89536: SUNRPC: wait for in-flight client TLS handshake callback (bsc#1280711).\n- CVE-2026-89538: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field (bsc#1280716).\n- CVE-2026-89539: SUNRPC: reject duplicate CREDS_VALUE options (bsc#1280717).\n- CVE-2026-89540: sunrpc: init gssp_lock before publishing proc entry (bsc#1280719).\n- CVE-2026-89541: SUNRPC: harden gss_unwrap_resp_priv length checks (bsc#1280388).\n- CVE-2026-89542: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (bsc#1280387).\n- CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280758).\n- CVE-2026-89545: sunrpc: defer rq_argp and rq_resp free until after RCU grace period (bsc#1280720).\n- CVE-2026-89547: SUNRPC: Check svc pool percpu counter allocation (bsc#1280548).\n- CVE-2026-89548: SUNRPC: always drain cache_cleaner before destroying a cache_detail (bsc#1280546).\n- CVE-2026-89550: SUNRPC: svcauth_gss: enforce krb5 token minimum length (bsc#1280726).\n- CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow (bsc#1280727).\n- CVE-2026-89564: ip: orphan prefetched skbs before multicast forwarding (bsc#1280797).\n- CVE-2026-89580: bpf: Disable preemption in __bpf_get_stack (bsc#1280577).\n- CVE-2026-89603: entry: Fix seccomp bypass after ptrace with TSYNC (bsc#1280923).\n- CVE-2026-89644: btrfs: fix extent map leak in NOCOW direct I/O write (bsc#1281054).\n- CVE-2026-89658: NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup (bsc#1280576).\n- CVE-2026-89660: NFSD: Prevent client use-after-free during admin state revocation (bsc#1280525).\n- CVE-2026-89662: NFSD: Prevent lock owner use-after-free during client teardown (bsc#1280509).\n- CVE-2026-89663: nfsd: revoke copy-notify stateids before dropping their reference (bsc#1280518).\n- CVE-2026-89665: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE (bsc#1281057).\n- CVE-2026-89669: nfsd: initialize copy-notify stateid before publishing it (bsc#1280251).\n- CVE-2026-89671: nfsd: gate nfs3 setacl by argp-\u003emask (bsc#1280252).\n- CVE-2026-89672: nfsd: gate nfs2 setacl by argp-\u003emask (bsc#1280235).\n- CVE-2026-89673: nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo (bsc#1280237).\n- CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280243).\n- CVE-2026-89680: nfsd: fix nfsd_file leak on inter-server COPY setup failure (bsc#1280206).\n- CVE-2026-89683: nfsd: fix dentry ref leak on V4ROOT export filehandle lookup (bsc#1280193).\n- CVE-2026-89684: nfsd: fix cpntf publish race in nfs4_init_cp_state (bsc#1280178).\n- CVE-2026-89685: nfsd: fix clock domain mismatch in clients_still_reclaiming() (bsc#1280179).\n- CVE-2026-89686: nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke (bsc#1280184).\n- CVE-2026-89688: nfsd: drop the stateid, not the stateowner, on seqid_op replay retry (bsc#1280171).\n- CVE-2026-89690: nfsd: defer vfree of compound ops to fix rpc_status UAF (bsc#1280166).\n- CVE-2026-89691: nfsd: clear opcnt on compound arg release to prevent OOB read (bsc#1280163).\n- CVE-2026-89694: nfsd: check client ownership when cancelling a copy-notify stateid (bsc#1280151).\n- CVE-2026-89696: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref (bsc#1280146).\n- CVE-2026-89697: nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() (bsc#1280148).\n- CVE-2026-89698: nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage (bsc#1280494).\n- CVE-2026-89699: nfsd: validate symlink target length in NFSv4 CREATE (bsc#1281077).\n- CVE-2026-89702: nfsd: size fh_verify server sockaddr slot by xpt_locallen (bsc#1280487).\n- CVE-2026-89703: nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations (bsc#1280488).\n- CVE-2026-89704: nfsd: sample writeback error cursor before async COPY loop (bsc#1280490).\n- CVE-2026-89705: nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths (bsc#1280464).\n- CVE-2026-89706: nfsd: Reset write verifier when async COPY writeback fails (bsc#1280477).\n- CVE-2026-89707: nfsd: release path refs on follow_down() error (bsc#1280468).\n- CVE-2026-89710: NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path (bsc#1280455).\n- CVE-2026-89712: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock (bsc#1280870).\n- CVE-2026-89713: NFSD: check truncate permission under inode lock (bsc#1280872).\n- CVE-2026-89747: tracing: Fix use-after-free in trace_pipe read on sub-buffer order change (bsc#1281025).\n- CVE-2026-89780: net: qualcomm: rmnet: restore skb-\u003edev on deaggregated frames (bsc#1280969).\n- CVE-2026-89784: SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 (bsc#1281224).\n- CVE-2026-89789: gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free (bsc#1281226).\n- CVE-2026-89791: perf: Fix use-after-free when perf mmap() revival races with the last munmap() (bsc#1281228).\n- CVE-2026-89798: svcrdma: Fix unmatched rn_unregister on failed accept (bsc#1281136).\n- CVE-2026-89912: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save (bsc#1281201).\n- CVE-2026-89913: KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables (bsc#1281202).\n- CVE-2026-89968: nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229).\n- CVE-2026-89970: nvmet: add a helper function for cqid checking (bsc#1281231).\n- CVE-2026-89984: perf/x86/intel: Fix kernel address leakages in LBR stack (bsc#1281273).\n- CVE-2026-90003: futex: Prevent rcuwait use-after-free during requeue PI (bsc#1281295).\n- CVE-2026-90065: net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure (bsc#1281660).\n- CVE-2026-90074: net/sched: fq_pie: clamp default quantum to avoid signed overflow (bsc#1281496).\n- CVE-2026-90097: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition (bsc#1281514).\n- CVE-2026-90101: bnxt_en: Fix call to hardware monitoring event handler (bsc#1281525 bsc#1283517).\n- CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546).\n- CVE-2026-90142: virtio_net: Fix resize of the RX ring (bsc#1281597).\n- CVE-2026-90149: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers (bsc#1281955).\n- CVE-2026-90150: pnfs/blocklayout: Fix device leaks on parse failure (bsc#1281956).\n- CVE-2026-90151: NFSv4: remove callback IDR entry on client allocation failure (bsc#1281599).\n- CVE-2026-90177: bpf: Check pointer type for all atomic RMW paths (bsc#1281645).\n- CVE-2026-90182: blk-iocost: clear delay state when freeing policy data (bsc#1281644).\n- CVE-2026-90183: blk-iolatency: clear delay state when freeing policy data (bsc#1281964).\n- CVE-2026-90203: Squashfs: check block offset is not negative (bsc#1281808).\n- CVE-2026-90218: RDMA/cma: Fix WARNING in res_to_rt (bsc#1281795).\n- CVE-2026-90228: nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() (bsc#1281717).\n- CVE-2026-90240: iommu/vt-d: Flush context cache with correct SID when tearing down aliases (bsc#1281683).\n- CVE-2026-90241: iommu/vt-d: Tear down scalable-mode context on probe failure (bsc#1281682).\n- CVE-2026-90243: iommu/vt-d: Clear Present bit before tearing down copied context entry (bsc#1281845).\n- CVE-2026-90259: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() (bsc#1281680).\n- CVE-2026-90263: btrfs: check if root is readonly when setting posix acl (bsc#1281922).\n- CVE-2026-90265: btrfs: defrag: fix deadlock between defrag and delalloc space reservation (bsc#1282054).\n- CVE-2026-90292: RDMA/siw: Fix use-after-free in siw_accept() (bsc#1281777).\n- CVE-2026-90293: IB/isert: post the full-feature receive buffers after session registration (bsc#1281778).\n- CVE-2026-90294: IB/isert: delay the final Login Response until the session is registered (bsc#1281732).\n- CVE-2026-90307: RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ (bsc#1282050).\n- CVE-2026-90308: RDMA/erdma: Hold QP references for AE and CM processing (bsc#1281786).\n- CVE-2026-90309: RDMA/erdma: Hold CQ references when processing EQ events (bsc#1281789).\n- CVE-2026-90358: bpf, x86: Fix trampoline stack size for 128-bit arguments (bsc#1281825).\n- CVE-2026-90388: iommu/dma: Check atomic pool allocation result directly (bsc#1282197).\n- CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received (bsc#1282113).\n- CVE-2026-90414: IB/isert: reject PDUs declaring more data than (bsc#1282110).\n- CVE-2026-90415: RDMA/cxgb4: free STAG index when TPT entry write fails (bsc#1282143).\n- CVE-2026-90417: RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() (bsc#1281973).\n- CVE-2026-90426: iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs (bsc#1282013).\n- CVE-2026-90428: iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs (bsc#1282003).\n- CVE-2026-90430: iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized (bsc#1281991).\n- CVE-2026-92495: RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap (bsc#1282072).\n- CVE-2026-92523: RDMA/nldev: validate dynamic counter attribute length (bsc#1282271).\n- CVE-2026-92525: RDMA/rxe: Validate num_sge/cur_sge before indexing wqe-\u003edma.sge[] (bsc#1282270).\n- CVE-2026-93037: RDMA/hfi1: Propagate sdma_txinit_ahg() errors (bsc#1282020).\n- CVE-2026-93107: RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state (bsc#1281399).\n- CVE-2026-93108: RDMA/ipoib: Drain RCU callbacks during module teardown (bsc#1281408).\n- CVE-2026-93109: RDMA/mlx5: Drain RCU callbacks during module teardown (bsc#1281379).\n- CVE-2026-93110: RDMA/core: Wait for RCU callbacks before unloading ib_core (bsc#1281387).\n- CVE-2026-93154: RDMA/irdma: Add refcounting to user ring MRs (bsc#1282104).\n- CVE-2026-93160: crypto: atmel-ecc - reject hardware ECDH without a public key (bsc#1282147).\n- CVE-2026-93207: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (bsc#1282672).\n- CVE-2026-93212: nfsd: guard nfsd_serv deref in nfsd_file_net_dispose (bsc#1282774).\n- CVE-2026-93264: RDMA/efa: Fix PBL chunk length computation (bsc#1282812).\n- CVE-2026-93782: vhost-scsi: flush backend after device ioctls (bsc#1282906).\n- CVE-2026-93794: smb/client: flush dirty data before punching a hole (bsc#1283154).\n- CVE-2026-93800: btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol() (bsc#1282808).\n- CVE-2026-93810: cachefiles: Fix double fput (bsc#1283213).\n- CVE-2026-93814: spi: core: Abort active target transfer on controller suspend.\n- CVE-2026-93825: spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data().\n- CVE-2026-93826: HID: hidpp: fix potential UAF in hidpp_connect_event() (bsc#1282891).\n- CVE-2026-93827: virtio-fs: avoid double-free on failed queue setup (bsc#1282747).\n- CVE-2026-93829: smb: client: fix races in cifsd thread creation (bsc#1282803).\n- CVE-2026-97413: RDMA/rtrs-srv: Fix integer underflow in process_read and process_write (bsc#1282975).\n- CVE-2026-97421: RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() (bsc#1283176).\n- CVE-2026-97477: RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() (bsc#1283230).\n- CVE-2026-97520: gfs2: move quota_init qc iterator increment (bsc#1283479).\n- CVE-2026-97521: gfs2: fix quota init duplicate scan (bsc#1283475).\n- CVE-2026-97543: xfs: destroy seen inode bitmap when we fail to add a dirpath (bsc#1283450).\n- CVE-2026-97544: xfs: don't leak dqacct if rhashtable insertion fails (bsc#1283149).\n- CVE-2026-97545: xfs: don't leak new_bp if xfs_btree_bload_drop_buf fails (bsc#1283205).\n- CVE-2026-97546: xfs: don't spin forever on zero-length dirents when salvaging them (bsc#1283203).\n- CVE-2026-97552: xfs: initialise error in xfs_defer_finish_one() (bsc#1283328).\n- CVE-2026-97557: smb: client: avoid leaking refcount in cifs_queue_oplock_break() (bsc#1283201).\n- CVE-2026-97571: bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc() (bsc#1283517 bsc#1283945).\n- CVE-2026-97572: bnxt_en: Propagate RX ring init failures in bnxt_init_nic() (bsc#1283517 bsc#1283794).\n- CVE-2026-97573: bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset() (bsc#1283517 bsc#1283880).\n- CVE-2026-97574: bnxt_en: Don't free the live ring's TPA state on queue restart failure (bsc#1283517 bsc#1283795).\n- CVE-2026-97605: erofs: preserve LZMA decoders on resize failure (bsc#1283173).\n- CVE-2026-97902: fs: don't return -EINVAL for successful nested thaw (bsc#1283166).\n- CVE-2026-97934: tracing: Fix memory corruption from a \"STACKTRACE\" histogram key (bsc#1282997).\n- CVE-2026-97940: ipv6: fix fib6 walker UAF on seq stop (bsc#1283163).\n- CVE-2026-97947: x86/amd_node: Avoid divide by zero on virtualized systems (bsc#1283130).\n- CVE-2026-97957: net: hinic: fix mailbox segment buffer overflow (bsc#1283119).\n- CVE-2026-98003: iommu/amd: Do not reallocate GA log buffers on resume (bsc#1283312).\n- CVE-2026-98028: eth: nfp: drop the replaced rule from the list when reprogramming fails (bsc#1283739).\n- CVE-2026-98029: eth: nfp: bound the ntuple rule dump by the caller's buffer size (bsc#1283490).\n- CVE-2026-98030: net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size (bsc#1283489).\n- CVE-2026-98091: btrfs: detach failed sprout device from transaction update list (bsc#1283805).\n- CVE-2026-100075: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (bsc#1282881).\n\nThe following non security issues were fixed:\n\n- ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach (stable-fixes).\n- ACPI: scan: Honor _DEP for ACPI0016 PCI/CXL host bridge (stable-fixes).\n- ACPICA: add boundary checks in acpi_ps_get_next_field() (stable-fixes).\n- ACPICA: add boundary checks in two places (stable-fixes).\n- ACPICA: Add package limit checks in parser functions (stable-fixes).\n- ACPICA: Add validation for node in acpi_ns_build_normalized_path() (stable-fixes).\n- ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() (stable-fixes).\n- ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() (stable-fixes).\n- ACPICA: Fix condition check in acpi_ps_parse_loop() (stable-fixes).\n- ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) (stable-fixes).\n- ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() (stable-fixes).\n- ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() (stable-fixes).\n- ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg() (stable-fixes).\n- ACPICA: Prevent adding invalid references (stable-fixes).\n- ACPICA: validate byte_count in acpi_ps_get_next_package_length() (stable-fixes).\n- ACPICA: validate handler object type in two places (stable-fixes).\n- ALSA: 6fire: Clean ups with guard() (stable-fixes).\n- ALSA: 6fire: fix OOB write from device-reported iso length (git-fixes).\n- ALSA: aloop: Check card index validity at probe (stable-fixes).\n- ALSA: bcd2000: Fix race between rawmidi and disconnect (git-fixes).\n- ALSA: caiaq: unregister the input device when probe fails (git-fixes).\n- ALSA: core: Add scoped cleanup helper for card references (stable-fixes).\n- ALSA: core: Define auto-cleanup for snd_card_free() (stable-fixes).\n- ALSA: core: Fix potential UAF after asynchronous card release (stable-fixes).\n- ALSA: es18xx: check control allocation before private data setup (stable-fixes).\n- ALSA: hda/common: Use cleanup macros for PM controls (stable-fixes).\n- ALSA: hda/common: Use guard() for mutex locks (stable-fixes).\n- ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10 (stable-fixes).\n- ALSA: hda/core: Use guard() for mutex locks (stable-fixes).\n- ALSA: hda/realtek - Add quirk for HP Victus 15-fa0xxx (MB 8A50) (stable-fixes).\n- ALSA: hda/realtek: Add HDA_CODEC_QUIRK for Samsung 750XBE/730XBE (stable-fixes).\n- ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx (stable-fixes).\n- ALSA: hda/realtek: Add mute LED quirk for HP Victus 16-e0xxx (MB 88ED) (stable-fixes).\n- ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP EliteBook 830 G8 (8AB8) to enable mute LEDs (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP Pavilion x360 (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP Victus 16-e0xxx (88EE) to enable mute LED (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Xiaoxin 14 GT (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Yoga 7 16IAP7 (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IRH8 (stable-fixes).\n- ALSA: hda/realtek: Add StarFighter HDA SSID (stable-fixes).\n- ALSA: hda/realtek: Fix speakers on MECHREVO WUJIE Series (stable-fixes).\n- ALSA: hda/realtek: Limit Star Labs internal mic boost (stable-fixes).\n- ALSA: hda/tegra: Re-enable SDO workaround for Tegra194 (git-fixes).\n- ALSA: hda: Add Lenovo Legion 7i 16IAX7 17AA3874 quirk (stable-fixes).\n- ALSA: hda: cs35l56: Fail if wmfw file is missing (stable-fixes).\n- ALSA: hda: ext: Clean up links if their initialization fails (stable-fixes).\n- ALSA: hda: Introduce auto cleanup macros for PM (stable-fixes).\n- ALSA: hda: trace PCM open only after assigning a stream (git-fixes).\n- ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup (git-fixes).\n- ALSA: ice1712: Fix the error handling via auto-cleanup at probe (git-fixes).\n- ALSA: line6: reject oversized playback packets (git-fixes).\n- ALSA: mpu401: Check card index validity at probe (stable-fixes).\n- ALSA: mts64: Check card index validity at probe (stable-fixes).\n- ALSA: pcm: Fix race between non-atomic ops and trigger-start (stable-fixes).\n- ALSA: pcm: set timer-\u003eprivate_data before registering the PCM timer (git-fixes).\n- ALSA: portman2x4: Check card index validity at probe (stable-fixes).\n- ALSA: seq: oss: Reject reads that cannot fit the next event (stable-fixes).\n- ALSA: seq: Remove arbitrary prioq insertion limit (stable-fixes).\n- ALSA: seq: Serialize compat port-info ioctls (git-fixes).\n- ALSA: serial-u16550: Check card index validity at probe (stable-fixes).\n- ALSA: ua101: reject mismatched capture/playback packet sizes (git-fixes).\n- ALSA: ump: Copy FB name string more safely (stable-fixes).\n- ALSA: ump: Copy safe string name to rawmidi (stable-fixes).\n- ALSA: ump: Update rawmidi name per EP name update (stable-fixes).\n- ALSA: usb-audio: Add dB map quirk for Razer Barracuda X 2.4 (stable-fixes).\n- ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless (stable-fixes).\n- ALSA: usb-audio: Add quirk flags for SC13A (stable-fixes).\n- ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision) (stable-fixes).\n- ALSA: usb-audio: Add quirk for Novation Mininova (stable-fixes).\n- ALSA: usb-audio: Add quirk for YAMAHA CDS3000 (stable-fixes).\n- ALSA: usb-audio: caiaq: validate EP1 reply lengths (stable-fixes).\n- ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity (git-fixes).\n- ALSA: usb-audio: Optimize the copy of packet sizes for implicit fb handling (stable-fixes).\n- ALSA: usb: 6fire: Avoid embedded URBs (stable-fixes).\n- ALSA: usx2y: Drain pending US-428 pipe-4 output commands (stable-fixes).\n- ALSA: virmidi: Check card index validity at probe (stable-fixes).\n- ALSA: virtio: reset device before deleting virtqueues (git-fixes).\n- arm64: fixmap: Allow 256K early_ioremap() at any offset (git-fixes).\n- arm64: hibernate: clone only the linear map that exists at runtime (git-fixes).\n- arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc (git-fixes).\n- arm64: kprobes: Allow reentering kprobes while single-stepping (git-fixes).\n- arm64: mte: Fix PTRACE_{PEEK,POKE}MTETAGS error documentation (git-fixes).\n- arm64: percpu: Fix LSE operations on {8,16}-bit types (git-fixes).\n- arm64: percpu: Fix this_cpu_and() mask generation (git-fixes).\n- arm64: percpu: Fix this_cpu_write() casting (git-fixes).\n- arm64: Use load LSE atomics for the non-return per-CPU atomic operations (git-fixes).\n- ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for HyperX OMEN Gaming Laptop 16-ap1xxx (stable-fixes).\n- ASoC: codecs: aw88261: only check PLL and clock state at power-up (git-fixes).\n- ASoC: codecs: aw88261: reduce log spam (stable-fixes).\n- ASoC: codecs: max98363: fix uninitialized stream_config-\u003etype (git-fixes).\n- ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive (stable-fixes).\n- ASoC: codecs: rk3328: Use managed GPIO and clock helpers (stable-fixes).\n- ASoC: codecs: rt274: Fix format setting for 44100 rate (git-fixes).\n- ASoC: codecs: rt286: Revert delay value for jack setup (git-fixes).\n- ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config-\u003etype (git-fixes).\n- ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config-\u003etype (git-fixes).\n- ASoC: fsl-asoc-card: reduce WM8904 PLL ratio to meet frequency limit (stable-fixes).\n- ASoC: hdmi-codec: Report a change when the channel status moves (git-fixes).\n- ASoC: Intel: catpt: Complete coredump handling (stable-fixes).\n- ASoC: Intel: sof_sdw: Add quirks for new Dell laptops (stable-fixes).\n- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (stable-fixes).\n- ASoC: mediatek: mt8365-afe-pcm: fix possible NULL-pointer dereferences in mt8365_afe_suspend() (stable-fixes).\n- ASoC: qcom: lpass-cpu: use DAI table index for playback constraints (git-fixes).\n- ASoC: qcom: q6apm: return error code to consumers on failures (stable-fixes).\n- ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt (stable-fixes).\n- ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence (stable-fixes).\n- ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure (stable-fixes).\n- ASoC: rt712-sdca: reset codec at io_init to fix silent headphone (stable-fixes).\n- ASoC: rt5645: Perform the initial jack detect at probe (stable-fixes).\n- ASoC: tas2781: Update default register address to TAS2563 (stable-fixes).\n- ASoC: tegra: Fix ASRC Stream6 input threshold control (git-fixes).\n- ASoC: ti: omap3pandora: update board check to use DT compatible (stable-fixes).\n- ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments (git-fixes).\n- ASoC: wm8903: Move the DRC QR threshold to the register that holds it (git-fixes).\n- Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough (git-fixes).\n- Bluetooth: btintel_pcie: Add 50 ms delay before MAC init on BlazarIW (stable-fixes).\n- Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit (git-fixes).\n- Bluetooth: btintel_pcie: validate device-supplied DMA indices (git-fixes).\n- Bluetooth: btmtk: add MT7902 MCU support (stable-fixes).\n- Bluetooth: btmtk: Disable remote wakeup for MT7922/MT7925 (stable-fixes).\n- Bluetooth: btmtk: fix wrong status for short WMT FUNC_CTRL events (git-fixes).\n- Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access (git-fixes).\n- Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown (git-fixes).\n- Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU (stable-fixes).\n- Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU (stable-fixes).\n- Bluetooth: btusb: Add Mercusys MA530 for Realtek RTL8761BUV (stable-fixes).\n- Bluetooth: btusb: Add Realtek RTL8922AE VID/PID 0bda/d922 (stable-fixes).\n- Bluetooth: btusb: Add Realtek RTL8922AE VID/PID 0bda/d923 (stable-fixes).\n- Bluetooth: btusb: Add support for Intel Lizard Peak 2 (0x8087:0x0040) (stable-fixes).\n- Bluetooth: btusb: Add support for TP-Link TL-UB250 (stable-fixes).\n- Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV (stable-fixes).\n- Bluetooth: btusb: fix NXP IW610 composite device handling (stable-fixes).\n- Bluetooth: btusb: MT7922: Add VID/PID 0e8d/223c (stable-fixes).\n- Bluetooth: btusb: MT7925: Add VID/PID 0e8d/8c38 (stable-fixes).\n- Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices (git-fixes).\n- Bluetooth: btusb: Record matched usb_device_id into btusb_data (stable-fixes).\n- Bluetooth: btusb: refactor endpoint lookup (stable-fixes).\n- Bluetooth: coredump: Quiesce dump work on unregister (git-fixes).\n- Bluetooth: eir: validate service data length before reading UUID (git-fixes).\n- Bluetooth: hci_codec: validate vendor codec count length (git-fixes).\n- Bluetooth: hci_conn: fix CIS hold ownership on reuse (git-fixes).\n- Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (git-fixes).\n- Bluetooth: hci_core: Print number of packets in conn-\u003edata_q (stable-fixes).\n- Bluetooth: hci_sock: reject out-of-range OCF values (git-fixes).\n- Bluetooth: hci_sock: validate event length before filtering (git-fixes).\n- Bluetooth: hci_sync: Serialize local codec list cleanup (git-fixes).\n- Bluetooth: ISO: balance the parent hold in hci_bind_bis() (git-fixes).\n- Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() (git-fixes).\n- Bluetooth: ISO: release unused CIS holds after channel attach (git-fixes).\n- Bluetooth: ISO: set BT_LISTEN before requesting a BIG sync (git-fixes).\n- Bluetooth: L2CAP: validate connectionless PSM length (stable-fixes).\n- Bluetooth: L2CAP: validate frame length before control and FCS access (git-fixes).\n- Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel (git-fixes).\n- Bluetooth: mgmt: fix race in read_unconf_index_list() (git-fixes).\n- Bluetooth: Properly disable remote wakeup for MT7922/MT7925 on Ryzen platform (git-fixes).\n- Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup (git-fixes).\n- Bluetooth: RFCOMM: fix NULL dereference of dlc-\u003esession in RFCOMM_CONNINFO (git-fixes).\n- Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() (git-fixes).\n- Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (stable-fixes).\n- Bluetooth: SMP: reject Security Request over BR/EDR (git-fixes).\n- bnxt_en: Bound SW TPA IDs to prevent crashes (git-fixes).\n- bnxt_en: Fix potential data corruption with HW GRO/LRO (git-fixes).\n- bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (bsc#1283517).\n- bnxt_en: Only restore LRO if the device supports TPA (bsc#1283517).\n- bnxt_en: Write doorbell when linearizing skb fails (bsc#1283517).\n- bonding: crypto offload enabled, non-offload slave failover, rekey failed (bsc#1282823).\n- btrfs: do not force reloc root creation during qgroup_account_snapshot() (bsc#1275740).\n- btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag (bsc#1279116).\n- btrfs: tree-checker: validate INODE_REF's namelen (git-fixes).\n- config: cleanup azure and kvmsmall Cleanup azure and kvmsmall configs after following comments updated default\n  configs: 4229ca50b2b3 Disable CONFIG_BATMAN_ADV (jsc#PED-16892).\n- dmaengine: Add devm_dma_request_chan() (stable-fixes).\n- dmaengine: altera-msgdma: Use memcpy_toio for descriptor FIFO writes (stable-fixes).\n- dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc (stable-fixes).\n- dmaengine: Fix device kref underflow in dma_chan_put() (git-fixes).\n- dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() (git-fixes).\n- dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() (git-fixes).\n- dmaengine: sprd: Fix runtime PM reference leak in probe (git-fixes).\n- dmaengine: sun6i: fix non-atomic read of DMA position registers (git-fixes).\n- dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status (git-fixes).\n- dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() (git-fixes).\n- dmaengine: wait for RCU readers before releasing dma_device (git-fixes).\n- dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA (git-fixes).\n- dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order (git-fixes).\n- driver core: Export get_dev_from_fwnode() (stable-fixes).\n- drm/amd/display: Bump frame warning limit for clang builds of dml (stable-fixes).\n- drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend (git-fixes).\n- drm/amd/display: Check for sharpening case when calculating max vtaps for scaler (stable-fixes).\n- drm/amd/display: clean-up dead code in dml2_mall_phantom (stable-fixes).\n- drm/amd/display: Find link encoder for flexible DIG mapping cases (stable-fixes).\n- drm/amd/display: Fix CRC open failure during active rendering (stable-fixes).\n- drm/amd/display: Fix dc stream excess put in dm_update_crtc_state() (git-fixes).\n- drm/amd/display: Fix DPMS using partially updated pipe context (stable-fixes).\n- drm/amd/display: Initialize dsc_caps to 0 (stable-fixes).\n- drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC (git-fixes).\n- drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized (stable-fixes).\n- drm/amd/pm/si: Fix updating clock limits from power states (stable-fixes).\n- drm/amd/pm/si: Fix updating clock limits on AC/DC (git-fixes).\n- drm/amd/pm: bound pp_dpm_set_pp_table() memcpy (stable-fixes).\n- drm/amd/pm: Check SMUv13.0.6/12 metrics integrity (stable-fixes).\n- drm/amd/pm: hide pp_table sysfs on APUs (git-fixes).\n- drm/amdgpu: add a helper to calculate ring distance (stable-fixes).\n- drm/amdgpu: check ras and obj before dereference (git-fixes).\n- drm/amdgpu: check thunderbolt before switcheroo registration (stable-fixes).\n- drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages (bsc#1284146).\n- drm/amdgpu: Failed to check various return code (stable-fixes).\n- drm/amdgpu: fix ACP MFD device leak on init failure (git-fixes).\n- drm/amdgpu: fix buffer overflow during vBIOS update (stable-fixes).\n- drm/amdgpu: fix IP instance memory leak on kobject add failure (git-fixes).\n- drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init() (git-fixes).\n- drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show() (git-fixes).\n- drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init() (git-fixes).\n- drm/amdgpu: flush pending RCU callbacks on module unload (stable-fixes).\n- drm/amdgpu: harden FRU PIA parsing with bounded helpers (stable-fixes).\n- drm/amdgpu: Prefer ROM BAR for default VGA device (stable-fixes).\n- drm/amdgpu: Skip accessing psp rum time db for APUs (stable-fixes).\n- drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT (stable-fixes).\n- drm/amdgpu: Use system unbound workqueue for soft IH ring (stable-fixes).\n- drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw (stable-fixes).\n- drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id (stable-fixes).\n- drm/amdkfd: Check bounds on allocate_doorbell (stable-fixes).\n- drm/amdkfd: check find_first_zero_bit before __set_bit on kfd-\u003edoorbell_bitmap (stable-fixes).\n- drm/amdkfd: fix UAF race in destroy_queue_cpsch (stable-fixes).\n- drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl (stable-fixes).\n- drm/amdkfd: Reject zero-sized AQL queue allocations after size halving (stable-fixes).\n- drm/amdkfd: Unwind debug trap enable on copy_to_user failure (stable-fixes).\n- drm/arm/komeda: fix error handling for clk_prepare_enable() and callers (stable-fixes).\n- drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend (stable-fixes).\n- drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach (git-fixes).\n- drm/bridge: tc358768: Set pre_enable_prev_first for reverse order (stable-fixes).\n- drm/cirrus: Use video aperture helpers (stable-fixes).\n- drm/dp: Add DSC virtual DPCD quirk for Realtek MST branch device (stable-fixes).\n- drm/gem: Consider GEM object reclaimable if shrinking fails (stable-fixes).\n- drm/gma500: return errors from Oaktrail HDMI I2C reads (stable-fixes).\n- drm/gud: Add RCade Display Adapter VID/PID pair (stable-fixes).\n- drm/gud: fix out-of-bounds write in gud_plane_atomic_check() (git-fixes).\n- drm/i915/psr: Add new SU area calculation helper to apply workarounds (stable-fixes).\n- drm/i915/psr: Clear stale sel fetch enable bits on sel fetch disable (git-fixes).\n- drm/i915: fix incorrect RCU teardown order (git-fixes).\n- drm/i915: Guard against NULL driver_data in i915_pci_probe() (stable-fixes).\n- drm/imagination: clamp freelist reconstruction requests (git-fixes).\n- drm/imagination: Fix page count for page table for map() interface (git-fixes).\n- drm/imagination: Populate FW common context ID before passing to the FW (stable-fixes).\n- drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl() (git-fixes).\n- drm/logicvc: Drop the select of the nonexistent CONFIG_DRM_KMS_DMA_HELPER (git-fixes).\n- drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device (git-fixes).\n- drm/mediatek: dsi: Add compatible for mt8167-dsi (stable-fixes).\n- drm/mediatek: Fix ovl adaptor platform device leak (git-fixes).\n- drm/mediatek: Fix pdev reference leak in mtk_drm_bind() (git-fixes).\n- drm/msm/adreno: fix autosuspend cleanup during teardown (git-fixes).\n- drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL (git-fixes).\n- drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure (git-fixes).\n- drm/msm: Recover HW before retire hung submit (git-fixes).\n- drm/nouveau/bios: skip the IFR header if present (stable-fixes).\n- drm/nouveau/clk: don't clobber reclock status when restoring volt/fan (git-fixes).\n- drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update (git-fixes).\n- drm/nouveau/disp: don't reject HDMI config on cards without SCDC (git-fixes).\n- drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM (git-fixes).\n- drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() (git-fixes).\n- drm/nouveau: fix autosuspend cleanup during teardown (git-fixes).\n- drm/nouveau: Fix bridge reference leak in nv1a_ram_new() (git-fixes).\n- drm/nouveau: fix double-free in nvif_vmm_dtor (git-fixes).\n- drm/nouveau: Fix gem reference leak in validate_init() (git-fixes).\n- drm/nouveau: Fix runtime PM leak in nouveau_connector_detect() (git-fixes).\n- drm/nouveau: RCU-free the scheduler-containing nouveau_sched (git-fixes).\n- drm/omap: dsi: Do not copy isr table (git-fixes).\n- drm/panel: Enable GPIOLIB for panels which uses functions from it (stable-fixes).\n- drm/panel: jadard-jd9365da-h3: set prepare_prev_first (stable-fixes).\n- drm/panel: simple: Add AM-1280800W8TZQW-T00H (stable-fixes).\n- drm/radeon: Read the VRAM VBIOS signature with readb() (git-fixes).\n- drm/vc4: Use managed KMS polling to fix UAF on unbind (git-fixes).\n- drm/virtio: fix memory leak of fence event on execbuffer failure (git-fixes).\n- drm/virtio: fix NULL pointer dereference on fence allocation failure (git-fixes).\n- drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() (git-fixes).\n- drm/virtio: fix object leak when drm_gem_handle_create() fails (git-fixes).\n- drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() (git-fixes).\n- drm/virtio: release the GEM object on virtio_gpu_vram_create() errors (git-fixes).\n- drm/xe: Limit sg segment size to PAGE_SIZE on Xen PV (git-fixes).\n- drm/xe: Wait on external BO kernel fences in exec IOCTL (CVE-2026-74440 bsc#1261564).\n- drm: add drm_memory_stats_is_zero (stable-fixes).\n- drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr (git-fixes).\n- fbcon: don't suspend/resume when vc is graphics mode (stable-fixes).\n- fbdev: pm2fb: unwind WC setup on probe failure (stable-fixes).\n- fbdev: pvr2fb: correct user pointer annotation and sentinel initializer (stable-fixes).\n- firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size (stable-fixes).\n- firmware: arm_scmi: Validate SENSOR_UPDATE payload size (stable-fixes).\n- firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS (git-fixes).\n- firmware: qcom_scm: Rename peripheral as pas_id (stable-fixes).\n- firmware: stratix10-svc: change get provision data to async SMC call (stable-fixes).\n- firmware: stratix10-svc: fix FCS SMC call kernel-doc (git-fixes).\n- firmware: sysfb: Move bpp-depth calculation into screen_info helper (stable-fixes).\n- gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() (git-fixes).\n- gpio: dwapb: Mask interrupts at hardware initialization (stable-fixes).\n- gpio: pisosr: Read \"ngpios\" as u32 (stable-fixes).\n- gpio: tps65219: Fix GPIO input value reads (git-fixes).\n- gpio: virtuser: skip free_irq when no IRQ is installed (git-fixes).\n- gpio: zynq: fix runtime PM leak on request error path (git-fixes).\n- HID: alps: fix use-after-free on input2 registration failure (git-fixes).\n- HID: alps: unregister DualPoint Stick input device on remove (git-fixes).\n- HID: amd_sfh: Validate PCI BAR size before mapping (git-fixes).\n- HID: asus: fortify keyboard handshake (stable-fixes).\n- HID: bpf: Add Huion Inspiroy Frego M button quirk (stable-fixes).\n- HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request (git-fixes).\n- HID: bpf: fix __hid_bpf_hw_check_params report length (git-fixes).\n- HID: core: quiesce input in hid_hw_stop() to prevent use-after-free (stable-fixes).\n- HID: elecom: fix bus type for M-XGL20DLBK (git-fixes).\n- HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM (stable-fixes).\n- HID: hidpp: fix potential UAF in hidpp_connect_event() (stable-fixes).\n- HID: logitech-hidpp: fix race condition when accessing stale stack pointer (stable-fixes).\n- HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes (git-fixes).\n- HID: mcp2221: fix OOB write in mcp2221_raw_event() (stable-fixes).\n- HID: mcp2221: stop device IO before hid_hw_stop (git-fixes).\n- HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard (stable-fixes).\n- HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() (git-fixes).\n- host1x: bus: Fix missing ops null check in error teardown (stable-fixes).\n- hwmon: (adt7462) Add of_match_table to support devicetree (stable-fixes).\n- hwmon: (corsair-psu) Fix linear11 calculation (stable-fixes).\n- hwmon: (dell-smm) Add Dell Latitude 7530 to fan control whitelist (stable-fixes).\n- hwmon: (emc1403) Drop hysteresis for low limit temperature (git-fixes).\n- hwmon: (emc1403) Rely on subsystem locking (stable-fixes).\n- hwmon: (gpio-fan) return IRQ_HANDLED from the shared alarm IRQ handler (git-fixes).\n- hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show() (git-fixes).\n- hwmon: (hp-wmi-sensors) Improve raw WMI string handling (git-fixes).\n- hwmon: (ina2xx) Parameterize ina2xx_data in ina226_alert_read() (stable-fixes).\n- hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i (stable-fixes).\n- hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding (git-fixes).\n- hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676 (git-fixes).\n- hwmon: (raspberrypi) Fix delayed-work teardown race (stable-fixes).\n- hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove (git-fixes).\n- hwmon: (w83793) release probe data through kref (git-fixes).\n- i2c: at91: release DMA channels on remove and probe error (git-fixes).\n- i2c: atr: fix dangling adapter pointer on add failure (git-fixes).\n- i2c: imx: disable autosuspend on remove (git-fixes).\n- i2c: imx: release DMA channels on probe error (git-fixes).\n- i2c: mxs: fix DMA channel leak on probe error (git-fixes).\n- i2c: qcom-cci: fix device_node refcount leak in cci_probe()/cci_remove() (git-fixes).\n- i2c: qcom-cci: Remove the unused variable cci_clk_rate (git-fixes).\n- i2c: qcom-cci: Stop complaining about DT set clock rate (stable-fixes).\n- i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode (git-fixes).\n- i3c: mipi-i3c-hci: Quieten initialization messages (stable-fixes).\n- i3c: mipi-i3c-hci: Refactor PIO register initialization (stable-fixes).\n- i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc() (stable-fixes).\n- ibmveth: Add multi buffers rx replenishment hcall support (jsc#PED-16852).\n- ibmvnic: Increase max subcrq indirect entries with fallback (jsc#PED-16854).\n- ibmvnic: Use ndo_get_stats64 to fix inaccurate SAR reporting (jsc#PED-16854).\n- iio: accel: kionix-kx022a: Fix array boundary check (git-fixes).\n- iio: accel: kxcjk-1013: reject duplicate event disable (git-fixes).\n- iio: accel: mma8452: switch to non-devm request_threaded_irq() (stable-fixes).\n- iio: accel: sca3000: fix frequency divider condition check (git-fixes).\n- iio: adc: pac1934: check ACPI label duplication (git-fixes).\n- iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind (stable-fixes).\n- iio: adc: rtq6056: add i2c_device_id support (stable-fixes).\n- iio: adc: stm32-adc: fix check on internal channel availability (git-fixes).\n- iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure (git-fixes).\n- iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls (git-fixes).\n- iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind (git-fixes).\n- iio: admv1013: initialize callback mutex before registering notifier (git-fixes).\n- iio: buffer: Ensure bounce buffer used for unaligned case is zeroed (git-fixes).\n- iio: buffer: serialize buffer teardown with mode claims (git-fixes).\n- iio: frequency: admv1013: fix wrong channel field used in admv1013_read_raw() (git-fixes).\n- iio: gyro: adis16136: fix unprotected debugfs reads (git-fixes).\n- iio: health: max30102: fix NULL dereference in interrupt handler (git-fixes).\n- iio: imu: adis16400: fix unprotected debugfs reads (git-fixes).\n- iio: light: gp2ap020a00f: drain irq_work after free_irq (git-fixes).\n- iio: light: stk3310: Deal with the ps interrupt issue in PM (stable-fixes).\n- iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup (git-fixes).\n- iio: proximity: aw96103: validate firmware data length (git-fixes).\n- iio: proximity: isl29501: Fix return type of isl29501_register_write (git-fixes).\n- iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure (git-fixes).\n- iio: proximity: sx9324: Correct proximity channel resolution (git-fixes).\n- iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler (git-fixes).\n- iio: trigger: cancel reenable_work before freeing trigger (git-fixes).\n- Input: adp5588-keys - cache GPIO state before registering the gpiochip (git-fixes).\n- Input: aiptek - validate raw macro indices before updating state (stable-fixes).\n- Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 (git-fixes).\n- Input: cyttsp5 - clamp the HID report size before memcpy (git-fixes).\n- Input: eeti_ts - publish the OF module alias (git-fixes).\n- Input: evdev - zero absinfo before partial copy in EVIOCSABS (git-fixes).\n- Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P (stable-fixes).\n- Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() (git-fixes).\n- Input: s6sy761 - fix resume ordering and restore sensing (git-fixes).\n- Input: soc_button_array - check btns_desc-\u003epackage.count (git-fixes).\n- Input: soc_button_array - fix MS Surface Pro 11 probe failure (git-fixes).\n- Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) (stable-fixes).\n- Input: synaptics - limit T440p InterTouch quirk to LEN0036 (git-fixes).\n- Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound (git-fixes).\n- Input: trackpoint - fix the inertia attribute name in the ABI document (git-fixes).\n- Input: xpad - add support for Azeron devices (stable-fixes).\n- Input: xpad - add support for Victrix Pro BFG Controller (stable-fixes).\n- Input: xpad - fix PDP Marvel Xbox 360 controller (git-fixes).\n- Input: zero ff_effect before compat copy in input_ff_effect_from_user (git-fixes).\n- kernel-binary.spec.in: Emulate kabi.pl error when suse-kabi-tools is used.\n- kernel-binary.spec.in: Fix syntax error.\n- KEYS: encrypted: fix integer overflow of datablob_len (git-fixes).\n- keys: fix lost wakeup when reaping a dead key type (git-fixes).\n- keys: translate request_key_auth pid for the reading procfs instance (git-fixes).\n- KEYS: trusted: Fix tpm2_load_cmd() boundary check (git-fixes).\n- KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure (git-fixes).\n- KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve() (git-fixes).\n- KVM: arm64: vgic: Don't leak the SPI array when init is retried (git-fixes).\n- KVM: arm64: vgic: Prevent speculative SPI array underflow (git-fixes).\n- KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU (git-fixes).\n- KVM: nVMX: Always flush vpid02 on first use (git-fixes).\n- KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02 (git-fixes).\n- KVM: nVMX: Synthesize SHUTDOWN on RSM if L2 requires emulation (git-fixes).\n- KVM: VMX: Handle bad values on proxied writes to LBR MSRs (git-fixes).\n- KVM: VMX: Reject KVM_RUN if userspace forces emulation during nested VM-Enter (git-fixes).\n- KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy (git-fixes).\n- KVM: x86/pmu: Move Intel PMU global MSRs to intel_is_valid_msr() (git-fixes).\n- KVM: x86: Extract VMX's unhandleable emulation check to common x86 (git-fixes).\n- KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails (git-fixes).\n- leds: pca9532: Don't stop blinking for non-zero brightness (stable-fixes).\n- leds: trigger: gpio: Use GPIOD_FLAGS_BIT_NONEXCLUSIVE (stable-fixes).\n- leds: uleds: Return -EFAULT on copy_to_user() failure (stable-fixes).\n- media: chips-media: wave5: Add range checks for dec_output_info (stable-fixes).\n- media: chips-media: wave5: Fix Reports from Kernel Lock Validator (stable-fixes).\n- media: dm1105: fix missing error check for dma_alloc_coherent (stable-fixes).\n- media: em28xx-video: fix missing res_free() on init_usb_xfer failure (stable-fixes).\n- media: i2c: imx355: Replace client-\u003edev usage (stable-fixes).\n- media: imon: Add iMON VFD HID OEM v1.2 key mappings (stable-fixes).\n- media: imx355: Avoid calling imx355_power_off twice in error path (git-fixes).\n- media: qcom: camss: avoid format string warning (stable-fixes).\n- media: rc: mceusb: Add support for 04eb:e033 (stable-fixes).\n- media: video-i2c: fix buffer queue ordering (stable-fixes).\n- media: video-i2c: use vb2_video_unregister_device on driver removal (stable-fixes).\n- memstick: ms_block: destroy io_queue workqueue on removal (git-fixes).\n- mfd: db8500-prcmu: Fold dbx500 header into db8500 (git-fixes).\n- mfd: rsmu: Add 8a34002 support (stable-fixes).\n- mfd: tps65219: Make poweroff handler conditional on system-power-controller (stable-fixes).\n- mmc: core: Add validation for host-provided max_segs (stable-fixes).\n- mmc: core: Cancel SDIO IRQ work before freeing host (git-fixes).\n- mmc: core: Fix OF node reference leak on card add failure (git-fixes).\n- mmc: davinci: avoid NULL deref of host-\u003edata in IRQ handler (stable-fixes).\n- mmc: davinci: fix mmc_add_host order in probe (stable-fixes).\n- mmc: hsq: Fix use-after-free in retry work (git-fixes).\n- mmc: mmci: Fix use-after-free in busy-timeout work (git-fixes).\n- mmc: mxcmmc: cancel data work and watchdog on remove (git-fixes).\n- mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC (stable-fixes).\n- mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC (stable-fixes).\n- mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260 (stable-fixes).\n- mmc: sdhci-of-aspeed: Remove children before releasing SDC resources (git-fixes).\n- mmc: sdhci_am654: Clear ITAPDLY on tuning failure (git-fixes).\n- mmc: sdhci_am654: Fallback to DT-provided itap delay on DDR50 tuning failure (git-fixes).\n- mmc: sdhci_am654: Move tuning_loop to local variable (git-fixes).\n- mmc: sdhci_am654: Reset command and data lines on failed tuning (git-fixes).\n- mmc: sdio_uart: fix xmit_fifo leak when the port table is full (git-fixes).\n- mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt (git-fixes).\n- mmc: spi: reset bytes_xfered before retrying CRC failures (git-fixes).\n- mtd: block2mtd: Fix divide error when erase_size is zero (git-fixes).\n- mtd: core: avoid double-free of OTP NVMEM device (git-fixes).\n- mtd: core: call _get_device() with the master MTD (git-fixes).\n- mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ (git-fixes).\n- mtd: rawnand: pl353: Add message about ECC mode (stable-fixes).\n- mtd: rawnand: pl353: Fix debug prints (git-fixes).\n- mtd: rawnand: pl353: Make sure we use the monolithic helpers for raw accesses (git-fixes).\n- mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB (git-fixes).\n- mtd: spinand: fix zero oobavail when no ECC engine is used (git-fixes).\n- net/ibmveth: fix comment typos in ibmveth.c (jsc#PED-16852).\n- net: mana: Clear RDMA teardown and suspend state in mana_rdma_probe() (git-fixes).\n- net: mana: Reserve extra CQ slot for the fence completion CQE (git-fixes).\n- net: mana: restore the XDP program pointer when pre-allocation fails (git-fixes).\n- net: page_pool: Remove zone/policy GFP flags when allocating XArray entries (git-fixes).\n- net: usb: catc: bound the RX packet length in catc_rx_done() (git-fixes).\n- net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist (stable-fixes).\n- net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs() (git-fixes).\n- net: usb: pegasus: don't rely on id table pointer arithmetic (stable-fixes).\n- net: usb: qmi_wwan: add MeiG SRM813Q (stable-fixes).\n- net: usb: sr9700: include receive overhead in the length check (git-fixes).\n- net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value (git-fixes).\n- net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain (git-fixes).\n- net: wwan: t7xx: Add delay between MD and SAP suspend (stable-fixes).\n- net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() (git-fixes).\n- nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() (git-fixes).\n- nfc: llcp: fix -ENOMEM on connect with zero-length service name (git-fixes).\n- nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() (git-fixes).\n- nfc: llcp: Fix race condition in accept_queue lifecycle (git-fixes).\n- nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure (git-fixes).\n- nfc: llcp: fix slab-out-of-bounds reads when logging service names (git-fixes).\n- nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() (git-fixes).\n- nfc: nfcmrvl: validate helper command length before pull (git-fixes).\n- nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() (git-fixes).\n- nfc: port100: reject frames whose declared length exceeds the received data (git-fixes).\n- nfc: st21nfca: validate ISO15693 inventory length (git-fixes).\n- nfc: st21nfca: validate received frame size (git-fixes).\n- nfc: virtual_ncidev: Add missing ioctl compat handler (git-fixes).\n- PCI/MSI: Enable memory decoding before restoring MSI-X messages (git-fixes).\n- PCI/proc: Fix race between pci_proc_init() and pci_bus_add_device() (stable-fixes).\n- PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store() (stable-fixes).\n- PCI: Accept AtomicOps already enabled by the hypervisor (git-fixes).\n- PCI: altera: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: Avoid FLR for MediaTek MT7925 WiFi (stable-fixes).\n- PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems (stable-fixes).\n- PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk (git-fixes).\n- PCI: iproc: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: mediatek: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: of_property: Omit bus properties without a subordinate bus (git-fixes).\n- PCI: plda: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: rockchip: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: Stop setting cached power state to 'unknown' on unbind (stable-fixes).\n- PCI: switchtec: Add Gen6 Device IDs (stable-fixes).\n- PCI: Wait for device readiness after D3hot -\u003e D0uninitialized transition (stable-fixes).\n- PCI: xgene: Drop unnecessary OF node reference (git-fixes).\n- PCI: xgene: Drop XGENE_PCIE_IP_VER_UNKN (stable-fixes).\n- phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow (git-fixes).\n- phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting (git-fixes).\n- pinctrl: meson: Fix typo in s4 group name (git-fixes).\n- pinctrl: single: free the IRQ on domain creation failure (git-fixes).\n- pinctrl: sunxi: keep a shadow copy of the data register output latches (git-fixes).\n- platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table (stable-fixes).\n- platform/x86: hp-bioscfg: bound ordered-list parsing by the package count (stable-fixes).\n- platform/x86: hp-bioscfg: pass validated element count to package parsers (stable-fixes).\n- platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table (stable-fixes).\n- platform/x86: ISST: Check for admin capability for write commands (stable-fixes).\n- platform/x86: ISST: Validate max level for set feature (git-fixes).\n- platform/x86: msi-ec: Add support for MSI Pulse GL66 12th Gen (stable-fixes).\n- platform/x86: sel3350-platform: Retain LED state on load and unload (stable-fixes).\n- platform/x86: think-lmi: improve check if BIOS account security enabled (stable-fixes).\n- power: sequencing: don't call .post_enable() if pwrseq_unit_enable() failed (git-fixes).\n- power: sequencing: fix NULL-pointer dereference in pwrseq_device_register() (git-fixes).\n- power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new() (git-fixes).\n- power: supply: ab8500_fg: fix use-after-free on remove (git-fixes).\n- power: supply: ab8500_fg: Remove redundant dev_err()/dev_err_probe() (stable-fixes).\n- powerpc/crash: stop watchdogs before booting kdump kernel (bsc#1277705 ltc#220979).\n- powerpc/perf: Add power12 Base Performance Monitoring support (jsc#PED-16906).\n- powerpc/pseries: Handle and log pseries-wdt registration failures (bsc#1277705 ltc#220979).\n- powerpc/pseries: Limit PVR list to 16 entries for CAS negotiation (jsc#PED-16906).\n- powerpc/pseries: Move H_WATCHDOG definitions to a common header (bsc#1277705 ltc#220979).\n- powerpc: Add Power12 architected mode (jsc#PED-16906).\n- powerpc: Add Power12 raw mode (jsc#PED-16906).\n- procfs: fix possible double mmput() in do_procmap_query() (git-fixes).\n- RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations (git-fixes).\n- RDMA/core: Fix potential use after free in counter_release() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_dealloc_pd_user() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_destroy_cq_user() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_destroy_srq_user() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_free_cq() (git-fixes).\n- RDMA/core: Fix use after free in ib_query_qp() (git-fixes).\n- RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup (git-fixes).\n- RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables (git-fixes).\n- RDMA/hfi1: Align probe error unwinding with device removal (git-fixes).\n- RDMA/hfi1: Allocate device data after PCI initialization (git-fixes).\n- RDMA/hfi1: Create workqueues before device initialization (git-fixes).\n- RDMA/hfi1: Defer device creation until probe succeeds (git-fixes).\n- RDMA/hfi1: Drop device data from hfi1_validate_rcvhdrcnt() (git-fixes).\n- RDMA/hfi1: Free RX data on late probe failure (git-fixes).\n- RDMA/hfi1: Initialize debugfs after probe completes (git-fixes).\n- RDMA/hfi1: Pass PCI device to hfi1_pcie_init() (git-fixes).\n- RDMA/hfi1: Preserve unit 0 on (git-fixes).\n- RDMA/hfi1: Remove redundant NULL checks in create_workqueues() (git-fixes).\n- RDMA/hfi1: Remove redundant PCI device ID validation (git-fixes).\n- RDMA/hfi1: Stop flushing the global IB workqueue (git-fixes).\n- RDMA/irdma: Add a refcount to track user ring MR associations (git-fixes).\n- RDMA/irdma: Add irdma_cq fields to track pbl allocations (git-fixes).\n- RDMA/irdma: Deduplicate the irdma_del_memlist logic (git-fixes).\n- RDMA/rvt: Return NULL after port allocation failure (git-fixes).\n- regulator: core: clamp voltage constraints before applying apply_uV (stable-fixes).\n- regulator: da9121: Use subvariant ids in the I2C table (stable-fixes).\n- ring-buffer: Add helper functions for allocations (bsc#1277895 bsc#1280334).\n- ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() (bsc#1277896).\n- ring-buffer: Simplify functions with __free(kfree) to free allocations (bsc#1277895 bsc#1280334).\n- rtc: ac100: Assign .num before accessing .hws (git-fixes).\n- rtc: aspeed: add AST2700 compatible (stable-fixes).\n- rtc: bq32000: add delay between RTC reads (stable-fixes).\n- rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak (git-fixes).\n- rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe() (git-fixes).\n- rtc: mv: add suspend/resume support for wakeup (stable-fixes).\n- rtc: spear: initialize IRQ state before requesting alarm IRQ (git-fixes).\n- selftests: fib_nexthops: do not mark skipped tests as failed (bsc#1283296).\n- serial: 8250: fix possible ISR soft lockup (stable-fixes).\n- serial: 8250_bcm7271: fix use-after-free in brcmuart_remove() (git-fixes).\n- serial: fix TIOCMIWAIT race (git-fixes).\n- serial: ma35d1: Fix clock reference leak in ma35d1serial_probe() (git-fixes).\n- serial: sc16is7xx: fix TX gap caused by kfifo circular buffer wrap-around (git-fixes).\n- serial: sc16is7xx: refill TX FIFO below trigger using fresh TXLVL (git-fixes).\n- serial: tegra: don't clear the Tx FIFO on an Rx-only reset (git-fixes).\n- serial: vt8500: Fix clock reference leak in vt8500_serial_probe() (git-fixes).\n- smb: client: reject overlapping data areas in SMB2 responses (git-fixes).\n- soc: qcom: geni-se: Correct QUP Core ICC vote constants (git-fixes).\n- soundwire: cadence_master: wait and cancel cdns-\u003ework before clock stop (git-fixes).\n- soundwire: dmi-quirks: Disable ghost Realtek devices (stable-fixes).\n- soundwire: intel: Move suspend tracking from trigger to pm suspend (stable-fixes).\n- soundwire: intel_auxdevice: Add cs42l43b to wake_capable_list (stable-fixes).\n- soundwire: only handle alert events when the peripheral is attached (stable-fixes).\n- soundwire: validate DT compatible before parsing it (stable-fixes).\n- spi: dw-dma: Wait for controller idle before completing Tx (git-fixes).\n- spi: dw-mmio: Add ACPI ID LECA0002 for LECARC SoCs (stable-fixes).\n- spi: dw: fix wrong RX_SAMPLE_DLY setting after resume (git-fixes).\n- spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM (stable-fixes).\n- spi: xilinx: let transfers timeout in case of no IRQ (stable-fixes).\n- thermal/drivers/qcom/tsens: Atomic temperature read with hardware-guided retries (stable-fixes).\n- thermal/drivers/tegra/soctherma: Switch to devm cooling device registration (stable-fixes).\n- thermal: gov_step_wise: Fix stale mitigation vote with non-zero lower bounds (git-fixes).\n- thunderbolt: Avoid reserved fields in path config space for USB4 routers (stable-fixes).\n- thunderbolt: Don't access path config space on Lane 1 adapters in tb_switch_reset_host() (stable-fixes).\n- thunderbolt: Don't disable lane adapter if XDomain lane bonding isn't possible (stable-fixes).\n- thunderbolt: Fix KASAN reported use-after-free when request is canceled (git-fixes).\n- thunderbolt: Improve multi-display DisplayPort tunnel allocation (stable-fixes).\n- thunderbolt: Increase timeout for Configuration Ready bit (stable-fixes).\n- thunderbolt: Keep the domain reference while processing hotplug (stable-fixes).\n- thunderbolt: Keep XDomain reference during the lifetime of a service (stable-fixes).\n- thunderbolt: Reject oversized XDomain properties responses (git-fixes).\n- thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() (stable-fixes).\n- thunderbolt: Set tb-\u003eroot_switch to NULL when domain is stopped (stable-fixes).\n- thunderbolt: Verify Router Ready bit is set after router enumeration (stable-fixes).\n- tpm: Disable TPM on null key name mismatch (git-fixes).\n- tty: serial: max3100: shut down timer before freeing port (git-fixes).\n- tty: serial: qcom_geni_serial: Keep console RX functional after deep idle (git-fixes).\n- tty: vt: fix memory leak in vc_allocate() (git-fixes).\n- usb-storage: ene_ub6250: fix race between scan work and probe (stable-fixes).\n- USB: cdc-acm: fix racy TIOCMIWAIT implementation (git-fixes).\n- USB: cdc-acm: skip URB restart in port_shutdown if disconnected (git-fixes).\n- USB: cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set (stable-fixes).\n- usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe (git-fixes).\n- usb: cdns3: fix use-after-free in cdns3_gadget_exit() (git-fixes).\n- usb: cdns3: rename hibernated argument of role-\u003eresume() to lost_power (stable-fixes).\n- usb: chipidea: tegra: disable runtime PM on resume failure (git-fixes).\n- usb: core: clear both ep_in and ep_out for non-ep0 control endpoints (git-fixes).\n- usb: core: hcd: fix possible deadlock in rh control transfers (stable-fixes).\n- usb: dwc3: am62: Fix runtime PM usage count leak on probe error path (git-fixes).\n- usb: gadget: aspeed-vhub: cancel wake work on device removal (git-fixes).\n- usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue (stable-fixes).\n- USB: gadget: dummy-hcd: Fix wait for outstanding request completions (git-fixes).\n- usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC (git-fixes).\n- usb: gadget: f_fs: Fix Use-After-Free in AIO error path (git-fixes).\n- usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd (git-fixes).\n- USB: gadget: ffs: fix mm lifetime handling (stable-fixes).\n- USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() (stable-fixes).\n- usb: gadget: goku_udc: avoid NULL deref of dev-\u003edriver in INT_USBRESET log (stable-fixes).\n- usb: gadget: midi2: Fix the jack descriptor array sizes (git-fixes).\n- usb: gadget: udc: skip pullup() if already connected (stable-fixes).\n- usb: host: add ARCH_AIROHA in XHCI MTK dependency (stable-fixes).\n- usb: hub: use shorter 120ms post resume hold for SS root hubs (git-fixes).\n- usb: image: mdc800: change kmalloc() to kzalloc() (stable-fixes).\n- usb: octeon-hcd: fix the FIFO-flush timeout computation (git-fixes).\n- usb: ohci-da8xx: disable controller wakeup on cleanup (git-fixes).\n- usb: ohci-s3c2410: disable controller wakeup on removal (git-fixes).\n- usb: ohci-st: disable controller wakeup on removal (git-fixes).\n- USB: serial: fix driver deregistration order (git-fixes).\n- USB: serial: fix dynamic id driver deregistration race (git-fixes).\n- USB: serial: fix ioctl hangup race (git-fixes).\n- USB: serial: fix port tear down use-after-free (git-fixes).\n- USB: serial: quatech2: fix baud rate overflow (git-fixes).\n- usb: serial: spcp8x5: don't store usb_device_id (stable-fixes).\n- USB: serial: ssu100: fix baud rate overflow (git-fixes).\n- usb: storage: sierra_ms: reject short SWoC info transfers (git-fixes).\n- usb: typec: anx7411 - stop the IRQ before destroying the workqueue (git-fixes).\n- usb: typec: tcpm: recover after failure to start the frs ams (git-fixes).\n- usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() (git-fixes).\n- usb: typec: ucsi: displayport: Current CAM OOB index fixup (git-fixes).\n- usb: typec: ucsi: Get the connector fwnode based on reg value (git-fixes).\n- usb: typec: ucsi: glink: fix use-after-free of ucsi on remove (git-fixes).\n- usb: usbtmc: don't store usb_device_id (stable-fixes).\n- usb: xhci: Improve Soft Retries after short transfers (stable-fixes).\n- usb: xhci: use cached HCSPARAMS1 value (stable-fixes).\n- usb: xusbatm: don't rely on id table pointer arithmetic (stable-fixes).\n- usbip: vhci_hcd: fix NULL deref in status_show_vhci (stable-fixes).\n- vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF (git-fixes).\n- vt: skip screen update for DEC alignment test on backgroup consoles (git-fixes).\n- watchdog: da9062: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes).\n- watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes).\n- watchdog: digicolor: Avoid division by zero (git-fixes).\n- watchdog: imx7ulp_wdt: Keep WDOG running until A55 enters WFI on i.MX94 (stable-fixes).\n- watchdog: lenovo_se10_wdt: Add support for SE10 Gen 2 platform (stable-fixes).\n- watchdog: lenovo_se10_wdt: Fix use-after-free and resource leak risk (stable-fixes).\n- watchdog: msc313e: Fix premature reset during timeout update (git-fixes).\n- watchdog: msc313e: Propagate error code in resume() (git-fixes).\n- watchdog: rtd119x: Avoid division by zero (git-fixes).\n- watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init() (git-fixes).\n- watchdog: starfive-wdt: Fix runtime PM leak in starfive_wdt_pm_start() (git-fixes).\n- wifi: ath9k_htc: don't store usb_device_id (stable-fixes).\n- wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all() (git-fixes).\n- wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi (stable-fixes).\n- wifi: ath11k: fix stride mismatch in mac_phy_caps_parse() (git-fixes).\n- wifi: ath12k: fix stride mismatch in mac_phy_caps_parse() (git-fixes).\n- wifi: brcmfmac: fix lost 802.1x TX completion wakeup (git-fixes).\n- wifi: brcmsmac: fix UAF in brcms_free_timer() (git-fixes).\n- wifi: cfg80211: check IP header size in cfg80211_classify8021d() (git-fixes).\n- wifi: cfg80211: don't filter by BSS type when removing stale entries (git-fixes).\n- wifi: cfg80211: don't get the radio mask for netdev-less wdevs (git-fixes).\n- wifi: cfg80211: expose cfg80211_chandef_get_width() (stable-fixes).\n- wifi: cfg80211: fix width unit in cfg80211_radio_chandef_valid() (git-fixes).\n- wifi: cfg80211: only group hidden BSSes with beacon entries (git-fixes).\n- wifi: cfg80211: reject duplicate wiphy cipher suite entries (stable-fixes).\n- wifi: cfg80211: skip regulatory for punctured subchannels (stable-fixes).\n- wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() (stable-fixes).\n- wifi: cfg80211: validate rx/tx MLME callback frame lengths before access (stable-fixes).\n- wifi: iwlegacy: fix broadcast stations deallocation (git-fixes).\n- wifi: iwlwifi: acpi: validate WGDS table revision index (stable-fixes).\n- wifi: iwlwifi: bound aligned TLV advance in FW parser (stable-fixes).\n- wifi: iwlwifi: mvm: add a check on the tid coming from the firmware (stable-fixes).\n- wifi: iwlwifi: mvm: fix a possible underflow (stable-fixes).\n- wifi: iwlwifi: mvm: fix an off-by-1 boundary check (stable-fixes).\n- wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif (stable-fixes).\n- wifi: iwlwifi: mvm: fix sched scan IE sizing (stable-fixes).\n- wifi: iwlwifi: mvm: parse beacon notif per layout (stable-fixes).\n- wifi: iwlwifi: mvm: validate mac_link_id in session protect notif (stable-fixes).\n- wifi: iwlwifi: mvm: validate sta_id in BA window status notif (stable-fixes).\n- wifi: iwlwifi: mvm: validate TX_CMD response layout (stable-fixes).\n- wifi: libertas: reject short monitor TX frames (stable-fixes).\n- wifi: libipw: fix key index receive bound checks (stable-fixes).\n- wifi: libipw: reject too-short association responses (git-fixes).\n- wifi: libipw: reject too-short beacon and probe responses (git-fixes).\n- wifi: mac80211: abort chanswitch when leaving a mesh (git-fixes).\n- wifi: mac80211: add HE 6 GHz capability in the scan elems len (git-fixes).\n- wifi: mac80211: always allow transmitting null-data on TXQs (stable-fixes).\n- wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver (git-fixes).\n- wifi: mac80211: don't access the TSF of a down interface (git-fixes).\n- wifi: mac80211: don't allow injecting frames wider than the chanctx (git-fixes).\n- wifi: mac80211: don't allow link changes when iface is down (git-fixes).\n- wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed (stable-fixes).\n- wifi: mac80211: don't offload TC setup on AP_VLAN interfaces (git-fixes).\n- wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set (git-fixes).\n- wifi: mac80211: don't start a ROC while scanning (git-fixes).\n- wifi: mac80211: explicitly disable FTM responder on AP stop (stable-fixes).\n- wifi: mac80211: ibss: wait for in-flight TX on disconnect (stable-fixes).\n- wifi: mac80211: mesh: release the channel if start fails (git-fixes).\n- wifi: mac80211: mesh: reset the CSA state when leaving (git-fixes).\n- wifi: mac80211: only operate on TDLS peers in the TDLS code (git-fixes).\n- wifi: mac80211: require a peer station for TDLS setup confirm (git-fixes).\n- wifi: mac80211: reset state when starting AP fails (git-fixes).\n- wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown (git-fixes).\n- wifi: mac80211: set up the TX info early to fix failure paths (git-fixes).\n- wifi: mac80211: suppress chanctx warning for debugfs reset (git-fixes).\n- wifi: mac80211: unlist vifs when their netdev is unregistered (git-fixes).\n- wifi: mac80211: validate deauth frame length before reason access (stable-fixes).\n- wifi: mt76: add init_wiphy callback (stable-fixes).\n- wifi: mt76: mt7915: set correct background radar capability (stable-fixes).\n- wifi: mt76: mt7925: add 320MHz bandwidth to bss_rlm_tlv (stable-fixes).\n- wifi: mt76: mt7925: add Netgear A8500 USB device ID (stable-fixes).\n- wifi: mt76: mt7925: advertise EHT 320MHz capabilities for 6GHz band (stable-fixes).\n- wifi: mt76: mt7925: Fix EHT Beamformee SS subfields to meet 802.11be minimum (git-fixes).\n- wifi: mt76: mt7925: handle 320MHz bandwidth in RXV and TXS (stable-fixes).\n- wifi: mt76: mt7925: populate EHT 320MHz MCS map in sta_rec (stable-fixes).\n- wifi: mt76: transform aspm_conf for pci_disable_link_state (stable-fixes).\n- wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length (git-fixes).\n- wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path (git-fixes).\n- wifi: mwifiex: prevent authentication frame length truncation (git-fixes).\n- wifi: mwifiex: replace one-element arrays with flexible array members (stable-fixes).\n- wifi: mwifiex: validate action frame fixed fields (git-fixes).\n- wifi: mwifiex: validate scan response extents (git-fixes).\n- wifi: nl80211: reject beacons with bad HE operation (stable-fixes).\n- wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST (git-fixes).\n- wifi: p54: validate curve data length in the calibration curve converters (git-fixes).\n- wifi: ralink: RT2X00: init EEPROM properly (stable-fixes).\n- wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers (stable-fixes).\n- wifi: rsi: fix heap OOB write on key removal (git-fixes).\n- wifi: rsi: validate beacon length before fixed buffer copy (stable-fixes).\n- wifi: rtw88: Add NULL check for chip-\u003eedcca_th in rtw_fw_adaptivity_result() (stable-fixes).\n- wifi: rtw88: Fix the random \"error beacon valid\" messages for USB (stable-fixes).\n- wifi: rtw88: TX QOS Null data the same way as Null data (stable-fixes).\n- wifi: rtw89: cleanup unused rtwdev::roc_work (stable-fixes).\n- wifi: rtw89: disable CSI STBC for VHT 160MHz (stable-fixes).\n- wifi: rtw89: Hide some errors when the device is unplugged (stable-fixes).\n- wifi: rtw89: pci: enable LTR based on pcie control register (stable-fixes).\n- wifi: rtw89: phy: check length before parsing PHY status IE (stable-fixes).\n- wifi: virt_wifi: don't transfer operstate before register (git-fixes).\n- wifi: virt_wifi: free skb when disconnected (git-fixes).\n- wifi: wilc1000: fix out-of-bounds read in P2P public action frames (git-fixes).\n- wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() (git-fixes).\n- wifi: wlcore: release runtime PM ref on regdomain config failure (git-fixes).\n- xhci: Prevent queuing new commands if xhci is inaccessible (stable-fixes).\n","status":"published","published":"2026-10-12T14:15:17Z","modified":"2026-10-21T17:23:09.534105524Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24235-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2025-40136: crypto: hisilicon/qm - request reserved interrupt for virtual function (bsc#1253340).\n- CVE-2026-23199: procfs: avoid fetching build ID while holding VMA lock (bsc#1258335).\n- CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).\n- CVE-2026-43210: tracing: ring-buffer: Fix to check event length before using (bsc#1264330).\n- CVE-2026-43272: ring-buffer: Fix possible dereference of uninitialized pointer (bsc#1264607).\n- CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).\n- CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).\n- CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).\n- CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).\n- CVE-2026-46272: coresight: tmc-etr: Fix race condition between sysfs and perf mode (bsc#1267672).\n- CVE-2026-53377: drm/msm: always recover the gpu (bsc#1271901).\n- CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).\n- CVE-2026-63838: ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] (bsc#1272388).\n- CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).\n- CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check\n  (bsc#1272890).\n- CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).\n- CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).\n- CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).\n- CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).\n- CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).\n- CVE-2026-64132: ipv6: ioam: refresh hdr pointer before ioam6_event() (bsc#1272347).\n- CVE-2026-64154: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() (bsc#1271950).\n- CVE-2026-64173: tracing: Do not call map-\u003eops-\u003eelt_free() if elt_alloc() fails (bsc#1272145).\n- CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).\n- CVE-2026-64216: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() (bsc#1272802).\n- CVE-2026-64235: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines (bsc#1272803).\n- CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).\n- CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).\n- CVE-2026-64324: udf: validate free block extents against the partition length (bsc#1273970).\n- CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).\n- CVE-2026-64377: cpufreq: qcom-cpufreq-hw: Fix possible double free (bsc#1273297).\n- CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).\n- CVE-2026-64402: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (bsc#1273258).\n- CVE-2026-64405: Bluetooth: separate CIS_LINK and BIS_LINK link types (bsc#1273512).\n- CVE-2026-64414: netfilter: handle unreadable frags (bsc#1273275).\n- CVE-2026-64418: mm: shrinker: fix shrinker_info teardown race with expansion (bsc#1273784).\n- CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).\n- CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).\n- CVE-2026-64457: virtio_pci: fix vq info pointer lookup via wrong index (bsc#1273491).\n- CVE-2026-64473: vfio: Remove device debugfs before releasing devres (bsc#1273320).\n- CVE-2026-64474: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (bsc#1274316).\n- CVE-2026-64475: vfio/pci: Release the VGA arbiter client on register_device() failure (bsc#1274319).\n- CVE-2026-64476: vfio/pci: Latch disable_idle_d3 per device (bsc#1274245).\n- CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037).\n- CVE-2026-64594: usb: gadget: f_fs: initialize reset_work at allocation time (bsc#1274538).\n- CVE-2026-64597: smb: client: fix double-free in SMB2_close() replay (bsc#1274297).\n- CVE-2026-64598: smb/client: Fix error code in smb2_aead_req_alloc() (bsc#1274298).\n- CVE-2026-68146: ftrace: Add global mutex to serialize trace_parser access (bsc#1274890).\n- CVE-2026-68264: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (bsc#1275142).\n- CVE-2026-68266: drm/xe: Hold a dma-buf reference for imported BOs (bsc#1275137).\n- CVE-2026-68290: rds: tcp: unregister sysctl before tearing down listen socket (bsc#1275977).\n- CVE-2026-68312: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (bsc#1274663).\n- CVE-2026-68343: smb: client: validate DFS referral PathConsumed (bsc#1274629).\n- CVE-2026-68367: usb: gadget: f_tcm: synchronize delayed set_alt with teardown (bsc#1275170).\n- CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).\n- CVE-2026-68382: drm/xe/guc: Hold device ref until queue teardown completes (bsc#1274824).\n- CVE-2026-68385: s390/checksum: Fix csum_partial() without vector facility (bsc#1274818).\n- CVE-2026-68400: KVM: arm64: Mask response to FFA_FEATURE call (bsc#1274912).\n- CVE-2026-68441: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains (bsc#1274776).\n- CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests (bsc#1276287).\n- CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests (bsc#1276295).\n- CVE-2026-68454: KVM: s390: pci: Fix handling of AIF enable without AISB (bsc#1276388).\n- CVE-2026-68471: wifi: ieee80211: validate MLE common info length (bsc#1276504).\n- CVE-2026-68477: ipvs: fix more places with wrong ipv6 transport offsets (bsc#1275495).\n- CVE-2026-72012: tracing/osnoise: Call synchronize_rcu() when unregistering (bsc#1276783).\n- CVE-2026-72018: dibs: loopback: validate offset and size in move_data() (bsc#1276852).\n- CVE-2026-72025: s390/monwriter: Reject buffer reuse with different data length (bsc#1276923).\n- CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).\n- CVE-2026-72070: wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() (bsc#1277153).\n- CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).\n- CVE-2026-72102: dm_early_create: fix freeing used table on dm_resume failure (bsc#1277314).\n- CVE-2026-72128: nvmet: fix refcount leak in nvmet_sq_create() (bsc#1277101).\n- CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).\n- CVE-2026-72130: nvmet-auth: reject short AUTH_RECEIVE buffers (bsc#1275549).\n- CVE-2026-72147: dmaengine: dw-edma-pcie: Reject devices without driver data (bsc#1277234).\n- CVE-2026-72166: net/9p: fix infinite loop in p9_client_rpc on fatal signal (bsc#1277556).\n- CVE-2026-72218: lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure (bsc#1277218).\n- CVE-2026-72219: lockd: Plug nlm_file leak when nlm_do_fopen() fails (bsc#1277217).\n- CVE-2026-72224: nvdimm/btt: Free arenas on btt_init() error paths (bsc#1277215).\n- CVE-2026-72237: perf/x86/amd/brs: Fix kernel address leakage (bsc#1277615).\n- CVE-2026-72247: netfilter: nf_conncount: fix zone comparison in tuple dedup (bsc#1277662).\n- CVE-2026-72256: netfilter: xt_cluster: reject template conntracks in hash match (bsc#1277674).\n- CVE-2026-72299: tipc: restrict socket queue dumps in enqueue tracepoints (bsc#1275924).\n- CVE-2026-72321: ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() (bsc#1277143).\n- CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).\n- CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).\n- CVE-2026-72349: netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() (bsc#1277784).\n- CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).\n- CVE-2026-72352: HID: bpf: Fix hid_bpf_get_data() range check (bsc#1277823).\n- CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).\n- CVE-2026-72392: ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump (bsc#1277128).\n- CVE-2026-72404: tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() (bsc#1278031).\n- CVE-2026-72406: net: sungem: fix probe error cleanup (bsc#1278035).\n- CVE-2026-72413: sctp: fix err_chunk memory leaks in INIT handling (bsc#1277122).\n- CVE-2026-72433: netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (bsc#1278053).\n- CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped (bsc#1278054).\n- CVE-2026-72435: netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() (bsc#1278056).\n- CVE-2026-72436: netfilter: ipset: Fix data race between add and dump in all hash types (bsc#1277245).\n- CVE-2026-72444: flow_dissector: check device type before reading ETH_ADDRS (bsc#1278100).\n- CVE-2026-72447: sctp: hold socket lock when dumping endpoints in sctp_diag (bsc#1277109).\n- CVE-2026-72491: net/9p: fix race condition on rdma-\u003estate in trans_rdma.c (bsc#1276947).\n- CVE-2026-74256: bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check (bsc#1276535).\n- CVE-2026-74257: sockmap: Fix use-after-free in udp_bpf_recvmsg() (bsc#1276532).\n- CVE-2026-74258: bpf: Guard __get_user acesss with access_ok for uprobe_multi data (bsc#1276538).\n- CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen\n  (bsc#1276519).\n- CVE-2026-74268: tcp: clear sock_ops cb flags before force-closing a child socket (bsc#1276508).\n- CVE-2026-74281: tipc: reject inverted service ranges from peer bindings (bsc#1276474).\n- CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators (bsc#1276475).\n- CVE-2026-74288: net: fib_rules: Don't dump dying fib_rule in fib_rules_dump() (bsc#1276460).\n- CVE-2026-74289: ipv4: fib: Don't dump dying fib_info in fib_leaf_notify() (bsc#1276461).\n- CVE-2026-74290: net/sched: cls_flow: Dont expose folded kernel pointers (bsc#1276462).\n- CVE-2026-74330: configfs: fix lockless traversals of -\u003es_children (bsc#1277129).\n- CVE-2026-74356: vhost: fix vhost_get_avail_idx for a non empty ring (bsc#1278063).\n- CVE-2026-74359: configfs_lookup(): don't leave -\u003es_dentry dangling on failure (bsc#1278067).\n- CVE-2026-74365: nvdimm/btt: Handle preemption in BTT lane acquisition (bsc#1278225).\n- CVE-2026-74376: md/raid10: reset read_slot when reusing r10bio for discard (bsc#1277401).\n- CVE-2026-74384: nvme-multipath: fix flex array size in struct nvme_ns_head (bsc#1277405).\n- CVE-2026-74385: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock (bsc#1278255).\n- CVE-2026-74386: nvmet-tcp: fix page fragment cache leak in error path (bsc#1277098).\n- CVE-2026-74389: RDMA/hns: Fix log flood after cmd_mbox failure (bsc#1278087).\n- CVE-2026-74391: tracing: Bound synthetic-field strings with seq_buf (bsc#1278091).\n- CVE-2026-74398: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (bsc#1277410).\n- CVE-2026-74440: drm/xe: Wait on external BO kernel fences in exec IOCTL (bsc#1261564).\n- CVE-2026-74449: drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport (bsc#1278215).\n- CVE-2026-74450: drm/amd/pm: fix pptable use-after-free (bsc#1278216).\n- CVE-2026-74465: net: openvswitch: fix potential UAF on meter attach failure (bsc#1277801).\n- CVE-2026-74467: s390/qeth: Check CAP_NET_ADMIN for private ioctls (bsc#1277805).\n- CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1277792).\n- CVE-2026-74471: tracing: Check return value of __register_event() in trace_module_add_events() (bsc#1277781).\n- CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() (bsc#1276340).\n- CVE-2026-74480: net: bridge: stop fast-leave after deleting a port group (bsc#1276353).\n- CVE-2026-74483: binfmt_misc: don't leak the user namespace when the mount fails (bsc#1276347).\n- CVE-2026-74484: binfmt_misc: don't let an 'F' entry pin its own instance (bsc#1276345).\n- CVE-2026-74485: binfmt_misc: reject a flag character as the field delimiter (bsc#1277892).\n- CVE-2026-74487: binfmt_misc: restore write access when removing an entry (bsc#1276349).\n- CVE-2026-74490: tipc: avoid use-after-free in poll trace queue dumps (bsc#1276352).\n- CVE-2026-74492: netfilter: ipset: do not update comments from kernel-side hash adds (bsc#1276337).\n- CVE-2026-74493: net/smc: fix socket use-after-free during link group termination (bsc#1276338).\n- CVE-2026-74515: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (bsc#1275953).\n- CVE-2026-74538: Bluetooth: ISO: lock sk in iso_connect_ind (bsc#1275682).\n- CVE-2026-74564: netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH (bsc#1275567).\n- CVE-2026-74579: netfilter: nft_payload: fix mask build for partial field offload (bsc#1275559).\n- CVE-2026-74580: vhost: reset the vring metadata cache on vring reconfiguration (bsc#1277885).\n- CVE-2026-74586: sctp: clear new_transport when removing a peer (bsc#1277820).\n- CVE-2026-74588: sctp: keep chunk-\u003etransport in step with the list it is queued on (bsc#1277766).\n- CVE-2026-74589: bpf, sockmap: Fix sk_redir use-after-free in send verdict (bsc#1277904).\n- CVE-2026-74590: fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions (bsc#1277824).\n- CVE-2026-74592: ima: Instantiate file_truncate and path_truncate hooks (bsc#1277900).\n- CVE-2026-74594: sched/psi: Shut down rtpoll_timer in psi_cgroup_free() (bsc#1277843).\n- CVE-2026-74595: fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() (bsc#1277910).\n- CVE-2026-74597: ip6_tunnel: clear skb2-\u003ecb in ip6ip6_err() (bsc#1277493).\n- CVE-2026-74600: mm/page_table_check: skip special zero mappings (bsc#1277640).\n- CVE-2026-74601: ring-buffer: Use current_context for safe per-CPU buffer swap (bsc#1277896).\n- CVE-2026-74602: ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer() (bsc#1277895).\n- CVE-2026-74603: ptp: ocp: Fix board ID over-read (bsc#1277915).\n- CVE-2026-74605: eventfs: Use children field for rcu head and add memory barriers (bsc#1277913).\n- CVE-2026-74606: eventfs: Fix use-after-free in eventfs_remove_rec() (bsc#1277864).\n- CVE-2026-74609: tipc: read le-\u003elink under the node lock in tipc_node_link_down() (bsc#1277906).\n- CVE-2026-74625: netfilter: bridge: release template ct on non-IP path (bsc#1277036).\n- CVE-2026-74628: net/x25: fix use-after-free of the socket by its timers (bsc#1277844).\n- CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191).\n- CVE-2026-74631: net: smc: fix splice entry lifetime imbalance in smc_rx_splice (bsc#1278195).\n- CVE-2026-74632: mm/huge_memory: fix huge_zero_pfn race (bsc#1278199).\n- CVE-2026-74634: ring-buffer: Prevent subbuf order change when resizing is disabled (bsc#1277379).\n- CVE-2026-74636: tracing: Fix race between update_event_fields and, event_define_fields (bsc#1277371).\n- CVE-2026-74637: perf/core: Fix group leader use-after-free after sibling detach (bsc#1277372).\n- CVE-2026-74638: drm/v3d: Serialize the scheduler timeout handlers (bsc#1277374).\n- CVE-2026-74659: net: bridge: mrp: fix uninitialised bytes on the wire (bsc#1277296).\n- CVE-2026-74660: netfilter: ebt_nflog: pin the NFLOG backend (bsc#1277272).\n- CVE-2026-74662: inet: frags: add inet_frag_putn() helper (bsc#1277277).\n- CVE-2026-74663: net/sched: reject overly deep qdisc hierarchies (bsc#1278311).\n- CVE-2026-74666: packet: synchronize pressure clearing with ring reconfiguration (bsc#1277032).\n- CVE-2026-74667: net/packet: reset the MAC header on the packet-socket transmit path (bsc#1277396).\n- CVE-2026-74671: ima: fix out-of-bounds read in xattr_verify() (bsc#1277392).\n- CVE-2026-74688: sctp: clear control chunk transport if it is being removed (bsc#1277489).\n- CVE-2026-74689: net/atm: fix slab-out-of-bounds read in vcc_setsockopt() (bsc#1278314).\n- CVE-2026-74692: net/smc: fix TOCTOU race between smc_listen_out() and listener close (bsc#1276927).\n- CVE-2026-74694: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length (bsc#1277625).\n- CVE-2026-74696: tcp: fix TFO max_qlen accounting across reuseport migration (bsc#1276930).\n- CVE-2026-74697: bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips (bsc#1277897).\n- CVE-2026-74700: net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers (bsc#1277626).\n- CVE-2026-74701: net/openvswitch: check Ethernet header length in key_extract() (bsc#1276921).\n- CVE-2026-74710: xsk: require at least 16 bytes of TX metadata (bsc#1276579).\n- CVE-2026-74713: vhost_iotlb: bound map allocation in add_range (bsc#1276570).\n- CVE-2026-74718: devlink: fix net namespace reference leak in reload (bsc#1276573).\n- CVE-2026-74725: enic: fix tx_hang_reset use-after-free on device removal (bsc#1276563).\n- CVE-2026-74726: bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor (bsc#1276565).\n- CVE-2026-74735: l2tp: fix tunnel and session refcount leak on seq_file release (bsc#1277030).\n- CVE-2026-74739: net/sched: cls_u32: skip hash tables in u32_bind_class() (bsc#1278247).\n- CVE-2026-74745: eth: bnxt: decrease indent in bnxt_request_irq() (bsc#1277382).\n- CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315).\n- CVE-2026-80521: af_unix: Unlink scc_entry in unix_del_edge() (bsc#1277568).\n- CVE-2026-80585: mptcp: fastopen: only mark MPTFO subflows with SYN data (bsc#1277342).\n- CVE-2026-80613: veth: fix NAPI leak in XDP enable error path (bsc#1278205).\n- CVE-2026-80631: btrfs: lzo: reject compressed segment that overflows the compressed input (bsc#1277558).\n- CVE-2026-80664: netfilter: xt_nat: reject unsupported target families (bsc#1277555).\n- CVE-2026-80679: s390/dasd: Fix potential NULL pointer dereference (bsc#1277557).\n- CVE-2026-80686: mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE (bsc#1278245).\n- CVE-2026-80694: net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller (bsc#1278363).\n- CVE-2026-80715: igc: remove napi_synchronize() in igc_down() (bsc#1277840).\n- CVE-2026-80725: net: gro: properly validate BIG TCP aggregation criteria (bsc#1277452).\n- CVE-2026-80747: drm/amdkfd: Add bounds check for CRAT subtype length (bsc#1279536).\n- CVE-2026-80756: selinux: do not cancel a policy conversion that never started (bsc#1278708).\n- CVE-2026-80779: net/ionic: avoid OOB TX partner lookup for hwstamp RXQ (bsc#1279590).\n- CVE-2026-80789: nvmet-tcp: bound SGL data length before allocating command buffers (bsc#1279621).\n- CVE-2026-80793: ipv4: reject undersized MTUs in ip_do_fragment() (bsc#1279799).\n- CVE-2026-80836: crypto: virtio - bound the akcipher result length (bsc#1279819).\n- CVE-2026-80840: ipv6: seg6: clear IPv4 control block on IPIP decapsulation (bsc#1279875).\n- CVE-2026-80841: net/packet: defer vmalloc TX_RING free until skbs finish (bsc#1279835).\n- CVE-2026-80842: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context (bsc#1279888).\n- CVE-2026-80844: xfrm: ah6: validate routing header segments_left (bsc#1279786).\n- CVE-2026-80846: xfrm: drop ESP-in-TCP packets with no ingress device (bsc#1279878).\n- CVE-2026-80847: tcp: clamp route advmss to TCP_MIN_MSS (bsc#1279850).\n- CVE-2026-80848: xfrm: espintcp: fix UAF during close (bsc#1279581).\n- CVE-2026-80851: gtp: serialize PDP context updates (bsc#1279569).\n- CVE-2026-80852: tls: device: fix out-of-bounds write in tls_append_frag() (bsc#1279532).\n- CVE-2026-80863: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (bsc#1279535).\n- CVE-2026-80864: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (bsc#1279525).\n- CVE-2026-80865: bpf: Add missing access_ok call to copy_user_syms (bsc#1279527).\n- CVE-2026-80880: IB/mlx5: Properly support implicit ODP rereg_mr (bsc#1279497).\n- CVE-2026-80895: mshv: Order pt_vp_array publish against irqfd assertion path (bsc#1279702).\n- CVE-2026-80932: vsock/virtio: flush works in dependency order (bsc#1280143).\n- CVE-2026-80976: seg6: reset IP6CB after IPv6 decapsulation (bsc#1280298).\n- CVE-2026-80979: net/smc: unregister the connection before draining the rx tasklet (bsc#1280299).\n- CVE-2026-80980: net/smc: Address spelling errors (bsc#1280303).\n- CVE-2026-80983: net/smc: fix socket refcount leak in smc_switch_conns() (bsc#1280296).\n- CVE-2026-80984: net/smc: do not dereference an unset send buffer on the SMC-D teardown path (bsc#1280309).\n- CVE-2026-81000: net: tun: bound receive headroom (bsc#1280263).\n- CVE-2026-81001: slip: fix use-after-free in sl_sync() (bsc#1280375).\n- CVE-2026-89448: iommu/vt-d: Force requesting ACS when tboot is enabled (bsc#1280379).\n- CVE-2026-89451: iommu/sva: Set handle-\u003edev before the SVA handle is visible (bsc#1280383).\n- CVE-2026-89453: iommu/amd: Put PCI device after handling PPR faults (bsc#1280384).\n- CVE-2026-89477: sctp: fix NULL deref on untransmitted RECONF completion (bsc#1280338).\n- CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786).\n- CVE-2026-89480: nvme-tcp: reject a read that transferred too few bytes (bsc#1280449).\n- CVE-2026-89481: nvme-tcp: fix host memory disclosure on R2T for a read command (bsc#1280451).\n- CVE-2026-89482: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (bsc#1280350).\n- CVE-2026-89485: lockd: pin next file across nlm_inspect_file lock-drop (bsc#1280456).\n- CVE-2026-89500: ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page (bsc#1280333).\n- CVE-2026-89501: ring-buffer: Hold cpu_buffer::lock when resizing a subbuf (bsc#1280335).\n- CVE-2026-89502: ring-buffer: Free cpu_buffer::free_page with subbuf_order (bsc#1280336).\n- CVE-2026-89503: ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() (bsc#1280334).\n- CVE-2026-89508: RDMA/ucma: Lock the handler in ucma_set_ib_path() (bsc#1280544).\n- CVE-2026-89510: RDMA/cxgb4: Cancel reg_work before freeing device on remove (bsc#1280551).\n- CVE-2026-89511: qede: Fix NULL pointer dereference in TPA fragment processing (bsc#1280508).\n- CVE-2026-89525: udf: reject VAT indexes equal to the entry count (bsc#1282288).\n- CVE-2026-89526: svcrdma: Validate Read chunk positions before reconstruction (bsc#1280901).\n- CVE-2026-89527: svcrdma: Use svc_xprt_put to free listener on create failure (bsc#1281754).\n- CVE-2026-89530: svcrdma: Reject inline replies that overflow the pull-up buffer (bsc#1280920).\n- CVE-2026-89531: svcrdma: Reject connection when transport allocation fails (bsc#1281738).\n- CVE-2026-89532: svcrdma: Fix pcl_for_each_segment for empty chunks (bsc#1280985).\n- CVE-2026-89533: svcrdma: Fix offset arithmetic in read_chunk_range (bsc#1280993).\n- CVE-2026-89534: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails (bsc#1280766).\n- CVE-2026-89535: svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id (bsc#1280761).\n- CVE-2026-89536: SUNRPC: wait for in-flight client TLS handshake callback (bsc#1280711).\n- CVE-2026-89538: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field (bsc#1280716).\n- CVE-2026-89539: SUNRPC: reject duplicate CREDS_VALUE options (bsc#1280717).\n- CVE-2026-89540: sunrpc: init gssp_lock before publishing proc entry (bsc#1280719).\n- CVE-2026-89541: SUNRPC: harden gss_unwrap_resp_priv length checks (bsc#1280388).\n- CVE-2026-89542: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (bsc#1280387).\n- CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280758).\n- CVE-2026-89545: sunrpc: defer rq_argp and rq_resp free until after RCU grace period (bsc#1280720).\n- CVE-2026-89547: SUNRPC: Check svc pool percpu counter allocation (bsc#1280548).\n- CVE-2026-89548: SUNRPC: always drain cache_cleaner before destroying a cache_detail (bsc#1280546).\n- CVE-2026-89550: SUNRPC: svcauth_gss: enforce krb5 token minimum length (bsc#1280726).\n- CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow (bsc#1280727).\n- CVE-2026-89564: ip: orphan prefetched skbs before multicast forwarding (bsc#1280797).\n- CVE-2026-89580: bpf: Disable preemption in __bpf_get_stack (bsc#1280577).\n- CVE-2026-89603: entry: Fix seccomp bypass after ptrace with TSYNC (bsc#1280923).\n- CVE-2026-89644: btrfs: fix extent map leak in NOCOW direct I/O write (bsc#1281054).\n- CVE-2026-89658: NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup (bsc#1280576).\n- CVE-2026-89660: NFSD: Prevent client use-after-free during admin state revocation (bsc#1280525).\n- CVE-2026-89662: NFSD: Prevent lock owner use-after-free during client teardown (bsc#1280509).\n- CVE-2026-89663: nfsd: revoke copy-notify stateids before dropping their reference (bsc#1280518).\n- CVE-2026-89665: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE (bsc#1281057).\n- CVE-2026-89669: nfsd: initialize copy-notify stateid before publishing it (bsc#1280251).\n- CVE-2026-89671: nfsd: gate nfs3 setacl by argp-\u003emask (bsc#1280252).\n- CVE-2026-89672: nfsd: gate nfs2 setacl by argp-\u003emask (bsc#1280235).\n- CVE-2026-89673: nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo (bsc#1280237).\n- CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280243).\n- CVE-2026-89680: nfsd: fix nfsd_file leak on inter-server COPY setup failure (bsc#1280206).\n- CVE-2026-89683: nfsd: fix dentry ref leak on V4ROOT export filehandle lookup (bsc#1280193).\n- CVE-2026-89684: nfsd: fix cpntf publish race in nfs4_init_cp_state (bsc#1280178).\n- CVE-2026-89685: nfsd: fix clock domain mismatch in clients_still_reclaiming() (bsc#1280179).\n- CVE-2026-89686: nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke (bsc#1280184).\n- CVE-2026-89688: nfsd: drop the stateid, not the stateowner, on seqid_op replay retry (bsc#1280171).\n- CVE-2026-89690: nfsd: defer vfree of compound ops to fix rpc_status UAF (bsc#1280166).\n- CVE-2026-89691: nfsd: clear opcnt on compound arg release to prevent OOB read (bsc#1280163).\n- CVE-2026-89694: nfsd: check client ownership when cancelling a copy-notify stateid (bsc#1280151).\n- CVE-2026-89696: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref (bsc#1280146).\n- CVE-2026-89697: nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() (bsc#1280148).\n- CVE-2026-89698: nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage (bsc#1280494).\n- CVE-2026-89699: nfsd: validate symlink target length in NFSv4 CREATE (bsc#1281077).\n- CVE-2026-89702: nfsd: size fh_verify server sockaddr slot by xpt_locallen (bsc#1280487).\n- CVE-2026-89703: nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations (bsc#1280488).\n- CVE-2026-89704: nfsd: sample writeback error cursor before async COPY loop (bsc#1280490).\n- CVE-2026-89705: nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths (bsc#1280464).\n- CVE-2026-89706: nfsd: Reset write verifier when async COPY writeback fails (bsc#1280477).\n- CVE-2026-89707: nfsd: release path refs on follow_down() error (bsc#1280468).\n- CVE-2026-89710: NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path (bsc#1280455).\n- CVE-2026-89712: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock (bsc#1280870).\n- CVE-2026-89713: NFSD: check truncate permission under inode lock (bsc#1280872).\n- CVE-2026-89747: tracing: Fix use-after-free in trace_pipe read on sub-buffer order change (bsc#1281025).\n- CVE-2026-89780: net: qualcomm: rmnet: restore skb-\u003edev on deaggregated frames (bsc#1280969).\n- CVE-2026-89784: SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 (bsc#1281224).\n- CVE-2026-89789: gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free (bsc#1281226).\n- CVE-2026-89791: perf: Fix use-after-free when perf mmap() revival races with the last munmap() (bsc#1281228).\n- CVE-2026-89798: svcrdma: Fix unmatched rn_unregister on failed accept (bsc#1281136).\n- CVE-2026-89912: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save (bsc#1281201).\n- CVE-2026-89913: KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables (bsc#1281202).\n- CVE-2026-89968: nvmet-tcp: reject unsolicited H2CData PDUs (bsc#1281229).\n- CVE-2026-89970: nvmet: add a helper function for cqid checking (bsc#1281231).\n- CVE-2026-89984: perf/x86/intel: Fix kernel address leakages in LBR stack (bsc#1281273).\n- CVE-2026-90003: futex: Prevent rcuwait use-after-free during requeue PI (bsc#1281295).\n- CVE-2026-90065: net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure (bsc#1281660).\n- CVE-2026-90074: net/sched: fq_pie: clamp default quantum to avoid signed overflow (bsc#1281496).\n- CVE-2026-90097: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition (bsc#1281514).\n- CVE-2026-90101: bnxt_en: Fix call to hardware monitoring event handler (bsc#1281525 bsc#1283517).\n- CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546).\n- CVE-2026-90142: virtio_net: Fix resize of the RX ring (bsc#1281597).\n- CVE-2026-90149: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers (bsc#1281955).\n- CVE-2026-90150: pnfs/blocklayout: Fix device leaks on parse failure (bsc#1281956).\n- CVE-2026-90151: NFSv4: remove callback IDR entry on client allocation failure (bsc#1281599).\n- CVE-2026-90177: bpf: Check pointer type for all atomic RMW paths (bsc#1281645).\n- CVE-2026-90182: blk-iocost: clear delay state when freeing policy data (bsc#1281644).\n- CVE-2026-90183: blk-iolatency: clear delay state when freeing policy data (bsc#1281964).\n- CVE-2026-90203: Squashfs: check block offset is not negative (bsc#1281808).\n- CVE-2026-90218: RDMA/cma: Fix WARNING in res_to_rt (bsc#1281795).\n- CVE-2026-90228: nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() (bsc#1281717).\n- CVE-2026-90240: iommu/vt-d: Flush context cache with correct SID when tearing down aliases (bsc#1281683).\n- CVE-2026-90241: iommu/vt-d: Tear down scalable-mode context on probe failure (bsc#1281682).\n- CVE-2026-90243: iommu/vt-d: Clear Present bit before tearing down copied context entry (bsc#1281845).\n- CVE-2026-90259: btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() (bsc#1281680).\n- CVE-2026-90263: btrfs: check if root is readonly when setting posix acl (bsc#1281922).\n- CVE-2026-90265: btrfs: defrag: fix deadlock between defrag and delalloc space reservation (bsc#1282054).\n- CVE-2026-90292: RDMA/siw: Fix use-after-free in siw_accept() (bsc#1281777).\n- CVE-2026-90293: IB/isert: post the full-feature receive buffers after session registration (bsc#1281778).\n- CVE-2026-90294: IB/isert: delay the final Login Response until the session is registered (bsc#1281732).\n- CVE-2026-90307: RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ (bsc#1282050).\n- CVE-2026-90308: RDMA/erdma: Hold QP references for AE and CM processing (bsc#1281786).\n- CVE-2026-90309: RDMA/erdma: Hold CQ references when processing EQ events (bsc#1281789).\n- CVE-2026-90358: bpf, x86: Fix trampoline stack size for 128-bit arguments (bsc#1281825).\n- CVE-2026-90388: iommu/dma: Check atomic pool allocation result directly (bsc#1282197).\n- CVE-2026-90413: IB/isert: reject login PDUs declaring more data than was received (bsc#1282113).\n- CVE-2026-90414: IB/isert: reject PDUs declaring more data than (bsc#1282110).\n- CVE-2026-90415: RDMA/cxgb4: free STAG index when TPT entry write fails (bsc#1282143).\n- CVE-2026-90417: RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() (bsc#1281973).\n- CVE-2026-90426: iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs (bsc#1282013).\n- CVE-2026-90428: iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs (bsc#1282003).\n- CVE-2026-90430: iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized (bsc#1281991).\n- CVE-2026-92495: RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap (bsc#1282072).\n- CVE-2026-92523: RDMA/nldev: validate dynamic counter attribute length (bsc#1282271).\n- CVE-2026-92525: RDMA/rxe: Validate num_sge/cur_sge before indexing wqe-\u003edma.sge[] (bsc#1282270).\n- CVE-2026-93037: RDMA/hfi1: Propagate sdma_txinit_ahg() errors (bsc#1282020).\n- CVE-2026-93107: RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state (bsc#1281399).\n- CVE-2026-93108: RDMA/ipoib: Drain RCU callbacks during module teardown (bsc#1281408).\n- CVE-2026-93109: RDMA/mlx5: Drain RCU callbacks during module teardown (bsc#1281379).\n- CVE-2026-93110: RDMA/core: Wait for RCU callbacks before unloading ib_core (bsc#1281387).\n- CVE-2026-93154: RDMA/irdma: Add refcounting to user ring MRs (bsc#1282104).\n- CVE-2026-93160: crypto: atmel-ecc - reject hardware ECDH without a public key (bsc#1282147).\n- CVE-2026-93207: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (bsc#1282672).\n- CVE-2026-93212: nfsd: guard nfsd_serv deref in nfsd_file_net_dispose (bsc#1282774).\n- CVE-2026-93264: RDMA/efa: Fix PBL chunk length computation (bsc#1282812).\n- CVE-2026-93782: vhost-scsi: flush backend after device ioctls (bsc#1282906).\n- CVE-2026-93794: smb/client: flush dirty data before punching a hole (bsc#1283154).\n- CVE-2026-93800: btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol() (bsc#1282808).\n- CVE-2026-93810: cachefiles: Fix double fput (bsc#1283213).\n- CVE-2026-93814: spi: core: Abort active target transfer on controller suspend.\n- CVE-2026-93825: spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data().\n- CVE-2026-93826: HID: hidpp: fix potential UAF in hidpp_connect_event() (bsc#1282891).\n- CVE-2026-93827: virtio-fs: avoid double-free on failed queue setup (bsc#1282747).\n- CVE-2026-93829: smb: client: fix races in cifsd thread creation (bsc#1282803).\n- CVE-2026-97413: RDMA/rtrs-srv: Fix integer underflow in process_read and process_write (bsc#1282975).\n- CVE-2026-97421: RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() (bsc#1283176).\n- CVE-2026-97477: RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() (bsc#1283230).\n- CVE-2026-97520: gfs2: move quota_init qc iterator increment (bsc#1283479).\n- CVE-2026-97521: gfs2: fix quota init duplicate scan (bsc#1283475).\n- CVE-2026-97543: xfs: destroy seen inode bitmap when we fail to add a dirpath (bsc#1283450).\n- CVE-2026-97544: xfs: don't leak dqacct if rhashtable insertion fails (bsc#1283149).\n- CVE-2026-97545: xfs: don't leak new_bp if xfs_btree_bload_drop_buf fails (bsc#1283205).\n- CVE-2026-97546: xfs: don't spin forever on zero-length dirents when salvaging them (bsc#1283203).\n- CVE-2026-97552: xfs: initialise error in xfs_defer_finish_one() (bsc#1283328).\n- CVE-2026-97557: smb: client: avoid leaking refcount in cifs_queue_oplock_break() (bsc#1283201).\n- CVE-2026-97571: bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc() (bsc#1283517 bsc#1283945).\n- CVE-2026-97572: bnxt_en: Propagate RX ring init failures in bnxt_init_nic() (bsc#1283517 bsc#1283794).\n- CVE-2026-97573: bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset() (bsc#1283517 bsc#1283880).\n- CVE-2026-97574: bnxt_en: Don't free the live ring's TPA state on queue restart failure (bsc#1283517 bsc#1283795).\n- CVE-2026-97605: erofs: preserve LZMA decoders on resize failure (bsc#1283173).\n- CVE-2026-97902: fs: don't return -EINVAL for successful nested thaw (bsc#1283166).\n- CVE-2026-97934: tracing: Fix memory corruption from a \"STACKTRACE\" histogram key (bsc#1282997).\n- CVE-2026-97940: ipv6: fix fib6 walker UAF on seq stop (bsc#1283163).\n- CVE-2026-97947: x86/amd_node: Avoid divide by zero on virtualized systems (bsc#1283130).\n- CVE-2026-97957: net: hinic: fix mailbox segment buffer overflow (bsc#1283119).\n- CVE-2026-98003: iommu/amd: Do not reallocate GA log buffers on resume (bsc#1283312).\n- CVE-2026-98028: eth: nfp: drop the replaced rule from the list when reprogramming fails (bsc#1283739).\n- CVE-2026-98029: eth: nfp: bound the ntuple rule dump by the caller's buffer size (bsc#1283490).\n- CVE-2026-98030: net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size (bsc#1283489).\n- CVE-2026-98091: btrfs: detach failed sprout device from transaction update list (bsc#1283805).\n- CVE-2026-100075: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (bsc#1282881).\n\nThe following non security issues were fixed:\n\n- ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach (stable-fixes).\n- ACPI: scan: Honor _DEP for ACPI0016 PCI/CXL host bridge (stable-fixes).\n- ACPICA: add boundary checks in acpi_ps_get_next_field() (stable-fixes).\n- ACPICA: add boundary checks in two places (stable-fixes).\n- ACPICA: Add package limit checks in parser functions (stable-fixes).\n- ACPICA: Add validation for node in acpi_ns_build_normalized_path() (stable-fixes).\n- ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() (stable-fixes).\n- ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() (stable-fixes).\n- ACPICA: Fix condition check in acpi_ps_parse_loop() (stable-fixes).\n- ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) (stable-fixes).\n- ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() (stable-fixes).\n- ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() (stable-fixes).\n- ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg() (stable-fixes).\n- ACPICA: Prevent adding invalid references (stable-fixes).\n- ACPICA: validate byte_count in acpi_ps_get_next_package_length() (stable-fixes).\n- ACPICA: validate handler object type in two places (stable-fixes).\n- ALSA: 6fire: Clean ups with guard() (stable-fixes).\n- ALSA: 6fire: fix OOB write from device-reported iso length (git-fixes).\n- ALSA: aloop: Check card index validity at probe (stable-fixes).\n- ALSA: bcd2000: Fix race between rawmidi and disconnect (git-fixes).\n- ALSA: caiaq: unregister the input device when probe fails (git-fixes).\n- ALSA: core: Add scoped cleanup helper for card references (stable-fixes).\n- ALSA: core: Define auto-cleanup for snd_card_free() (stable-fixes).\n- ALSA: core: Fix potential UAF after asynchronous card release (stable-fixes).\n- ALSA: es18xx: check control allocation before private data setup (stable-fixes).\n- ALSA: hda/common: Use cleanup macros for PM controls (stable-fixes).\n- ALSA: hda/common: Use guard() for mutex locks (stable-fixes).\n- ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10 (stable-fixes).\n- ALSA: hda/core: Use guard() for mutex locks (stable-fixes).\n- ALSA: hda/realtek - Add quirk for HP Victus 15-fa0xxx (MB 8A50) (stable-fixes).\n- ALSA: hda/realtek: Add HDA_CODEC_QUIRK for Samsung 750XBE/730XBE (stable-fixes).\n- ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx (stable-fixes).\n- ALSA: hda/realtek: Add mute LED quirk for HP Victus 16-e0xxx (MB 88ED) (stable-fixes).\n- ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP EliteBook 830 G8 (8AB8) to enable mute LEDs (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP Pavilion x360 (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP Victus 16-e0xxx (88EE) to enable mute LED (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Xiaoxin 14 GT (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Yoga 7 16IAP7 (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IRH8 (stable-fixes).\n- ALSA: hda/realtek: Add StarFighter HDA SSID (stable-fixes).\n- ALSA: hda/realtek: Fix speakers on MECHREVO WUJIE Series (stable-fixes).\n- ALSA: hda/realtek: Limit Star Labs internal mic boost (stable-fixes).\n- ALSA: hda/tegra: Re-enable SDO workaround for Tegra194 (git-fixes).\n- ALSA: hda: Add Lenovo Legion 7i 16IAX7 17AA3874 quirk (stable-fixes).\n- ALSA: hda: cs35l56: Fail if wmfw file is missing (stable-fixes).\n- ALSA: hda: ext: Clean up links if their initialization fails (stable-fixes).\n- ALSA: hda: Introduce auto cleanup macros for PM (stable-fixes).\n- ALSA: hda: trace PCM open only after assigning a stream (git-fixes).\n- ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup (git-fixes).\n- ALSA: ice1712: Fix the error handling via auto-cleanup at probe (git-fixes).\n- ALSA: line6: reject oversized playback packets (git-fixes).\n- ALSA: mpu401: Check card index validity at probe (stable-fixes).\n- ALSA: mts64: Check card index validity at probe (stable-fixes).\n- ALSA: pcm: Fix race between non-atomic ops and trigger-start (stable-fixes).\n- ALSA: pcm: set timer-\u003eprivate_data before registering the PCM timer (git-fixes).\n- ALSA: portman2x4: Check card index validity at probe (stable-fixes).\n- ALSA: seq: oss: Reject reads that cannot fit the next event (stable-fixes).\n- ALSA: seq: Remove arbitrary prioq insertion limit (stable-fixes).\n- ALSA: seq: Serialize compat port-info ioctls (git-fixes).\n- ALSA: serial-u16550: Check card index validity at probe (stable-fixes).\n- ALSA: ua101: reject mismatched capture/playback packet sizes (git-fixes).\n- ALSA: ump: Copy FB name string more safely (stable-fixes).\n- ALSA: ump: Copy safe string name to rawmidi (stable-fixes).\n- ALSA: ump: Update rawmidi name per EP name update (stable-fixes).\n- ALSA: usb-audio: Add dB map quirk for Razer Barracuda X 2.4 (stable-fixes).\n- ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless (stable-fixes).\n- ALSA: usb-audio: Add quirk flags for SC13A (stable-fixes).\n- ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision) (stable-fixes).\n- ALSA: usb-audio: Add quirk for Novation Mininova (stable-fixes).\n- ALSA: usb-audio: Add quirk for YAMAHA CDS3000 (stable-fixes).\n- ALSA: usb-audio: caiaq: validate EP1 reply lengths (stable-fixes).\n- ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity (git-fixes).\n- ALSA: usb-audio: Optimize the copy of packet sizes for implicit fb handling (stable-fixes).\n- ALSA: usb: 6fire: Avoid embedded URBs (stable-fixes).\n- ALSA: usx2y: Drain pending US-428 pipe-4 output commands (stable-fixes).\n- ALSA: virmidi: Check card index validity at probe (stable-fixes).\n- ALSA: virtio: reset device before deleting virtqueues (git-fixes).\n- arm64: fixmap: Allow 256K early_ioremap() at any offset (git-fixes).\n- arm64: hibernate: clone only the linear map that exists at runtime (git-fixes).\n- arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc (git-fixes).\n- arm64: kprobes: Allow reentering kprobes while single-stepping (git-fixes).\n- arm64: mte: Fix PTRACE_{PEEK,POKE}MTETAGS error documentation (git-fixes).\n- arm64: percpu: Fix LSE operations on {8,16}-bit types (git-fixes).\n- arm64: percpu: Fix this_cpu_and() mask generation (git-fixes).\n- arm64: percpu: Fix this_cpu_write() casting (git-fixes).\n- arm64: Use load LSE atomics for the non-return per-CPU atomic operations (git-fixes).\n- ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for HyperX OMEN Gaming Laptop 16-ap1xxx (stable-fixes).\n- ASoC: codecs: aw88261: only check PLL and clock state at power-up (git-fixes).\n- ASoC: codecs: aw88261: reduce log spam (stable-fixes).\n- ASoC: codecs: max98363: fix uninitialized stream_config-\u003etype (git-fixes).\n- ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive (stable-fixes).\n- ASoC: codecs: rk3328: Use managed GPIO and clock helpers (stable-fixes).\n- ASoC: codecs: rt274: Fix format setting for 44100 rate (git-fixes).\n- ASoC: codecs: rt286: Revert delay value for jack setup (git-fixes).\n- ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config-\u003etype (git-fixes).\n- ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config-\u003etype (git-fixes).\n- ASoC: fsl-asoc-card: reduce WM8904 PLL ratio to meet frequency limit (stable-fixes).\n- ASoC: hdmi-codec: Report a change when the channel status moves (git-fixes).\n- ASoC: Intel: catpt: Complete coredump handling (stable-fixes).\n- ASoC: Intel: sof_sdw: Add quirks for new Dell laptops (stable-fixes).\n- ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (stable-fixes).\n- ASoC: mediatek: mt8365-afe-pcm: fix possible NULL-pointer dereferences in mt8365_afe_suspend() (stable-fixes).\n- ASoC: qcom: lpass-cpu: use DAI table index for playback constraints (git-fixes).\n- ASoC: qcom: q6apm: return error code to consumers on failures (stable-fixes).\n- ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt (stable-fixes).\n- ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence (stable-fixes).\n- ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure (stable-fixes).\n- ASoC: rt712-sdca: reset codec at io_init to fix silent headphone (stable-fixes).\n- ASoC: rt5645: Perform the initial jack detect at probe (stable-fixes).\n- ASoC: tas2781: Update default register address to TAS2563 (stable-fixes).\n- ASoC: tegra: Fix ASRC Stream6 input threshold control (git-fixes).\n- ASoC: ti: omap3pandora: update board check to use DT compatible (stable-fixes).\n- ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments (git-fixes).\n- ASoC: wm8903: Move the DRC QR threshold to the register that holds it (git-fixes).\n- Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough (git-fixes).\n- Bluetooth: btintel_pcie: Add 50 ms delay before MAC init on BlazarIW (stable-fixes).\n- Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit (git-fixes).\n- Bluetooth: btintel_pcie: validate device-supplied DMA indices (git-fixes).\n- Bluetooth: btmtk: add MT7902 MCU support (stable-fixes).\n- Bluetooth: btmtk: Disable remote wakeup for MT7922/MT7925 (stable-fixes).\n- Bluetooth: btmtk: fix wrong status for short WMT FUNC_CTRL events (git-fixes).\n- Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access (git-fixes).\n- Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown (git-fixes).\n- Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU (stable-fixes).\n- Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU (stable-fixes).\n- Bluetooth: btusb: Add Mercusys MA530 for Realtek RTL8761BUV (stable-fixes).\n- Bluetooth: btusb: Add Realtek RTL8922AE VID/PID 0bda/d922 (stable-fixes).\n- Bluetooth: btusb: Add Realtek RTL8922AE VID/PID 0bda/d923 (stable-fixes).\n- Bluetooth: btusb: Add support for Intel Lizard Peak 2 (0x8087:0x0040) (stable-fixes).\n- Bluetooth: btusb: Add support for TP-Link TL-UB250 (stable-fixes).\n- Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV (stable-fixes).\n- Bluetooth: btusb: fix NXP IW610 composite device handling (stable-fixes).\n- Bluetooth: btusb: MT7922: Add VID/PID 0e8d/223c (stable-fixes).\n- Bluetooth: btusb: MT7925: Add VID/PID 0e8d/8c38 (stable-fixes).\n- Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices (git-fixes).\n- Bluetooth: btusb: Record matched usb_device_id into btusb_data (stable-fixes).\n- Bluetooth: btusb: refactor endpoint lookup (stable-fixes).\n- Bluetooth: coredump: Quiesce dump work on unregister (git-fixes).\n- Bluetooth: eir: validate service data length before reading UUID (git-fixes).\n- Bluetooth: hci_codec: validate vendor codec count length (git-fixes).\n- Bluetooth: hci_conn: fix CIS hold ownership on reuse (git-fixes).\n- Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (git-fixes).\n- Bluetooth: hci_core: Print number of packets in conn-\u003edata_q (stable-fixes).\n- Bluetooth: hci_sock: reject out-of-range OCF values (git-fixes).\n- Bluetooth: hci_sock: validate event length before filtering (git-fixes).\n- Bluetooth: hci_sync: Serialize local codec list cleanup (git-fixes).\n- Bluetooth: ISO: balance the parent hold in hci_bind_bis() (git-fixes).\n- Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() (git-fixes).\n- Bluetooth: ISO: release unused CIS holds after channel attach (git-fixes).\n- Bluetooth: ISO: set BT_LISTEN before requesting a BIG sync (git-fixes).\n- Bluetooth: L2CAP: validate connectionless PSM length (stable-fixes).\n- Bluetooth: L2CAP: validate frame length before control and FCS access (git-fixes).\n- Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel (git-fixes).\n- Bluetooth: mgmt: fix race in read_unconf_index_list() (git-fixes).\n- Bluetooth: Properly disable remote wakeup for MT7922/MT7925 on Ryzen platform (git-fixes).\n- Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup (git-fixes).\n- Bluetooth: RFCOMM: fix NULL dereference of dlc-\u003esession in RFCOMM_CONNINFO (git-fixes).\n- Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() (git-fixes).\n- Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (stable-fixes).\n- Bluetooth: SMP: reject Security Request over BR/EDR (git-fixes).\n- bnxt_en: Bound SW TPA IDs to prevent crashes (git-fixes).\n- bnxt_en: Fix potential data corruption with HW GRO/LRO (git-fixes).\n- bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (bsc#1283517).\n- bnxt_en: Only restore LRO if the device supports TPA (bsc#1283517).\n- bnxt_en: Write doorbell when linearizing skb fails (bsc#1283517).\n- bonding: crypto offload enabled, non-offload slave failover, rekey failed (bsc#1282823).\n- btrfs: do not force reloc root creation during qgroup_account_snapshot() (bsc#1275740).\n- btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag (bsc#1279116).\n- btrfs: tree-checker: validate INODE_REF's namelen (git-fixes).\n- config: cleanup azure and kvmsmall Cleanup azure and kvmsmall configs after following comments updated default\n  configs: 4229ca50b2b3 Disable CONFIG_BATMAN_ADV (jsc#PED-16892).\n- dmaengine: Add devm_dma_request_chan() (stable-fixes).\n- dmaengine: altera-msgdma: Use memcpy_toio for descriptor FIFO writes (stable-fixes).\n- dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc (stable-fixes).\n- dmaengine: Fix device kref underflow in dma_chan_put() (git-fixes).\n- dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() (git-fixes).\n- dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() (git-fixes).\n- dmaengine: sprd: Fix runtime PM reference leak in probe (git-fixes).\n- dmaengine: sun6i: fix non-atomic read of DMA position registers (git-fixes).\n- dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status (git-fixes).\n- dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() (git-fixes).\n- dmaengine: wait for RCU readers before releasing dma_device (git-fixes).\n- dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA (git-fixes).\n- dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order (git-fixes).\n- driver core: Export get_dev_from_fwnode() (stable-fixes).\n- drm/amd/display: Bump frame warning limit for clang builds of dml (stable-fixes).\n- drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend (git-fixes).\n- drm/amd/display: Check for sharpening case when calculating max vtaps for scaler (stable-fixes).\n- drm/amd/display: clean-up dead code in dml2_mall_phantom (stable-fixes).\n- drm/amd/display: Find link encoder for flexible DIG mapping cases (stable-fixes).\n- drm/amd/display: Fix CRC open failure during active rendering (stable-fixes).\n- drm/amd/display: Fix dc stream excess put in dm_update_crtc_state() (git-fixes).\n- drm/amd/display: Fix DPMS using partially updated pipe context (stable-fixes).\n- drm/amd/display: Initialize dsc_caps to 0 (stable-fixes).\n- drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC (git-fixes).\n- drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized (stable-fixes).\n- drm/amd/pm/si: Fix updating clock limits from power states (stable-fixes).\n- drm/amd/pm/si: Fix updating clock limits on AC/DC (git-fixes).\n- drm/amd/pm: bound pp_dpm_set_pp_table() memcpy (stable-fixes).\n- drm/amd/pm: Check SMUv13.0.6/12 metrics integrity (stable-fixes).\n- drm/amd/pm: hide pp_table sysfs on APUs (git-fixes).\n- drm/amdgpu: add a helper to calculate ring distance (stable-fixes).\n- drm/amdgpu: check ras and obj before dereference (git-fixes).\n- drm/amdgpu: check thunderbolt before switcheroo registration (stable-fixes).\n- drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages (bsc#1284146).\n- drm/amdgpu: Failed to check various return code (stable-fixes).\n- drm/amdgpu: fix ACP MFD device leak on init failure (git-fixes).\n- drm/amdgpu: fix buffer overflow during vBIOS update (stable-fixes).\n- drm/amdgpu: fix IP instance memory leak on kobject add failure (git-fixes).\n- drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init() (git-fixes).\n- drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show() (git-fixes).\n- drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init() (git-fixes).\n- drm/amdgpu: flush pending RCU callbacks on module unload (stable-fixes).\n- drm/amdgpu: harden FRU PIA parsing with bounded helpers (stable-fixes).\n- drm/amdgpu: Prefer ROM BAR for default VGA device (stable-fixes).\n- drm/amdgpu: Skip accessing psp rum time db for APUs (stable-fixes).\n- drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT (stable-fixes).\n- drm/amdgpu: Use system unbound workqueue for soft IH ring (stable-fixes).\n- drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw (stable-fixes).\n- drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id (stable-fixes).\n- drm/amdkfd: Check bounds on allocate_doorbell (stable-fixes).\n- drm/amdkfd: check find_first_zero_bit before __set_bit on kfd-\u003edoorbell_bitmap (stable-fixes).\n- drm/amdkfd: fix UAF race in destroy_queue_cpsch (stable-fixes).\n- drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl (stable-fixes).\n- drm/amdkfd: Reject zero-sized AQL queue allocations after size halving (stable-fixes).\n- drm/amdkfd: Unwind debug trap enable on copy_to_user failure (stable-fixes).\n- drm/arm/komeda: fix error handling for clk_prepare_enable() and callers (stable-fixes).\n- drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend (stable-fixes).\n- drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach (git-fixes).\n- drm/bridge: tc358768: Set pre_enable_prev_first for reverse order (stable-fixes).\n- drm/cirrus: Use video aperture helpers (stable-fixes).\n- drm/dp: Add DSC virtual DPCD quirk for Realtek MST branch device (stable-fixes).\n- drm/gem: Consider GEM object reclaimable if shrinking fails (stable-fixes).\n- drm/gma500: return errors from Oaktrail HDMI I2C reads (stable-fixes).\n- drm/gud: Add RCade Display Adapter VID/PID pair (stable-fixes).\n- drm/gud: fix out-of-bounds write in gud_plane_atomic_check() (git-fixes).\n- drm/i915/psr: Add new SU area calculation helper to apply workarounds (stable-fixes).\n- drm/i915/psr: Clear stale sel fetch enable bits on sel fetch disable (git-fixes).\n- drm/i915: fix incorrect RCU teardown order (git-fixes).\n- drm/i915: Guard against NULL driver_data in i915_pci_probe() (stable-fixes).\n- drm/imagination: clamp freelist reconstruction requests (git-fixes).\n- drm/imagination: Fix page count for page table for map() interface (git-fixes).\n- drm/imagination: Populate FW common context ID before passing to the FW (stable-fixes).\n- drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl() (git-fixes).\n- drm/logicvc: Drop the select of the nonexistent CONFIG_DRM_KMS_DMA_HELPER (git-fixes).\n- drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device (git-fixes).\n- drm/mediatek: dsi: Add compatible for mt8167-dsi (stable-fixes).\n- drm/mediatek: Fix ovl adaptor platform device leak (git-fixes).\n- drm/mediatek: Fix pdev reference leak in mtk_drm_bind() (git-fixes).\n- drm/msm/adreno: fix autosuspend cleanup during teardown (git-fixes).\n- drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL (git-fixes).\n- drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure (git-fixes).\n- drm/msm: Recover HW before retire hung submit (git-fixes).\n- drm/nouveau/bios: skip the IFR header if present (stable-fixes).\n- drm/nouveau/clk: don't clobber reclock status when restoring volt/fan (git-fixes).\n- drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update (git-fixes).\n- drm/nouveau/disp: don't reject HDMI config on cards without SCDC (git-fixes).\n- drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM (git-fixes).\n- drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() (git-fixes).\n- drm/nouveau: fix autosuspend cleanup during teardown (git-fixes).\n- drm/nouveau: Fix bridge reference leak in nv1a_ram_new() (git-fixes).\n- drm/nouveau: fix double-free in nvif_vmm_dtor (git-fixes).\n- drm/nouveau: Fix gem reference leak in validate_init() (git-fixes).\n- drm/nouveau: Fix runtime PM leak in nouveau_connector_detect() (git-fixes).\n- drm/nouveau: RCU-free the scheduler-containing nouveau_sched (git-fixes).\n- drm/omap: dsi: Do not copy isr table (git-fixes).\n- drm/panel: Enable GPIOLIB for panels which uses functions from it (stable-fixes).\n- drm/panel: jadard-jd9365da-h3: set prepare_prev_first (stable-fixes).\n- drm/panel: simple: Add AM-1280800W8TZQW-T00H (stable-fixes).\n- drm/radeon: Read the VRAM VBIOS signature with readb() (git-fixes).\n- drm/vc4: Use managed KMS polling to fix UAF on unbind (git-fixes).\n- drm/virtio: fix memory leak of fence event on execbuffer failure (git-fixes).\n- drm/virtio: fix NULL pointer dereference on fence allocation failure (git-fixes).\n- drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() (git-fixes).\n- drm/virtio: fix object leak when drm_gem_handle_create() fails (git-fixes).\n- drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() (git-fixes).\n- drm/virtio: release the GEM object on virtio_gpu_vram_create() errors (git-fixes).\n- drm/xe: Limit sg segment size to PAGE_SIZE on Xen PV (git-fixes).\n- drm/xe: Wait on external BO kernel fences in exec IOCTL (CVE-2026-74440 bsc#1261564).\n- drm: add drm_memory_stats_is_zero (stable-fixes).\n- drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr (git-fixes).\n- fbcon: don't suspend/resume when vc is graphics mode (stable-fixes).\n- fbdev: pm2fb: unwind WC setup on probe failure (stable-fixes).\n- fbdev: pvr2fb: correct user pointer annotation and sentinel initializer (stable-fixes).\n- firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size (stable-fixes).\n- firmware: arm_scmi: Validate SENSOR_UPDATE payload size (stable-fixes).\n- firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS (git-fixes).\n- firmware: qcom_scm: Rename peripheral as pas_id (stable-fixes).\n- firmware: stratix10-svc: change get provision data to async SMC call (stable-fixes).\n- firmware: stratix10-svc: fix FCS SMC call kernel-doc (git-fixes).\n- firmware: sysfb: Move bpp-depth calculation into screen_info helper (stable-fixes).\n- gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() (git-fixes).\n- gpio: dwapb: Mask interrupts at hardware initialization (stable-fixes).\n- gpio: pisosr: Read \"ngpios\" as u32 (stable-fixes).\n- gpio: tps65219: Fix GPIO input value reads (git-fixes).\n- gpio: virtuser: skip free_irq when no IRQ is installed (git-fixes).\n- gpio: zynq: fix runtime PM leak on request error path (git-fixes).\n- HID: alps: fix use-after-free on input2 registration failure (git-fixes).\n- HID: alps: unregister DualPoint Stick input device on remove (git-fixes).\n- HID: amd_sfh: Validate PCI BAR size before mapping (git-fixes).\n- HID: asus: fortify keyboard handshake (stable-fixes).\n- HID: bpf: Add Huion Inspiroy Frego M button quirk (stable-fixes).\n- HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request (git-fixes).\n- HID: bpf: fix __hid_bpf_hw_check_params report length (git-fixes).\n- HID: core: quiesce input in hid_hw_stop() to prevent use-after-free (stable-fixes).\n- HID: elecom: fix bus type for M-XGL20DLBK (git-fixes).\n- HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM (stable-fixes).\n- HID: hidpp: fix potential UAF in hidpp_connect_event() (stable-fixes).\n- HID: logitech-hidpp: fix race condition when accessing stale stack pointer (stable-fixes).\n- HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes (git-fixes).\n- HID: mcp2221: fix OOB write in mcp2221_raw_event() (stable-fixes).\n- HID: mcp2221: stop device IO before hid_hw_stop (git-fixes).\n- HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard (stable-fixes).\n- HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() (git-fixes).\n- host1x: bus: Fix missing ops null check in error teardown (stable-fixes).\n- hwmon: (adt7462) Add of_match_table to support devicetree (stable-fixes).\n- hwmon: (corsair-psu) Fix linear11 calculation (stable-fixes).\n- hwmon: (dell-smm) Add Dell Latitude 7530 to fan control whitelist (stable-fixes).\n- hwmon: (emc1403) Drop hysteresis for low limit temperature (git-fixes).\n- hwmon: (emc1403) Rely on subsystem locking (stable-fixes).\n- hwmon: (gpio-fan) return IRQ_HANDLED from the shared alarm IRQ handler (git-fixes).\n- hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show() (git-fixes).\n- hwmon: (hp-wmi-sensors) Improve raw WMI string handling (git-fixes).\n- hwmon: (ina2xx) Parameterize ina2xx_data in ina226_alert_read() (stable-fixes).\n- hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i (stable-fixes).\n- hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding (git-fixes).\n- hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676 (git-fixes).\n- hwmon: (raspberrypi) Fix delayed-work teardown race (stable-fixes).\n- hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove (git-fixes).\n- hwmon: (w83793) release probe data through kref (git-fixes).\n- i2c: at91: release DMA channels on remove and probe error (git-fixes).\n- i2c: atr: fix dangling adapter pointer on add failure (git-fixes).\n- i2c: imx: disable autosuspend on remove (git-fixes).\n- i2c: imx: release DMA channels on probe error (git-fixes).\n- i2c: mxs: fix DMA channel leak on probe error (git-fixes).\n- i2c: qcom-cci: fix device_node refcount leak in cci_probe()/cci_remove() (git-fixes).\n- i2c: qcom-cci: Remove the unused variable cci_clk_rate (git-fixes).\n- i2c: qcom-cci: Stop complaining about DT set clock rate (stable-fixes).\n- i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode (git-fixes).\n- i3c: mipi-i3c-hci: Quieten initialization messages (stable-fixes).\n- i3c: mipi-i3c-hci: Refactor PIO register initialization (stable-fixes).\n- i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc() (stable-fixes).\n- ibmveth: Add multi buffers rx replenishment hcall support (jsc#PED-16852).\n- ibmvnic: Increase max subcrq indirect entries with fallback (jsc#PED-16854).\n- ibmvnic: Use ndo_get_stats64 to fix inaccurate SAR reporting (jsc#PED-16854).\n- iio: accel: kionix-kx022a: Fix array boundary check (git-fixes).\n- iio: accel: kxcjk-1013: reject duplicate event disable (git-fixes).\n- iio: accel: mma8452: switch to non-devm request_threaded_irq() (stable-fixes).\n- iio: accel: sca3000: fix frequency divider condition check (git-fixes).\n- iio: adc: pac1934: check ACPI label duplication (git-fixes).\n- iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind (stable-fixes).\n- iio: adc: rtq6056: add i2c_device_id support (stable-fixes).\n- iio: adc: stm32-adc: fix check on internal channel availability (git-fixes).\n- iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure (git-fixes).\n- iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls (git-fixes).\n- iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind (git-fixes).\n- iio: admv1013: initialize callback mutex before registering notifier (git-fixes).\n- iio: buffer: Ensure bounce buffer used for unaligned case is zeroed (git-fixes).\n- iio: buffer: serialize buffer teardown with mode claims (git-fixes).\n- iio: frequency: admv1013: fix wrong channel field used in admv1013_read_raw() (git-fixes).\n- iio: gyro: adis16136: fix unprotected debugfs reads (git-fixes).\n- iio: health: max30102: fix NULL dereference in interrupt handler (git-fixes).\n- iio: imu: adis16400: fix unprotected debugfs reads (git-fixes).\n- iio: light: gp2ap020a00f: drain irq_work after free_irq (git-fixes).\n- iio: light: stk3310: Deal with the ps interrupt issue in PM (stable-fixes).\n- iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup (git-fixes).\n- iio: proximity: aw96103: validate firmware data length (git-fixes).\n- iio: proximity: isl29501: Fix return type of isl29501_register_write (git-fixes).\n- iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure (git-fixes).\n- iio: proximity: sx9324: Correct proximity channel resolution (git-fixes).\n- iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler (git-fixes).\n- iio: trigger: cancel reenable_work before freeing trigger (git-fixes).\n- Input: adp5588-keys - cache GPIO state before registering the gpiochip (git-fixes).\n- Input: aiptek - validate raw macro indices before updating state (stable-fixes).\n- Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 (git-fixes).\n- Input: cyttsp5 - clamp the HID report size before memcpy (git-fixes).\n- Input: eeti_ts - publish the OF module alias (git-fixes).\n- Input: evdev - zero absinfo before partial copy in EVIOCSABS (git-fixes).\n- Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P (stable-fixes).\n- Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() (git-fixes).\n- Input: s6sy761 - fix resume ordering and restore sensing (git-fixes).\n- Input: soc_button_array - check btns_desc-\u003epackage.count (git-fixes).\n- Input: soc_button_array - fix MS Surface Pro 11 probe failure (git-fixes).\n- Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) (stable-fixes).\n- Input: synaptics - limit T440p InterTouch quirk to LEN0036 (git-fixes).\n- Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound (git-fixes).\n- Input: trackpoint - fix the inertia attribute name in the ABI document (git-fixes).\n- Input: xpad - add support for Azeron devices (stable-fixes).\n- Input: xpad - add support for Victrix Pro BFG Controller (stable-fixes).\n- Input: xpad - fix PDP Marvel Xbox 360 controller (git-fixes).\n- Input: zero ff_effect before compat copy in input_ff_effect_from_user (git-fixes).\n- kernel-binary.spec.in: Emulate kabi.pl error when suse-kabi-tools is used.\n- kernel-binary.spec.in: Fix syntax error.\n- KEYS: encrypted: fix integer overflow of datablob_len (git-fixes).\n- keys: fix lost wakeup when reaping a dead key type (git-fixes).\n- keys: translate request_key_auth pid for the reading procfs instance (git-fixes).\n- KEYS: trusted: Fix tpm2_load_cmd() boundary check (git-fixes).\n- KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure (git-fixes).\n- KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve() (git-fixes).\n- KVM: arm64: vgic: Don't leak the SPI array when init is retried (git-fixes).\n- KVM: arm64: vgic: Prevent speculative SPI array underflow (git-fixes).\n- KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU (git-fixes).\n- KVM: nVMX: Always flush vpid02 on first use (git-fixes).\n- KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02 (git-fixes).\n- KVM: nVMX: Synthesize SHUTDOWN on RSM if L2 requires emulation (git-fixes).\n- KVM: VMX: Handle bad values on proxied writes to LBR MSRs (git-fixes).\n- KVM: VMX: Reject KVM_RUN if userspace forces emulation during nested VM-Enter (git-fixes).\n- KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy (git-fixes).\n- KVM: x86/pmu: Move Intel PMU global MSRs to intel_is_valid_msr() (git-fixes).\n- KVM: x86: Extract VMX's unhandleable emulation check to common x86 (git-fixes).\n- KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails (git-fixes).\n- leds: pca9532: Don't stop blinking for non-zero brightness (stable-fixes).\n- leds: trigger: gpio: Use GPIOD_FLAGS_BIT_NONEXCLUSIVE (stable-fixes).\n- leds: uleds: Return -EFAULT on copy_to_user() failure (stable-fixes).\n- media: chips-media: wave5: Add range checks for dec_output_info (stable-fixes).\n- media: chips-media: wave5: Fix Reports from Kernel Lock Validator (stable-fixes).\n- media: dm1105: fix missing error check for dma_alloc_coherent (stable-fixes).\n- media: em28xx-video: fix missing res_free() on init_usb_xfer failure (stable-fixes).\n- media: i2c: imx355: Replace client-\u003edev usage (stable-fixes).\n- media: imon: Add iMON VFD HID OEM v1.2 key mappings (stable-fixes).\n- media: imx355: Avoid calling imx355_power_off twice in error path (git-fixes).\n- media: qcom: camss: avoid format string warning (stable-fixes).\n- media: rc: mceusb: Add support for 04eb:e033 (stable-fixes).\n- media: video-i2c: fix buffer queue ordering (stable-fixes).\n- media: video-i2c: use vb2_video_unregister_device on driver removal (stable-fixes).\n- memstick: ms_block: destroy io_queue workqueue on removal (git-fixes).\n- mfd: db8500-prcmu: Fold dbx500 header into db8500 (git-fixes).\n- mfd: rsmu: Add 8a34002 support (stable-fixes).\n- mfd: tps65219: Make poweroff handler conditional on system-power-controller (stable-fixes).\n- mmc: core: Add validation for host-provided max_segs (stable-fixes).\n- mmc: core: Cancel SDIO IRQ work before freeing host (git-fixes).\n- mmc: core: Fix OF node reference leak on card add failure (git-fixes).\n- mmc: davinci: avoid NULL deref of host-\u003edata in IRQ handler (stable-fixes).\n- mmc: davinci: fix mmc_add_host order in probe (stable-fixes).\n- mmc: hsq: Fix use-after-free in retry work (git-fixes).\n- mmc: mmci: Fix use-after-free in busy-timeout work (git-fixes).\n- mmc: mxcmmc: cancel data work and watchdog on remove (git-fixes).\n- mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC (stable-fixes).\n- mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC (stable-fixes).\n- mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260 (stable-fixes).\n- mmc: sdhci-of-aspeed: Remove children before releasing SDC resources (git-fixes).\n- mmc: sdhci_am654: Clear ITAPDLY on tuning failure (git-fixes).\n- mmc: sdhci_am654: Fallback to DT-provided itap delay on DDR50 tuning failure (git-fixes).\n- mmc: sdhci_am654: Move tuning_loop to local variable (git-fixes).\n- mmc: sdhci_am654: Reset command and data lines on failed tuning (git-fixes).\n- mmc: sdio_uart: fix xmit_fifo leak when the port table is full (git-fixes).\n- mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt (git-fixes).\n- mmc: spi: reset bytes_xfered before retrying CRC failures (git-fixes).\n- mtd: block2mtd: Fix divide error when erase_size is zero (git-fixes).\n- mtd: core: avoid double-free of OTP NVMEM device (git-fixes).\n- mtd: core: call _get_device() with the master MTD (git-fixes).\n- mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ (git-fixes).\n- mtd: rawnand: pl353: Add message about ECC mode (stable-fixes).\n- mtd: rawnand: pl353: Fix debug prints (git-fixes).\n- mtd: rawnand: pl353: Make sure we use the monolithic helpers for raw accesses (git-fixes).\n- mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB (git-fixes).\n- mtd: spinand: fix zero oobavail when no ECC engine is used (git-fixes).\n- net/ibmveth: fix comment typos in ibmveth.c (jsc#PED-16852).\n- net: mana: Clear RDMA teardown and suspend state in mana_rdma_probe() (git-fixes).\n- net: mana: Reserve extra CQ slot for the fence completion CQE (git-fixes).\n- net: mana: restore the XDP program pointer when pre-allocation fails (git-fixes).\n- net: page_pool: Remove zone/policy GFP flags when allocating XArray entries (git-fixes).\n- net: usb: catc: bound the RX packet length in catc_rx_done() (git-fixes).\n- net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist (stable-fixes).\n- net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs() (git-fixes).\n- net: usb: pegasus: don't rely on id table pointer arithmetic (stable-fixes).\n- net: usb: qmi_wwan: add MeiG SRM813Q (stable-fixes).\n- net: usb: sr9700: include receive overhead in the length check (git-fixes).\n- net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value (git-fixes).\n- net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain (git-fixes).\n- net: wwan: t7xx: Add delay between MD and SAP suspend (stable-fixes).\n- net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() (git-fixes).\n- nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() (git-fixes).\n- nfc: llcp: fix -ENOMEM on connect with zero-length service name (git-fixes).\n- nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() (git-fixes).\n- nfc: llcp: Fix race condition in accept_queue lifecycle (git-fixes).\n- nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure (git-fixes).\n- nfc: llcp: fix slab-out-of-bounds reads when logging service names (git-fixes).\n- nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() (git-fixes).\n- nfc: nfcmrvl: validate helper command length before pull (git-fixes).\n- nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() (git-fixes).\n- nfc: port100: reject frames whose declared length exceeds the received data (git-fixes).\n- nfc: st21nfca: validate ISO15693 inventory length (git-fixes).\n- nfc: st21nfca: validate received frame size (git-fixes).\n- nfc: virtual_ncidev: Add missing ioctl compat handler (git-fixes).\n- PCI/MSI: Enable memory decoding before restoring MSI-X messages (git-fixes).\n- PCI/proc: Fix race between pci_proc_init() and pci_bus_add_device() (stable-fixes).\n- PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store() (stable-fixes).\n- PCI: Accept AtomicOps already enabled by the hypervisor (git-fixes).\n- PCI: altera: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: Avoid FLR for MediaTek MT7925 WiFi (stable-fixes).\n- PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems (stable-fixes).\n- PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk (git-fixes).\n- PCI: iproc: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: mediatek: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: of_property: Omit bus properties without a subordinate bus (git-fixes).\n- PCI: plda: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: rockchip: Protect root bus removal with rescan lock (stable-fixes).\n- PCI: Stop setting cached power state to 'unknown' on unbind (stable-fixes).\n- PCI: switchtec: Add Gen6 Device IDs (stable-fixes).\n- PCI: Wait for device readiness after D3hot -\u003e D0uninitialized transition (stable-fixes).\n- PCI: xgene: Drop unnecessary OF node reference (git-fixes).\n- PCI: xgene: Drop XGENE_PCIE_IP_VER_UNKN (stable-fixes).\n- phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow (git-fixes).\n- phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting (git-fixes).\n- pinctrl: meson: Fix typo in s4 group name (git-fixes).\n- pinctrl: single: free the IRQ on domain creation failure (git-fixes).\n- pinctrl: sunxi: keep a shadow copy of the data register output latches (git-fixes).\n- platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table (stable-fixes).\n- platform/x86: hp-bioscfg: bound ordered-list parsing by the package count (stable-fixes).\n- platform/x86: hp-bioscfg: pass validated element count to package parsers (stable-fixes).\n- platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table (stable-fixes).\n- platform/x86: ISST: Check for admin capability for write commands (stable-fixes).\n- platform/x86: ISST: Validate max level for set feature (git-fixes).\n- platform/x86: msi-ec: Add support for MSI Pulse GL66 12th Gen (stable-fixes).\n- platform/x86: sel3350-platform: Retain LED state on load and unload (stable-fixes).\n- platform/x86: think-lmi: improve check if BIOS account security enabled (stable-fixes).\n- power: sequencing: don't call .post_enable() if pwrseq_unit_enable() failed (git-fixes).\n- power: sequencing: fix NULL-pointer dereference in pwrseq_device_register() (git-fixes).\n- power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new() (git-fixes).\n- power: supply: ab8500_fg: fix use-after-free on remove (git-fixes).\n- power: supply: ab8500_fg: Remove redundant dev_err()/dev_err_probe() (stable-fixes).\n- powerpc/crash: stop watchdogs before booting kdump kernel (bsc#1277705 ltc#220979).\n- powerpc/perf: Add power12 Base Performance Monitoring support (jsc#PED-16906).\n- powerpc/pseries: Handle and log pseries-wdt registration failures (bsc#1277705 ltc#220979).\n- powerpc/pseries: Limit PVR list to 16 entries for CAS negotiation (jsc#PED-16906).\n- powerpc/pseries: Move H_WATCHDOG definitions to a common header (bsc#1277705 ltc#220979).\n- powerpc: Add Power12 architected mode (jsc#PED-16906).\n- powerpc: Add Power12 raw mode (jsc#PED-16906).\n- procfs: fix possible double mmput() in do_procmap_query() (git-fixes).\n- RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations (git-fixes).\n- RDMA/core: Fix potential use after free in counter_release() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_dealloc_pd_user() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_destroy_cq_user() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_destroy_srq_user() (git-fixes).\n- RDMA/core: Fix potential use after free in ib_free_cq() (git-fixes).\n- RDMA/core: Fix use after free in ib_query_qp() (git-fixes).\n- RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup (git-fixes).\n- RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables (git-fixes).\n- RDMA/hfi1: Align probe error unwinding with device removal (git-fixes).\n- RDMA/hfi1: Allocate device data after PCI initialization (git-fixes).\n- RDMA/hfi1: Create workqueues before device initialization (git-fixes).\n- RDMA/hfi1: Defer device creation until probe succeeds (git-fixes).\n- RDMA/hfi1: Drop device data from hfi1_validate_rcvhdrcnt() (git-fixes).\n- RDMA/hfi1: Free RX data on late probe failure (git-fixes).\n- RDMA/hfi1: Initialize debugfs after probe completes (git-fixes).\n- RDMA/hfi1: Pass PCI device to hfi1_pcie_init() (git-fixes).\n- RDMA/hfi1: Preserve unit 0 on (git-fixes).\n- RDMA/hfi1: Remove redundant NULL checks in create_workqueues() (git-fixes).\n- RDMA/hfi1: Remove redundant PCI device ID validation (git-fixes).\n- RDMA/hfi1: Stop flushing the global IB workqueue (git-fixes).\n- RDMA/irdma: Add a refcount to track user ring MR associations (git-fixes).\n- RDMA/irdma: Add irdma_cq fields to track pbl allocations (git-fixes).\n- RDMA/irdma: Deduplicate the irdma_del_memlist logic (git-fixes).\n- RDMA/rvt: Return NULL after port allocation failure (git-fixes).\n- regulator: core: clamp voltage constraints before applying apply_uV (stable-fixes).\n- regulator: da9121: Use subvariant ids in the I2C table (stable-fixes).\n- ring-buffer: Add helper functions for allocations (bsc#1277895 bsc#1280334).\n- ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() (bsc#1277896).\n- ring-buffer: Simplify functions with __free(kfree) to free allocations (bsc#1277895 bsc#1280334).\n- rtc: ac100: Assign .num before accessing .hws (git-fixes).\n- rtc: aspeed: add AST2700 compatible (stable-fixes).\n- rtc: bq32000: add delay between RTC reads (stable-fixes).\n- rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak (git-fixes).\n- rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe() (git-fixes).\n- rtc: mv: add suspend/resume support for wakeup (stable-fixes).\n- rtc: spear: initialize IRQ state before requesting alarm IRQ (git-fixes).\n- selftests: fib_nexthops: do not mark skipped tests as failed (bsc#1283296).\n- serial: 8250: fix possible ISR soft lockup (stable-fixes).\n- serial: 8250_bcm7271: fix use-after-free in brcmuart_remove() (git-fixes).\n- serial: fix TIOCMIWAIT race (git-fixes).\n- serial: ma35d1: Fix clock reference leak in ma35d1serial_probe() (git-fixes).\n- serial: sc16is7xx: fix TX gap caused by kfifo circular buffer wrap-around (git-fixes).\n- serial: sc16is7xx: refill TX FIFO below trigger using fresh TXLVL (git-fixes).\n- serial: tegra: don't clear the Tx FIFO on an Rx-only reset (git-fixes).\n- serial: vt8500: Fix clock reference leak in vt8500_serial_probe() (git-fixes).\n- smb: client: reject overlapping data areas in SMB2 responses (git-fixes).\n- soc: qcom: geni-se: Correct QUP Core ICC vote constants (git-fixes).\n- soundwire: cadence_master: wait and cancel cdns-\u003ework before clock stop (git-fixes).\n- soundwire: dmi-quirks: Disable ghost Realtek devices (stable-fixes).\n- soundwire: intel: Move suspend tracking from trigger to pm suspend (stable-fixes).\n- soundwire: intel_auxdevice: Add cs42l43b to wake_capable_list (stable-fixes).\n- soundwire: only handle alert events when the peripheral is attached (stable-fixes).\n- soundwire: validate DT compatible before parsing it (stable-fixes).\n- spi: dw-dma: Wait for controller idle before completing Tx (git-fixes).\n- spi: dw-mmio: Add ACPI ID LECA0002 for LECARC SoCs (stable-fixes).\n- spi: dw: fix wrong RX_SAMPLE_DLY setting after resume (git-fixes).\n- spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM (stable-fixes).\n- spi: xilinx: let transfers timeout in case of no IRQ (stable-fixes).\n- thermal/drivers/qcom/tsens: Atomic temperature read with hardware-guided retries (stable-fixes).\n- thermal/drivers/tegra/soctherma: Switch to devm cooling device registration (stable-fixes).\n- thermal: gov_step_wise: Fix stale mitigation vote with non-zero lower bounds (git-fixes).\n- thunderbolt: Avoid reserved fields in path config space for USB4 routers (stable-fixes).\n- thunderbolt: Don't access path config space on Lane 1 adapters in tb_switch_reset_host() (stable-fixes).\n- thunderbolt: Don't disable lane adapter if XDomain lane bonding isn't possible (stable-fixes).\n- thunderbolt: Fix KASAN reported use-after-free when request is canceled (git-fixes).\n- thunderbolt: Improve multi-display DisplayPort tunnel allocation (stable-fixes).\n- thunderbolt: Increase timeout for Configuration Ready bit (stable-fixes).\n- thunderbolt: Keep the domain reference while processing hotplug (stable-fixes).\n- thunderbolt: Keep XDomain reference during the lifetime of a service (stable-fixes).\n- thunderbolt: Reject oversized XDomain properties responses (git-fixes).\n- thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() (stable-fixes).\n- thunderbolt: Set tb-\u003eroot_switch to NULL when domain is stopped (stable-fixes).\n- thunderbolt: Verify Router Ready bit is set after router enumeration (stable-fixes).\n- tpm: Disable TPM on null key name mismatch (git-fixes).\n- tty: serial: max3100: shut down timer before freeing port (git-fixes).\n- tty: serial: qcom_geni_serial: Keep console RX functional after deep idle (git-fixes).\n- tty: vt: fix memory leak in vc_allocate() (git-fixes).\n- usb-storage: ene_ub6250: fix race between scan work and probe (stable-fixes).\n- USB: cdc-acm: fix racy TIOCMIWAIT implementation (git-fixes).\n- USB: cdc-acm: skip URB restart in port_shutdown if disconnected (git-fixes).\n- USB: cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set (stable-fixes).\n- usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe (git-fixes).\n- usb: cdns3: fix use-after-free in cdns3_gadget_exit() (git-fixes).\n- usb: cdns3: rename hibernated argument of role-\u003eresume() to lost_power (stable-fixes).\n- usb: chipidea: tegra: disable runtime PM on resume failure (git-fixes).\n- usb: core: clear both ep_in and ep_out for non-ep0 control endpoints (git-fixes).\n- usb: core: hcd: fix possible deadlock in rh control transfers (stable-fixes).\n- usb: dwc3: am62: Fix runtime PM usage count leak on probe error path (git-fixes).\n- usb: gadget: aspeed-vhub: cancel wake work on device removal (git-fixes).\n- usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue (stable-fixes).\n- USB: gadget: dummy-hcd: Fix wait for outstanding request completions (git-fixes).\n- usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC (git-fixes).\n- usb: gadget: f_fs: Fix Use-After-Free in AIO error path (git-fixes).\n- usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd (git-fixes).\n- USB: gadget: ffs: fix mm lifetime handling (stable-fixes).\n- USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() (stable-fixes).\n- usb: gadget: goku_udc: avoid NULL deref of dev-\u003edriver in INT_USBRESET log (stable-fixes).\n- usb: gadget: midi2: Fix the jack descriptor array sizes (git-fixes).\n- usb: gadget: udc: skip pullup() if already connected (stable-fixes).\n- usb: host: add ARCH_AIROHA in XHCI MTK dependency (stable-fixes).\n- usb: hub: use shorter 120ms post resume hold for SS root hubs (git-fixes).\n- usb: image: mdc800: change kmalloc() to kzalloc() (stable-fixes).\n- usb: octeon-hcd: fix the FIFO-flush timeout computation (git-fixes).\n- usb: ohci-da8xx: disable controller wakeup on cleanup (git-fixes).\n- usb: ohci-s3c2410: disable controller wakeup on removal (git-fixes).\n- usb: ohci-st: disable controller wakeup on removal (git-fixes).\n- USB: serial: fix driver deregistration order (git-fixes).\n- USB: serial: fix dynamic id driver deregistration race (git-fixes).\n- USB: serial: fix ioctl hangup race (git-fixes).\n- USB: serial: fix port tear down use-after-free (git-fixes).\n- USB: serial: quatech2: fix baud rate overflow (git-fixes).\n- usb: serial: spcp8x5: don't store usb_device_id (stable-fixes).\n- USB: serial: ssu100: fix baud rate overflow (git-fixes).\n- usb: storage: sierra_ms: reject short SWoC info transfers (git-fixes).\n- usb: typec: anx7411 - stop the IRQ before destroying the workqueue (git-fixes).\n- usb: typec: tcpm: recover after failure to start the frs ams (git-fixes).\n- usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() (git-fixes).\n- usb: typec: ucsi: displayport: Current CAM OOB index fixup (git-fixes).\n- usb: typec: ucsi: Get the connector fwnode based on reg value (git-fixes).\n- usb: typec: ucsi: glink: fix use-after-free of ucsi on remove (git-fixes).\n- usb: usbtmc: don't store usb_device_id (stable-fixes).\n- usb: xhci: Improve Soft Retries after short transfers (stable-fixes).\n- usb: xhci: use cached HCSPARAMS1 value (stable-fixes).\n- usb: xusbatm: don't rely on id table pointer arithmetic (stable-fixes).\n- usbip: vhci_hcd: fix NULL deref in status_show_vhci (stable-fixes).\n- vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF (git-fixes).\n- vt: skip screen update for DEC alignment test on backgroup consoles (git-fixes).\n- watchdog: da9062: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes).\n- watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog (git-fixes).\n- watchdog: digicolor: Avoid division by zero (git-fixes).\n- watchdog: imx7ulp_wdt: Keep WDOG running until A55 enters WFI on i.MX94 (stable-fixes).\n- watchdog: lenovo_se10_wdt: Add support for SE10 Gen 2 platform (stable-fixes).\n- watchdog: lenovo_se10_wdt: Fix use-after-free and resource leak risk (stable-fixes).\n- watchdog: msc313e: Fix premature reset during timeout update (git-fixes).\n- watchdog: msc313e: Propagate error code in resume() (git-fixes).\n- watchdog: rtd119x: Avoid division by zero (git-fixes).\n- watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init() (git-fixes).\n- watchdog: starfive-wdt: Fix runtime PM leak in starfive_wdt_pm_start() (git-fixes).\n- wifi: ath9k_htc: don't store usb_device_id (stable-fixes).\n- wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all() (git-fixes).\n- wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi (stable-fixes).\n- wifi: ath11k: fix stride mismatch in mac_phy_caps_parse() (git-fixes).\n- wifi: ath12k: fix stride mismatch in mac_phy_caps_parse() (git-fixes).\n- wifi: brcmfmac: fix lost 802.1x TX completion wakeup (git-fixes).\n- wifi: brcmsmac: fix UAF in brcms_free_timer() (git-fixes).\n- wifi: cfg80211: check IP header size in cfg80211_classify8021d() (git-fixes).\n- wifi: cfg80211: don't filter by BSS type when removing stale entries (git-fixes).\n- wifi: cfg80211: don't get the radio mask for netdev-less wdevs (git-fixes).\n- wifi: cfg80211: expose cfg80211_chandef_get_width() (stable-fixes).\n- wifi: cfg80211: fix width unit in cfg80211_radio_chandef_valid() (git-fixes).\n- wifi: cfg80211: only group hidden BSSes with beacon entries (git-fixes).\n- wifi: cfg80211: reject duplicate wiphy cipher suite entries (stable-fixes).\n- wifi: cfg80211: skip regulatory for punctured subchannels (stable-fixes).\n- wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() (stable-fixes).\n- wifi: cfg80211: validate rx/tx MLME callback frame lengths before access (stable-fixes).\n- wifi: iwlegacy: fix broadcast stations deallocation (git-fixes).\n- wifi: iwlwifi: acpi: validate WGDS table revision index (stable-fixes).\n- wifi: iwlwifi: bound aligned TLV advance in FW parser (stable-fixes).\n- wifi: iwlwifi: mvm: add a check on the tid coming from the firmware (stable-fixes).\n- wifi: iwlwifi: mvm: fix a possible underflow (stable-fixes).\n- wifi: iwlwifi: mvm: fix an off-by-1 boundary check (stable-fixes).\n- wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif (stable-fixes).\n- wifi: iwlwifi: mvm: fix sched scan IE sizing (stable-fixes).\n- wifi: iwlwifi: mvm: parse beacon notif per layout (stable-fixes).\n- wifi: iwlwifi: mvm: validate mac_link_id in session protect notif (stable-fixes).\n- wifi: iwlwifi: mvm: validate sta_id in BA window status notif (stable-fixes).\n- wifi: iwlwifi: mvm: validate TX_CMD response layout (stable-fixes).\n- wifi: libertas: reject short monitor TX frames (stable-fixes).\n- wifi: libipw: fix key index receive bound checks (stable-fixes).\n- wifi: libipw: reject too-short association responses (git-fixes).\n- wifi: libipw: reject too-short beacon and probe responses (git-fixes).\n- wifi: mac80211: abort chanswitch when leaving a mesh (git-fixes).\n- wifi: mac80211: add HE 6 GHz capability in the scan elems len (git-fixes).\n- wifi: mac80211: always allow transmitting null-data on TXQs (stable-fixes).\n- wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver (git-fixes).\n- wifi: mac80211: don't access the TSF of a down interface (git-fixes).\n- wifi: mac80211: don't allow injecting frames wider than the chanctx (git-fixes).\n- wifi: mac80211: don't allow link changes when iface is down (git-fixes).\n- wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed (stable-fixes).\n- wifi: mac80211: don't offload TC setup on AP_VLAN interfaces (git-fixes).\n- wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set (git-fixes).\n- wifi: mac80211: don't start a ROC while scanning (git-fixes).\n- wifi: mac80211: explicitly disable FTM responder on AP stop (stable-fixes).\n- wifi: mac80211: ibss: wait for in-flight TX on disconnect (stable-fixes).\n- wifi: mac80211: mesh: release the channel if start fails (git-fixes).\n- wifi: mac80211: mesh: reset the CSA state when leaving (git-fixes).\n- wifi: mac80211: only operate on TDLS peers in the TDLS code (git-fixes).\n- wifi: mac80211: require a peer station for TDLS setup confirm (git-fixes).\n- wifi: mac80211: reset state when starting AP fails (git-fixes).\n- wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown (git-fixes).\n- wifi: mac80211: set up the TX info early to fix failure paths (git-fixes).\n- wifi: mac80211: suppress chanctx warning for debugfs reset (git-fixes).\n- wifi: mac80211: unlist vifs when their netdev is unregistered (git-fixes).\n- wifi: mac80211: validate deauth frame length before reason access (stable-fixes).\n- wifi: mt76: add init_wiphy callback (stable-fixes).\n- wifi: mt76: mt7915: set correct background radar capability (stable-fixes).\n- wifi: mt76: mt7925: add 320MHz bandwidth to bss_rlm_tlv (stable-fixes).\n- wifi: mt76: mt7925: add Netgear A8500 USB device ID (stable-fixes).\n- wifi: mt76: mt7925: advertise EHT 320MHz capabilities for 6GHz band (stable-fixes).\n- wifi: mt76: mt7925: Fix EHT Beamformee SS subfields to meet 802.11be minimum (git-fixes).\n- wifi: mt76: mt7925: handle 320MHz bandwidth in RXV and TXS (stable-fixes).\n- wifi: mt76: mt7925: populate EHT 320MHz MCS map in sta_rec (stable-fixes).\n- wifi: mt76: transform aspm_conf for pci_disable_link_state (stable-fixes).\n- wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length (git-fixes).\n- wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path (git-fixes).\n- wifi: mwifiex: prevent authentication frame length truncation (git-fixes).\n- wifi: mwifiex: replace one-element arrays with flexible array members (stable-fixes).\n- wifi: mwifiex: validate action frame fixed fields (git-fixes).\n- wifi: mwifiex: validate scan response extents (git-fixes).\n- wifi: nl80211: reject beacons with bad HE operation (stable-fixes).\n- wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST (git-fixes).\n- wifi: p54: validate curve data length in the calibration curve converters (git-fixes).\n- wifi: ralink: RT2X00: init EEPROM properly (stable-fixes).\n- wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers (stable-fixes).\n- wifi: rsi: fix heap OOB write on key removal (git-fixes).\n- wifi: rsi: validate beacon length before fixed buffer copy (stable-fixes).\n- wifi: rtw88: Add NULL check for chip-\u003eedcca_th in rtw_fw_adaptivity_result() (stable-fixes).\n- wifi: rtw88: Fix the random \"error beacon valid\" messages for USB (stable-fixes).\n- wifi: rtw88: TX QOS Null data the same way as Null data (stable-fixes).\n- wifi: rtw89: cleanup unused rtwdev::roc_work (stable-fixes).\n- wifi: rtw89: disable CSI STBC for VHT 160MHz (stable-fixes).\n- wifi: rtw89: Hide some errors when the device is unplugged (stable-fixes).\n- wifi: rtw89: pci: enable LTR based on pcie control register (stable-fixes).\n- wifi: rtw89: phy: check length before parsing PHY status IE (stable-fixes).\n- wifi: virt_wifi: don't transfer operstate before register (git-fixes).\n- wifi: virt_wifi: free skb when disconnected (git-fixes).\n- wifi: wilc1000: fix out-of-bounds read in P2P public action frames (git-fixes).\n- wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() (git-fixes).\n- wifi: wlcore: release runtime PM ref on regdomain config failure (git-fixes).\n- xhci: Prevent queuing new commands if xhci is inaccessible (stable-fixes).\n","status":"published","published":"2026-10-12T13:51:59Z","modified":"2026-10-21T17:23:12.046754854Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"UBUNTU-CVE-2025-40136","description":"In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/qm - request reserved interrupt for virtual function The device interrupt vector 3 is an error interrupt for physical function and a reserved interrupt for virtual function. However, the driver has not registered the reserved interrupt for virtual function. When allocating interrupts, the number of interrupts is allocated based on powers of two, which includes this interrupt. When the system enables GICv4 and the virtual function passthrough to the virtual machine, releasing the interrupt in the driver triggers a warning. The WARNING report is: WARNING: CPU: 62 PID: 14889 at arch/arm64/kvm/vgic/vgic-its.c:852 its_free_ite+0x94/0xb4 Therefore, register a reserved interrupt for VF and set the IRQF_NO_AUTOEN flag to avoid that warning.","status":"published","published":"2025-11-12T11:15:00Z","modified":"2026-11-10T02:50:05.300779659Z","updated_at":"2026-11-10T03:18:44.407792Z"},{"id":"USN-8029-1","title":"linux, linux-raspi, linux-realtime vulnerabilities","description":"Several security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - MIPS architecture;\n  - Nios II architecture;\n  - PA-RISC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - Sun Sparc architecture;\n  - x86 architecture;\n  - Xtensa architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Drivers core;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Hardware random number generator core;\n  - Character device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - CXL (Compute Express Link) drivers;\n  - Device frequency scaling framework;\n  - ARM SCMI message protocol;\n  - GPIO subsystem;\n  - GPU drivers;\n  - Hardware monitoring drivers;\n  - HW tracing;\n  - InfiniBand drivers;\n  - Input Device (Miscellaneous) drivers;\n  - IOMMU subsystem;\n  - ISDN/mISDN subsystem;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - Fastrpc Driver;\n  - PCI Endpoint Test driver;\n  - VMware Balloon Driver;\n  - MOST (Media Oriented Systems Transport) drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - NVME drivers;\n  - PCI subsystem;\n  - Performance monitor drivers;\n  - Pin controllers subsystem;\n  - Mellanox platform drivers;\n  - x86 platform drivers;\n  - ARM PM domains;\n  - PPS (Pulse Per Second) driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - Remote Processor subsystem;\n  - SCSI subsystem;\n  - SPI subsystem;\n  - Trusted Execution Environment drivers;\n  - Thunderbolt and USB4 drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Userspace I/O drivers;\n  - Cadence USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - vDPA drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Framebuffer layer;\n  - Xen hypervisor drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EROFS file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - GFS2 file system;\n  - JFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - Proc file system;\n  - Diskquota system;\n  - SMB network file system;\n  - BPF subsystem;\n  - Mellanox drivers;\n  - Memory management;\n  - Virtio network driver;\n  - Bluetooth subsystem;\n  - IP tunnels definitions;\n  - io_uring subsystem;\n  - Kernel crash support code;\n  - Perf events;\n  - Kernel futex primitives;\n  - PID allocator;\n  - Scheduler infrastructure;\n  - Syscalls implementation;\n  - Timer subsystem;\n  - Tracing infrastructure;\n  - 9P file system network protocol;\n  - Ethernet bridge;\n  - Networking core;\n  - IPv4 networking;\n  - IPv6 networking;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - Network traffic control;\n  - SCTP protocol;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - VMware vSockets driver;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Integrity Measurement Architecture(IMA) framework;\n  - ALSA framework;\n  - HD-audio driver;\n  - AMD SoC Alsa drivers;\n  - WCD audio codecs;\n  - Intel ASoC drivers;\n  - USB sound devices;\n  - KVM subsystem;\n(CVE-2025-40001, CVE-2025-40002, CVE-2025-40003, CVE-2025-40004,\nCVE-2025-40029, CVE-2025-40030, CVE-2025-40031, CVE-2025-40032,\nCVE-2025-40033, CVE-2025-40034, CVE-2025-40035, CVE-2025-40036,\nCVE-2025-40037, CVE-2025-40038, CVE-2025-40039, CVE-2025-40040,\nCVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40045,\nCVE-2025-40046, CVE-2025-40047, CVE-2025-40048, CVE-2025-40049,\nCVE-2025-40050, CVE-2025-40051, CVE-2025-40052, CVE-2025-40053,\nCVE-2025-40054, CVE-2025-40055, CVE-2025-40056, CVE-2025-40057,\nCVE-2025-40058, CVE-2025-40059, CVE-2025-40060, CVE-2025-40061,\nCVE-2025-40062, CVE-2025-40063, CVE-2025-40064, CVE-2025-40065,\nCVE-2025-40066, CVE-2025-40067, CVE-2025-40068, CVE-2025-40069,\nCVE-2025-40070, CVE-2025-40071, CVE-2025-40072, CVE-2025-40073,\nCVE-2025-40074, CVE-2025-40075, CVE-2025-40076, CVE-2025-40077,\nCVE-2025-40078, CVE-2025-40079, CVE-2025-40080, CVE-2025-40081,\nCVE-2025-40082, CVE-2025-40084, CVE-2025-40085, CVE-2025-40086,\nCVE-2025-40087, CVE-2025-40088, CVE-2025-40089, CVE-2025-40091,\nCVE-2025-40092, CVE-2025-40093, CVE-2025-40094, CVE-2025-40095,\nCVE-2025-40096, CVE-2025-40097, CVE-2025-40098, CVE-2025-40099,\nCVE-2025-40100, CVE-2025-40101, CVE-2025-40102, CVE-2025-40103,\nCVE-2025-40104, CVE-2025-40105, CVE-2025-40106, CVE-2025-40110,\nCVE-2025-40111, CVE-2025-40112, CVE-2025-40113, CVE-2025-40115,\nCVE-2025-40116, CVE-2025-40117, CVE-2025-40118, CVE-2025-40119,\nCVE-2025-40120, CVE-2025-40121, CVE-2025-40122, CVE-2025-40123,\nCVE-2025-40124, CVE-2025-40125, CVE-2025-40126, CVE-2025-40127,\nCVE-2025-40129, CVE-2025-40130, CVE-2025-40131, CVE-2025-40132,\nCVE-2025-40133, CVE-2025-40134, CVE-2025-40135, CVE-2025-40136,\nCVE-2025-40137, CVE-2025-40138, CVE-2025-40139, CVE-2025-40140,\nCVE-2025-40141, CVE-2025-40142, CVE-2025-40143, CVE-2025-40145,\nCVE-2025-40146, CVE-2025-40147, CVE-2025-40148, CVE-2025-40149,\nCVE-2025-40150, CVE-2025-40152, CVE-2025-40153, CVE-2025-40154,\nCVE-2025-40155, CVE-2025-40156, CVE-2025-40158, CVE-2025-40159,\nCVE-2025-40160, CVE-2025-40161, CVE-2025-40162, CVE-2025-40163,\nCVE-2025-40164, CVE-2025-40165, CVE-2025-40166, CVE-2025-40167,\nCVE-2025-40168, CVE-2025-40169, CVE-2025-40170, CVE-2025-40171,\nCVE-2025-40172, CVE-2025-40173, CVE-2025-40174, CVE-2025-40175,\nCVE-2025-40176, CVE-2025-40177, CVE-2025-40178, CVE-2025-40179,\nCVE-2025-40180, CVE-2025-40181, CVE-2025-40182, CVE-2025-40183,\nCVE-2025-40184, CVE-2025-40185, CVE-2025-40186, CVE-2025-40187,\nCVE-2025-40188, CVE-2025-40189, CVE-2025-40191, CVE-2025-40192,\nCVE-2025-40193, CVE-2025-40194, CVE-2025-40195, CVE-2025-40196,\nCVE-2025-40198, CVE-2025-40199, CVE-2025-40200, CVE-2025-40201,\nCVE-2025-40203, CVE-2025-40204, CVE-2025-40205, CVE-2025-40206,\nCVE-2025-40207, CVE-2025-40208, CVE-2025-40209, CVE-2025-40210,\nCVE-2025-40211, CVE-2025-40212, CVE-2025-40213, CVE-2025-40217,\nCVE-2025-40218, CVE-2025-40219, CVE-2025-40220, CVE-2025-40221,\nCVE-2025-40222, CVE-2025-40223, CVE-2025-40224, CVE-2025-40225,\nCVE-2025-40226, CVE-2025-40227, CVE-2025-40228, CVE-2025-40229,\nCVE-2025-40230, CVE-2025-40231, CVE-2025-40233, CVE-2025-40234,\nCVE-2025-40235, CVE-2025-40236, CVE-2025-40237, CVE-2025-40238,\nCVE-2025-40239, CVE-2025-40240, CVE-2025-40241, CVE-2025-40242,\nCVE-2025-40243, CVE-2025-40244, CVE-2025-40245, CVE-2025-40256,\nCVE-2025-40267, CVE-2025-40268, CVE-2025-40269, CVE-2025-40270,\nCVE-2025-40271, CVE-2025-40272, CVE-2025-40273, CVE-2025-40274,\nCVE-2025-40275, CVE-2025-40276, CVE-2025-40277, CVE-2025-40278,\nCVE-2025-40279, CVE-2025-40280, CVE-2025-40281, CVE-2025-40282,\nCVE-2025-40283, CVE-2025-40284, CVE-2025-40285, CVE-2025-40286,\nCVE-2025-40287, CVE-2025-40288, CVE-2025-40289, CVE-2025-40291,\nCVE-2025-40292, CVE-2025-40293, CVE-2025-40294, CVE-2025-40295,\nCVE-2025-40296, CVE-2025-40297, CVE-2025-40298, CVE-2025-40299,\nCVE-2025-40301, CVE-2025-40302, CVE-2025-40303, CVE-2025-40304,\nCVE-2025-40305, CVE-2025-40306, CVE-2025-40307, CVE-2025-40308,\nCVE-2025-40309, CVE-2025-40310, CVE-2025-40311, CVE-2025-40312,\nCVE-2025-40313, CVE-2025-40314, CVE-2025-40315, CVE-2025-40316,\nCVE-2025-40317, CVE-2025-40318, CVE-2025-40319, CVE-2025-40320,\nCVE-2025-40321, CVE-2025-40322, CVE-2025-40323, CVE-2025-40324,\nCVE-2025-40326, CVE-2025-40327, CVE-2025-40328, CVE-2025-40329,\nCVE-2025-40330, CVE-2025-40331, CVE-2025-40332, CVE-2025-40333,\nCVE-2025-40334, CVE-2025-40335, CVE-2025-40336, CVE-2025-40337,\nCVE-2025-40338, CVE-2025-40339, CVE-2025-40340, CVE-2025-40341,\nCVE-2025-40342, CVE-2025-40343, CVE-2025-40344, CVE-2025-40346,\nCVE-2025-40347, CVE-2025-40349, CVE-2025-40350, CVE-2025-40351,\nCVE-2025-40352, CVE-2025-40353, CVE-2025-40354, CVE-2025-40355,\nCVE-2025-40356, CVE-2025-40357, CVE-2025-40358, CVE-2025-40359,\nCVE-2025-40360, CVE-2025-40362, CVE-2025-40363, CVE-2025-68167,\nCVE-2025-68168, CVE-2025-68169, CVE-2025-68170, CVE-2025-68171,\nCVE-2025-68172, CVE-2025-68173, CVE-2025-68174, CVE-2025-68175,\nCVE-2025-68176, CVE-2025-68177, CVE-2025-68178, CVE-2025-68179,\nCVE-2025-68180, CVE-2025-68181, CVE-2025-68182, CVE-2025-68183,\nCVE-2025-68184, CVE-2025-68185, CVE-2025-68186, CVE-2025-68187,\nCVE-2025-68188, CVE-2025-68189, CVE-2025-68190, CVE-2025-68191,\nCVE-2025-68192, CVE-2025-68193, CVE-2025-68194, CVE-2025-68196,\nCVE-2025-68197, CVE-2025-68198, CVE-2025-68199, CVE-2025-68200,\nCVE-2025-68201, CVE-2025-68202, CVE-2025-68204, CVE-2025-68205,\nCVE-2025-68206, CVE-2025-68207, CVE-2025-68208, CVE-2025-68209,\nCVE-2025-68210, CVE-2025-68211, CVE-2025-68239, CVE-2025-68240,\nCVE-2025-68241, CVE-2025-68242, CVE-2025-68243, CVE-2025-68244,\nCVE-2025-68245, CVE-2025-68246, CVE-2025-68247, CVE-2025-68248,\nCVE-2025-68249, CVE-2025-68250, CVE-2025-68251, CVE-2025-68253,\nCVE-2025-68309, CVE-2025-68310, CVE-2025-68311, CVE-2025-68312,\nCVE-2025-68313, CVE-2025-68314, CVE-2025-68315, CVE-2025-68316,\nCVE-2025-68317, CVE-2025-68318, CVE-2025-68319, CVE-2025-68320,\nCVE-2025-68321, CVE-2025-68322, CVE-2025-68734)\n","status":"published","published":"2026-02-12T09:15:01Z","modified":"2026-11-03T14:34:42.37518646Z","updated_at":"2026-11-03T15:16:54.00292Z"},{"id":"USN-8029-2","title":"linux-aws, linux-oracle vulnerabilities","description":"Several security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - MIPS architecture;\n  - Nios II architecture;\n  - PA-RISC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - Sun Sparc architecture;\n  - x86 architecture;\n  - Xtensa architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Drivers core;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Hardware random number generator core;\n  - Character device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - CXL (Compute Express Link) drivers;\n  - Device frequency scaling framework;\n  - ARM SCMI message protocol;\n  - GPIO subsystem;\n  - GPU drivers;\n  - Hardware monitoring drivers;\n  - HW tracing;\n  - InfiniBand drivers;\n  - Input Device (Miscellaneous) drivers;\n  - IOMMU subsystem;\n  - ISDN/mISDN subsystem;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - Fastrpc Driver;\n  - PCI Endpoint Test driver;\n  - VMware Balloon Driver;\n  - MOST (Media Oriented Systems Transport) drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - NVME drivers;\n  - PCI subsystem;\n  - Performance monitor drivers;\n  - Pin controllers subsystem;\n  - Mellanox platform drivers;\n  - x86 platform drivers;\n  - ARM PM domains;\n  - PPS (Pulse Per Second) driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - Remote Processor subsystem;\n  - SCSI subsystem;\n  - SPI subsystem;\n  - Trusted Execution Environment drivers;\n  - Thunderbolt and USB4 drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Userspace I/O drivers;\n  - Cadence USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - vDPA drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Framebuffer layer;\n  - Xen hypervisor drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EROFS file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - GFS2 file system;\n  - JFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - Proc file system;\n  - Diskquota system;\n  - SMB network file system;\n  - BPF subsystem;\n  - Mellanox drivers;\n  - Memory management;\n  - Virtio network driver;\n  - Bluetooth subsystem;\n  - IP tunnels definitions;\n  - io_uring subsystem;\n  - Kernel crash support code;\n  - Perf events;\n  - Kernel futex primitives;\n  - PID allocator;\n  - Scheduler infrastructure;\n  - Syscalls implementation;\n  - Timer subsystem;\n  - Tracing infrastructure;\n  - 9P file system network protocol;\n  - Ethernet bridge;\n  - Networking core;\n  - IPv4 networking;\n  - IPv6 networking;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - Network traffic control;\n  - SCTP protocol;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - VMware vSockets driver;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Integrity Measurement Architecture(IMA) framework;\n  - ALSA framework;\n  - HD-audio driver;\n  - AMD SoC Alsa drivers;\n  - WCD audio codecs;\n  - Intel ASoC drivers;\n  - USB sound devices;\n  - KVM subsystem;\n(CVE-2025-40001, CVE-2025-40002, CVE-2025-40003, CVE-2025-40004,\nCVE-2025-40029, CVE-2025-40030, CVE-2025-40031, CVE-2025-40032,\nCVE-2025-40033, CVE-2025-40034, CVE-2025-40035, CVE-2025-40036,\nCVE-2025-40037, CVE-2025-40038, CVE-2025-40039, CVE-2025-40040,\nCVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40045,\nCVE-2025-40046, CVE-2025-40047, CVE-2025-40048, CVE-2025-40049,\nCVE-2025-40050, CVE-2025-40051, CVE-2025-40052, CVE-2025-40053,\nCVE-2025-40054, CVE-2025-40055, CVE-2025-40056, CVE-2025-40057,\nCVE-2025-40058, CVE-2025-40059, CVE-2025-40060, CVE-2025-40061,\nCVE-2025-40062, CVE-2025-40063, CVE-2025-40064, CVE-2025-40065,\nCVE-2025-40066, CVE-2025-40067, CVE-2025-40068, CVE-2025-40069,\nCVE-2025-40070, CVE-2025-40071, CVE-2025-40072, CVE-2025-40073,\nCVE-2025-40074, CVE-2025-40075, CVE-2025-40076, CVE-2025-40077,\nCVE-2025-40078, CVE-2025-40079, CVE-2025-40080, CVE-2025-40081,\nCVE-2025-40082, CVE-2025-40084, CVE-2025-40085, CVE-2025-40086,\nCVE-2025-40087, CVE-2025-40088, CVE-2025-40089, CVE-2025-40091,\nCVE-2025-40092, CVE-2025-40093, CVE-2025-40094, CVE-2025-40095,\nCVE-2025-40096, CVE-2025-40097, CVE-2025-40098, CVE-2025-40099,\nCVE-2025-40100, CVE-2025-40101, CVE-2025-40102, CVE-2025-40103,\nCVE-2025-40104, CVE-2025-40105, CVE-2025-40106, CVE-2025-40110,\nCVE-2025-40111, CVE-2025-40112, CVE-2025-40113, CVE-2025-40115,\nCVE-2025-40116, CVE-2025-40117, CVE-2025-40118, CVE-2025-40119,\nCVE-2025-40120, CVE-2025-40121, CVE-2025-40122, CVE-2025-40123,\nCVE-2025-40124, CVE-2025-40125, CVE-2025-40126, CVE-2025-40127,\nCVE-2025-40129, CVE-2025-40130, CVE-2025-40131, CVE-2025-40132,\nCVE-2025-40133, CVE-2025-40134, CVE-2025-40135, CVE-2025-40136,\nCVE-2025-40137, CVE-2025-40138, CVE-2025-40139, CVE-2025-40140,\nCVE-2025-40141, CVE-2025-40142, CVE-2025-40143, CVE-2025-40145,\nCVE-2025-40146, CVE-2025-40147, CVE-2025-40148, CVE-2025-40149,\nCVE-2025-40150, CVE-2025-40152, CVE-2025-40153, CVE-2025-40154,\nCVE-2025-40155, CVE-2025-40156, CVE-2025-40158, CVE-2025-40159,\nCVE-2025-40160, CVE-2025-40161, CVE-2025-40162, CVE-2025-40163,\nCVE-2025-40164, CVE-2025-40165, CVE-2025-40166, CVE-2025-40167,\nCVE-2025-40168, CVE-2025-40169, CVE-2025-40170, CVE-2025-40171,\nCVE-2025-40172, CVE-2025-40173, CVE-2025-40174, CVE-2025-40175,\nCVE-2025-40176, CVE-2025-40177, CVE-2025-40178, CVE-2025-40179,\nCVE-2025-40180, CVE-2025-40181, CVE-2025-40182, CVE-2025-40183,\nCVE-2025-40184, CVE-2025-40185, CVE-2025-40186, CVE-2025-40187,\nCVE-2025-40188, CVE-2025-40189, CVE-2025-40191, CVE-2025-40192,\nCVE-2025-40193, CVE-2025-40194, CVE-2025-40195, CVE-2025-40196,\nCVE-2025-40198, CVE-2025-40199, CVE-2025-40200, CVE-2025-40201,\nCVE-2025-40203, CVE-2025-40204, CVE-2025-40205, CVE-2025-40206,\nCVE-2025-40207, CVE-2025-40208, CVE-2025-40209, CVE-2025-40210,\nCVE-2025-40211, CVE-2025-40212, CVE-2025-40213, CVE-2025-40217,\nCVE-2025-40218, CVE-2025-40219, CVE-2025-40220, CVE-2025-40221,\nCVE-2025-40222, CVE-2025-40223, CVE-2025-40224, CVE-2025-40225,\nCVE-2025-40226, CVE-2025-40227, CVE-2025-40228, CVE-2025-40229,\nCVE-2025-40230, CVE-2025-40231, CVE-2025-40233, CVE-2025-40234,\nCVE-2025-40235, CVE-2025-40236, CVE-2025-40237, CVE-2025-40238,\nCVE-2025-40239, CVE-2025-40240, CVE-2025-40241, CVE-2025-40242,\nCVE-2025-40243, CVE-2025-40244, CVE-2025-40245, CVE-2025-40256,\nCVE-2025-40267, CVE-2025-40268, CVE-2025-40269, CVE-2025-40270,\nCVE-2025-40271, CVE-2025-40272, CVE-2025-40273, CVE-2025-40274,\nCVE-2025-40275, CVE-2025-40276, CVE-2025-40277, CVE-2025-40278,\nCVE-2025-40279, CVE-2025-40280, CVE-2025-40281, CVE-2025-40282,\nCVE-2025-40283, CVE-2025-40284, CVE-2025-40285, CVE-2025-40286,\nCVE-2025-40287, CVE-2025-40288, CVE-2025-40289, CVE-2025-40291,\nCVE-2025-40292, CVE-2025-40293, CVE-2025-40294, CVE-2025-40295,\nCVE-2025-40296, CVE-2025-40297, CVE-2025-40298, CVE-2025-40299,\nCVE-2025-40301, CVE-2025-40302, CVE-2025-40303, CVE-2025-40304,\nCVE-2025-40305, CVE-2025-40306, CVE-2025-40307, CVE-2025-40308,\nCVE-2025-40309, CVE-2025-40310, CVE-2025-40311, CVE-2025-40312,\nCVE-2025-40313, CVE-2025-40314, CVE-2025-40315, CVE-2025-40316,\nCVE-2025-40317, CVE-2025-40318, CVE-2025-40319, CVE-2025-40320,\nCVE-2025-40321, CVE-2025-40322, CVE-2025-40323, CVE-2025-40324,\nCVE-2025-40326, CVE-2025-40327, CVE-2025-40328, CVE-2025-40329,\nCVE-2025-40330, CVE-2025-40331, CVE-2025-40332, CVE-2025-40333,\nCVE-2025-40334, CVE-2025-40335, CVE-2025-40336, CVE-2025-40337,\nCVE-2025-40338, CVE-2025-40339, CVE-2025-40340, CVE-2025-40341,\nCVE-2025-40342, CVE-2025-40343, CVE-2025-40344, CVE-2025-40346,\nCVE-2025-40347, CVE-2025-40349, CVE-2025-40350, CVE-2025-40351,\nCVE-2025-40352, CVE-2025-40353, CVE-2025-40354, CVE-2025-40355,\nCVE-2025-40356, CVE-2025-40357, CVE-2025-40358, CVE-2025-40359,\nCVE-2025-40360, CVE-2025-40362, CVE-2025-40363, CVE-2025-68167,\nCVE-2025-68168, CVE-2025-68169, CVE-2025-68170, CVE-2025-68171,\nCVE-2025-68172, CVE-2025-68173, CVE-2025-68174, CVE-2025-68175,\nCVE-2025-68176, CVE-2025-68177, CVE-2025-68178, CVE-2025-68179,\nCVE-2025-68180, CVE-2025-68181, CVE-2025-68182, CVE-2025-68183,\nCVE-2025-68184, CVE-2025-68185, CVE-2025-68186, CVE-2025-68187,\nCVE-2025-68188, CVE-2025-68189, CVE-2025-68190, CVE-2025-68191,\nCVE-2025-68192, CVE-2025-68193, CVE-2025-68194, CVE-2025-68196,\nCVE-2025-68197, CVE-2025-68198, CVE-2025-68199, CVE-2025-68200,\nCVE-2025-68201, CVE-2025-68202, CVE-2025-68204, CVE-2025-68205,\nCVE-2025-68206, CVE-2025-68207, CVE-2025-68208, CVE-2025-68209,\nCVE-2025-68210, CVE-2025-68211, CVE-2025-68239, CVE-2025-68240,\nCVE-2025-68241, CVE-2025-68242, CVE-2025-68243, CVE-2025-68244,\nCVE-2025-68245, CVE-2025-68246, CVE-2025-68247, CVE-2025-68248,\nCVE-2025-68249, CVE-2025-68250, CVE-2025-68251, CVE-2025-68253,\nCVE-2025-68309, CVE-2025-68310, CVE-2025-68311, CVE-2025-68312,\nCVE-2025-68313, CVE-2025-68314, CVE-2025-68315, CVE-2025-68316,\nCVE-2025-68317, CVE-2025-68318, CVE-2025-68319, CVE-2025-68320,\nCVE-2025-68321, CVE-2025-68322, CVE-2025-68734)\n","status":"published","published":"2026-02-17T12:49:18Z","modified":"2026-11-03T14:35:03.428875576Z","updated_at":"2026-11-03T15:16:36.034517Z"},{"id":"USN-8029-3","title":"linux-azure vulnerabilities","description":"Several security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - MIPS architecture;\n  - Nios II architecture;\n  - PA-RISC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - Sun Sparc architecture;\n  - x86 architecture;\n  - Xtensa architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Drivers core;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Hardware random number generator core;\n  - Character device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - CXL (Compute Express Link) drivers;\n  - Device frequency scaling framework;\n  - ARM SCMI message protocol;\n  - GPIO subsystem;\n  - GPU drivers;\n  - Hardware monitoring drivers;\n  - HW tracing;\n  - InfiniBand drivers;\n  - Input Device (Miscellaneous) drivers;\n  - IOMMU subsystem;\n  - ISDN/mISDN subsystem;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - Fastrpc Driver;\n  - PCI Endpoint Test driver;\n  - VMware Balloon Driver;\n  - MOST (Media Oriented Systems Transport) drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - NVME drivers;\n  - PCI subsystem;\n  - Performance monitor drivers;\n  - Pin controllers subsystem;\n  - Mellanox platform drivers;\n  - x86 platform drivers;\n  - ARM PM domains;\n  - PPS (Pulse Per Second) driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - Remote Processor subsystem;\n  - SCSI subsystem;\n  - SPI subsystem;\n  - Trusted Execution Environment drivers;\n  - Thunderbolt and USB4 drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Userspace I/O drivers;\n  - Cadence USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - vDPA drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Framebuffer layer;\n  - Xen hypervisor drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EROFS file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - GFS2 file system;\n  - JFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - Proc file system;\n  - Diskquota system;\n  - SMB network file system;\n  - BPF subsystem;\n  - Mellanox drivers;\n  - Memory management;\n  - Virtio network driver;\n  - Bluetooth subsystem;\n  - IP tunnels definitions;\n  - io_uring subsystem;\n  - Kernel crash support code;\n  - Perf events;\n  - Kernel futex primitives;\n  - PID allocator;\n  - Scheduler infrastructure;\n  - Syscalls implementation;\n  - Timer subsystem;\n  - Tracing infrastructure;\n  - 9P file system network protocol;\n  - Ethernet bridge;\n  - Networking core;\n  - IPv4 networking;\n  - IPv6 networking;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - Network traffic control;\n  - SCTP protocol;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - VMware vSockets driver;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Integrity Measurement Architecture(IMA) framework;\n  - ALSA framework;\n  - HD-audio driver;\n  - AMD SoC Alsa drivers;\n  - WCD audio codecs;\n  - Intel ASoC drivers;\n  - USB sound devices;\n  - KVM subsystem;\n(CVE-2025-40001, CVE-2025-40002, CVE-2025-40003, CVE-2025-40004,\nCVE-2025-40029, CVE-2025-40030, CVE-2025-40031, CVE-2025-40032,\nCVE-2025-40033, CVE-2025-40034, CVE-2025-40035, CVE-2025-40036,\nCVE-2025-40037, CVE-2025-40038, CVE-2025-40039, CVE-2025-40040,\nCVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40045,\nCVE-2025-40046, CVE-2025-40047, CVE-2025-40048, CVE-2025-40049,\nCVE-2025-40050, CVE-2025-40051, CVE-2025-40052, CVE-2025-40053,\nCVE-2025-40054, CVE-2025-40055, CVE-2025-40056, CVE-2025-40057,\nCVE-2025-40058, CVE-2025-40059, CVE-2025-40060, CVE-2025-40061,\nCVE-2025-40062, CVE-2025-40063, CVE-2025-40064, CVE-2025-40065,\nCVE-2025-40066, CVE-2025-40067, CVE-2025-40068, CVE-2025-40069,\nCVE-2025-40070, CVE-2025-40071, CVE-2025-40072, CVE-2025-40073,\nCVE-2025-40074, CVE-2025-40075, CVE-2025-40076, CVE-2025-40077,\nCVE-2025-40078, CVE-2025-40079, CVE-2025-40080, CVE-2025-40081,\nCVE-2025-40082, CVE-2025-40084, CVE-2025-40085, CVE-2025-40086,\nCVE-2025-40087, CVE-2025-40088, CVE-2025-40089, CVE-2025-40091,\nCVE-2025-40092, CVE-2025-40093, CVE-2025-40094, CVE-2025-40095,\nCVE-2025-40096, CVE-2025-40097, CVE-2025-40098, CVE-2025-40099,\nCVE-2025-40100, CVE-2025-40101, CVE-2025-40102, CVE-2025-40103,\nCVE-2025-40104, CVE-2025-40105, CVE-2025-40106, CVE-2025-40110,\nCVE-2025-40111, CVE-2025-40112, CVE-2025-40113, CVE-2025-40115,\nCVE-2025-40116, CVE-2025-40117, CVE-2025-40118, CVE-2025-40119,\nCVE-2025-40120, CVE-2025-40121, CVE-2025-40122, CVE-2025-40123,\nCVE-2025-40124, CVE-2025-40125, CVE-2025-40126, CVE-2025-40127,\nCVE-2025-40129, CVE-2025-40130, CVE-2025-40131, CVE-2025-40132,\nCVE-2025-40133, CVE-2025-40134, CVE-2025-40135, CVE-2025-40136,\nCVE-2025-40137, CVE-2025-40138, CVE-2025-40139, CVE-2025-40140,\nCVE-2025-40141, CVE-2025-40142, CVE-2025-40143, CVE-2025-40145,\nCVE-2025-40146, CVE-2025-40147, CVE-2025-40148, CVE-2025-40149,\nCVE-2025-40150, CVE-2025-40152, CVE-2025-40153, CVE-2025-40154,\nCVE-2025-40155, CVE-2025-40156, CVE-2025-40158, CVE-2025-40159,\nCVE-2025-40160, CVE-2025-40161, CVE-2025-40162, CVE-2025-40163,\nCVE-2025-40164, CVE-2025-40165, CVE-2025-40166, CVE-2025-40167,\nCVE-2025-40168, CVE-2025-40169, CVE-2025-40170, CVE-2025-40171,\nCVE-2025-40172, CVE-2025-40173, CVE-2025-40174, CVE-2025-40175,\nCVE-2025-40176, CVE-2025-40177, CVE-2025-40178, CVE-2025-40179,\nCVE-2025-40180, CVE-2025-40181, CVE-2025-40182, CVE-2025-40183,\nCVE-2025-40184, CVE-2025-40185, CVE-2025-40186, CVE-2025-40187,\nCVE-2025-40188, CVE-2025-40189, CVE-2025-40191, CVE-2025-40192,\nCVE-2025-40193, CVE-2025-40194, CVE-2025-40195, CVE-2025-40196,\nCVE-2025-40198, CVE-2025-40199, CVE-2025-40200, CVE-2025-40201,\nCVE-2025-40203, CVE-2025-40204, CVE-2025-40205, CVE-2025-40206,\nCVE-2025-40207, CVE-2025-40208, CVE-2025-40209, CVE-2025-40210,\nCVE-2025-40211, CVE-2025-40212, CVE-2025-40213, CVE-2025-40217,\nCVE-2025-40218, CVE-2025-40219, CVE-2025-40220, CVE-2025-40221,\nCVE-2025-40222, CVE-2025-40223, CVE-2025-40224, CVE-2025-40225,\nCVE-2025-40226, CVE-2025-40227, CVE-2025-40228, CVE-2025-40229,\nCVE-2025-40230, CVE-2025-40231, CVE-2025-40233, CVE-2025-40234,\nCVE-2025-40235, CVE-2025-40236, CVE-2025-40237, CVE-2025-40238,\nCVE-2025-40239, CVE-2025-40240, CVE-2025-40241, CVE-2025-40242,\nCVE-2025-40243, CVE-2025-40244, CVE-2025-40245, CVE-2025-40256,\nCVE-2025-40267, CVE-2025-40268, CVE-2025-40269, CVE-2025-40270,\nCVE-2025-40271, CVE-2025-40272, CVE-2025-40273, CVE-2025-40274,\nCVE-2025-40275, CVE-2025-40276, CVE-2025-40277, CVE-2025-40278,\nCVE-2025-40279, CVE-2025-40280, CVE-2025-40281, CVE-2025-40282,\nCVE-2025-40283, CVE-2025-40284, CVE-2025-40285, CVE-2025-40286,\nCVE-2025-40287, CVE-2025-40288, CVE-2025-40289, CVE-2025-40291,\nCVE-2025-40292, CVE-2025-40293, CVE-2025-40294, CVE-2025-40295,\nCVE-2025-40296, CVE-2025-40297, CVE-2025-40298, CVE-2025-40299,\nCVE-2025-40301, CVE-2025-40302, CVE-2025-40303, CVE-2025-40304,\nCVE-2025-40305, CVE-2025-40306, CVE-2025-40307, CVE-2025-40308,\nCVE-2025-40309, CVE-2025-40310, CVE-2025-40311, CVE-2025-40312,\nCVE-2025-40313, CVE-2025-40314, CVE-2025-40315, CVE-2025-40316,\nCVE-2025-40317, CVE-2025-40318, CVE-2025-40319, CVE-2025-40320,\nCVE-2025-40321, CVE-2025-40322, CVE-2025-40323, CVE-2025-40324,\nCVE-2025-40326, CVE-2025-40327, CVE-2025-40328, CVE-2025-40329,\nCVE-2025-40330, CVE-2025-40331, CVE-2025-40332, CVE-2025-40333,\nCVE-2025-40334, CVE-2025-40335, CVE-2025-40336, CVE-2025-40337,\nCVE-2025-40338, CVE-2025-40339, CVE-2025-40340, CVE-2025-40341,\nCVE-2025-40342, CVE-2025-40343, CVE-2025-40344, CVE-2025-40346,\nCVE-2025-40347, CVE-2025-40349, CVE-2025-40350, CVE-2025-40351,\nCVE-2025-40352, CVE-2025-40353, CVE-2025-40354, CVE-2025-40355,\nCVE-2025-40356, CVE-2025-40357, CVE-2025-40358, CVE-2025-40359,\nCVE-2025-40360, CVE-2025-40362, CVE-2025-40363, CVE-2025-68167,\nCVE-2025-68168, CVE-2025-68169, CVE-2025-68170, CVE-2025-68171,\nCVE-2025-68172, CVE-2025-68173, CVE-2025-68174, CVE-2025-68175,\nCVE-2025-68176, CVE-2025-68177, CVE-2025-68178, CVE-2025-68179,\nCVE-2025-68180, CVE-2025-68181, CVE-2025-68182, CVE-2025-68183,\nCVE-2025-68184, CVE-2025-68185, CVE-2025-68186, CVE-2025-68187,\nCVE-2025-68188, CVE-2025-68189, CVE-2025-68190, CVE-2025-68191,\nCVE-2025-68192, CVE-2025-68193, CVE-2025-68194, CVE-2025-68196,\nCVE-2025-68197, CVE-2025-68198, CVE-2025-68199, CVE-2025-68200,\nCVE-2025-68201, CVE-2025-68202, CVE-2025-68204, CVE-2025-68205,\nCVE-2025-68206, CVE-2025-68207, CVE-2025-68208, CVE-2025-68209,\nCVE-2025-68210, CVE-2025-68211, CVE-2025-68239, CVE-2025-68240,\nCVE-2025-68241, CVE-2025-68242, CVE-2025-68243, CVE-2025-68244,\nCVE-2025-68245, CVE-2025-68246, CVE-2025-68247, CVE-2025-68248,\nCVE-2025-68249, CVE-2025-68250, CVE-2025-68251, CVE-2025-68253,\nCVE-2025-68309, CVE-2025-68310, CVE-2025-68311, CVE-2025-68312,\nCVE-2025-68313, CVE-2025-68314, CVE-2025-68315, CVE-2025-68316,\nCVE-2025-68317, CVE-2025-68318, CVE-2025-68319, CVE-2025-68320,\nCVE-2025-68321, CVE-2025-68322, CVE-2025-68734)\n","status":"published","published":"2026-02-24T11:20:31Z","modified":"2026-11-03T14:35:00.15213949Z","updated_at":"2026-11-03T15:16:40.267874Z"},{"id":"USN-8030-1","title":"linux-gcp vulnerabilities","description":"Several security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - MIPS architecture;\n  - Nios II architecture;\n  - PA-RISC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - Sun Sparc architecture;\n  - x86 architecture;\n  - Xtensa architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Drivers core;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Hardware random number generator core;\n  - Character device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - CXL (Compute Express Link) drivers;\n  - Device frequency scaling framework;\n  - ARM SCMI message protocol;\n  - GPIO subsystem;\n  - GPU drivers;\n  - Hardware monitoring drivers;\n  - HW tracing;\n  - InfiniBand drivers;\n  - Input Device (Miscellaneous) drivers;\n  - IOMMU subsystem;\n  - ISDN/mISDN subsystem;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - Fastrpc Driver;\n  - PCI Endpoint Test driver;\n  - VMware Balloon Driver;\n  - MOST (Media Oriented Systems Transport) drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - NVME drivers;\n  - PCI subsystem;\n  - Performance monitor drivers;\n  - Pin controllers subsystem;\n  - Mellanox platform drivers;\n  - x86 platform drivers;\n  - ARM PM domains;\n  - PPS (Pulse Per Second) driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - Remote Processor subsystem;\n  - SCSI subsystem;\n  - SPI subsystem;\n  - Trusted Execution Environment drivers;\n  - Thunderbolt and USB4 drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Userspace I/O drivers;\n  - Cadence USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - vDPA drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Framebuffer layer;\n  - Xen hypervisor drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EROFS file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - GFS2 file system;\n  - JFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - Proc file system;\n  - Diskquota system;\n  - SMB network file system;\n  - BPF subsystem;\n  - Mellanox drivers;\n  - Memory management;\n  - Virtio network driver;\n  - Bluetooth subsystem;\n  - IP tunnels definitions;\n  - io_uring subsystem;\n  - Kernel crash support code;\n  - Perf events;\n  - Kernel futex primitives;\n  - PID allocator;\n  - Scheduler infrastructure;\n  - Syscalls implementation;\n  - Timer subsystem;\n  - Tracing infrastructure;\n  - 9P file system network protocol;\n  - Ethernet bridge;\n  - Networking core;\n  - IPv4 networking;\n  - IPv6 networking;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - Network traffic control;\n  - SCTP protocol;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - VMware vSockets driver;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Integrity Measurement Architecture(IMA) framework;\n  - ALSA framework;\n  - HD-audio driver;\n  - AMD SoC Alsa drivers;\n  - WCD audio codecs;\n  - Intel ASoC drivers;\n  - USB sound devices;\n  - KVM subsystem;\n(CVE-2025-40001, CVE-2025-40002, CVE-2025-40003, CVE-2025-40004,\nCVE-2025-40029, CVE-2025-40030, CVE-2025-40031, CVE-2025-40032,\nCVE-2025-40033, CVE-2025-40034, CVE-2025-40035, CVE-2025-40036,\nCVE-2025-40037, CVE-2025-40038, CVE-2025-40039, CVE-2025-40040,\nCVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40045,\nCVE-2025-40046, CVE-2025-40047, CVE-2025-40048, CVE-2025-40049,\nCVE-2025-40050, CVE-2025-40051, CVE-2025-40052, CVE-2025-40053,\nCVE-2025-40054, CVE-2025-40055, CVE-2025-40056, CVE-2025-40057,\nCVE-2025-40058, CVE-2025-40059, CVE-2025-40060, CVE-2025-40061,\nCVE-2025-40062, CVE-2025-40063, CVE-2025-40064, CVE-2025-40065,\nCVE-2025-40066, CVE-2025-40067, CVE-2025-40068, CVE-2025-40069,\nCVE-2025-40070, CVE-2025-40071, CVE-2025-40072, CVE-2025-40073,\nCVE-2025-40074, CVE-2025-40075, CVE-2025-40076, CVE-2025-40077,\nCVE-2025-40078, CVE-2025-40079, CVE-2025-40080, CVE-2025-40081,\nCVE-2025-40082, CVE-2025-40084, CVE-2025-40085, CVE-2025-40086,\nCVE-2025-40087, CVE-2025-40088, CVE-2025-40089, CVE-2025-40091,\nCVE-2025-40092, CVE-2025-40093, CVE-2025-40094, CVE-2025-40095,\nCVE-2025-40096, CVE-2025-40097, CVE-2025-40098, CVE-2025-40099,\nCVE-2025-40100, CVE-2025-40101, CVE-2025-40102, CVE-2025-40103,\nCVE-2025-40104, CVE-2025-40105, CVE-2025-40106, CVE-2025-40110,\nCVE-2025-40111, CVE-2025-40112, CVE-2025-40113, CVE-2025-40115,\nCVE-2025-40116, CVE-2025-40117, CVE-2025-40118, CVE-2025-40119,\nCVE-2025-40120, CVE-2025-40121, CVE-2025-40122, CVE-2025-40123,\nCVE-2025-40124, CVE-2025-40125, CVE-2025-40126, CVE-2025-40127,\nCVE-2025-40129, CVE-2025-40130, CVE-2025-40131, CVE-2025-40132,\nCVE-2025-40133, CVE-2025-40134, CVE-2025-40135, CVE-2025-40136,\nCVE-2025-40137, CVE-2025-40138, CVE-2025-40139, CVE-2025-40140,\nCVE-2025-40141, CVE-2025-40142, CVE-2025-40143, CVE-2025-40145,\nCVE-2025-40146, CVE-2025-40147, CVE-2025-40148, CVE-2025-40149,\nCVE-2025-40150, CVE-2025-40152, CVE-2025-40153, CVE-2025-40154,\nCVE-2025-40155, CVE-2025-40156, CVE-2025-40158, CVE-2025-40159,\nCVE-2025-40160, CVE-2025-40161, CVE-2025-40162, CVE-2025-40163,\nCVE-2025-40164, CVE-2025-40165, CVE-2025-40166, CVE-2025-40167,\nCVE-2025-40168, CVE-2025-40169, CVE-2025-40170, CVE-2025-40171,\nCVE-2025-40172, CVE-2025-40173, CVE-2025-40174, CVE-2025-40175,\nCVE-2025-40176, CVE-2025-40177, CVE-2025-40178, CVE-2025-40179,\nCVE-2025-40180, CVE-2025-40182, CVE-2025-40183, CVE-2025-40184,\nCVE-2025-40185, CVE-2025-40186, CVE-2025-40187, CVE-2025-40188,\nCVE-2025-40189, CVE-2025-40191, CVE-2025-40192, CVE-2025-40193,\nCVE-2025-40194, CVE-2025-40195, CVE-2025-40196, CVE-2025-40198,\nCVE-2025-40199, CVE-2025-40200, CVE-2025-40201, CVE-2025-40203,\nCVE-2025-40204, CVE-2025-40205, CVE-2025-40206, CVE-2025-40207,\nCVE-2025-40208, CVE-2025-40209, CVE-2025-40210, CVE-2025-40211,\nCVE-2025-40212, CVE-2025-40213, CVE-2025-40217, CVE-2025-40218,\nCVE-2025-40219, CVE-2025-40220, CVE-2025-40221, CVE-2025-40222,\nCVE-2025-40223, CVE-2025-40224, CVE-2025-40225, CVE-2025-40226,\nCVE-2025-40227, CVE-2025-40228, CVE-2025-40229, CVE-2025-40230,\nCVE-2025-40231, CVE-2025-40233, CVE-2025-40234, CVE-2025-40235,\nCVE-2025-40236, CVE-2025-40237, CVE-2025-40238, CVE-2025-40239,\nCVE-2025-40240, CVE-2025-40241, CVE-2025-40242, CVE-2025-40243,\nCVE-2025-40244, CVE-2025-40245, CVE-2025-40256, CVE-2025-40267,\nCVE-2025-40268, CVE-2025-40269, CVE-2025-40270, CVE-2025-40271,\nCVE-2025-40272, CVE-2025-40273, CVE-2025-40274, CVE-2025-40275,\nCVE-2025-40276, CVE-2025-40277, CVE-2025-40278, CVE-2025-40279,\nCVE-2025-40280, CVE-2025-40281, CVE-2025-40282, CVE-2025-40283,\nCVE-2025-40284, CVE-2025-40285, CVE-2025-40286, CVE-2025-40287,\nCVE-2025-40288, CVE-2025-40289, CVE-2025-40291, CVE-2025-40292,\nCVE-2025-40293, CVE-2025-40294, CVE-2025-40295, CVE-2025-40296,\nCVE-2025-40297, CVE-2025-40298, CVE-2025-40299, CVE-2025-40301,\nCVE-2025-40302, CVE-2025-40303, CVE-2025-40304, CVE-2025-40305,\nCVE-2025-40306, CVE-2025-40307, CVE-2025-40308, CVE-2025-40309,\nCVE-2025-40310, CVE-2025-40311, CVE-2025-40312, CVE-2025-40313,\nCVE-2025-40314, CVE-2025-40315, CVE-2025-40316, CVE-2025-40317,\nCVE-2025-40318, CVE-2025-40319, CVE-2025-40320, CVE-2025-40321,\nCVE-2025-40322, CVE-2025-40323, CVE-2025-40324, CVE-2025-40326,\nCVE-2025-40327, CVE-2025-40328, CVE-2025-40329, CVE-2025-40330,\nCVE-2025-40331, CVE-2025-40332, CVE-2025-40333, CVE-2025-40334,\nCVE-2025-40335, CVE-2025-40336, CVE-2025-40337, CVE-2025-40338,\nCVE-2025-40339, CVE-2025-40340, CVE-2025-40341, CVE-2025-40342,\nCVE-2025-40343, CVE-2025-40344, CVE-2025-40346, CVE-2025-40347,\nCVE-2025-40349, CVE-2025-40350, CVE-2025-40351, CVE-2025-40352,\nCVE-2025-40353, CVE-2025-40354, CVE-2025-40355, CVE-2025-40356,\nCVE-2025-40357, CVE-2025-40358, CVE-2025-40359, CVE-2025-40360,\nCVE-2025-40362, CVE-2025-40363, CVE-2025-68167, CVE-2025-68168,\nCVE-2025-68169, CVE-2025-68170, CVE-2025-68171, CVE-2025-68172,\nCVE-2025-68173, CVE-2025-68174, CVE-2025-68175, CVE-2025-68176,\nCVE-2025-68177, CVE-2025-68178, CVE-2025-68179, CVE-2025-68180,\nCVE-2025-68181, CVE-2025-68182, CVE-2025-68183, CVE-2025-68184,\nCVE-2025-68185, CVE-2025-68186, CVE-2025-68187, CVE-2025-68188,\nCVE-2025-68189, CVE-2025-68190, CVE-2025-68191, CVE-2025-68192,\nCVE-2025-68193, CVE-2025-68194, CVE-2025-68196, CVE-2025-68197,\nCVE-2025-68198, CVE-2025-68199, CVE-2025-68200, CVE-2025-68201,\nCVE-2025-68202, CVE-2025-68204, CVE-2025-68205, CVE-2025-68206,\nCVE-2025-68207, CVE-2025-68208, CVE-2025-68209, CVE-2025-68210,\nCVE-2025-68211, CVE-2025-68239, CVE-2025-68240, CVE-2025-68241,\nCVE-2025-68242, CVE-2025-68243, CVE-2025-68244, CVE-2025-68245,\nCVE-2025-68246, CVE-2025-68247, CVE-2025-68248, CVE-2025-68249,\nCVE-2025-68250, CVE-2025-68251, CVE-2025-68253, CVE-2025-68309,\nCVE-2025-68310, CVE-2025-68311, CVE-2025-68312, CVE-2025-68313,\nCVE-2025-68314, CVE-2025-68315, CVE-2025-68316, CVE-2025-68317,\nCVE-2025-68318, CVE-2025-68319, CVE-2025-68320, CVE-2025-68321,\nCVE-2025-68322, CVE-2025-68734)\n","status":"published","published":"2026-02-12T09:39:54Z","modified":"2026-11-03T14:34:59.664448895Z","updated_at":"2026-11-03T15:16:40.267874Z"},{"id":"USN-8048-1","title":"linux-oem-6.17 vulnerabilities","description":"Several security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - MIPS architecture;\n  - Nios II architecture;\n  - PA-RISC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - Sun Sparc architecture;\n  - x86 architecture;\n  - Xtensa architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Drivers core;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Hardware random number generator core;\n  - Character device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - CXL (Compute Express Link) drivers;\n  - Device frequency scaling framework;\n  - ARM SCMI message protocol;\n  - GPIO subsystem;\n  - GPU drivers;\n  - Hardware monitoring drivers;\n  - HW tracing;\n  - InfiniBand drivers;\n  - Input Device (Miscellaneous) drivers;\n  - IOMMU subsystem;\n  - ISDN/mISDN subsystem;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - Fastrpc Driver;\n  - PCI Endpoint Test driver;\n  - VMware Balloon Driver;\n  - MOST (Media Oriented Systems Transport) drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - NVME drivers;\n  - PCI subsystem;\n  - Performance monitor drivers;\n  - Pin controllers subsystem;\n  - Mellanox platform drivers;\n  - x86 platform drivers;\n  - ARM PM domains;\n  - PPS (Pulse Per Second) driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - Remote Processor subsystem;\n  - SCSI subsystem;\n  - SPI subsystem;\n  - Trusted Execution Environment drivers;\n  - Thunderbolt and USB4 drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Userspace I/O drivers;\n  - Cadence USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - vDPA drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Framebuffer layer;\n  - Xen hypervisor drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EROFS file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - GFS2 file system;\n  - JFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - Proc file system;\n  - Diskquota system;\n  - SMB network file system;\n  - BPF subsystem;\n  - Mellanox drivers;\n  - Memory management;\n  - Virtio network driver;\n  - Bluetooth subsystem;\n  - IP tunnels definitions;\n  - io_uring subsystem;\n  - Kernel crash support code;\n  - Perf events;\n  - Kernel futex primitives;\n  - PID allocator;\n  - Scheduler infrastructure;\n  - Syscalls implementation;\n  - Timer subsystem;\n  - Tracing infrastructure;\n  - 9P file system network protocol;\n  - Ethernet bridge;\n  - Networking core;\n  - IPv4 networking;\n  - IPv6 networking;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - Network traffic control;\n  - SCTP protocol;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - VMware vSockets driver;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Integrity Measurement Architecture(IMA) framework;\n  - ALSA framework;\n  - HD-audio driver;\n  - AMD SoC Alsa drivers;\n  - WCD audio codecs;\n  - Intel ASoC drivers;\n  - USB sound devices;\n  - KVM subsystem;\n(CVE-2025-40001, CVE-2025-40002, CVE-2025-40003, CVE-2025-40004,\nCVE-2025-40029, CVE-2025-40030, CVE-2025-40031, CVE-2025-40032,\nCVE-2025-40033, CVE-2025-40034, CVE-2025-40035, CVE-2025-40036,\nCVE-2025-40037, CVE-2025-40038, CVE-2025-40039, CVE-2025-40040,\nCVE-2025-40041, CVE-2025-40042, CVE-2025-40043, CVE-2025-40044,\nCVE-2025-40045, CVE-2025-40046, CVE-2025-40047, CVE-2025-40048,\nCVE-2025-40049, CVE-2025-40050, CVE-2025-40051, CVE-2025-40052,\nCVE-2025-40053, CVE-2025-40054, CVE-2025-40055, CVE-2025-40056,\nCVE-2025-40057, CVE-2025-40058, CVE-2025-40059, CVE-2025-40060,\nCVE-2025-40061, CVE-2025-40062, CVE-2025-40063, CVE-2025-40064,\nCVE-2025-40065, CVE-2025-40066, CVE-2025-40067, CVE-2025-40068,\nCVE-2025-40069, CVE-2025-40070, CVE-2025-40071, CVE-2025-40072,\nCVE-2025-40073, CVE-2025-40074, CVE-2025-40075, CVE-2025-40076,\nCVE-2025-40077, CVE-2025-40078, CVE-2025-40079, CVE-2025-40080,\nCVE-2025-40081, CVE-2025-40082, CVE-2025-40084, CVE-2025-40085,\nCVE-2025-40086, CVE-2025-40087, CVE-2025-40088, CVE-2025-40089,\nCVE-2025-40091, CVE-2025-40092, CVE-2025-40093, CVE-2025-40094,\nCVE-2025-40095, CVE-2025-40096, CVE-2025-40097, CVE-2025-40098,\nCVE-2025-40099, CVE-2025-40100, CVE-2025-40101, CVE-2025-40102,\nCVE-2025-40103, CVE-2025-40104, CVE-2025-40105, CVE-2025-40106,\nCVE-2025-40110, CVE-2025-40111, CVE-2025-40112, CVE-2025-40113,\nCVE-2025-40115, CVE-2025-40116, CVE-2025-40117, CVE-2025-40118,\nCVE-2025-40119, CVE-2025-40120, CVE-2025-40121, CVE-2025-40122,\nCVE-2025-40123, CVE-2025-40124, CVE-2025-40125, CVE-2025-40126,\nCVE-2025-40127, CVE-2025-40129, CVE-2025-40130, CVE-2025-40131,\nCVE-2025-40132, CVE-2025-40133, CVE-2025-40134, CVE-2025-40135,\nCVE-2025-40136, CVE-2025-40137, CVE-2025-40138, CVE-2025-40139,\nCVE-2025-40140, CVE-2025-40141, CVE-2025-40142, CVE-2025-40143,\nCVE-2025-40145, CVE-2025-40146, CVE-2025-40147, CVE-2025-40148,\nCVE-2025-40149, CVE-2025-40150, CVE-2025-40151, CVE-2025-40152,\nCVE-2025-40153, CVE-2025-40154, CVE-2025-40155, CVE-2025-40156,\nCVE-2025-40158, CVE-2025-40159, CVE-2025-40160, CVE-2025-40161,\nCVE-2025-40162, CVE-2025-40163, CVE-2025-40164, CVE-2025-40165,\nCVE-2025-40166, CVE-2025-40167, CVE-2025-40168, CVE-2025-40169,\nCVE-2025-40170, CVE-2025-40171, CVE-2025-40173, CVE-2025-40174,\nCVE-2025-40175, CVE-2025-40176, CVE-2025-40178, CVE-2025-40179,\nCVE-2025-40180, CVE-2025-40181, CVE-2025-40182, CVE-2025-40183,\nCVE-2025-40184, CVE-2025-40185, CVE-2025-40186, CVE-2025-40187,\nCVE-2025-40188, CVE-2025-40189, CVE-2025-40191, CVE-2025-40192,\nCVE-2025-40193, CVE-2025-40194, CVE-2025-40195, CVE-2025-40196,\nCVE-2025-40198, CVE-2025-40199, CVE-2025-40200, CVE-2025-40201,\nCVE-2025-40203, CVE-2025-40204, CVE-2025-40205, CVE-2025-40206,\nCVE-2025-40207, CVE-2025-40208, CVE-2025-40209, CVE-2025-40210,\nCVE-2025-40211, CVE-2025-40212, CVE-2025-40213, CVE-2025-40217,\nCVE-2025-40218, CVE-2025-40219, CVE-2025-40220, CVE-2025-40221,\nCVE-2025-40222, CVE-2025-40223, CVE-2025-40224, CVE-2025-40225,\nCVE-2025-40226, CVE-2025-40227, CVE-2025-40228, CVE-2025-40229,\nCVE-2025-40230, CVE-2025-40231, CVE-2025-40233, CVE-2025-40234,\nCVE-2025-40235, CVE-2025-40236, CVE-2025-40237, CVE-2025-40238,\nCVE-2025-40239, CVE-2025-40240, CVE-2025-40241, CVE-2025-40242,\nCVE-2025-40243, CVE-2025-40244, CVE-2025-40245, CVE-2025-40256,\nCVE-2025-40267, CVE-2025-40268, CVE-2025-40269, CVE-2025-40270,\nCVE-2025-40271, CVE-2025-40272, CVE-2025-40273, CVE-2025-40274,\nCVE-2025-40275, CVE-2025-40276, CVE-2025-40277, CVE-2025-40278,\nCVE-2025-40279, CVE-2025-40280, CVE-2025-40281, CVE-2025-40282,\nCVE-2025-40283, CVE-2025-40284, CVE-2025-40285, CVE-2025-40286,\nCVE-2025-40287, CVE-2025-40288, CVE-2025-40289, CVE-2025-40291,\nCVE-2025-40292, CVE-2025-40293, CVE-2025-40294, CVE-2025-40295,\nCVE-2025-40296, CVE-2025-40297, CVE-2025-40298, CVE-2025-40299,\nCVE-2025-40301, CVE-2025-40302, CVE-2025-40303, CVE-2025-40304,\nCVE-2025-40305, CVE-2025-40306, CVE-2025-40307, CVE-2025-40308,\nCVE-2025-40309, CVE-2025-40310, CVE-2025-40311, CVE-2025-40312,\nCVE-2025-40313, CVE-2025-40314, CVE-2025-40315, CVE-2025-40316,\nCVE-2025-40317, CVE-2025-40318, CVE-2025-40319, CVE-2025-40320,\nCVE-2025-40321, CVE-2025-40322, CVE-2025-40323, CVE-2025-40324,\nCVE-2025-40326, CVE-2025-40327, CVE-2025-40328, CVE-2025-40329,\nCVE-2025-40330, CVE-2025-40331, CVE-2025-40332, CVE-2025-40333,\nCVE-2025-40334, CVE-2025-40335, CVE-2025-40336, CVE-2025-40337,\nCVE-2025-40338, CVE-2025-40339, CVE-2025-40340, CVE-2025-40341,\nCVE-2025-40342, CVE-2025-40343, CVE-2025-40344, CVE-2025-40346,\nCVE-2025-40347, CVE-2025-40349, CVE-2025-40350, CVE-2025-40351,\nCVE-2025-40352, CVE-2025-40353, CVE-2025-40354, CVE-2025-40355,\nCVE-2025-40356, CVE-2025-40357, CVE-2025-40358, CVE-2025-40359,\nCVE-2025-40360, CVE-2025-40362, CVE-2025-40363, CVE-2025-68167,\nCVE-2025-68168, CVE-2025-68169, CVE-2025-68170, CVE-2025-68171,\nCVE-2025-68172, CVE-2025-68173, CVE-2025-68174, CVE-2025-68175,\nCVE-2025-68176, CVE-2025-68177, CVE-2025-68178, CVE-2025-68179,\nCVE-2025-68180, CVE-2025-68181, CVE-2025-68182, CVE-2025-68183,\nCVE-2025-68184, CVE-2025-68185, CVE-2025-68186, CVE-2025-68187,\nCVE-2025-68188, CVE-2025-68189, CVE-2025-68190, CVE-2025-68191,\nCVE-2025-68192, CVE-2025-68193, CVE-2025-68194, CVE-2025-68196,\nCVE-2025-68197, CVE-2025-68198, CVE-2025-68199, CVE-2025-68200,\nCVE-2025-68201, CVE-2025-68202, CVE-2025-68204, CVE-2025-68205,\nCVE-2025-68206, CVE-2025-68207, CVE-2025-68208, CVE-2025-68209,\nCVE-2025-68210, CVE-2025-68211, CVE-2025-68239, CVE-2025-68240,\nCVE-2025-68241, CVE-2025-68242, CVE-2025-68243, CVE-2025-68244,\nCVE-2025-68245, CVE-2025-68246, CVE-2025-68247, CVE-2025-68248,\nCVE-2025-68249, CVE-2025-68250, CVE-2025-68251, CVE-2025-68253,\nCVE-2025-68309, CVE-2025-68310, CVE-2025-68311, CVE-2025-68312,\nCVE-2025-68313, CVE-2025-68314, CVE-2025-68315, CVE-2025-68317,\nCVE-2025-68318, CVE-2025-68319, CVE-2025-68320, CVE-2025-68321,\nCVE-2025-68322, CVE-2025-68734)\n","status":"published","published":"2026-02-17T15:24:04Z","modified":"2026-11-03T14:35:01.29943175Z","updated_at":"2026-11-03T15:16:36.034517Z"}]}}