{"id":"CVE-2025-40216","aliases":["BELL-CVE-2025-40216","DEBIAN-CVE-2025-40216","EUVD-2025-201161","GHSA-vv4p-ph8q-2hhx","SUSE-SU-2026:23066-1","SUSE-SU-2026:23068-1","SUSE-SU-2026:23221-1","SUSE-SU-2026:23231-1","SUSE-SU-2026:23237-1","SUSE-SU-2026:2799-1","SUSE-SU-2026:2800-1","UBUNTU-CVE-2025-40216","openSUSE-SU-2026:21555-1"],"status":"published","title":"io_uring/rsrc: don't rely on user vaddr alignment","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/rsrc: don't rely on user vaddr alignment\n\nThere is no guaranteed alignment for user pointers, however the\ncalculation of an offset of the first page into a folio after coalescing\nuses some weird bit mask logic, get rid of it.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00152,"percentile":0.04405,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2025-12-04T14:14:14Z","modified":"2026-10-28T02:31:14Z","fixes":[{"ecosystem":"Alpaquita:25","package":"linux-lts","fixed_in":["6.12.41-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"linux-lts","fixed_in":["6.18.35-r1"],"sources":["osv"]},{"ecosystem":"Linux","package":"Kernel","fixed_in":["6.12.36","6.15.5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["6.12.37-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["6.12.37-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws-6.14","fixed_in":["6.14.0-1015.15~24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.14","fixed_in":["6.14.0-1014.14~24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-nvidia-6.14","fixed_in":["6.14.0-1007.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.14","fixed_in":["6.14.0-1018.19~24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.14","fixed_in":["6.14.0-1014.14"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle-6.14","fixed_in":["6.14.0-1015.15~24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime-6.14","fixed_in":["6.14.0-1014.14~24.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:25","package":"linux-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.6.89-r0"},{"fixed":"6.12.41-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"linux-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.12.92-r1"},{"fixed":"6.18.35-r1"}]}]},{"source":"osv","ecosystem":"Linux","package":"Kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.12.0"},{"fixed":"6.12.36"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.15.5"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.37-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.37-1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro Extras 6.2","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Micro Extras 6.2","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1.160000.2.19"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1.160000.2.19"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1.160000.2.19"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1.160000.2.19"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1.160000.2.19"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"kernel-livepatch-SLE15-SP7-RT_Update_17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150700.1.3.1"}]}],"bundled":168},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP7","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.7.62.1"}]}],"bundled":168},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP7","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.7.62.1"}]}],"bundled":168},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP7","package":"kernel-syms-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.7.62.1"}]}],"bundled":168},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.66.1"}]}],"bundled":105},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.66.1"}]}],"bundled":105},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.66.1.150700.17.39.1"}]}],"bundled":105},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.66.1"}]}],"bundled":105},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.66.1"}]}],"bundled":105},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.66.2"}]}],"bundled":105},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.66.1"}]}],"bundled":105},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.66.1"}]}],"bundled":105},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.66.1"}]}],"bundled":105},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.66.1"}]}],"bundled":105},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.66.1"}]}],"bundled":105},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"kernel-livepatch-SLE15-SP7_Update_18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150700.15.3.1"}]}],"bundled":105},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.66.1"}]}],"bundled":105},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.66.1"}]}],"bundled":105},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.66.1"}]}],"bundled":105},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.0-28.30~16.04.1","4.8.0-30.32~16.04.1","4.8.0-32.34~16.04.1","4.8.0-34.36~16.04.1","4.10.0-14.16~16.04.1","4.10.0-19.21~16.04.1","4.10.0-20.22~16.04.1","4.10.0-21.23~16.04.1","4.10.0-22.24~16.04.1","4.10.0-24.28~16.04.1","4.10.0-26.30~16.04.1","4.11.0-13.19~16.04.1","4.11.0-14.20~16.04.1","4.13.0-16.19~16.04.3","4.13.0-17.20~16.04.1","4.13.0-19.22~16.04.1","4.13.0-21.24~16.04.1","4.13.0-25.29~16.04.2","4.15.0-13.14~16.04.1","4.15.0-15.16~16.04.1","4.15.0-20.21~16.04.1","4.15.0-22.24~16.04.1","4.15.0-23.25~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1021.24~18.04.1","5.0.0-1022.25~18.04.1","5.0.0-1023.26~18.04.1","5.0.0-1024.27~18.04.1","5.0.0-1025.28","5.0.0-1027.30"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1019.21~18.04.1","5.3.0-1023.25~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.2","5.3.0-1033.35","5.3.0-1034.36","5.3.0-1035.37"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.2","4.15.0-1003.3","4.15.0-1004.4","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1012.12","4.15.0-1013.13","4.15.0-1014.14","4.15.0-1018.18","4.15.0-1019.19","4.15.0-1021.21","4.15.0-1022.23","4.15.0-1023.24","4.15.0-1025.26","4.15.0-1028.29","4.15.0-1030.31","4.15.0-1031.32","4.15.0-1032.33","4.15.0-1035.36","4.15.0-1036.38","4.15.0-1037.39","4.18.0-1011.11~18.04.1","4.18.0-1013.13~18.04.1","4.18.0-1014.14~18.04.1","4.18.0-1018.18~18.04.1","4.18.0-1019.19~18.04.1","4.18.0-1020.20~18.04.1","4.18.0-1023.24~18.04.1","4.18.0-1024.25~18.04.1","4.18.0-1025.27~18.04.1","5.0.0-1014.14~18.04.1","5.0.0-1016.17~18.04.1","5.0.0-1018.19~18.04.1","5.0.0-1020.21~18.04.1","5.0.0-1022.23~18.04.1","5.0.0-1023.24~18.04.1","5.0.0-1025.27~18.04.1","5.0.0-1027.29~18.04.1","5.0.0-1028.30~18.04.1","5.0.0-1029.31~18.04.1","5.0.0-1031.33","5.0.0-1032.34","5.0.0-1035.37","5.0.0-1036.38"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8~18.04.1","5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1019.20~18.04.1","5.3.0-1020.21~18.04.1","5.3.0-1022.23~18.04.1","5.3.0-1028.29~18.04.1","5.3.0-1031.32~18.04.1","5.3.0-1032.33~18.04.1","5.3.0-1034.35~18.04.1","5.3.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-1006.6~18.04.1","4.18.0-1007.7~18.04.1","4.18.0-1008.8~18.04.1","5.0.0-1012.12~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1001.1","4.15.0-1003.3","4.15.0-1005.5","4.15.0-1006.6","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1010.10","4.15.0-1014.14","4.15.0-1015.15","4.15.0-1017.18","4.15.0-1018.19","4.15.0-1019.20","4.15.0-1021.22","4.15.0-1023.24","4.15.0-1024.25","4.15.0-1025.26","4.15.0-1026.27","4.15.0-1027.28","4.15.0-1028.29","4.15.0-1029.31","4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1042.45","4.15.0-1044.70","5.0.0-1020.20~18.04.1","5.0.0-1021.21~18.04.1","5.0.0-1025.26~18.04.1","5.0.0-1026.27~18.04.1","5.0.0-1028.29~18.04.1","5.0.0-1029.30~18.04.1","5.0.0-1031.32","5.0.0-1033.34","5.0.0-1034.35"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1020.22~18.04.1","5.3.0-1026.28~18.04.1","5.3.0-1029.31~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-4.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1041.43","4.15.0-1042.44","4.15.0-1044.46","4.15.0-1045.48","4.15.0-1046.49","4.15.0-1048.51","4.15.0-1049.52","4.15.0-1050.53","4.15.0-1052.55","4.15.0-1055.58","4.15.0-1057.60","4.15.0-1058.61","4.15.0-1059.62","4.15.0-1063.66","4.15.0-1064.67","4.15.0-1066.69","4.15.0-1067.70","4.15.0-1069.72","4.15.0-1070.73","4.15.0-1072.76","4.15.0-1073.78","4.15.0-1074.79","4.15.0-1076.81","4.15.0-1077.82","4.15.0-1078.83","4.15.0-1079.84"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1025.25~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.31~18.04.1","5.4.0-1030.32~18.04.1","5.4.0-1032.34~18.04.1","5.4.0-1033.35~18.04.1","5.4.0-1035.37~18.04.1","5.4.0-1036.38~18.04.1","5.4.0-1037.39~18.04.1","5.4.0-1039.41~18.04.1","5.4.0-1040.42~18.04.1","5.4.0-1042.44~18.04.1","5.4.0-1043.45~18.04.1","5.4.0-1044.46~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1","5.4.0-1052.55~18.04.1","5.4.0-1053.56~18.04.1","5.4.0-1054.57~18.04.1","5.4.0-1055.58~18.04.1","5.4.0-1056.59~18.04.1","5.4.0-1057.60~18.04.1","5.4.0-1059.62~18.04.1","5.4.0-1061.64~18.04.1","5.4.0-1062.65~18.04.1","5.4.0-1063.66~18.04.1","5.4.0-1065.68~18.04.1","5.4.0-1066.69~18.04.1","5.4.0-1067.70~18.04.1","5.4.0-1068.71~18.04.1","5.4.0-1071.76~18.04.3","5.4.0-1072.77~18.04.1","5.4.0-1074.79~18.04.1","5.4.0-1076.82~18.04.1","5.4.0-1078.84~18.04.1","5.4.0-1080.86~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gkeop-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1001.1","5.4.0-1003.3","5.4.0-1004.5","5.4.0-1005.6","5.4.0-1007.8~18.04.1","5.4.0-1008.9~18.04.1","5.4.0-1009.10~18.04.1","5.4.0-1010.11~18.04.1","5.4.0-1011.12~18.04.2","5.4.0-1012.13~18.04.1","5.4.0-1013.14~18.04.1","5.4.0-1014.15~18.04.1","5.4.0-1015.16~18.04.1","5.4.0-1016.17~18.04.1","5.4.0-1018.19~18.04.1","5.4.0-1021.22~18.04.1","5.4.0-1022.23~18.04.1","5.4.0-1023.24~18.04.1","5.4.0-1024.25~18.04.1","5.4.0-1025.26~18.04.1","5.4.0-1026.27~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.30~18.04.2","5.4.0-1031.32~18.04.1","5.4.0-1032.33~18.04.1","5.4.0-1033.34~18.04.1","5.4.0-1034.35~18.04.1","5.4.0-1036.37~18.04.1","5.4.0-1037.38~18.04.1","5.4.0-1038.39~18.04.1","5.4.0-1039.40~18.04.1","5.4.0-1040.41~18.04.1","5.4.0-1043.44~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1048.51~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-13.14~18.04.1","4.18.0-14.15~18.04.1","4.18.0-15.16~18.04.1","4.18.0-16.17~18.04.1","4.18.0-17.18~18.04.1","4.18.0-18.19~18.04.1","4.18.0-20.21~18.04.1","4.18.0-21.22~18.04.1","4.18.0-22.23~18.04.1","4.18.0-24.25~18.04.1","4.18.0-25.26~18.04.1","5.0.0-23.24~18.04.1","5.0.0-25.26~18.04.1","5.0.0-27.28~18.04.1","5.0.0-29.31~18.04.1","5.0.0-31.33~18.04.1","5.0.0-32.34~18.04.2","5.0.0-35.38~18.04.1","5.0.0-36.39~18.04.1","5.0.0-37.40~18.04.1","5.3.0-26.28~18.04.1","5.3.0-28.30~18.04.1","5.3.0-40.32~18.04.1","5.3.0-42.34~18.04.1","5.3.0-45.37~18.04.1","5.3.0-46.38~18.04.1","5.3.0-51.44~18.04.2","5.3.0-53.47~18.04.1","5.3.0-59.53~18.04.1","5.3.0-61.55~18.04.1","5.3.0-62.56~18.04.1","5.3.0-64.58~18.04.1","5.3.0-65.59","5.3.0-66.60","5.3.0-67.61","5.3.0-68.63","5.3.0-69.65","5.3.0-70.66","5.3.0-72.68","5.3.0-73.69","5.3.0-74.70","5.3.0-75.71","5.3.0-76.72"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-15.16~18.04.1","5.0.0-16.17~18.04.1","5.0.0-17.18~18.04.1","5.0.0-19.20~18.04.1","5.0.0-20.21~18.04.1","5.3.0-19.20~18.04.2","5.3.0-22.24~18.04.1","5.3.0-23.25~18.04.1","5.3.0-23.25~18.04.2","5.3.0-24.26~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.3","4.15.0-1004.5","4.15.0-1006.9","4.15.0-1008.11","4.15.0-1009.12","4.15.0-1012.15","4.15.0-1013.16","4.15.0-1015.18","4.15.0-1017.20","4.15.0-1018.21","4.15.0-1021.24","4.15.0-1024.29","4.15.0-1026.31","4.15.0-1028.33","4.15.0-1030.35","4.15.0-1033.38","4.15.0-1034.39","4.15.0-1035.40","4.15.0-1036.41","4.15.0-1038.43","4.15.0-1039.44","4.15.0-1043.48","4.15.0-1045.50","4.15.0-1050.57","4.15.0-1056.65","4.15.0-1057.66","4.15.0-1059.68","4.15.0-1063.72","4.15.0-1064.73","4.15.0-1065.75","4.15.0-1066.76","4.15.0-1067.77","4.15.0-1069.79","4.15.0-1073.83","4.15.0-1076.86","4.15.0-1079.89","4.15.0-1080.90","4.15.0-1081.91","4.15.0-1087.97","4.15.0-1090.100","4.15.0-1091.101","4.15.0-1093.103","4.15.0-1094.104","4.15.0-1096.106","4.15.0-1097.107","4.15.0-1099.109","4.15.0-1100.110","4.15.0-1101.112","4.15.0-1102.113","4.15.0-1103.114"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1007.12~18.04.1","5.0.0-1008.13~18.04.1","5.0.0-1009.14~18.04.1","5.0.0-1010.15~18.04.1","5.0.0-1011.16","5.0.0-1013.18","5.0.0-1014.19"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1011.12~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.18~18.04.1","5.3.0-1018.20~18.04.1","5.3.0-1024.26~18.04.1","5.3.0-1027.29~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.9~20.04.2","5.11.0-1014.15~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.2","5.11.0-1021.22~20.04.2","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.2","5.13.0-1011.12~20.04.1","5.13.0-1012.13~20.04.1","5.13.0-1014.15~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1019.21~20.04.1","5.13.0-1021.23~20.04.2","5.13.0-1022.24~20.04.1","5.13.0-1023.25~20.04.1","5.13.0-1025.27~20.04.1","5.13.0-1028.31~20.04.1","5.13.0-1029.32~20.04.1","5.13.0-1031.35~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1041.43~20.04.1","5.8.0-1042.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1007.7~20.04.2","5.11.0-1012.13~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10~20.04.2","5.13.0-1012.14~20.04.1","5.13.0-1013.15~20.04.1","5.13.0-1014.16~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1021.24~20.04.1","5.13.0-1022.26~20.04.1","5.13.0-1023.27~20.04.1","5.13.0-1025.29~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1029.34~20.04.1","5.13.0-1031.37~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1033.35~20.04.1","5.8.0-1036.38~20.04.1","5.8.0-1039.42~20.04.1","5.8.0-1040.43~20.04.1","5.8.0-1041.44~20.04.1","5.8.0-1042.45~20.04.1","5.8.0-1043.46~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1063.66+cvm2.2","5.4.0-1063.66+cvm3.2","5.4.0-1064.67+cvm1.1","5.4.0-1065.68+cvm2.1","5.4.0-1067.70+cvm1.1","5.4.0-1068.71+cvm1.1","5.4.0-1069.72+cvm1.1","5.4.0-1070.73+cvm1.1","5.4.0-1072.75+cvm1.1","5.4.0-1073.76+cvm1.1","5.4.0-1074.77+cvm1.1","5.4.0-1076.79+cvm1.1","5.4.0-1078.81+cvm1.1","5.4.0-1080.83+cvm1.1","5.4.0-1083.87+cvm1.1","5.4.0-1085.90+cvm1.1","5.4.0-1085.90+cvm2.1","5.4.0-1086.91+cvm1.1","5.4.0-1089.94+cvm1.2","5.4.0-1090.95+cvm1.1","5.4.0-1091.96+cvm1.1","5.4.0-1092.97+cvm1.1","5.4.0-1095.101+cvm1.1","5.4.0-1098.104+cvm1.1","5.4.0-1100.106+cvm1.1","5.4.0-1103.109+cvm1.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.10~20.04.1","5.11.0-1014.16~20.04.1","5.11.0-1017.19~20.04.1","5.11.0-1018.20~20.04.2","5.11.0-1020.22~20.04.1","5.11.0-1021.23~20.04.1","5.11.0-1022.24~20.04.1","5.11.0-1023.25~20.04.1","5.11.0-1024.26~20.04.1","5.11.0-1026.29~20.04.1","5.11.0-1028.32~20.04.1","5.11.0-1029.33~20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.3","5.13.0-1012.15~20.04.1","5.13.0-1013.16~20.04.1","5.13.0-1015.18~20.04.1","5.13.0-1019.23~20.04.1","5.13.0-1021.25~20.04.1","5.13.0-1023.28~20.04.1","5.13.0-1024.29~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1030.36~20.04.1","5.13.0-1031.37~20.04.1","5.13.0-1033.40~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1032.34~20.04.1","5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1039.41"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1033.35","5.4.0-1035.37","5.4.0-1036.38","5.4.0-1037.39","5.4.0-1039.41","5.4.0-1041.43","5.4.0-1042.44","5.4.0-1043.45","5.4.0-1044.46","5.4.0-1046.48","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1055.58","5.4.0-1056.59","5.4.0-1057.60","5.4.0-1059.62","5.4.0-1061.64","5.4.0-1062.65","5.4.0-1063.66","5.4.0-1065.68","5.4.0-1066.69","5.4.0-1067.70","5.4.0-1068.71","5.4.0-1071.76","5.4.0-1072.77","5.4.0-1074.79","5.4.0-1076.82","5.4.0-1078.84","5.4.0-1080.86","5.4.0-1081.87","5.4.0-1083.89","5.4.0-1084.90","5.4.0-1086.93","5.4.0-1087.94","5.4.0-1090.97","5.4.0-1091.98","5.4.0-1094.101","5.4.0-1095.102","5.4.0-1096.103","5.4.0-1097.104","5.4.0-1098.105","5.4.0-1099.106","5.4.0-1100.107","5.4.0-1101.108","5.4.0-1102.109","5.4.0-1103.110","5.4.0-1104.111","5.4.0-1105.112"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1011.14~20.04.1","5.15.0-1014.17~20.04.1","5.15.0-1015.18~20.04.1","5.15.0-1016.19~20.04.1","5.15.0-1019.23~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1023.28~20.04.2","5.15.0-1027.32~20.04.1","5.15.0-1028.33~20.04.1","5.15.0-1029.34~20.04.1","5.15.0-1031.36~20.04.1","5.15.0-1032.37~20.04.1","5.15.0-1033.38~20.04.1","5.15.0-1034.39~20.04.1","5.15.0-1036.41~20.04.1","5.15.0-1037.42~20.04.1","5.15.0-1038.43~20.04.1","5.15.0-1039.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1008.9","5.4.0-1009.10","5.4.0-1010.11","5.4.0-1011.12","5.4.0-1012.13","5.4.0-1013.14","5.4.0-1014.15","5.4.0-1015.16","5.4.0-1016.17","5.4.0-1018.19","5.4.0-1021.22","5.4.0-1022.23","5.4.0-1023.24","5.4.0-1024.25","5.4.0-1025.26","5.4.0-1026.27","5.4.0-1027.28","5.4.0-1029.30","5.4.0-1031.32","5.4.0-1032.33","5.4.0-1033.34","5.4.0-1034.35","5.4.0-1036.37","5.4.0-1037.38","5.4.0-1038.39","5.4.0-1039.40","5.4.0-1040.41","5.4.0-1043.44","5.4.0-1046.48","5.4.0-1048.51","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1056.60","5.4.0-1057.61","5.4.0-1060.64","5.4.0-1061.65","5.4.0-1062.66","5.4.0-1064.68","5.4.0-1065.69","5.4.0-1066.70","5.4.0-1067.71","5.4.0-1068.72","5.4.0-1069.73","5.4.0-1070.74","5.4.0-1071.75","5.4.0-1072.76","5.4.0-1073.77","5.4.0-1074.78","5.4.0-1075.79","5.4.0-1076.80","5.4.0-1077.81","5.4.0-1078.82","5.4.0-1079.83","5.4.0-1080.84","5.4.0-1081.85","5.4.0-1083.87","5.4.0-1084.88","5.4.0-1085.89","5.4.0-1086.90","5.4.0-1087.91","5.4.0-1088.92","5.4.0-1089.93","5.4.0-1090.94","5.4.0-1091.95","5.4.0-1092.96","5.4.0-1093.97","5.4.0-1094.98","5.4.0-1095.99","5.4.0-1096.100","5.4.0-1097.101","5.4.0-1098.102","5.4.0-1099.103","5.4.0-1100.104","5.4.0-1101.105","5.4.0-1102.106"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gkeop-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1003.5~20.04.2","5.15.0-1005.7~20.04.1","5.15.0-1007.10~20.04.1","5.15.0-1008.12~20.04.1","5.15.0-1011.15~20.04.2","5.15.0-1012.16~20.04.1","5.15.0-1013.17~20.04.1","5.15.0-1015.19~20.04.1","5.15.0-1016.21~20.04.1","5.15.0-1017.22~20.04.1","5.15.0-1018.23~20.04.1","5.15.0-1019.24~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1021.26~20.04.1","5.15.0-1022.27~20.04.1","5.15.0-1023.28~20.04.1","5.15.0-1024.29~20.04.1","5.15.0-1025.30~20.04.1","5.15.0-1026.31~20.04.1","5.15.0-1027.32~20.04.1","5.15.0-1028.33~20.04.1","5.15.0-1030.35~20.04.1","5.15.0-1031.37~20.04.1","5.15.0-1032.38~20.04.1","5.15.0-1033.39~20.04.1","5.15.0-1034.40~20.04.1","5.15.0-1035.41~20.04.1","5.15.0-1036.42~20.04.1","5.15.0-1037.43~20.04.1","5.15.0-1038.44~20.04.1","5.15.0-1039.45~20.04.1","5.15.0-1040.46~20.04.1","5.15.0-1043.50~20.04.1","5.15.0-1044.51~20.04.1","5.15.0-1045.52~20.04.1","5.15.0-1046.53~20.04.1","5.15.0-1047.54~20.04.1","5.15.0-1048.55~20.04.1","5.15.0-1049.56~20.04.1","5.15.0-1050.57~20.04.1","5.15.0-1051.58~20.04.1","5.15.0-1052.59~20.04.1","5.15.0-1053.60~20.04.1","5.15.0-1054.61~20.04.1","5.15.0-1055.62~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-22.23~20.04.1","5.11.0-25.27~20.04.1","5.11.0-27.29~20.04.1","5.11.0-34.36~20.04.1","5.11.0-36.40~20.04.1","5.11.0-37.41~20.04.2","5.11.0-38.42~20.04.1","5.11.0-40.44~20.04.2","5.11.0-41.45~20.04.1","5.11.0-43.47~20.04.2","5.11.0-44.48~20.04.2","5.11.0-46.51~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-21.21~20.04.1","5.13.0-22.22~20.04.1","5.13.0-23.23~20.04.2","5.13.0-25.26~20.04.1","5.13.0-27.29~20.04.1","5.13.0-28.31~20.04.1","5.13.0-30.33~20.04.1","5.13.0-35.40~20.04.1","5.13.0-37.42~20.04.1","5.13.0-39.44~20.04.1","5.13.0-40.45~20.04.1","5.13.0-41.46~20.04.1","5.13.0-44.49~20.04.1","5.13.0-48.54~20.04.1","5.13.0-51.58~20.04.1","5.13.0-52.59~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-23.24~20.04.1","5.8.0-25.26~20.04.1","5.8.0-28.30~20.04.1","5.8.0-29.31~20.04.1","5.8.0-31.33~20.04.1","5.8.0-33.36~20.04.1","5.8.0-34.37~20.04.2","5.8.0-36.40~20.04.1","5.8.0-38.43~20.04.1","5.8.0-40.45~20.04.1","5.8.0-41.46~20.04.1","5.8.0-43.49~20.04.1","5.8.0-44.50~20.04.1","5.8.0-45.51~20.04.1","5.8.0-48.54~20.04.1","5.8.0-49.55~20.04.1","5.8.0-50.56~20.04.1","5.8.0-53.60~20.04.1","5.8.0-55.62~20.04.1","5.8.0-59.66~20.04.1","5.8.0-63.71~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-intel-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1007.7","5.13.0-1008.8","5.13.0-1009.9","5.13.0-1010.10","5.13.0-1011.11","5.13.0-1014.15","5.13.0-1017.19"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.10.0-1008.9","5.10.0-1011.12","5.10.0-1013.14","5.10.0-1014.15","5.10.0-1016.17","5.10.0-1017.18","5.10.0-1019.20","5.10.0-1021.22","5.10.0-1022.23","5.10.0-1023.24","5.10.0-1025.26","5.10.0-1026.27","5.10.0-1029.30","5.10.0-1032.33","5.10.0-1033.34","5.10.0-1034.35","5.10.0-1038.40","5.10.0-1044.46","5.10.0-1045.47","5.10.0-1049.51","5.10.0-1050.52","5.10.0-1051.53","5.10.0-1052.54","5.10.0-1053.55","5.10.0-1055.58","5.10.0-1057.61"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10","5.13.0-1010.11","5.13.0-1012.16","5.13.0-1014.18","5.13.0-1017.21","5.13.0-1019.23","5.13.0-1020.24","5.13.0-1021.25","5.13.0-1022.26","5.13.0-1026.32","5.13.0-1028.35","5.13.0-1029.36"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.14.0-1004.4","5.14.0-1005.5","5.14.0-1007.7","5.14.0-1008.8","5.14.0-1010.10","5.14.0-1011.11","5.14.0-1013.13","5.14.0-1018.19","5.14.0-1020.22","5.14.0-1022.24","5.14.0-1024.26","5.14.0-1027.30","5.14.0-1029.32","5.14.0-1031.34","5.14.0-1032.35","5.14.0-1033.36","5.14.0-1034.37","5.14.0-1036.40","5.14.0-1038.42","5.14.0-1042.47","5.14.0-1044.49","5.14.0-1045.51","5.14.0-1046.53","5.14.0-1047.54","5.14.0-1048.55","5.14.0-1049.56","5.14.0-1050.57","5.14.0-1051.58","5.14.0-1052.59","5.14.0-1054.61","5.14.0-1055.62","5.14.0-1056.63","5.14.0-1057.64","5.14.0-1058.66","5.14.0-1059.67"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.6.0-1007.7","5.6.0-1008.8","5.6.0-1010.10","5.6.0-1011.11","5.6.0-1013.13","5.6.0-1017.17","5.6.0-1018.18","5.6.0-1020.20","5.6.0-1021.21","5.6.0-1023.23","5.6.0-1026.26","5.6.0-1027.27","5.6.0-1028.28","5.6.0-1031.32","5.6.0-1032.33","5.6.0-1033.35","5.6.0-1034.36","5.6.0-1035.37","5.6.0-1036.39","5.6.0-1039.43","5.6.0-1042.46","5.6.0-1047.51","5.6.0-1048.52","5.6.0-1050.54","5.6.0-1052.56","5.6.0-1053.57","5.6.0-1054.58","5.6.0-1055.59","5.6.0-1056.60"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1008.8~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1011.13~20.04.2","5.13.0-1015.19~20.04.1","5.13.0-1016.20~20.04.1","5.13.0-1018.22~20.04.1","5.13.0-1021.26~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1030.35~20.04.1","5.13.0-1033.39~20.04.1","5.13.0-1034.40~20.04.1","5.13.0-1036.43~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1031.32~20.04.2","5.8.0-1033.34~20.04.1","5.8.0-1034.35~20.04.2","5.8.0-1037.38~20.04.1","5.8.0-1038.39~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8","5.3.0-1014.16","5.3.0-1015.17","5.3.0-1017.19","5.4.0-1004.4","5.4.0-1006.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-24.28","5.4.0-26.30","5.4.0-27.31","5.4.0-28.32","5.4.0-30.34","5.4.0-31.35","5.4.0-33.37","5.4.0-34.38","5.4.0-36.41","5.4.0-37.42","5.4.0-39.44","5.4.0-40.45"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1018.19~20.04.2","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1024.25~20.04.1","5.11.0-1026.28~20.04.1","5.11.0-1028.31~20.04.1","5.11.0-1029.32~20.04.1","5.11.0-1030.34","5.11.0-1031.35"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-14.16~20.04.1","5.8.0-14.16~20.04.3","5.8.0-16.18~20.04.1","5.8.0-17.19~20.04.1","5.8.0-18.20~20.04.1","5.8.0-20.22~20.04.1","5.8.0-22.24~20.04.1","5.8.0-25.27~20.04.1","5.8.0-26.28~20.04.1","5.8.0-29.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-allwinner-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1007.7~22.04.1","5.19.0-1009.9~22.04.1","5.19.0-1010.10~22.04.1","5.19.0-1011.11~22.04.1","5.19.0-1012.12~22.04.1","5.19.0-1013.13~22.04.1","5.19.0-1014.14~22.04.1","5.19.0-1015.15~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1019.20~22.04.1","5.19.0-1020.21~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1026.27~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1029.30~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1008.8~22.04.1","6.5.0-1010.10~22.04.1","6.5.0-1011.11~22.04.1","6.5.0-1012.12~22.04.1","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.2","6.5.0-1018.18~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1021.21~22.04.1","6.5.0-1022.22~22.04.1","6.5.0-1023.23~22.04.1","6.5.0-1024.24~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.21~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1025.28~22.04.1","5.19.0-1026.29~22.04.1","5.19.0-1027.30~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1","6.2.0-1019.19~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.7~22.04.1","6.5.0-1009.9~22.04.1","6.5.0-1010.10~22.04.1","6.5.0-1011.11~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.1","6.5.0-1018.19~22.04.2","6.5.0-1019.20~22.04.1","6.5.0-1021.22~22.04.1","6.5.0-1022.23~22.04.1","6.5.0-1023.24~22.04.1","6.5.0-1024.25~22.04.1","6.5.0-1025.26~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1025.28~22.04.1.1","5.19.0-1026.29~22.04.1.1","5.19.0-1027.30~22.04.2.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1.1","6.2.0-1009.9~22.04.3.1","6.2.0-1011.11~22.04.1.1","6.2.0-1012.12~22.04.1.1","6.2.0-1014.14~22.04.1.1","6.2.0-1015.15~22.04.1.1","6.2.0-1016.16~22.04.1.1","6.2.0-1017.17~22.04.1.1","6.2.0-1018.18~22.04.1.1","6.2.0-1019.19~22.04.1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.22~22.04.2","5.19.0-1021.23~22.04.1","5.19.0-1022.24~22.04.1","5.19.0-1024.26~22.04.1","5.19.0-1025.27~22.04.1","5.19.0-1026.28~22.04.1","5.19.0-1027.29~22.04.1","5.19.0-1030.32~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1011.11~22.04.3","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1016.18~22.04.1","6.2.0-1017.19~22.04.1","6.2.0-1018.20~22.04.1","6.2.0-1019.21~22.04.1","6.2.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1010.10~22.04.3","6.5.0-1011.11~22.04.1","6.5.0-1013.13~22.04.1","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.1","6.5.0-1018.18~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1022.24~22.04.1","6.5.0-1023.25~22.04.1","6.5.0-1024.26~22.04.1","6.5.0-1025.27~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-28.29~22.04.1","5.19.0-32.33~22.04.1","5.19.0-35.36~22.04.1","5.19.0-38.39~22.04.1","5.19.0-40.41~22.04.1","5.19.0-41.42~22.04.1","5.19.0-42.43~22.04.1","5.19.0-43.44~22.04.1","5.19.0-45.46~22.04.1","5.19.0-46.47~22.04.1","5.19.0-50.50"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-25.25~22.04.2","6.2.0-26.26~22.04.1","6.2.0-31.31~22.04.1","6.2.0-32.32~22.04.1","6.2.0-33.33~22.04.1","6.2.0-34.34~22.04.1","6.2.0-35.35~22.04.1","6.2.0-36.37~22.04.1","6.2.0-37.38~22.04.1","6.2.0-39.40~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-14.14~22.04.1","6.5.0-15.15~22.04.1","6.5.0-17.17~22.04.1","6.5.0-18.18~22.04.1","6.5.0-21.21~22.04.1","6.5.0-25.25~22.04.1","6.5.0-26.26~22.04.1","6.5.0-27.28~22.04.1","6.5.0-28.29~22.04.1","6.5.0-35.35~22.04.1","6.5.0-41.41~22.04.2","6.5.0-44.44~22.04.1","6.5.0-45.45~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-intel-iot-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1073.75"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1030.30"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-14.14.1~22.04.1","6.5.0-15.15.1.1~22.04.1","6.5.0-17.17.1.1.1~22.04.1","6.5.0-21.21.1~22.04.1","6.5.0-25.25.1~22.04.1","6.5.0-26.26.1~22.04.1","6.5.0-27.28.1~22.04.1","6.5.0-28.29.1~22.04.1","6.5.0-35.35.1~22.04.1","6.5.0-41.41.1~22.04.1","6.5.0-42.42.1~22.04.1","6.5.0-44.44.1~22.04.1","6.5.0-45.45.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1003.3~22.04.1","6.2.0-1009.9","6.2.0-1010.10","6.2.0-1011.11","6.2.0-1012.12","6.2.0-1013.13","6.2.0-1015.15"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1004.4","6.5.0-1007.7","6.5.0-1013.13","6.5.0-1014.14","6.5.0-1015.15","6.5.0-1018.18","6.5.0-1019.19","6.5.0-1021.22","6.5.0-1022.23","6.5.0-1023.24","6.5.0-1024.25"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-5.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.17.0-1003.3","5.17.0-1004.4","5.17.0-1006.6","5.17.0-1011.12","5.17.0-1012.13","5.17.0-1013.14","5.17.0-1014.15","5.17.0-1015.16","5.17.0-1016.17","5.17.0-1017.18","5.17.0-1018.19","5.17.0-1019.20","5.17.0-1020.21","5.17.0-1021.22","5.17.0-1024.25","5.17.0-1025.26","5.17.0-1026.27","5.17.0-1027.28","5.17.0-1028.29","5.17.0-1029.30","5.17.0-1030.31","5.17.0-1031.32","5.17.0-1032.33","5.17.0-1033.34","5.17.0-1034.35","5.17.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.0-1006.6","6.0.0-1007.7","6.0.0-1008.8","6.0.0-1009.9","6.0.0-1010.10","6.0.0-1011.11","6.0.0-1012.12","6.0.0-1013.13","6.0.0-1014.14","6.0.0-1015.15","6.0.0-1016.16","6.0.0-1017.17","6.0.0-1018.18","6.0.0-1019.19","6.0.0-1020.20","6.0.0-1021.21"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.0-1004.4","6.1.0-1006.6","6.1.0-1007.7","6.1.0-1008.8","6.1.0-1009.9","6.1.0-1010.10","6.1.0-1012.12","6.1.0-1013.13","6.1.0-1014.14","6.1.0-1015.15","6.1.0-1016.16","6.1.0-1017.17","6.1.0-1019.19","6.1.0-1020.20","6.1.0-1021.21","6.1.0-1022.22","6.1.0-1023.23","6.1.0-1024.24","6.1.0-1025.25","6.1.0-1026.26","6.1.0-1027.27","6.1.0-1028.28","6.1.0-1029.29","6.1.0-1033.33","6.1.0-1034.34","6.1.0-1035.35","6.1.0-1036.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1003.3","6.5.0-1004.4","6.5.0-1006.6","6.5.0-1007.7","6.5.0-1008.8","6.5.0-1009.10","6.5.0-1011.12","6.5.0-1013.14","6.5.0-1014.15","6.5.0-1015.16","6.5.0-1016.17","6.5.0-1018.19","6.5.0-1019.20","6.5.0-1020.21","6.5.0-1022.23","6.5.0-1023.24","6.5.0-1024.25","6.5.0-1025.26","6.5.0-1027.28"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1013.13~22.04.4","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1018.18~22.04.1","6.5.0-1019.19~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1021.21~22.04.1","6.5.0-1023.23~22.04.1","6.5.0-1024.24~22.04.1","6.5.0-1025.25~22.04.1","6.5.0-1026.26~22.04.1","6.5.0-1027.27~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1032.35"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1004.4","5.13.0-1006.6+22.04.1","5.13.0-1007.7+22.04.1","5.13.0-1010.11+22.04.1","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1006.6","5.15.0-1007.7","5.15.0-1008.8","5.15.0-1011.12","5.15.0-1012.13","5.15.0-1014.16","5.15.0-1015.17","5.15.0-1016.18","5.15.0-1017.19","5.15.0-1018.21","5.15.0-1019.22","5.15.0-1020.23","5.15.0-1022.26","5.15.0-1023.27","5.15.0-1026.30","5.15.0-1027.31","5.15.0-1028.32"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1012.13~22.04.1","5.19.0-1015.16~22.04.1","5.19.0-1016.17~22.04.1","5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1","5.19.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-17.17.1.1~22.04.1","6.5.0-21.21.1~22.04.1","6.5.0-25.25.1~22.04.1","6.5.0-26.26.1~22.04.1","6.5.0-27.28.1~22.04.1","6.5.0-28.29.1~22.04.1","6.5.0-35.35.1~22.04.1","6.5.0-40.40.1~22.04.1","6.5.0-42.42.1~22.04.1","6.5.0-45.45.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1014.16~22.04.1","5.19.0-1015.17~22.04.1","5.19.0-1016.18~22.04.1","5.19.0-1017.19~22.04.1","5.19.0-1018.20~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1006.7~22.04.1","6.2.0-1007.8~22.04.1","6.2.0-1009.10~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.8~22.04.1","6.5.0-1008.9~22.04.1","6.5.0-1009.10~22.04.1","6.5.0-1010.11~22.04.1","6.5.0-1011.12~22.04.1","6.5.0-1012.13~22.04.1","6.5.0-1014.15~22.04.1","6.5.0-1015.16~22.04.1","6.5.0-1016.17~22.04.1","6.5.0-1017.18~22.04.1","6.5.0-1018.19~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.0-1015.15~24.04.1"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1009.9~24.04.1","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1008.8~24.04.1","6.11.0-1012.12~24.04.1","6.11.0-1013.13~24.04.1","6.11.0-1014.14~24.04.1","6.11.0-1015.15~24.04.1","6.11.0-1017.17~24.04.1","6.11.0-1018.18~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.0-1014.14~24.04.1"}]}],"versions":["6.14.0-1010.10~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-nvidia-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.0-1007.7"}]}],"versions":["6.14.0-1003.3","6.14.0-1006.6"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1006.6~24.04.2","6.11.0-1011.11~24.04.1","6.11.0-1013.13~24.04.1","6.11.0-1014.14~24.04.1","6.11.0-1015.15~24.04.1","6.11.0-1016.16~24.04.1","6.11.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.0-1018.19~24.04.1"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1014.15~24.04.1","6.14.0-1015.16~24.04.1","6.14.0-1016.17~24.04.1","6.14.0-1017.18~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-hwe-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-17.17~24.04.2","6.11.0-19.19~24.04.1","6.11.0-21.21~24.04.1","6.11.0-24.24~24.04.1","6.11.0-25.25~24.04.1","6.11.0-26.26~24.04.1","6.11.0-28.28~24.04.1","6.11.0-29.29~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency-hwe-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1009.10~24.04.1","6.11.0-1011.12~24.04.1","6.11.0-1012.13~24.04.1","6.11.0-1013.14~24.04.1","6.11.0-1014.15~24.04.1","6.11.0-1015.16~24.04.2","6.11.0-1016.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1002.2","6.11.0-1003.3","6.11.0-1007.7","6.11.0-1010.10","6.11.0-1011.11","6.11.0-1012.12","6.11.0-1013.13","6.11.0-1016.16"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1007.7","6.11.0-1008.8","6.11.0-1009.9","6.11.0-1010.10","6.11.0-1011.11","6.11.0-1012.12","6.11.0-1013.13","6.11.0-1015.15","6.11.0-1016.16","6.11.0-1017.17","6.11.0-1018.18","6.11.0-1020.20","6.11.0-1021.21","6.11.0-1022.22","6.11.0-1023.23","6.11.0-1024.24","6.11.0-1025.25","6.11.0-1027.27"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.0-1014.14"}]}],"versions":["6.14.0-1004.4","6.14.0-1005.5","6.14.0-1006.6","6.14.0-1007.7","6.14.0-1008.8","6.14.0-1010.10","6.14.0-1011.11","6.14.0-1012.12","6.14.0-1013.13"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1016.16","6.8.0-1017.17","6.8.0-1018.18","6.8.0-1019.19","6.8.0-1020.20","6.8.0-1024.24","6.8.0-1025.25","6.8.0-1026.26","6.8.0-1027.27","6.8.0-1028.28","6.8.0-1029.29","6.8.0-1030.30","6.8.0-1031.31","6.8.0-1032.32"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.0-1015.15~24.04.1"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1009.9~24.04.1","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-2019.20"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.1-1015.16"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-9.9.1","6.8.0-20.20.1","6.8.0-28.28.1","6.8.0-31.31.1","6.8.0-35.35.1","6.8.0-36.36.1","6.8.0-38.38.1","6.8.0-39.39.1","6.8.0-40.40.1","6.8.0-41.41.1","6.8.0-44.44.1","6.8.0-47.47.1","6.8.0-48.48.1","6.8.0-49.49.1","6.8.0-50.51.1","6.8.0-51.52.1","6.8.0-52.53.1","6.8.0-53.55.1","6.8.0-55.57.1","6.8.0-56.58.1","6.8.0-57.59.1","6.8.0-58.60.1","6.8.0-59.61.1","6.8.0-60.63.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-22.22.1~24.04.1","6.14.0-23.23.1~24.04.1","6.14.0-24.24.1~24.04.1","6.14.0-27.27.1~24.04.1","6.14.0-28.28.1~24.04.1","6.14.0-29.29.1~24.04.1","6.14.0-32.32.1~24.04.1","6.14.0-33.33.1~24.04.1","6.14.0-34.34.1~24.04.1","6.14.0-35.35.1~24.04.1","6.14.0-36.36.1~24.04.1","6.14.0-37.37.1~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.14.0-1014.14~24.04.1"}]}],"versions":["6.14.0-1003.3~24.04.3","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1003.3","6.17.0-1004.4","6.17.0-1005.5","6.17.0-1007.7","6.17.0-1008.8","6.17.0-1010.10","6.17.0-1012.12","6.17.0-1014.14","6.17.0-1015.15","6.17.0-1017.17"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"dtb-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1.160000.2.19"}]}],"bundled":894},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.37.1"}]}],"bundled":894}],"products":[{"vendor":"linux","product":"linux"}],"references":[{"url":"https://git.kernel.org/stable/c/50998b0ae7d9d552e96d8b7239981cf05f65eff5","tags":["web","report"]},{"url":"https://git.kernel.org/stable/c/f16769241594be59387b56ab525e327f54377e60","tags":["web","report"]},{"url":"https://git.kernel.org/stable/c/3a3c6d61577dbb23c09df3e21f6f9eda1ecd634b","tags":["web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40216","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-vv4p-ph8q-2hhx"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-40216","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40216.json","tags":["advisory"]},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-40216","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623066-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1185845","tags":["report"]},{"url":"https://bugzilla.suse.com/1234634","tags":["report"]},{"url":"https://bugzilla.suse.com/1237449","tags":["report"]},{"url":"https://bugzilla.suse.com/1243603","tags":["report"]},{"url":"https://bugzilla.suse.com/1246179","tags":["report"]},{"url":"https://bugzilla.suse.com/1246182","tags":["report"]},{"url":"https://bugzilla.suse.com/1247455","tags":["report"]},{"url":"https://bugzilla.suse.com/1248480","tags":["report"]},{"url":"https://bugzilla.suse.com/1248611","tags":["report"]},{"url":"https://bugzilla.suse.com/1251966","tags":["report"]},{"url":"https://bugzilla.suse.com/1252682","tags":["report"]},{"url":"https://bugzilla.suse.com/1253262","tags":["report"]},{"url":"https://bugzilla.suse.com/1253434","tags":["report"]},{"url":"https://bugzilla.suse.com/1253454","tags":["report"]},{"url":"https://bugzilla.suse.com/1254306","tags":["report"]},{"url":"https://bugzilla.suse.com/1255224","tags":["report"]},{"url":"https://bugzilla.suse.com/1255250","tags":["report"]},{"url":"https://bugzilla.suse.com/1255441","tags":["report"]},{"url":"https://bugzilla.suse.com/1255687","tags":["report"]},{"url":"https://bugzilla.suse.com/1257721","tags":["report"]},{"url":"https://bugzilla.suse.com/1257777","tags":["report"]},{"url":"https://bugzilla.suse.com/1258472","tags":["report"]},{"url":"https://bugzilla.suse.com/1258718","tags":["report"]},{"url":"https://bugzilla.suse.com/1259329","tags":["report"]},{"url":"https://bugzilla.suse.com/1259762","tags":["report"]},{"url":"https://bugzilla.suse.com/1259764","tags":["report"]},{"url":"https://bugzilla.suse.com/1259866","tags":["report"]},{"url":"https://bugzilla.suse.com/1259955","tags":["report"]},{"url":"https://bugzilla.suse.com/1260012","tags":["report"]},{"url":"https://bugzilla.suse.com/1260347","tags":["report"]},{"url":"https://bugzilla.suse.com/1260553","tags":["report"]},{"url":"https://bugzilla.suse.com/1260593","tags":["report"]},{"url":"https://bugzilla.suse.com/1261250","tags":["report"]},{"url":"https://bugzilla.suse.com/1261562","tags":["report"]},{"url":"https://bugzilla.suse.com/1261590","tags":["report"]},{"url":"https://bugzilla.suse.com/1262160","tags":["report"]},{"url":"https://bugzilla.suse.com/1262391","tags":["report"]},{"url":"https://bugzilla.suse.com/1262573","tags":["report"]},{"url":"https://bugzilla.suse.com/1262602","tags":["report"]},{"url":"https://bugzilla.suse.com/1262603","tags":["report"]},{"url":"https://bugzilla.suse.com/1262605","tags":["report"]},{"url":"https://bugzilla.suse.com/1262614","tags":["report"]},{"url":"https://bugzilla.suse.com/1262637","tags":["report"]},{"url":"https://bugzilla.suse.com/1262639","tags":["report"]},{"url":"https://bugzilla.suse.com/1262640","tags":["report"]},{"url":"https://bugzilla.suse.com/1262652","tags":["report"]},{"url":"https://bugzilla.suse.com/1262653","tags":["report"]},{"url":"https://bugzilla.suse.com/1262655","tags":["report"]},{"url":"https://bugzilla.suse.com/1262658","tags":["report"]},{"url":"https://bugzilla.suse.com/1262659","tags":["report"]},{"url":"https://bugzilla.suse.com/1262663","tags":["report"]},{"url":"https://bugzilla.suse.com/1262678","tags":["report"]},{"url":"https://bugzilla.suse.com/1262679","tags":["report"]},{"url":"https://bugzilla.suse.com/1262723","tags":["report"]},{"url":"https://bugzilla.suse.com/1262734","tags":["report"]},{"url":"https://bugzilla.suse.com/1262745","tags":["report"]},{"url":"https://bugzilla.suse.com/1262746","tags":["report"]},{"url":"https://bugzilla.suse.com/1262751","tags":["report"]},{"url":"https://bugzilla.suse.com/1262757","tags":["report"]},{"url":"https://bugzilla.suse.com/1262768","tags":["report"]},{"url":"https://bugzilla.suse.com/1262770","tags":["report"]},{"url":"https://bugzilla.suse.com/1262771","tags":["report"]},{"url":"https://bugzilla.suse.com/1262992","tags":["report"]},{"url":"https://bugzilla.suse.com/1262993","tags":["report"]},{"url":"https://bugzilla.suse.com/1263008","tags":["report"]},{"url":"https://bugzilla.suse.com/1263010","tags":["report"]},{"url":"https://bugzilla.suse.com/1263011","tags":["report"]},{"url":"https://bugzilla.suse.com/1263013","tags":["report"]},{"url":"https://bugzilla.suse.com/1263014","tags":["report"]},{"url":"https://bugzilla.suse.com/1263016","tags":["report"]},{"url":"https://bugzilla.suse.com/1263017","tags":["report"]},{"url":"https://bugzilla.suse.com/1263020","tags":["report"]},{"url":"https://bugzilla.suse.com/1263025","tags":["report"]},{"url":"https://bugzilla.suse.com/1263030","tags":["report"]},{"url":"https://bugzilla.suse.com/1263031","tags":["report"]},{"url":"https://bugzilla.suse.com/1263045","tags":["report"]},{"url":"https://bugzilla.suse.com/1263055","tags":["report"]},{"url":"https://bugzilla.suse.com/1263059","tags":["report"]},{"url":"https://bugzilla.suse.com/1263061","tags":["report"]},{"url":"https://bugzilla.suse.com/1263065","tags":["report"]},{"url":"https://bugzilla.suse.com/1263073","tags":["report"]},{"url":"https://bugzilla.suse.com/1263075","tags":["report"]},{"url":"https://bugzilla.suse.com/1263097","tags":["report"]},{"url":"https://bugzilla.suse.com/1263111","tags":["report"]},{"url":"https://bugzilla.suse.com/1263122","tags":["report"]},{"url":"https://bugzilla.suse.com/1263123","tags":["report"]},{"url":"https://bugzilla.suse.com/1263124","tags":["report"]},{"url":"https://bugzilla.suse.com/1263128","tags":["report"]},{"url":"https://bugzilla.suse.com/1263130","tags":["report"]},{"url":"https://bugzilla.suse.com/1263134","tags":["report"]},{"url":"https://bugzilla.suse.com/1263139","tags":["report"]},{"url":"https://bugzilla.suse.com/1263142","tags":["report"]},{"url":"https://bugzilla.suse.com/1263145","tags":["report"]},{"url":"https://bugzilla.suse.com/1263152","tags":["report"]},{"url":"https://bugzilla.suse.com/1263167","tags":["report"]},{"url":"https://bugzilla.suse.com/1263170","tags":["report"]},{"url":"https://bugzilla.suse.com/1263173","tags":["report"]},{"url":"https://bugzilla.suse.com/1263175","tags":["report"]},{"url":"https://bugzilla.suse.com/1263491","tags":["report"]},{"url":"https://bugzilla.suse.com/1263493","tags":["report"]},{"url":"https://bugzilla.suse.com/1263495","tags":["report"]},{"url":"https://bugzilla.suse.com/1263539","tags":["report"]},{"url":"https://bugzilla.suse.com/1263560","tags":["report"]},{"url":"https://bugzilla.suse.com/1263588","tags":["report"]},{"url":"https://bugzilla.suse.com/1263591","tags":["report"]},{"url":"https://bugzilla.suse.com/1263598","tags":["report"]},{"url":"https://bugzilla.suse.com/1263600","tags":["report"]},{"url":"https://bugzilla.suse.com/1263657","tags":["report"]},{"url":"https://bugzilla.suse.com/1263718","tags":["report"]},{"url":"https://bugzilla.suse.com/1263723","tags":["report"]},{"url":"https://bugzilla.suse.com/1263776","tags":["report"]},{"url":"https://bugzilla.suse.com/1263777","tags":["report"]},{"url":"https://bugzilla.suse.com/1263778","tags":["report"]},{"url":"https://bugzilla.suse.com/1263780","tags":["report"]},{"url":"https://bugzilla.suse.com/1263782","tags":["report"]},{"url":"https://bugzilla.suse.com/1263785","tags":["report"]},{"url":"https://bugzilla.suse.com/1263786","tags":["report"]},{"url":"https://bugzilla.suse.com/1263788","tags":["report"]},{"url":"https://bugzilla.suse.com/1263790","tags":["report"]},{"url":"https://bugzilla.suse.com/1263797","tags":["report"]},{"url":"https://bugzilla.suse.com/1263806","tags":["report"]},{"url":"https://bugzilla.suse.com/1263876","tags":["report"]},{"url":"https://bugzilla.suse.com/1263879","tags":["report"]},{"url":"https://bugzilla.suse.com/1263880","tags":["report"]},{"url":"https://bugzilla.suse.com/1263904","tags":["report"]},{"url":"https://bugzilla.suse.com/1263905","tags":["report"]},{"url":"https://bugzilla.suse.com/1263911","tags":["report"]},{"url":"https://bugzilla.suse.com/1263917","tags":["report"]},{"url":"https://bugzilla.suse.com/1263918","tags":["report"]},{"url":"https://bugzilla.suse.com/1263919","tags":["report"]},{"url":"https://bugzilla.suse.com/1263921","tags":["report"]},{"url":"https://bugzilla.suse.com/1263923","tags":["report"]},{"url":"https://bugzilla.suse.com/1263945","tags":["report"]},{"url":"https://bugzilla.suse.com/1263975","tags":["report"]},{"url":"https://bugzilla.suse.com/1263999","tags":["report"]},{"url":"https://bugzilla.suse.com/1264003","tags":["report"]},{"url":"https://bugzilla.suse.com/1264006","tags":["report"]},{"url":"https://bugzilla.suse.com/1264008","tags":["report"]},{"url":"https://bugzilla.suse.com/1264009","tags":["report"]},{"url":"https://bugzilla.suse.com/1264013","tags":["report"]},{"url":"https://bugzilla.suse.com/1264019","tags":["report"]},{"url":"https://bugzilla.suse.com/1264030","tags":["report"]},{"url":"https://bugzilla.suse.com/1264032","tags":["report"]},{"url":"https://bugzilla.suse.com/1264033","tags":["report"]},{"url":"https://bugzilla.suse.com/1264035","tags":["report"]},{"url":"https://bugzilla.suse.com/1264039","tags":["report"]},{"url":"https://bugzilla.suse.com/1264041","tags":["report"]},{"url":"https://bugzilla.suse.com/1264044","tags":["report"]},{"url":"https://bugzilla.suse.com/1264048","tags":["report"]},{"url":"https://bugzilla.suse.com/1264053","tags":["report"]},{"url":"https://bugzilla.suse.com/1264065","tags":["report"]},{"url":"https://bugzilla.suse.com/1264070","tags":["report"]},{"url":"https://bugzilla.suse.com/1264071","tags":["report"]},{"url":"https://bugzilla.suse.com/1264073","tags":["report"]},{"url":"https://bugzilla.suse.com/1264074","tags":["report"]},{"url":"https://bugzilla.suse.com/1264075","tags":["report"]},{"url":"https://bugzilla.suse.com/1264076","tags":["report"]},{"url":"https://bugzilla.suse.com/1264079","tags":["report"]},{"url":"https://bugzilla.suse.com/1264080","tags":["report"]},{"url":"https://bugzilla.suse.com/1264084","tags":["report"]},{"url":"https://bugzilla.suse.com/1264087","tags":["report"]},{"url":"https://bugzilla.suse.com/1264088","tags":["report"]},{"url":"https://bugzilla.suse.com/1264089","tags":["report"]},{"url":"https://bugzilla.suse.com/1264090","tags":["report"]},{"url":"https://bugzilla.suse.com/1264093","tags":["report"]},{"url":"https://bugzilla.suse.com/1264100","tags":["report"]},{"url":"https://bugzilla.suse.com/1264101","tags":["report"]},{"url":"https://bugzilla.suse.com/1264110","tags":["report"]},{"url":"https://bugzilla.suse.com/1264116","tags":["report"]},{"url":"https://bugzilla.suse.com/1264117","tags":["report"]},{"url":"https://bugzilla.suse.com/1264121","tags":["report"]},{"url":"https://bugzilla.suse.com/1264122","tags":["report"]},{"url":"https://bugzilla.suse.com/1264124","tags":["report"]},{"url":"https://bugzilla.suse.com/1264125","tags":["report"]},{"url":"https://bugzilla.suse.com/1264129","tags":["report"]},{"url":"https://bugzilla.suse.com/1264137","tags":["report"]},{"url":"https://bugzilla.suse.com/1264142","tags":["report"]},{"url":"https://bugzilla.suse.com/1264184","tags":["report"]},{"url":"https://bugzilla.suse.com/1264188","tags":["report"]},{"url":"https://bugzilla.suse.com/1264189","tags":["report"]},{"url":"https://bugzilla.suse.com/1264190","tags":["report"]},{"url":"https://bugzilla.suse.com/1264197","tags":["report"]},{"url":"https://bugzilla.suse.com/1264228","tags":["report"]},{"url":"https://bugzilla.suse.com/1264235","tags":["report"]},{"url":"https://bugzilla.suse.com/1264237","tags":["report"]},{"url":"https://bugzilla.suse.com/1264247","tags":["report"]},{"url":"https://bugzilla.suse.com/1264257","tags":["report"]},{"url":"https://bugzilla.suse.com/1264267","tags":["report"]},{"url":"https://bugzilla.suse.com/1264296","tags":["report"]},{"url":"https://bugzilla.suse.com/1264303","tags":["report"]},{"url":"https://bugzilla.suse.com/1264308","tags":["report"]},{"url":"https://bugzilla.suse.com/1264313","tags":["report"]},{"url":"https://bugzilla.suse.com/1264317","tags":["report"]},{"url":"https://bugzilla.suse.com/1264319","tags":["report"]},{"url":"https://bugzilla.suse.com/1264321","tags":["report"]},{"url":"https://bugzilla.suse.com/1264322","tags":["report"]},{"url":"https://bugzilla.suse.com/1264331","tags":["report"]},{"url":"https://bugzilla.suse.com/1264336","tags":["report"]},{"url":"https://bugzilla.suse.com/1264338","tags":["report"]},{"url":"https://bugzilla.suse.com/1264339","tags":["report"]},{"url":"https://bugzilla.suse.com/1264340","tags":["report"]},{"url":"https://bugzilla.suse.com/1264365","tags":["report"]},{"url":"https://bugzilla.suse.com/1264377","tags":["report"]},{"url":"https://bugzilla.suse.com/1264379","tags":["report"]},{"url":"https://bugzilla.suse.com/1264386","tags":["report"]},{"url":"https://bugzilla.suse.com/1264387","tags":["report"]},{"url":"https://bugzilla.suse.com/1264388","tags":["report"]},{"url":"https://bugzilla.suse.com/1264414","tags":["report"]},{"url":"https://bugzilla.suse.com/1264416","tags":["report"]},{"url":"https://bugzilla.suse.com/1264417","tags":["report"]},{"url":"https://bugzilla.suse.com/1264418","tags":["report"]},{"url":"https://bugzilla.suse.com/1264419","tags":["report"]},{"url":"https://bugzilla.suse.com/1264422","tags":["report"]},{"url":"https://bugzilla.suse.com/1264423","tags":["report"]},{"url":"https://bugzilla.suse.com/1264424","tags":["report"]},{"url":"https://bugzilla.suse.com/1264425","tags":["report"]},{"url":"https://bugzilla.suse.com/1264430","tags":["report"]},{"url":"https://bugzilla.suse.com/1264431","tags":["report"]},{"url":"https://bugzilla.suse.com/1264436","tags":["report"]},{"url":"https://bugzilla.suse.com/1264442","tags":["report"]},{"url":"https://bugzilla.suse.com/1264446","tags":["report"]},{"url":"https://bugzilla.suse.com/1264451","tags":["report"]},{"url":"https://bugzilla.suse.com/1264452","tags":["report"]},{"url":"https://bugzilla.suse.com/1264473","tags":["report"]},{"url":"https://bugzilla.suse.com/1264475","tags":["report"]},{"url":"https://bugzilla.suse.com/1264476","tags":["report"]},{"url":"https://bugzilla.suse.com/1264477","tags":["report"]},{"url":"https://bugzilla.suse.com/1264479","tags":["report"]},{"url":"https://bugzilla.suse.com/1264480","tags":["report"]},{"url":"https://bugzilla.suse.com/1264482","tags":["report"]},{"url":"https://bugzilla.suse.com/1264520","tags":["report"]},{"url":"https://bugzilla.suse.com/1264526","tags":["report"]},{"url":"https://bugzilla.suse.com/1264530","tags":["report"]},{"url":"https://bugzilla.suse.com/1264531","tags":["report"]},{"url":"https://bugzilla.suse.com/1264534","tags":["report"]},{"url":"https://bugzilla.suse.com/1264537","tags":["report"]},{"url":"https://bugzilla.suse.com/1264538","tags":["report"]},{"url":"https://bugzilla.suse.com/1264539","tags":["report"]},{"url":"https://bugzilla.suse.com/1264540","tags":["report"]},{"url":"https://bugzilla.suse.com/1264543","tags":["report"]},{"url":"https://bugzilla.suse.com/1264551","tags":["report"]},{"url":"https://bugzilla.suse.com/1264553","tags":["report"]},{"url":"https://bugzilla.suse.com/1264558","tags":["report"]},{"url":"https://bugzilla.suse.com/1264560","tags":["report"]},{"url":"https://bugzilla.suse.com/1264562","tags":["report"]},{"url":"https://bugzilla.suse.com/1264564","tags":["report"]},{"url":"https://bugzilla.suse.com/1264566","tags":["report"]},{"url":"https://bugzilla.suse.com/1264584","tags":["report"]},{"url":"https://bugzilla.suse.com/1264590","tags":["report"]},{"url":"https://bugzilla.suse.com/1264592","tags":["report"]},{"url":"https://bugzilla.suse.com/1264594","tags":["report"]},{"url":"https://bugzilla.suse.com/1264598","tags":["report"]},{"url":"https://bugzilla.suse.com/1264600","tags":["report"]},{"url":"https://bugzilla.suse.com/1264601","tags":["report"]},{"url":"https://bugzilla.suse.com/1264613","tags":["report"]},{"url":"https://bugzilla.suse.com/1264615","tags":["report"]},{"url":"https://bugzilla.suse.com/1264616","tags":["report"]},{"url":"https://bugzilla.suse.com/1264618","tags":["report"]},{"url":"https://bugzilla.suse.com/1264620","tags":["report"]},{"url":"https://bugzilla.suse.com/1264626","tags":["report"]},{"url":"https://bugzilla.suse.com/1264630","tags":["report"]},{"url":"https://bugzilla.suse.com/1264631","tags":["report"]},{"url":"https://bugzilla.suse.com/1264633","tags":["report"]},{"url":"https://bugzilla.suse.com/1264634","tags":["report"]},{"url":"https://bugzilla.suse.com/1264637","tags":["report"]},{"url":"https://bugzilla.suse.com/1264640","tags":["report"]},{"url":"https://bugzilla.suse.com/1264642","tags":["report"]},{"url":"https://bugzilla.suse.com/1264644","tags":["report"]},{"url":"https://bugzilla.suse.com/1264645","tags":["report"]},{"url":"https://bugzilla.suse.com/1264646","tags":["report"]},{"url":"https://bugzilla.suse.com/1264647","tags":["report"]},{"url":"https://bugzilla.suse.com/1264649","tags":["report"]},{"url":"https://bugzilla.suse.com/1264651","tags":["report"]},{"url":"https://bugzilla.suse.com/1264668","tags":["report"]},{"url":"https://bugzilla.suse.com/1264671","tags":["report"]},{"url":"https://bugzilla.suse.com/1264677","tags":["report"]},{"url":"https://bugzilla.suse.com/1264678","tags":["report"]},{"url":"https://bugzilla.suse.com/1264712","tags":["report"]},{"url":"https://bugzilla.suse.com/1264725","tags":["report"]},{"url":"https://bugzilla.suse.com/1264731","tags":["report"]},{"url":"https://bugzilla.suse.com/1264739","tags":["report"]},{"url":"https://bugzilla.suse.com/1264746","tags":["report"]},{"url":"https://bugzilla.suse.com/1264748","tags":["report"]},{"url":"https://bugzilla.suse.com/1264758","tags":["report"]},{"url":"https://bugzilla.suse.com/1264768","tags":["report"]},{"url":"https://bugzilla.suse.com/1264779","tags":["report"]},{"url":"https://bugzilla.suse.com/1264780","tags":["report"]},{"url":"https://bugzilla.suse.com/1264781","tags":["report"]},{"url":"https://bugzilla.suse.com/1264782","tags":["report"]},{"url":"https://bugzilla.suse.com/1264783","tags":["report"]},{"url":"https://bugzilla.suse.com/1264785","tags":["report"]},{"url":"https://bugzilla.suse.com/1264788","tags":["report"]},{"url":"https://bugzilla.suse.com/1264791","tags":["report"]},{"url":"https://bugzilla.suse.com/1264793","tags":["report"]},{"url":"https://bugzilla.suse.com/1264795","tags":["report"]},{"url":"https://bugzilla.suse.com/1264801","tags":["report"]},{"url":"https://bugzilla.suse.com/1264803","tags":["report"]},{"url":"https://bugzilla.suse.com/1264805","tags":["report"]},{"url":"https://bugzilla.suse.com/1264809","tags":["report"]},{"url":"https://bugzilla.suse.com/1264815","tags":["report"]},{"url":"https://bugzilla.suse.com/1264816","tags":["report"]},{"url":"https://bugzilla.suse.com/1264819","tags":["report"]},{"url":"https://bugzilla.suse.com/1264821","tags":["report"]},{"url":"https://bugzilla.suse.com/1264822","tags":["report"]},{"url":"https://bugzilla.suse.com/1264826","tags":["report"]},{"url":"https://bugzilla.suse.com/1264827","tags":["report"]},{"url":"https://bugzilla.suse.com/1264830","tags":["report"]},{"url":"https://bugzilla.suse.com/1264844","tags":["report"]},{"url":"https://bugzilla.suse.com/1264982","tags":["report"]},{"url":"https://bugzilla.suse.com/1264987","tags":["report"]},{"url":"https://bugzilla.suse.com/1264988","tags":["report"]},{"url":"https://bugzilla.suse.com/1264991","tags":["report"]},{"url":"https://bugzilla.suse.com/1264993","tags":["report"]},{"url":"https://bugzilla.suse.com/1265009","tags":["report"]},{"url":"https://bugzilla.suse.com/1265019","tags":["report"]},{"url":"https://bugzilla.suse.com/1265032","tags":["report"]},{"url":"https://bugzilla.suse.com/1265035","tags":["report"]},{"url":"https://bugzilla.suse.com/1265037","tags":["report"]},{"url":"https://bugzilla.suse.com/1265041","tags":["report"]},{"url":"https://bugzilla.suse.com/1265046","tags":["report"]},{"url":"https://bugzilla.suse.com/1265047","tags":["report"]},{"url":"https://bugzilla.suse.com/1265054","tags":["report"]},{"url":"https://bugzilla.suse.com/1265058","tags":["report"]},{"url":"https://bugzilla.suse.com/1265074","tags":["report"]},{"url":"https://bugzilla.suse.com/1265078","tags":["report"]},{"url":"https://bugzilla.suse.com/1265080","tags":["report"]},{"url":"https://bugzilla.suse.com/1265086","tags":["report"]},{"url":"https://bugzilla.suse.com/1265089","tags":["report"]},{"url":"https://bugzilla.suse.com/1265090","tags":["report"]},{"url":"https://bugzilla.suse.com/1265092","tags":["report"]},{"url":"https://bugzilla.suse.com/1265093","tags":["report"]},{"url":"https://bugzilla.suse.com/1265096","tags":["report"]},{"url":"https://bugzilla.suse.com/1265100","tags":["report"]},{"url":"https://bugzilla.suse.com/1265101","tags":["report"]},{"url":"https://bugzilla.suse.com/1265102","tags":["report"]},{"url":"https://bugzilla.suse.com/1265105","tags":["report"]},{"url":"https://bugzilla.suse.com/1265122","tags":["report"]},{"url":"https://bugzilla.suse.com/1265126","tags":["report"]},{"url":"https://bugzilla.suse.com/1265133","tags":["report"]},{"url":"https://bugzilla.suse.com/1265138","tags":["report"]},{"url":"https://bugzilla.suse.com/1265144","tags":["report"]},{"url":"https://bugzilla.suse.com/1265240","tags":["report"]},{"url":"https://bugzilla.suse.com/1265247","tags":["report"]},{"url":"https://bugzilla.suse.com/1265249","tags":["report"]},{"url":"https://bugzilla.suse.com/1265251","tags":["report"]},{"url":"https://bugzilla.suse.com/1265254","tags":["report"]},{"url":"https://bugzilla.suse.com/1265257","tags":["report"]},{"url":"https://bugzilla.suse.com/1265264","tags":["report"]},{"url":"https://bugzilla.suse.com/1265449","tags":["report"]},{"url":"https://bugzilla.suse.com/1265627","tags":["report"]},{"url":"https://bugzilla.suse.com/1265928","tags":["report"]},{"url":"https://bugzilla.suse.com/1265999","tags":["report"]},{"url":"https://bugzilla.suse.com/1266000","tags":["report"]},{"url":"https://bugzilla.suse.com/1266009","tags":["report"]},{"url":"https://bugzilla.suse.com/1266393","tags":["report"]},{"url":"https://bugzilla.suse.com/1266399","tags":["report"]},{"url":"https://bugzilla.suse.com/1266402","tags":["report"]},{"url":"https://bugzilla.suse.com/1266411","tags":["report"]},{"url":"https://bugzilla.suse.com/1266412","tags":["report"]},{"url":"https://bugzilla.suse.com/1266467","tags":["report"]},{"url":"https://bugzilla.suse.com/1266468","tags":["report"]},{"url":"https://bugzilla.suse.com/1266470","tags":["report"]},{"url":"https://bugzilla.suse.com/1266677","tags":["report"]},{"url":"https://bugzilla.suse.com/1266679","tags":["report"]},{"url":"https://bugzilla.suse.com/1266684","tags":["report"]},{"url":"https://bugzilla.suse.com/1266685","tags":["report"]},{"url":"https://bugzilla.suse.com/1266688","tags":["report"]},{"url":"https://bugzilla.suse.com/1266690","tags":["report"]},{"url":"https://bugzilla.suse.com/1266692","tags":["report"]},{"url":"https://bugzilla.suse.com/1266694","tags":["report"]},{"url":"https://bugzilla.suse.com/1266695","tags":["report"]},{"url":"https://bugzilla.suse.com/1266703","tags":["report"]},{"url":"https://bugzilla.suse.com/1266706","tags":["report"]},{"url":"https://bugzilla.suse.com/1266707","tags":["report"]},{"url":"https://bugzilla.suse.com/1266712","tags":["report"]},{"url":"https://bugzilla.suse.com/1266714","tags":["report"]},{"url":"https://bugzilla.suse.com/1266715","tags":["report"]},{"url":"https://bugzilla.suse.com/1266716","tags":["report"]},{"url":"https://bugzilla.suse.com/1266721","tags":["report"]},{"url":"https://bugzilla.suse.com/1266729","tags":["report"]},{"url":"https://bugzilla.suse.com/1266730","tags":["report"]},{"url":"https://bugzilla.suse.com/1266732","tags":["report"]},{"url":"https://bugzilla.suse.com/1266735","tags":["report"]},{"url":"https://bugzilla.suse.com/1266736","tags":["report"]},{"url":"https://bugzilla.suse.com/1266739","tags":["report"]},{"url":"https://bugzilla.suse.com/1266741","tags":["report"]},{"url":"https://bugzilla.suse.com/1266743","tags":["report"]},{"url":"https://bugzilla.suse.com/1266744","tags":["report"]},{"url":"https://bugzilla.suse.com/1266751","tags":["report"]},{"url":"https://bugzilla.suse.com/1266755","tags":["report"]},{"url":"https://bugzilla.suse.com/1266757","tags":["report"]},{"url":"https://bugzilla.suse.com/1266758","tags":["report"]},{"url":"https://bugzilla.suse.com/1266762","tags":["report"]},{"url":"https://bugzilla.suse.com/1266767","tags":["report"]},{"url":"https://bugzilla.suse.com/1266774","tags":["report"]},{"url":"https://bugzilla.suse.com/1266775","tags":["report"]},{"url":"https://bugzilla.suse.com/1266780","tags":["report"]},{"url":"https://bugzilla.suse.com/1266806","tags":["report"]},{"url":"https://bugzilla.suse.com/1266813","tags":["report"]},{"url":"https://bugzilla.suse.com/1266831","tags":["report"]},{"url":"https://bugzilla.suse.com/1266832","tags":["report"]},{"url":"https://bugzilla.suse.com/1266834","tags":["report"]},{"url":"https://bugzilla.suse.com/1266835","tags":["report"]},{"url":"https://bugzilla.suse.com/1266836","tags":["report"]},{"url":"https://bugzilla.suse.com/1266839","tags":["report"]},{"url":"https://bugzilla.suse.com/1266841","tags":["report"]},{"url":"https://bugzilla.suse.com/1266842","tags":["report"]},{"url":"https://bugzilla.suse.com/1266846","tags":["report"]},{"url":"https://bugzilla.suse.com/1266850","tags":["report"]},{"url":"https://bugzilla.suse.com/1266854","tags":["report"]},{"url":"https://bugzilla.suse.com/1266855","tags":["report"]},{"url":"https://bugzilla.suse.com/1266858","tags":["report"]},{"url":"https://bugzilla.suse.com/1266863","tags":["report"]},{"url":"https://bugzilla.suse.com/1266864","tags":["report"]},{"url":"https://bugzilla.suse.com/1266869","tags":["report"]},{"url":"https://bugzilla.suse.com/1266870","tags":["report"]},{"url":"https://bugzilla.suse.com/1266872","tags":["report"]},{"url":"https://bugzilla.suse.com/1266876","tags":["report"]},{"url":"https://bugzilla.suse.com/1266879","tags":["report"]},{"url":"https://bugzilla.suse.com/1266880","tags":["report"]},{"url":"https://bugzilla.suse.com/1266882","tags":["report"]},{"url":"https://bugzilla.suse.com/1266886","tags":["report"]},{"url":"https://bugzilla.suse.com/1266890","tags":["report"]},{"url":"https://bugzilla.suse.com/1266891","tags":["report"]},{"url":"https://bugzilla.suse.com/1266894","tags":["report"]},{"url":"https://bugzilla.suse.com/1266896","tags":["report"]},{"url":"https://bugzilla.suse.com/1266898","tags":["report"]},{"url":"https://bugzilla.suse.com/1266900","tags":["report"]},{"url":"https://bugzilla.suse.com/1266904","tags":["report"]},{"url":"https://bugzilla.suse.com/1266908","tags":["report"]},{"url":"https://bugzilla.suse.com/1266910","tags":["report"]},{"url":"https://bugzilla.suse.com/1266913","tags":["report"]},{"url":"https://bugzilla.suse.com/1266917","tags":["report"]},{"url":"https://bugzilla.suse.com/1266918","tags":["report"]},{"url":"https://bugzilla.suse.com/1266920","tags":["report"]},{"url":"https://bugzilla.suse.com/1266930","tags":["report"]},{"url":"https://bugzilla.suse.com/1266931","tags":["report"]},{"url":"https://bugzilla.suse.com/1266932","tags":["report"]},{"url":"https://bugzilla.suse.com/1266934","tags":["report"]},{"url":"https://bugzilla.suse.com/1266935","tags":["report"]},{"url":"https://bugzilla.suse.com/1266939","tags":["report"]},{"url":"https://bugzilla.suse.com/1266947","tags":["report"]},{"url":"https://bugzilla.suse.com/1266969","tags":["report"]},{"url":"https://bugzilla.suse.com/1267021","tags":["report"]},{"url":"https://bugzilla.suse.com/1267025","tags":["report"]},{"url":"https://bugzilla.suse.com/1267027","tags":["report"]},{"url":"https://bugzilla.suse.com/1267198","tags":["report"]},{"url":"https://bugzilla.suse.com/1267203","tags":["report"]},{"url":"https://bugzilla.suse.com/1267204","tags":["report"]},{"url":"https://bugzilla.suse.com/1267209","tags":["report"]},{"url":"https://bugzilla.suse.com/1267210","tags":["report"]},{"url":"https://bugzilla.suse.com/1267213","tags":["report"]},{"url":"https://bugzilla.suse.com/1267222","tags":["report"]},{"url":"https://bugzilla.suse.com/1267226","tags":["report"]},{"url":"https://bugzilla.suse.com/1267234","tags":["report"]},{"url":"https://bugzilla.suse.com/1267236","tags":["report"]},{"url":"https://bugzilla.suse.com/1267251","tags":["report"]},{"url":"https://bugzilla.suse.com/1267367","tags":["report"]},{"url":"https://bugzilla.suse.com/1267371","tags":["report"]},{"url":"https://bugzilla.suse.com/1267375","tags":["report"]},{"url":"https://bugzilla.suse.com/1267380","tags":["report"]},{"url":"https://bugzilla.suse.com/1267381","tags":["report"]},{"url":"https://bugzilla.suse.com/1267384","tags":["report"]},{"url":"https://bugzilla.suse.com/1267419","tags":["report"]},{"url":"https://bugzilla.suse.com/1267432","tags":["report"]},{"url":"https://bugzilla.suse.com/1267435","tags":["report"]},{"url":"https://bugzilla.suse.com/1267436","tags":["report"]},{"url":"https://bugzilla.suse.com/1267439","tags":["report"]},{"url":"https://bugzilla.suse.com/1267445","tags":["report"]},{"url":"https://bugzilla.suse.com/1267448","tags":["report"]},{"url":"https://bugzilla.suse.com/1267449","tags":["report"]},{"url":"https://bugzilla.suse.com/1267466","tags":["report"]},{"url":"https://bugzilla.suse.com/1267468","tags":["report"]},{"url":"https://bugzilla.suse.com/1267470","tags":["report"]},{"url":"https://bugzilla.suse.com/1267472","tags":["report"]},{"url":"https://bugzilla.suse.com/1267473","tags":["report"]},{"url":"https://bugzilla.suse.com/1267479","tags":["report"]},{"url":"https://bugzilla.suse.com/1267491","tags":["report"]},{"url":"https://bugzilla.suse.com/1267495","tags":["report"]},{"url":"https://bugzilla.suse.com/1267496","tags":["report"]},{"url":"https://bugzilla.suse.com/1267497","tags":["report"]},{"url":"https://bugzilla.suse.com/1267502","tags":["report"]},{"url":"https://bugzilla.suse.com/1267524","tags":["report"]},{"url":"https://bugzilla.suse.com/1267555","tags":["report"]},{"url":"https://bugzilla.suse.com/1267565","tags":["report"]},{"url":"https://bugzilla.suse.com/1267567","tags":["report"]},{"url":"https://bugzilla.suse.com/1267570","tags":["report"]},{"url":"https://bugzilla.suse.com/1267571","tags":["report"]},{"url":"https://bugzilla.suse.com/1267583","tags":["report"]},{"url":"https://bugzilla.suse.com/1267584","tags":["report"]},{"url":"https://bugzilla.suse.com/1267592","tags":["report"]},{"url":"https://bugzilla.suse.com/1267594","tags":["report"]},{"url":"https://bugzilla.suse.com/1267595","tags":["report"]},{"url":"https://bugzilla.suse.com/1267596","tags":["report"]},{"url":"https://bugzilla.suse.com/1267597","tags":["report"]},{"url":"https://bugzilla.suse.com/1267600","tags":["report"]},{"url":"https://bugzilla.suse.com/1267611","tags":["report"]},{"url":"https://bugzilla.suse.com/1267615","tags":["report"]},{"url":"https://bugzilla.suse.com/1267616","tags":["report"]},{"url":"https://bugzilla.suse.com/1267621","tags":["report"]},{"url":"https://bugzilla.suse.com/1267623","tags":["report"]},{"url":"https://bugzilla.suse.com/1267627","tags":["report"]},{"url":"https://bugzilla.suse.com/1267629","tags":["report"]},{"url":"https://bugzilla.suse.com/1267630","tags":["report"]},{"url":"https://bugzilla.suse.com/1267632","tags":["report"]},{"url":"https://bugzilla.suse.com/1267636","tags":["report"]},{"url":"https://bugzilla.suse.com/1267638","tags":["report"]},{"url":"https://bugzilla.suse.com/1267643","tags":["report"]},{"url":"https://bugzilla.suse.com/1267646","tags":["report"]},{"url":"https://bugzilla.suse.com/1267648","tags":["report"]},{"url":"https://bugzilla.suse.com/1267649","tags":["report"]},{"url":"https://bugzilla.suse.com/1267651","tags":["report"]},{"url":"https://bugzilla.suse.com/1267656","tags":["report"]},{"url":"https://bugzilla.suse.com/1267657","tags":["report"]},{"url":"https://bugzilla.suse.com/1267658","tags":["report"]},{"url":"https://bugzilla.suse.com/1267659","tags":["report"]},{"url":"https://bugzilla.suse.com/1267661","tags":["report"]},{"url":"https://bugzilla.suse.com/1267662","tags":["report"]},{"url":"https://bugzilla.suse.com/1267663","tags":["report"]},{"url":"https://bugzilla.suse.com/1267666","tags":["report"]},{"url":"https://bugzilla.suse.com/1267667","tags":["report"]},{"url":"https://bugzilla.suse.com/1267669","tags":["report"]},{"url":"https://bugzilla.suse.com/1267673","tags":["report"]},{"url":"https://bugzilla.suse.com/1267676","tags":["report"]},{"url":"https://bugzilla.suse.com/1267677","tags":["report"]},{"url":"https://bugzilla.suse.com/1267678","tags":["report"]},{"url":"https://bugzilla.suse.com/1267680","tags":["report"]},{"url":"https://bugzilla.suse.com/1267682","tags":["report"]},{"url":"https://bugzilla.suse.com/1267683","tags":["report"]},{"url":"https://bugzilla.suse.com/1267689","tags":["report"]},{"url":"https://bugzilla.suse.com/1267690","tags":["report"]},{"url":"https://bugzilla.suse.com/1267691","tags":["report"]},{"url":"https://bugzilla.suse.com/1267693","tags":["report"]},{"url":"https://bugzilla.suse.com/1267701","tags":["report"]},{"url":"https://bugzilla.suse.com/1267702","tags":["report"]},{"url":"https://bugzilla.suse.com/1267704","tags":["report"]},{"url":"https://bugzilla.suse.com/1267712","tags":["report"]},{"url":"https://bugzilla.suse.com/1267714","tags":["report"]},{"url":"https://bugzilla.suse.com/1267715","tags":["report"]},{"url":"https://bugzilla.suse.com/1267719","tags":["report"]},{"url":"https://bugzilla.suse.com/1267725","tags":["report"]},{"url":"https://bugzilla.suse.com/1267726","tags":["report"]},{"url":"https://bugzilla.suse.com/1267728","tags":["report"]},{"url":"https://bugzilla.suse.com/1267738","tags":["report"]},{"url":"https://bugzilla.suse.com/1267918","tags":["report"]},{"url":"https://bugzilla.suse.com/1267919","tags":["report"]},{"url":"https://bugzilla.suse.com/1267922","tags":["report"]},{"url":"https://bugzilla.suse.com/1267927","tags":["report"]},{"url":"https://bugzilla.suse.com/1267932","tags":["report"]},{"url":"https://bugzilla.suse.com/1267939","tags":["report"]},{"url":"https://bugzilla.suse.com/1267943","tags":["report"]},{"url":"https://bugzilla.suse.com/1267948","tags":["report"]},{"url":"https://bugzilla.suse.com/1267952","tags":["report"]},{"url":"https://bugzilla.suse.com/1267953","tags":["report"]},{"url":"https://bugzilla.suse.com/1267954","tags":["report"]},{"url":"https://bugzilla.suse.com/1267968","tags":["report"]},{"url":"https://bugzilla.suse.com/1267983","tags":["report"]},{"url":"https://bugzilla.suse.com/1267986","tags":["report"]},{"url":"https://bugzilla.suse.com/1267987","tags":["report"]},{"url":"https://bugzilla.suse.com/1267990","tags":["report"]},{"url":"https://bugzilla.suse.com/1267991","tags":["report"]},{"url":"https://bugzilla.suse.com/1267995","tags":["report"]},{"url":"https://bugzilla.suse.com/1268024","tags":["report"]},{"url":"https://bugzilla.suse.com/1268029","tags":["report"]},{"url":"https://bugzilla.suse.com/1268030","tags":["report"]},{"url":"https://bugzilla.suse.com/1268031","tags":["report"]},{"url":"https://bugzilla.suse.com/1268038","tags":["report"]},{"url":"https://bugzilla.suse.com/1268051","tags":["report"]},{"url":"https://bugzilla.suse.com/1268220","tags":["report"]},{"url":"https://bugzilla.suse.com/1268221","tags":["report"]},{"url":"https://bugzilla.suse.com/1268222","tags":["report"]},{"url":"https://bugzilla.suse.com/1268223","tags":["report"]},{"url":"https://bugzilla.suse.com/1268307","tags":["report"]},{"url":"https://bugzilla.suse.com/1268659","tags":["report"]},{"url":"https://bugzilla.suse.com/1268966","tags":["report"]},{"url":"https://bugzilla.suse.com/1268967","tags":["report"]},{"url":"https://bugzilla.suse.com/1268981","tags":["report"]},{"url":"https://bugzilla.suse.com/1268983","tags":["report"]},{"url":"https://bugzilla.suse.com/1268985","tags":["report"]},{"url":"https://bugzilla.suse.com/1268987","tags":["report"]},{"url":"https://bugzilla.suse.com/1268994","tags":["report"]},{"url":"https://bugzilla.suse.com/1269001","tags":["report"]},{"url":"https://bugzilla.suse.com/1269002","tags":["report"]},{"url":"https://bugzilla.suse.com/1269003","tags":["report"]},{"url":"https://bugzilla.suse.com/1269024","tags":["report"]},{"url":"https://bugzilla.suse.com/1269025","tags":["report"]},{"url":"https://bugzilla.suse.com/1269027","tags":["report"]},{"url":"https://bugzilla.suse.com/1269030","tags":["report"]},{"url":"https://bugzilla.suse.com/1269081","tags":["report"]},{"url":"https://bugzilla.suse.com/1269090","tags":["report"]},{"url":"https://bugzilla.suse.com/1269092","tags":["report"]},{"url":"https://bugzilla.suse.com/1269094","tags":["report"]},{"url":"https://bugzilla.suse.com/1269095","tags":["report"]},{"url":"https://bugzilla.suse.com/1269098","tags":["report"]},{"url":"https://bugzilla.suse.com/1269100","tags":["report"]},{"url":"https://bugzilla.suse.com/1269104","tags":["report"]},{"url":"https://bugzilla.suse.com/1269106","tags":["report"]},{"url":"https://bugzilla.suse.com/1269107","tags":["report"]},{"url":"https://bugzilla.suse.com/1269111","tags":["report"]},{"url":"https://bugzilla.suse.com/1269112","tags":["report"]},{"url":"https://bugzilla.suse.com/1269115","tags":["report"]},{"url":"https://bugzilla.suse.com/1269116","tags":["report"]},{"url":"https://bugzilla.suse.com/1269117","tags":["report"]},{"url":"https://bugzilla.suse.com/1269118","tags":["report"]},{"url":"https://bugzilla.suse.com/1269119","tags":["report"]},{"url":"https://bugzilla.suse.com/1269124","tags":["report"]},{"url":"https://bugzilla.suse.com/1269125","tags":["report"]},{"url":"https://bugzilla.suse.com/1269131","tags":["report"]},{"url":"https://bugzilla.suse.com/1269132","tags":["report"]},{"url":"https://bugzilla.suse.com/1269133","tags":["report"]},{"url":"https://bugzilla.suse.com/1269138","tags":["report"]},{"url":"https://bugzilla.suse.com/1269141","tags":["report"]},{"url":"https://bugzilla.suse.com/1269153","tags":["report"]},{"url":"https://bugzilla.suse.com/1269154","tags":["report"]},{"url":"https://bugzilla.suse.com/1269157","tags":["report"]},{"url":"https://bugzilla.suse.com/1269158","tags":["report"]},{"url":"https://bugzilla.suse.com/1269166","tags":["report"]},{"url":"https://bugzilla.suse.com/1269170","tags":["report"]},{"url":"https://bugzilla.suse.com/1269172","tags":["report"]},{"url":"https://bugzilla.suse.com/1269174","tags":["report"]},{"url":"https://bugzilla.suse.com/1269175","tags":["report"]},{"url":"https://bugzilla.suse.com/1269177","tags":["report"]},{"url":"https://bugzilla.suse.com/1269178","tags":["report"]},{"url":"https://bugzilla.suse.com/1269181","tags":["report"]},{"url":"https://bugzilla.suse.com/1269184","tags":["report"]},{"url":"https://bugzilla.suse.com/1269185","tags":["report"]},{"url":"https://bugzilla.suse.com/1269186","tags":["report"]},{"url":"https://bugzilla.suse.com/1269187","tags":["report"]},{"url":"https://bugzilla.suse.com/1269190","tags":["report"]},{"url":"https://bugzilla.suse.com/1269195","tags":["report"]},{"url":"https://bugzilla.suse.com/1269198","tags":["report"]},{"url":"https://bugzilla.suse.com/1269227","tags":["report"]},{"url":"https://bugzilla.suse.com/1269229","tags":["report"]},{"url":"https://bugzilla.suse.com/1269232","tags":["report"]},{"url":"https://bugzilla.suse.com/1269233","tags":["report"]},{"url":"https://bugzilla.suse.com/1269235","tags":["report"]},{"url":"https://bugzilla.suse.com/1269236","tags":["report"]},{"url":"https://bugzilla.suse.com/1269239","tags":["report"]},{"url":"https://bugzilla.suse.com/1269240","tags":["report"]},{"url":"https://bugzilla.suse.com/1269241","tags":["report"]},{"url":"https://bugzilla.suse.com/1269244","tags":["report"]},{"url":"https://bugzilla.suse.com/1269245","tags":["report"]},{"url":"https://bugzilla.suse.com/1269254","tags":["report"]},{"url":"https://bugzilla.suse.com/1269255","tags":["report"]},{"url":"https://bugzilla.suse.com/1269257","tags":["report"]},{"url":"https://bugzilla.suse.com/1269258","tags":["report"]},{"url":"https://bugzilla.suse.com/1269270","tags":["report"]},{"url":"https://bugzilla.suse.com/1269272","tags":["report"]},{"url":"https://bugzilla.suse.com/1269273","tags":["report"]},{"url":"https://bugzilla.suse.com/1269281","tags":["report"]},{"url":"https://bugzilla.suse.com/1269283","tags":["report"]},{"url":"https://bugzilla.suse.com/1269286","tags":["report"]},{"url":"https://bugzilla.suse.com/1269289","tags":["report"]},{"url":"https://bugzilla.suse.com/1269290","tags":["report"]},{"url":"https://bugzilla.suse.com/1269304","tags":["report"]},{"url":"https://bugzilla.suse.com/1269307","tags":["report"]},{"url":"https://bugzilla.suse.com/1269314","tags":["report"]},{"url":"https://bugzilla.suse.com/1269318","tags":["report"]},{"url":"https://bugzilla.suse.com/1269337","tags":["report"]},{"url":"https://bugzilla.suse.com/1269362","tags":["report"]},{"url":"https://bugzilla.suse.com/1269364","tags":["report"]},{"url":"https://bugzilla.suse.com/1269376","tags":["report"]},{"url":"https://bugzilla.suse.com/1269378","tags":["report"]},{"url":"https://bugzilla.suse.com/1269383","tags":["report"]},{"url":"https://bugzilla.suse.com/1269385","tags":["report"]},{"url":"https://bugzilla.suse.com/1269386","tags":["report"]},{"url":"https://bugzilla.suse.com/1269391","tags":["report"]},{"url":"https://bugzilla.suse.com/1269403","tags":["report"]},{"url":"https://bugzilla.suse.com/1269404","tags":["report"]},{"url":"https://bugzilla.suse.com/1269410","tags":["report"]},{"url":"https://bugzilla.suse.com/1269414","tags":["report"]},{"url":"https://bugzilla.suse.com/1269415","tags":["report"]},{"url":"https://bugzilla.suse.com/1269505","tags":["report"]},{"url":"https://bugzilla.suse.com/1269511","tags":["report"]},{"url":"https://bugzilla.suse.com/1269512","tags":["report"]},{"url":"https://bugzilla.suse.com/1269513","tags":["report"]},{"url":"https://bugzilla.suse.com/1269556","tags":["report"]},{"url":"https://bugzilla.suse.com/1269557","tags":["report"]},{"url":"https://bugzilla.suse.com/1269574","tags":["report"]},{"url":"https://bugzilla.suse.com/1269577","tags":["report"]},{"url":"https://bugzilla.suse.com/1269588","tags":["report"]},{"url":"https://bugzilla.suse.com/1269637","tags":["report"]},{"url":"https://bugzilla.suse.com/1269643","tags":["report"]},{"url":"https://bugzilla.suse.com/1269644","tags":["report"]},{"url":"https://bugzilla.suse.com/1269652","tags":["report"]},{"url":"https://bugzilla.suse.com/1269654","tags":["report"]},{"url":"https://bugzilla.suse.com/1269658","tags":["report"]},{"url":"https://bugzilla.suse.com/1269659","tags":["report"]},{"url":"https://bugzilla.suse.com/1269660","tags":["report"]},{"url":"https://bugzilla.suse.com/1269661","tags":["report"]},{"url":"https://bugzilla.suse.com/1269663","tags":["report"]},{"url":"https://bugzilla.suse.com/1269669","tags":["report"]},{"url":"https://bugzilla.suse.com/1269670","tags":["report"]},{"url":"https://bugzilla.suse.com/1269672","tags":["report"]},{"url":"https://bugzilla.suse.com/1269674","tags":["report"]},{"url":"https://bugzilla.suse.com/1269675","tags":["report"]},{"url":"https://bugzilla.suse.com/1269677","tags":["report"]},{"url":"https://bugzilla.suse.com/1269678","tags":["report"]},{"url":"https://bugzilla.suse.com/1269681","tags":["report"]},{"url":"https://bugzilla.suse.com/1269682","tags":["report"]},{"url":"https://bugzilla.suse.com/1269684","tags":["report"]},{"url":"https://bugzilla.suse.com/1269687","tags":["report"]},{"url":"https://bugzilla.suse.com/1269688","tags":["report"]},{"url":"https://bugzilla.suse.com/1269689","tags":["report"]},{"url":"https://bugzilla.suse.com/1269694","tags":["report"]},{"url":"https://bugzilla.suse.com/1269709","tags":["report"]},{"url":"https://bugzilla.suse.com/1269711","tags":["report"]},{"url":"https://bugzilla.suse.com/1269712","tags":["report"]},{"url":"https://bugzilla.suse.com/1269713","tags":["report"]},{"url":"https://bugzilla.suse.com/1269714","tags":["report"]},{"url":"https://bugzilla.suse.com/1269719","tags":["report"]},{"url":"https://bugzilla.suse.com/1269722","tags":["report"]},{"url":"https://bugzilla.suse.com/1269724","tags":["report"]},{"url":"https://bugzilla.suse.com/1269726","tags":["report"]},{"url":"https://bugzilla.suse.com/1269727","tags":["report"]},{"url":"https://bugzilla.suse.com/1269731","tags":["report"]},{"url":"https://bugzilla.suse.com/1269733","tags":["report"]},{"url":"https://bugzilla.suse.com/1269734","tags":["report"]},{"url":"https://bugzilla.suse.com/1269770","tags":["report"]},{"url":"https://bugzilla.suse.com/1269772","tags":["report"]},{"url":"https://bugzilla.suse.com/1269773","tags":["report"]},{"url":"https://bugzilla.suse.com/1269786","tags":["report"]},{"url":"https://bugzilla.suse.com/1269796","tags":["report"]},{"url":"https://bugzilla.suse.com/1269797","tags":["report"]},{"url":"https://bugzilla.suse.com/1269799","tags":["report"]},{"url":"https://bugzilla.suse.com/1269801","tags":["report"]},{"url":"https://bugzilla.suse.com/1269808","tags":["report"]},{"url":"https://bugzilla.suse.com/1269810","tags":["report"]},{"url":"https://bugzilla.suse.com/1269811","tags":["report"]},{"url":"https://bugzilla.suse.com/1269817","tags":["report"]},{"url":"https://bugzilla.suse.com/1269819","tags":["report"]},{"url":"https://bugzilla.suse.com/1269826","tags":["report"]},{"url":"https://bugzilla.suse.com/1269877","tags":["report"]},{"url":"https://bugzilla.suse.com/1269879","tags":["report"]},{"url":"https://bugzilla.suse.com/1269884","tags":["report"]},{"url":"https://bugzilla.suse.com/1269886","tags":["report"]},{"url":"https://bugzilla.suse.com/1269889","tags":["report"]},{"url":"https://bugzilla.suse.com/1269898","tags":["report"]},{"url":"https://bugzilla.suse.com/1269899","tags":["report"]},{"url":"https://bugzilla.suse.com/1269902","tags":["report"]},{"url":"https://bugzilla.suse.com/1269950","tags":["report"]},{"url":"https://bugzilla.suse.com/1269961","tags":["report"]},{"url":"https://bugzilla.suse.com/1269964","tags":["report"]},{"url":"https://bugzilla.suse.com/1269973","tags":["report"]},{"url":"https://bugzilla.suse.com/1269976","tags":["report"]},{"url":"https://bugzilla.suse.com/1269979","tags":["report"]},{"url":"https://bugzilla.suse.com/1269984","tags":["report"]},{"url":"https://bugzilla.suse.com/1269986","tags":["report"]},{"url":"https://bugzilla.suse.com/1269988","tags":["report"]},{"url":"https://bugzilla.suse.com/1269990","tags":["report"]},{"url":"https://bugzilla.suse.com/1269991","tags":["report"]},{"url":"https://bugzilla.suse.com/1269993","tags":["report"]},{"url":"https://bugzilla.suse.com/1269994","tags":["report"]},{"url":"https://bugzilla.suse.com/1269995","tags":["report"]},{"url":"https://bugzilla.suse.com/1269996","tags":["report"]},{"url":"https://bugzilla.suse.com/1269997","tags":["report"]},{"url":"https://bugzilla.suse.com/1269998","tags":["report"]},{"url":"https://bugzilla.suse.com/1270058","tags":["report"]},{"url":"https://bugzilla.suse.com/1270059","tags":["report"]},{"url":"https://bugzilla.suse.com/1270102","tags":["report"]},{"url":"https://bugzilla.suse.com/1270112","tags":["report"]},{"url":"https://bugzilla.suse.com/1270113","tags":["report"]},{"url":"https://bugzilla.suse.com/1270132","tags":["report"]},{"url":"https://bugzilla.suse.com/1270241","tags":["report"]},{"url":"https://bugzilla.suse.com/1270244","tags":["report"]},{"url":"https://bugzilla.suse.com/1270248","tags":["report"]},{"url":"https://bugzilla.suse.com/1270249","tags":["report"]},{"url":"https://bugzilla.suse.com/1270257","tags":["report"]},{"url":"https://bugzilla.suse.com/1270260","tags":["report"]},{"url":"https://bugzilla.suse.com/1270302","tags":["report"]},{"url":"https://bugzilla.suse.com/1271290","tags":["report"]},{"url":"https://bugzilla.suse.com/1271291","tags":["report"]},{"url":"https://bugzilla.suse.com/1271349","tags":["report"]},{"url":"https://bugzilla.suse.com/1271366","tags":["report"]},{"url":"https://bugzilla.suse.com/1271368","tags":["report"]},{"url":"https://bugzilla.suse.com/1271395","tags":["report"]},{"url":"https://bugzilla.suse.com/1271526","tags":["report"]},{"url":"https://bugzilla.suse.com/1271717","tags":["report"]},{"url":"https://bugzilla.suse.com/1271731","tags":["report"]},{"url":"https://bugzilla.suse.com/1271813","tags":["report"]},{"url":"https://bugzilla.suse.com/1271818","tags":["report"]},{"url":"https://bugzilla.suse.com/1271820","tags":["report"]},{"url":"https://bugzilla.suse.com/1271825","tags":["report"]},{"url":"https://bugzilla.suse.com/1271826","tags":["report"]},{"url":"https://bugzilla.suse.com/1271827","tags":["report"]},{"url":"https://bugzilla.suse.com/1271830","tags":["report"]},{"url":"https://bugzilla.suse.com/1271831","tags":["report"]},{"url":"https://bugzilla.suse.com/1271832","tags":["report"]},{"url":"https://bugzilla.suse.com/1271833","tags":["report"]},{"url":"https://bugzilla.suse.com/1271834","tags":["report"]},{"url":"https://bugzilla.suse.com/1271835","tags":["report"]},{"url":"https://bugzilla.suse.com/1271858","tags":["report"]},{"url":"https://bugzilla.suse.com/1271859","tags":["report"]},{"url":"https://bugzilla.suse.com/1271866","tags":["report"]},{"url":"https://bugzilla.suse.com/1271869","tags":["report"]},{"url":"https://bugzilla.suse.com/1271870","tags":["report"]},{"url":"https://bugzilla.suse.com/1271899","tags":["report"]},{"url":"https://bugzilla.suse.com/1271904","tags":["report"]},{"url":"https://bugzilla.suse.com/1271906","tags":["report"]},{"url":"https://bugzilla.suse.com/1271908","tags":["report"]},{"url":"https://bugzilla.suse.com/1271912","tags":["report"]},{"url":"https://bugzilla.suse.com/1271937","tags":["report"]},{"url":"https://bugzilla.suse.com/1271955","tags":["report"]},{"url":"https://bugzilla.suse.com/1271964","tags":["report"]},{"url":"https://bugzilla.suse.com/1271967","tags":["report"]},{"url":"https://bugzilla.suse.com/1272146","tags":["report"]},{"url":"https://bugzilla.suse.com/1272150","tags":["report"]},{"url":"https://bugzilla.suse.com/1272176","tags":["report"]},{"url":"https://bugzilla.suse.com/1272179","tags":["report"]},{"url":"https://bugzilla.suse.com/1272180","tags":["report"]},{"url":"https://bugzilla.suse.com/1272183","tags":["report"]},{"url":"https://bugzilla.suse.com/1272184","tags":["report"]},{"url":"https://bugzilla.suse.com/1272187","tags":["report"]},{"url":"https://bugzilla.suse.com/1272194","tags":["report"]},{"url":"https://bugzilla.suse.com/1272197","tags":["report"]},{"url":"https://bugzilla.suse.com/1272204","tags":["report"]},{"url":"https://bugzilla.suse.com/1272207","tags":["report"]},{"url":"https://bugzilla.suse.com/1272211","tags":["report"]},{"url":"https://bugzilla.suse.com/1272242","tags":["report"]},{"url":"https://bugzilla.suse.com/1272246","tags":["report"]},{"url":"https://bugzilla.suse.com/1272263","tags":["report"]},{"url":"https://bugzilla.suse.com/1272268","tags":["report"]},{"url":"https://bugzilla.suse.com/1272282","tags":["report"]},{"url":"https://bugzilla.suse.com/1272296","tags":["report"]},{"url":"https://bugzilla.suse.com/1272359","tags":["report"]},{"url":"https://bugzilla.suse.com/1272360","tags":["report"]},{"url":"https://bugzilla.suse.com/1272361","tags":["report"]},{"url":"https://bugzilla.suse.com/1272362","tags":["report"]},{"url":"https://bugzilla.suse.com/1272373","tags":["report"]},{"url":"https://bugzilla.suse.com/1272374","tags":["report"]},{"url":"https://bugzilla.suse.com/1272380","tags":["report"]},{"url":"https://bugzilla.suse.com/1272381","tags":["report"]},{"url":"https://bugzilla.suse.com/1272383","tags":["report"]},{"url":"https://bugzilla.suse.com/1272384","tags":["report"]},{"url":"https://bugzilla.suse.com/1272387","tags":["report"]},{"url":"https://bugzilla.suse.com/1272389","tags":["report"]},{"url":"https://bugzilla.suse.com/1272406","tags":["report"]},{"url":"https://bugzilla.suse.com/1272422","tags":["report"]},{"url":"https://bugzilla.suse.com/1272434","tags":["report"]},{"url":"https://bugzilla.suse.com/1272462","tags":["report"]},{"url":"https://bugzilla.suse.com/1272466","tags":["report"]},{"url":"https://bugzilla.suse.com/1272467","tags":["report"]},{"url":"https://bugzilla.suse.com/1272468","tags":["report"]},{"url":"https://bugzilla.suse.com/1272470","tags":["report"]},{"url":"https://bugzilla.suse.com/1272471","tags":["report"]},{"url":"https://bugzilla.suse.com/1272472","tags":["report"]},{"url":"https://bugzilla.suse.com/1272474","tags":["report"]},{"url":"https://bugzilla.suse.com/1272478","tags":["report"]},{"url":"https://bugzilla.suse.com/1272480","tags":["report"]},{"url":"https://bugzilla.suse.com/1272482","tags":["report"]},{"url":"https://bugzilla.suse.com/1272483","tags":["report"]},{"url":"https://bugzilla.suse.com/1272489","tags":["report"]},{"url":"https://bugzilla.suse.com/1272492","tags":["report"]},{"url":"https://bugzilla.suse.com/1272494","tags":["report"]},{"url":"https://bugzilla.suse.com/1272499","tags":["report"]},{"url":"https://bugzilla.suse.com/1272500","tags":["report"]},{"url":"https://bugzilla.suse.com/1272504","tags":["report"]},{"url":"https://bugzilla.suse.com/1272505","tags":["report"]},{"url":"https://bugzilla.suse.com/1272514","tags":["report"]},{"url":"https://bugzilla.suse.com/1272517","tags":["report"]},{"url":"https://bugzilla.suse.com/1272522","tags":["report"]},{"url":"https://bugzilla.suse.com/1272523","tags":["report"]},{"url":"https://bugzilla.suse.com/1272524","tags":["report"]},{"url":"https://bugzilla.suse.com/1272568","tags":["report"]},{"url":"https://bugzilla.suse.com/1272572","tags":["report"]},{"url":"https://bugzilla.suse.com/1272573","tags":["report"]},{"url":"https://bugzilla.suse.com/1272578","tags":["report"]},{"url":"https://bugzilla.suse.com/1272591","tags":["report"]},{"url":"https://bugzilla.suse.com/1272607","tags":["report"]},{"url":"https://bugzilla.suse.com/1272610","tags":["report"]},{"url":"https://bugzilla.suse.com/1272612","tags":["report"]},{"url":"https://bugzilla.suse.com/1272613","tags":["report"]},{"url":"https://bugzilla.suse.com/1272614","tags":["report"]},{"url":"https://bugzilla.suse.com/1272617","tags":["report"]},{"url":"https://bugzilla.suse.com/1272618","tags":["report"]},{"url":"https://bugzilla.suse.com/1272620","tags":["report"]},{"url":"https://bugzilla.suse.com/1272642","tags":["report"]},{"url":"https://bugzilla.suse.com/1272646","tags":["report"]},{"url":"https://bugzilla.suse.com/1272659","tags":["report"]},{"url":"https://bugzilla.suse.com/1272662","tags":["report"]},{"url":"https://bugzilla.suse.com/1272664","tags":["report"]},{"url":"https://bugzilla.suse.com/1272665","tags":["report"]},{"url":"https://bugzilla.suse.com/1272668","tags":["report"]},{"url":"https://bugzilla.suse.com/1272670","tags":["report"]},{"url":"https://bugzilla.suse.com/1272671","tags":["report"]},{"url":"https://bugzilla.suse.com/1272675","tags":["report"]},{"url":"https://bugzilla.suse.com/1272678","tags":["report"]},{"url":"https://bugzilla.suse.com/1272680","tags":["report"]},{"url":"https://bugzilla.suse.com/1272681","tags":["report"]},{"url":"https://bugzilla.suse.com/1272682","tags":["report"]},{"url":"https://bugzilla.suse.com/1272685","tags":["report"]},{"url":"https://bugzilla.suse.com/1272686","tags":["report"]},{"url":"https://bugzilla.suse.com/1272689","tags":["report"]},{"url":"https://bugzilla.suse.com/1272690","tags":["report"]},{"url":"https://bugzilla.suse.com/1272691","tags":["report"]},{"url":"https://bugzilla.suse.com/1272693","tags":["report"]},{"url":"https://bugzilla.suse.com/1272694","tags":["report"]},{"url":"https://bugzilla.suse.com/1272706","tags":["report"]},{"url":"https://bugzilla.suse.com/1272781","tags":["report"]},{"url":"https://bugzilla.suse.com/1272785","tags":["report"]},{"url":"https://bugzilla.suse.com/1272787","tags":["report"]},{"url":"https://bugzilla.suse.com/1272797","tags":["report"]},{"url":"https://bugzilla.suse.com/1272800","tags":["report"]},{"url":"https://bugzilla.suse.com/1272807","tags":["report"]},{"url":"https://bugzilla.suse.com/1272836","tags":["report"]},{"url":"https://bugzilla.suse.com/1272843","tags":["report"]},{"url":"https://bugzilla.suse.com/1272847","tags":["report"]},{"url":"https://bugzilla.suse.com/1272848","tags":["report"]},{"url":"https://bugzilla.suse.com/1272850","tags":["report"]},{"url":"https://bugzilla.suse.com/1272853","tags":["report"]},{"url":"https://bugzilla.suse.com/1272858","tags":["report"]},{"url":"https://bugzilla.suse.com/1272863","tags":["report"]},{"url":"https://bugzilla.suse.com/1272867","tags":["report"]},{"url":"https://bugzilla.suse.com/1272871","tags":["report"]},{"url":"https://bugzilla.suse.com/1272891","tags":["report"]},{"url":"https://bugzilla.suse.com/1272892","tags":["report"]},{"url":"https://bugzilla.suse.com/1272897","tags":["report"]},{"url":"https://bugzilla.suse.com/1272903","tags":["report"]},{"url":"https://bugzilla.suse.com/1272907","tags":["report"]},{"url":"https://bugzilla.suse.com/1272920","tags":["report"]},{"url":"https://bugzilla.suse.com/1272973","tags":["report"]},{"url":"https://bugzilla.suse.com/1272993","tags":["report"]},{"url":"https://bugzilla.suse.com/1273005","tags":["report"]},{"url":"https://bugzilla.suse.com/1273023","tags":["report"]},{"url":"https://bugzilla.suse.com/1273035","tags":["report"]},{"url":"https://bugzilla.suse.com/1273044","tags":["report"]},{"url":"https://bugzilla.suse.com/1273053","tags":["report"]},{"url":"https://bugzilla.suse.com/1273054","tags":["report"]},{"url":"https://bugzilla.suse.com/1273117","tags":["report"]},{"url":"https://bugzilla.suse.com/1273231","tags":["report"]},{"url":"https://bugzilla.suse.com/1274072","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-2058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38250","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71273","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71274","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71294","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71305","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71314","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31430","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31431","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31440","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31442","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31443","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31462","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31467","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31474","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31482","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31483","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31485","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31488","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31489","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31509","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31510","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31520","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31522","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31532","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31540","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31548","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31549","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31552","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31561","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31570","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31576","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31578","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31581","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31582","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31583","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31585","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31587","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31590","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31591","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31592","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31593","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31598","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31599","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31604","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31605","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31607","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31626","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31627","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31628","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31629","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31656","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31657","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31659","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31661","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31672","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31687","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31697","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31698","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31726","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31730","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31741","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31747","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31748","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31749","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31755","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31756","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31758","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31759","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31762","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31765","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31767","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31768","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31772","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31773","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31780","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31781","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43007","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43023","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43062","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43069","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43072","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43077","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43110","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43114","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43118","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43120","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43129","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43134","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43140","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43147","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43152","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43159","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43169","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43170","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43200","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43202","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43211","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43220","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43223","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43230","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43240","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43242","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43249","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43250","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43251","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43255","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43256","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43261","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43266","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43269","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43273","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43275","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43278","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43279","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43293","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43295","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43302","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43307","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43309","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43314","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43319","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43320","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43324","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43334","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43342","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43343","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43344","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43352","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43353","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43368","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43370","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43395","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43397","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43413","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43424","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43428","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43430","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43437","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43440","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43443","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43444","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43451","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43467","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43472","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43480","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43483","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43486","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43488","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43493","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43501","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45849","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45867","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45880","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45881","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45885","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45915","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45916","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45917","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45923","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45925","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45994","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46001","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46006","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46009","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46023","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46026","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46027","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46048","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46060","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46074","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46077","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46082","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46084","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46096","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46102","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46109","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46121","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46125","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46127","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46130","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46140","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46147","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46152","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46165","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46170","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46198","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46200","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46201","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46211","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46212","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46220","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46226","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46230","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46235","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46249","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46255","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46261","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46267","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46273","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46274","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46275","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46282","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46294","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46301","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46307","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46321","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46324","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46326","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52910","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52915","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52916","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52925","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52926","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52927","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52942","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52953","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52967","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52974","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53002","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53006","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53009","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53012","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53035","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53062","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53065","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53069","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53070","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53071","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53072","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53074","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53082","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53083","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53084","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53102","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53121","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53134","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53140","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53147","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53152","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53159","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53175","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53192","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53202","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53208","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53212","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53213","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53226","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53230","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53235","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53242","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53250","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53251","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53255","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53256","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53260","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53267","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53273","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53275","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53279","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53293","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53317","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53321","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53324","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53331","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53332","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53347","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53355","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53366","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53369","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53394","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53397","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53400","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63802","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63826","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63827","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63836","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63843","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63844","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63850","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63886","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63892","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63893","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63894","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63899","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63915","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63916","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63923","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63927","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63929","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63939","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63942","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63949","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63960","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63962","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63967","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63968","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63971","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63974","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63994","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64021","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64025","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64220","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64223","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64242","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64347","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64528","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64530","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64560","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64561","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64564","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64600","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623068-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623221-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623231-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623237-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262799-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1236743","tags":["report"]},{"url":"https://bugzilla.suse.com/1255029","tags":["report"]},{"url":"https://bugzilla.suse.com/1256668","tags":["report"]},{"url":"https://bugzilla.suse.com/1261256","tags":["report"]},{"url":"https://bugzilla.suse.com/1261604","tags":["report"]},{"url":"https://bugzilla.suse.com/1262085","tags":["report"]},{"url":"https://bugzilla.suse.com/1262392","tags":["report"]},{"url":"https://bugzilla.suse.com/1262617","tags":["report"]},{"url":"https://bugzilla.suse.com/1262618","tags":["report"]},{"url":"https://bugzilla.suse.com/1262620","tags":["report"]},{"url":"https://bugzilla.suse.com/1262674","tags":["report"]},{"url":"https://bugzilla.suse.com/1262748","tags":["report"]},{"url":"https://bugzilla.suse.com/1262798","tags":["report"]},{"url":"https://bugzilla.suse.com/1263057","tags":["report"]},{"url":"https://bugzilla.suse.com/1263072","tags":["report"]},{"url":"https://bugzilla.suse.com/1263137","tags":["report"]},{"url":"https://bugzilla.suse.com/1263178","tags":["report"]},{"url":"https://bugzilla.suse.com/1263563","tags":["report"]},{"url":"https://bugzilla.suse.com/1263568","tags":["report"]},{"url":"https://bugzilla.suse.com/1263573","tags":["report"]},{"url":"https://bugzilla.suse.com/1263578","tags":["report"]},{"url":"https://bugzilla.suse.com/1263581","tags":["report"]},{"url":"https://bugzilla.suse.com/1263930","tags":["report"]},{"url":"https://bugzilla.suse.com/1263934","tags":["report"]},{"url":"https://bugzilla.suse.com/1263993","tags":["report"]},{"url":"https://bugzilla.suse.com/1263996","tags":["report"]},{"url":"https://bugzilla.suse.com/1263998","tags":["report"]},{"url":"https://bugzilla.suse.com/1264001","tags":["report"]},{"url":"https://bugzilla.suse.com/1264015","tags":["report"]},{"url":"https://bugzilla.suse.com/1264045","tags":["report"]},{"url":"https://bugzilla.suse.com/1264145","tags":["report"]},{"url":"https://bugzilla.suse.com/1264230","tags":["report"]},{"url":"https://bugzilla.suse.com/1264231","tags":["report"]},{"url":"https://bugzilla.suse.com/1264236","tags":["report"]},{"url":"https://bugzilla.suse.com/1264239","tags":["report"]},{"url":"https://bugzilla.suse.com/1264241","tags":["report"]},{"url":"https://bugzilla.suse.com/1264254","tags":["report"]},{"url":"https://bugzilla.suse.com/1264258","tags":["report"]},{"url":"https://bugzilla.suse.com/1264261","tags":["report"]},{"url":"https://bugzilla.suse.com/1264263","tags":["report"]},{"url":"https://bugzilla.suse.com/1264266","tags":["report"]},{"url":"https://bugzilla.suse.com/1264286","tags":["report"]},{"url":"https://bugzilla.suse.com/1264294","tags":["report"]},{"url":"https://bugzilla.suse.com/1264320","tags":["report"]},{"url":"https://bugzilla.suse.com/1264337","tags":["report"]},{"url":"https://bugzilla.suse.com/1264437","tags":["report"]},{"url":"https://bugzilla.suse.com/1264444","tags":["report"]},{"url":"https://bugzilla.suse.com/1264449","tags":["report"]},{"url":"https://bugzilla.suse.com/1264470","tags":["report"]},{"url":"https://bugzilla.suse.com/1264549","tags":["report"]},{"url":"https://bugzilla.suse.com/1264561","tags":["report"]},{"url":"https://bugzilla.suse.com/1264595","tags":["report"]},{"url":"https://bugzilla.suse.com/1264603","tags":["report"]},{"url":"https://bugzilla.suse.com/1264610","tags":["report"]},{"url":"https://bugzilla.suse.com/1264612","tags":["report"]},{"url":"https://bugzilla.suse.com/1264734","tags":["report"]},{"url":"https://bugzilla.suse.com/1264741","tags":["report"]},{"url":"https://bugzilla.suse.com/1264763","tags":["report"]},{"url":"https://bugzilla.suse.com/1264814","tags":["report"]},{"url":"https://bugzilla.suse.com/1264974","tags":["report"]},{"url":"https://bugzilla.suse.com/1265103","tags":["report"]},{"url":"https://bugzilla.suse.com/1265113","tags":["report"]},{"url":"https://bugzilla.suse.com/1265143","tags":["report"]},{"url":"https://bugzilla.suse.com/1265211","tags":["report"]},{"url":"https://bugzilla.suse.com/1265421","tags":["report"]},{"url":"https://bugzilla.suse.com/1265628","tags":["report"]},{"url":"https://bugzilla.suse.com/1265629","tags":["report"]},{"url":"https://bugzilla.suse.com/1266008","tags":["report"]},{"url":"https://bugzilla.suse.com/1266290","tags":["report"]},{"url":"https://bugzilla.suse.com/1266390","tags":["report"]},{"url":"https://bugzilla.suse.com/1266396","tags":["report"]},{"url":"https://bugzilla.suse.com/1266397","tags":["report"]},{"url":"https://bugzilla.suse.com/1266698","tags":["report"]},{"url":"https://bugzilla.suse.com/1266700","tags":["report"]},{"url":"https://bugzilla.suse.com/1266704","tags":["report"]},{"url":"https://bugzilla.suse.com/1266705","tags":["report"]},{"url":"https://bugzilla.suse.com/1266717","tags":["report"]},{"url":"https://bugzilla.suse.com/1266734","tags":["report"]},{"url":"https://bugzilla.suse.com/1266830","tags":["report"]},{"url":"https://bugzilla.suse.com/1266840","tags":["report"]},{"url":"https://bugzilla.suse.com/1266847","tags":["report"]},{"url":"https://bugzilla.suse.com/1266878","tags":["report"]},{"url":"https://bugzilla.suse.com/1266895","tags":["report"]},{"url":"https://bugzilla.suse.com/1266899","tags":["report"]},{"url":"https://bugzilla.suse.com/1266903","tags":["report"]},{"url":"https://bugzilla.suse.com/1266916","tags":["report"]},{"url":"https://bugzilla.suse.com/1266922","tags":["report"]},{"url":"https://bugzilla.suse.com/1266928","tags":["report"]},{"url":"https://bugzilla.suse.com/1266929","tags":["report"]},{"url":"https://bugzilla.suse.com/1266933","tags":["report"]},{"url":"https://bugzilla.suse.com/1267208","tags":["report"]},{"url":"https://bugzilla.suse.com/1267228","tags":["report"]},{"url":"https://bugzilla.suse.com/1267361","tags":["report"]},{"url":"https://bugzilla.suse.com/1267365","tags":["report"]},{"url":"https://bugzilla.suse.com/1267369","tags":["report"]},{"url":"https://bugzilla.suse.com/1267387","tags":["report"]},{"url":"https://bugzilla.suse.com/1267427","tags":["report"]},{"url":"https://bugzilla.suse.com/1267430","tags":["report"]},{"url":"https://bugzilla.suse.com/1267431","tags":["report"]},{"url":"https://bugzilla.suse.com/1267437","tags":["report"]},{"url":"https://bugzilla.suse.com/1267458","tags":["report"]},{"url":"https://bugzilla.suse.com/1267582","tags":["report"]},{"url":"https://bugzilla.suse.com/1267591","tags":["report"]},{"url":"https://bugzilla.suse.com/1267624","tags":["report"]},{"url":"https://bugzilla.suse.com/1267628","tags":["report"]},{"url":"https://bugzilla.suse.com/1267635","tags":["report"]},{"url":"https://bugzilla.suse.com/1267637","tags":["report"]},{"url":"https://bugzilla.suse.com/1267640","tags":["report"]},{"url":"https://bugzilla.suse.com/1267654","tags":["report"]},{"url":"https://bugzilla.suse.com/1267684","tags":["report"]},{"url":"https://bugzilla.suse.com/1267685","tags":["report"]},{"url":"https://bugzilla.suse.com/1267697","tags":["report"]},{"url":"https://bugzilla.suse.com/1267717","tags":["report"]},{"url":"https://bugzilla.suse.com/1267722","tags":["report"]},{"url":"https://bugzilla.suse.com/1267744","tags":["report"]},{"url":"https://bugzilla.suse.com/1267816","tags":["report"]},{"url":"https://bugzilla.suse.com/1267825","tags":["report"]},{"url":"https://bugzilla.suse.com/1267937","tags":["report"]},{"url":"https://bugzilla.suse.com/1267966","tags":["report"]},{"url":"https://bugzilla.suse.com/1267993","tags":["report"]},{"url":"https://bugzilla.suse.com/1268022","tags":["report"]},{"url":"https://bugzilla.suse.com/1268037","tags":["report"]},{"url":"https://bugzilla.suse.com/1268159","tags":["report"]},{"url":"https://bugzilla.suse.com/1268237","tags":["report"]},{"url":"https://bugzilla.suse.com/1268335","tags":["report"]},{"url":"https://bugzilla.suse.com/1268428","tags":["report"]},{"url":"https://bugzilla.suse.com/1268660","tags":["report"]},{"url":"https://bugzilla.suse.com/1268661","tags":["report"]},{"url":"https://bugzilla.suse.com/1269022","tags":["report"]},{"url":"https://bugzilla.suse.com/1269033","tags":["report"]},{"url":"https://bugzilla.suse.com/1269103","tags":["report"]},{"url":"https://bugzilla.suse.com/1269135","tags":["report"]},{"url":"https://bugzilla.suse.com/1269136","tags":["report"]},{"url":"https://bugzilla.suse.com/1269137","tags":["report"]},{"url":"https://bugzilla.suse.com/1269199","tags":["report"]},{"url":"https://bugzilla.suse.com/1269310","tags":["report"]},{"url":"https://bugzilla.suse.com/1269397","tags":["report"]},{"url":"https://bugzilla.suse.com/1269398","tags":["report"]},{"url":"https://bugzilla.suse.com/1269418","tags":["report"]},{"url":"https://bugzilla.suse.com/1269493","tags":["report"]},{"url":"https://bugzilla.suse.com/1269506","tags":["report"]},{"url":"https://bugzilla.suse.com/1269519","tags":["report"]},{"url":"https://bugzilla.suse.com/1269617","tags":["report"]},{"url":"https://bugzilla.suse.com/1269798","tags":["report"]},{"url":"https://bugzilla.suse.com/1269821","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-10263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23451","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31414","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31450","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31453","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31492","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31560","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31647","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31664","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31670","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31693","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31771","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43010","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43028","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43035","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43074","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43081","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43083","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43094","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43119","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43171","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43198","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43420","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43491","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43492","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45838","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45841","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45894","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45974","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45985","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46028","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46065","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46069","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46071","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46076","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46116","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46119","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46120","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46124","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46173","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46266","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46319","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46320","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46331","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52923","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52962","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53041","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53266","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53362","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262800-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1264484","tags":["report"]},{"url":"https://bugzilla.suse.com/1268049","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43109","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46330","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-40216","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-40216","tags":["report"]},{"url":"https://git.kernel.org/linus/3a3c6d61577dbb23c09df3e21f6f9eda1ecd634b","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-40216","title":"io_uring/rsrc: don't rely on user vaddr alignment","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/rsrc: don't rely on user vaddr alignment\n\nThere is no guaranteed alignment for user pointers, however the\ncalculation of an offset of the first page into a folio after coalescing\nuses some weird bit mask logic, get rid of it.","status":"published","published":"2025-12-04T14:14:14.69Z","modified":"2026-10-15T22:02:41.119Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:32:34.434755Z"}],"euvd":[{"id":"EUVD-2025-201161","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/rsrc: don't rely on user vaddr alignment\n\nThere is no guaranteed alignment for user pointers, however the\ncalculation of an offset of the first page into a folio after coalescing\nuses some weird bit mask logic, get rid of it.","status":"published","published":"2025-12-04T14:14:14Z","modified":"2026-10-15T22:02:41Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:00:07.251605Z"}],"ghsa":[{"id":"GHSA-vv4p-ph8q-2hhx","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/rsrc: don't rely on...","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/rsrc: don't rely on user vaddr alignment\n\nThere is no guaranteed alignment for user pointers, however the\ncalculation of an offset of the first page into a folio after coalescing\nuses some weird bit mask logic, get rid of it.","status":"published","published":"2025-12-04T15:30:33Z","modified":"2026-07-30T06:32:18Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:09:54.918351Z"}],"nvd":[{"id":"CVE-2025-40216","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/rsrc: don't rely on user vaddr alignment\n\nThere is no guaranteed alignment for user pointers, however the\ncalculation of an offset of the first page into a folio after coalescing\nuses some weird bit mask logic, get rid of it.","status":"published","published":"2025-12-04T15:15:57.3Z","modified":"2026-10-19T21:10:00.16Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"updated_at":"2026-11-02T14:11:47.746175Z"}],"osv":[{"id":"BELL-CVE-2025-40216","status":"published","published":"2025-12-06T06:06:26.237779Z","modified":"2026-07-31T07:19:18.780513079Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:22.495824Z"},{"id":"CVE-2025-40216","title":"io_uring/rsrc: don't rely on user vaddr alignment","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/rsrc: don't rely on user vaddr alignment\n\nThere is no guaranteed alignment for user pointers, however the\ncalculation of an offset of the first page into a folio after coalescing\nuses some weird bit mask logic, get rid of it.","status":"published","published":"2025-12-04T14:14:14.69Z","modified":"2026-10-28T02:31:14.281416036Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:49.394967Z"},{"id":"DEBIAN-CVE-2025-40216","description":"In the Linux kernel, the following vulnerability has been resolved:  io_uring/rsrc: don't rely on user vaddr alignment  There is no guaranteed alignment for user pointers, however the calculation of an offset of the first page into a folio after coalescing uses some weird bit mask logic, get rid of it.","status":"published","published":"2025-12-04T15:15:57.3Z","modified":"2026-10-23T17:47:37.800587325Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:46.998514Z"},{"id":"UBUNTU-CVE-2025-40216","description":"In the Linux kernel, the following vulnerability has been resolved: io_uring/rsrc: don't rely on user vaddr alignment There is no guaranteed alignment for user pointers, however the calculation of an offset of the first page into a folio after coalescing uses some weird bit mask logic, get rid of it.","status":"published","published":"2025-12-04T15:15:00Z","modified":"2026-09-09T14:35:36.440137958Z","cvss":[{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"low"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:46.53147Z"},{"id":"openSUSE-SU-2026:21555-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).\n- CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).\n- CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).\n- CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).\n- CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).\n- CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).\n- CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).\n- CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).\n- CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).\n- CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).\n- CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).\n- CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).\n- CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).\n- CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).\n- CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).\n- CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).\n- CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).\n- CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).\n- CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).\n- CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).\n- CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).\n- CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).\n- CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).\n- CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).\n- CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).\n- CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).\n- CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).\n- CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).\n- CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).\n- CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).\n- CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).\n- CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).\n- CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).\n- CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).\n- CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).\n- CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).\n- CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).\n- CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).\n- CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).\n- CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).\n- CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).\n- CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).\n- CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).\n- CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).\n- CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).\n- CVE-2026-46033: crypto: authencesn - reject short ahash digests during instance creation (bsc#1266692).\n- CVE-2026-46034: vfio/cdx: Fix NULL pointer dereference in interrupt trigger path (bsc#1266757).\n- CVE-2026-46036: vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex (bsc#1267470).\n- CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).\n- CVE-2026-46040: inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (bsc#1267472).\n- CVE-2026-46064: ibmasm: fix heap over-read in ibmasm_send_i2o_message() (bsc#1267497).\n- CVE-2026-46068: crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx (bsc#1267592).\n- CVE-2026-46086: net: bridge: use a stable FDB dst snapshot in RCU readers (bsc#1267524).\n- CVE-2026-46089: zram: do not forget to endio for partial discard requests (bsc#1267445).\n- CVE-2026-46102: net: strparser: fix skb_head leak in strp_abort_strp() (bsc#1267502).\n- CVE-2026-46121: mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock (bsc#1266932).\n- CVE-2026-46127: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() (bsc#1267236).\n- CVE-2026-46130: dm-verity-fec: fix reading parity bytes split across blocks (take 3) (bsc#1267629).\n- CVE-2026-46132: net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo (bsc#1267616).\n- CVE-2026-46137: mptcp: pm: ADD_ADDR rtx: fix potential data-race (bsc#1267570).\n- CVE-2026-46147: KVM: arm64: Factor out pKVM hyp vcpu creation to separate function (bsc#1267689).\n- CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).\n- CVE-2026-46158: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (bsc#1266880).\n- CVE-2026-46168: mptcp: sockopt: set timestamp flags on subflow socket, not msk (bsc#1266869).\n- CVE-2026-46170: mptcp: disable add_addr retransmission when timeout is 0 (bsc#1267714).\n- CVE-2026-46189: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (bsc#1266918).\n- CVE-2026-46191: fbcon: Avoid OOB font access if console rotation fails (bsc#1267690).\n- CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks (bsc#1267656).\n- CVE-2026-46207: vsock/virtio: fix length and offset in tap skb for split packets (bsc#1267691).\n- CVE-2026-46216: drm/xe/hdcp: Add NULL check for media_gt in (bsc#1267234).\n- CVE-2026-46234: vsock: fix buffer size clamping order (bsc#1266904).\n- CVE-2026-46245: drm/amd/display: Fix dc_link NULL handling in HPD init (bsc#1267678).\n- CVE-2026-46249: octeontx2-af: Fix PF driver crash with kexec kernel booting (bsc#1267683).\n- CVE-2026-46265: RDMA/hns: Fix WQ_MEM_RECLAIM warning (bsc#1267662).\n- CVE-2026-46287: net: txgbe: fix RTNL assertion warning when remove module (bsc#1267954).\n- CVE-2026-46292: pmdomain: core: Fix detach procedure for virtual devices in genpd (bsc#1267943).\n- CVE-2026-46306: flow_dissector: do not dissect PPPoE PFC frames (bsc#1267986).\n- CVE-2026-46321: tun: free page on short-frame rejection in tun_xdp_one() (bsc#1268024).\n- CVE-2026-46324: netfilter: nf_tables: Introduce functions freeing nft_hook objects (bsc#1267995).\n- CVE-2026-46327: dm: fix unlocked test for dm_suspended_md (bsc#1268031).\n- CVE-2026-46329: erofs: handle end of filesystem properly for file-backed mounts (bsc#1268038).\n- CVE-2026-52913: batman-adv: v: stop OGMv2 on disabled interface (bsc#1268985).\n- CVE-2026-52915: netfilter: ip6t_hbh: reject oversized option lists (bsc#1269001).\n- CVE-2026-52916: batman-adv: frag: disallow unicast fragment in fragment (bsc#1269002).\n- CVE-2026-52921: netfilter: ipset: stop hash:* range iteration at end (bsc#1269024).\n- CVE-2026-52922: batman-adv: dat: handle forward allocation error (bsc#1269030).\n- CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).\n- CVE-2026-52926: batman-adv: clear current gateway during teardown (bsc#1269025).\n- CVE-2026-52927: netfilter: ebtables: fix OOB read in compat_mtw_from_user (bsc#1269027).\n- CVE-2026-52930: ipc/shm: serialize orphan cleanup with shm_nattch updates (bsc#1269003).\n- CVE-2026-52934: batman-adv: tvlv: reject oversized TVLV packets (bsc#1268994).\n- CVE-2026-52937: tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR (bsc#1268983).\n- CVE-2026-52941: net/smc: avoid NULL deref of conn-\u003elnk in smc_msg_event tracepoint (bsc#1268966).\n- CVE-2026-52942: netfilter: nf_log: validate MAC header was set before dumping it (bsc#1268967).\n- CVE-2026-52947: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (bsc#1269115).\n- CVE-2026-52953: iommu/vt-d: Fix oops due to out of scope access (bsc#1269133).\n- CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1269172).\n- CVE-2026-52958: libceph: Fix potential out-of-bounds access in osdmap_decode() (bsc#1269174).\n- CVE-2026-52967: smb/client: fix possible infinite loop and oob read in symlink_data() (bsc#1269181).\n- CVE-2026-52970: netfilter: nft_ct: fix missing expect put in obj eval (bsc#1269229).\n- CVE-2026-52974: net: tls: fix strparser anchor skb leak on offload RX setup failure (bsc#1269233).\n- CVE-2026-52981: neigh: let neigh_xmit take skb ownership (bsc#1269254).\n- CVE-2026-52984: net/sched: netem: fix queue limit check to include reordered packets (bsc#1269272).\n- CVE-2026-52986: netfilter: nf_conntrack_sip: don't use simple_strtoul (bsc#1269289).\n- CVE-2026-52988: netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (bsc#1269362).\n- CVE-2026-52995: net/rds: zero per-item info buffer before handing it to visitors (bsc#1269124).\n- CVE-2026-52998: netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (bsc#1269118).\n- CVE-2026-52999: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (bsc#1269119).\n- CVE-2026-53000: netfilter: nat: use kfree_rcu to release ops (bsc#1269117).\n- CVE-2026-53002: netfilter: conntrack: remove sprintf usage (bsc#1269112).\n- CVE-2026-53003: pppoe: drop PFC frames (bsc#1269111).\n- CVE-2026-53004: sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks (bsc#1269106).\n- CVE-2026-53005: af_unix: Drop all SCM attributes for SOCKMAP (bsc#1269107).\n- CVE-2026-53006: ipv6: fix possible UAF in icmpv6_rcv() (bsc#1269104).\n- CVE-2026-53009: ice: fix double-free of tx_buf skb (bsc#1269098).\n- CVE-2026-53011: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (bsc#1269094).\n- CVE-2026-53012: nexthop: fix IPv6 route referencing IPv4 nexthop (bsc#1269154).\n- CVE-2026-53013: macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF (bsc#1269095).\n- CVE-2026-53014: net/sched: act_mirred: fix wrong device for mac_header_xmit check in tcf_blockcast_redir\n  (bsc#1269092).\n- CVE-2026-53032: bpf: Fix NULL deref in map_kptr_match_type for scalar regs (bsc#1269138).\n- CVE-2026-53035: bpf, sockmap: Fix af_unix iter deadlock (bsc#1269190).\n- CVE-2026-53038: ima_fs: Correctly create securityfs files for unsupported hash algos (bsc#1269391).\n- CVE-2026-53062: dm cache policy smq: fix missing locks in invalidating cache blocks (bsc#1269658).\n- CVE-2026-53063: dm cache: fix write hang in passthrough mode (bsc#1269659).\n- CVE-2026-53064: dm cache: fix null-deref with concurrent writes in passthrough mode (bsc#1269132).\n- CVE-2026-53069: net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master (bsc#1269186).\n- CVE-2026-53074: bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb (bsc#1269688).\n- CVE-2026-53083: bpf: Fix RCU stall in bpf_fd_array_map_clear() (bsc#1269964).\n- CVE-2026-53085: bpf: fix mm lifecycle in open-coded task_vma iterator (bsc#1269879).\n- CVE-2026-53088: net: bcmgenet: fix off-by-one in bcmgenet_put_txcb (bsc#1269185).\n- CVE-2026-53101: wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync (bsc#1269415).\n- CVE-2026-53104: wifi: mt76: Fix memory leak destroying device (bsc#1269157).\n- CVE-2026-53106: bpf: Do not allow deleting local storage in NMI (bsc#1269990).\n- CVE-2026-53107: wifi: libertas: use USB anchors for tracking in-flight URBs (bsc#1269991).\n- CVE-2026-53121: amd-pstate: Fix memory leak in amd_pstate_epp_cpu_init() (bsc#1269198).\n- CVE-2026-53123: md: wake raid456 reshape waiters before suspend (bsc#1269643).\n- CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269773).\n- CVE-2026-53132: vsock/virtio: fix potential unbounded skb queue (bsc#1269290).\n- CVE-2026-53134: netfilter: nft_fib: fix stale stack leak via the OIFNAME register (bsc#1269819).\n- CVE-2026-53157: net: phonet: free phonet_device after RCU grace period (bsc#1269241).\n- CVE-2026-53175: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush (bsc#1269714).\n- CVE-2026-53181: vsock/vmci: fix sk_ack_backlog leak on failed handshake (bsc#1269886).\n- CVE-2026-53183: mptcp: allow subflow rcv wnd to shrink (bsc#1269376).\n- CVE-2026-53184: udp: clear skb-\u003edev before running a sockmap verdict (bsc#1269689).\n- CVE-2026-53185: zram: fix use-after-free in zram_bvec_write_partial() (bsc#1269660).\n- CVE-2026-53186: RDMA/srp: bound SRP_RSP sense copy by the received length (bsc#1269663).\n- CVE-2026-53189: mm/huge_memory: update file PMD counter before folio_put() (bsc#1269797).\n- CVE-2026-53210: tee: shm: fix shm leak in register_shm_helper() (bsc#1269727).\n- CVE-2026-53212: netfilter: nft_tunnel: fix use-after-free on object destroy (bsc#1269672).\n- CVE-2026-53214: ipv6: Fix a potential NPD in cleanup_prefix_route() (bsc#1269588).\n- CVE-2026-53218: netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (bsc#1269273).\n- CVE-2026-53221: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() (bsc#1269318).\n- CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997).\n- CVE-2026-53225: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() (bsc#1269711).\n- CVE-2026-53227: net: openvswitch: fix possible kfree_skb of ERR_PTR (bsc#1269877).\n- CVE-2026-53230: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (bsc#1269270).\n- CVE-2026-53233: netdev: fix double-free in netdev_nl_bind_rx_doit() (bsc#1269801).\n- CVE-2026-53235: net: add pskb_may_pull() to skb_gro_receive_list() (bsc#1269286).\n- CVE-2026-53236: tcp: restrict SO_ATTACH_FILTER to priv users (bsc#1269994).\n- CVE-2026-53239: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (bsc#1269677).\n- CVE-2026-53245: net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr (bsc#1269675).\n- CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1269988).\n- CVE-2026-53247: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown (bsc#1269235).\n- CVE-2026-53250: xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() (bsc#1269808).\n- CVE-2026-53252: Bluetooth: fix memory leak in error path of hci_alloc_dev() (bsc#1269307).\n- CVE-2026-53260: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req() (bsc#1269731).\n- CVE-2026-53267: netfilter: nft_ct: bail out on template ct in get eval (bsc#1269577).\n- CVE-2026-53268: netfilter: conntrack_irc: fix possible out-of-bounds read (bsc#1269257).\n- CVE-2026-53270: ipvs: clear the svc scheduler ptr early on edit (bsc#1269240).\n- CVE-2026-53273: tee: optee: prevent use-after-free when the client exits before the supplicant (bsc#1269713).\n- CVE-2026-53275: ipv6: mcast: Fix use-after-free when processing MLD queries (bsc#1269810).\n- CVE-2026-53289: ice: fix NULL pointer dereference in ice_reset_all_vfs() (bsc#1269694).\n- CVE-2026-53321: io_uring/napi: cap busy_poll_to 10 msec (bsc#1269724).\n- CVE-2026-53355: net: rds: clear i_sends on setup unwind (bsc#1270249).\n- CVE-2026-53369: udf: reject descriptors with oversized CRC length (bsc#1271818).\n- CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830).\n- CVE-2026-53388: fuse: re-lock request before replacing page cache folio (bsc#1271825).\n- CVE-2026-53391: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (bsc#1271904).\n- CVE-2026-53392: NFSv4/flexfiles: reject zero filehandle version count (bsc#1271826).\n- CVE-2026-53393: nfsd: reset write verifier on deferred writeback errors (bsc#1271858).\n- CVE-2026-53394: nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race (bsc#1271859).\n- CVE-2026-53397: nfsd: fix posix_acl leak on SETACL decode failure (bsc#1271869).\n- CVE-2026-53398: NFSD: Fix SECINFO_NO_NAME decode error cleanup (bsc#1271870).\n- CVE-2026-53399: nfsd: release layout stid on setlease failure (bsc#1271832).\n- CVE-2026-53402: fbdev: fbcon: fix out-of-bounds read in err_out of (bsc#1271908).\n- CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (bsc#1271964).\n- CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).\n- CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272282).\n- CVE-2026-63809: bpf: NUL-terminate replaced sysctl value (bsc#1272296).\n- CVE-2026-63829: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1272176).\n- CVE-2026-63831: mac802154: llsec: add skb_cow_data() before in-place crypto (bsc#1272184).\n- CVE-2026-63836: batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd (bsc#1272246).\n- CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272836).\n- CVE-2026-63919: xfrm: input: hold netns during deferred transport reinjection (bsc#1272907).\n- CVE-2026-63923: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (bsc#1273005).\n- CVE-2026-63952: memfd: deny writeable mappings when implying SEAL_WRITE (bsc#1272468).\n- CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272466).\n- CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272678).\n- CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp() (bsc#1273035).\n- CVE-2026-64025: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx (bsc#1273117).\n- CVE-2026-64061: netfs: Fix early put of sink folio in netfs_read_gaps() (bsc#1272505).\n- CVE-2026-64091: batman-adv: tt: fix TOCTOU race for reported vlans (bsc#1272514).\n- CVE-2026-64106: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (bsc#1272242).\n- CVE-2026-64157: netfs: Fix partial invalidation of streaming-write folio (bsc#1272462).\n- CVE-2026-64158: netfs: Fix write streaming disablement if fd open O_RDWR (bsc#1272524).\n- CVE-2026-64187: xfs: fail recovery on a committed log item with no regions (bsc#1272204).\n- CVE-2026-64188: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() (bsc#1272150).\n- CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272207).\n- CVE-2026-64357: xfs: fix exchmaps reservation limit check (bsc#1272612).\n- CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing (bsc#1274072).\n- CVE-2026-64561: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (bsc#1273231).\n- CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (bsc#1271526).\n\nThe following non security issues were fixed:\n\n- accel/ivpu: Fix wrong register read in LNL failure diagnostics (git-fixes).\n- accel/ivpu: Reject firmware log with size smaller than header (git-fixes).\n- ALSA: hda: codecs: hdmi: disable keep-alive before audio format change (git-fixes).\n- ALSA: hda: conexant: Remove mic bias threshold override (git-fixes).\n- ALSA: hda: cs35l41: validate and free ACPI mute object (git-fixes).\n- ALSA: hda: Fix cached processing coefficient verbs (git-fixes).\n- ALSA: lx6464es: fix period byte count for 16-bit streams (git-fixes).\n- ALSA: pcm: wake linked drain waiters on unlink (git-fixes).\n- ALSA: scarlett2: Allow selecting config_set by firmware version (stable-fixes).\n- ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417 (git-fixes).\n- ALSA: seq: close a re-opened queue timer in the destructor (git-fixes).\n- ALSA: seq: Fix division by zero in initialize_timer() (git-fixes).\n- ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (git-fixes).\n- ALSA: timer: don't re-enter an instance callback that is still running (git-fixes).\n- ALSA: timer: drain a slave's callback before its master detaches it (git-fixes).\n- ALSA: ump: fix double free of out_cvts on rawmidi error (git-fixes).\n- ALSA: usb-audio: Clamp frame size in implicit-feedback mode (git-fixes).\n- ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() (git-fixes).\n- ALSA: usb-audio: fix stack info leak in RME Digiface status (git-fixes).\n- ALSA: usb-audio: fix use-after-free in ump_to_endpoint() (git-fixes).\n- ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC (git-fixes).\n- apparmor: fix use-after-free in rawdata dedup loop (git-fixes).\n- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (git-fixes).\n- ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() (git-fixes).\n- ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI (git-fixes).\n- ASoC: cs35l56: Fix potential probe() deadlock (git-fixes).\n- ASoC: cs35l56: Use complete_all() to signal init_completion (git-fixes).\n- ASoC: cs42l43: Correct report for forced microphone jack (git-fixes).\n- ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP (git-fixes).\n- ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop (git-fixes).\n- ASoC: tas2562: fix broken entries in the volume lookup table (git-fixes).\n- ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup (git-fixes).\n- ASoC: tas2562: fix DVC coefficient write order (git-fixes).\n- ASoC: tas2781: bound firmware description string parsing (git-fixes).\n- assoc_array: trim the final shortcut word using the current chunk end (git-fixes).\n- batman-adv: bla: reacquire gw address after skb realloc (git-fixes).\n- batman-adv: dat: ensure accessible eth_hdr proto field (git-fixes).\n- batman-adv: dat: fix tie-break for candidate selection (git-fixes).\n- batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes).\n- batman-adv: fix VLAN priority offset (git-fixes).\n- batman-adv: frag: fix primary_if leak on failed linearization (git-fixes).\n- batman-adv: frag: free unfragmentable packet (git-fixes).\n- batman-adv: mcast: avoid OOB read of num_dests header (git-fixes).\n- batman-adv: tt: avoid request storms during pending request (git-fixes).\n- batman-adv: tt: prevent TVLV OOB check overflow (git-fixes).\n- bitops: use common function parameter names (git-fixes).\n- Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (stable-fixes).\n- Bluetooth: 6lowpan: Fix using chan-\u003econn as indication to no remote netdev (git-fixes).\n- Bluetooth: btintel: Validate length before parsing diagnostics TLV (git-fixes).\n- Bluetooth: btrtl: validate firmware patch bounds (git-fixes).\n- Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB (stable-fixes).\n- Bluetooth: btusb: validate Realtek vendor event length (git-fixes).\n- Bluetooth: hci_qca: Clear memdump state on invalid dump size (git-fixes).\n- Bluetooth: hci_sync: Fix advertising data UAFs (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback (git-fixes).\n- Bluetooth: hci_sync: Protect UUID list traversal (git-fixes).\n- Bluetooth: HIDP: reject frames without a transaction header (git-fixes).\n- Bluetooth: HIDP: validate numbered report payloads (git-fixes).\n- Bluetooth: ISO: clear iso_data always when detaching conn from hcon (git-fixes).\n- Bluetooth: ISO: fix CONNECTED -\u003e CLOSED transition on shutdown/release (git-fixes).\n- Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos (git-fixes).\n- Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis() (git-fixes).\n- Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (git-fixes).\n- Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (git-fixes).\n- Bluetooth: mgmt: Translate HCI reason in Device Disconnected event (git-fixes).\n- Bluetooth: RFCOMM: Fix session UAF in set_termios (git-fixes).\n- Bluetooth: SCO: give the socket its own sco_conn reference (git-fixes).\n- btrfs: do not trim a device which is not writeable (bsc#1272568).\n- bus: sunxi-rsb: Always check register address validity (git-fixes).\n- can: bcm: add missing rcu list annotations and operations (git-fixes).\n- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (git-fixes).\n- can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure (git-fixes).\n- can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured (git-fixes).\n- can: ctucanfd: add missing MODULE_DEVICE_TABLE() (git-fixes).\n- can: ctucanfd: handle bus error interrupts (git-fixes).\n- can: ctucanfd: mark error-active controller status valid (git-fixes).\n- can: ctucanfd: unmap BAR0 using base address (git-fixes).\n- can: ctucanfd: use self-test mode for PRESUME_ACK (git-fixes).\n- can: ems_usb: validate CPC message lengths (git-fixes).\n- can: esd_usb: kill anchored URBs before freeing netdevs (git-fixes).\n- can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure (git-fixes).\n- can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure (git-fixes).\n- can: isotp: check register_netdevice_notifier() error in module init (git-fixes).\n- can: isotp: use unconditional synchronize_rcu() in isotp_release() (git-fixes).\n- can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer (git-fixes).\n- can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() (git-fixes).\n- can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents (git-fixes).\n- can: peak_usb: add bounds check for USB channel index (git-fixes).\n- can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error (git-fixes).\n- can: peak_usb: validate uCAN receive record lengths (git-fixes).\n- can: softing: fw_parse(): validate firmware record spans (git-fixes).\n- cdrom: fix stack out-of-bounds read in CDROMVOLCTRL (git-fixes).\n- comedi: comedi_parport: deal with premature interrupt (git-fixes).\n- crypto/xxhash: set downstream CRYPTO_ALG_FIPS_UNAPPROVED (bsc#1262160 jsc#PED-15986).\n- crypto: introduce downstream CRYPTO_ALG_FIPS_UNAPPROVED (bsc#1262160 jsc#PED-15986).\n- crypto: qat - keep VFs enabled during reset (stable-fixes).\n- crypto: qat - notify fatal error before AER reset preparation (stable-fixes).\n- dm cache policy smq: check allocation under invalidate lock (git-fixes).\n- dm cache: fix missing return in invalidate_committed's error path (git-fixes).\n- dmaengine: idxd: fix double free of wq, engine, and group structs (git-fixes).\n- dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (git-fixes).\n- dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ (git-fixes).\n- dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA (git-fixes).\n- driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout() (git-fixes).\n- driver core: Guard deferred probe timeout extension with delayed_work_pending() (git-fixes).\n- driver core: Use mod_delayed_work to prevent lost deferred probe work (git-fixes).\n- Drivers: hv: vmbus: Set DMA coherent mask for VMBus devices (git-fixes).\n- drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference (git-fixes).\n- drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips (git-fixes).\n- drm/amd/display: set new_stream to NULL after release (git-fixes).\n- drm/amd/display: use proper context for logging (git-fixes).\n- drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) (git-fixes).\n- drm/amd/pm: fix amdgpu_pm_info power display units (git-fixes).\n- drm/amd/pm: fix smu13 power limit range calculation (git-fixes).\n- drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge (git-fixes).\n- drm/amdgpu: fix aperture mapping leak (git-fixes).\n- drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment (git-fixes).\n- drm/amdkfd: free MQD managers on DQM init failures (git-fixes).\n- drm/amdkfd: hold event_mutex while checkpointing CRIU events (git-fixes).\n- drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs (git-fixes).\n- drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() (git-fixes).\n- drm/gfx10: Program DB_RING_CONTROL (git-fixes).\n- drm/i915/bios: range check LFP Data Block panel_type2 (git-fixes).\n- drm/i915/gem: Do not leak siblings[] on proto context error (git-fixes).\n- drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU (git-fixes).\n- drm/i915/gt: use correct selftest config symbol (git-fixes).\n- drm/i915/selftests: Fix GT PM sort comparators (git-fixes).\n- drm/i915: ensure segment offset never exceeds allowed max (stable-fixes).\n- drm/i915: Return NULL on error in active_instance (git-fixes).\n- drm/imagination: acquire vm_ctx-\u003elock before mapping memory to GPU VM (git-fixes).\n- drm/imagination: Fix double call to drm_sched_entity_fini() (git-fixes).\n- drm/imagination: fix error checking of pvr_vm_context_lookup() (git-fixes).\n- drm/imagination: Fix returned size for DRM_IOCTL_PVR_DEV_QUERY (git-fixes).\n- drm/imagination: Fix user array stride in pvr_set_uobj_array() (git-fixes).\n- drm/mediatek: Check CRTC state before freeing (git-fixes).\n- drm/mediatek: ovl_adaptor: balance component registrations (git-fixes).\n- drm/panthor: Don't overrule pending immediate ticks in sched_resume_tick() (git-fixes).\n- drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced (git-fixes).\n- drm/panthor: Fix potential invalid pointer deref in group_process_tiler_oom() (git-fixes).\n- drm/panthor: Interrupt group start/resumption if group_bind_locked() fails (git-fixes).\n- drm/panthor: reject firmware sections with oversized data (git-fixes).\n- drm/panthor: return error on truncated firmware (git-fixes).\n- drm/panthor: validate firmware interface structure sizes (git-fixes).\n- drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove (git-fixes).\n- drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered (stable-fixes).\n- drm/tests: shmem: Set DMA mask to 64-bit in drm_gem_shmem (git-fixes).\n- drm/v3d: Reject invalid indirect BO handle in indirect CSD setup (git-fixes).\n- drm/vc4: hvs/v3d: Fix null dereference in unbind (git-fixes).\n- drm/vc4: Prevent shader BO mappings from becoming writable (git-fixes).\n- drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size (git-fixes).\n- drm/vc4: Zero the tile state data array before each BIN job (git-fixes).\n- drm/virtio: bound EDID block reads to the response buffer (git-fixes).\n- drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker (git-fixes).\n- drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure (git-fixes).\n- drm/vmwgfx: bound DMA command body size against suffix pointer (git-fixes).\n- drm/vmwgfx: drop dma_buf reference on foreign-fd prime import (git-fixes).\n- drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size (git-fixes).\n- drm/vmwgfx: reject DX_BIND_QUERY without a DX context (git-fixes).\n- drm/vmwgfx: use check_add_overflow for shader size+offset bound (git-fixes).\n- drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (git-fixes).\n- drm/vmwgfx: validate external BO copy bounds for both stride paths (git-fixes).\n- drm/vmwgfx: Validate vmw_surface_metadata::array_size (git-fixes).\n- drm/xe/hw_engine: Fix double-free of managed BO in error path (git-fixes).\n- drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays (git-fixes).\n- drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry() (git-fixes).\n- drm/xe/wopcm: fix WOPCM size for LNL+ (git-fixes).\n- drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds (git-fixes).\n- drm/xe: remove duplicate \u003ckunit/test-bug.h\u003e include (git-fixes).\n- erofs: set fileio bio failed in short read case (git-fixes).\n- fbcon: fix NULL pointer dereference for a console without vc_data (stable-fixes).\n- fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() (git-fixes).\n- fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() (git-fixes).\n- fbdev: efifb: fix memory leak in efifb_probe() (git-fixes).\n- fbdev: hecubafb: fix potential memory leak in hecubafb_probe() (git-fixes).\n- fbdev: i740fb: fix potential memory leak in i740fb_probe() (git-fixes).\n- fbdev: metronomefb: fix potential memory leak in metronomefb_probe() (git-fixes).\n- fbdev: nvidia: fix potential memory leak in nvidiafb_probe() (git-fixes).\n- fbdev: radeon: fix potential memory leak in radeonfb_pci_register() (git-fixes).\n- fbdev: s3fb: fix potential memory leak in s3_pci_probe() (git-fixes).\n- fbdev: sm501fb: Fix buffer errors in OF binding code (git-fixes).\n- fbdev: sm712: Fix operator precedence in big_swap macro (git-fixes).\n- fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() (git-fixes).\n- fbdev: tridentfb: fix potential memory leak in trident_pci_probe() (git-fixes).\n- fbdev: uvesafb: fix potential memory leak in uvesafb_probe() (git-fixes).\n- fbdev: vesafb: fix memory leak in vesafb_probe() (git-fixes).\n- firewire: net: Fix fragmented datagram reassembly (git-fixes).\n- firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() (git-fixes).\n- firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits (git-fixes).\n- gpio-f7188x: Add support for NCT6126D version B (git-fixes).\n- gpio: davinci: fix IRQ domain leak on devm_kzalloc failure (git-fixes).\n- gpio: eic-sprd: use raw_spinlock_t in the irq startup path (git-fixes).\n- gpio: htc-egpio: use managed gpiochip registration (git-fixes).\n- gpio: mlxbf3: fail probe if gpiochip registration fails (git-fixes).\n- gpio: mvebu: fail probe if gpiochip registration fails (git-fixes).\n- gpio: mvebu: free generic chips on unbind (git-fixes).\n- gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (git-fixes).\n- gpio: rockchip: change the GPIO version judgment logic (stable-fixes).\n- gpio: rockchip: fix generic IRQ chip leak on remove (git-fixes).\n- gpio: rockchip: teardown bugs and resource leaks (git-fixes).\n- gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe() (git-fixes).\n- gpio: tegra: do not call pinctrl for GPIO direction (git-fixes).\n- gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe (git-fixes).\n- gpios: palmas: add .get_direction() op (git-fixes).\n- HID: add haptics page defines (stable-fixes).\n- HID: hid-sjoy: race between init and usage (git-fixes).\n- HID: pidff: Add missing spaces (stable-fixes).\n- HID: pidff: Fix missing blank lines after declarations (stable-fixes).\n- HID: playstation: validate num_touch_reports in DualShock 4 reports (stable-fixes).\n- hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread (git-fixes).\n- hwmon: (adt7470) Fix cache updated before hardware write on I2C error (git-fixes).\n- hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read (git-fixes).\n- hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors (git-fixes).\n- hwmon: (adt7470) Fix PWM auto temp state array and bounds check (git-fixes).\n- hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks (git-fixes).\n- hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() (git-fixes).\n- hwmon: (adt7470) Use cached PWM frequency value (git-fixes).\n- hwmon: (asus-ec-sensors) add missed handle for ENOMEM (git-fixes).\n- hwmon: (asus-ec-sensors) fix EC read intervals (git-fixes).\n- hwmon: (asus-ec-sensors) fix looping over banks while reading from EC (git-fixes).\n- hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (lm90) Only report alarms if driver is ready (git-fixes).\n- hwmon: (ltc4282) Fix reading the minimum alarm voltage (git-fixes).\n- hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 (git-fixes).\n- hwmon: (nct6775-core) Prevent access to unsupported weight registers (git-fixes).\n- hwmon: (npcm750-pwm-fan): stop fan timer on device detach (git-fixes).\n- hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (nzxt-smart2) DMA-align output buffer (git-fixes).\n- hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (pmbus) Fix return value from pmbus_update_byte_data() (git-fixes).\n- hwmon: (pmbus/core) notify on the hwmon device, not the i2c client (git-fixes).\n- hwmon: (sht3x) Fix unaligned accesses (git-fixes).\n- hwmon: (w83627hf) remove VID sysfs files on error and remove (stable-fixes).\n- hwmon: (w83793) remove vrm sysfs file on probe failure (stable-fixes).\n- hwmon: occ: validate poll response sensor blocks (git-fixes).\n- i2c: amd-mp2: Unregister callback on adapter add failure (git-fixes).\n- i2c: imx: Cancel hrtimer before clearing slave pointer (git-fixes).\n- i2c: imx: Fix slave registration race and error handling (git-fixes).\n- i2c: iproc: reset bus after timeout if START_BUSY is stuck (git-fixes).\n- i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock (git-fixes).\n- i2c: mediatek: fix WRRD for SoCs without auto_restart option (git-fixes).\n- i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() (git-fixes).\n- i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue (git-fixes).\n- i3c: mipi-i3c-hci: Preserve RUN bit when aborting DMA ring (git-fixes).\n- ieee802154: admin-gate legacy LLSEC dump operations (git-fixes).\n- ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation (git-fixes).\n- ieee802154: ca8210: fix cas_ctl leak on spi_async failure (git-fixes).\n- ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit (git-fixes).\n- ieee802154: fix kernel-infoleak in dgram_recvmsg() (git-fixes).\n- ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() (git-fixes).\n- iio: accel: bmc150: clamp the device-reported FIFO frame count (git-fixes).\n- iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error (git-fixes).\n- iio: adc: lpc32xx: Initialize completion before requesting IRQ (git-fixes).\n- iio: adc: spear: Initialize completion before requesting IRQ (git-fixes).\n- iio: adc: ti-ads124s08: Return reset GPIO lookup errors (git-fixes).\n- iio: adc: ti-ads1119: fix PM reference leak in buffer preenable (git-fixes).\n- iio: common: st_sensors: honour channel endianness in read_axis_data (git-fixes).\n- iio: event: Fix event FIFO reset race (git-fixes).\n- iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ (git-fixes).\n- iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ (git-fixes).\n- iio: imu: inv_icm42600: fix timestamp clock period by using lower value (git-fixes).\n- iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading (git-fixes).\n- iio: imu: st_lsm6dsx: deselect shub page before reading whoami (git-fixes).\n- iio: light: al3010: fix incorrect scale for the highest gain range (git-fixes).\n- iio: light: gp2ap002: fix runtime PM leak on read error (git-fixes).\n- iio: light: tsl2591: return actual error from probe IRQ failure (git-fixes).\n- iio: magnetometer: ak8975: fix potential kernel stack memory leak (git-fixes).\n- iio: temperature: Build mlx90635 with CONFIG_MLX90635 (git-fixes).\n- Input: ads7846 - restore half-duplex support (git-fixes).\n- Input: atkbd - validate scancode in firmware keymap entries (git-fixes).\n- Input: elan_i2c - prevent division by zero and arithmetic underflow (git-fixes).\n- Input: goodix - clamp the device-reported contact count (git-fixes).\n- Input: iforce - bound the device-reported force-feedback effect index (git-fixes).\n- Input: ims-pcu - add response length checks (git-fixes).\n- Input: ims-pcu - fix DMA mapping violation in line setup (git-fixes).\n- Input: ims-pcu - fix firmware leak in async update (git-fixes).\n- Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() (git-fixes).\n- Input: ims-pcu - fix logic error in packet reset (git-fixes).\n- Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging (git-fixes).\n- Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix race condition in reset_device sysfs callback (git-fixes).\n- Input: ims-pcu - fix type confusion in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix use-after-free and double-free in disconnect (git-fixes).\n- Input: ims-pcu - only expose sysfs attributes on control interface (git-fixes).\n- Input: ims-pcu - release data interface on disconnect (git-fixes).\n- Input: ims-pcu - validate control endpoint type (git-fixes).\n- Input: maple_keyb - set driver data before registering input device (stable-fixes).\n- Input: maplecontrol - set driver data before registering input device (stable-fixes).\n- Input: maplemouse - fix NULL pointer dereference in open() (git-fixes).\n- Input: maplemouse - set driver data before registering input device (stable-fixes).\n- Input: mms114 - fix multi-touch slot corruption (git-fixes).\n- Input: mms114 - fix touch indexing for MMS134S and MMS136 (git-fixes).\n- Input: mms114 - reject an oversized device packet size (git-fixes).\n- Input: rmi4 - fix bit count in bitmap_copy() (git-fixes).\n- Input: rmi4 - fix limit in rmi_register_desc_has_subpacket() (git-fixes).\n- Input: rmi4 - fix memory leak in rmi_set_attn_data() (git-fixes).\n- Input: rmi4 - fix num_subpackets overflow in register descriptor (git-fixes).\n- Input: rmi4 - fix register descriptor address calculation (git-fixes).\n- Input: rmi4 - fix type overflow in register counts (git-fixes).\n- Input: rmi4 - initialize attn_fifo properly (stable-fixes).\n- Input: rmi4 - iterative IRQ handler (git-fixes).\n- Input: rmi4 - refactor F12 probe function (stable-fixes).\n- Input: rmi4 - refactor function allocation and registration (stable-fixes).\n- Input: rmi4 - refactor register descriptor parsing (git-fixes).\n- Input: rmi4 - tolerate short register descriptor structure (git-fixes).\n- Input: rmi4 - use local presence map in rmi_read_register_desc() (stable-fixes).\n- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (git-fixes).\n- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (git-fixes).\n- Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure (git-fixes).\n- Input: touchwin - reset the packet index on every complete packet (git-fixes).\n- intel_th: core: fix null pointer dereference in intel_th_irq (bsc#1248480).\n- intel_th: fix MSC output device reference leak (git-fixes).\n- io_uring/kbuf: don't truncate end buffer for bundles (bsc#1271290).\n- io_uring/kbuf: fix missing BUF_MORE for incremental buffers at EOF (bsc#1261250).\n- io_uring/kbuf: flag partial buffer mappings (bsc#1271290).\n- io_uring/kbuf: propagate BUF_MORE through early buffer commit path (bsc#1261250).\n- io_uring/net: always use current transfer count for buffer put (git-fixes).\n- io_uring/net: improve recv bundles (bsc#1271290).\n- io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries (bsc#1271290).\n- io_uring/net: only consider msg_inq if larger than 1 (git-fixes).\n- io_uring/net: only retry recv bundle for a full transfer (bsc#1271290).\n- io_uring/timeout: add helper for parsing user time (bsc#1271291).\n- io_uring/timeout: honour caller's time namespace for IORING_TIMEOUT_ABS (bsc#1271291).\n- io_uring/timeout: migrate reqs from ts64 to ktime (bsc#1271291).\n- io_uring/wait: honour caller's time namespace for IORING_ENTER_ABS_TIMER (bsc#1271291).\n- ixgbe: reduce number of reads when getting OROM data (bsc#1269637).\n- KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT (git-fixes).\n- KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) (git-fixes).\n- KVM: nSVM: Clear tracking of L1-\u003eL2 NMI and soft IRQ on nested #VMEXIT (git-fixes).\n- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (git-fixes).\n- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (git-fixes).\n- KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs (git-fixes).\n- KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug (git-fixes).\n- KVM: TDX: Reject concurrent change to CPUID entry count (git-fixes).\n- KVM: x86/mmu: Check write tracking in all address spaces (git-fixes).\n- KVM: x86/mmu: Fix use-after-free on vendor module reload (git-fixes).\n- KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots (git-fixes).\n- KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs (git-fixes).\n- KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN (git-fixes).\n- leds: uleds: Fix potential buffer overread (git-fixes).\n- mac802154: hold an interface reference across the scan worker (git-fixes).\n- mac802154: llsec: reject frames shorter than the authentication tag (git-fixes).\n- mac802154: Prevent overwrite return code in mac802154_perform_association() (git-fixes).\n- mac802154: remove interfaces with RCU list deletion (git-fixes).\n- mailbox: zynqmp: setup IPI for each valid child node (bsc#1271395).\n- mctp: Fix incorrect tx flow invalidation condition in mctp-i2c (bsc#1266694).\n- media: aspeed: fix missing of_reserved_mem_device_release() on probe failure (git-fixes).\n- media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() (git-fixes).\n- media: atomisp: gc2235: fix UAF and memory leak (git-fixes).\n- media: cec: seco: unregister adapter on IR probe failure (git-fixes).\n- media: cedrus: Fix failure to clean up hardware on probe failure (git-fixes).\n- media: cedrus: Fix missing cleanup in error path (git-fixes).\n- media: cedrus: skip invalid H.264 reference list entries (git-fixes).\n- media: marvell-cam: fix missing pci_disable_device() on remove (git-fixes).\n- media: mtk-jpeg: cancel workqueue on release for supported platforms only (git-fixes).\n- media: nxp: imx8-isi: Fix use-after-free on remove (git-fixes).\n- media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code (stable-fixes).\n- media: pci: dm1105: Free allocated workqueue (git-fixes).\n- media: qcom: camss: vfe: fix PIX subdev naming on VFE lite (git-fixes).\n- media: qcom: venus: drop extra padding in NV12 raw size calculation (git-fixes).\n- media: qcom: venus: relax encoder frame/blur dimension steps on v4 (git-fixes).\n- media: qcom: venus: relax encoder frame/blur step size on v6 (git-fixes).\n- media: rockchip: rga: fix too small buffer size (git-fixes).\n- media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe (git-fixes).\n- media: ti: vpe: unwind v4l2 device registration on probe error (git-fixes).\n- media: uvcvideo: Avoid partial metadata buffers (git-fixes).\n- media: uvcvideo: Do not add clock samples with small sof delta (git-fixes).\n- media: uvcvideo: Fix buffer sequence in frame gaps (git-fixes).\n- media: uvcvideo: Fix dev_sof filtering in hw timestamp (git-fixes).\n- media: uvcvideo: Fix sequence number when no EOF (git-fixes).\n- media: uvcvideo: Relax the constrains for interpolating the hw clock (git-fixes).\n- media: uvcvideo: Use hw timestaming if the clock buffer is full (git-fixes).\n- media: v4l2-common: Add YUV24 format info (git-fixes).\n- media: v4l2-ctrls: validate HEVC active reference counts (git-fixes).\n- media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si (git-fixes).\n- media: vidtv: fix reference leak on failed device registration (git-fixes).\n- media: vimc: fix reference leak on failed device registration (git-fixes).\n- media: vpif_capture: fix OF node reference imbalance (git-fixes).\n- mei: bus: access mei_device under device_lock on cleanup (git-fixes).\n- memory: tegra: Wire up system sleep PM ops (git-fixes).\n- memstick: ms_block: reject a card that reports too many blocks (git-fixes).\n- mfd: cros_ec: Delay dev_set_drvdata() until probe success (git-fixes).\n- mfd: cs42l43: Sanity check firmware size (git-fixes).\n- mfd: rsmu: Fix page register setup (git-fixes).\n- mfd: sm501: Fix reference leak on failed device registration (git-fixes).\n- mfd: tps6586x: Fix OF node refcount (git-fixes).\n- misc: nsm: only unlock nsm_dev on post-lock error paths (git-fixes).\n- misc: nsm: pin the module while the device is open (git-fixes).\n- mkspec-dtb: Skip missing DTBs.\n- mm: zero range of eof folio exposed by inode size extension (bsc#1272920).\n- mmc: block: fix RPMB device unregister ordering (git-fixes).\n- mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe() method (git-fixes).\n- mmc: vub300: defer reset until cmd_mutex is unlocked (git-fixes).\n- mshv: fix hv_input_get_system_property struct (git-fixes).\n- mtd: mchp23k256: use SPI match data for chip caps (git-fixes).\n- mtd: onenand: samsung: report DMA completion timeouts (git-fixes).\n- mtd: rawnand: fsl_ifc: return errors for failed page reads (git-fixes).\n- mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout (git-fixes).\n- mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout (git-fixes).\n- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (bsc#1271866).\n- net/x25: fix use-after-free in x25_kill_by_neigh() (git-fixes).\n- net: mana: Add Interrupt Moderation support (bsc#1271368).\n- net: mana: Return error code from mana_create_rxq() (git-fixes).\n- net: mctp i2c: Copy headers if cloned (bsc#1266694).\n- net: mctp-i2c: fix duplicate reception of old data (bsc#1266694).\n- net: thunderbolt: Fix frags overflow by bounding frame_count (git-fixes).\n- net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() (git-fixes).\n- net: usb: lan78xx: move functions to avoid forward definitions (stable-fixes).\n- net: wwan: t7xx: check skb_clone in control TX (git-fixes).\n- net: wwan: t7xx: destroy DMA pool on CLDMA late init failure (git-fixes).\n- netfs: Defer the emission of trace_netfs_folio() (git-fixes).\n- of: cpu: add check in __of_find_n_match_cpu_property() (git-fixes).\n- phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access (git-fixes).\n- phy: phy-can-transceiver: Check driver match and driver data against NULL (git-fixes).\n- phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask (git-fixes).\n- phy: zynqmp: fix runtime PM leak on probe allocation failure (git-fixes).\n- phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB (git-fixes).\n- phy: zynqmp: use read-modify-write for SERDES scrambler bypass (git-fixes).\n- pinctrl-amd: Don't clear S4 wake bits at probe (git-fixes).\n- pinctrl: bm1880: add missing select GENERIC_PINCONF (git-fixes).\n- pinctrl: cs42l43: Fix polarity on debounce (git-fixes).\n- pinctrl: devicetree: don't free uninitialized dev_name on error path (git-fixes).\n- pinctrl: equilibrium: fix warning trace on load (git-fixes).\n- pinctrl: equilibrium: rename irq_chip function callbacks (stable-fixes).\n- pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: meson: restore non-sleeping GPIO access (git-fixes).\n- pinctrl: nuvoton: ma35d1: fix MFP register offset and pin table (git-fixes).\n- pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 (git-fixes).\n- pinctrl: qcom: Unconditionally mark gpio as wakeup enable (git-fixes).\n- pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path (git-fixes).\n- pkspec-dtb: Fix dtb-al rename.\n- platform/x86/amd/pmc: Add delay_suspend module parameter (stable-fixes).\n- platform/x86/amd/pmc: Avoid logging \"(null)\" for DMI values (git-fixes).\n- platform/x86/amd/pmc: Check for intermediate wakeup in function (stable-fixes).\n- platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops (stable-fixes).\n- platform/x86/amd/pmc: Don't log during intermediate wakeups (stable-fixes).\n- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (git-fixes).\n- posix-cpu-timers: Cleanup the firing logic (bsc#1271912).\n- posix-cpu-timers: Correctly update timer status in posix_cpu_timer_del() (bsc#1271912).\n- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (bsc#1271912).\n- posix-timers: Add proper state tracking (bsc#1271912).\n- posix-timers: Avoid direct access to hrtimer clockbase (bsc#1271912).\n- posix-timers: Expand timer_arm() callbacks with a boolean return value (bsc#1271912).\n- power: sequencing: fix ABBA deadlock in pwrseq_device_unregister() (git-fixes).\n- power: supply: bq25890: fix the -10 C NTC lookup entry (git-fixes).\n- power: supply: max17040: handle missing status supplier (git-fixes).\n- RDMA/mana_ib: initialize err for empty send WR lists (git-fixes).\n- regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK (git-fixes).\n- regulator: ltc3676: Fix incorrect IRQSTAT bit offsets (git-fixes).\n- regulator: mt6358: use regmap helper to read fixed LDO calibration (git-fixes).\n- remoteproc: qcom: Fix leak when custom dump_segments addition fails (git-fixes).\n- reset: sunxi: fix memory region leak on ioremap failure (git-fixes).\n- Revert \"Input: rmi4 - fix register descriptor address calculation\" (stable-fixes).\n- sctp: validate embedded address parameter length (git-fixes).\n- security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() (git-fixes).\n- selftests: Disable dad for ipv6 in fcnal-test.sh (bsc#1272871).\n- selftests: Replace sleep with slowwait (bsc#1272871).\n- serial: 8250_mid: Disable DMA for selected platforms (git-fixes).\n- serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms (git-fixes).\n- serial: 8250_omap: clear rx_running on zero-length DMA completes (git-fixes).\n- serial: msm: Disable DMA for kernel console UART (git-fixes).\n- serial: sc16is7xx: implement gpio get_direction() callback (git-fixes).\n- soc: fsl: qe: panic on ioremap() failure in qe_reset() (git-fixes).\n- soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy (git-fixes).\n- soc: xilinx: Shutdown and free rx mailbox channel (git-fixes).\n- spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure (git-fixes).\n- spi: sh-msiof: abort transfers when reset times out (git-fixes).\n- staging: media: atomisp: fix loop shadowing in ia_css_stream_destroy() (git-fixes).\n- staging: media: atomisp: reduce load_primary_binaries() stack usage (git-fixes).\n- staging: rtl8723bs: core: move constants to right side in comparison (stable-fixes).\n- staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() (git-fixes).\n- staging: rtl8723bs: fix inverted HT40 secondary channel offset (git-fixes).\n- staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() (git-fixes).\n- staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB write in HT_caps_handler() (git-fixes).\n- staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() (git-fixes).\n- thermal: core: Free thermal zone ID later during removal (git-fixes).\n- time: Switch to hrtimer_setup() (bsc#1271912).\n- tpm: Make the TPM character devices non-seekable (git-fixes).\n- uio_hv_generic: Bind to FCopy device by default (git-fixes).\n- usb: cdc_acm: Add quirk for Uniden BC125AT scanner (stable-fixes).\n- usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() (git-fixes).\n- USB: chaoskey: Fix slab-use-after-free in chaoskey_release() (git-fixes).\n- usb: chipidea: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub (stable-fixes).\n- usb: core: port: Deattach Type-C connector on component unbind (git-fixes).\n- usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() (git-fixes).\n- usb: dwc3: run gadget disconnect from sleepable suspend context (git-fixes).\n- usb: free iso schedules on failed submit (git-fixes).\n- usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler (git-fixes).\n- usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback (git-fixes).\n- usb: gadget: f_fs: Fix DMA fence leak (git-fixes).\n- usb: gadget: f_midi: cancel pending IN work before freeing the midi object (git-fixes).\n- usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() (git-fixes).\n- usb: gadget: f_printer: take kref only for successful open (git-fixes).\n- USB: gadget: fsl-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: function: rndis: add length check for header (stable-fixes).\n- usb: gadget: function: rndis: add length check to response query (stable-fixes).\n- usb: gadget: printer: fix infinite loop in printer_read() (git-fixes).\n- USB: gadget: snps-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown (git-fixes).\n- usb: gadget: udc: Fix use-after-free in gadget_match_driver (stable-fixes).\n- usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer (git-fixes).\n- USB: idmouse: fix use-after-free on disconnect race (git-fixes).\n- USB: iowarrior: fix use-after-free on disconnect (git-fixes).\n- USB: iowarrior: fix use-after-free on disconnect race (git-fixes).\n- usb: iowarrior: remove inherent race with minor number (stable-fixes).\n- USB: ldusb: fix use-after-free on disconnect race (git-fixes).\n- USB: legousbtower: fix use-after-free on disconnect race (git-fixes).\n- USB: misc: uss720: unregister parport on probe failure (git-fixes).\n- usb: mtu3: unmap request DMA on queue failure (git-fixes).\n- USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD (stable-fixes).\n- USB: serial: digi_acceleport: fix broken rx after throttle (git-fixes).\n- USB: serial: digi_acceleport: fix hard lockup on disconnect (git-fixes).\n- USB: serial: digi_acceleport: fix write buffer corruption (git-fixes).\n- USB: serial: io_edgeport: cap received transmit credits (git-fixes).\n- USB: serial: io_ti: reject oversized boot-mode firmware (git-fixes).\n- USB: serial: keyspan_pda: fix data loss on receive throttling (git-fixes).\n- USB: serial: keyspan_pda: fix information leak (git-fixes).\n- USB: serial: mxuport: validate firmware header size (git-fixes).\n- USB: serial: option: add MeiG SRM813Q (stable-fixes).\n- USB: serial: option: add Telit Cinterion FE990D50 compositions (stable-fixes).\n- usb: sl811-hcd: disable controller wakeup on remove (git-fixes).\n- USB: storage: include US_FL_NO_SAME in quirks mask (git-fixes).\n- usb: typec: anx7411: use devm_pm_runtime_enable() (git-fixes).\n- usb: typec: class: drop PD lookup reference (git-fixes).\n- usb: typec: tcpm: Fix VDM type for Enter Mode commands (git-fixes).\n- usb: typec: tcpm: Validate SVID index in svdm_consume_modes() (git-fixes).\n- usb: typec: ucsi: cancel pending work on system suspend (git-fixes).\n- usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove (git-fixes).\n- usb: typec: ucsi: Detect and skip duplicate altmodes from buggy firmware (git-fixes).\n- usb: typec: ucsi: Invert DisplayPort role assignment (git-fixes).\n- usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode (git-fixes).\n- USB: ulpi: fix memory leak on registration failure (git-fixes).\n- USB: usb-storage: ene_ub6250: restore media-ready check (git-fixes).\n- usb: xhci: Fix sleep in atomic context in xhci_free_streams() (git-fixes).\n- usbip: tools: support SuperSpeedPlus devices (git-fixes).\n- usbip: vudc: fix NULL deref in vep_dequeue() (git-fixes).\n- wan: wanxl: Only reset hardware after BAR mapping (git-fixes).\n- watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() (git-fixes).\n- wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() (git-fixes).\n- wifi: ath6kl: fix OOB access from firmware ADDBA window size (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware IE lengths in connect event (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler (git-fixes).\n- wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (git-fixes).\n- wifi: ath10k: fix skb leak on incomplete msdu during rx pop (git-fixes).\n- wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin (git-fixes).\n- wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() (git-fixes).\n- wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: brcmfmac: fix 802.1X-SHA256 call trace warning (git-fixes).\n- wifi: brcmfmac: make release_scratchbuffers idempotent (git-fixes).\n- wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read (git-fixes).\n- wifi: carl9170: fix buffer overflow in rx_stream failover path (git-fixes).\n- wifi: carl9170: fix OOB read from off-by-two in TX status handler (git-fixes).\n- wifi: iwlwifi: mvm: fix read in wake packet notification handler (git-fixes).\n- wifi: iwlwifi: mvm: validate SAR GEO response payload size (git-fixes).\n- wifi: mac80211: fix memory leak in ieee80211_register_hw() (git-fixes).\n- wifi: mac80211: free ack status frame on TX header build failure (git-fixes).\n- wifi: mac80211: recalculate TIM when a station enters power save (git-fixes).\n- wifi: mac80211: tear down new links on vif update error path (git-fixes).\n- wifi: mac80211: validate individual TWT params before driver setup (git-fixes).\n- wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() (git-fixes).\n- wifi: mt76: Disable napi when removing device (git-fixes).\n- wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7915: guard HE capability lookups (git-fixes).\n- wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7925: fix crash in reset link replay (git-fixes).\n- wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv() (git-fixes).\n- wifi: mt76: mt7925: guard link STA in decap offload (git-fixes).\n- wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() (git-fixes).\n- wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() (git-fixes).\n- wifi: mwifiex: bound uAP association event IEs to the event buffer (git-fixes).\n- wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper (git-fixes).\n- wifi: mwifiex: fix permanently busy scans after multiple roam iterations (git-fixes).\n- wifi: mwifiex: fix roaming to different channel in host_mlme mode (git-fixes).\n- wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (git-fixes).\n- wifi: rt2x00: avoid full teardown before work setup in probe (git-fixes).\n- wifi: wilc1000: validate assoc response length before subtracting header (git-fixes).\n- xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit (bsc#1264267).\n- xfs: only assert new size for datafork during truncate extents (bsc#1264084).\n- xfs: rearrange code in xfs_inode_item_precommit (bsc#1237449).\n- xfs: rework datasync tracking and execution (bsc#1237449).\n- xhci: dbgtty: fix device unregister (git-fixes).\n- xhci: dbgtty: fix device unregister: fixup (git-fixes).\n","status":"published","published":"2026-08-12T01:09:28Z","modified":"2026-08-12T17:45:23.234348653Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:23066-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).\n- CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).\n- CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).\n- CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).\n- CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).\n- CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).\n- CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).\n- CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).\n- CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).\n- CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).\n- CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).\n- CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).\n- CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).\n- CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).\n- CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).\n- CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).\n- CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).\n- CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).\n- CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).\n- CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).\n- CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).\n- CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).\n- CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).\n- CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).\n- CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).\n- CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).\n- CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).\n- CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).\n- CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).\n- CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).\n- CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).\n- CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).\n- CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).\n- CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).\n- CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).\n- CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).\n- CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).\n- CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).\n- CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).\n- CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).\n- CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).\n- CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).\n- CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).\n- CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).\n- CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).\n- CVE-2026-46033: crypto: authencesn - reject short ahash digests during instance creation (bsc#1266692).\n- CVE-2026-46034: vfio/cdx: Fix NULL pointer dereference in interrupt trigger path (bsc#1266757).\n- CVE-2026-46036: vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex (bsc#1267470).\n- CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).\n- CVE-2026-46040: inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (bsc#1267472).\n- CVE-2026-46064: ibmasm: fix heap over-read in ibmasm_send_i2o_message() (bsc#1267497).\n- CVE-2026-46068: crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx (bsc#1267592).\n- CVE-2026-46086: net: bridge: use a stable FDB dst snapshot in RCU readers (bsc#1267524).\n- CVE-2026-46089: zram: do not forget to endio for partial discard requests (bsc#1267445).\n- CVE-2026-46102: net: strparser: fix skb_head leak in strp_abort_strp() (bsc#1267502).\n- CVE-2026-46121: mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock (bsc#1266932).\n- CVE-2026-46127: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() (bsc#1267236).\n- CVE-2026-46130: dm-verity-fec: fix reading parity bytes split across blocks (take 3) (bsc#1267629).\n- CVE-2026-46132: net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo (bsc#1267616).\n- CVE-2026-46137: mptcp: pm: ADD_ADDR rtx: fix potential data-race (bsc#1267570).\n- CVE-2026-46147: KVM: arm64: Factor out pKVM hyp vcpu creation to separate function (bsc#1267689).\n- CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).\n- CVE-2026-46158: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (bsc#1266880).\n- CVE-2026-46168: mptcp: sockopt: set timestamp flags on subflow socket, not msk (bsc#1266869).\n- CVE-2026-46170: mptcp: disable add_addr retransmission when timeout is 0 (bsc#1267714).\n- CVE-2026-46189: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (bsc#1266918).\n- CVE-2026-46191: fbcon: Avoid OOB font access if console rotation fails (bsc#1267690).\n- CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks (bsc#1267656).\n- CVE-2026-46207: vsock/virtio: fix length and offset in tap skb for split packets (bsc#1267691).\n- CVE-2026-46216: drm/xe/hdcp: Add NULL check for media_gt in (bsc#1267234).\n- CVE-2026-46234: vsock: fix buffer size clamping order (bsc#1266904).\n- CVE-2026-46245: drm/amd/display: Fix dc_link NULL handling in HPD init (bsc#1267678).\n- CVE-2026-46249: octeontx2-af: Fix PF driver crash with kexec kernel booting (bsc#1267683).\n- CVE-2026-46265: RDMA/hns: Fix WQ_MEM_RECLAIM warning (bsc#1267662).\n- CVE-2026-46287: net: txgbe: fix RTNL assertion warning when remove module (bsc#1267954).\n- CVE-2026-46292: pmdomain: core: Fix detach procedure for virtual devices in genpd (bsc#1267943).\n- CVE-2026-46306: flow_dissector: do not dissect PPPoE PFC frames (bsc#1267986).\n- CVE-2026-46321: tun: free page on short-frame rejection in tun_xdp_one() (bsc#1268024).\n- CVE-2026-46324: netfilter: nf_tables: Introduce functions freeing nft_hook objects (bsc#1267995).\n- CVE-2026-46327: dm: fix unlocked test for dm_suspended_md (bsc#1268031).\n- CVE-2026-46329: erofs: handle end of filesystem properly for file-backed mounts (bsc#1268038).\n- CVE-2026-52913: batman-adv: v: stop OGMv2 on disabled interface (bsc#1268985).\n- CVE-2026-52915: netfilter: ip6t_hbh: reject oversized option lists (bsc#1269001).\n- CVE-2026-52916: batman-adv: frag: disallow unicast fragment in fragment (bsc#1269002).\n- CVE-2026-52921: netfilter: ipset: stop hash:* range iteration at end (bsc#1269024).\n- CVE-2026-52922: batman-adv: dat: handle forward allocation error (bsc#1269030).\n- CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).\n- CVE-2026-52926: batman-adv: clear current gateway during teardown (bsc#1269025).\n- CVE-2026-52927: netfilter: ebtables: fix OOB read in compat_mtw_from_user (bsc#1269027).\n- CVE-2026-52930: ipc/shm: serialize orphan cleanup with shm_nattch updates (bsc#1269003).\n- CVE-2026-52934: batman-adv: tvlv: reject oversized TVLV packets (bsc#1268994).\n- CVE-2026-52937: tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR (bsc#1268983).\n- CVE-2026-52941: net/smc: avoid NULL deref of conn-\u003elnk in smc_msg_event tracepoint (bsc#1268966).\n- CVE-2026-52942: netfilter: nf_log: validate MAC header was set before dumping it (bsc#1268967).\n- CVE-2026-52947: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (bsc#1269115).\n- CVE-2026-52953: iommu/vt-d: Fix oops due to out of scope access (bsc#1269133).\n- CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1269172).\n- CVE-2026-52958: libceph: Fix potential out-of-bounds access in osdmap_decode() (bsc#1269174).\n- CVE-2026-52967: smb/client: fix possible infinite loop and oob read in symlink_data() (bsc#1269181).\n- CVE-2026-52970: netfilter: nft_ct: fix missing expect put in obj eval (bsc#1269229).\n- CVE-2026-52974: net: tls: fix strparser anchor skb leak on offload RX setup failure (bsc#1269233).\n- CVE-2026-52981: neigh: let neigh_xmit take skb ownership (bsc#1269254).\n- CVE-2026-52984: net/sched: netem: fix queue limit check to include reordered packets (bsc#1269272).\n- CVE-2026-52986: netfilter: nf_conntrack_sip: don't use simple_strtoul (bsc#1269289).\n- CVE-2026-52988: netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (bsc#1269362).\n- CVE-2026-52995: net/rds: zero per-item info buffer before handing it to visitors (bsc#1269124).\n- CVE-2026-52998: netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (bsc#1269118).\n- CVE-2026-52999: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (bsc#1269119).\n- CVE-2026-53000: netfilter: nat: use kfree_rcu to release ops (bsc#1269117).\n- CVE-2026-53002: netfilter: conntrack: remove sprintf usage (bsc#1269112).\n- CVE-2026-53003: pppoe: drop PFC frames (bsc#1269111).\n- CVE-2026-53004: sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks (bsc#1269106).\n- CVE-2026-53005: af_unix: Drop all SCM attributes for SOCKMAP (bsc#1269107).\n- CVE-2026-53006: ipv6: fix possible UAF in icmpv6_rcv() (bsc#1269104).\n- CVE-2026-53009: ice: fix double-free of tx_buf skb (bsc#1269098).\n- CVE-2026-53011: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (bsc#1269094).\n- CVE-2026-53012: nexthop: fix IPv6 route referencing IPv4 nexthop (bsc#1269154).\n- CVE-2026-53013: macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF (bsc#1269095).\n- CVE-2026-53014: net/sched: act_mirred: fix wrong device for mac_header_xmit check in tcf_blockcast_redir\n  (bsc#1269092).\n- CVE-2026-53032: bpf: Fix NULL deref in map_kptr_match_type for scalar regs (bsc#1269138).\n- CVE-2026-53035: bpf, sockmap: Fix af_unix iter deadlock (bsc#1269190).\n- CVE-2026-53038: ima_fs: Correctly create securityfs files for unsupported hash algos (bsc#1269391).\n- CVE-2026-53062: dm cache policy smq: fix missing locks in invalidating cache blocks (bsc#1269658).\n- CVE-2026-53063: dm cache: fix write hang in passthrough mode (bsc#1269659).\n- CVE-2026-53064: dm cache: fix null-deref with concurrent writes in passthrough mode (bsc#1269132).\n- CVE-2026-53069: net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master (bsc#1269186).\n- CVE-2026-53074: bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb (bsc#1269688).\n- CVE-2026-53083: bpf: Fix RCU stall in bpf_fd_array_map_clear() (bsc#1269964).\n- CVE-2026-53085: bpf: fix mm lifecycle in open-coded task_vma iterator (bsc#1269879).\n- CVE-2026-53088: net: bcmgenet: fix off-by-one in bcmgenet_put_txcb (bsc#1269185).\n- CVE-2026-53101: wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync (bsc#1269415).\n- CVE-2026-53104: wifi: mt76: Fix memory leak destroying device (bsc#1269157).\n- CVE-2026-53106: bpf: Do not allow deleting local storage in NMI (bsc#1269990).\n- CVE-2026-53107: wifi: libertas: use USB anchors for tracking in-flight URBs (bsc#1269991).\n- CVE-2026-53121: amd-pstate: Fix memory leak in amd_pstate_epp_cpu_init() (bsc#1269198).\n- CVE-2026-53123: md: wake raid456 reshape waiters before suspend (bsc#1269643).\n- CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269773).\n- CVE-2026-53132: vsock/virtio: fix potential unbounded skb queue (bsc#1269290).\n- CVE-2026-53134: netfilter: nft_fib: fix stale stack leak via the OIFNAME register (bsc#1269819).\n- CVE-2026-53157: net: phonet: free phonet_device after RCU grace period (bsc#1269241).\n- CVE-2026-53175: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush (bsc#1269714).\n- CVE-2026-53181: vsock/vmci: fix sk_ack_backlog leak on failed handshake (bsc#1269886).\n- CVE-2026-53183: mptcp: allow subflow rcv wnd to shrink (bsc#1269376).\n- CVE-2026-53184: udp: clear skb-\u003edev before running a sockmap verdict (bsc#1269689).\n- CVE-2026-53185: zram: fix use-after-free in zram_bvec_write_partial() (bsc#1269660).\n- CVE-2026-53186: RDMA/srp: bound SRP_RSP sense copy by the received length (bsc#1269663).\n- CVE-2026-53189: mm/huge_memory: update file PMD counter before folio_put() (bsc#1269797).\n- CVE-2026-53210: tee: shm: fix shm leak in register_shm_helper() (bsc#1269727).\n- CVE-2026-53212: netfilter: nft_tunnel: fix use-after-free on object destroy (bsc#1269672).\n- CVE-2026-53214: ipv6: Fix a potential NPD in cleanup_prefix_route() (bsc#1269588).\n- CVE-2026-53218: netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (bsc#1269273).\n- CVE-2026-53221: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() (bsc#1269318).\n- CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997).\n- CVE-2026-53225: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() (bsc#1269711).\n- CVE-2026-53227: net: openvswitch: fix possible kfree_skb of ERR_PTR (bsc#1269877).\n- CVE-2026-53230: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (bsc#1269270).\n- CVE-2026-53233: netdev: fix double-free in netdev_nl_bind_rx_doit() (bsc#1269801).\n- CVE-2026-53235: net: add pskb_may_pull() to skb_gro_receive_list() (bsc#1269286).\n- CVE-2026-53236: tcp: restrict SO_ATTACH_FILTER to priv users (bsc#1269994).\n- CVE-2026-53239: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (bsc#1269677).\n- CVE-2026-53245: net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr (bsc#1269675).\n- CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1269988).\n- CVE-2026-53247: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown (bsc#1269235).\n- CVE-2026-53250: xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() (bsc#1269808).\n- CVE-2026-53252: Bluetooth: fix memory leak in error path of hci_alloc_dev() (bsc#1269307).\n- CVE-2026-53260: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req() (bsc#1269731).\n- CVE-2026-53267: netfilter: nft_ct: bail out on template ct in get eval (bsc#1269577).\n- CVE-2026-53268: netfilter: conntrack_irc: fix possible out-of-bounds read (bsc#1269257).\n- CVE-2026-53270: ipvs: clear the svc scheduler ptr early on edit (bsc#1269240).\n- CVE-2026-53273: tee: optee: prevent use-after-free when the client exits before the supplicant (bsc#1269713).\n- CVE-2026-53275: ipv6: mcast: Fix use-after-free when processing MLD queries (bsc#1269810).\n- CVE-2026-53289: ice: fix NULL pointer dereference in ice_reset_all_vfs() (bsc#1269694).\n- CVE-2026-53321: io_uring/napi: cap busy_poll_to 10 msec (bsc#1269724).\n- CVE-2026-53355: net: rds: clear i_sends on setup unwind (bsc#1270249).\n- CVE-2026-53369: udf: reject descriptors with oversized CRC length (bsc#1271818).\n- CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830).\n- CVE-2026-53388: fuse: re-lock request before replacing page cache folio (bsc#1271825).\n- CVE-2026-53391: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (bsc#1271904).\n- CVE-2026-53392: NFSv4/flexfiles: reject zero filehandle version count (bsc#1271826).\n- CVE-2026-53393: nfsd: reset write verifier on deferred writeback errors (bsc#1271858).\n- CVE-2026-53394: nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race (bsc#1271859).\n- CVE-2026-53397: nfsd: fix posix_acl leak on SETACL decode failure (bsc#1271869).\n- CVE-2026-53398: NFSD: Fix SECINFO_NO_NAME decode error cleanup (bsc#1271870).\n- CVE-2026-53399: nfsd: release layout stid on setlease failure (bsc#1271832).\n- CVE-2026-53402: fbdev: fbcon: fix out-of-bounds read in err_out of (bsc#1271908).\n- CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (bsc#1271964).\n- CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).\n- CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272282).\n- CVE-2026-63809: bpf: NUL-terminate replaced sysctl value (bsc#1272296).\n- CVE-2026-63829: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1272176).\n- CVE-2026-63831: mac802154: llsec: add skb_cow_data() before in-place crypto (bsc#1272184).\n- CVE-2026-63836: batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd (bsc#1272246).\n- CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272836).\n- CVE-2026-63919: xfrm: input: hold netns during deferred transport reinjection (bsc#1272907).\n- CVE-2026-63923: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (bsc#1273005).\n- CVE-2026-63952: memfd: deny writeable mappings when implying SEAL_WRITE (bsc#1272468).\n- CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272466).\n- CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272678).\n- CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp() (bsc#1273035).\n- CVE-2026-64025: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx (bsc#1273117).\n- CVE-2026-64061: netfs: Fix early put of sink folio in netfs_read_gaps() (bsc#1272505).\n- CVE-2026-64091: batman-adv: tt: fix TOCTOU race for reported vlans (bsc#1272514).\n- CVE-2026-64106: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (bsc#1272242).\n- CVE-2026-64157: netfs: Fix partial invalidation of streaming-write folio (bsc#1272462).\n- CVE-2026-64158: netfs: Fix write streaming disablement if fd open O_RDWR (bsc#1272524).\n- CVE-2026-64187: xfs: fail recovery on a committed log item with no regions (bsc#1272204).\n- CVE-2026-64188: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() (bsc#1272150).\n- CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272207).\n- CVE-2026-64357: xfs: fix exchmaps reservation limit check (bsc#1272612).\n- CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing (bsc#1274072).\n- CVE-2026-64561: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (bsc#1273231).\n- CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (bsc#1271526).\n\nThe following non security issues were fixed:\n\n- accel/ivpu: Fix wrong register read in LNL failure diagnostics (git-fixes).\n- accel/ivpu: Reject firmware log with size smaller than header (git-fixes).\n- ALSA: hda: codecs: hdmi: disable keep-alive before audio format change (git-fixes).\n- ALSA: hda: conexant: Remove mic bias threshold override (git-fixes).\n- ALSA: hda: cs35l41: validate and free ACPI mute object (git-fixes).\n- ALSA: hda: Fix cached processing coefficient verbs (git-fixes).\n- ALSA: lx6464es: fix period byte count for 16-bit streams (git-fixes).\n- ALSA: pcm: wake linked drain waiters on unlink (git-fixes).\n- ALSA: scarlett2: Allow selecting config_set by firmware version (stable-fixes).\n- ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417 (git-fixes).\n- ALSA: seq: close a re-opened queue timer in the destructor (git-fixes).\n- ALSA: seq: Fix division by zero in initialize_timer() (git-fixes).\n- ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (git-fixes).\n- ALSA: timer: don't re-enter an instance callback that is still running (git-fixes).\n- ALSA: timer: drain a slave's callback before its master detaches it (git-fixes).\n- ALSA: ump: fix double free of out_cvts on rawmidi error (git-fixes).\n- ALSA: usb-audio: Clamp frame size in implicit-feedback mode (git-fixes).\n- ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() (git-fixes).\n- ALSA: usb-audio: fix stack info leak in RME Digiface status (git-fixes).\n- ALSA: usb-audio: fix use-after-free in ump_to_endpoint() (git-fixes).\n- ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC (git-fixes).\n- apparmor: fix use-after-free in rawdata dedup loop (git-fixes).\n- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (git-fixes).\n- ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() (git-fixes).\n- ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI (git-fixes).\n- ASoC: cs35l56: Fix potential probe() deadlock (git-fixes).\n- ASoC: cs35l56: Use complete_all() to signal init_completion (git-fixes).\n- ASoC: cs42l43: Correct report for forced microphone jack (git-fixes).\n- ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP (git-fixes).\n- ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop (git-fixes).\n- ASoC: tas2562: fix broken entries in the volume lookup table (git-fixes).\n- ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup (git-fixes).\n- ASoC: tas2562: fix DVC coefficient write order (git-fixes).\n- ASoC: tas2781: bound firmware description string parsing (git-fixes).\n- assoc_array: trim the final shortcut word using the current chunk end (git-fixes).\n- batman-adv: bla: reacquire gw address after skb realloc (git-fixes).\n- batman-adv: dat: ensure accessible eth_hdr proto field (git-fixes).\n- batman-adv: dat: fix tie-break for candidate selection (git-fixes).\n- batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes).\n- batman-adv: fix VLAN priority offset (git-fixes).\n- batman-adv: frag: fix primary_if leak on failed linearization (git-fixes).\n- batman-adv: frag: free unfragmentable packet (git-fixes).\n- batman-adv: mcast: avoid OOB read of num_dests header (git-fixes).\n- batman-adv: tt: avoid request storms during pending request (git-fixes).\n- batman-adv: tt: prevent TVLV OOB check overflow (git-fixes).\n- bitops: use common function parameter names (git-fixes).\n- Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (stable-fixes).\n- Bluetooth: 6lowpan: Fix using chan-\u003econn as indication to no remote netdev (git-fixes).\n- Bluetooth: btintel: Validate length before parsing diagnostics TLV (git-fixes).\n- Bluetooth: btrtl: validate firmware patch bounds (git-fixes).\n- Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB (stable-fixes).\n- Bluetooth: btusb: validate Realtek vendor event length (git-fixes).\n- Bluetooth: hci_qca: Clear memdump state on invalid dump size (git-fixes).\n- Bluetooth: hci_sync: Fix advertising data UAFs (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback (git-fixes).\n- Bluetooth: hci_sync: Protect UUID list traversal (git-fixes).\n- Bluetooth: HIDP: reject frames without a transaction header (git-fixes).\n- Bluetooth: HIDP: validate numbered report payloads (git-fixes).\n- Bluetooth: ISO: clear iso_data always when detaching conn from hcon (git-fixes).\n- Bluetooth: ISO: fix CONNECTED -\u003e CLOSED transition on shutdown/release (git-fixes).\n- Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos (git-fixes).\n- Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis() (git-fixes).\n- Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (git-fixes).\n- Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (git-fixes).\n- Bluetooth: mgmt: Translate HCI reason in Device Disconnected event (git-fixes).\n- Bluetooth: RFCOMM: Fix session UAF in set_termios (git-fixes).\n- Bluetooth: SCO: give the socket its own sco_conn reference (git-fixes).\n- btrfs: do not trim a device which is not writeable (bsc#1272568).\n- bus: sunxi-rsb: Always check register address validity (git-fixes).\n- can: bcm: add missing rcu list annotations and operations (git-fixes).\n- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (git-fixes).\n- can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure (git-fixes).\n- can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured (git-fixes).\n- can: ctucanfd: add missing MODULE_DEVICE_TABLE() (git-fixes).\n- can: ctucanfd: handle bus error interrupts (git-fixes).\n- can: ctucanfd: mark error-active controller status valid (git-fixes).\n- can: ctucanfd: unmap BAR0 using base address (git-fixes).\n- can: ctucanfd: use self-test mode for PRESUME_ACK (git-fixes).\n- can: ems_usb: validate CPC message lengths (git-fixes).\n- can: esd_usb: kill anchored URBs before freeing netdevs (git-fixes).\n- can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure (git-fixes).\n- can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure (git-fixes).\n- can: isotp: check register_netdevice_notifier() error in module init (git-fixes).\n- can: isotp: use unconditional synchronize_rcu() in isotp_release() (git-fixes).\n- can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer (git-fixes).\n- can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() (git-fixes).\n- can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents (git-fixes).\n- can: peak_usb: add bounds check for USB channel index (git-fixes).\n- can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error (git-fixes).\n- can: peak_usb: validate uCAN receive record lengths (git-fixes).\n- can: softing: fw_parse(): validate firmware record spans (git-fixes).\n- cdrom: fix stack out-of-bounds read in CDROMVOLCTRL (git-fixes).\n- comedi: comedi_parport: deal with premature interrupt (git-fixes).\n- crypto/xxhash: set downstream CRYPTO_ALG_FIPS_UNAPPROVED (bsc#1262160 jsc#PED-15986).\n- crypto: introduce downstream CRYPTO_ALG_FIPS_UNAPPROVED (bsc#1262160 jsc#PED-15986).\n- crypto: qat - keep VFs enabled during reset (stable-fixes).\n- crypto: qat - notify fatal error before AER reset preparation (stable-fixes).\n- dm cache policy smq: check allocation under invalidate lock (git-fixes).\n- dm cache: fix missing return in invalidate_committed's error path (git-fixes).\n- dmaengine: idxd: fix double free of wq, engine, and group structs (git-fixes).\n- dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (git-fixes).\n- dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ (git-fixes).\n- dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA (git-fixes).\n- driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout() (git-fixes).\n- driver core: Guard deferred probe timeout extension with delayed_work_pending() (git-fixes).\n- driver core: Use mod_delayed_work to prevent lost deferred probe work (git-fixes).\n- Drivers: hv: vmbus: Set DMA coherent mask for VMBus devices (git-fixes).\n- drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference (git-fixes).\n- drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips (git-fixes).\n- drm/amd/display: set new_stream to NULL after release (git-fixes).\n- drm/amd/display: use proper context for logging (git-fixes).\n- drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) (git-fixes).\n- drm/amd/pm: fix amdgpu_pm_info power display units (git-fixes).\n- drm/amd/pm: fix smu13 power limit range calculation (git-fixes).\n- drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge (git-fixes).\n- drm/amdgpu: fix aperture mapping leak (git-fixes).\n- drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment (git-fixes).\n- drm/amdkfd: free MQD managers on DQM init failures (git-fixes).\n- drm/amdkfd: hold event_mutex while checkpointing CRIU events (git-fixes).\n- drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs (git-fixes).\n- drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() (git-fixes).\n- drm/gfx10: Program DB_RING_CONTROL (git-fixes).\n- drm/i915/bios: range check LFP Data Block panel_type2 (git-fixes).\n- drm/i915/gem: Do not leak siblings[] on proto context error (git-fixes).\n- drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU (git-fixes).\n- drm/i915/gt: use correct selftest config symbol (git-fixes).\n- drm/i915/selftests: Fix GT PM sort comparators (git-fixes).\n- drm/i915: ensure segment offset never exceeds allowed max (stable-fixes).\n- drm/i915: Return NULL on error in active_instance (git-fixes).\n- drm/imagination: acquire vm_ctx-\u003elock before mapping memory to GPU VM (git-fixes).\n- drm/imagination: Fix double call to drm_sched_entity_fini() (git-fixes).\n- drm/imagination: fix error checking of pvr_vm_context_lookup() (git-fixes).\n- drm/imagination: Fix returned size for DRM_IOCTL_PVR_DEV_QUERY (git-fixes).\n- drm/imagination: Fix user array stride in pvr_set_uobj_array() (git-fixes).\n- drm/mediatek: Check CRTC state before freeing (git-fixes).\n- drm/mediatek: ovl_adaptor: balance component registrations (git-fixes).\n- drm/panthor: Don't overrule pending immediate ticks in sched_resume_tick() (git-fixes).\n- drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced (git-fixes).\n- drm/panthor: Fix potential invalid pointer deref in group_process_tiler_oom() (git-fixes).\n- drm/panthor: Interrupt group start/resumption if group_bind_locked() fails (git-fixes).\n- drm/panthor: reject firmware sections with oversized data (git-fixes).\n- drm/panthor: return error on truncated firmware (git-fixes).\n- drm/panthor: validate firmware interface structure sizes (git-fixes).\n- drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove (git-fixes).\n- drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered (stable-fixes).\n- drm/tests: shmem: Set DMA mask to 64-bit in drm_gem_shmem (git-fixes).\n- drm/v3d: Reject invalid indirect BO handle in indirect CSD setup (git-fixes).\n- drm/vc4: hvs/v3d: Fix null dereference in unbind (git-fixes).\n- drm/vc4: Prevent shader BO mappings from becoming writable (git-fixes).\n- drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size (git-fixes).\n- drm/vc4: Zero the tile state data array before each BIN job (git-fixes).\n- drm/virtio: bound EDID block reads to the response buffer (git-fixes).\n- drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker (git-fixes).\n- drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure (git-fixes).\n- drm/vmwgfx: bound DMA command body size against suffix pointer (git-fixes).\n- drm/vmwgfx: drop dma_buf reference on foreign-fd prime import (git-fixes).\n- drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size (git-fixes).\n- drm/vmwgfx: reject DX_BIND_QUERY without a DX context (git-fixes).\n- drm/vmwgfx: use check_add_overflow for shader size+offset bound (git-fixes).\n- drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (git-fixes).\n- drm/vmwgfx: validate external BO copy bounds for both stride paths (git-fixes).\n- drm/vmwgfx: Validate vmw_surface_metadata::array_size (git-fixes).\n- drm/xe/hw_engine: Fix double-free of managed BO in error path (git-fixes).\n- drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays (git-fixes).\n- drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry() (git-fixes).\n- drm/xe/wopcm: fix WOPCM size for LNL+ (git-fixes).\n- drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds (git-fixes).\n- drm/xe: remove duplicate \u003ckunit/test-bug.h\u003e include (git-fixes).\n- erofs: set fileio bio failed in short read case (git-fixes).\n- fbcon: fix NULL pointer dereference for a console without vc_data (stable-fixes).\n- fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() (git-fixes).\n- fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() (git-fixes).\n- fbdev: efifb: fix memory leak in efifb_probe() (git-fixes).\n- fbdev: hecubafb: fix potential memory leak in hecubafb_probe() (git-fixes).\n- fbdev: i740fb: fix potential memory leak in i740fb_probe() (git-fixes).\n- fbdev: metronomefb: fix potential memory leak in metronomefb_probe() (git-fixes).\n- fbdev: nvidia: fix potential memory leak in nvidiafb_probe() (git-fixes).\n- fbdev: radeon: fix potential memory leak in radeonfb_pci_register() (git-fixes).\n- fbdev: s3fb: fix potential memory leak in s3_pci_probe() (git-fixes).\n- fbdev: sm501fb: Fix buffer errors in OF binding code (git-fixes).\n- fbdev: sm712: Fix operator precedence in big_swap macro (git-fixes).\n- fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() (git-fixes).\n- fbdev: tridentfb: fix potential memory leak in trident_pci_probe() (git-fixes).\n- fbdev: uvesafb: fix potential memory leak in uvesafb_probe() (git-fixes).\n- fbdev: vesafb: fix memory leak in vesafb_probe() (git-fixes).\n- firewire: net: Fix fragmented datagram reassembly (git-fixes).\n- firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() (git-fixes).\n- firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits (git-fixes).\n- gpio-f7188x: Add support for NCT6126D version B (git-fixes).\n- gpio: davinci: fix IRQ domain leak on devm_kzalloc failure (git-fixes).\n- gpio: eic-sprd: use raw_spinlock_t in the irq startup path (git-fixes).\n- gpio: htc-egpio: use managed gpiochip registration (git-fixes).\n- gpio: mlxbf3: fail probe if gpiochip registration fails (git-fixes).\n- gpio: mvebu: fail probe if gpiochip registration fails (git-fixes).\n- gpio: mvebu: free generic chips on unbind (git-fixes).\n- gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (git-fixes).\n- gpio: rockchip: change the GPIO version judgment logic (stable-fixes).\n- gpio: rockchip: fix generic IRQ chip leak on remove (git-fixes).\n- gpio: rockchip: teardown bugs and resource leaks (git-fixes).\n- gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe() (git-fixes).\n- gpio: tegra: do not call pinctrl for GPIO direction (git-fixes).\n- gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe (git-fixes).\n- gpios: palmas: add .get_direction() op (git-fixes).\n- HID: add haptics page defines (stable-fixes).\n- HID: hid-sjoy: race between init and usage (git-fixes).\n- HID: pidff: Add missing spaces (stable-fixes).\n- HID: pidff: Fix missing blank lines after declarations (stable-fixes).\n- HID: playstation: validate num_touch_reports in DualShock 4 reports (stable-fixes).\n- hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread (git-fixes).\n- hwmon: (adt7470) Fix cache updated before hardware write on I2C error (git-fixes).\n- hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read (git-fixes).\n- hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors (git-fixes).\n- hwmon: (adt7470) Fix PWM auto temp state array and bounds check (git-fixes).\n- hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks (git-fixes).\n- hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() (git-fixes).\n- hwmon: (adt7470) Use cached PWM frequency value (git-fixes).\n- hwmon: (asus-ec-sensors) add missed handle for ENOMEM (git-fixes).\n- hwmon: (asus-ec-sensors) fix EC read intervals (git-fixes).\n- hwmon: (asus-ec-sensors) fix looping over banks while reading from EC (git-fixes).\n- hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (lm90) Only report alarms if driver is ready (git-fixes).\n- hwmon: (ltc4282) Fix reading the minimum alarm voltage (git-fixes).\n- hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 (git-fixes).\n- hwmon: (nct6775-core) Prevent access to unsupported weight registers (git-fixes).\n- hwmon: (npcm750-pwm-fan): stop fan timer on device detach (git-fixes).\n- hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (nzxt-smart2) DMA-align output buffer (git-fixes).\n- hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (pmbus) Fix return value from pmbus_update_byte_data() (git-fixes).\n- hwmon: (pmbus/core) notify on the hwmon device, not the i2c client (git-fixes).\n- hwmon: (sht3x) Fix unaligned accesses (git-fixes).\n- hwmon: (w83627hf) remove VID sysfs files on error and remove (stable-fixes).\n- hwmon: (w83793) remove vrm sysfs file on probe failure (stable-fixes).\n- hwmon: occ: validate poll response sensor blocks (git-fixes).\n- i2c: amd-mp2: Unregister callback on adapter add failure (git-fixes).\n- i2c: imx: Cancel hrtimer before clearing slave pointer (git-fixes).\n- i2c: imx: Fix slave registration race and error handling (git-fixes).\n- i2c: iproc: reset bus after timeout if START_BUSY is stuck (git-fixes).\n- i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock (git-fixes).\n- i2c: mediatek: fix WRRD for SoCs without auto_restart option (git-fixes).\n- i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() (git-fixes).\n- i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue (git-fixes).\n- i3c: mipi-i3c-hci: Preserve RUN bit when aborting DMA ring (git-fixes).\n- ieee802154: admin-gate legacy LLSEC dump operations (git-fixes).\n- ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation (git-fixes).\n- ieee802154: ca8210: fix cas_ctl leak on spi_async failure (git-fixes).\n- ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit (git-fixes).\n- ieee802154: fix kernel-infoleak in dgram_recvmsg() (git-fixes).\n- ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() (git-fixes).\n- iio: accel: bmc150: clamp the device-reported FIFO frame count (git-fixes).\n- iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error (git-fixes).\n- iio: adc: lpc32xx: Initialize completion before requesting IRQ (git-fixes).\n- iio: adc: spear: Initialize completion before requesting IRQ (git-fixes).\n- iio: adc: ti-ads124s08: Return reset GPIO lookup errors (git-fixes).\n- iio: adc: ti-ads1119: fix PM reference leak in buffer preenable (git-fixes).\n- iio: common: st_sensors: honour channel endianness in read_axis_data (git-fixes).\n- iio: event: Fix event FIFO reset race (git-fixes).\n- iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ (git-fixes).\n- iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ (git-fixes).\n- iio: imu: inv_icm42600: fix timestamp clock period by using lower value (git-fixes).\n- iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading (git-fixes).\n- iio: imu: st_lsm6dsx: deselect shub page before reading whoami (git-fixes).\n- iio: light: al3010: fix incorrect scale for the highest gain range (git-fixes).\n- iio: light: gp2ap002: fix runtime PM leak on read error (git-fixes).\n- iio: light: tsl2591: return actual error from probe IRQ failure (git-fixes).\n- iio: magnetometer: ak8975: fix potential kernel stack memory leak (git-fixes).\n- iio: temperature: Build mlx90635 with CONFIG_MLX90635 (git-fixes).\n- Input: ads7846 - restore half-duplex support (git-fixes).\n- Input: atkbd - validate scancode in firmware keymap entries (git-fixes).\n- Input: elan_i2c - prevent division by zero and arithmetic underflow (git-fixes).\n- Input: goodix - clamp the device-reported contact count (git-fixes).\n- Input: iforce - bound the device-reported force-feedback effect index (git-fixes).\n- Input: ims-pcu - add response length checks (git-fixes).\n- Input: ims-pcu - fix DMA mapping violation in line setup (git-fixes).\n- Input: ims-pcu - fix firmware leak in async update (git-fixes).\n- Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() (git-fixes).\n- Input: ims-pcu - fix logic error in packet reset (git-fixes).\n- Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging (git-fixes).\n- Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix race condition in reset_device sysfs callback (git-fixes).\n- Input: ims-pcu - fix type confusion in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix use-after-free and double-free in disconnect (git-fixes).\n- Input: ims-pcu - only expose sysfs attributes on control interface (git-fixes).\n- Input: ims-pcu - release data interface on disconnect (git-fixes).\n- Input: ims-pcu - validate control endpoint type (git-fixes).\n- Input: maple_keyb - set driver data before registering input device (stable-fixes).\n- Input: maplecontrol - set driver data before registering input device (stable-fixes).\n- Input: maplemouse - fix NULL pointer dereference in open() (git-fixes).\n- Input: maplemouse - set driver data before registering input device (stable-fixes).\n- Input: mms114 - fix multi-touch slot corruption (git-fixes).\n- Input: mms114 - fix touch indexing for MMS134S and MMS136 (git-fixes).\n- Input: mms114 - reject an oversized device packet size (git-fixes).\n- Input: rmi4 - fix bit count in bitmap_copy() (git-fixes).\n- Input: rmi4 - fix limit in rmi_register_desc_has_subpacket() (git-fixes).\n- Input: rmi4 - fix memory leak in rmi_set_attn_data() (git-fixes).\n- Input: rmi4 - fix num_subpackets overflow in register descriptor (git-fixes).\n- Input: rmi4 - fix register descriptor address calculation (git-fixes).\n- Input: rmi4 - fix type overflow in register counts (git-fixes).\n- Input: rmi4 - initialize attn_fifo properly (stable-fixes).\n- Input: rmi4 - iterative IRQ handler (git-fixes).\n- Input: rmi4 - refactor F12 probe function (stable-fixes).\n- Input: rmi4 - refactor function allocation and registration (stable-fixes).\n- Input: rmi4 - refactor register descriptor parsing (git-fixes).\n- Input: rmi4 - tolerate short register descriptor structure (git-fixes).\n- Input: rmi4 - use local presence map in rmi_read_register_desc() (stable-fixes).\n- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (git-fixes).\n- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (git-fixes).\n- Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure (git-fixes).\n- Input: touchwin - reset the packet index on every complete packet (git-fixes).\n- intel_th: core: fix null pointer dereference in intel_th_irq (bsc#1248480).\n- intel_th: fix MSC output device reference leak (git-fixes).\n- io_uring/kbuf: don't truncate end buffer for bundles (bsc#1271290).\n- io_uring/kbuf: fix missing BUF_MORE for incremental buffers at EOF (bsc#1261250).\n- io_uring/kbuf: flag partial buffer mappings (bsc#1271290).\n- io_uring/kbuf: propagate BUF_MORE through early buffer commit path (bsc#1261250).\n- io_uring/net: always use current transfer count for buffer put (git-fixes).\n- io_uring/net: improve recv bundles (bsc#1271290).\n- io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries (bsc#1271290).\n- io_uring/net: only consider msg_inq if larger than 1 (git-fixes).\n- io_uring/net: only retry recv bundle for a full transfer (bsc#1271290).\n- io_uring/timeout: add helper for parsing user time (bsc#1271291).\n- io_uring/timeout: honour caller's time namespace for IORING_TIMEOUT_ABS (bsc#1271291).\n- io_uring/timeout: migrate reqs from ts64 to ktime (bsc#1271291).\n- io_uring/wait: honour caller's time namespace for IORING_ENTER_ABS_TIMER (bsc#1271291).\n- ixgbe: reduce number of reads when getting OROM data (bsc#1269637).\n- KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT (git-fixes).\n- KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) (git-fixes).\n- KVM: nSVM: Clear tracking of L1-\u003eL2 NMI and soft IRQ on nested #VMEXIT (git-fixes).\n- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (git-fixes).\n- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (git-fixes).\n- KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs (git-fixes).\n- KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug (git-fixes).\n- KVM: TDX: Reject concurrent change to CPUID entry count (git-fixes).\n- KVM: x86/mmu: Check write tracking in all address spaces (git-fixes).\n- KVM: x86/mmu: Fix use-after-free on vendor module reload (git-fixes).\n- KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots (git-fixes).\n- KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs (git-fixes).\n- KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN (git-fixes).\n- leds: uleds: Fix potential buffer overread (git-fixes).\n- mac802154: hold an interface reference across the scan worker (git-fixes).\n- mac802154: llsec: reject frames shorter than the authentication tag (git-fixes).\n- mac802154: Prevent overwrite return code in mac802154_perform_association() (git-fixes).\n- mac802154: remove interfaces with RCU list deletion (git-fixes).\n- mailbox: zynqmp: setup IPI for each valid child node (bsc#1271395).\n- mctp: Fix incorrect tx flow invalidation condition in mctp-i2c (bsc#1266694).\n- media: aspeed: fix missing of_reserved_mem_device_release() on probe failure (git-fixes).\n- media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() (git-fixes).\n- media: atomisp: gc2235: fix UAF and memory leak (git-fixes).\n- media: cec: seco: unregister adapter on IR probe failure (git-fixes).\n- media: cedrus: Fix failure to clean up hardware on probe failure (git-fixes).\n- media: cedrus: Fix missing cleanup in error path (git-fixes).\n- media: cedrus: skip invalid H.264 reference list entries (git-fixes).\n- media: marvell-cam: fix missing pci_disable_device() on remove (git-fixes).\n- media: mtk-jpeg: cancel workqueue on release for supported platforms only (git-fixes).\n- media: nxp: imx8-isi: Fix use-after-free on remove (git-fixes).\n- media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code (stable-fixes).\n- media: pci: dm1105: Free allocated workqueue (git-fixes).\n- media: qcom: camss: vfe: fix PIX subdev naming on VFE lite (git-fixes).\n- media: qcom: venus: drop extra padding in NV12 raw size calculation (git-fixes).\n- media: qcom: venus: relax encoder frame/blur dimension steps on v4 (git-fixes).\n- media: qcom: venus: relax encoder frame/blur step size on v6 (git-fixes).\n- media: rockchip: rga: fix too small buffer size (git-fixes).\n- media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe (git-fixes).\n- media: ti: vpe: unwind v4l2 device registration on probe error (git-fixes).\n- media: uvcvideo: Avoid partial metadata buffers (git-fixes).\n- media: uvcvideo: Do not add clock samples with small sof delta (git-fixes).\n- media: uvcvideo: Fix buffer sequence in frame gaps (git-fixes).\n- media: uvcvideo: Fix dev_sof filtering in hw timestamp (git-fixes).\n- media: uvcvideo: Fix sequence number when no EOF (git-fixes).\n- media: uvcvideo: Relax the constrains for interpolating the hw clock (git-fixes).\n- media: uvcvideo: Use hw timestaming if the clock buffer is full (git-fixes).\n- media: v4l2-common: Add YUV24 format info (git-fixes).\n- media: v4l2-ctrls: validate HEVC active reference counts (git-fixes).\n- media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si (git-fixes).\n- media: vidtv: fix reference leak on failed device registration (git-fixes).\n- media: vimc: fix reference leak on failed device registration (git-fixes).\n- media: vpif_capture: fix OF node reference imbalance (git-fixes).\n- mei: bus: access mei_device under device_lock on cleanup (git-fixes).\n- memory: tegra: Wire up system sleep PM ops (git-fixes).\n- memstick: ms_block: reject a card that reports too many blocks (git-fixes).\n- mfd: cros_ec: Delay dev_set_drvdata() until probe success (git-fixes).\n- mfd: cs42l43: Sanity check firmware size (git-fixes).\n- mfd: rsmu: Fix page register setup (git-fixes).\n- mfd: sm501: Fix reference leak on failed device registration (git-fixes).\n- mfd: tps6586x: Fix OF node refcount (git-fixes).\n- misc: nsm: only unlock nsm_dev on post-lock error paths (git-fixes).\n- misc: nsm: pin the module while the device is open (git-fixes).\n- mkspec-dtb: Skip missing DTBs.\n- mm: zero range of eof folio exposed by inode size extension (bsc#1272920).\n- mmc: block: fix RPMB device unregister ordering (git-fixes).\n- mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe() method (git-fixes).\n- mmc: vub300: defer reset until cmd_mutex is unlocked (git-fixes).\n- mshv: fix hv_input_get_system_property struct (git-fixes).\n- mtd: mchp23k256: use SPI match data for chip caps (git-fixes).\n- mtd: onenand: samsung: report DMA completion timeouts (git-fixes).\n- mtd: rawnand: fsl_ifc: return errors for failed page reads (git-fixes).\n- mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout (git-fixes).\n- mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout (git-fixes).\n- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (bsc#1271866).\n- net/x25: fix use-after-free in x25_kill_by_neigh() (git-fixes).\n- net: mana: Add Interrupt Moderation support (bsc#1271368).\n- net: mana: Return error code from mana_create_rxq() (git-fixes).\n- net: mctp i2c: Copy headers if cloned (bsc#1266694).\n- net: mctp-i2c: fix duplicate reception of old data (bsc#1266694).\n- net: thunderbolt: Fix frags overflow by bounding frame_count (git-fixes).\n- net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() (git-fixes).\n- net: usb: lan78xx: move functions to avoid forward definitions (stable-fixes).\n- net: wwan: t7xx: check skb_clone in control TX (git-fixes).\n- net: wwan: t7xx: destroy DMA pool on CLDMA late init failure (git-fixes).\n- netfs: Defer the emission of trace_netfs_folio() (git-fixes).\n- of: cpu: add check in __of_find_n_match_cpu_property() (git-fixes).\n- phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access (git-fixes).\n- phy: phy-can-transceiver: Check driver match and driver data against NULL (git-fixes).\n- phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask (git-fixes).\n- phy: zynqmp: fix runtime PM leak on probe allocation failure (git-fixes).\n- phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB (git-fixes).\n- phy: zynqmp: use read-modify-write for SERDES scrambler bypass (git-fixes).\n- pinctrl-amd: Don't clear S4 wake bits at probe (git-fixes).\n- pinctrl: bm1880: add missing select GENERIC_PINCONF (git-fixes).\n- pinctrl: cs42l43: Fix polarity on debounce (git-fixes).\n- pinctrl: devicetree: don't free uninitialized dev_name on error path (git-fixes).\n- pinctrl: equilibrium: fix warning trace on load (git-fixes).\n- pinctrl: equilibrium: rename irq_chip function callbacks (stable-fixes).\n- pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: meson: restore non-sleeping GPIO access (git-fixes).\n- pinctrl: nuvoton: ma35d1: fix MFP register offset and pin table (git-fixes).\n- pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 (git-fixes).\n- pinctrl: qcom: Unconditionally mark gpio as wakeup enable (git-fixes).\n- pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path (git-fixes).\n- pkspec-dtb: Fix dtb-al rename.\n- platform/x86/amd/pmc: Add delay_suspend module parameter (stable-fixes).\n- platform/x86/amd/pmc: Avoid logging \"(null)\" for DMI values (git-fixes).\n- platform/x86/amd/pmc: Check for intermediate wakeup in function (stable-fixes).\n- platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops (stable-fixes).\n- platform/x86/amd/pmc: Don't log during intermediate wakeups (stable-fixes).\n- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (git-fixes).\n- posix-cpu-timers: Cleanup the firing logic (bsc#1271912).\n- posix-cpu-timers: Correctly update timer status in posix_cpu_timer_del() (bsc#1271912).\n- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (bsc#1271912).\n- posix-timers: Add proper state tracking (bsc#1271912).\n- posix-timers: Avoid direct access to hrtimer clockbase (bsc#1271912).\n- posix-timers: Expand timer_arm() callbacks with a boolean return value (bsc#1271912).\n- power: sequencing: fix ABBA deadlock in pwrseq_device_unregister() (git-fixes).\n- power: supply: bq25890: fix the -10 C NTC lookup entry (git-fixes).\n- power: supply: max17040: handle missing status supplier (git-fixes).\n- RDMA/mana_ib: initialize err for empty send WR lists (git-fixes).\n- regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK (git-fixes).\n- regulator: ltc3676: Fix incorrect IRQSTAT bit offsets (git-fixes).\n- regulator: mt6358: use regmap helper to read fixed LDO calibration (git-fixes).\n- remoteproc: qcom: Fix leak when custom dump_segments addition fails (git-fixes).\n- reset: sunxi: fix memory region leak on ioremap failure (git-fixes).\n- Revert \"Input: rmi4 - fix register descriptor address calculation\" (stable-fixes).\n- sctp: validate embedded address parameter length (git-fixes).\n- security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() (git-fixes).\n- selftests: Disable dad for ipv6 in fcnal-test.sh (bsc#1272871).\n- selftests: Replace sleep with slowwait (bsc#1272871).\n- serial: 8250_mid: Disable DMA for selected platforms (git-fixes).\n- serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms (git-fixes).\n- serial: 8250_omap: clear rx_running on zero-length DMA completes (git-fixes).\n- serial: msm: Disable DMA for kernel console UART (git-fixes).\n- serial: sc16is7xx: implement gpio get_direction() callback (git-fixes).\n- soc: fsl: qe: panic on ioremap() failure in qe_reset() (git-fixes).\n- soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy (git-fixes).\n- soc: xilinx: Shutdown and free rx mailbox channel (git-fixes).\n- spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure (git-fixes).\n- spi: sh-msiof: abort transfers when reset times out (git-fixes).\n- staging: media: atomisp: fix loop shadowing in ia_css_stream_destroy() (git-fixes).\n- staging: media: atomisp: reduce load_primary_binaries() stack usage (git-fixes).\n- staging: rtl8723bs: core: move constants to right side in comparison (stable-fixes).\n- staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() (git-fixes).\n- staging: rtl8723bs: fix inverted HT40 secondary channel offset (git-fixes).\n- staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() (git-fixes).\n- staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB write in HT_caps_handler() (git-fixes).\n- staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() (git-fixes).\n- thermal: core: Free thermal zone ID later during removal (git-fixes).\n- time: Switch to hrtimer_setup() (bsc#1271912).\n- tpm: Make the TPM character devices non-seekable (git-fixes).\n- uio_hv_generic: Bind to FCopy device by default (git-fixes).\n- usb: cdc_acm: Add quirk for Uniden BC125AT scanner (stable-fixes).\n- usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() (git-fixes).\n- USB: chaoskey: Fix slab-use-after-free in chaoskey_release() (git-fixes).\n- usb: chipidea: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub (stable-fixes).\n- usb: core: port: Deattach Type-C connector on component unbind (git-fixes).\n- usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() (git-fixes).\n- usb: dwc3: run gadget disconnect from sleepable suspend context (git-fixes).\n- usb: free iso schedules on failed submit (git-fixes).\n- usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler (git-fixes).\n- usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback (git-fixes).\n- usb: gadget: f_fs: Fix DMA fence leak (git-fixes).\n- usb: gadget: f_midi: cancel pending IN work before freeing the midi object (git-fixes).\n- usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() (git-fixes).\n- usb: gadget: f_printer: take kref only for successful open (git-fixes).\n- USB: gadget: fsl-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: function: rndis: add length check for header (stable-fixes).\n- usb: gadget: function: rndis: add length check to response query (stable-fixes).\n- usb: gadget: printer: fix infinite loop in printer_read() (git-fixes).\n- USB: gadget: snps-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown (git-fixes).\n- usb: gadget: udc: Fix use-after-free in gadget_match_driver (stable-fixes).\n- usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer (git-fixes).\n- USB: idmouse: fix use-after-free on disconnect race (git-fixes).\n- USB: iowarrior: fix use-after-free on disconnect (git-fixes).\n- USB: iowarrior: fix use-after-free on disconnect race (git-fixes).\n- usb: iowarrior: remove inherent race with minor number (stable-fixes).\n- USB: ldusb: fix use-after-free on disconnect race (git-fixes).\n- USB: legousbtower: fix use-after-free on disconnect race (git-fixes).\n- USB: misc: uss720: unregister parport on probe failure (git-fixes).\n- usb: mtu3: unmap request DMA on queue failure (git-fixes).\n- USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD (stable-fixes).\n- USB: serial: digi_acceleport: fix broken rx after throttle (git-fixes).\n- USB: serial: digi_acceleport: fix hard lockup on disconnect (git-fixes).\n- USB: serial: digi_acceleport: fix write buffer corruption (git-fixes).\n- USB: serial: io_edgeport: cap received transmit credits (git-fixes).\n- USB: serial: io_ti: reject oversized boot-mode firmware (git-fixes).\n- USB: serial: keyspan_pda: fix data loss on receive throttling (git-fixes).\n- USB: serial: keyspan_pda: fix information leak (git-fixes).\n- USB: serial: mxuport: validate firmware header size (git-fixes).\n- USB: serial: option: add MeiG SRM813Q (stable-fixes).\n- USB: serial: option: add Telit Cinterion FE990D50 compositions (stable-fixes).\n- usb: sl811-hcd: disable controller wakeup on remove (git-fixes).\n- USB: storage: include US_FL_NO_SAME in quirks mask (git-fixes).\n- usb: typec: anx7411: use devm_pm_runtime_enable() (git-fixes).\n- usb: typec: class: drop PD lookup reference (git-fixes).\n- usb: typec: tcpm: Fix VDM type for Enter Mode commands (git-fixes).\n- usb: typec: tcpm: Validate SVID index in svdm_consume_modes() (git-fixes).\n- usb: typec: ucsi: cancel pending work on system suspend (git-fixes).\n- usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove (git-fixes).\n- usb: typec: ucsi: Detect and skip duplicate altmodes from buggy firmware (git-fixes).\n- usb: typec: ucsi: Invert DisplayPort role assignment (git-fixes).\n- usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode (git-fixes).\n- USB: ulpi: fix memory leak on registration failure (git-fixes).\n- USB: usb-storage: ene_ub6250: restore media-ready check (git-fixes).\n- usb: xhci: Fix sleep in atomic context in xhci_free_streams() (git-fixes).\n- usbip: tools: support SuperSpeedPlus devices (git-fixes).\n- usbip: vudc: fix NULL deref in vep_dequeue() (git-fixes).\n- wan: wanxl: Only reset hardware after BAR mapping (git-fixes).\n- watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() (git-fixes).\n- wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() (git-fixes).\n- wifi: ath6kl: fix OOB access from firmware ADDBA window size (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware IE lengths in connect event (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler (git-fixes).\n- wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (git-fixes).\n- wifi: ath10k: fix skb leak on incomplete msdu during rx pop (git-fixes).\n- wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin (git-fixes).\n- wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() (git-fixes).\n- wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: brcmfmac: fix 802.1X-SHA256 call trace warning (git-fixes).\n- wifi: brcmfmac: make release_scratchbuffers idempotent (git-fixes).\n- wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read (git-fixes).\n- wifi: carl9170: fix buffer overflow in rx_stream failover path (git-fixes).\n- wifi: carl9170: fix OOB read from off-by-two in TX status handler (git-fixes).\n- wifi: iwlwifi: mvm: fix read in wake packet notification handler (git-fixes).\n- wifi: iwlwifi: mvm: validate SAR GEO response payload size (git-fixes).\n- wifi: mac80211: fix memory leak in ieee80211_register_hw() (git-fixes).\n- wifi: mac80211: free ack status frame on TX header build failure (git-fixes).\n- wifi: mac80211: recalculate TIM when a station enters power save (git-fixes).\n- wifi: mac80211: tear down new links on vif update error path (git-fixes).\n- wifi: mac80211: validate individual TWT params before driver setup (git-fixes).\n- wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() (git-fixes).\n- wifi: mt76: Disable napi when removing device (git-fixes).\n- wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7915: guard HE capability lookups (git-fixes).\n- wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7925: fix crash in reset link replay (git-fixes).\n- wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv() (git-fixes).\n- wifi: mt76: mt7925: guard link STA in decap offload (git-fixes).\n- wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() (git-fixes).\n- wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() (git-fixes).\n- wifi: mwifiex: bound uAP association event IEs to the event buffer (git-fixes).\n- wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper (git-fixes).\n- wifi: mwifiex: fix permanently busy scans after multiple roam iterations (git-fixes).\n- wifi: mwifiex: fix roaming to different channel in host_mlme mode (git-fixes).\n- wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (git-fixes).\n- wifi: rt2x00: avoid full teardown before work setup in probe (git-fixes).\n- wifi: wilc1000: validate assoc response length before subtracting header (git-fixes).\n- xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit (bsc#1264267).\n- xfs: only assert new size for datafork during truncate extents (bsc#1264084).\n- xfs: rearrange code in xfs_inode_item_precommit (bsc#1237449).\n- xfs: rework datasync tracking and execution (bsc#1237449).\n- xhci: dbgtty: fix device unregister (git-fixes).\n- xhci: dbgtty: fix device unregister: fixup (git-fixes).\n","status":"published","published":"2026-08-11T20:56:24Z","modified":"2026-08-15T18:23:51.257464779Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23068-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).\n- CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).\n- CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).\n- CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).\n- CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).\n- CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).\n- CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).\n- CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).\n- CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).\n- CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).\n- CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).\n- CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).\n- CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).\n- CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).\n- CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).\n- CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).\n- CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).\n- CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).\n- CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).\n- CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).\n- CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).\n- CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).\n- CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).\n- CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).\n- CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).\n- CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).\n- CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).\n- CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).\n- CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).\n- CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).\n- CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).\n- CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).\n- CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).\n- CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).\n- CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).\n- CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).\n- CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).\n- CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).\n- CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).\n- CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).\n- CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).\n- CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).\n- CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).\n- CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).\n- CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).\n- CVE-2026-46033: crypto: authencesn - reject short ahash digests during instance creation (bsc#1266692).\n- CVE-2026-46034: vfio/cdx: Fix NULL pointer dereference in interrupt trigger path (bsc#1266757).\n- CVE-2026-46036: vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex (bsc#1267470).\n- CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).\n- CVE-2026-46040: inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (bsc#1267472).\n- CVE-2026-46064: ibmasm: fix heap over-read in ibmasm_send_i2o_message() (bsc#1267497).\n- CVE-2026-46068: crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx (bsc#1267592).\n- CVE-2026-46086: net: bridge: use a stable FDB dst snapshot in RCU readers (bsc#1267524).\n- CVE-2026-46089: zram: do not forget to endio for partial discard requests (bsc#1267445).\n- CVE-2026-46102: net: strparser: fix skb_head leak in strp_abort_strp() (bsc#1267502).\n- CVE-2026-46121: mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock (bsc#1266932).\n- CVE-2026-46127: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() (bsc#1267236).\n- CVE-2026-46130: dm-verity-fec: fix reading parity bytes split across blocks (take 3) (bsc#1267629).\n- CVE-2026-46132: net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo (bsc#1267616).\n- CVE-2026-46137: mptcp: pm: ADD_ADDR rtx: fix potential data-race (bsc#1267570).\n- CVE-2026-46147: KVM: arm64: Factor out pKVM hyp vcpu creation to separate function (bsc#1267689).\n- CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).\n- CVE-2026-46158: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (bsc#1266880).\n- CVE-2026-46168: mptcp: sockopt: set timestamp flags on subflow socket, not msk (bsc#1266869).\n- CVE-2026-46170: mptcp: disable add_addr retransmission when timeout is 0 (bsc#1267714).\n- CVE-2026-46189: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (bsc#1266918).\n- CVE-2026-46191: fbcon: Avoid OOB font access if console rotation fails (bsc#1267690).\n- CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks (bsc#1267656).\n- CVE-2026-46207: vsock/virtio: fix length and offset in tap skb for split packets (bsc#1267691).\n- CVE-2026-46216: drm/xe/hdcp: Add NULL check for media_gt in (bsc#1267234).\n- CVE-2026-46234: vsock: fix buffer size clamping order (bsc#1266904).\n- CVE-2026-46245: drm/amd/display: Fix dc_link NULL handling in HPD init (bsc#1267678).\n- CVE-2026-46249: octeontx2-af: Fix PF driver crash with kexec kernel booting (bsc#1267683).\n- CVE-2026-46265: RDMA/hns: Fix WQ_MEM_RECLAIM warning (bsc#1267662).\n- CVE-2026-46287: net: txgbe: fix RTNL assertion warning when remove module (bsc#1267954).\n- CVE-2026-46292: pmdomain: core: Fix detach procedure for virtual devices in genpd (bsc#1267943).\n- CVE-2026-46306: flow_dissector: do not dissect PPPoE PFC frames (bsc#1267986).\n- CVE-2026-46321: tun: free page on short-frame rejection in tun_xdp_one() (bsc#1268024).\n- CVE-2026-46324: netfilter: nf_tables: Introduce functions freeing nft_hook objects (bsc#1267995).\n- CVE-2026-46327: dm: fix unlocked test for dm_suspended_md (bsc#1268031).\n- CVE-2026-46329: erofs: handle end of filesystem properly for file-backed mounts (bsc#1268038).\n- CVE-2026-52913: batman-adv: v: stop OGMv2 on disabled interface (bsc#1268985).\n- CVE-2026-52915: netfilter: ip6t_hbh: reject oversized option lists (bsc#1269001).\n- CVE-2026-52916: batman-adv: frag: disallow unicast fragment in fragment (bsc#1269002).\n- CVE-2026-52921: netfilter: ipset: stop hash:* range iteration at end (bsc#1269024).\n- CVE-2026-52922: batman-adv: dat: handle forward allocation error (bsc#1269030).\n- CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).\n- CVE-2026-52926: batman-adv: clear current gateway during teardown (bsc#1269025).\n- CVE-2026-52927: netfilter: ebtables: fix OOB read in compat_mtw_from_user (bsc#1269027).\n- CVE-2026-52930: ipc/shm: serialize orphan cleanup with shm_nattch updates (bsc#1269003).\n- CVE-2026-52934: batman-adv: tvlv: reject oversized TVLV packets (bsc#1268994).\n- CVE-2026-52937: tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR (bsc#1268983).\n- CVE-2026-52941: net/smc: avoid NULL deref of conn-\u003elnk in smc_msg_event tracepoint (bsc#1268966).\n- CVE-2026-52942: netfilter: nf_log: validate MAC header was set before dumping it (bsc#1268967).\n- CVE-2026-52947: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (bsc#1269115).\n- CVE-2026-52953: iommu/vt-d: Fix oops due to out of scope access (bsc#1269133).\n- CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1269172).\n- CVE-2026-52958: libceph: Fix potential out-of-bounds access in osdmap_decode() (bsc#1269174).\n- CVE-2026-52967: smb/client: fix possible infinite loop and oob read in symlink_data() (bsc#1269181).\n- CVE-2026-52970: netfilter: nft_ct: fix missing expect put in obj eval (bsc#1269229).\n- CVE-2026-52974: net: tls: fix strparser anchor skb leak on offload RX setup failure (bsc#1269233).\n- CVE-2026-52981: neigh: let neigh_xmit take skb ownership (bsc#1269254).\n- CVE-2026-52984: net/sched: netem: fix queue limit check to include reordered packets (bsc#1269272).\n- CVE-2026-52986: netfilter: nf_conntrack_sip: don't use simple_strtoul (bsc#1269289).\n- CVE-2026-52988: netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (bsc#1269362).\n- CVE-2026-52995: net/rds: zero per-item info buffer before handing it to visitors (bsc#1269124).\n- CVE-2026-52998: netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (bsc#1269118).\n- CVE-2026-52999: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (bsc#1269119).\n- CVE-2026-53000: netfilter: nat: use kfree_rcu to release ops (bsc#1269117).\n- CVE-2026-53002: netfilter: conntrack: remove sprintf usage (bsc#1269112).\n- CVE-2026-53003: pppoe: drop PFC frames (bsc#1269111).\n- CVE-2026-53004: sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks (bsc#1269106).\n- CVE-2026-53005: af_unix: Drop all SCM attributes for SOCKMAP (bsc#1269107).\n- CVE-2026-53006: ipv6: fix possible UAF in icmpv6_rcv() (bsc#1269104).\n- CVE-2026-53009: ice: fix double-free of tx_buf skb (bsc#1269098).\n- CVE-2026-53011: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (bsc#1269094).\n- CVE-2026-53012: nexthop: fix IPv6 route referencing IPv4 nexthop (bsc#1269154).\n- CVE-2026-53013: macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF (bsc#1269095).\n- CVE-2026-53014: net/sched: act_mirred: fix wrong device for mac_header_xmit check in tcf_blockcast_redir\n  (bsc#1269092).\n- CVE-2026-53032: bpf: Fix NULL deref in map_kptr_match_type for scalar regs (bsc#1269138).\n- CVE-2026-53035: bpf, sockmap: Fix af_unix iter deadlock (bsc#1269190).\n- CVE-2026-53038: ima_fs: Correctly create securityfs files for unsupported hash algos (bsc#1269391).\n- CVE-2026-53062: dm cache policy smq: fix missing locks in invalidating cache blocks (bsc#1269658).\n- CVE-2026-53063: dm cache: fix write hang in passthrough mode (bsc#1269659).\n- CVE-2026-53064: dm cache: fix null-deref with concurrent writes in passthrough mode (bsc#1269132).\n- CVE-2026-53069: net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master (bsc#1269186).\n- CVE-2026-53074: bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb (bsc#1269688).\n- CVE-2026-53083: bpf: Fix RCU stall in bpf_fd_array_map_clear() (bsc#1269964).\n- CVE-2026-53085: bpf: fix mm lifecycle in open-coded task_vma iterator (bsc#1269879).\n- CVE-2026-53088: net: bcmgenet: fix off-by-one in bcmgenet_put_txcb (bsc#1269185).\n- CVE-2026-53101: wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync (bsc#1269415).\n- CVE-2026-53104: wifi: mt76: Fix memory leak destroying device (bsc#1269157).\n- CVE-2026-53106: bpf: Do not allow deleting local storage in NMI (bsc#1269990).\n- CVE-2026-53107: wifi: libertas: use USB anchors for tracking in-flight URBs (bsc#1269991).\n- CVE-2026-53121: amd-pstate: Fix memory leak in amd_pstate_epp_cpu_init() (bsc#1269198).\n- CVE-2026-53123: md: wake raid456 reshape waiters before suspend (bsc#1269643).\n- CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269773).\n- CVE-2026-53132: vsock/virtio: fix potential unbounded skb queue (bsc#1269290).\n- CVE-2026-53134: netfilter: nft_fib: fix stale stack leak via the OIFNAME register (bsc#1269819).\n- CVE-2026-53157: net: phonet: free phonet_device after RCU grace period (bsc#1269241).\n- CVE-2026-53175: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush (bsc#1269714).\n- CVE-2026-53181: vsock/vmci: fix sk_ack_backlog leak on failed handshake (bsc#1269886).\n- CVE-2026-53183: mptcp: allow subflow rcv wnd to shrink (bsc#1269376).\n- CVE-2026-53184: udp: clear skb-\u003edev before running a sockmap verdict (bsc#1269689).\n- CVE-2026-53185: zram: fix use-after-free in zram_bvec_write_partial() (bsc#1269660).\n- CVE-2026-53186: RDMA/srp: bound SRP_RSP sense copy by the received length (bsc#1269663).\n- CVE-2026-53189: mm/huge_memory: update file PMD counter before folio_put() (bsc#1269797).\n- CVE-2026-53210: tee: shm: fix shm leak in register_shm_helper() (bsc#1269727).\n- CVE-2026-53212: netfilter: nft_tunnel: fix use-after-free on object destroy (bsc#1269672).\n- CVE-2026-53214: ipv6: Fix a potential NPD in cleanup_prefix_route() (bsc#1269588).\n- CVE-2026-53218: netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (bsc#1269273).\n- CVE-2026-53221: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() (bsc#1269318).\n- CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997).\n- CVE-2026-53225: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() (bsc#1269711).\n- CVE-2026-53227: net: openvswitch: fix possible kfree_skb of ERR_PTR (bsc#1269877).\n- CVE-2026-53230: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (bsc#1269270).\n- CVE-2026-53233: netdev: fix double-free in netdev_nl_bind_rx_doit() (bsc#1269801).\n- CVE-2026-53235: net: add pskb_may_pull() to skb_gro_receive_list() (bsc#1269286).\n- CVE-2026-53236: tcp: restrict SO_ATTACH_FILTER to priv users (bsc#1269994).\n- CVE-2026-53239: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (bsc#1269677).\n- CVE-2026-53245: net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr (bsc#1269675).\n- CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1269988).\n- CVE-2026-53247: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown (bsc#1269235).\n- CVE-2026-53250: xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() (bsc#1269808).\n- CVE-2026-53252: Bluetooth: fix memory leak in error path of hci_alloc_dev() (bsc#1269307).\n- CVE-2026-53260: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req() (bsc#1269731).\n- CVE-2026-53267: netfilter: nft_ct: bail out on template ct in get eval (bsc#1269577).\n- CVE-2026-53268: netfilter: conntrack_irc: fix possible out-of-bounds read (bsc#1269257).\n- CVE-2026-53270: ipvs: clear the svc scheduler ptr early on edit (bsc#1269240).\n- CVE-2026-53273: tee: optee: prevent use-after-free when the client exits before the supplicant (bsc#1269713).\n- CVE-2026-53275: ipv6: mcast: Fix use-after-free when processing MLD queries (bsc#1269810).\n- CVE-2026-53289: ice: fix NULL pointer dereference in ice_reset_all_vfs() (bsc#1269694).\n- CVE-2026-53321: io_uring/napi: cap busy_poll_to 10 msec (bsc#1269724).\n- CVE-2026-53355: net: rds: clear i_sends on setup unwind (bsc#1270249).\n- CVE-2026-53369: udf: reject descriptors with oversized CRC length (bsc#1271818).\n- CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830).\n- CVE-2026-53388: fuse: re-lock request before replacing page cache folio (bsc#1271825).\n- CVE-2026-53391: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (bsc#1271904).\n- CVE-2026-53392: NFSv4/flexfiles: reject zero filehandle version count (bsc#1271826).\n- CVE-2026-53393: nfsd: reset write verifier on deferred writeback errors (bsc#1271858).\n- CVE-2026-53394: nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race (bsc#1271859).\n- CVE-2026-53397: nfsd: fix posix_acl leak on SETACL decode failure (bsc#1271869).\n- CVE-2026-53398: NFSD: Fix SECINFO_NO_NAME decode error cleanup (bsc#1271870).\n- CVE-2026-53399: nfsd: release layout stid on setlease failure (bsc#1271832).\n- CVE-2026-53402: fbdev: fbcon: fix out-of-bounds read in err_out of (bsc#1271908).\n- CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (bsc#1271964).\n- CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).\n- CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272282).\n- CVE-2026-63809: bpf: NUL-terminate replaced sysctl value (bsc#1272296).\n- CVE-2026-63829: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1272176).\n- CVE-2026-63831: mac802154: llsec: add skb_cow_data() before in-place crypto (bsc#1272184).\n- CVE-2026-63836: batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd (bsc#1272246).\n- CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272836).\n- CVE-2026-63919: xfrm: input: hold netns during deferred transport reinjection (bsc#1272907).\n- CVE-2026-63923: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (bsc#1273005).\n- CVE-2026-63952: memfd: deny writeable mappings when implying SEAL_WRITE (bsc#1272468).\n- CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272466).\n- CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272678).\n- CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp() (bsc#1273035).\n- CVE-2026-64025: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx (bsc#1273117).\n- CVE-2026-64061: netfs: Fix early put of sink folio in netfs_read_gaps() (bsc#1272505).\n- CVE-2026-64091: batman-adv: tt: fix TOCTOU race for reported vlans (bsc#1272514).\n- CVE-2026-64106: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (bsc#1272242).\n- CVE-2026-64157: netfs: Fix partial invalidation of streaming-write folio (bsc#1272462).\n- CVE-2026-64158: netfs: Fix write streaming disablement if fd open O_RDWR (bsc#1272524).\n- CVE-2026-64187: xfs: fail recovery on a committed log item with no regions (bsc#1272204).\n- CVE-2026-64188: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() (bsc#1272150).\n- CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272207).\n- CVE-2026-64357: xfs: fix exchmaps reservation limit check (bsc#1272612).\n- CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing (bsc#1274072).\n- CVE-2026-64561: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (bsc#1273231).\n- CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (bsc#1271526).\n\nThe following non security issues were fixed:\n\n- accel/ivpu: Fix wrong register read in LNL failure diagnostics (git-fixes).\n- accel/ivpu: Reject firmware log with size smaller than header (git-fixes).\n- ALSA: hda: codecs: hdmi: disable keep-alive before audio format change (git-fixes).\n- ALSA: hda: conexant: Remove mic bias threshold override (git-fixes).\n- ALSA: hda: cs35l41: validate and free ACPI mute object (git-fixes).\n- ALSA: hda: Fix cached processing coefficient verbs (git-fixes).\n- ALSA: lx6464es: fix period byte count for 16-bit streams (git-fixes).\n- ALSA: pcm: wake linked drain waiters on unlink (git-fixes).\n- ALSA: scarlett2: Allow selecting config_set by firmware version (stable-fixes).\n- ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417 (git-fixes).\n- ALSA: seq: close a re-opened queue timer in the destructor (git-fixes).\n- ALSA: seq: Fix division by zero in initialize_timer() (git-fixes).\n- ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (git-fixes).\n- ALSA: timer: don't re-enter an instance callback that is still running (git-fixes).\n- ALSA: timer: drain a slave's callback before its master detaches it (git-fixes).\n- ALSA: ump: fix double free of out_cvts on rawmidi error (git-fixes).\n- ALSA: usb-audio: Clamp frame size in implicit-feedback mode (git-fixes).\n- ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() (git-fixes).\n- ALSA: usb-audio: fix stack info leak in RME Digiface status (git-fixes).\n- ALSA: usb-audio: fix use-after-free in ump_to_endpoint() (git-fixes).\n- ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC (git-fixes).\n- apparmor: fix use-after-free in rawdata dedup loop (git-fixes).\n- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (git-fixes).\n- ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() (git-fixes).\n- ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI (git-fixes).\n- ASoC: cs35l56: Fix potential probe() deadlock (git-fixes).\n- ASoC: cs35l56: Use complete_all() to signal init_completion (git-fixes).\n- ASoC: cs42l43: Correct report for forced microphone jack (git-fixes).\n- ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP (git-fixes).\n- ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop (git-fixes).\n- ASoC: tas2562: fix broken entries in the volume lookup table (git-fixes).\n- ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup (git-fixes).\n- ASoC: tas2562: fix DVC coefficient write order (git-fixes).\n- ASoC: tas2781: bound firmware description string parsing (git-fixes).\n- assoc_array: trim the final shortcut word using the current chunk end (git-fixes).\n- batman-adv: bla: reacquire gw address after skb realloc (git-fixes).\n- batman-adv: dat: ensure accessible eth_hdr proto field (git-fixes).\n- batman-adv: dat: fix tie-break for candidate selection (git-fixes).\n- batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes).\n- batman-adv: fix VLAN priority offset (git-fixes).\n- batman-adv: frag: fix primary_if leak on failed linearization (git-fixes).\n- batman-adv: frag: free unfragmentable packet (git-fixes).\n- batman-adv: mcast: avoid OOB read of num_dests header (git-fixes).\n- batman-adv: tt: avoid request storms during pending request (git-fixes).\n- batman-adv: tt: prevent TVLV OOB check overflow (git-fixes).\n- bitops: use common function parameter names (git-fixes).\n- Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (stable-fixes).\n- Bluetooth: 6lowpan: Fix using chan-\u003econn as indication to no remote netdev (git-fixes).\n- Bluetooth: btintel: Validate length before parsing diagnostics TLV (git-fixes).\n- Bluetooth: btrtl: validate firmware patch bounds (git-fixes).\n- Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB (stable-fixes).\n- Bluetooth: btusb: validate Realtek vendor event length (git-fixes).\n- Bluetooth: hci_qca: Clear memdump state on invalid dump size (git-fixes).\n- Bluetooth: hci_sync: Fix advertising data UAFs (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback (git-fixes).\n- Bluetooth: hci_sync: Protect UUID list traversal (git-fixes).\n- Bluetooth: HIDP: reject frames without a transaction header (git-fixes).\n- Bluetooth: HIDP: validate numbered report payloads (git-fixes).\n- Bluetooth: ISO: clear iso_data always when detaching conn from hcon (git-fixes).\n- Bluetooth: ISO: fix CONNECTED -\u003e CLOSED transition on shutdown/release (git-fixes).\n- Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos (git-fixes).\n- Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis() (git-fixes).\n- Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (git-fixes).\n- Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (git-fixes).\n- Bluetooth: mgmt: Translate HCI reason in Device Disconnected event (git-fixes).\n- Bluetooth: RFCOMM: Fix session UAF in set_termios (git-fixes).\n- Bluetooth: SCO: give the socket its own sco_conn reference (git-fixes).\n- btrfs: do not trim a device which is not writeable (bsc#1272568).\n- bus: sunxi-rsb: Always check register address validity (git-fixes).\n- can: bcm: add missing rcu list annotations and operations (git-fixes).\n- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (git-fixes).\n- can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure (git-fixes).\n- can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured (git-fixes).\n- can: ctucanfd: add missing MODULE_DEVICE_TABLE() (git-fixes).\n- can: ctucanfd: handle bus error interrupts (git-fixes).\n- can: ctucanfd: mark error-active controller status valid (git-fixes).\n- can: ctucanfd: unmap BAR0 using base address (git-fixes).\n- can: ctucanfd: use self-test mode for PRESUME_ACK (git-fixes).\n- can: ems_usb: validate CPC message lengths (git-fixes).\n- can: esd_usb: kill anchored URBs before freeing netdevs (git-fixes).\n- can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure (git-fixes).\n- can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure (git-fixes).\n- can: isotp: check register_netdevice_notifier() error in module init (git-fixes).\n- can: isotp: use unconditional synchronize_rcu() in isotp_release() (git-fixes).\n- can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer (git-fixes).\n- can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() (git-fixes).\n- can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents (git-fixes).\n- can: peak_usb: add bounds check for USB channel index (git-fixes).\n- can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error (git-fixes).\n- can: peak_usb: validate uCAN receive record lengths (git-fixes).\n- can: softing: fw_parse(): validate firmware record spans (git-fixes).\n- cdrom: fix stack out-of-bounds read in CDROMVOLCTRL (git-fixes).\n- comedi: comedi_parport: deal with premature interrupt (git-fixes).\n- crypto/xxhash: set downstream CRYPTO_ALG_FIPS_UNAPPROVED (bsc#1262160 jsc#PED-15986).\n- crypto: introduce downstream CRYPTO_ALG_FIPS_UNAPPROVED (bsc#1262160 jsc#PED-15986).\n- crypto: qat - keep VFs enabled during reset (stable-fixes).\n- crypto: qat - notify fatal error before AER reset preparation (stable-fixes).\n- dm cache policy smq: check allocation under invalidate lock (git-fixes).\n- dm cache: fix missing return in invalidate_committed's error path (git-fixes).\n- dmaengine: idxd: fix double free of wq, engine, and group structs (git-fixes).\n- dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (git-fixes).\n- dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ (git-fixes).\n- dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA (git-fixes).\n- driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout() (git-fixes).\n- driver core: Guard deferred probe timeout extension with delayed_work_pending() (git-fixes).\n- driver core: Use mod_delayed_work to prevent lost deferred probe work (git-fixes).\n- Drivers: hv: vmbus: Set DMA coherent mask for VMBus devices (git-fixes).\n- drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference (git-fixes).\n- drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips (git-fixes).\n- drm/amd/display: set new_stream to NULL after release (git-fixes).\n- drm/amd/display: use proper context for logging (git-fixes).\n- drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) (git-fixes).\n- drm/amd/pm: fix amdgpu_pm_info power display units (git-fixes).\n- drm/amd/pm: fix smu13 power limit range calculation (git-fixes).\n- drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge (git-fixes).\n- drm/amdgpu: fix aperture mapping leak (git-fixes).\n- drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment (git-fixes).\n- drm/amdkfd: free MQD managers on DQM init failures (git-fixes).\n- drm/amdkfd: hold event_mutex while checkpointing CRIU events (git-fixes).\n- drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs (git-fixes).\n- drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() (git-fixes).\n- drm/gfx10: Program DB_RING_CONTROL (git-fixes).\n- drm/i915/bios: range check LFP Data Block panel_type2 (git-fixes).\n- drm/i915/gem: Do not leak siblings[] on proto context error (git-fixes).\n- drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU (git-fixes).\n- drm/i915/gt: use correct selftest config symbol (git-fixes).\n- drm/i915/selftests: Fix GT PM sort comparators (git-fixes).\n- drm/i915: ensure segment offset never exceeds allowed max (stable-fixes).\n- drm/i915: Return NULL on error in active_instance (git-fixes).\n- drm/imagination: acquire vm_ctx-\u003elock before mapping memory to GPU VM (git-fixes).\n- drm/imagination: Fix double call to drm_sched_entity_fini() (git-fixes).\n- drm/imagination: fix error checking of pvr_vm_context_lookup() (git-fixes).\n- drm/imagination: Fix returned size for DRM_IOCTL_PVR_DEV_QUERY (git-fixes).\n- drm/imagination: Fix user array stride in pvr_set_uobj_array() (git-fixes).\n- drm/mediatek: Check CRTC state before freeing (git-fixes).\n- drm/mediatek: ovl_adaptor: balance component registrations (git-fixes).\n- drm/panthor: Don't overrule pending immediate ticks in sched_resume_tick() (git-fixes).\n- drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced (git-fixes).\n- drm/panthor: Fix potential invalid pointer deref in group_process_tiler_oom() (git-fixes).\n- drm/panthor: Interrupt group start/resumption if group_bind_locked() fails (git-fixes).\n- drm/panthor: reject firmware sections with oversized data (git-fixes).\n- drm/panthor: return error on truncated firmware (git-fixes).\n- drm/panthor: validate firmware interface structure sizes (git-fixes).\n- drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove (git-fixes).\n- drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered (stable-fixes).\n- drm/tests: shmem: Set DMA mask to 64-bit in drm_gem_shmem (git-fixes).\n- drm/v3d: Reject invalid indirect BO handle in indirect CSD setup (git-fixes).\n- drm/vc4: hvs/v3d: Fix null dereference in unbind (git-fixes).\n- drm/vc4: Prevent shader BO mappings from becoming writable (git-fixes).\n- drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size (git-fixes).\n- drm/vc4: Zero the tile state data array before each BIN job (git-fixes).\n- drm/virtio: bound EDID block reads to the response buffer (git-fixes).\n- drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker (git-fixes).\n- drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure (git-fixes).\n- drm/vmwgfx: bound DMA command body size against suffix pointer (git-fixes).\n- drm/vmwgfx: drop dma_buf reference on foreign-fd prime import (git-fixes).\n- drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size (git-fixes).\n- drm/vmwgfx: reject DX_BIND_QUERY without a DX context (git-fixes).\n- drm/vmwgfx: use check_add_overflow for shader size+offset bound (git-fixes).\n- drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (git-fixes).\n- drm/vmwgfx: validate external BO copy bounds for both stride paths (git-fixes).\n- drm/vmwgfx: Validate vmw_surface_metadata::array_size (git-fixes).\n- drm/xe/hw_engine: Fix double-free of managed BO in error path (git-fixes).\n- drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays (git-fixes).\n- drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry() (git-fixes).\n- drm/xe/wopcm: fix WOPCM size for LNL+ (git-fixes).\n- drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds (git-fixes).\n- drm/xe: remove duplicate \u003ckunit/test-bug.h\u003e include (git-fixes).\n- erofs: set fileio bio failed in short read case (git-fixes).\n- fbcon: fix NULL pointer dereference for a console without vc_data (stable-fixes).\n- fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() (git-fixes).\n- fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() (git-fixes).\n- fbdev: efifb: fix memory leak in efifb_probe() (git-fixes).\n- fbdev: hecubafb: fix potential memory leak in hecubafb_probe() (git-fixes).\n- fbdev: i740fb: fix potential memory leak in i740fb_probe() (git-fixes).\n- fbdev: metronomefb: fix potential memory leak in metronomefb_probe() (git-fixes).\n- fbdev: nvidia: fix potential memory leak in nvidiafb_probe() (git-fixes).\n- fbdev: radeon: fix potential memory leak in radeonfb_pci_register() (git-fixes).\n- fbdev: s3fb: fix potential memory leak in s3_pci_probe() (git-fixes).\n- fbdev: sm501fb: Fix buffer errors in OF binding code (git-fixes).\n- fbdev: sm712: Fix operator precedence in big_swap macro (git-fixes).\n- fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() (git-fixes).\n- fbdev: tridentfb: fix potential memory leak in trident_pci_probe() (git-fixes).\n- fbdev: uvesafb: fix potential memory leak in uvesafb_probe() (git-fixes).\n- fbdev: vesafb: fix memory leak in vesafb_probe() (git-fixes).\n- firewire: net: Fix fragmented datagram reassembly (git-fixes).\n- firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() (git-fixes).\n- firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits (git-fixes).\n- gpio-f7188x: Add support for NCT6126D version B (git-fixes).\n- gpio: davinci: fix IRQ domain leak on devm_kzalloc failure (git-fixes).\n- gpio: eic-sprd: use raw_spinlock_t in the irq startup path (git-fixes).\n- gpio: htc-egpio: use managed gpiochip registration (git-fixes).\n- gpio: mlxbf3: fail probe if gpiochip registration fails (git-fixes).\n- gpio: mvebu: fail probe if gpiochip registration fails (git-fixes).\n- gpio: mvebu: free generic chips on unbind (git-fixes).\n- gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (git-fixes).\n- gpio: rockchip: change the GPIO version judgment logic (stable-fixes).\n- gpio: rockchip: fix generic IRQ chip leak on remove (git-fixes).\n- gpio: rockchip: teardown bugs and resource leaks (git-fixes).\n- gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe() (git-fixes).\n- gpio: tegra: do not call pinctrl for GPIO direction (git-fixes).\n- gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe (git-fixes).\n- gpios: palmas: add .get_direction() op (git-fixes).\n- HID: add haptics page defines (stable-fixes).\n- HID: hid-sjoy: race between init and usage (git-fixes).\n- HID: pidff: Add missing spaces (stable-fixes).\n- HID: pidff: Fix missing blank lines after declarations (stable-fixes).\n- HID: playstation: validate num_touch_reports in DualShock 4 reports (stable-fixes).\n- hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread (git-fixes).\n- hwmon: (adt7470) Fix cache updated before hardware write on I2C error (git-fixes).\n- hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read (git-fixes).\n- hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors (git-fixes).\n- hwmon: (adt7470) Fix PWM auto temp state array and bounds check (git-fixes).\n- hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks (git-fixes).\n- hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() (git-fixes).\n- hwmon: (adt7470) Use cached PWM frequency value (git-fixes).\n- hwmon: (asus-ec-sensors) add missed handle for ENOMEM (git-fixes).\n- hwmon: (asus-ec-sensors) fix EC read intervals (git-fixes).\n- hwmon: (asus-ec-sensors) fix looping over banks while reading from EC (git-fixes).\n- hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (lm90) Only report alarms if driver is ready (git-fixes).\n- hwmon: (ltc4282) Fix reading the minimum alarm voltage (git-fixes).\n- hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 (git-fixes).\n- hwmon: (nct6775-core) Prevent access to unsupported weight registers (git-fixes).\n- hwmon: (npcm750-pwm-fan): stop fan timer on device detach (git-fixes).\n- hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (nzxt-smart2) DMA-align output buffer (git-fixes).\n- hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (pmbus) Fix return value from pmbus_update_byte_data() (git-fixes).\n- hwmon: (pmbus/core) notify on the hwmon device, not the i2c client (git-fixes).\n- hwmon: (sht3x) Fix unaligned accesses (git-fixes).\n- hwmon: (w83627hf) remove VID sysfs files on error and remove (stable-fixes).\n- hwmon: (w83793) remove vrm sysfs file on probe failure (stable-fixes).\n- hwmon: occ: validate poll response sensor blocks (git-fixes).\n- i2c: amd-mp2: Unregister callback on adapter add failure (git-fixes).\n- i2c: imx: Cancel hrtimer before clearing slave pointer (git-fixes).\n- i2c: imx: Fix slave registration race and error handling (git-fixes).\n- i2c: iproc: reset bus after timeout if START_BUSY is stuck (git-fixes).\n- i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock (git-fixes).\n- i2c: mediatek: fix WRRD for SoCs without auto_restart option (git-fixes).\n- i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() (git-fixes).\n- i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue (git-fixes).\n- i3c: mipi-i3c-hci: Preserve RUN bit when aborting DMA ring (git-fixes).\n- ieee802154: admin-gate legacy LLSEC dump operations (git-fixes).\n- ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation (git-fixes).\n- ieee802154: ca8210: fix cas_ctl leak on spi_async failure (git-fixes).\n- ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit (git-fixes).\n- ieee802154: fix kernel-infoleak in dgram_recvmsg() (git-fixes).\n- ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() (git-fixes).\n- iio: accel: bmc150: clamp the device-reported FIFO frame count (git-fixes).\n- iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error (git-fixes).\n- iio: adc: lpc32xx: Initialize completion before requesting IRQ (git-fixes).\n- iio: adc: spear: Initialize completion before requesting IRQ (git-fixes).\n- iio: adc: ti-ads124s08: Return reset GPIO lookup errors (git-fixes).\n- iio: adc: ti-ads1119: fix PM reference leak in buffer preenable (git-fixes).\n- iio: common: st_sensors: honour channel endianness in read_axis_data (git-fixes).\n- iio: event: Fix event FIFO reset race (git-fixes).\n- iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ (git-fixes).\n- iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ (git-fixes).\n- iio: imu: inv_icm42600: fix timestamp clock period by using lower value (git-fixes).\n- iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading (git-fixes).\n- iio: imu: st_lsm6dsx: deselect shub page before reading whoami (git-fixes).\n- iio: light: al3010: fix incorrect scale for the highest gain range (git-fixes).\n- iio: light: gp2ap002: fix runtime PM leak on read error (git-fixes).\n- iio: light: tsl2591: return actual error from probe IRQ failure (git-fixes).\n- iio: magnetometer: ak8975: fix potential kernel stack memory leak (git-fixes).\n- iio: temperature: Build mlx90635 with CONFIG_MLX90635 (git-fixes).\n- Input: ads7846 - restore half-duplex support (git-fixes).\n- Input: atkbd - validate scancode in firmware keymap entries (git-fixes).\n- Input: elan_i2c - prevent division by zero and arithmetic underflow (git-fixes).\n- Input: goodix - clamp the device-reported contact count (git-fixes).\n- Input: iforce - bound the device-reported force-feedback effect index (git-fixes).\n- Input: ims-pcu - add response length checks (git-fixes).\n- Input: ims-pcu - fix DMA mapping violation in line setup (git-fixes).\n- Input: ims-pcu - fix firmware leak in async update (git-fixes).\n- Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() (git-fixes).\n- Input: ims-pcu - fix logic error in packet reset (git-fixes).\n- Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging (git-fixes).\n- Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix race condition in reset_device sysfs callback (git-fixes).\n- Input: ims-pcu - fix type confusion in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix use-after-free and double-free in disconnect (git-fixes).\n- Input: ims-pcu - only expose sysfs attributes on control interface (git-fixes).\n- Input: ims-pcu - release data interface on disconnect (git-fixes).\n- Input: ims-pcu - validate control endpoint type (git-fixes).\n- Input: maple_keyb - set driver data before registering input device (stable-fixes).\n- Input: maplecontrol - set driver data before registering input device (stable-fixes).\n- Input: maplemouse - fix NULL pointer dereference in open() (git-fixes).\n- Input: maplemouse - set driver data before registering input device (stable-fixes).\n- Input: mms114 - fix multi-touch slot corruption (git-fixes).\n- Input: mms114 - fix touch indexing for MMS134S and MMS136 (git-fixes).\n- Input: mms114 - reject an oversized device packet size (git-fixes).\n- Input: rmi4 - fix bit count in bitmap_copy() (git-fixes).\n- Input: rmi4 - fix limit in rmi_register_desc_has_subpacket() (git-fixes).\n- Input: rmi4 - fix memory leak in rmi_set_attn_data() (git-fixes).\n- Input: rmi4 - fix num_subpackets overflow in register descriptor (git-fixes).\n- Input: rmi4 - fix register descriptor address calculation (git-fixes).\n- Input: rmi4 - fix type overflow in register counts (git-fixes).\n- Input: rmi4 - initialize attn_fifo properly (stable-fixes).\n- Input: rmi4 - iterative IRQ handler (git-fixes).\n- Input: rmi4 - refactor F12 probe function (stable-fixes).\n- Input: rmi4 - refactor function allocation and registration (stable-fixes).\n- Input: rmi4 - refactor register descriptor parsing (git-fixes).\n- Input: rmi4 - tolerate short register descriptor structure (git-fixes).\n- Input: rmi4 - use local presence map in rmi_read_register_desc() (stable-fixes).\n- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (git-fixes).\n- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (git-fixes).\n- Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure (git-fixes).\n- Input: touchwin - reset the packet index on every complete packet (git-fixes).\n- intel_th: core: fix null pointer dereference in intel_th_irq (bsc#1248480).\n- intel_th: fix MSC output device reference leak (git-fixes).\n- io_uring/kbuf: don't truncate end buffer for bundles (bsc#1271290).\n- io_uring/kbuf: fix missing BUF_MORE for incremental buffers at EOF (bsc#1261250).\n- io_uring/kbuf: flag partial buffer mappings (bsc#1271290).\n- io_uring/kbuf: propagate BUF_MORE through early buffer commit path (bsc#1261250).\n- io_uring/net: always use current transfer count for buffer put (git-fixes).\n- io_uring/net: improve recv bundles (bsc#1271290).\n- io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries (bsc#1271290).\n- io_uring/net: only consider msg_inq if larger than 1 (git-fixes).\n- io_uring/net: only retry recv bundle for a full transfer (bsc#1271290).\n- io_uring/timeout: add helper for parsing user time (bsc#1271291).\n- io_uring/timeout: honour caller's time namespace for IORING_TIMEOUT_ABS (bsc#1271291).\n- io_uring/timeout: migrate reqs from ts64 to ktime (bsc#1271291).\n- io_uring/wait: honour caller's time namespace for IORING_ENTER_ABS_TIMER (bsc#1271291).\n- ixgbe: reduce number of reads when getting OROM data (bsc#1269637).\n- KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT (git-fixes).\n- KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) (git-fixes).\n- KVM: nSVM: Clear tracking of L1-\u003eL2 NMI and soft IRQ on nested #VMEXIT (git-fixes).\n- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (git-fixes).\n- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (git-fixes).\n- KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs (git-fixes).\n- KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug (git-fixes).\n- KVM: TDX: Reject concurrent change to CPUID entry count (git-fixes).\n- KVM: x86/mmu: Check write tracking in all address spaces (git-fixes).\n- KVM: x86/mmu: Fix use-after-free on vendor module reload (git-fixes).\n- KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots (git-fixes).\n- KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs (git-fixes).\n- KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN (git-fixes).\n- leds: uleds: Fix potential buffer overread (git-fixes).\n- mac802154: hold an interface reference across the scan worker (git-fixes).\n- mac802154: llsec: reject frames shorter than the authentication tag (git-fixes).\n- mac802154: Prevent overwrite return code in mac802154_perform_association() (git-fixes).\n- mac802154: remove interfaces with RCU list deletion (git-fixes).\n- mailbox: zynqmp: setup IPI for each valid child node (bsc#1271395).\n- mctp: Fix incorrect tx flow invalidation condition in mctp-i2c (bsc#1266694).\n- media: aspeed: fix missing of_reserved_mem_device_release() on probe failure (git-fixes).\n- media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() (git-fixes).\n- media: atomisp: gc2235: fix UAF and memory leak (git-fixes).\n- media: cec: seco: unregister adapter on IR probe failure (git-fixes).\n- media: cedrus: Fix failure to clean up hardware on probe failure (git-fixes).\n- media: cedrus: Fix missing cleanup in error path (git-fixes).\n- media: cedrus: skip invalid H.264 reference list entries (git-fixes).\n- media: marvell-cam: fix missing pci_disable_device() on remove (git-fixes).\n- media: mtk-jpeg: cancel workqueue on release for supported platforms only (git-fixes).\n- media: nxp: imx8-isi: Fix use-after-free on remove (git-fixes).\n- media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code (stable-fixes).\n- media: pci: dm1105: Free allocated workqueue (git-fixes).\n- media: qcom: camss: vfe: fix PIX subdev naming on VFE lite (git-fixes).\n- media: qcom: venus: drop extra padding in NV12 raw size calculation (git-fixes).\n- media: qcom: venus: relax encoder frame/blur dimension steps on v4 (git-fixes).\n- media: qcom: venus: relax encoder frame/blur step size on v6 (git-fixes).\n- media: rockchip: rga: fix too small buffer size (git-fixes).\n- media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe (git-fixes).\n- media: ti: vpe: unwind v4l2 device registration on probe error (git-fixes).\n- media: uvcvideo: Avoid partial metadata buffers (git-fixes).\n- media: uvcvideo: Do not add clock samples with small sof delta (git-fixes).\n- media: uvcvideo: Fix buffer sequence in frame gaps (git-fixes).\n- media: uvcvideo: Fix dev_sof filtering in hw timestamp (git-fixes).\n- media: uvcvideo: Fix sequence number when no EOF (git-fixes).\n- media: uvcvideo: Relax the constrains for interpolating the hw clock (git-fixes).\n- media: uvcvideo: Use hw timestaming if the clock buffer is full (git-fixes).\n- media: v4l2-common: Add YUV24 format info (git-fixes).\n- media: v4l2-ctrls: validate HEVC active reference counts (git-fixes).\n- media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si (git-fixes).\n- media: vidtv: fix reference leak on failed device registration (git-fixes).\n- media: vimc: fix reference leak on failed device registration (git-fixes).\n- media: vpif_capture: fix OF node reference imbalance (git-fixes).\n- mei: bus: access mei_device under device_lock on cleanup (git-fixes).\n- memory: tegra: Wire up system sleep PM ops (git-fixes).\n- memstick: ms_block: reject a card that reports too many blocks (git-fixes).\n- mfd: cros_ec: Delay dev_set_drvdata() until probe success (git-fixes).\n- mfd: cs42l43: Sanity check firmware size (git-fixes).\n- mfd: rsmu: Fix page register setup (git-fixes).\n- mfd: sm501: Fix reference leak on failed device registration (git-fixes).\n- mfd: tps6586x: Fix OF node refcount (git-fixes).\n- misc: nsm: only unlock nsm_dev on post-lock error paths (git-fixes).\n- misc: nsm: pin the module while the device is open (git-fixes).\n- mkspec-dtb: Skip missing DTBs.\n- mm: zero range of eof folio exposed by inode size extension (bsc#1272920).\n- mmc: block: fix RPMB device unregister ordering (git-fixes).\n- mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe() method (git-fixes).\n- mmc: vub300: defer reset until cmd_mutex is unlocked (git-fixes).\n- mshv: fix hv_input_get_system_property struct (git-fixes).\n- mtd: mchp23k256: use SPI match data for chip caps (git-fixes).\n- mtd: onenand: samsung: report DMA completion timeouts (git-fixes).\n- mtd: rawnand: fsl_ifc: return errors for failed page reads (git-fixes).\n- mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout (git-fixes).\n- mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout (git-fixes).\n- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (bsc#1271866).\n- net/x25: fix use-after-free in x25_kill_by_neigh() (git-fixes).\n- net: mana: Add Interrupt Moderation support (bsc#1271368).\n- net: mana: Return error code from mana_create_rxq() (git-fixes).\n- net: mctp i2c: Copy headers if cloned (bsc#1266694).\n- net: mctp-i2c: fix duplicate reception of old data (bsc#1266694).\n- net: thunderbolt: Fix frags overflow by bounding frame_count (git-fixes).\n- net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() (git-fixes).\n- net: usb: lan78xx: move functions to avoid forward definitions (stable-fixes).\n- net: wwan: t7xx: check skb_clone in control TX (git-fixes).\n- net: wwan: t7xx: destroy DMA pool on CLDMA late init failure (git-fixes).\n- netfs: Defer the emission of trace_netfs_folio() (git-fixes).\n- of: cpu: add check in __of_find_n_match_cpu_property() (git-fixes).\n- phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access (git-fixes).\n- phy: phy-can-transceiver: Check driver match and driver data against NULL (git-fixes).\n- phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask (git-fixes).\n- phy: zynqmp: fix runtime PM leak on probe allocation failure (git-fixes).\n- phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB (git-fixes).\n- phy: zynqmp: use read-modify-write for SERDES scrambler bypass (git-fixes).\n- pinctrl-amd: Don't clear S4 wake bits at probe (git-fixes).\n- pinctrl: bm1880: add missing select GENERIC_PINCONF (git-fixes).\n- pinctrl: cs42l43: Fix polarity on debounce (git-fixes).\n- pinctrl: devicetree: don't free uninitialized dev_name on error path (git-fixes).\n- pinctrl: equilibrium: fix warning trace on load (git-fixes).\n- pinctrl: equilibrium: rename irq_chip function callbacks (stable-fixes).\n- pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: meson: restore non-sleeping GPIO access (git-fixes).\n- pinctrl: nuvoton: ma35d1: fix MFP register offset and pin table (git-fixes).\n- pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 (git-fixes).\n- pinctrl: qcom: Unconditionally mark gpio as wakeup enable (git-fixes).\n- pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path (git-fixes).\n- pkspec-dtb: Fix dtb-al rename.\n- platform/x86/amd/pmc: Add delay_suspend module parameter (stable-fixes).\n- platform/x86/amd/pmc: Avoid logging \"(null)\" for DMI values (git-fixes).\n- platform/x86/amd/pmc: Check for intermediate wakeup in function (stable-fixes).\n- platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops (stable-fixes).\n- platform/x86/amd/pmc: Don't log during intermediate wakeups (stable-fixes).\n- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (git-fixes).\n- posix-cpu-timers: Cleanup the firing logic (bsc#1271912).\n- posix-cpu-timers: Correctly update timer status in posix_cpu_timer_del() (bsc#1271912).\n- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (bsc#1271912).\n- posix-timers: Add proper state tracking (bsc#1271912).\n- posix-timers: Avoid direct access to hrtimer clockbase (bsc#1271912).\n- posix-timers: Expand timer_arm() callbacks with a boolean return value (bsc#1271912).\n- power: sequencing: fix ABBA deadlock in pwrseq_device_unregister() (git-fixes).\n- power: supply: bq25890: fix the -10 C NTC lookup entry (git-fixes).\n- power: supply: max17040: handle missing status supplier (git-fixes).\n- RDMA/mana_ib: initialize err for empty send WR lists (git-fixes).\n- regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK (git-fixes).\n- regulator: ltc3676: Fix incorrect IRQSTAT bit offsets (git-fixes).\n- regulator: mt6358: use regmap helper to read fixed LDO calibration (git-fixes).\n- remoteproc: qcom: Fix leak when custom dump_segments addition fails (git-fixes).\n- reset: sunxi: fix memory region leak on ioremap failure (git-fixes).\n- Revert \"Input: rmi4 - fix register descriptor address calculation\" (stable-fixes).\n- sctp: validate embedded address parameter length (git-fixes).\n- security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() (git-fixes).\n- selftests: Disable dad for ipv6 in fcnal-test.sh (bsc#1272871).\n- selftests: Replace sleep with slowwait (bsc#1272871).\n- serial: 8250_mid: Disable DMA for selected platforms (git-fixes).\n- serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms (git-fixes).\n- serial: 8250_omap: clear rx_running on zero-length DMA completes (git-fixes).\n- serial: msm: Disable DMA for kernel console UART (git-fixes).\n- serial: sc16is7xx: implement gpio get_direction() callback (git-fixes).\n- soc: fsl: qe: panic on ioremap() failure in qe_reset() (git-fixes).\n- soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy (git-fixes).\n- soc: xilinx: Shutdown and free rx mailbox channel (git-fixes).\n- spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure (git-fixes).\n- spi: sh-msiof: abort transfers when reset times out (git-fixes).\n- staging: media: atomisp: fix loop shadowing in ia_css_stream_destroy() (git-fixes).\n- staging: media: atomisp: reduce load_primary_binaries() stack usage (git-fixes).\n- staging: rtl8723bs: core: move constants to right side in comparison (stable-fixes).\n- staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() (git-fixes).\n- staging: rtl8723bs: fix inverted HT40 secondary channel offset (git-fixes).\n- staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() (git-fixes).\n- staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB write in HT_caps_handler() (git-fixes).\n- staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() (git-fixes).\n- thermal: core: Free thermal zone ID later during removal (git-fixes).\n- time: Switch to hrtimer_setup() (bsc#1271912).\n- tpm: Make the TPM character devices non-seekable (git-fixes).\n- uio_hv_generic: Bind to FCopy device by default (git-fixes).\n- usb: cdc_acm: Add quirk for Uniden BC125AT scanner (stable-fixes).\n- usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() (git-fixes).\n- USB: chaoskey: Fix slab-use-after-free in chaoskey_release() (git-fixes).\n- usb: chipidea: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub (stable-fixes).\n- usb: core: port: Deattach Type-C connector on component unbind (git-fixes).\n- usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() (git-fixes).\n- usb: dwc3: run gadget disconnect from sleepable suspend context (git-fixes).\n- usb: free iso schedules on failed submit (git-fixes).\n- usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler (git-fixes).\n- usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback (git-fixes).\n- usb: gadget: f_fs: Fix DMA fence leak (git-fixes).\n- usb: gadget: f_midi: cancel pending IN work before freeing the midi object (git-fixes).\n- usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() (git-fixes).\n- usb: gadget: f_printer: take kref only for successful open (git-fixes).\n- USB: gadget: fsl-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: function: rndis: add length check for header (stable-fixes).\n- usb: gadget: function: rndis: add length check to response query (stable-fixes).\n- usb: gadget: printer: fix infinite loop in printer_read() (git-fixes).\n- USB: gadget: snps-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown (git-fixes).\n- usb: gadget: udc: Fix use-after-free in gadget_match_driver (stable-fixes).\n- usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer (git-fixes).\n- USB: idmouse: fix use-after-free on disconnect race (git-fixes).\n- USB: iowarrior: fix use-after-free on disconnect (git-fixes).\n- USB: iowarrior: fix use-after-free on disconnect race (git-fixes).\n- usb: iowarrior: remove inherent race with minor number (stable-fixes).\n- USB: ldusb: fix use-after-free on disconnect race (git-fixes).\n- USB: legousbtower: fix use-after-free on disconnect race (git-fixes).\n- USB: misc: uss720: unregister parport on probe failure (git-fixes).\n- usb: mtu3: unmap request DMA on queue failure (git-fixes).\n- USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD (stable-fixes).\n- USB: serial: digi_acceleport: fix broken rx after throttle (git-fixes).\n- USB: serial: digi_acceleport: fix hard lockup on disconnect (git-fixes).\n- USB: serial: digi_acceleport: fix write buffer corruption (git-fixes).\n- USB: serial: io_edgeport: cap received transmit credits (git-fixes).\n- USB: serial: io_ti: reject oversized boot-mode firmware (git-fixes).\n- USB: serial: keyspan_pda: fix data loss on receive throttling (git-fixes).\n- USB: serial: keyspan_pda: fix information leak (git-fixes).\n- USB: serial: mxuport: validate firmware header size (git-fixes).\n- USB: serial: option: add MeiG SRM813Q (stable-fixes).\n- USB: serial: option: add Telit Cinterion FE990D50 compositions (stable-fixes).\n- usb: sl811-hcd: disable controller wakeup on remove (git-fixes).\n- USB: storage: include US_FL_NO_SAME in quirks mask (git-fixes).\n- usb: typec: anx7411: use devm_pm_runtime_enable() (git-fixes).\n- usb: typec: class: drop PD lookup reference (git-fixes).\n- usb: typec: tcpm: Fix VDM type for Enter Mode commands (git-fixes).\n- usb: typec: tcpm: Validate SVID index in svdm_consume_modes() (git-fixes).\n- usb: typec: ucsi: cancel pending work on system suspend (git-fixes).\n- usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove (git-fixes).\n- usb: typec: ucsi: Detect and skip duplicate altmodes from buggy firmware (git-fixes).\n- usb: typec: ucsi: Invert DisplayPort role assignment (git-fixes).\n- usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode (git-fixes).\n- USB: ulpi: fix memory leak on registration failure (git-fixes).\n- USB: usb-storage: ene_ub6250: restore media-ready check (git-fixes).\n- usb: xhci: Fix sleep in atomic context in xhci_free_streams() (git-fixes).\n- usbip: tools: support SuperSpeedPlus devices (git-fixes).\n- usbip: vudc: fix NULL deref in vep_dequeue() (git-fixes).\n- wan: wanxl: Only reset hardware after BAR mapping (git-fixes).\n- watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() (git-fixes).\n- wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() (git-fixes).\n- wifi: ath6kl: fix OOB access from firmware ADDBA window size (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware IE lengths in connect event (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler (git-fixes).\n- wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (git-fixes).\n- wifi: ath10k: fix skb leak on incomplete msdu during rx pop (git-fixes).\n- wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin (git-fixes).\n- wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() (git-fixes).\n- wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: brcmfmac: fix 802.1X-SHA256 call trace warning (git-fixes).\n- wifi: brcmfmac: make release_scratchbuffers idempotent (git-fixes).\n- wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read (git-fixes).\n- wifi: carl9170: fix buffer overflow in rx_stream failover path (git-fixes).\n- wifi: carl9170: fix OOB read from off-by-two in TX status handler (git-fixes).\n- wifi: iwlwifi: mvm: fix read in wake packet notification handler (git-fixes).\n- wifi: iwlwifi: mvm: validate SAR GEO response payload size (git-fixes).\n- wifi: mac80211: fix memory leak in ieee80211_register_hw() (git-fixes).\n- wifi: mac80211: free ack status frame on TX header build failure (git-fixes).\n- wifi: mac80211: recalculate TIM when a station enters power save (git-fixes).\n- wifi: mac80211: tear down new links on vif update error path (git-fixes).\n- wifi: mac80211: validate individual TWT params before driver setup (git-fixes).\n- wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() (git-fixes).\n- wifi: mt76: Disable napi when removing device (git-fixes).\n- wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7915: guard HE capability lookups (git-fixes).\n- wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7925: fix crash in reset link replay (git-fixes).\n- wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv() (git-fixes).\n- wifi: mt76: mt7925: guard link STA in decap offload (git-fixes).\n- wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() (git-fixes).\n- wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() (git-fixes).\n- wifi: mwifiex: bound uAP association event IEs to the event buffer (git-fixes).\n- wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper (git-fixes).\n- wifi: mwifiex: fix permanently busy scans after multiple roam iterations (git-fixes).\n- wifi: mwifiex: fix roaming to different channel in host_mlme mode (git-fixes).\n- wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (git-fixes).\n- wifi: rt2x00: avoid full teardown before work setup in probe (git-fixes).\n- wifi: wilc1000: validate assoc response length before subtracting header (git-fixes).\n- xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit (bsc#1264267).\n- xfs: only assert new size for datafork during truncate extents (bsc#1264084).\n- xfs: rearrange code in xfs_inode_item_precommit (bsc#1237449).\n- xfs: rework datasync tracking and execution (bsc#1237449).\n- xhci: dbgtty: fix device unregister (git-fixes).\n- xhci: dbgtty: fix device unregister: fixup (git-fixes).\n","status":"published","published":"2026-08-11T21:26:34Z","modified":"2026-08-15T18:23:51.243537972Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23221-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).\n- CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).\n- CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).\n- CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).\n- CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).\n- CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).\n- CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).\n- CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).\n- CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).\n- CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).\n- CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).\n- CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).\n- CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).\n- CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).\n- CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).\n- CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).\n- CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).\n- CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).\n- CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).\n- CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).\n- CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).\n- CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).\n- CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).\n- CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).\n- CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).\n- CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).\n- CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).\n- CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).\n- CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).\n- CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).\n- CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).\n- CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).\n- CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).\n- CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).\n- CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).\n- CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).\n- CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).\n- CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).\n- CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).\n- CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).\n- CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).\n- CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).\n- CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).\n- CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).\n- CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).\n- CVE-2026-46033: crypto: authencesn - reject short ahash digests during instance creation (bsc#1266692).\n- CVE-2026-46034: vfio/cdx: Fix NULL pointer dereference in interrupt trigger path (bsc#1266757).\n- CVE-2026-46036: vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex (bsc#1267470).\n- CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).\n- CVE-2026-46040: inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (bsc#1267472).\n- CVE-2026-46064: ibmasm: fix heap over-read in ibmasm_send_i2o_message() (bsc#1267497).\n- CVE-2026-46068: crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx (bsc#1267592).\n- CVE-2026-46086: net: bridge: use a stable FDB dst snapshot in RCU readers (bsc#1267524).\n- CVE-2026-46089: zram: do not forget to endio for partial discard requests (bsc#1267445).\n- CVE-2026-46102: net: strparser: fix skb_head leak in strp_abort_strp() (bsc#1267502).\n- CVE-2026-46121: mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock (bsc#1266932).\n- CVE-2026-46127: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() (bsc#1267236).\n- CVE-2026-46130: dm-verity-fec: fix reading parity bytes split across blocks (take 3) (bsc#1267629).\n- CVE-2026-46132: net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo (bsc#1267616).\n- CVE-2026-46137: mptcp: pm: ADD_ADDR rtx: fix potential data-race (bsc#1267570).\n- CVE-2026-46147: KVM: arm64: Factor out pKVM hyp vcpu creation to separate function (bsc#1267689).\n- CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).\n- CVE-2026-46158: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (bsc#1266880).\n- CVE-2026-46168: mptcp: sockopt: set timestamp flags on subflow socket, not msk (bsc#1266869).\n- CVE-2026-46170: mptcp: disable add_addr retransmission when timeout is 0 (bsc#1267714).\n- CVE-2026-46189: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (bsc#1266918).\n- CVE-2026-46191: fbcon: Avoid OOB font access if console rotation fails (bsc#1267690).\n- CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks (bsc#1267656).\n- CVE-2026-46207: vsock/virtio: fix length and offset in tap skb for split packets (bsc#1267691).\n- CVE-2026-46216: drm/xe/hdcp: Add NULL check for media_gt in (bsc#1267234).\n- CVE-2026-46234: vsock: fix buffer size clamping order (bsc#1266904).\n- CVE-2026-46245: drm/amd/display: Fix dc_link NULL handling in HPD init (bsc#1267678).\n- CVE-2026-46249: octeontx2-af: Fix PF driver crash with kexec kernel booting (bsc#1267683).\n- CVE-2026-46265: RDMA/hns: Fix WQ_MEM_RECLAIM warning (bsc#1267662).\n- CVE-2026-46287: net: txgbe: fix RTNL assertion warning when remove module (bsc#1267954).\n- CVE-2026-46292: pmdomain: core: Fix detach procedure for virtual devices in genpd (bsc#1267943).\n- CVE-2026-46306: flow_dissector: do not dissect PPPoE PFC frames (bsc#1267986).\n- CVE-2026-46321: tun: free page on short-frame rejection in tun_xdp_one() (bsc#1268024).\n- CVE-2026-46324: netfilter: nf_tables: Introduce functions freeing nft_hook objects (bsc#1267995).\n- CVE-2026-46327: dm: fix unlocked test for dm_suspended_md (bsc#1268031).\n- CVE-2026-46329: erofs: handle end of filesystem properly for file-backed mounts (bsc#1268038).\n- CVE-2026-52913: batman-adv: v: stop OGMv2 on disabled interface (bsc#1268985).\n- CVE-2026-52915: netfilter: ip6t_hbh: reject oversized option lists (bsc#1269001).\n- CVE-2026-52916: batman-adv: frag: disallow unicast fragment in fragment (bsc#1269002).\n- CVE-2026-52921: netfilter: ipset: stop hash:* range iteration at end (bsc#1269024).\n- CVE-2026-52922: batman-adv: dat: handle forward allocation error (bsc#1269030).\n- CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).\n- CVE-2026-52926: batman-adv: clear current gateway during teardown (bsc#1269025).\n- CVE-2026-52927: netfilter: ebtables: fix OOB read in compat_mtw_from_user (bsc#1269027).\n- CVE-2026-52930: ipc/shm: serialize orphan cleanup with shm_nattch updates (bsc#1269003).\n- CVE-2026-52934: batman-adv: tvlv: reject oversized TVLV packets (bsc#1268994).\n- CVE-2026-52937: tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR (bsc#1268983).\n- CVE-2026-52941: net/smc: avoid NULL deref of conn-\u003elnk in smc_msg_event tracepoint (bsc#1268966).\n- CVE-2026-52942: netfilter: nf_log: validate MAC header was set before dumping it (bsc#1268967).\n- CVE-2026-52947: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (bsc#1269115).\n- CVE-2026-52953: iommu/vt-d: Fix oops due to out of scope access (bsc#1269133).\n- CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1269172).\n- CVE-2026-52958: libceph: Fix potential out-of-bounds access in osdmap_decode() (bsc#1269174).\n- CVE-2026-52967: smb/client: fix possible infinite loop and oob read in symlink_data() (bsc#1269181).\n- CVE-2026-52970: netfilter: nft_ct: fix missing expect put in obj eval (bsc#1269229).\n- CVE-2026-52974: net: tls: fix strparser anchor skb leak on offload RX setup failure (bsc#1269233).\n- CVE-2026-52981: neigh: let neigh_xmit take skb ownership (bsc#1269254).\n- CVE-2026-52984: net/sched: netem: fix queue limit check to include reordered packets (bsc#1269272).\n- CVE-2026-52986: netfilter: nf_conntrack_sip: don't use simple_strtoul (bsc#1269289).\n- CVE-2026-52988: netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (bsc#1269362).\n- CVE-2026-52995: net/rds: zero per-item info buffer before handing it to visitors (bsc#1269124).\n- CVE-2026-52998: netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (bsc#1269118).\n- CVE-2026-52999: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (bsc#1269119).\n- CVE-2026-53000: netfilter: nat: use kfree_rcu to release ops (bsc#1269117).\n- CVE-2026-53002: netfilter: conntrack: remove sprintf usage (bsc#1269112).\n- CVE-2026-53003: pppoe: drop PFC frames (bsc#1269111).\n- CVE-2026-53004: sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks (bsc#1269106).\n- CVE-2026-53005: af_unix: Drop all SCM attributes for SOCKMAP (bsc#1269107).\n- CVE-2026-53006: ipv6: fix possible UAF in icmpv6_rcv() (bsc#1269104).\n- CVE-2026-53009: ice: fix double-free of tx_buf skb (bsc#1269098).\n- CVE-2026-53011: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (bsc#1269094).\n- CVE-2026-53012: nexthop: fix IPv6 route referencing IPv4 nexthop (bsc#1269154).\n- CVE-2026-53013: macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF (bsc#1269095).\n- CVE-2026-53014: net/sched: act_mirred: fix wrong device for mac_header_xmit check in tcf_blockcast_redir\n  (bsc#1269092).\n- CVE-2026-53032: bpf: Fix NULL deref in map_kptr_match_type for scalar regs (bsc#1269138).\n- CVE-2026-53035: bpf, sockmap: Fix af_unix iter deadlock (bsc#1269190).\n- CVE-2026-53038: ima_fs: Correctly create securityfs files for unsupported hash algos (bsc#1269391).\n- CVE-2026-53062: dm cache policy smq: fix missing locks in invalidating cache blocks (bsc#1269658).\n- CVE-2026-53063: dm cache: fix write hang in passthrough mode (bsc#1269659).\n- CVE-2026-53064: dm cache: fix null-deref with concurrent writes in passthrough mode (bsc#1269132).\n- CVE-2026-53069: net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master (bsc#1269186).\n- CVE-2026-53074: bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb (bsc#1269688).\n- CVE-2026-53083: bpf: Fix RCU stall in bpf_fd_array_map_clear() (bsc#1269964).\n- CVE-2026-53085: bpf: fix mm lifecycle in open-coded task_vma iterator (bsc#1269879).\n- CVE-2026-53088: net: bcmgenet: fix off-by-one in bcmgenet_put_txcb (bsc#1269185).\n- CVE-2026-53101: wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync (bsc#1269415).\n- CVE-2026-53104: wifi: mt76: Fix memory leak destroying device (bsc#1269157).\n- CVE-2026-53106: bpf: Do not allow deleting local storage in NMI (bsc#1269990).\n- CVE-2026-53107: wifi: libertas: use USB anchors for tracking in-flight URBs (bsc#1269991).\n- CVE-2026-53121: amd-pstate: Fix memory leak in amd_pstate_epp_cpu_init() (bsc#1269198).\n- CVE-2026-53123: md: wake raid456 reshape waiters before suspend (bsc#1269643).\n- CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269773).\n- CVE-2026-53132: vsock/virtio: fix potential unbounded skb queue (bsc#1269290).\n- CVE-2026-53134: netfilter: nft_fib: fix stale stack leak via the OIFNAME register (bsc#1269819).\n- CVE-2026-53157: net: phonet: free phonet_device after RCU grace period (bsc#1269241).\n- CVE-2026-53175: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush (bsc#1269714).\n- CVE-2026-53181: vsock/vmci: fix sk_ack_backlog leak on failed handshake (bsc#1269886).\n- CVE-2026-53183: mptcp: allow subflow rcv wnd to shrink (bsc#1269376).\n- CVE-2026-53184: udp: clear skb-\u003edev before running a sockmap verdict (bsc#1269689).\n- CVE-2026-53185: zram: fix use-after-free in zram_bvec_write_partial() (bsc#1269660).\n- CVE-2026-53186: RDMA/srp: bound SRP_RSP sense copy by the received length (bsc#1269663).\n- CVE-2026-53189: mm/huge_memory: update file PMD counter before folio_put() (bsc#1269797).\n- CVE-2026-53210: tee: shm: fix shm leak in register_shm_helper() (bsc#1269727).\n- CVE-2026-53212: netfilter: nft_tunnel: fix use-after-free on object destroy (bsc#1269672).\n- CVE-2026-53214: ipv6: Fix a potential NPD in cleanup_prefix_route() (bsc#1269588).\n- CVE-2026-53218: netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (bsc#1269273).\n- CVE-2026-53221: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() (bsc#1269318).\n- CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997).\n- CVE-2026-53225: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() (bsc#1269711).\n- CVE-2026-53227: net: openvswitch: fix possible kfree_skb of ERR_PTR (bsc#1269877).\n- CVE-2026-53230: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (bsc#1269270).\n- CVE-2026-53233: netdev: fix double-free in netdev_nl_bind_rx_doit() (bsc#1269801).\n- CVE-2026-53235: net: add pskb_may_pull() to skb_gro_receive_list() (bsc#1269286).\n- CVE-2026-53236: tcp: restrict SO_ATTACH_FILTER to priv users (bsc#1269994).\n- CVE-2026-53239: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (bsc#1269677).\n- CVE-2026-53245: net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr (bsc#1269675).\n- CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1269988).\n- CVE-2026-53247: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown (bsc#1269235).\n- CVE-2026-53250: xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() (bsc#1269808).\n- CVE-2026-53252: Bluetooth: fix memory leak in error path of hci_alloc_dev() (bsc#1269307).\n- CVE-2026-53260: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req() (bsc#1269731).\n- CVE-2026-53267: netfilter: nft_ct: bail out on template ct in get eval (bsc#1269577).\n- CVE-2026-53268: netfilter: conntrack_irc: fix possible out-of-bounds read (bsc#1269257).\n- CVE-2026-53270: ipvs: clear the svc scheduler ptr early on edit (bsc#1269240).\n- CVE-2026-53273: tee: optee: prevent use-after-free when the client exits before the supplicant (bsc#1269713).\n- CVE-2026-53275: ipv6: mcast: Fix use-after-free when processing MLD queries (bsc#1269810).\n- CVE-2026-53289: ice: fix NULL pointer dereference in ice_reset_all_vfs() (bsc#1269694).\n- CVE-2026-53321: io_uring/napi: cap busy_poll_to 10 msec (bsc#1269724).\n- CVE-2026-53355: net: rds: clear i_sends on setup unwind (bsc#1270249).\n- CVE-2026-53369: udf: reject descriptors with oversized CRC length (bsc#1271818).\n- CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830).\n- CVE-2026-53388: fuse: re-lock request before replacing page cache folio (bsc#1271825).\n- CVE-2026-53391: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (bsc#1271904).\n- CVE-2026-53392: NFSv4/flexfiles: reject zero filehandle version count (bsc#1271826).\n- CVE-2026-53393: nfsd: reset write verifier on deferred writeback errors (bsc#1271858).\n- CVE-2026-53394: nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race (bsc#1271859).\n- CVE-2026-53397: nfsd: fix posix_acl leak on SETACL decode failure (bsc#1271869).\n- CVE-2026-53398: NFSD: Fix SECINFO_NO_NAME decode error cleanup (bsc#1271870).\n- CVE-2026-53399: nfsd: release layout stid on setlease failure (bsc#1271832).\n- CVE-2026-53402: fbdev: fbcon: fix out-of-bounds read in err_out of (bsc#1271908).\n- CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (bsc#1271964).\n- CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).\n- CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272282).\n- CVE-2026-63809: bpf: NUL-terminate replaced sysctl value (bsc#1272296).\n- CVE-2026-63829: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1272176).\n- CVE-2026-63831: mac802154: llsec: add skb_cow_data() before in-place crypto (bsc#1272184).\n- CVE-2026-63836: batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd (bsc#1272246).\n- CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272836).\n- CVE-2026-63919: xfrm: input: hold netns during deferred transport reinjection (bsc#1272907).\n- CVE-2026-63923: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (bsc#1273005).\n- CVE-2026-63952: memfd: deny writeable mappings when implying SEAL_WRITE (bsc#1272468).\n- CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272466).\n- CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272678).\n- CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp() (bsc#1273035).\n- CVE-2026-64025: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx (bsc#1273117).\n- CVE-2026-64061: netfs: Fix early put of sink folio in netfs_read_gaps() (bsc#1272505).\n- CVE-2026-64091: batman-adv: tt: fix TOCTOU race for reported vlans (bsc#1272514).\n- CVE-2026-64106: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (bsc#1272242).\n- CVE-2026-64157: netfs: Fix partial invalidation of streaming-write folio (bsc#1272462).\n- CVE-2026-64158: netfs: Fix write streaming disablement if fd open O_RDWR (bsc#1272524).\n- CVE-2026-64187: xfs: fail recovery on a committed log item with no regions (bsc#1272204).\n- CVE-2026-64188: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() (bsc#1272150).\n- CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272207).\n- CVE-2026-64357: xfs: fix exchmaps reservation limit check (bsc#1272612).\n- CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing (bsc#1274072).\n- CVE-2026-64561: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (bsc#1273231).\n- CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (bsc#1271526).\n\nThe following non security issues were fixed:\n\n- accel/ivpu: Fix wrong register read in LNL failure diagnostics (git-fixes).\n- accel/ivpu: Reject firmware log with size smaller than header (git-fixes).\n- ALSA: hda: codecs: hdmi: disable keep-alive before audio format change (git-fixes).\n- ALSA: hda: conexant: Remove mic bias threshold override (git-fixes).\n- ALSA: hda: cs35l41: validate and free ACPI mute object (git-fixes).\n- ALSA: hda: Fix cached processing coefficient verbs (git-fixes).\n- ALSA: lx6464es: fix period byte count for 16-bit streams (git-fixes).\n- ALSA: pcm: wake linked drain waiters on unlink (git-fixes).\n- ALSA: scarlett2: Allow selecting config_set by firmware version (stable-fixes).\n- ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417 (git-fixes).\n- ALSA: seq: close a re-opened queue timer in the destructor (git-fixes).\n- ALSA: seq: Fix division by zero in initialize_timer() (git-fixes).\n- ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (git-fixes).\n- ALSA: timer: don't re-enter an instance callback that is still running (git-fixes).\n- ALSA: timer: drain a slave's callback before its master detaches it (git-fixes).\n- ALSA: ump: fix double free of out_cvts on rawmidi error (git-fixes).\n- ALSA: usb-audio: Clamp frame size in implicit-feedback mode (git-fixes).\n- ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() (git-fixes).\n- ALSA: usb-audio: fix stack info leak in RME Digiface status (git-fixes).\n- ALSA: usb-audio: fix use-after-free in ump_to_endpoint() (git-fixes).\n- ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC (git-fixes).\n- apparmor: fix use-after-free in rawdata dedup loop (git-fixes).\n- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (git-fixes).\n- ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() (git-fixes).\n- ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI (git-fixes).\n- ASoC: cs35l56: Fix potential probe() deadlock (git-fixes).\n- ASoC: cs35l56: Use complete_all() to signal init_completion (git-fixes).\n- ASoC: cs42l43: Correct report for forced microphone jack (git-fixes).\n- ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP (git-fixes).\n- ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop (git-fixes).\n- ASoC: tas2562: fix broken entries in the volume lookup table (git-fixes).\n- ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup (git-fixes).\n- ASoC: tas2562: fix DVC coefficient write order (git-fixes).\n- ASoC: tas2781: bound firmware description string parsing (git-fixes).\n- assoc_array: trim the final shortcut word using the current chunk end (git-fixes).\n- batman-adv: bla: reacquire gw address after skb realloc (git-fixes).\n- batman-adv: dat: ensure accessible eth_hdr proto field (git-fixes).\n- batman-adv: dat: fix tie-break for candidate selection (git-fixes).\n- batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes).\n- batman-adv: fix VLAN priority offset (git-fixes).\n- batman-adv: frag: fix primary_if leak on failed linearization (git-fixes).\n- batman-adv: frag: free unfragmentable packet (git-fixes).\n- batman-adv: mcast: avoid OOB read of num_dests header (git-fixes).\n- batman-adv: tt: avoid request storms during pending request (git-fixes).\n- batman-adv: tt: prevent TVLV OOB check overflow (git-fixes).\n- bitops: use common function parameter names (git-fixes).\n- Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (stable-fixes).\n- Bluetooth: 6lowpan: Fix using chan-\u003econn as indication to no remote netdev (git-fixes).\n- Bluetooth: btintel: Validate length before parsing diagnostics TLV (git-fixes).\n- Bluetooth: btrtl: validate firmware patch bounds (git-fixes).\n- Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB (stable-fixes).\n- Bluetooth: btusb: validate Realtek vendor event length (git-fixes).\n- Bluetooth: hci_qca: Clear memdump state on invalid dump size (git-fixes).\n- Bluetooth: hci_sync: Fix advertising data UAFs (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback (git-fixes).\n- Bluetooth: hci_sync: Protect UUID list traversal (git-fixes).\n- Bluetooth: HIDP: reject frames without a transaction header (git-fixes).\n- Bluetooth: HIDP: validate numbered report payloads (git-fixes).\n- Bluetooth: ISO: clear iso_data always when detaching conn from hcon (git-fixes).\n- Bluetooth: ISO: fix CONNECTED -\u003e CLOSED transition on shutdown/release (git-fixes).\n- Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos (git-fixes).\n- Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis() (git-fixes).\n- Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (git-fixes).\n- Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (git-fixes).\n- Bluetooth: mgmt: Translate HCI reason in Device Disconnected event (git-fixes).\n- Bluetooth: RFCOMM: Fix session UAF in set_termios (git-fixes).\n- Bluetooth: SCO: give the socket its own sco_conn reference (git-fixes).\n- btrfs: do not trim a device which is not writeable (bsc#1272568).\n- bus: sunxi-rsb: Always check register address validity (git-fixes).\n- can: bcm: add missing rcu list annotations and operations (git-fixes).\n- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (git-fixes).\n- can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure (git-fixes).\n- can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured (git-fixes).\n- can: ctucanfd: add missing MODULE_DEVICE_TABLE() (git-fixes).\n- can: ctucanfd: handle bus error interrupts (git-fixes).\n- can: ctucanfd: mark error-active controller status valid (git-fixes).\n- can: ctucanfd: unmap BAR0 using base address (git-fixes).\n- can: ctucanfd: use self-test mode for PRESUME_ACK (git-fixes).\n- can: ems_usb: validate CPC message lengths (git-fixes).\n- can: esd_usb: kill anchored URBs before freeing netdevs (git-fixes).\n- can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure (git-fixes).\n- can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure (git-fixes).\n- can: isotp: check register_netdevice_notifier() error in module init (git-fixes).\n- can: isotp: use unconditional synchronize_rcu() in isotp_release() (git-fixes).\n- can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer (git-fixes).\n- can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() (git-fixes).\n- can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents (git-fixes).\n- can: peak_usb: add bounds check for USB channel index (git-fixes).\n- can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error (git-fixes).\n- can: peak_usb: validate uCAN receive record lengths (git-fixes).\n- can: softing: fw_parse(): validate firmware record spans (git-fixes).\n- cdrom: fix stack out-of-bounds read in CDROMVOLCTRL (git-fixes).\n- comedi: comedi_parport: deal with premature interrupt (git-fixes).\n- crypto/xxhash: set downstream CRYPTO_ALG_FIPS_UNAPPROVED (bsc#1262160 jsc#PED-15986).\n- crypto: introduce downstream CRYPTO_ALG_FIPS_UNAPPROVED (bsc#1262160 jsc#PED-15986).\n- crypto: qat - keep VFs enabled during reset (stable-fixes).\n- crypto: qat - notify fatal error before AER reset preparation (stable-fixes).\n- dm cache policy smq: check allocation under invalidate lock (git-fixes).\n- dm cache: fix missing return in invalidate_committed's error path (git-fixes).\n- dmaengine: idxd: fix double free of wq, engine, and group structs (git-fixes).\n- dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (git-fixes).\n- dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ (git-fixes).\n- dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA (git-fixes).\n- driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout() (git-fixes).\n- driver core: Guard deferred probe timeout extension with delayed_work_pending() (git-fixes).\n- driver core: Use mod_delayed_work to prevent lost deferred probe work (git-fixes).\n- Drivers: hv: vmbus: Set DMA coherent mask for VMBus devices (git-fixes).\n- drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference (git-fixes).\n- drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips (git-fixes).\n- drm/amd/display: set new_stream to NULL after release (git-fixes).\n- drm/amd/display: use proper context for logging (git-fixes).\n- drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) (git-fixes).\n- drm/amd/pm: fix amdgpu_pm_info power display units (git-fixes).\n- drm/amd/pm: fix smu13 power limit range calculation (git-fixes).\n- drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge (git-fixes).\n- drm/amdgpu: fix aperture mapping leak (git-fixes).\n- drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment (git-fixes).\n- drm/amdkfd: free MQD managers on DQM init failures (git-fixes).\n- drm/amdkfd: hold event_mutex while checkpointing CRIU events (git-fixes).\n- drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs (git-fixes).\n- drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() (git-fixes).\n- drm/gfx10: Program DB_RING_CONTROL (git-fixes).\n- drm/i915/bios: range check LFP Data Block panel_type2 (git-fixes).\n- drm/i915/gem: Do not leak siblings[] on proto context error (git-fixes).\n- drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU (git-fixes).\n- drm/i915/gt: use correct selftest config symbol (git-fixes).\n- drm/i915/selftests: Fix GT PM sort comparators (git-fixes).\n- drm/i915: ensure segment offset never exceeds allowed max (stable-fixes).\n- drm/i915: Return NULL on error in active_instance (git-fixes).\n- drm/imagination: acquire vm_ctx-\u003elock before mapping memory to GPU VM (git-fixes).\n- drm/imagination: Fix double call to drm_sched_entity_fini() (git-fixes).\n- drm/imagination: fix error checking of pvr_vm_context_lookup() (git-fixes).\n- drm/imagination: Fix returned size for DRM_IOCTL_PVR_DEV_QUERY (git-fixes).\n- drm/imagination: Fix user array stride in pvr_set_uobj_array() (git-fixes).\n- drm/mediatek: Check CRTC state before freeing (git-fixes).\n- drm/mediatek: ovl_adaptor: balance component registrations (git-fixes).\n- drm/panthor: Don't overrule pending immediate ticks in sched_resume_tick() (git-fixes).\n- drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced (git-fixes).\n- drm/panthor: Fix potential invalid pointer deref in group_process_tiler_oom() (git-fixes).\n- drm/panthor: Interrupt group start/resumption if group_bind_locked() fails (git-fixes).\n- drm/panthor: reject firmware sections with oversized data (git-fixes).\n- drm/panthor: return error on truncated firmware (git-fixes).\n- drm/panthor: validate firmware interface structure sizes (git-fixes).\n- drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove (git-fixes).\n- drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered (stable-fixes).\n- drm/tests: shmem: Set DMA mask to 64-bit in drm_gem_shmem (git-fixes).\n- drm/v3d: Reject invalid indirect BO handle in indirect CSD setup (git-fixes).\n- drm/vc4: hvs/v3d: Fix null dereference in unbind (git-fixes).\n- drm/vc4: Prevent shader BO mappings from becoming writable (git-fixes).\n- drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size (git-fixes).\n- drm/vc4: Zero the tile state data array before each BIN job (git-fixes).\n- drm/virtio: bound EDID block reads to the response buffer (git-fixes).\n- drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker (git-fixes).\n- drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure (git-fixes).\n- drm/vmwgfx: bound DMA command body size against suffix pointer (git-fixes).\n- drm/vmwgfx: drop dma_buf reference on foreign-fd prime import (git-fixes).\n- drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size (git-fixes).\n- drm/vmwgfx: reject DX_BIND_QUERY without a DX context (git-fixes).\n- drm/vmwgfx: use check_add_overflow for shader size+offset bound (git-fixes).\n- drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (git-fixes).\n- drm/vmwgfx: validate external BO copy bounds for both stride paths (git-fixes).\n- drm/vmwgfx: Validate vmw_surface_metadata::array_size (git-fixes).\n- drm/xe/hw_engine: Fix double-free of managed BO in error path (git-fixes).\n- drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays (git-fixes).\n- drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry() (git-fixes).\n- drm/xe/wopcm: fix WOPCM size for LNL+ (git-fixes).\n- drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds (git-fixes).\n- drm/xe: remove duplicate \u003ckunit/test-bug.h\u003e include (git-fixes).\n- erofs: set fileio bio failed in short read case (git-fixes).\n- fbcon: fix NULL pointer dereference for a console without vc_data (stable-fixes).\n- fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() (git-fixes).\n- fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() (git-fixes).\n- fbdev: efifb: fix memory leak in efifb_probe() (git-fixes).\n- fbdev: hecubafb: fix potential memory leak in hecubafb_probe() (git-fixes).\n- fbdev: i740fb: fix potential memory leak in i740fb_probe() (git-fixes).\n- fbdev: metronomefb: fix potential memory leak in metronomefb_probe() (git-fixes).\n- fbdev: nvidia: fix potential memory leak in nvidiafb_probe() (git-fixes).\n- fbdev: radeon: fix potential memory leak in radeonfb_pci_register() (git-fixes).\n- fbdev: s3fb: fix potential memory leak in s3_pci_probe() (git-fixes).\n- fbdev: sm501fb: Fix buffer errors in OF binding code (git-fixes).\n- fbdev: sm712: Fix operator precedence in big_swap macro (git-fixes).\n- fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() (git-fixes).\n- fbdev: tridentfb: fix potential memory leak in trident_pci_probe() (git-fixes).\n- fbdev: uvesafb: fix potential memory leak in uvesafb_probe() (git-fixes).\n- fbdev: vesafb: fix memory leak in vesafb_probe() (git-fixes).\n- firewire: net: Fix fragmented datagram reassembly (git-fixes).\n- firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() (git-fixes).\n- firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits (git-fixes).\n- gpio-f7188x: Add support for NCT6126D version B (git-fixes).\n- gpio: davinci: fix IRQ domain leak on devm_kzalloc failure (git-fixes).\n- gpio: eic-sprd: use raw_spinlock_t in the irq startup path (git-fixes).\n- gpio: htc-egpio: use managed gpiochip registration (git-fixes).\n- gpio: mlxbf3: fail probe if gpiochip registration fails (git-fixes).\n- gpio: mvebu: fail probe if gpiochip registration fails (git-fixes).\n- gpio: mvebu: free generic chips on unbind (git-fixes).\n- gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (git-fixes).\n- gpio: rockchip: change the GPIO version judgment logic (stable-fixes).\n- gpio: rockchip: fix generic IRQ chip leak on remove (git-fixes).\n- gpio: rockchip: teardown bugs and resource leaks (git-fixes).\n- gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe() (git-fixes).\n- gpio: tegra: do not call pinctrl for GPIO direction (git-fixes).\n- gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe (git-fixes).\n- gpios: palmas: add .get_direction() op (git-fixes).\n- HID: add haptics page defines (stable-fixes).\n- HID: hid-sjoy: race between init and usage (git-fixes).\n- HID: pidff: Add missing spaces (stable-fixes).\n- HID: pidff: Fix missing blank lines after declarations (stable-fixes).\n- HID: playstation: validate num_touch_reports in DualShock 4 reports (stable-fixes).\n- hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread (git-fixes).\n- hwmon: (adt7470) Fix cache updated before hardware write on I2C error (git-fixes).\n- hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read (git-fixes).\n- hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors (git-fixes).\n- hwmon: (adt7470) Fix PWM auto temp state array and bounds check (git-fixes).\n- hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks (git-fixes).\n- hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() (git-fixes).\n- hwmon: (adt7470) Use cached PWM frequency value (git-fixes).\n- hwmon: (asus-ec-sensors) add missed handle for ENOMEM (git-fixes).\n- hwmon: (asus-ec-sensors) fix EC read intervals (git-fixes).\n- hwmon: (asus-ec-sensors) fix looping over banks while reading from EC (git-fixes).\n- hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (lm90) Only report alarms if driver is ready (git-fixes).\n- hwmon: (ltc4282) Fix reading the minimum alarm voltage (git-fixes).\n- hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 (git-fixes).\n- hwmon: (nct6775-core) Prevent access to unsupported weight registers (git-fixes).\n- hwmon: (npcm750-pwm-fan): stop fan timer on device detach (git-fixes).\n- hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (nzxt-smart2) DMA-align output buffer (git-fixes).\n- hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (pmbus) Fix return value from pmbus_update_byte_data() (git-fixes).\n- hwmon: (pmbus/core) notify on the hwmon device, not the i2c client (git-fixes).\n- hwmon: (sht3x) Fix unaligned accesses (git-fixes).\n- hwmon: (w83627hf) remove VID sysfs files on error and remove (stable-fixes).\n- hwmon: (w83793) remove vrm sysfs file on probe failure (stable-fixes).\n- hwmon: occ: validate poll response sensor blocks (git-fixes).\n- i2c: amd-mp2: Unregister callback on adapter add failure (git-fixes).\n- i2c: imx: Cancel hrtimer before clearing slave pointer (git-fixes).\n- i2c: imx: Fix slave registration race and error handling (git-fixes).\n- i2c: iproc: reset bus after timeout if START_BUSY is stuck (git-fixes).\n- i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock (git-fixes).\n- i2c: mediatek: fix WRRD for SoCs without auto_restart option (git-fixes).\n- i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() (git-fixes).\n- i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue (git-fixes).\n- i3c: mipi-i3c-hci: Preserve RUN bit when aborting DMA ring (git-fixes).\n- ieee802154: admin-gate legacy LLSEC dump operations (git-fixes).\n- ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation (git-fixes).\n- ieee802154: ca8210: fix cas_ctl leak on spi_async failure (git-fixes).\n- ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit (git-fixes).\n- ieee802154: fix kernel-infoleak in dgram_recvmsg() (git-fixes).\n- ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() (git-fixes).\n- iio: accel: bmc150: clamp the device-reported FIFO frame count (git-fixes).\n- iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error (git-fixes).\n- iio: adc: lpc32xx: Initialize completion before requesting IRQ (git-fixes).\n- iio: adc: spear: Initialize completion before requesting IRQ (git-fixes).\n- iio: adc: ti-ads124s08: Return reset GPIO lookup errors (git-fixes).\n- iio: adc: ti-ads1119: fix PM reference leak in buffer preenable (git-fixes).\n- iio: common: st_sensors: honour channel endianness in read_axis_data (git-fixes).\n- iio: event: Fix event FIFO reset race (git-fixes).\n- iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ (git-fixes).\n- iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ (git-fixes).\n- iio: imu: inv_icm42600: fix timestamp clock period by using lower value (git-fixes).\n- iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading (git-fixes).\n- iio: imu: st_lsm6dsx: deselect shub page before reading whoami (git-fixes).\n- iio: light: al3010: fix incorrect scale for the highest gain range (git-fixes).\n- iio: light: gp2ap002: fix runtime PM leak on read error (git-fixes).\n- iio: light: tsl2591: return actual error from probe IRQ failure (git-fixes).\n- iio: magnetometer: ak8975: fix potential kernel stack memory leak (git-fixes).\n- iio: temperature: Build mlx90635 with CONFIG_MLX90635 (git-fixes).\n- Input: ads7846 - restore half-duplex support (git-fixes).\n- Input: atkbd - validate scancode in firmware keymap entries (git-fixes).\n- Input: elan_i2c - prevent division by zero and arithmetic underflow (git-fixes).\n- Input: goodix - clamp the device-reported contact count (git-fixes).\n- Input: iforce - bound the device-reported force-feedback effect index (git-fixes).\n- Input: ims-pcu - add response length checks (git-fixes).\n- Input: ims-pcu - fix DMA mapping violation in line setup (git-fixes).\n- Input: ims-pcu - fix firmware leak in async update (git-fixes).\n- Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() (git-fixes).\n- Input: ims-pcu - fix logic error in packet reset (git-fixes).\n- Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging (git-fixes).\n- Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix race condition in reset_device sysfs callback (git-fixes).\n- Input: ims-pcu - fix type confusion in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix use-after-free and double-free in disconnect (git-fixes).\n- Input: ims-pcu - only expose sysfs attributes on control interface (git-fixes).\n- Input: ims-pcu - release data interface on disconnect (git-fixes).\n- Input: ims-pcu - validate control endpoint type (git-fixes).\n- Input: maple_keyb - set driver data before registering input device (stable-fixes).\n- Input: maplecontrol - set driver data before registering input device (stable-fixes).\n- Input: maplemouse - fix NULL pointer dereference in open() (git-fixes).\n- Input: maplemouse - set driver data before registering input device (stable-fixes).\n- Input: mms114 - fix multi-touch slot corruption (git-fixes).\n- Input: mms114 - fix touch indexing for MMS134S and MMS136 (git-fixes).\n- Input: mms114 - reject an oversized device packet size (git-fixes).\n- Input: rmi4 - fix bit count in bitmap_copy() (git-fixes).\n- Input: rmi4 - fix limit in rmi_register_desc_has_subpacket() (git-fixes).\n- Input: rmi4 - fix memory leak in rmi_set_attn_data() (git-fixes).\n- Input: rmi4 - fix num_subpackets overflow in register descriptor (git-fixes).\n- Input: rmi4 - fix register descriptor address calculation (git-fixes).\n- Input: rmi4 - fix type overflow in register counts (git-fixes).\n- Input: rmi4 - initialize attn_fifo properly (stable-fixes).\n- Input: rmi4 - iterative IRQ handler (git-fixes).\n- Input: rmi4 - refactor F12 probe function (stable-fixes).\n- Input: rmi4 - refactor function allocation and registration (stable-fixes).\n- Input: rmi4 - refactor register descriptor parsing (git-fixes).\n- Input: rmi4 - tolerate short register descriptor structure (git-fixes).\n- Input: rmi4 - use local presence map in rmi_read_register_desc() (stable-fixes).\n- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (git-fixes).\n- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (git-fixes).\n- Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure (git-fixes).\n- Input: touchwin - reset the packet index on every complete packet (git-fixes).\n- intel_th: core: fix null pointer dereference in intel_th_irq (bsc#1248480).\n- intel_th: fix MSC output device reference leak (git-fixes).\n- io_uring/kbuf: don't truncate end buffer for bundles (bsc#1271290).\n- io_uring/kbuf: fix missing BUF_MORE for incremental buffers at EOF (bsc#1261250).\n- io_uring/kbuf: flag partial buffer mappings (bsc#1271290).\n- io_uring/kbuf: propagate BUF_MORE through early buffer commit path (bsc#1261250).\n- io_uring/net: always use current transfer count for buffer put (git-fixes).\n- io_uring/net: improve recv bundles (bsc#1271290).\n- io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries (bsc#1271290).\n- io_uring/net: only consider msg_inq if larger than 1 (git-fixes).\n- io_uring/net: only retry recv bundle for a full transfer (bsc#1271290).\n- io_uring/timeout: add helper for parsing user time (bsc#1271291).\n- io_uring/timeout: honour caller's time namespace for IORING_TIMEOUT_ABS (bsc#1271291).\n- io_uring/timeout: migrate reqs from ts64 to ktime (bsc#1271291).\n- io_uring/wait: honour caller's time namespace for IORING_ENTER_ABS_TIMER (bsc#1271291).\n- ixgbe: reduce number of reads when getting OROM data (bsc#1269637).\n- KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT (git-fixes).\n- KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) (git-fixes).\n- KVM: nSVM: Clear tracking of L1-\u003eL2 NMI and soft IRQ on nested #VMEXIT (git-fixes).\n- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (git-fixes).\n- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (git-fixes).\n- KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs (git-fixes).\n- KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug (git-fixes).\n- KVM: TDX: Reject concurrent change to CPUID entry count (git-fixes).\n- KVM: x86/mmu: Check write tracking in all address spaces (git-fixes).\n- KVM: x86/mmu: Fix use-after-free on vendor module reload (git-fixes).\n- KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots (git-fixes).\n- KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs (git-fixes).\n- KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN (git-fixes).\n- leds: uleds: Fix potential buffer overread (git-fixes).\n- mac802154: hold an interface reference across the scan worker (git-fixes).\n- mac802154: llsec: reject frames shorter than the authentication tag (git-fixes).\n- mac802154: Prevent overwrite return code in mac802154_perform_association() (git-fixes).\n- mac802154: remove interfaces with RCU list deletion (git-fixes).\n- mailbox: zynqmp: setup IPI for each valid child node (bsc#1271395).\n- mctp: Fix incorrect tx flow invalidation condition in mctp-i2c (bsc#1266694).\n- media: aspeed: fix missing of_reserved_mem_device_release() on probe failure (git-fixes).\n- media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() (git-fixes).\n- media: atomisp: gc2235: fix UAF and memory leak (git-fixes).\n- media: cec: seco: unregister adapter on IR probe failure (git-fixes).\n- media: cedrus: Fix failure to clean up hardware on probe failure (git-fixes).\n- media: cedrus: Fix missing cleanup in error path (git-fixes).\n- media: cedrus: skip invalid H.264 reference list entries (git-fixes).\n- media: marvell-cam: fix missing pci_disable_device() on remove (git-fixes).\n- media: mtk-jpeg: cancel workqueue on release for supported platforms only (git-fixes).\n- media: nxp: imx8-isi: Fix use-after-free on remove (git-fixes).\n- media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code (stable-fixes).\n- media: pci: dm1105: Free allocated workqueue (git-fixes).\n- media: qcom: camss: vfe: fix PIX subdev naming on VFE lite (git-fixes).\n- media: qcom: venus: drop extra padding in NV12 raw size calculation (git-fixes).\n- media: qcom: venus: relax encoder frame/blur dimension steps on v4 (git-fixes).\n- media: qcom: venus: relax encoder frame/blur step size on v6 (git-fixes).\n- media: rockchip: rga: fix too small buffer size (git-fixes).\n- media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe (git-fixes).\n- media: ti: vpe: unwind v4l2 device registration on probe error (git-fixes).\n- media: uvcvideo: Avoid partial metadata buffers (git-fixes).\n- media: uvcvideo: Do not add clock samples with small sof delta (git-fixes).\n- media: uvcvideo: Fix buffer sequence in frame gaps (git-fixes).\n- media: uvcvideo: Fix dev_sof filtering in hw timestamp (git-fixes).\n- media: uvcvideo: Fix sequence number when no EOF (git-fixes).\n- media: uvcvideo: Relax the constrains for interpolating the hw clock (git-fixes).\n- media: uvcvideo: Use hw timestaming if the clock buffer is full (git-fixes).\n- media: v4l2-common: Add YUV24 format info (git-fixes).\n- media: v4l2-ctrls: validate HEVC active reference counts (git-fixes).\n- media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si (git-fixes).\n- media: vidtv: fix reference leak on failed device registration (git-fixes).\n- media: vimc: fix reference leak on failed device registration (git-fixes).\n- media: vpif_capture: fix OF node reference imbalance (git-fixes).\n- mei: bus: access mei_device under device_lock on cleanup (git-fixes).\n- memory: tegra: Wire up system sleep PM ops (git-fixes).\n- memstick: ms_block: reject a card that reports too many blocks (git-fixes).\n- mfd: cros_ec: Delay dev_set_drvdata() until probe success (git-fixes).\n- mfd: cs42l43: Sanity check firmware size (git-fixes).\n- mfd: rsmu: Fix page register setup (git-fixes).\n- mfd: sm501: Fix reference leak on failed device registration (git-fixes).\n- mfd: tps6586x: Fix OF node refcount (git-fixes).\n- misc: nsm: only unlock nsm_dev on post-lock error paths (git-fixes).\n- misc: nsm: pin the module while the device is open (git-fixes).\n- mkspec-dtb: Skip missing DTBs.\n- mm: zero range of eof folio exposed by inode size extension (bsc#1272920).\n- mmc: block: fix RPMB device unregister ordering (git-fixes).\n- mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe() method (git-fixes).\n- mmc: vub300: defer reset until cmd_mutex is unlocked (git-fixes).\n- mshv: fix hv_input_get_system_property struct (git-fixes).\n- mtd: mchp23k256: use SPI match data for chip caps (git-fixes).\n- mtd: onenand: samsung: report DMA completion timeouts (git-fixes).\n- mtd: rawnand: fsl_ifc: return errors for failed page reads (git-fixes).\n- mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout (git-fixes).\n- mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout (git-fixes).\n- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (bsc#1271866).\n- net/x25: fix use-after-free in x25_kill_by_neigh() (git-fixes).\n- net: mana: Add Interrupt Moderation support (bsc#1271368).\n- net: mana: Return error code from mana_create_rxq() (git-fixes).\n- net: mctp i2c: Copy headers if cloned (bsc#1266694).\n- net: mctp-i2c: fix duplicate reception of old data (bsc#1266694).\n- net: thunderbolt: Fix frags overflow by bounding frame_count (git-fixes).\n- net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() (git-fixes).\n- net: usb: lan78xx: move functions to avoid forward definitions (stable-fixes).\n- net: wwan: t7xx: check skb_clone in control TX (git-fixes).\n- net: wwan: t7xx: destroy DMA pool on CLDMA late init failure (git-fixes).\n- netfs: Defer the emission of trace_netfs_folio() (git-fixes).\n- of: cpu: add check in __of_find_n_match_cpu_property() (git-fixes).\n- phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access (git-fixes).\n- phy: phy-can-transceiver: Check driver match and driver data against NULL (git-fixes).\n- phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask (git-fixes).\n- phy: zynqmp: fix runtime PM leak on probe allocation failure (git-fixes).\n- phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB (git-fixes).\n- phy: zynqmp: use read-modify-write for SERDES scrambler bypass (git-fixes).\n- pinctrl-amd: Don't clear S4 wake bits at probe (git-fixes).\n- pinctrl: bm1880: add missing select GENERIC_PINCONF (git-fixes).\n- pinctrl: cs42l43: Fix polarity on debounce (git-fixes).\n- pinctrl: devicetree: don't free uninitialized dev_name on error path (git-fixes).\n- pinctrl: equilibrium: fix warning trace on load (git-fixes).\n- pinctrl: equilibrium: rename irq_chip function callbacks (stable-fixes).\n- pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: meson: restore non-sleeping GPIO access (git-fixes).\n- pinctrl: nuvoton: ma35d1: fix MFP register offset and pin table (git-fixes).\n- pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 (git-fixes).\n- pinctrl: qcom: Unconditionally mark gpio as wakeup enable (git-fixes).\n- pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path (git-fixes).\n- pkspec-dtb: Fix dtb-al rename.\n- platform/x86/amd/pmc: Add delay_suspend module parameter (stable-fixes).\n- platform/x86/amd/pmc: Avoid logging \"(null)\" for DMI values (git-fixes).\n- platform/x86/amd/pmc: Check for intermediate wakeup in function (stable-fixes).\n- platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops (stable-fixes).\n- platform/x86/amd/pmc: Don't log during intermediate wakeups (stable-fixes).\n- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (git-fixes).\n- posix-cpu-timers: Cleanup the firing logic (bsc#1271912).\n- posix-cpu-timers: Correctly update timer status in posix_cpu_timer_del() (bsc#1271912).\n- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (bsc#1271912).\n- posix-timers: Add proper state tracking (bsc#1271912).\n- posix-timers: Avoid direct access to hrtimer clockbase (bsc#1271912).\n- posix-timers: Expand timer_arm() callbacks with a boolean return value (bsc#1271912).\n- power: sequencing: fix ABBA deadlock in pwrseq_device_unregister() (git-fixes).\n- power: supply: bq25890: fix the -10 C NTC lookup entry (git-fixes).\n- power: supply: max17040: handle missing status supplier (git-fixes).\n- RDMA/mana_ib: initialize err for empty send WR lists (git-fixes).\n- regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK (git-fixes).\n- regulator: ltc3676: Fix incorrect IRQSTAT bit offsets (git-fixes).\n- regulator: mt6358: use regmap helper to read fixed LDO calibration (git-fixes).\n- remoteproc: qcom: Fix leak when custom dump_segments addition fails (git-fixes).\n- reset: sunxi: fix memory region leak on ioremap failure (git-fixes).\n- Revert \"Input: rmi4 - fix register descriptor address calculation\" (stable-fixes).\n- sctp: validate embedded address parameter length (git-fixes).\n- security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() (git-fixes).\n- selftests: Disable dad for ipv6 in fcnal-test.sh (bsc#1272871).\n- selftests: Replace sleep with slowwait (bsc#1272871).\n- serial: 8250_mid: Disable DMA for selected platforms (git-fixes).\n- serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms (git-fixes).\n- serial: 8250_omap: clear rx_running on zero-length DMA completes (git-fixes).\n- serial: msm: Disable DMA for kernel console UART (git-fixes).\n- serial: sc16is7xx: implement gpio get_direction() callback (git-fixes).\n- soc: fsl: qe: panic on ioremap() failure in qe_reset() (git-fixes).\n- soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy (git-fixes).\n- soc: xilinx: Shutdown and free rx mailbox channel (git-fixes).\n- spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure (git-fixes).\n- spi: sh-msiof: abort transfers when reset times out (git-fixes).\n- staging: media: atomisp: fix loop shadowing in ia_css_stream_destroy() (git-fixes).\n- staging: media: atomisp: reduce load_primary_binaries() stack usage (git-fixes).\n- staging: rtl8723bs: core: move constants to right side in comparison (stable-fixes).\n- staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() (git-fixes).\n- staging: rtl8723bs: fix inverted HT40 secondary channel offset (git-fixes).\n- staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() (git-fixes).\n- staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB write in HT_caps_handler() (git-fixes).\n- staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() (git-fixes).\n- thermal: core: Free thermal zone ID later during removal (git-fixes).\n- time: Switch to hrtimer_setup() (bsc#1271912).\n- tpm: Make the TPM character devices non-seekable (git-fixes).\n- uio_hv_generic: Bind to FCopy device by default (git-fixes).\n- usb: cdc_acm: Add quirk for Uniden BC125AT scanner (stable-fixes).\n- usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() (git-fixes).\n- USB: chaoskey: Fix slab-use-after-free in chaoskey_release() (git-fixes).\n- usb: chipidea: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub (stable-fixes).\n- usb: core: port: Deattach Type-C connector on component unbind (git-fixes).\n- usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() (git-fixes).\n- usb: dwc3: run gadget disconnect from sleepable suspend context (git-fixes).\n- usb: free iso schedules on failed submit (git-fixes).\n- usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler (git-fixes).\n- usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback (git-fixes).\n- usb: gadget: f_fs: Fix DMA fence leak (git-fixes).\n- usb: gadget: f_midi: cancel pending IN work before freeing the midi object (git-fixes).\n- usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() (git-fixes).\n- usb: gadget: f_printer: take kref only for successful open (git-fixes).\n- USB: gadget: fsl-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: function: rndis: add length check for header (stable-fixes).\n- usb: gadget: function: rndis: add length check to response query (stable-fixes).\n- usb: gadget: printer: fix infinite loop in printer_read() (git-fixes).\n- USB: gadget: snps-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown (git-fixes).\n- usb: gadget: udc: Fix use-after-free in gadget_match_driver (stable-fixes).\n- usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer (git-fixes).\n- USB: idmouse: fix use-after-free on disconnect race (git-fixes).\n- USB: iowarrior: fix use-after-free on disconnect (git-fixes).\n- USB: iowarrior: fix use-after-free on disconnect race (git-fixes).\n- usb: iowarrior: remove inherent race with minor number (stable-fixes).\n- USB: ldusb: fix use-after-free on disconnect race (git-fixes).\n- USB: legousbtower: fix use-after-free on disconnect race (git-fixes).\n- USB: misc: uss720: unregister parport on probe failure (git-fixes).\n- usb: mtu3: unmap request DMA on queue failure (git-fixes).\n- USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD (stable-fixes).\n- USB: serial: digi_acceleport: fix broken rx after throttle (git-fixes).\n- USB: serial: digi_acceleport: fix hard lockup on disconnect (git-fixes).\n- USB: serial: digi_acceleport: fix write buffer corruption (git-fixes).\n- USB: serial: io_edgeport: cap received transmit credits (git-fixes).\n- USB: serial: io_ti: reject oversized boot-mode firmware (git-fixes).\n- USB: serial: keyspan_pda: fix data loss on receive throttling (git-fixes).\n- USB: serial: keyspan_pda: fix information leak (git-fixes).\n- USB: serial: mxuport: validate firmware header size (git-fixes).\n- USB: serial: option: add MeiG SRM813Q (stable-fixes).\n- USB: serial: option: add Telit Cinterion FE990D50 compositions (stable-fixes).\n- usb: sl811-hcd: disable controller wakeup on remove (git-fixes).\n- USB: storage: include US_FL_NO_SAME in quirks mask (git-fixes).\n- usb: typec: anx7411: use devm_pm_runtime_enable() (git-fixes).\n- usb: typec: class: drop PD lookup reference (git-fixes).\n- usb: typec: tcpm: Fix VDM type for Enter Mode commands (git-fixes).\n- usb: typec: tcpm: Validate SVID index in svdm_consume_modes() (git-fixes).\n- usb: typec: ucsi: cancel pending work on system suspend (git-fixes).\n- usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove (git-fixes).\n- usb: typec: ucsi: Detect and skip duplicate altmodes from buggy firmware (git-fixes).\n- usb: typec: ucsi: Invert DisplayPort role assignment (git-fixes).\n- usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode (git-fixes).\n- USB: ulpi: fix memory leak on registration failure (git-fixes).\n- USB: usb-storage: ene_ub6250: restore media-ready check (git-fixes).\n- usb: xhci: Fix sleep in atomic context in xhci_free_streams() (git-fixes).\n- usbip: tools: support SuperSpeedPlus devices (git-fixes).\n- usbip: vudc: fix NULL deref in vep_dequeue() (git-fixes).\n- wan: wanxl: Only reset hardware after BAR mapping (git-fixes).\n- watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() (git-fixes).\n- wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() (git-fixes).\n- wifi: ath6kl: fix OOB access from firmware ADDBA window size (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware IE lengths in connect event (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler (git-fixes).\n- wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (git-fixes).\n- wifi: ath10k: fix skb leak on incomplete msdu during rx pop (git-fixes).\n- wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin (git-fixes).\n- wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() (git-fixes).\n- wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: brcmfmac: fix 802.1X-SHA256 call trace warning (git-fixes).\n- wifi: brcmfmac: make release_scratchbuffers idempotent (git-fixes).\n- wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read (git-fixes).\n- wifi: carl9170: fix buffer overflow in rx_stream failover path (git-fixes).\n- wifi: carl9170: fix OOB read from off-by-two in TX status handler (git-fixes).\n- wifi: iwlwifi: mvm: fix read in wake packet notification handler (git-fixes).\n- wifi: iwlwifi: mvm: validate SAR GEO response payload size (git-fixes).\n- wifi: mac80211: fix memory leak in ieee80211_register_hw() (git-fixes).\n- wifi: mac80211: free ack status frame on TX header build failure (git-fixes).\n- wifi: mac80211: recalculate TIM when a station enters power save (git-fixes).\n- wifi: mac80211: tear down new links on vif update error path (git-fixes).\n- wifi: mac80211: validate individual TWT params before driver setup (git-fixes).\n- wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() (git-fixes).\n- wifi: mt76: Disable napi when removing device (git-fixes).\n- wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7915: guard HE capability lookups (git-fixes).\n- wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7925: fix crash in reset link replay (git-fixes).\n- wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv() (git-fixes).\n- wifi: mt76: mt7925: guard link STA in decap offload (git-fixes).\n- wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() (git-fixes).\n- wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() (git-fixes).\n- wifi: mwifiex: bound uAP association event IEs to the event buffer (git-fixes).\n- wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper (git-fixes).\n- wifi: mwifiex: fix permanently busy scans after multiple roam iterations (git-fixes).\n- wifi: mwifiex: fix roaming to different channel in host_mlme mode (git-fixes).\n- wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (git-fixes).\n- wifi: rt2x00: avoid full teardown before work setup in probe (git-fixes).\n- wifi: wilc1000: validate assoc response length before subtracting header (git-fixes).\n- xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit (bsc#1264267).\n- xfs: only assert new size for datafork during truncate extents (bsc#1264084).\n- xfs: rearrange code in xfs_inode_item_precommit (bsc#1237449).\n- xfs: rework datasync tracking and execution (bsc#1237449).\n- xhci: dbgtty: fix device unregister (git-fixes).\n- xhci: dbgtty: fix device unregister: fixup (git-fixes).\n","status":"published","published":"2026-08-11T21:26:34Z","modified":"2026-08-27T18:23:09.328001936Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23231-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).\n- CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).\n- CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).\n- CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).\n- CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).\n- CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).\n- CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).\n- CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).\n- CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).\n- CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).\n- CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).\n- CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).\n- CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).\n- CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).\n- CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).\n- CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).\n- CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).\n- CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).\n- CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).\n- CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).\n- CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).\n- CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).\n- CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).\n- CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).\n- CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).\n- CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).\n- CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).\n- CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).\n- CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).\n- CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).\n- CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).\n- CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).\n- CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).\n- CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).\n- CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).\n- CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).\n- CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).\n- CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).\n- CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).\n- CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).\n- CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).\n- CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).\n- CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).\n- CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).\n- CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).\n- CVE-2026-46033: crypto: authencesn - reject short ahash digests during instance creation (bsc#1266692).\n- CVE-2026-46034: vfio/cdx: Fix NULL pointer dereference in interrupt trigger path (bsc#1266757).\n- CVE-2026-46036: vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex (bsc#1267470).\n- CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).\n- CVE-2026-46040: inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (bsc#1267472).\n- CVE-2026-46064: ibmasm: fix heap over-read in ibmasm_send_i2o_message() (bsc#1267497).\n- CVE-2026-46068: crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx (bsc#1267592).\n- CVE-2026-46086: net: bridge: use a stable FDB dst snapshot in RCU readers (bsc#1267524).\n- CVE-2026-46089: zram: do not forget to endio for partial discard requests (bsc#1267445).\n- CVE-2026-46102: net: strparser: fix skb_head leak in strp_abort_strp() (bsc#1267502).\n- CVE-2026-46121: mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock (bsc#1266932).\n- CVE-2026-46127: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() (bsc#1267236).\n- CVE-2026-46130: dm-verity-fec: fix reading parity bytes split across blocks (take 3) (bsc#1267629).\n- CVE-2026-46132: net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo (bsc#1267616).\n- CVE-2026-46137: mptcp: pm: ADD_ADDR rtx: fix potential data-race (bsc#1267570).\n- CVE-2026-46147: KVM: arm64: Factor out pKVM hyp vcpu creation to separate function (bsc#1267689).\n- CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).\n- CVE-2026-46158: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (bsc#1266880).\n- CVE-2026-46168: mptcp: sockopt: set timestamp flags on subflow socket, not msk (bsc#1266869).\n- CVE-2026-46170: mptcp: disable add_addr retransmission when timeout is 0 (bsc#1267714).\n- CVE-2026-46189: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (bsc#1266918).\n- CVE-2026-46191: fbcon: Avoid OOB font access if console rotation fails (bsc#1267690).\n- CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks (bsc#1267656).\n- CVE-2026-46207: vsock/virtio: fix length and offset in tap skb for split packets (bsc#1267691).\n- CVE-2026-46216: drm/xe/hdcp: Add NULL check for media_gt in (bsc#1267234).\n- CVE-2026-46234: vsock: fix buffer size clamping order (bsc#1266904).\n- CVE-2026-46245: drm/amd/display: Fix dc_link NULL handling in HPD init (bsc#1267678).\n- CVE-2026-46249: octeontx2-af: Fix PF driver crash with kexec kernel booting (bsc#1267683).\n- CVE-2026-46265: RDMA/hns: Fix WQ_MEM_RECLAIM warning (bsc#1267662).\n- CVE-2026-46287: net: txgbe: fix RTNL assertion warning when remove module (bsc#1267954).\n- CVE-2026-46292: pmdomain: core: Fix detach procedure for virtual devices in genpd (bsc#1267943).\n- CVE-2026-46306: flow_dissector: do not dissect PPPoE PFC frames (bsc#1267986).\n- CVE-2026-46321: tun: free page on short-frame rejection in tun_xdp_one() (bsc#1268024).\n- CVE-2026-46324: netfilter: nf_tables: Introduce functions freeing nft_hook objects (bsc#1267995).\n- CVE-2026-46327: dm: fix unlocked test for dm_suspended_md (bsc#1268031).\n- CVE-2026-46329: erofs: handle end of filesystem properly for file-backed mounts (bsc#1268038).\n- CVE-2026-52913: batman-adv: v: stop OGMv2 on disabled interface (bsc#1268985).\n- CVE-2026-52915: netfilter: ip6t_hbh: reject oversized option lists (bsc#1269001).\n- CVE-2026-52916: batman-adv: frag: disallow unicast fragment in fragment (bsc#1269002).\n- CVE-2026-52921: netfilter: ipset: stop hash:* range iteration at end (bsc#1269024).\n- CVE-2026-52922: batman-adv: dat: handle forward allocation error (bsc#1269030).\n- CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).\n- CVE-2026-52926: batman-adv: clear current gateway during teardown (bsc#1269025).\n- CVE-2026-52927: netfilter: ebtables: fix OOB read in compat_mtw_from_user (bsc#1269027).\n- CVE-2026-52930: ipc/shm: serialize orphan cleanup with shm_nattch updates (bsc#1269003).\n- CVE-2026-52934: batman-adv: tvlv: reject oversized TVLV packets (bsc#1268994).\n- CVE-2026-52937: tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR (bsc#1268983).\n- CVE-2026-52941: net/smc: avoid NULL deref of conn-\u003elnk in smc_msg_event tracepoint (bsc#1268966).\n- CVE-2026-52942: netfilter: nf_log: validate MAC header was set before dumping it (bsc#1268967).\n- CVE-2026-52947: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (bsc#1269115).\n- CVE-2026-52953: iommu/vt-d: Fix oops due to out of scope access (bsc#1269133).\n- CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1269172).\n- CVE-2026-52958: libceph: Fix potential out-of-bounds access in osdmap_decode() (bsc#1269174).\n- CVE-2026-52967: smb/client: fix possible infinite loop and oob read in symlink_data() (bsc#1269181).\n- CVE-2026-52970: netfilter: nft_ct: fix missing expect put in obj eval (bsc#1269229).\n- CVE-2026-52974: net: tls: fix strparser anchor skb leak on offload RX setup failure (bsc#1269233).\n- CVE-2026-52981: neigh: let neigh_xmit take skb ownership (bsc#1269254).\n- CVE-2026-52984: net/sched: netem: fix queue limit check to include reordered packets (bsc#1269272).\n- CVE-2026-52986: netfilter: nf_conntrack_sip: don't use simple_strtoul (bsc#1269289).\n- CVE-2026-52988: netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (bsc#1269362).\n- CVE-2026-52995: net/rds: zero per-item info buffer before handing it to visitors (bsc#1269124).\n- CVE-2026-52998: netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (bsc#1269118).\n- CVE-2026-52999: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (bsc#1269119).\n- CVE-2026-53000: netfilter: nat: use kfree_rcu to release ops (bsc#1269117).\n- CVE-2026-53002: netfilter: conntrack: remove sprintf usage (bsc#1269112).\n- CVE-2026-53003: pppoe: drop PFC frames (bsc#1269111).\n- CVE-2026-53004: sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks (bsc#1269106).\n- CVE-2026-53005: af_unix: Drop all SCM attributes for SOCKMAP (bsc#1269107).\n- CVE-2026-53006: ipv6: fix possible UAF in icmpv6_rcv() (bsc#1269104).\n- CVE-2026-53009: ice: fix double-free of tx_buf skb (bsc#1269098).\n- CVE-2026-53011: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (bsc#1269094).\n- CVE-2026-53012: nexthop: fix IPv6 route referencing IPv4 nexthop (bsc#1269154).\n- CVE-2026-53013: macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF (bsc#1269095).\n- CVE-2026-53014: net/sched: act_mirred: fix wrong device for mac_header_xmit check in tcf_blockcast_redir\n  (bsc#1269092).\n- CVE-2026-53032: bpf: Fix NULL deref in map_kptr_match_type for scalar regs (bsc#1269138).\n- CVE-2026-53035: bpf, sockmap: Fix af_unix iter deadlock (bsc#1269190).\n- CVE-2026-53038: ima_fs: Correctly create securityfs files for unsupported hash algos (bsc#1269391).\n- CVE-2026-53062: dm cache policy smq: fix missing locks in invalidating cache blocks (bsc#1269658).\n- CVE-2026-53063: dm cache: fix write hang in passthrough mode (bsc#1269659).\n- CVE-2026-53064: dm cache: fix null-deref with concurrent writes in passthrough mode (bsc#1269132).\n- CVE-2026-53069: net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master (bsc#1269186).\n- CVE-2026-53074: bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb (bsc#1269688).\n- CVE-2026-53083: bpf: Fix RCU stall in bpf_fd_array_map_clear() (bsc#1269964).\n- CVE-2026-53085: bpf: fix mm lifecycle in open-coded task_vma iterator (bsc#1269879).\n- CVE-2026-53088: net: bcmgenet: fix off-by-one in bcmgenet_put_txcb (bsc#1269185).\n- CVE-2026-53101: wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync (bsc#1269415).\n- CVE-2026-53104: wifi: mt76: Fix memory leak destroying device (bsc#1269157).\n- CVE-2026-53106: bpf: Do not allow deleting local storage in NMI (bsc#1269990).\n- CVE-2026-53107: wifi: libertas: use USB anchors for tracking in-flight URBs (bsc#1269991).\n- CVE-2026-53121: amd-pstate: Fix memory leak in amd_pstate_epp_cpu_init() (bsc#1269198).\n- CVE-2026-53123: md: wake raid456 reshape waiters before suspend (bsc#1269643).\n- CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269773).\n- CVE-2026-53132: vsock/virtio: fix potential unbounded skb queue (bsc#1269290).\n- CVE-2026-53134: netfilter: nft_fib: fix stale stack leak via the OIFNAME register (bsc#1269819).\n- CVE-2026-53157: net: phonet: free phonet_device after RCU grace period (bsc#1269241).\n- CVE-2026-53175: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush (bsc#1269714).\n- CVE-2026-53181: vsock/vmci: fix sk_ack_backlog leak on failed handshake (bsc#1269886).\n- CVE-2026-53183: mptcp: allow subflow rcv wnd to shrink (bsc#1269376).\n- CVE-2026-53184: udp: clear skb-\u003edev before running a sockmap verdict (bsc#1269689).\n- CVE-2026-53185: zram: fix use-after-free in zram_bvec_write_partial() (bsc#1269660).\n- CVE-2026-53186: RDMA/srp: bound SRP_RSP sense copy by the received length (bsc#1269663).\n- CVE-2026-53189: mm/huge_memory: update file PMD counter before folio_put() (bsc#1269797).\n- CVE-2026-53210: tee: shm: fix shm leak in register_shm_helper() (bsc#1269727).\n- CVE-2026-53212: netfilter: nft_tunnel: fix use-after-free on object destroy (bsc#1269672).\n- CVE-2026-53214: ipv6: Fix a potential NPD in cleanup_prefix_route() (bsc#1269588).\n- CVE-2026-53218: netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (bsc#1269273).\n- CVE-2026-53221: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() (bsc#1269318).\n- CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997).\n- CVE-2026-53225: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() (bsc#1269711).\n- CVE-2026-53227: net: openvswitch: fix possible kfree_skb of ERR_PTR (bsc#1269877).\n- CVE-2026-53230: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (bsc#1269270).\n- CVE-2026-53233: netdev: fix double-free in netdev_nl_bind_rx_doit() (bsc#1269801).\n- CVE-2026-53235: net: add pskb_may_pull() to skb_gro_receive_list() (bsc#1269286).\n- CVE-2026-53236: tcp: restrict SO_ATTACH_FILTER to priv users (bsc#1269994).\n- CVE-2026-53239: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (bsc#1269677).\n- CVE-2026-53245: net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr (bsc#1269675).\n- CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1269988).\n- CVE-2026-53247: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown (bsc#1269235).\n- CVE-2026-53250: xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() (bsc#1269808).\n- CVE-2026-53252: Bluetooth: fix memory leak in error path of hci_alloc_dev() (bsc#1269307).\n- CVE-2026-53260: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req() (bsc#1269731).\n- CVE-2026-53267: netfilter: nft_ct: bail out on template ct in get eval (bsc#1269577).\n- CVE-2026-53268: netfilter: conntrack_irc: fix possible out-of-bounds read (bsc#1269257).\n- CVE-2026-53270: ipvs: clear the svc scheduler ptr early on edit (bsc#1269240).\n- CVE-2026-53273: tee: optee: prevent use-after-free when the client exits before the supplicant (bsc#1269713).\n- CVE-2026-53275: ipv6: mcast: Fix use-after-free when processing MLD queries (bsc#1269810).\n- CVE-2026-53289: ice: fix NULL pointer dereference in ice_reset_all_vfs() (bsc#1269694).\n- CVE-2026-53321: io_uring/napi: cap busy_poll_to 10 msec (bsc#1269724).\n- CVE-2026-53355: net: rds: clear i_sends on setup unwind (bsc#1270249).\n- CVE-2026-53369: udf: reject descriptors with oversized CRC length (bsc#1271818).\n- CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830).\n- CVE-2026-53388: fuse: re-lock request before replacing page cache folio (bsc#1271825).\n- CVE-2026-53391: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (bsc#1271904).\n- CVE-2026-53392: NFSv4/flexfiles: reject zero filehandle version count (bsc#1271826).\n- CVE-2026-53393: nfsd: reset write verifier on deferred writeback errors (bsc#1271858).\n- CVE-2026-53394: nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race (bsc#1271859).\n- CVE-2026-53397: nfsd: fix posix_acl leak on SETACL decode failure (bsc#1271869).\n- CVE-2026-53398: NFSD: Fix SECINFO_NO_NAME decode error cleanup (bsc#1271870).\n- CVE-2026-53399: nfsd: release layout stid on setlease failure (bsc#1271832).\n- CVE-2026-53402: fbdev: fbcon: fix out-of-bounds read in err_out of (bsc#1271908).\n- CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (bsc#1271964).\n- CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).\n- CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272282).\n- CVE-2026-63809: bpf: NUL-terminate replaced sysctl value (bsc#1272296).\n- CVE-2026-63829: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1272176).\n- CVE-2026-63831: mac802154: llsec: add skb_cow_data() before in-place crypto (bsc#1272184).\n- CVE-2026-63836: batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd (bsc#1272246).\n- CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272836).\n- CVE-2026-63919: xfrm: input: hold netns during deferred transport reinjection (bsc#1272907).\n- CVE-2026-63923: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (bsc#1273005).\n- CVE-2026-63952: memfd: deny writeable mappings when implying SEAL_WRITE (bsc#1272468).\n- CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272466).\n- CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272678).\n- CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp() (bsc#1273035).\n- CVE-2026-64025: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx (bsc#1273117).\n- CVE-2026-64061: netfs: Fix early put of sink folio in netfs_read_gaps() (bsc#1272505).\n- CVE-2026-64091: batman-adv: tt: fix TOCTOU race for reported vlans (bsc#1272514).\n- CVE-2026-64106: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (bsc#1272242).\n- CVE-2026-64157: netfs: Fix partial invalidation of streaming-write folio (bsc#1272462).\n- CVE-2026-64158: netfs: Fix write streaming disablement if fd open O_RDWR (bsc#1272524).\n- CVE-2026-64187: xfs: fail recovery on a committed log item with no regions (bsc#1272204).\n- CVE-2026-64188: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() (bsc#1272150).\n- CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272207).\n- CVE-2026-64357: xfs: fix exchmaps reservation limit check (bsc#1272612).\n- CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing (bsc#1274072).\n- CVE-2026-64561: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (bsc#1273231).\n- CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (bsc#1271526).\n\nThe following non security issues were fixed:\n\n- accel/ivpu: Fix wrong register read in LNL failure diagnostics (git-fixes).\n- accel/ivpu: Reject firmware log with size smaller than header (git-fixes).\n- ALSA: hda: codecs: hdmi: disable keep-alive before audio format change (git-fixes).\n- ALSA: hda: conexant: Remove mic bias threshold override (git-fixes).\n- ALSA: hda: cs35l41: validate and free ACPI mute object (git-fixes).\n- ALSA: hda: Fix cached processing coefficient verbs (git-fixes).\n- ALSA: lx6464es: fix period byte count for 16-bit streams (git-fixes).\n- ALSA: pcm: wake linked drain waiters on unlink (git-fixes).\n- ALSA: scarlett2: Allow selecting config_set by firmware version (stable-fixes).\n- ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417 (git-fixes).\n- ALSA: seq: close a re-opened queue timer in the destructor (git-fixes).\n- ALSA: seq: Fix division by zero in initialize_timer() (git-fixes).\n- ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (git-fixes).\n- ALSA: timer: don't re-enter an instance callback that is still running (git-fixes).\n- ALSA: timer: drain a slave's callback before its master detaches it (git-fixes).\n- ALSA: ump: fix double free of out_cvts on rawmidi error (git-fixes).\n- ALSA: usb-audio: Clamp frame size in implicit-feedback mode (git-fixes).\n- ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() (git-fixes).\n- ALSA: usb-audio: fix stack info leak in RME Digiface status (git-fixes).\n- ALSA: usb-audio: fix use-after-free in ump_to_endpoint() (git-fixes).\n- ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC (git-fixes).\n- apparmor: fix use-after-free in rawdata dedup loop (git-fixes).\n- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (git-fixes).\n- ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() (git-fixes).\n- ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI (git-fixes).\n- ASoC: cs35l56: Fix potential probe() deadlock (git-fixes).\n- ASoC: cs35l56: Use complete_all() to signal init_completion (git-fixes).\n- ASoC: cs42l43: Correct report for forced microphone jack (git-fixes).\n- ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP (git-fixes).\n- ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop (git-fixes).\n- ASoC: tas2562: fix broken entries in the volume lookup table (git-fixes).\n- ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup (git-fixes).\n- ASoC: tas2562: fix DVC coefficient write order (git-fixes).\n- ASoC: tas2781: bound firmware description string parsing (git-fixes).\n- assoc_array: trim the final shortcut word using the current chunk end (git-fixes).\n- batman-adv: bla: reacquire gw address after skb realloc (git-fixes).\n- batman-adv: dat: ensure accessible eth_hdr proto field (git-fixes).\n- batman-adv: dat: fix tie-break for candidate selection (git-fixes).\n- batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes).\n- batman-adv: fix VLAN priority offset (git-fixes).\n- batman-adv: frag: fix primary_if leak on failed linearization (git-fixes).\n- batman-adv: frag: free unfragmentable packet (git-fixes).\n- batman-adv: mcast: avoid OOB read of num_dests header (git-fixes).\n- batman-adv: tt: avoid request storms during pending request (git-fixes).\n- batman-adv: tt: prevent TVLV OOB check overflow (git-fixes).\n- bitops: use common function parameter names (git-fixes).\n- Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (stable-fixes).\n- Bluetooth: 6lowpan: Fix using chan-\u003econn as indication to no remote netdev (git-fixes).\n- Bluetooth: btintel: Validate length before parsing diagnostics TLV (git-fixes).\n- Bluetooth: btrtl: validate firmware patch bounds (git-fixes).\n- Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB (stable-fixes).\n- Bluetooth: btusb: validate Realtek vendor event length (git-fixes).\n- Bluetooth: hci_qca: Clear memdump state on invalid dump size (git-fixes).\n- Bluetooth: hci_sync: Fix advertising data UAFs (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback (git-fixes).\n- Bluetooth: hci_sync: Protect UUID list traversal (git-fixes).\n- Bluetooth: HIDP: reject frames without a transaction header (git-fixes).\n- Bluetooth: HIDP: validate numbered report payloads (git-fixes).\n- Bluetooth: ISO: clear iso_data always when detaching conn from hcon (git-fixes).\n- Bluetooth: ISO: fix CONNECTED -\u003e CLOSED transition on shutdown/release (git-fixes).\n- Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos (git-fixes).\n- Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis() (git-fixes).\n- Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (git-fixes).\n- Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (git-fixes).\n- Bluetooth: mgmt: Translate HCI reason in Device Disconnected event (git-fixes).\n- Bluetooth: RFCOMM: Fix session UAF in set_termios (git-fixes).\n- Bluetooth: SCO: give the socket its own sco_conn reference (git-fixes).\n- btrfs: do not trim a device which is not writeable (bsc#1272568).\n- bus: sunxi-rsb: Always check register address validity (git-fixes).\n- can: bcm: add missing rcu list annotations and operations (git-fixes).\n- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (git-fixes).\n- can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure (git-fixes).\n- can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured (git-fixes).\n- can: ctucanfd: add missing MODULE_DEVICE_TABLE() (git-fixes).\n- can: ctucanfd: handle bus error interrupts (git-fixes).\n- can: ctucanfd: mark error-active controller status valid (git-fixes).\n- can: ctucanfd: unmap BAR0 using base address (git-fixes).\n- can: ctucanfd: use self-test mode for PRESUME_ACK (git-fixes).\n- can: ems_usb: validate CPC message lengths (git-fixes).\n- can: esd_usb: kill anchored URBs before freeing netdevs (git-fixes).\n- can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure (git-fixes).\n- can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure (git-fixes).\n- can: isotp: check register_netdevice_notifier() error in module init (git-fixes).\n- can: isotp: use unconditional synchronize_rcu() in isotp_release() (git-fixes).\n- can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer (git-fixes).\n- can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() (git-fixes).\n- can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents (git-fixes).\n- can: peak_usb: add bounds check for USB channel index (git-fixes).\n- can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error (git-fixes).\n- can: peak_usb: validate uCAN receive record lengths (git-fixes).\n- can: softing: fw_parse(): validate firmware record spans (git-fixes).\n- cdrom: fix stack out-of-bounds read in CDROMVOLCTRL (git-fixes).\n- comedi: comedi_parport: deal with premature interrupt (git-fixes).\n- crypto/xxhash: set downstream CRYPTO_ALG_FIPS_UNAPPROVED (bsc#1262160 jsc#PED-15986).\n- crypto: introduce downstream CRYPTO_ALG_FIPS_UNAPPROVED (bsc#1262160 jsc#PED-15986).\n- crypto: qat - keep VFs enabled during reset (stable-fixes).\n- crypto: qat - notify fatal error before AER reset preparation (stable-fixes).\n- dm cache policy smq: check allocation under invalidate lock (git-fixes).\n- dm cache: fix missing return in invalidate_committed's error path (git-fixes).\n- dmaengine: idxd: fix double free of wq, engine, and group structs (git-fixes).\n- dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (git-fixes).\n- dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ (git-fixes).\n- dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA (git-fixes).\n- driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout() (git-fixes).\n- driver core: Guard deferred probe timeout extension with delayed_work_pending() (git-fixes).\n- driver core: Use mod_delayed_work to prevent lost deferred probe work (git-fixes).\n- Drivers: hv: vmbus: Set DMA coherent mask for VMBus devices (git-fixes).\n- drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference (git-fixes).\n- drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips (git-fixes).\n- drm/amd/display: set new_stream to NULL after release (git-fixes).\n- drm/amd/display: use proper context for logging (git-fixes).\n- drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) (git-fixes).\n- drm/amd/pm: fix amdgpu_pm_info power display units (git-fixes).\n- drm/amd/pm: fix smu13 power limit range calculation (git-fixes).\n- drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge (git-fixes).\n- drm/amdgpu: fix aperture mapping leak (git-fixes).\n- drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment (git-fixes).\n- drm/amdkfd: free MQD managers on DQM init failures (git-fixes).\n- drm/amdkfd: hold event_mutex while checkpointing CRIU events (git-fixes).\n- drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs (git-fixes).\n- drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() (git-fixes).\n- drm/gfx10: Program DB_RING_CONTROL (git-fixes).\n- drm/i915/bios: range check LFP Data Block panel_type2 (git-fixes).\n- drm/i915/gem: Do not leak siblings[] on proto context error (git-fixes).\n- drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU (git-fixes).\n- drm/i915/gt: use correct selftest config symbol (git-fixes).\n- drm/i915/selftests: Fix GT PM sort comparators (git-fixes).\n- drm/i915: ensure segment offset never exceeds allowed max (stable-fixes).\n- drm/i915: Return NULL on error in active_instance (git-fixes).\n- drm/imagination: acquire vm_ctx-\u003elock before mapping memory to GPU VM (git-fixes).\n- drm/imagination: Fix double call to drm_sched_entity_fini() (git-fixes).\n- drm/imagination: fix error checking of pvr_vm_context_lookup() (git-fixes).\n- drm/imagination: Fix returned size for DRM_IOCTL_PVR_DEV_QUERY (git-fixes).\n- drm/imagination: Fix user array stride in pvr_set_uobj_array() (git-fixes).\n- drm/mediatek: Check CRTC state before freeing (git-fixes).\n- drm/mediatek: ovl_adaptor: balance component registrations (git-fixes).\n- drm/panthor: Don't overrule pending immediate ticks in sched_resume_tick() (git-fixes).\n- drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced (git-fixes).\n- drm/panthor: Fix potential invalid pointer deref in group_process_tiler_oom() (git-fixes).\n- drm/panthor: Interrupt group start/resumption if group_bind_locked() fails (git-fixes).\n- drm/panthor: reject firmware sections with oversized data (git-fixes).\n- drm/panthor: return error on truncated firmware (git-fixes).\n- drm/panthor: validate firmware interface structure sizes (git-fixes).\n- drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove (git-fixes).\n- drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered (stable-fixes).\n- drm/tests: shmem: Set DMA mask to 64-bit in drm_gem_shmem (git-fixes).\n- drm/v3d: Reject invalid indirect BO handle in indirect CSD setup (git-fixes).\n- drm/vc4: hvs/v3d: Fix null dereference in unbind (git-fixes).\n- drm/vc4: Prevent shader BO mappings from becoming writable (git-fixes).\n- drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size (git-fixes).\n- drm/vc4: Zero the tile state data array before each BIN job (git-fixes).\n- drm/virtio: bound EDID block reads to the response buffer (git-fixes).\n- drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker (git-fixes).\n- drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure (git-fixes).\n- drm/vmwgfx: bound DMA command body size against suffix pointer (git-fixes).\n- drm/vmwgfx: drop dma_buf reference on foreign-fd prime import (git-fixes).\n- drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size (git-fixes).\n- drm/vmwgfx: reject DX_BIND_QUERY without a DX context (git-fixes).\n- drm/vmwgfx: use check_add_overflow for shader size+offset bound (git-fixes).\n- drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (git-fixes).\n- drm/vmwgfx: validate external BO copy bounds for both stride paths (git-fixes).\n- drm/vmwgfx: Validate vmw_surface_metadata::array_size (git-fixes).\n- drm/xe/hw_engine: Fix double-free of managed BO in error path (git-fixes).\n- drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays (git-fixes).\n- drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry() (git-fixes).\n- drm/xe/wopcm: fix WOPCM size for LNL+ (git-fixes).\n- drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds (git-fixes).\n- drm/xe: remove duplicate \u003ckunit/test-bug.h\u003e include (git-fixes).\n- erofs: set fileio bio failed in short read case (git-fixes).\n- fbcon: fix NULL pointer dereference for a console without vc_data (stable-fixes).\n- fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() (git-fixes).\n- fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() (git-fixes).\n- fbdev: efifb: fix memory leak in efifb_probe() (git-fixes).\n- fbdev: hecubafb: fix potential memory leak in hecubafb_probe() (git-fixes).\n- fbdev: i740fb: fix potential memory leak in i740fb_probe() (git-fixes).\n- fbdev: metronomefb: fix potential memory leak in metronomefb_probe() (git-fixes).\n- fbdev: nvidia: fix potential memory leak in nvidiafb_probe() (git-fixes).\n- fbdev: radeon: fix potential memory leak in radeonfb_pci_register() (git-fixes).\n- fbdev: s3fb: fix potential memory leak in s3_pci_probe() (git-fixes).\n- fbdev: sm501fb: Fix buffer errors in OF binding code (git-fixes).\n- fbdev: sm712: Fix operator precedence in big_swap macro (git-fixes).\n- fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() (git-fixes).\n- fbdev: tridentfb: fix potential memory leak in trident_pci_probe() (git-fixes).\n- fbdev: uvesafb: fix potential memory leak in uvesafb_probe() (git-fixes).\n- fbdev: vesafb: fix memory leak in vesafb_probe() (git-fixes).\n- firewire: net: Fix fragmented datagram reassembly (git-fixes).\n- firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() (git-fixes).\n- firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits (git-fixes).\n- gpio-f7188x: Add support for NCT6126D version B (git-fixes).\n- gpio: davinci: fix IRQ domain leak on devm_kzalloc failure (git-fixes).\n- gpio: eic-sprd: use raw_spinlock_t in the irq startup path (git-fixes).\n- gpio: htc-egpio: use managed gpiochip registration (git-fixes).\n- gpio: mlxbf3: fail probe if gpiochip registration fails (git-fixes).\n- gpio: mvebu: fail probe if gpiochip registration fails (git-fixes).\n- gpio: mvebu: free generic chips on unbind (git-fixes).\n- gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (git-fixes).\n- gpio: rockchip: change the GPIO version judgment logic (stable-fixes).\n- gpio: rockchip: fix generic IRQ chip leak on remove (git-fixes).\n- gpio: rockchip: teardown bugs and resource leaks (git-fixes).\n- gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe() (git-fixes).\n- gpio: tegra: do not call pinctrl for GPIO direction (git-fixes).\n- gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe (git-fixes).\n- gpios: palmas: add .get_direction() op (git-fixes).\n- HID: add haptics page defines (stable-fixes).\n- HID: hid-sjoy: race between init and usage (git-fixes).\n- HID: pidff: Add missing spaces (stable-fixes).\n- HID: pidff: Fix missing blank lines after declarations (stable-fixes).\n- HID: playstation: validate num_touch_reports in DualShock 4 reports (stable-fixes).\n- hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread (git-fixes).\n- hwmon: (adt7470) Fix cache updated before hardware write on I2C error (git-fixes).\n- hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read (git-fixes).\n- hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors (git-fixes).\n- hwmon: (adt7470) Fix PWM auto temp state array and bounds check (git-fixes).\n- hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks (git-fixes).\n- hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() (git-fixes).\n- hwmon: (adt7470) Use cached PWM frequency value (git-fixes).\n- hwmon: (asus-ec-sensors) add missed handle for ENOMEM (git-fixes).\n- hwmon: (asus-ec-sensors) fix EC read intervals (git-fixes).\n- hwmon: (asus-ec-sensors) fix looping over banks while reading from EC (git-fixes).\n- hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (lm90) Only report alarms if driver is ready (git-fixes).\n- hwmon: (ltc4282) Fix reading the minimum alarm voltage (git-fixes).\n- hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 (git-fixes).\n- hwmon: (nct6775-core) Prevent access to unsupported weight registers (git-fixes).\n- hwmon: (npcm750-pwm-fan): stop fan timer on device detach (git-fixes).\n- hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (nzxt-smart2) DMA-align output buffer (git-fixes).\n- hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (pmbus) Fix return value from pmbus_update_byte_data() (git-fixes).\n- hwmon: (pmbus/core) notify on the hwmon device, not the i2c client (git-fixes).\n- hwmon: (sht3x) Fix unaligned accesses (git-fixes).\n- hwmon: (w83627hf) remove VID sysfs files on error and remove (stable-fixes).\n- hwmon: (w83793) remove vrm sysfs file on probe failure (stable-fixes).\n- hwmon: occ: validate poll response sensor blocks (git-fixes).\n- i2c: amd-mp2: Unregister callback on adapter add failure (git-fixes).\n- i2c: imx: Cancel hrtimer before clearing slave pointer (git-fixes).\n- i2c: imx: Fix slave registration race and error handling (git-fixes).\n- i2c: iproc: reset bus after timeout if START_BUSY is stuck (git-fixes).\n- i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock (git-fixes).\n- i2c: mediatek: fix WRRD for SoCs without auto_restart option (git-fixes).\n- i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() (git-fixes).\n- i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue (git-fixes).\n- i3c: mipi-i3c-hci: Preserve RUN bit when aborting DMA ring (git-fixes).\n- ieee802154: admin-gate legacy LLSEC dump operations (git-fixes).\n- ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation (git-fixes).\n- ieee802154: ca8210: fix cas_ctl leak on spi_async failure (git-fixes).\n- ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit (git-fixes).\n- ieee802154: fix kernel-infoleak in dgram_recvmsg() (git-fixes).\n- ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() (git-fixes).\n- iio: accel: bmc150: clamp the device-reported FIFO frame count (git-fixes).\n- iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error (git-fixes).\n- iio: adc: lpc32xx: Initialize completion before requesting IRQ (git-fixes).\n- iio: adc: spear: Initialize completion before requesting IRQ (git-fixes).\n- iio: adc: ti-ads124s08: Return reset GPIO lookup errors (git-fixes).\n- iio: adc: ti-ads1119: fix PM reference leak in buffer preenable (git-fixes).\n- iio: common: st_sensors: honour channel endianness in read_axis_data (git-fixes).\n- iio: event: Fix event FIFO reset race (git-fixes).\n- iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ (git-fixes).\n- iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ (git-fixes).\n- iio: imu: inv_icm42600: fix timestamp clock period by using lower value (git-fixes).\n- iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading (git-fixes).\n- iio: imu: st_lsm6dsx: deselect shub page before reading whoami (git-fixes).\n- iio: light: al3010: fix incorrect scale for the highest gain range (git-fixes).\n- iio: light: gp2ap002: fix runtime PM leak on read error (git-fixes).\n- iio: light: tsl2591: return actual error from probe IRQ failure (git-fixes).\n- iio: magnetometer: ak8975: fix potential kernel stack memory leak (git-fixes).\n- iio: temperature: Build mlx90635 with CONFIG_MLX90635 (git-fixes).\n- Input: ads7846 - restore half-duplex support (git-fixes).\n- Input: atkbd - validate scancode in firmware keymap entries (git-fixes).\n- Input: elan_i2c - prevent division by zero and arithmetic underflow (git-fixes).\n- Input: goodix - clamp the device-reported contact count (git-fixes).\n- Input: iforce - bound the device-reported force-feedback effect index (git-fixes).\n- Input: ims-pcu - add response length checks (git-fixes).\n- Input: ims-pcu - fix DMA mapping violation in line setup (git-fixes).\n- Input: ims-pcu - fix firmware leak in async update (git-fixes).\n- Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() (git-fixes).\n- Input: ims-pcu - fix logic error in packet reset (git-fixes).\n- Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging (git-fixes).\n- Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix race condition in reset_device sysfs callback (git-fixes).\n- Input: ims-pcu - fix type confusion in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix use-after-free and double-free in disconnect (git-fixes).\n- Input: ims-pcu - only expose sysfs attributes on control interface (git-fixes).\n- Input: ims-pcu - release data interface on disconnect (git-fixes).\n- Input: ims-pcu - validate control endpoint type (git-fixes).\n- Input: maple_keyb - set driver data before registering input device (stable-fixes).\n- Input: maplecontrol - set driver data before registering input device (stable-fixes).\n- Input: maplemouse - fix NULL pointer dereference in open() (git-fixes).\n- Input: maplemouse - set driver data before registering input device (stable-fixes).\n- Input: mms114 - fix multi-touch slot corruption (git-fixes).\n- Input: mms114 - fix touch indexing for MMS134S and MMS136 (git-fixes).\n- Input: mms114 - reject an oversized device packet size (git-fixes).\n- Input: rmi4 - fix bit count in bitmap_copy() (git-fixes).\n- Input: rmi4 - fix limit in rmi_register_desc_has_subpacket() (git-fixes).\n- Input: rmi4 - fix memory leak in rmi_set_attn_data() (git-fixes).\n- Input: rmi4 - fix num_subpackets overflow in register descriptor (git-fixes).\n- Input: rmi4 - fix register descriptor address calculation (git-fixes).\n- Input: rmi4 - fix type overflow in register counts (git-fixes).\n- Input: rmi4 - initialize attn_fifo properly (stable-fixes).\n- Input: rmi4 - iterative IRQ handler (git-fixes).\n- Input: rmi4 - refactor F12 probe function (stable-fixes).\n- Input: rmi4 - refactor function allocation and registration (stable-fixes).\n- Input: rmi4 - refactor register descriptor parsing (git-fixes).\n- Input: rmi4 - tolerate short register descriptor structure (git-fixes).\n- Input: rmi4 - use local presence map in rmi_read_register_desc() (stable-fixes).\n- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (git-fixes).\n- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (git-fixes).\n- Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure (git-fixes).\n- Input: touchwin - reset the packet index on every complete packet (git-fixes).\n- intel_th: core: fix null pointer dereference in intel_th_irq (bsc#1248480).\n- intel_th: fix MSC output device reference leak (git-fixes).\n- io_uring/kbuf: don't truncate end buffer for bundles (bsc#1271290).\n- io_uring/kbuf: fix missing BUF_MORE for incremental buffers at EOF (bsc#1261250).\n- io_uring/kbuf: flag partial buffer mappings (bsc#1271290).\n- io_uring/kbuf: propagate BUF_MORE through early buffer commit path (bsc#1261250).\n- io_uring/net: always use current transfer count for buffer put (git-fixes).\n- io_uring/net: improve recv bundles (bsc#1271290).\n- io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries (bsc#1271290).\n- io_uring/net: only consider msg_inq if larger than 1 (git-fixes).\n- io_uring/net: only retry recv bundle for a full transfer (bsc#1271290).\n- io_uring/timeout: add helper for parsing user time (bsc#1271291).\n- io_uring/timeout: honour caller's time namespace for IORING_TIMEOUT_ABS (bsc#1271291).\n- io_uring/timeout: migrate reqs from ts64 to ktime (bsc#1271291).\n- io_uring/wait: honour caller's time namespace for IORING_ENTER_ABS_TIMER (bsc#1271291).\n- ixgbe: reduce number of reads when getting OROM data (bsc#1269637).\n- KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT (git-fixes).\n- KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) (git-fixes).\n- KVM: nSVM: Clear tracking of L1-\u003eL2 NMI and soft IRQ on nested #VMEXIT (git-fixes).\n- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (git-fixes).\n- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (git-fixes).\n- KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs (git-fixes).\n- KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug (git-fixes).\n- KVM: TDX: Reject concurrent change to CPUID entry count (git-fixes).\n- KVM: x86/mmu: Check write tracking in all address spaces (git-fixes).\n- KVM: x86/mmu: Fix use-after-free on vendor module reload (git-fixes).\n- KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots (git-fixes).\n- KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs (git-fixes).\n- KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN (git-fixes).\n- leds: uleds: Fix potential buffer overread (git-fixes).\n- mac802154: hold an interface reference across the scan worker (git-fixes).\n- mac802154: llsec: reject frames shorter than the authentication tag (git-fixes).\n- mac802154: Prevent overwrite return code in mac802154_perform_association() (git-fixes).\n- mac802154: remove interfaces with RCU list deletion (git-fixes).\n- mailbox: zynqmp: setup IPI for each valid child node (bsc#1271395).\n- mctp: Fix incorrect tx flow invalidation condition in mctp-i2c (bsc#1266694).\n- media: aspeed: fix missing of_reserved_mem_device_release() on probe failure (git-fixes).\n- media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() (git-fixes).\n- media: atomisp: gc2235: fix UAF and memory leak (git-fixes).\n- media: cec: seco: unregister adapter on IR probe failure (git-fixes).\n- media: cedrus: Fix failure to clean up hardware on probe failure (git-fixes).\n- media: cedrus: Fix missing cleanup in error path (git-fixes).\n- media: cedrus: skip invalid H.264 reference list entries (git-fixes).\n- media: marvell-cam: fix missing pci_disable_device() on remove (git-fixes).\n- media: mtk-jpeg: cancel workqueue on release for supported platforms only (git-fixes).\n- media: nxp: imx8-isi: Fix use-after-free on remove (git-fixes).\n- media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code (stable-fixes).\n- media: pci: dm1105: Free allocated workqueue (git-fixes).\n- media: qcom: camss: vfe: fix PIX subdev naming on VFE lite (git-fixes).\n- media: qcom: venus: drop extra padding in NV12 raw size calculation (git-fixes).\n- media: qcom: venus: relax encoder frame/blur dimension steps on v4 (git-fixes).\n- media: qcom: venus: relax encoder frame/blur step size on v6 (git-fixes).\n- media: rockchip: rga: fix too small buffer size (git-fixes).\n- media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe (git-fixes).\n- media: ti: vpe: unwind v4l2 device registration on probe error (git-fixes).\n- media: uvcvideo: Avoid partial metadata buffers (git-fixes).\n- media: uvcvideo: Do not add clock samples with small sof delta (git-fixes).\n- media: uvcvideo: Fix buffer sequence in frame gaps (git-fixes).\n- media: uvcvideo: Fix dev_sof filtering in hw timestamp (git-fixes).\n- media: uvcvideo: Fix sequence number when no EOF (git-fixes).\n- media: uvcvideo: Relax the constrains for interpolating the hw clock (git-fixes).\n- media: uvcvideo: Use hw timestaming if the clock buffer is full (git-fixes).\n- media: v4l2-common: Add YUV24 format info (git-fixes).\n- media: v4l2-ctrls: validate HEVC active reference counts (git-fixes).\n- media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si (git-fixes).\n- media: vidtv: fix reference leak on failed device registration (git-fixes).\n- media: vimc: fix reference leak on failed device registration (git-fixes).\n- media: vpif_capture: fix OF node reference imbalance (git-fixes).\n- mei: bus: access mei_device under device_lock on cleanup (git-fixes).\n- memory: tegra: Wire up system sleep PM ops (git-fixes).\n- memstick: ms_block: reject a card that reports too many blocks (git-fixes).\n- mfd: cros_ec: Delay dev_set_drvdata() until probe success (git-fixes).\n- mfd: cs42l43: Sanity check firmware size (git-fixes).\n- mfd: rsmu: Fix page register setup (git-fixes).\n- mfd: sm501: Fix reference leak on failed device registration (git-fixes).\n- mfd: tps6586x: Fix OF node refcount (git-fixes).\n- misc: nsm: only unlock nsm_dev on post-lock error paths (git-fixes).\n- misc: nsm: pin the module while the device is open (git-fixes).\n- mkspec-dtb: Skip missing DTBs.\n- mm: zero range of eof folio exposed by inode size extension (bsc#1272920).\n- mmc: block: fix RPMB device unregister ordering (git-fixes).\n- mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe() method (git-fixes).\n- mmc: vub300: defer reset until cmd_mutex is unlocked (git-fixes).\n- mshv: fix hv_input_get_system_property struct (git-fixes).\n- mtd: mchp23k256: use SPI match data for chip caps (git-fixes).\n- mtd: onenand: samsung: report DMA completion timeouts (git-fixes).\n- mtd: rawnand: fsl_ifc: return errors for failed page reads (git-fixes).\n- mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout (git-fixes).\n- mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout (git-fixes).\n- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (bsc#1271866).\n- net/x25: fix use-after-free in x25_kill_by_neigh() (git-fixes).\n- net: mana: Add Interrupt Moderation support (bsc#1271368).\n- net: mana: Return error code from mana_create_rxq() (git-fixes).\n- net: mctp i2c: Copy headers if cloned (bsc#1266694).\n- net: mctp-i2c: fix duplicate reception of old data (bsc#1266694).\n- net: thunderbolt: Fix frags overflow by bounding frame_count (git-fixes).\n- net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() (git-fixes).\n- net: usb: lan78xx: move functions to avoid forward definitions (stable-fixes).\n- net: wwan: t7xx: check skb_clone in control TX (git-fixes).\n- net: wwan: t7xx: destroy DMA pool on CLDMA late init failure (git-fixes).\n- netfs: Defer the emission of trace_netfs_folio() (git-fixes).\n- of: cpu: add check in __of_find_n_match_cpu_property() (git-fixes).\n- phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access (git-fixes).\n- phy: phy-can-transceiver: Check driver match and driver data against NULL (git-fixes).\n- phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask (git-fixes).\n- phy: zynqmp: fix runtime PM leak on probe allocation failure (git-fixes).\n- phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB (git-fixes).\n- phy: zynqmp: use read-modify-write for SERDES scrambler bypass (git-fixes).\n- pinctrl-amd: Don't clear S4 wake bits at probe (git-fixes).\n- pinctrl: bm1880: add missing select GENERIC_PINCONF (git-fixes).\n- pinctrl: cs42l43: Fix polarity on debounce (git-fixes).\n- pinctrl: devicetree: don't free uninitialized dev_name on error path (git-fixes).\n- pinctrl: equilibrium: fix warning trace on load (git-fixes).\n- pinctrl: equilibrium: rename irq_chip function callbacks (stable-fixes).\n- pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: meson: restore non-sleeping GPIO access (git-fixes).\n- pinctrl: nuvoton: ma35d1: fix MFP register offset and pin table (git-fixes).\n- pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 (git-fixes).\n- pinctrl: qcom: Unconditionally mark gpio as wakeup enable (git-fixes).\n- pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path (git-fixes).\n- pkspec-dtb: Fix dtb-al rename.\n- platform/x86/amd/pmc: Add delay_suspend module parameter (stable-fixes).\n- platform/x86/amd/pmc: Avoid logging \"(null)\" for DMI values (git-fixes).\n- platform/x86/amd/pmc: Check for intermediate wakeup in function (stable-fixes).\n- platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops (stable-fixes).\n- platform/x86/amd/pmc: Don't log during intermediate wakeups (stable-fixes).\n- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (git-fixes).\n- posix-cpu-timers: Cleanup the firing logic (bsc#1271912).\n- posix-cpu-timers: Correctly update timer status in posix_cpu_timer_del() (bsc#1271912).\n- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (bsc#1271912).\n- posix-timers: Add proper state tracking (bsc#1271912).\n- posix-timers: Avoid direct access to hrtimer clockbase (bsc#1271912).\n- posix-timers: Expand timer_arm() callbacks with a boolean return value (bsc#1271912).\n- power: sequencing: fix ABBA deadlock in pwrseq_device_unregister() (git-fixes).\n- power: supply: bq25890: fix the -10 C NTC lookup entry (git-fixes).\n- power: supply: max17040: handle missing status supplier (git-fixes).\n- RDMA/mana_ib: initialize err for empty send WR lists (git-fixes).\n- regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK (git-fixes).\n- regulator: ltc3676: Fix incorrect IRQSTAT bit offsets (git-fixes).\n- regulator: mt6358: use regmap helper to read fixed LDO calibration (git-fixes).\n- remoteproc: qcom: Fix leak when custom dump_segments addition fails (git-fixes).\n- reset: sunxi: fix memory region leak on ioremap failure (git-fixes).\n- Revert \"Input: rmi4 - fix register descriptor address calculation\" (stable-fixes).\n- sctp: validate embedded address parameter length (git-fixes).\n- security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() (git-fixes).\n- selftests: Disable dad for ipv6 in fcnal-test.sh (bsc#1272871).\n- selftests: Replace sleep with slowwait (bsc#1272871).\n- serial: 8250_mid: Disable DMA for selected platforms (git-fixes).\n- serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms (git-fixes).\n- serial: 8250_omap: clear rx_running on zero-length DMA completes (git-fixes).\n- serial: msm: Disable DMA for kernel console UART (git-fixes).\n- serial: sc16is7xx: implement gpio get_direction() callback (git-fixes).\n- soc: fsl: qe: panic on ioremap() failure in qe_reset() (git-fixes).\n- soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy (git-fixes).\n- soc: xilinx: Shutdown and free rx mailbox channel (git-fixes).\n- spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure (git-fixes).\n- spi: sh-msiof: abort transfers when reset times out (git-fixes).\n- staging: media: atomisp: fix loop shadowing in ia_css_stream_destroy() (git-fixes).\n- staging: media: atomisp: reduce load_primary_binaries() stack usage (git-fixes).\n- staging: rtl8723bs: core: move constants to right side in comparison (stable-fixes).\n- staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() (git-fixes).\n- staging: rtl8723bs: fix inverted HT40 secondary channel offset (git-fixes).\n- staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() (git-fixes).\n- staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB write in HT_caps_handler() (git-fixes).\n- staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() (git-fixes).\n- thermal: core: Free thermal zone ID later during removal (git-fixes).\n- time: Switch to hrtimer_setup() (bsc#1271912).\n- tpm: Make the TPM character devices non-seekable (git-fixes).\n- uio_hv_generic: Bind to FCopy device by default (git-fixes).\n- usb: cdc_acm: Add quirk for Uniden BC125AT scanner (stable-fixes).\n- usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() (git-fixes).\n- USB: chaoskey: Fix slab-use-after-free in chaoskey_release() (git-fixes).\n- usb: chipidea: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub (stable-fixes).\n- usb: core: port: Deattach Type-C connector on component unbind (git-fixes).\n- usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() (git-fixes).\n- usb: dwc3: run gadget disconnect from sleepable suspend context (git-fixes).\n- usb: free iso schedules on failed submit (git-fixes).\n- usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler (git-fixes).\n- usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback (git-fixes).\n- usb: gadget: f_fs: Fix DMA fence leak (git-fixes).\n- usb: gadget: f_midi: cancel pending IN work before freeing the midi object (git-fixes).\n- usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() (git-fixes).\n- usb: gadget: f_printer: take kref only for successful open (git-fixes).\n- USB: gadget: fsl-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: function: rndis: add length check for header (stable-fixes).\n- usb: gadget: function: rndis: add length check to response query (stable-fixes).\n- usb: gadget: printer: fix infinite loop in printer_read() (git-fixes).\n- USB: gadget: snps-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown (git-fixes).\n- usb: gadget: udc: Fix use-after-free in gadget_match_driver (stable-fixes).\n- usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer (git-fixes).\n- USB: idmouse: fix use-after-free on disconnect race (git-fixes).\n- USB: iowarrior: fix use-after-free on disconnect (git-fixes).\n- USB: iowarrior: fix use-after-free on disconnect race (git-fixes).\n- usb: iowarrior: remove inherent race with minor number (stable-fixes).\n- USB: ldusb: fix use-after-free on disconnect race (git-fixes).\n- USB: legousbtower: fix use-after-free on disconnect race (git-fixes).\n- USB: misc: uss720: unregister parport on probe failure (git-fixes).\n- usb: mtu3: unmap request DMA on queue failure (git-fixes).\n- USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD (stable-fixes).\n- USB: serial: digi_acceleport: fix broken rx after throttle (git-fixes).\n- USB: serial: digi_acceleport: fix hard lockup on disconnect (git-fixes).\n- USB: serial: digi_acceleport: fix write buffer corruption (git-fixes).\n- USB: serial: io_edgeport: cap received transmit credits (git-fixes).\n- USB: serial: io_ti: reject oversized boot-mode firmware (git-fixes).\n- USB: serial: keyspan_pda: fix data loss on receive throttling (git-fixes).\n- USB: serial: keyspan_pda: fix information leak (git-fixes).\n- USB: serial: mxuport: validate firmware header size (git-fixes).\n- USB: serial: option: add MeiG SRM813Q (stable-fixes).\n- USB: serial: option: add Telit Cinterion FE990D50 compositions (stable-fixes).\n- usb: sl811-hcd: disable controller wakeup on remove (git-fixes).\n- USB: storage: include US_FL_NO_SAME in quirks mask (git-fixes).\n- usb: typec: anx7411: use devm_pm_runtime_enable() (git-fixes).\n- usb: typec: class: drop PD lookup reference (git-fixes).\n- usb: typec: tcpm: Fix VDM type for Enter Mode commands (git-fixes).\n- usb: typec: tcpm: Validate SVID index in svdm_consume_modes() (git-fixes).\n- usb: typec: ucsi: cancel pending work on system suspend (git-fixes).\n- usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove (git-fixes).\n- usb: typec: ucsi: Detect and skip duplicate altmodes from buggy firmware (git-fixes).\n- usb: typec: ucsi: Invert DisplayPort role assignment (git-fixes).\n- usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode (git-fixes).\n- USB: ulpi: fix memory leak on registration failure (git-fixes).\n- USB: usb-storage: ene_ub6250: restore media-ready check (git-fixes).\n- usb: xhci: Fix sleep in atomic context in xhci_free_streams() (git-fixes).\n- usbip: tools: support SuperSpeedPlus devices (git-fixes).\n- usbip: vudc: fix NULL deref in vep_dequeue() (git-fixes).\n- wan: wanxl: Only reset hardware after BAR mapping (git-fixes).\n- watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() (git-fixes).\n- wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() (git-fixes).\n- wifi: ath6kl: fix OOB access from firmware ADDBA window size (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware IE lengths in connect event (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler (git-fixes).\n- wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (git-fixes).\n- wifi: ath10k: fix skb leak on incomplete msdu during rx pop (git-fixes).\n- wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin (git-fixes).\n- wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() (git-fixes).\n- wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: brcmfmac: fix 802.1X-SHA256 call trace warning (git-fixes).\n- wifi: brcmfmac: make release_scratchbuffers idempotent (git-fixes).\n- wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read (git-fixes).\n- wifi: carl9170: fix buffer overflow in rx_stream failover path (git-fixes).\n- wifi: carl9170: fix OOB read from off-by-two in TX status handler (git-fixes).\n- wifi: iwlwifi: mvm: fix read in wake packet notification handler (git-fixes).\n- wifi: iwlwifi: mvm: validate SAR GEO response payload size (git-fixes).\n- wifi: mac80211: fix memory leak in ieee80211_register_hw() (git-fixes).\n- wifi: mac80211: free ack status frame on TX header build failure (git-fixes).\n- wifi: mac80211: recalculate TIM when a station enters power save (git-fixes).\n- wifi: mac80211: tear down new links on vif update error path (git-fixes).\n- wifi: mac80211: validate individual TWT params before driver setup (git-fixes).\n- wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() (git-fixes).\n- wifi: mt76: Disable napi when removing device (git-fixes).\n- wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7915: guard HE capability lookups (git-fixes).\n- wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7925: fix crash in reset link replay (git-fixes).\n- wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv() (git-fixes).\n- wifi: mt76: mt7925: guard link STA in decap offload (git-fixes).\n- wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() (git-fixes).\n- wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() (git-fixes).\n- wifi: mwifiex: bound uAP association event IEs to the event buffer (git-fixes).\n- wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper (git-fixes).\n- wifi: mwifiex: fix permanently busy scans after multiple roam iterations (git-fixes).\n- wifi: mwifiex: fix roaming to different channel in host_mlme mode (git-fixes).\n- wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (git-fixes).\n- wifi: rt2x00: avoid full teardown before work setup in probe (git-fixes).\n- wifi: wilc1000: validate assoc response length before subtracting header (git-fixes).\n- xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit (bsc#1264267).\n- xfs: only assert new size for datafork during truncate extents (bsc#1264084).\n- xfs: rearrange code in xfs_inode_item_precommit (bsc#1237449).\n- xfs: rework datasync tracking and execution (bsc#1237449).\n- xhci: dbgtty: fix device unregister (git-fixes).\n- xhci: dbgtty: fix device unregister: fixup (git-fixes).\n","status":"published","published":"2026-08-11T21:26:34Z","modified":"2026-08-27T18:23:10.279362294Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23237-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).\n- CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).\n- CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).\n- CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).\n- CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).\n- CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).\n- CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).\n- CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).\n- CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).\n- CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).\n- CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).\n- CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).\n- CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).\n- CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).\n- CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).\n- CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).\n- CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).\n- CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).\n- CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).\n- CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).\n- CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).\n- CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).\n- CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).\n- CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).\n- CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).\n- CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).\n- CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).\n- CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).\n- CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).\n- CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).\n- CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).\n- CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).\n- CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).\n- CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).\n- CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).\n- CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).\n- CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).\n- CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).\n- CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).\n- CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).\n- CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).\n- CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).\n- CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).\n- CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).\n- CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).\n- CVE-2026-46033: crypto: authencesn - reject short ahash digests during instance creation (bsc#1266692).\n- CVE-2026-46034: vfio/cdx: Fix NULL pointer dereference in interrupt trigger path (bsc#1266757).\n- CVE-2026-46036: vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex (bsc#1267470).\n- CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).\n- CVE-2026-46040: inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (bsc#1267472).\n- CVE-2026-46064: ibmasm: fix heap over-read in ibmasm_send_i2o_message() (bsc#1267497).\n- CVE-2026-46068: crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx (bsc#1267592).\n- CVE-2026-46086: net: bridge: use a stable FDB dst snapshot in RCU readers (bsc#1267524).\n- CVE-2026-46089: zram: do not forget to endio for partial discard requests (bsc#1267445).\n- CVE-2026-46102: net: strparser: fix skb_head leak in strp_abort_strp() (bsc#1267502).\n- CVE-2026-46121: mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock (bsc#1266932).\n- CVE-2026-46127: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() (bsc#1267236).\n- CVE-2026-46130: dm-verity-fec: fix reading parity bytes split across blocks (take 3) (bsc#1267629).\n- CVE-2026-46132: net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo (bsc#1267616).\n- CVE-2026-46137: mptcp: pm: ADD_ADDR rtx: fix potential data-race (bsc#1267570).\n- CVE-2026-46147: KVM: arm64: Factor out pKVM hyp vcpu creation to separate function (bsc#1267689).\n- CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).\n- CVE-2026-46158: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (bsc#1266880).\n- CVE-2026-46168: mptcp: sockopt: set timestamp flags on subflow socket, not msk (bsc#1266869).\n- CVE-2026-46170: mptcp: disable add_addr retransmission when timeout is 0 (bsc#1267714).\n- CVE-2026-46189: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (bsc#1266918).\n- CVE-2026-46191: fbcon: Avoid OOB font access if console rotation fails (bsc#1267690).\n- CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks (bsc#1267656).\n- CVE-2026-46207: vsock/virtio: fix length and offset in tap skb for split packets (bsc#1267691).\n- CVE-2026-46216: drm/xe/hdcp: Add NULL check for media_gt in (bsc#1267234).\n- CVE-2026-46234: vsock: fix buffer size clamping order (bsc#1266904).\n- CVE-2026-46245: drm/amd/display: Fix dc_link NULL handling in HPD init (bsc#1267678).\n- CVE-2026-46249: octeontx2-af: Fix PF driver crash with kexec kernel booting (bsc#1267683).\n- CVE-2026-46265: RDMA/hns: Fix WQ_MEM_RECLAIM warning (bsc#1267662).\n- CVE-2026-46287: net: txgbe: fix RTNL assertion warning when remove module (bsc#1267954).\n- CVE-2026-46292: pmdomain: core: Fix detach procedure for virtual devices in genpd (bsc#1267943).\n- CVE-2026-46306: flow_dissector: do not dissect PPPoE PFC frames (bsc#1267986).\n- CVE-2026-46321: tun: free page on short-frame rejection in tun_xdp_one() (bsc#1268024).\n- CVE-2026-46324: netfilter: nf_tables: Introduce functions freeing nft_hook objects (bsc#1267995).\n- CVE-2026-46327: dm: fix unlocked test for dm_suspended_md (bsc#1268031).\n- CVE-2026-46329: erofs: handle end of filesystem properly for file-backed mounts (bsc#1268038).\n- CVE-2026-52913: batman-adv: v: stop OGMv2 on disabled interface (bsc#1268985).\n- CVE-2026-52915: netfilter: ip6t_hbh: reject oversized option lists (bsc#1269001).\n- CVE-2026-52916: batman-adv: frag: disallow unicast fragment in fragment (bsc#1269002).\n- CVE-2026-52921: netfilter: ipset: stop hash:* range iteration at end (bsc#1269024).\n- CVE-2026-52922: batman-adv: dat: handle forward allocation error (bsc#1269030).\n- CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).\n- CVE-2026-52926: batman-adv: clear current gateway during teardown (bsc#1269025).\n- CVE-2026-52927: netfilter: ebtables: fix OOB read in compat_mtw_from_user (bsc#1269027).\n- CVE-2026-52930: ipc/shm: serialize orphan cleanup with shm_nattch updates (bsc#1269003).\n- CVE-2026-52934: batman-adv: tvlv: reject oversized TVLV packets (bsc#1268994).\n- CVE-2026-52937: tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR (bsc#1268983).\n- CVE-2026-52941: net/smc: avoid NULL deref of conn-\u003elnk in smc_msg_event tracepoint (bsc#1268966).\n- CVE-2026-52942: netfilter: nf_log: validate MAC header was set before dumping it (bsc#1268967).\n- CVE-2026-52947: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (bsc#1269115).\n- CVE-2026-52953: iommu/vt-d: Fix oops due to out of scope access (bsc#1269133).\n- CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1269172).\n- CVE-2026-52958: libceph: Fix potential out-of-bounds access in osdmap_decode() (bsc#1269174).\n- CVE-2026-52967: smb/client: fix possible infinite loop and oob read in symlink_data() (bsc#1269181).\n- CVE-2026-52970: netfilter: nft_ct: fix missing expect put in obj eval (bsc#1269229).\n- CVE-2026-52974: net: tls: fix strparser anchor skb leak on offload RX setup failure (bsc#1269233).\n- CVE-2026-52981: neigh: let neigh_xmit take skb ownership (bsc#1269254).\n- CVE-2026-52984: net/sched: netem: fix queue limit check to include reordered packets (bsc#1269272).\n- CVE-2026-52986: netfilter: nf_conntrack_sip: don't use simple_strtoul (bsc#1269289).\n- CVE-2026-52988: netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (bsc#1269362).\n- CVE-2026-52995: net/rds: zero per-item info buffer before handing it to visitors (bsc#1269124).\n- CVE-2026-52998: netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (bsc#1269118).\n- CVE-2026-52999: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (bsc#1269119).\n- CVE-2026-53000: netfilter: nat: use kfree_rcu to release ops (bsc#1269117).\n- CVE-2026-53002: netfilter: conntrack: remove sprintf usage (bsc#1269112).\n- CVE-2026-53003: pppoe: drop PFC frames (bsc#1269111).\n- CVE-2026-53004: sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks (bsc#1269106).\n- CVE-2026-53005: af_unix: Drop all SCM attributes for SOCKMAP (bsc#1269107).\n- CVE-2026-53006: ipv6: fix possible UAF in icmpv6_rcv() (bsc#1269104).\n- CVE-2026-53009: ice: fix double-free of tx_buf skb (bsc#1269098).\n- CVE-2026-53011: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (bsc#1269094).\n- CVE-2026-53012: nexthop: fix IPv6 route referencing IPv4 nexthop (bsc#1269154).\n- CVE-2026-53013: macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF (bsc#1269095).\n- CVE-2026-53014: net/sched: act_mirred: fix wrong device for mac_header_xmit check in tcf_blockcast_redir\n  (bsc#1269092).\n- CVE-2026-53032: bpf: Fix NULL deref in map_kptr_match_type for scalar regs (bsc#1269138).\n- CVE-2026-53035: bpf, sockmap: Fix af_unix iter deadlock (bsc#1269190).\n- CVE-2026-53038: ima_fs: Correctly create securityfs files for unsupported hash algos (bsc#1269391).\n- CVE-2026-53062: dm cache policy smq: fix missing locks in invalidating cache blocks (bsc#1269658).\n- CVE-2026-53063: dm cache: fix write hang in passthrough mode (bsc#1269659).\n- CVE-2026-53064: dm cache: fix null-deref with concurrent writes in passthrough mode (bsc#1269132).\n- CVE-2026-53069: net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master (bsc#1269186).\n- CVE-2026-53074: bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb (bsc#1269688).\n- CVE-2026-53083: bpf: Fix RCU stall in bpf_fd_array_map_clear() (bsc#1269964).\n- CVE-2026-53085: bpf: fix mm lifecycle in open-coded task_vma iterator (bsc#1269879).\n- CVE-2026-53088: net: bcmgenet: fix off-by-one in bcmgenet_put_txcb (bsc#1269185).\n- CVE-2026-53101: wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync (bsc#1269415).\n- CVE-2026-53104: wifi: mt76: Fix memory leak destroying device (bsc#1269157).\n- CVE-2026-53106: bpf: Do not allow deleting local storage in NMI (bsc#1269990).\n- CVE-2026-53107: wifi: libertas: use USB anchors for tracking in-flight URBs (bsc#1269991).\n- CVE-2026-53121: amd-pstate: Fix memory leak in amd_pstate_epp_cpu_init() (bsc#1269198).\n- CVE-2026-53123: md: wake raid456 reshape waiters before suspend (bsc#1269643).\n- CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269773).\n- CVE-2026-53132: vsock/virtio: fix potential unbounded skb queue (bsc#1269290).\n- CVE-2026-53134: netfilter: nft_fib: fix stale stack leak via the OIFNAME register (bsc#1269819).\n- CVE-2026-53157: net: phonet: free phonet_device after RCU grace period (bsc#1269241).\n- CVE-2026-53175: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush (bsc#1269714).\n- CVE-2026-53181: vsock/vmci: fix sk_ack_backlog leak on failed handshake (bsc#1269886).\n- CVE-2026-53183: mptcp: allow subflow rcv wnd to shrink (bsc#1269376).\n- CVE-2026-53184: udp: clear skb-\u003edev before running a sockmap verdict (bsc#1269689).\n- CVE-2026-53185: zram: fix use-after-free in zram_bvec_write_partial() (bsc#1269660).\n- CVE-2026-53186: RDMA/srp: bound SRP_RSP sense copy by the received length (bsc#1269663).\n- CVE-2026-53189: mm/huge_memory: update file PMD counter before folio_put() (bsc#1269797).\n- CVE-2026-53210: tee: shm: fix shm leak in register_shm_helper() (bsc#1269727).\n- CVE-2026-53212: netfilter: nft_tunnel: fix use-after-free on object destroy (bsc#1269672).\n- CVE-2026-53214: ipv6: Fix a potential NPD in cleanup_prefix_route() (bsc#1269588).\n- CVE-2026-53218: netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (bsc#1269273).\n- CVE-2026-53221: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() (bsc#1269318).\n- CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997).\n- CVE-2026-53225: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() (bsc#1269711).\n- CVE-2026-53227: net: openvswitch: fix possible kfree_skb of ERR_PTR (bsc#1269877).\n- CVE-2026-53230: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (bsc#1269270).\n- CVE-2026-53233: netdev: fix double-free in netdev_nl_bind_rx_doit() (bsc#1269801).\n- CVE-2026-53235: net: add pskb_may_pull() to skb_gro_receive_list() (bsc#1269286).\n- CVE-2026-53236: tcp: restrict SO_ATTACH_FILTER to priv users (bsc#1269994).\n- CVE-2026-53239: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (bsc#1269677).\n- CVE-2026-53245: net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr (bsc#1269675).\n- CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1269988).\n- CVE-2026-53247: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown (bsc#1269235).\n- CVE-2026-53250: xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() (bsc#1269808).\n- CVE-2026-53252: Bluetooth: fix memory leak in error path of hci_alloc_dev() (bsc#1269307).\n- CVE-2026-53260: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req() (bsc#1269731).\n- CVE-2026-53267: netfilter: nft_ct: bail out on template ct in get eval (bsc#1269577).\n- CVE-2026-53268: netfilter: conntrack_irc: fix possible out-of-bounds read (bsc#1269257).\n- CVE-2026-53270: ipvs: clear the svc scheduler ptr early on edit (bsc#1269240).\n- CVE-2026-53273: tee: optee: prevent use-after-free when the client exits before the supplicant (bsc#1269713).\n- CVE-2026-53275: ipv6: mcast: Fix use-after-free when processing MLD queries (bsc#1269810).\n- CVE-2026-53289: ice: fix NULL pointer dereference in ice_reset_all_vfs() (bsc#1269694).\n- CVE-2026-53321: io_uring/napi: cap busy_poll_to 10 msec (bsc#1269724).\n- CVE-2026-53355: net: rds: clear i_sends on setup unwind (bsc#1270249).\n- CVE-2026-53369: udf: reject descriptors with oversized CRC length (bsc#1271818).\n- CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830).\n- CVE-2026-53388: fuse: re-lock request before replacing page cache folio (bsc#1271825).\n- CVE-2026-53391: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (bsc#1271904).\n- CVE-2026-53392: NFSv4/flexfiles: reject zero filehandle version count (bsc#1271826).\n- CVE-2026-53393: nfsd: reset write verifier on deferred writeback errors (bsc#1271858).\n- CVE-2026-53394: nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race (bsc#1271859).\n- CVE-2026-53397: nfsd: fix posix_acl leak on SETACL decode failure (bsc#1271869).\n- CVE-2026-53398: NFSD: Fix SECINFO_NO_NAME decode error cleanup (bsc#1271870).\n- CVE-2026-53399: nfsd: release layout stid on setlease failure (bsc#1271832).\n- CVE-2026-53402: fbdev: fbcon: fix out-of-bounds read in err_out of (bsc#1271908).\n- CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (bsc#1271964).\n- CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).\n- CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272282).\n- CVE-2026-63809: bpf: NUL-terminate replaced sysctl value (bsc#1272296).\n- CVE-2026-63829: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1272176).\n- CVE-2026-63831: mac802154: llsec: add skb_cow_data() before in-place crypto (bsc#1272184).\n- CVE-2026-63836: batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd (bsc#1272246).\n- CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272836).\n- CVE-2026-63919: xfrm: input: hold netns during deferred transport reinjection (bsc#1272907).\n- CVE-2026-63923: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (bsc#1273005).\n- CVE-2026-63952: memfd: deny writeable mappings when implying SEAL_WRITE (bsc#1272468).\n- CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272466).\n- CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272678).\n- CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp() (bsc#1273035).\n- CVE-2026-64025: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx (bsc#1273117).\n- CVE-2026-64061: netfs: Fix early put of sink folio in netfs_read_gaps() (bsc#1272505).\n- CVE-2026-64091: batman-adv: tt: fix TOCTOU race for reported vlans (bsc#1272514).\n- CVE-2026-64106: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (bsc#1272242).\n- CVE-2026-64157: netfs: Fix partial invalidation of streaming-write folio (bsc#1272462).\n- CVE-2026-64158: netfs: Fix write streaming disablement if fd open O_RDWR (bsc#1272524).\n- CVE-2026-64187: xfs: fail recovery on a committed log item with no regions (bsc#1272204).\n- CVE-2026-64188: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() (bsc#1272150).\n- CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272207).\n- CVE-2026-64357: xfs: fix exchmaps reservation limit check (bsc#1272612).\n- CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing (bsc#1274072).\n- CVE-2026-64561: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (bsc#1273231).\n- CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (bsc#1271526).\n\nThe following non security issues were fixed:\n\n- accel/ivpu: Fix wrong register read in LNL failure diagnostics (git-fixes).\n- accel/ivpu: Reject firmware log with size smaller than header (git-fixes).\n- ALSA: hda: codecs: hdmi: disable keep-alive before audio format change (git-fixes).\n- ALSA: hda: conexant: Remove mic bias threshold override (git-fixes).\n- ALSA: hda: cs35l41: validate and free ACPI mute object (git-fixes).\n- ALSA: hda: Fix cached processing coefficient verbs (git-fixes).\n- ALSA: lx6464es: fix period byte count for 16-bit streams (git-fixes).\n- ALSA: pcm: wake linked drain waiters on unlink (git-fixes).\n- ALSA: scarlett2: Allow selecting config_set by firmware version (stable-fixes).\n- ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417 (git-fixes).\n- ALSA: seq: close a re-opened queue timer in the destructor (git-fixes).\n- ALSA: seq: Fix division by zero in initialize_timer() (git-fixes).\n- ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (git-fixes).\n- ALSA: timer: don't re-enter an instance callback that is still running (git-fixes).\n- ALSA: timer: drain a slave's callback before its master detaches it (git-fixes).\n- ALSA: ump: fix double free of out_cvts on rawmidi error (git-fixes).\n- ALSA: usb-audio: Clamp frame size in implicit-feedback mode (git-fixes).\n- ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() (git-fixes).\n- ALSA: usb-audio: fix stack info leak in RME Digiface status (git-fixes).\n- ALSA: usb-audio: fix use-after-free in ump_to_endpoint() (git-fixes).\n- ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC (git-fixes).\n- apparmor: fix use-after-free in rawdata dedup loop (git-fixes).\n- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (git-fixes).\n- ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() (git-fixes).\n- ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI (git-fixes).\n- ASoC: cs35l56: Fix potential probe() deadlock (git-fixes).\n- ASoC: cs35l56: Use complete_all() to signal init_completion (git-fixes).\n- ASoC: cs42l43: Correct report for forced microphone jack (git-fixes).\n- ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP (git-fixes).\n- ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup (git-fixes).\n- ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop (git-fixes).\n- ASoC: tas2562: fix broken entries in the volume lookup table (git-fixes).\n- ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup (git-fixes).\n- ASoC: tas2562: fix DVC coefficient write order (git-fixes).\n- ASoC: tas2781: bound firmware description string parsing (git-fixes).\n- assoc_array: trim the final shortcut word using the current chunk end (git-fixes).\n- batman-adv: bla: reacquire gw address after skb realloc (git-fixes).\n- batman-adv: dat: ensure accessible eth_hdr proto field (git-fixes).\n- batman-adv: dat: fix tie-break for candidate selection (git-fixes).\n- batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes).\n- batman-adv: fix VLAN priority offset (git-fixes).\n- batman-adv: frag: fix primary_if leak on failed linearization (git-fixes).\n- batman-adv: frag: free unfragmentable packet (git-fixes).\n- batman-adv: mcast: avoid OOB read of num_dests header (git-fixes).\n- batman-adv: tt: avoid request storms during pending request (git-fixes).\n- batman-adv: tt: prevent TVLV OOB check overflow (git-fixes).\n- bitops: use common function parameter names (git-fixes).\n- Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (stable-fixes).\n- Bluetooth: 6lowpan: Fix using chan-\u003econn as indication to no remote netdev (git-fixes).\n- Bluetooth: btintel: Validate length before parsing diagnostics TLV (git-fixes).\n- Bluetooth: btrtl: validate firmware patch bounds (git-fixes).\n- Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB (stable-fixes).\n- Bluetooth: btusb: validate Realtek vendor event length (git-fixes).\n- Bluetooth: hci_qca: Clear memdump state on invalid dump size (git-fixes).\n- Bluetooth: hci_sync: Fix advertising data UAFs (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback (git-fixes).\n- Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback (git-fixes).\n- Bluetooth: hci_sync: Protect UUID list traversal (git-fixes).\n- Bluetooth: HIDP: reject frames without a transaction header (git-fixes).\n- Bluetooth: HIDP: validate numbered report payloads (git-fixes).\n- Bluetooth: ISO: clear iso_data always when detaching conn from hcon (git-fixes).\n- Bluetooth: ISO: fix CONNECTED -\u003e CLOSED transition on shutdown/release (git-fixes).\n- Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos (git-fixes).\n- Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis() (git-fixes).\n- Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (git-fixes).\n- Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (git-fixes).\n- Bluetooth: mgmt: Translate HCI reason in Device Disconnected event (git-fixes).\n- Bluetooth: RFCOMM: Fix session UAF in set_termios (git-fixes).\n- Bluetooth: SCO: give the socket its own sco_conn reference (git-fixes).\n- btrfs: do not trim a device which is not writeable (bsc#1272568).\n- bus: sunxi-rsb: Always check register address validity (git-fixes).\n- can: bcm: add missing rcu list annotations and operations (git-fixes).\n- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (git-fixes).\n- can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure (git-fixes).\n- can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured (git-fixes).\n- can: ctucanfd: add missing MODULE_DEVICE_TABLE() (git-fixes).\n- can: ctucanfd: handle bus error interrupts (git-fixes).\n- can: ctucanfd: mark error-active controller status valid (git-fixes).\n- can: ctucanfd: unmap BAR0 using base address (git-fixes).\n- can: ctucanfd: use self-test mode for PRESUME_ACK (git-fixes).\n- can: ems_usb: validate CPC message lengths (git-fixes).\n- can: esd_usb: kill anchored URBs before freeing netdevs (git-fixes).\n- can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure (git-fixes).\n- can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure (git-fixes).\n- can: isotp: check register_netdevice_notifier() error in module init (git-fixes).\n- can: isotp: use unconditional synchronize_rcu() in isotp_release() (git-fixes).\n- can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer (git-fixes).\n- can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() (git-fixes).\n- can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents (git-fixes).\n- can: peak_usb: add bounds check for USB channel index (git-fixes).\n- can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error (git-fixes).\n- can: peak_usb: validate uCAN receive record lengths (git-fixes).\n- can: softing: fw_parse(): validate firmware record spans (git-fixes).\n- cdrom: fix stack out-of-bounds read in CDROMVOLCTRL (git-fixes).\n- comedi: comedi_parport: deal with premature interrupt (git-fixes).\n- crypto/xxhash: set downstream CRYPTO_ALG_FIPS_UNAPPROVED (bsc#1262160 jsc#PED-15986).\n- crypto: introduce downstream CRYPTO_ALG_FIPS_UNAPPROVED (bsc#1262160 jsc#PED-15986).\n- crypto: qat - keep VFs enabled during reset (stable-fixes).\n- crypto: qat - notify fatal error before AER reset preparation (stable-fixes).\n- dm cache policy smq: check allocation under invalidate lock (git-fixes).\n- dm cache: fix missing return in invalidate_committed's error path (git-fixes).\n- dmaengine: idxd: fix double free of wq, engine, and group structs (git-fixes).\n- dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (git-fixes).\n- dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ (git-fixes).\n- dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA (git-fixes).\n- driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout() (git-fixes).\n- driver core: Guard deferred probe timeout extension with delayed_work_pending() (git-fixes).\n- driver core: Use mod_delayed_work to prevent lost deferred probe work (git-fixes).\n- Drivers: hv: vmbus: Set DMA coherent mask for VMBus devices (git-fixes).\n- drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference (git-fixes).\n- drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips (git-fixes).\n- drm/amd/display: set new_stream to NULL after release (git-fixes).\n- drm/amd/display: use proper context for logging (git-fixes).\n- drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) (git-fixes).\n- drm/amd/pm: fix amdgpu_pm_info power display units (git-fixes).\n- drm/amd/pm: fix smu13 power limit range calculation (git-fixes).\n- drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge (git-fixes).\n- drm/amdgpu: fix aperture mapping leak (git-fixes).\n- drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment (git-fixes).\n- drm/amdkfd: free MQD managers on DQM init failures (git-fixes).\n- drm/amdkfd: hold event_mutex while checkpointing CRIU events (git-fixes).\n- drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs (git-fixes).\n- drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() (git-fixes).\n- drm/gfx10: Program DB_RING_CONTROL (git-fixes).\n- drm/i915/bios: range check LFP Data Block panel_type2 (git-fixes).\n- drm/i915/gem: Do not leak siblings[] on proto context error (git-fixes).\n- drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU (git-fixes).\n- drm/i915/gt: use correct selftest config symbol (git-fixes).\n- drm/i915/selftests: Fix GT PM sort comparators (git-fixes).\n- drm/i915: ensure segment offset never exceeds allowed max (stable-fixes).\n- drm/i915: Return NULL on error in active_instance (git-fixes).\n- drm/imagination: acquire vm_ctx-\u003elock before mapping memory to GPU VM (git-fixes).\n- drm/imagination: Fix double call to drm_sched_entity_fini() (git-fixes).\n- drm/imagination: fix error checking of pvr_vm_context_lookup() (git-fixes).\n- drm/imagination: Fix returned size for DRM_IOCTL_PVR_DEV_QUERY (git-fixes).\n- drm/imagination: Fix user array stride in pvr_set_uobj_array() (git-fixes).\n- drm/mediatek: Check CRTC state before freeing (git-fixes).\n- drm/mediatek: ovl_adaptor: balance component registrations (git-fixes).\n- drm/panthor: Don't overrule pending immediate ticks in sched_resume_tick() (git-fixes).\n- drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced (git-fixes).\n- drm/panthor: Fix potential invalid pointer deref in group_process_tiler_oom() (git-fixes).\n- drm/panthor: Interrupt group start/resumption if group_bind_locked() fails (git-fixes).\n- drm/panthor: reject firmware sections with oversized data (git-fixes).\n- drm/panthor: return error on truncated firmware (git-fixes).\n- drm/panthor: validate firmware interface structure sizes (git-fixes).\n- drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove (git-fixes).\n- drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered (stable-fixes).\n- drm/tests: shmem: Set DMA mask to 64-bit in drm_gem_shmem (git-fixes).\n- drm/v3d: Reject invalid indirect BO handle in indirect CSD setup (git-fixes).\n- drm/vc4: hvs/v3d: Fix null dereference in unbind (git-fixes).\n- drm/vc4: Prevent shader BO mappings from becoming writable (git-fixes).\n- drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size (git-fixes).\n- drm/vc4: Zero the tile state data array before each BIN job (git-fixes).\n- drm/virtio: bound EDID block reads to the response buffer (git-fixes).\n- drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker (git-fixes).\n- drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure (git-fixes).\n- drm/vmwgfx: bound DMA command body size against suffix pointer (git-fixes).\n- drm/vmwgfx: drop dma_buf reference on foreign-fd prime import (git-fixes).\n- drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size (git-fixes).\n- drm/vmwgfx: reject DX_BIND_QUERY without a DX context (git-fixes).\n- drm/vmwgfx: use check_add_overflow for shader size+offset bound (git-fixes).\n- drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (git-fixes).\n- drm/vmwgfx: validate external BO copy bounds for both stride paths (git-fixes).\n- drm/vmwgfx: Validate vmw_surface_metadata::array_size (git-fixes).\n- drm/xe/hw_engine: Fix double-free of managed BO in error path (git-fixes).\n- drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays (git-fixes).\n- drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry() (git-fixes).\n- drm/xe/wopcm: fix WOPCM size for LNL+ (git-fixes).\n- drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds (git-fixes).\n- drm/xe: remove duplicate \u003ckunit/test-bug.h\u003e include (git-fixes).\n- erofs: set fileio bio failed in short read case (git-fixes).\n- fbcon: fix NULL pointer dereference for a console without vc_data (stable-fixes).\n- fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() (git-fixes).\n- fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() (git-fixes).\n- fbdev: efifb: fix memory leak in efifb_probe() (git-fixes).\n- fbdev: hecubafb: fix potential memory leak in hecubafb_probe() (git-fixes).\n- fbdev: i740fb: fix potential memory leak in i740fb_probe() (git-fixes).\n- fbdev: metronomefb: fix potential memory leak in metronomefb_probe() (git-fixes).\n- fbdev: nvidia: fix potential memory leak in nvidiafb_probe() (git-fixes).\n- fbdev: radeon: fix potential memory leak in radeonfb_pci_register() (git-fixes).\n- fbdev: s3fb: fix potential memory leak in s3_pci_probe() (git-fixes).\n- fbdev: sm501fb: Fix buffer errors in OF binding code (git-fixes).\n- fbdev: sm712: Fix operator precedence in big_swap macro (git-fixes).\n- fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() (git-fixes).\n- fbdev: tridentfb: fix potential memory leak in trident_pci_probe() (git-fixes).\n- fbdev: uvesafb: fix potential memory leak in uvesafb_probe() (git-fixes).\n- fbdev: vesafb: fix memory leak in vesafb_probe() (git-fixes).\n- firewire: net: Fix fragmented datagram reassembly (git-fixes).\n- firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() (git-fixes).\n- firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits (git-fixes).\n- gpio-f7188x: Add support for NCT6126D version B (git-fixes).\n- gpio: davinci: fix IRQ domain leak on devm_kzalloc failure (git-fixes).\n- gpio: eic-sprd: use raw_spinlock_t in the irq startup path (git-fixes).\n- gpio: htc-egpio: use managed gpiochip registration (git-fixes).\n- gpio: mlxbf3: fail probe if gpiochip registration fails (git-fixes).\n- gpio: mvebu: fail probe if gpiochip registration fails (git-fixes).\n- gpio: mvebu: free generic chips on unbind (git-fixes).\n- gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (git-fixes).\n- gpio: rockchip: change the GPIO version judgment logic (stable-fixes).\n- gpio: rockchip: fix generic IRQ chip leak on remove (git-fixes).\n- gpio: rockchip: teardown bugs and resource leaks (git-fixes).\n- gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe() (git-fixes).\n- gpio: tegra: do not call pinctrl for GPIO direction (git-fixes).\n- gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe (git-fixes).\n- gpios: palmas: add .get_direction() op (git-fixes).\n- HID: add haptics page defines (stable-fixes).\n- HID: hid-sjoy: race between init and usage (git-fixes).\n- HID: pidff: Add missing spaces (stable-fixes).\n- HID: pidff: Fix missing blank lines after declarations (stable-fixes).\n- HID: playstation: validate num_touch_reports in DualShock 4 reports (stable-fixes).\n- hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread (git-fixes).\n- hwmon: (adt7470) Fix cache updated before hardware write on I2C error (git-fixes).\n- hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read (git-fixes).\n- hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors (git-fixes).\n- hwmon: (adt7470) Fix PWM auto temp state array and bounds check (git-fixes).\n- hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks (git-fixes).\n- hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read() (git-fixes).\n- hwmon: (adt7470) Use cached PWM frequency value (git-fixes).\n- hwmon: (asus-ec-sensors) add missed handle for ENOMEM (git-fixes).\n- hwmon: (asus-ec-sensors) fix EC read intervals (git-fixes).\n- hwmon: (asus-ec-sensors) fix looping over banks while reading from EC (git-fixes).\n- hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (lm90) Only report alarms if driver is ready (git-fixes).\n- hwmon: (ltc4282) Fix reading the minimum alarm voltage (git-fixes).\n- hwmon: (nct6775-core) Fix number of temperature registers for NCT6116 (git-fixes).\n- hwmon: (nct6775-core) Prevent access to unsupported weight registers (git-fixes).\n- hwmon: (npcm750-pwm-fan): stop fan timer on device detach (git-fixes).\n- hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (nzxt-smart2) DMA-align output buffer (git-fixes).\n- hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop (git-fixes).\n- hwmon: (pmbus) Fix return value from pmbus_update_byte_data() (git-fixes).\n- hwmon: (pmbus/core) notify on the hwmon device, not the i2c client (git-fixes).\n- hwmon: (sht3x) Fix unaligned accesses (git-fixes).\n- hwmon: (w83627hf) remove VID sysfs files on error and remove (stable-fixes).\n- hwmon: (w83793) remove vrm sysfs file on probe failure (stable-fixes).\n- hwmon: occ: validate poll response sensor blocks (git-fixes).\n- i2c: amd-mp2: Unregister callback on adapter add failure (git-fixes).\n- i2c: imx: Cancel hrtimer before clearing slave pointer (git-fixes).\n- i2c: imx: Fix slave registration race and error handling (git-fixes).\n- i2c: iproc: reset bus after timeout if START_BUSY is stuck (git-fixes).\n- i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock (git-fixes).\n- i2c: mediatek: fix WRRD for SoCs without auto_restart option (git-fixes).\n- i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() (git-fixes).\n- i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue (git-fixes).\n- i3c: mipi-i3c-hci: Preserve RUN bit when aborting DMA ring (git-fixes).\n- ieee802154: admin-gate legacy LLSEC dump operations (git-fixes).\n- ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation (git-fixes).\n- ieee802154: ca8210: fix cas_ctl leak on spi_async failure (git-fixes).\n- ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit (git-fixes).\n- ieee802154: fix kernel-infoleak in dgram_recvmsg() (git-fixes).\n- ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() (git-fixes).\n- iio: accel: bmc150: clamp the device-reported FIFO frame count (git-fixes).\n- iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error (git-fixes).\n- iio: adc: lpc32xx: Initialize completion before requesting IRQ (git-fixes).\n- iio: adc: spear: Initialize completion before requesting IRQ (git-fixes).\n- iio: adc: ti-ads124s08: Return reset GPIO lookup errors (git-fixes).\n- iio: adc: ti-ads1119: fix PM reference leak in buffer preenable (git-fixes).\n- iio: common: st_sensors: honour channel endianness in read_axis_data (git-fixes).\n- iio: event: Fix event FIFO reset race (git-fixes).\n- iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ (git-fixes).\n- iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ (git-fixes).\n- iio: imu: inv_icm42600: fix timestamp clock period by using lower value (git-fixes).\n- iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading (git-fixes).\n- iio: imu: st_lsm6dsx: deselect shub page before reading whoami (git-fixes).\n- iio: light: al3010: fix incorrect scale for the highest gain range (git-fixes).\n- iio: light: gp2ap002: fix runtime PM leak on read error (git-fixes).\n- iio: light: tsl2591: return actual error from probe IRQ failure (git-fixes).\n- iio: magnetometer: ak8975: fix potential kernel stack memory leak (git-fixes).\n- iio: temperature: Build mlx90635 with CONFIG_MLX90635 (git-fixes).\n- Input: ads7846 - restore half-duplex support (git-fixes).\n- Input: atkbd - validate scancode in firmware keymap entries (git-fixes).\n- Input: elan_i2c - prevent division by zero and arithmetic underflow (git-fixes).\n- Input: goodix - clamp the device-reported contact count (git-fixes).\n- Input: iforce - bound the device-reported force-feedback effect index (git-fixes).\n- Input: ims-pcu - add response length checks (git-fixes).\n- Input: ims-pcu - fix DMA mapping violation in line setup (git-fixes).\n- Input: ims-pcu - fix firmware leak in async update (git-fixes).\n- Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() (git-fixes).\n- Input: ims-pcu - fix logic error in packet reset (git-fixes).\n- Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging (git-fixes).\n- Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix race condition in reset_device sysfs callback (git-fixes).\n- Input: ims-pcu - fix type confusion in CDC union descriptor parsing (git-fixes).\n- Input: ims-pcu - fix use-after-free and double-free in disconnect (git-fixes).\n- Input: ims-pcu - only expose sysfs attributes on control interface (git-fixes).\n- Input: ims-pcu - release data interface on disconnect (git-fixes).\n- Input: ims-pcu - validate control endpoint type (git-fixes).\n- Input: maple_keyb - set driver data before registering input device (stable-fixes).\n- Input: maplecontrol - set driver data before registering input device (stable-fixes).\n- Input: maplemouse - fix NULL pointer dereference in open() (git-fixes).\n- Input: maplemouse - set driver data before registering input device (stable-fixes).\n- Input: mms114 - fix multi-touch slot corruption (git-fixes).\n- Input: mms114 - fix touch indexing for MMS134S and MMS136 (git-fixes).\n- Input: mms114 - reject an oversized device packet size (git-fixes).\n- Input: rmi4 - fix bit count in bitmap_copy() (git-fixes).\n- Input: rmi4 - fix limit in rmi_register_desc_has_subpacket() (git-fixes).\n- Input: rmi4 - fix memory leak in rmi_set_attn_data() (git-fixes).\n- Input: rmi4 - fix num_subpackets overflow in register descriptor (git-fixes).\n- Input: rmi4 - fix register descriptor address calculation (git-fixes).\n- Input: rmi4 - fix type overflow in register counts (git-fixes).\n- Input: rmi4 - initialize attn_fifo properly (stable-fixes).\n- Input: rmi4 - iterative IRQ handler (git-fixes).\n- Input: rmi4 - refactor F12 probe function (stable-fixes).\n- Input: rmi4 - refactor function allocation and registration (stable-fixes).\n- Input: rmi4 - refactor register descriptor parsing (git-fixes).\n- Input: rmi4 - tolerate short register descriptor structure (git-fixes).\n- Input: rmi4 - use local presence map in rmi_read_register_desc() (stable-fixes).\n- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (git-fixes).\n- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (git-fixes).\n- Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure (git-fixes).\n- Input: touchwin - reset the packet index on every complete packet (git-fixes).\n- intel_th: core: fix null pointer dereference in intel_th_irq (bsc#1248480).\n- intel_th: fix MSC output device reference leak (git-fixes).\n- io_uring/kbuf: don't truncate end buffer for bundles (bsc#1271290).\n- io_uring/kbuf: fix missing BUF_MORE for incremental buffers at EOF (bsc#1261250).\n- io_uring/kbuf: flag partial buffer mappings (bsc#1271290).\n- io_uring/kbuf: propagate BUF_MORE through early buffer commit path (bsc#1261250).\n- io_uring/net: always use current transfer count for buffer put (git-fixes).\n- io_uring/net: improve recv bundles (bsc#1271290).\n- io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries (bsc#1271290).\n- io_uring/net: only consider msg_inq if larger than 1 (git-fixes).\n- io_uring/net: only retry recv bundle for a full transfer (bsc#1271290).\n- io_uring/timeout: add helper for parsing user time (bsc#1271291).\n- io_uring/timeout: honour caller's time namespace for IORING_TIMEOUT_ABS (bsc#1271291).\n- io_uring/timeout: migrate reqs from ts64 to ktime (bsc#1271291).\n- io_uring/wait: honour caller's time namespace for IORING_ENTER_ABS_TIMER (bsc#1271291).\n- ixgbe: reduce number of reads when getting OROM data (bsc#1269637).\n- KVM: nSVM: Clear EVENTINJ fields in vmcb12 on nested #VMEXIT (git-fixes).\n- KVM: nSVM: Clear GIF on nested #VMEXIT(INVALID) (git-fixes).\n- KVM: nSVM: Clear tracking of L1-\u003eL2 NMI and soft IRQ on nested #VMEXIT (git-fixes).\n- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (git-fixes).\n- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (git-fixes).\n- KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs (git-fixes).\n- KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug (git-fixes).\n- KVM: TDX: Reject concurrent change to CPUID entry count (git-fixes).\n- KVM: x86/mmu: Check write tracking in all address spaces (git-fixes).\n- KVM: x86/mmu: Fix use-after-free on vendor module reload (git-fixes).\n- KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots (git-fixes).\n- KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs (git-fixes).\n- KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN (git-fixes).\n- leds: uleds: Fix potential buffer overread (git-fixes).\n- mac802154: hold an interface reference across the scan worker (git-fixes).\n- mac802154: llsec: reject frames shorter than the authentication tag (git-fixes).\n- mac802154: Prevent overwrite return code in mac802154_perform_association() (git-fixes).\n- mac802154: remove interfaces with RCU list deletion (git-fixes).\n- mailbox: zynqmp: setup IPI for each valid child node (bsc#1271395).\n- mctp: Fix incorrect tx flow invalidation condition in mctp-i2c (bsc#1266694).\n- media: aspeed: fix missing of_reserved_mem_device_release() on probe failure (git-fixes).\n- media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() (git-fixes).\n- media: atomisp: gc2235: fix UAF and memory leak (git-fixes).\n- media: cec: seco: unregister adapter on IR probe failure (git-fixes).\n- media: cedrus: Fix failure to clean up hardware on probe failure (git-fixes).\n- media: cedrus: Fix missing cleanup in error path (git-fixes).\n- media: cedrus: skip invalid H.264 reference list entries (git-fixes).\n- media: marvell-cam: fix missing pci_disable_device() on remove (git-fixes).\n- media: mtk-jpeg: cancel workqueue on release for supported platforms only (git-fixes).\n- media: nxp: imx8-isi: Fix use-after-free on remove (git-fixes).\n- media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code (stable-fixes).\n- media: pci: dm1105: Free allocated workqueue (git-fixes).\n- media: qcom: camss: vfe: fix PIX subdev naming on VFE lite (git-fixes).\n- media: qcom: venus: drop extra padding in NV12 raw size calculation (git-fixes).\n- media: qcom: venus: relax encoder frame/blur dimension steps on v4 (git-fixes).\n- media: qcom: venus: relax encoder frame/blur step size on v6 (git-fixes).\n- media: rockchip: rga: fix too small buffer size (git-fixes).\n- media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe (git-fixes).\n- media: ti: vpe: unwind v4l2 device registration on probe error (git-fixes).\n- media: uvcvideo: Avoid partial metadata buffers (git-fixes).\n- media: uvcvideo: Do not add clock samples with small sof delta (git-fixes).\n- media: uvcvideo: Fix buffer sequence in frame gaps (git-fixes).\n- media: uvcvideo: Fix dev_sof filtering in hw timestamp (git-fixes).\n- media: uvcvideo: Fix sequence number when no EOF (git-fixes).\n- media: uvcvideo: Relax the constrains for interpolating the hw clock (git-fixes).\n- media: uvcvideo: Use hw timestaming if the clock buffer is full (git-fixes).\n- media: v4l2-common: Add YUV24 format info (git-fixes).\n- media: v4l2-ctrls: validate HEVC active reference counts (git-fixes).\n- media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si (git-fixes).\n- media: vidtv: fix reference leak on failed device registration (git-fixes).\n- media: vimc: fix reference leak on failed device registration (git-fixes).\n- media: vpif_capture: fix OF node reference imbalance (git-fixes).\n- mei: bus: access mei_device under device_lock on cleanup (git-fixes).\n- memory: tegra: Wire up system sleep PM ops (git-fixes).\n- memstick: ms_block: reject a card that reports too many blocks (git-fixes).\n- mfd: cros_ec: Delay dev_set_drvdata() until probe success (git-fixes).\n- mfd: cs42l43: Sanity check firmware size (git-fixes).\n- mfd: rsmu: Fix page register setup (git-fixes).\n- mfd: sm501: Fix reference leak on failed device registration (git-fixes).\n- mfd: tps6586x: Fix OF node refcount (git-fixes).\n- misc: nsm: only unlock nsm_dev on post-lock error paths (git-fixes).\n- misc: nsm: pin the module while the device is open (git-fixes).\n- mkspec-dtb: Skip missing DTBs.\n- mm: zero range of eof folio exposed by inode size extension (bsc#1272920).\n- mmc: block: fix RPMB device unregister ordering (git-fixes).\n- mmc: sdhci-of-dwcmshc: check bus clock enable result in the probe() method (git-fixes).\n- mmc: vub300: defer reset until cmd_mutex is unlocked (git-fixes).\n- mshv: fix hv_input_get_system_property struct (git-fixes).\n- mtd: mchp23k256: use SPI match data for chip caps (git-fixes).\n- mtd: onenand: samsung: report DMA completion timeouts (git-fixes).\n- mtd: rawnand: fsl_ifc: return errors for failed page reads (git-fixes).\n- mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout (git-fixes).\n- mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout (git-fixes).\n- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (bsc#1271866).\n- net/x25: fix use-after-free in x25_kill_by_neigh() (git-fixes).\n- net: mana: Add Interrupt Moderation support (bsc#1271368).\n- net: mana: Return error code from mana_create_rxq() (git-fixes).\n- net: mctp i2c: Copy headers if cloned (bsc#1266694).\n- net: mctp-i2c: fix duplicate reception of old data (bsc#1266694).\n- net: thunderbolt: Fix frags overflow by bounding frame_count (git-fixes).\n- net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() (git-fixes).\n- net: usb: lan78xx: move functions to avoid forward definitions (stable-fixes).\n- net: wwan: t7xx: check skb_clone in control TX (git-fixes).\n- net: wwan: t7xx: destroy DMA pool on CLDMA late init failure (git-fixes).\n- netfs: Defer the emission of trace_netfs_folio() (git-fixes).\n- of: cpu: add check in __of_find_n_match_cpu_property() (git-fixes).\n- phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access (git-fixes).\n- phy: phy-can-transceiver: Check driver match and driver data against NULL (git-fixes).\n- phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask (git-fixes).\n- phy: zynqmp: fix runtime PM leak on probe allocation failure (git-fixes).\n- phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB (git-fixes).\n- phy: zynqmp: use read-modify-write for SERDES scrambler bypass (git-fixes).\n- pinctrl-amd: Don't clear S4 wake bits at probe (git-fixes).\n- pinctrl: bm1880: add missing select GENERIC_PINCONF (git-fixes).\n- pinctrl: cs42l43: Fix polarity on debounce (git-fixes).\n- pinctrl: devicetree: don't free uninitialized dev_name on error path (git-fixes).\n- pinctrl: equilibrium: fix warning trace on load (git-fixes).\n- pinctrl: equilibrium: rename irq_chip function callbacks (stable-fixes).\n- pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: meson: restore non-sleeping GPIO access (git-fixes).\n- pinctrl: nuvoton: ma35d1: fix MFP register offset and pin table (git-fixes).\n- pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151 (git-fixes).\n- pinctrl: qcom: Unconditionally mark gpio as wakeup enable (git-fixes).\n- pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path (git-fixes).\n- pkspec-dtb: Fix dtb-al rename.\n- platform/x86/amd/pmc: Add delay_suspend module parameter (stable-fixes).\n- platform/x86/amd/pmc: Avoid logging \"(null)\" for DMI values (git-fixes).\n- platform/x86/amd/pmc: Check for intermediate wakeup in function (stable-fixes).\n- platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops (stable-fixes).\n- platform/x86/amd/pmc: Don't log during intermediate wakeups (stable-fixes).\n- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (git-fixes).\n- posix-cpu-timers: Cleanup the firing logic (bsc#1271912).\n- posix-cpu-timers: Correctly update timer status in posix_cpu_timer_del() (bsc#1271912).\n- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (bsc#1271912).\n- posix-timers: Add proper state tracking (bsc#1271912).\n- posix-timers: Avoid direct access to hrtimer clockbase (bsc#1271912).\n- posix-timers: Expand timer_arm() callbacks with a boolean return value (bsc#1271912).\n- power: sequencing: fix ABBA deadlock in pwrseq_device_unregister() (git-fixes).\n- power: supply: bq25890: fix the -10 C NTC lookup entry (git-fixes).\n- power: supply: max17040: handle missing status supplier (git-fixes).\n- RDMA/mana_ib: initialize err for empty send WR lists (git-fixes).\n- regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK (git-fixes).\n- regulator: ltc3676: Fix incorrect IRQSTAT bit offsets (git-fixes).\n- regulator: mt6358: use regmap helper to read fixed LDO calibration (git-fixes).\n- remoteproc: qcom: Fix leak when custom dump_segments addition fails (git-fixes).\n- reset: sunxi: fix memory region leak on ioremap failure (git-fixes).\n- Revert \"Input: rmi4 - fix register descriptor address calculation\" (stable-fixes).\n- sctp: validate embedded address parameter length (git-fixes).\n- security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() (git-fixes).\n- selftests: Disable dad for ipv6 in fcnal-test.sh (bsc#1272871).\n- selftests: Replace sleep with slowwait (bsc#1272871).\n- serial: 8250_mid: Disable DMA for selected platforms (git-fixes).\n- serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms (git-fixes).\n- serial: 8250_omap: clear rx_running on zero-length DMA completes (git-fixes).\n- serial: msm: Disable DMA for kernel console UART (git-fixes).\n- serial: sc16is7xx: implement gpio get_direction() callback (git-fixes).\n- soc: fsl: qe: panic on ioremap() failure in qe_reset() (git-fixes).\n- soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy (git-fixes).\n- soc: xilinx: Shutdown and free rx mailbox channel (git-fixes).\n- spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure (git-fixes).\n- spi: sh-msiof: abort transfers when reset times out (git-fixes).\n- staging: media: atomisp: fix loop shadowing in ia_css_stream_destroy() (git-fixes).\n- staging: media: atomisp: reduce load_primary_binaries() stack usage (git-fixes).\n- staging: rtl8723bs: core: move constants to right side in comparison (stable-fixes).\n- staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() (git-fixes).\n- staging: rtl8723bs: fix inverted HT40 secondary channel offset (git-fixes).\n- staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() (git-fixes).\n- staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop (git-fixes).\n- staging: rtl8723bs: fix OOB write in HT_caps_handler() (git-fixes).\n- staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() (git-fixes).\n- thermal: core: Free thermal zone ID later during removal (git-fixes).\n- time: Switch to hrtimer_setup() (bsc#1271912).\n- tpm: Make the TPM character devices non-seekable (git-fixes).\n- uio_hv_generic: Bind to FCopy device by default (git-fixes).\n- usb: cdc_acm: Add quirk for Uniden BC125AT scanner (stable-fixes).\n- usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() (git-fixes).\n- USB: chaoskey: Fix slab-use-after-free in chaoskey_release() (git-fixes).\n- usb: chipidea: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub (stable-fixes).\n- usb: core: port: Deattach Type-C connector on component unbind (git-fixes).\n- usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() (git-fixes).\n- usb: dwc3: run gadget disconnect from sleepable suspend context (git-fixes).\n- usb: free iso schedules on failed submit (git-fixes).\n- usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler (git-fixes).\n- usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback (git-fixes).\n- usb: gadget: f_fs: Fix DMA fence leak (git-fixes).\n- usb: gadget: f_midi: cancel pending IN work before freeing the midi object (git-fixes).\n- usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() (git-fixes).\n- usb: gadget: f_printer: take kref only for successful open (git-fixes).\n- USB: gadget: fsl-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: function: rndis: add length check for header (stable-fixes).\n- usb: gadget: function: rndis: add length check to response query (stable-fixes).\n- usb: gadget: printer: fix infinite loop in printer_read() (git-fixes).\n- USB: gadget: snps-udc: fix device name leak on probe failure (git-fixes).\n- usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown (git-fixes).\n- usb: gadget: udc: Fix use-after-free in gadget_match_driver (stable-fixes).\n- usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer (git-fixes).\n- USB: idmouse: fix use-after-free on disconnect race (git-fixes).\n- USB: iowarrior: fix use-after-free on disconnect (git-fixes).\n- USB: iowarrior: fix use-after-free on disconnect race (git-fixes).\n- usb: iowarrior: remove inherent race with minor number (stable-fixes).\n- USB: ldusb: fix use-after-free on disconnect race (git-fixes).\n- USB: legousbtower: fix use-after-free on disconnect race (git-fixes).\n- USB: misc: uss720: unregister parport on probe failure (git-fixes).\n- usb: mtu3: unmap request DMA on queue failure (git-fixes).\n- USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD (stable-fixes).\n- USB: serial: digi_acceleport: fix broken rx after throttle (git-fixes).\n- USB: serial: digi_acceleport: fix hard lockup on disconnect (git-fixes).\n- USB: serial: digi_acceleport: fix write buffer corruption (git-fixes).\n- USB: serial: io_edgeport: cap received transmit credits (git-fixes).\n- USB: serial: io_ti: reject oversized boot-mode firmware (git-fixes).\n- USB: serial: keyspan_pda: fix data loss on receive throttling (git-fixes).\n- USB: serial: keyspan_pda: fix information leak (git-fixes).\n- USB: serial: mxuport: validate firmware header size (git-fixes).\n- USB: serial: option: add MeiG SRM813Q (stable-fixes).\n- USB: serial: option: add Telit Cinterion FE990D50 compositions (stable-fixes).\n- usb: sl811-hcd: disable controller wakeup on remove (git-fixes).\n- USB: storage: include US_FL_NO_SAME in quirks mask (git-fixes).\n- usb: typec: anx7411: use devm_pm_runtime_enable() (git-fixes).\n- usb: typec: class: drop PD lookup reference (git-fixes).\n- usb: typec: tcpm: Fix VDM type for Enter Mode commands (git-fixes).\n- usb: typec: tcpm: Validate SVID index in svdm_consume_modes() (git-fixes).\n- usb: typec: ucsi: cancel pending work on system suspend (git-fixes).\n- usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove (git-fixes).\n- usb: typec: ucsi: Detect and skip duplicate altmodes from buggy firmware (git-fixes).\n- usb: typec: ucsi: Invert DisplayPort role assignment (git-fixes).\n- usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode (git-fixes).\n- USB: ulpi: fix memory leak on registration failure (git-fixes).\n- USB: usb-storage: ene_ub6250: restore media-ready check (git-fixes).\n- usb: xhci: Fix sleep in atomic context in xhci_free_streams() (git-fixes).\n- usbip: tools: support SuperSpeedPlus devices (git-fixes).\n- usbip: vudc: fix NULL deref in vep_dequeue() (git-fixes).\n- wan: wanxl: Only reset hardware after BAR mapping (git-fixes).\n- watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() (git-fixes).\n- wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() (git-fixes).\n- wifi: ath6kl: fix OOB access from firmware ADDBA window size (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware IE lengths in connect event (git-fixes).\n- wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler (git-fixes).\n- wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (git-fixes).\n- wifi: ath10k: fix skb leak on incomplete msdu during rx pop (git-fixes).\n- wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin (git-fixes).\n- wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() (git-fixes).\n- wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET (git-fixes).\n- wifi: brcmfmac: fix 802.1X-SHA256 call trace warning (git-fixes).\n- wifi: brcmfmac: make release_scratchbuffers idempotent (git-fixes).\n- wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read (git-fixes).\n- wifi: carl9170: fix buffer overflow in rx_stream failover path (git-fixes).\n- wifi: carl9170: fix OOB read from off-by-two in TX status handler (git-fixes).\n- wifi: iwlwifi: mvm: fix read in wake packet notification handler (git-fixes).\n- wifi: iwlwifi: mvm: validate SAR GEO response payload size (git-fixes).\n- wifi: mac80211: fix memory leak in ieee80211_register_hw() (git-fixes).\n- wifi: mac80211: free ack status frame on TX header build failure (git-fixes).\n- wifi: mac80211: recalculate TIM when a station enters power save (git-fixes).\n- wifi: mac80211: tear down new links on vif update error path (git-fixes).\n- wifi: mac80211: validate individual TWT params before driver setup (git-fixes).\n- wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() (git-fixes).\n- wifi: mt76: Disable napi when removing device (git-fixes).\n- wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7915: guard HE capability lookups (git-fixes).\n- wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (git-fixes).\n- wifi: mt76: mt7925: fix crash in reset link replay (git-fixes).\n- wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv() (git-fixes).\n- wifi: mt76: mt7925: guard link STA in decap offload (git-fixes).\n- wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() (git-fixes).\n- wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() (git-fixes).\n- wifi: mwifiex: bound uAP association event IEs to the event buffer (git-fixes).\n- wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper (git-fixes).\n- wifi: mwifiex: fix permanently busy scans after multiple roam iterations (git-fixes).\n- wifi: mwifiex: fix roaming to different channel in host_mlme mode (git-fixes).\n- wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (git-fixes).\n- wifi: rt2x00: avoid full teardown before work setup in probe (git-fixes).\n- wifi: wilc1000: validate assoc response length before subtracting header (git-fixes).\n- xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit (bsc#1264267).\n- xfs: only assert new size for datafork during truncate extents (bsc#1264084).\n- xfs: rearrange code in xfs_inode_item_precommit (bsc#1237449).\n- xfs: rework datasync tracking and execution (bsc#1237449).\n- xhci: dbgtty: fix device unregister (git-fixes).\n- xhci: dbgtty: fix device unregister: fixup (git-fixes).\n","status":"published","published":"2026-08-11T21:34:22Z","modified":"2026-08-27T18:23:10.81084318Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:2799-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2025-10263: arm64: cputype: Add C1-Ultra definitions (bsc#1266290).\n- CVE-2025-40216: io_uring/rsrc: don't rely on user vaddr alignment (bsc#1259764).\n- CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).\n- CVE-2025-68822: Input: alps - fix use-after-free bugs caused by dev3_register_work (bsc#1256668).\n- CVE-2025-71294: drm/amdgpu: fix NULL pointer issue buffer funcs (bsc#1264562).\n- CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).\n- CVE-2026-31414: netfilter: nf_conntrack_expect: use expect-\u003ehelper (bsc#1262085).\n- CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).\n- CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).\n- CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).\n- CVE-2026-31462: drm/amdgpu: prevent immediate PASID reuse case (bsc#1262655).\n- CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).\n- CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false\n  (bsc#1267816).\n- CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).\n- CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).\n- CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).\n- CVE-2026-31500: Bluetooth: hci_sync: Remove remaining dependencies of hci_request (bsc#1262993).\n- CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).\n- CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).\n- CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).\n- CVE-2026-31592: KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm-\u003elock (bsc#1263123).\n- CVE-2026-31593: KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU (bsc#1263124).\n- CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).\n- CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).\n- CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).\n- CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).\n- CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).\n- CVE-2026-31677: crypto: af_alg - limit RX SG extraction by receive buffer budget (bsc#1263560).\n- CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).\n- CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).\n- CVE-2026-31697: crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (bsc#1264116).\n- CVE-2026-31698: crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (bsc#1263880).\n- CVE-2026-31699: crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (bsc#1263879).\n- CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).\n- CVE-2026-31759: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264076).\n- CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).\n- CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).\n- CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).\n- CVE-2026-43023: Bluetooth: SCO: fix race conditions in sco_sock_connect() (bsc#1264137).\n- CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).\n- CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).\n- CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).\n- CVE-2026-43035: net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak\n  (bsc#1263996).\n- CVE-2026-43036: net: use skb_header_pointer() for TCPv4 GSO frag_off check (bsc#1263993).\n- CVE-2026-43049: HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure (bsc#1264080).\n- CVE-2026-43053: xfs: factor out xfs_attr3_node_entry_remove (bsc#1264084).\n- CVE-2026-43074: eventpoll: defer struct eventpoll free to RCU grace period (bsc#1264263).\n- CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1264470).\n- CVE-2026-43079: perf/x86/intel/uncore: Skip discovery table for offline dies (bsc#1264228).\n- CVE-2026-43080: l2tp: Drop large packets with UDP encap (bsc#1264236).\n- CVE-2026-43081: net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ (bsc#1264241).\n- CVE-2026-43083: net: ioam6: fix OOB and missing lock (bsc#1264266).\n- CVE-2026-43085: netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (bsc#1264230).\n- CVE-2026-43086: ipvs: fix NULL deref in ip_vs_add_service error path (bsc#1264286).\n- CVE-2026-43089: xfrm_user: fix info leak in build_mapping() (bsc#1264261).\n- CVE-2026-43093: xsk: tighten UMEM headroom validation to account for tailroom and min frame (bsc#1264254).\n- CVE-2026-43094: ixgbevf: add missing negotiate_features op to Hyper-V ops table (bsc#1264231).\n- CVE-2026-43101: ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() (bsc#1264239).\n- CVE-2026-43107: xfrm: account XFRMA_IF_ID in aevent size calculation (bsc#1264258).\n- CVE-2026-43112: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (bsc#1264437).\n- CVE-2026-43119: Bluetooth: hci_sync: annotate data-races around hdev-\u003ereq_status (bsc#1264561).\n- CVE-2026-43128: RDMA/umem: Fix double dma_buf_unpin in failure path (bsc#1264612).\n- CVE-2026-43139: xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (bsc#1264294).\n- CVE-2026-43158: xfs: fix freemap adjustments when adding xattrs to leaf blocks (bsc#1264595).\n- CVE-2026-43171: EFI/CPER: don't dump the entire memory region (bsc#1264549).\n- CVE-2026-43187: xfs: delete attr leaf freemap entries when empty (bsc#1264603).\n- CVE-2026-43198: tcp: fix potential race in tcp_v6_syn_recv_sock() (bsc#1264610).\n- CVE-2026-43233: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (bsc#1264337).\n- CVE-2026-43238: net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (bsc#1264320).\n- CVE-2026-43239: smb: client: prevent races in -\u003equery_interfaces() (bsc#1264444).\n- CVE-2026-43303: mm/page_alloc: clear page-\u003eprivate in free_pages_prepare() (bsc#1264974).\n- CVE-2026-43336: lib/crypto: chacha: Zeroize permuted_state before it leaves scope (bsc#1265113).\n- CVE-2026-43339: ipv6: prevent possible UaF in addrconf_permanent_addr() (bsc#1264763).\n- CVE-2026-43345: net: ipa: fix event ring index not programmed for IPA v5.0+ (bsc#1265103).\n- CVE-2026-43405: libceph: Use u32 for non-negative values in ceph_monmap_decode() (bsc#1264741).\n- CVE-2026-43420: ceph: fix i_nlink underrun during async unlink (bsc#1264814).\n- CVE-2026-43456: bonding: fix type confusion in bond_setup_by_slave() (bsc#1264734).\n- CVE-2026-43469: xprtrdma: Decrement re_receiving on the early exit paths (bsc#1265143).\n- CVE-2026-43472: unshare: fix unshare_fs() handling (bsc#1264748).\n- CVE-2026-43491: net: qrtr: ns: Limit the maximum server registration per node (bsc#1265628).\n- CVE-2026-43492: lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() (bsc#1265629).\n- CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).\n- CVE-2026-45838: bpf: fix end-of-list detection in cgroup_storage_get_next_key() (bsc#1266396).\n- CVE-2026-45840: openvswitch: cap upcall PID array size and pre-size vport replies (bsc#1266397).\n- CVE-2026-45841: netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (bsc#1266390).\n- CVE-2026-45848: apparmor: fix NULL sock in aa_sock_file_perm (bsc#1266734).\n- CVE-2026-45862: iommu/vt-d: Flush cache for PASID table before using it (bsc#1266705).\n- CVE-2026-45870: SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (bsc#1266704).\n- CVE-2026-45891: net: hns3: fix double free issue for tx spare buffer (bsc#1266717).\n- CVE-2026-45894: iommu/vt-d: Clear Present bit before tearing down PASID entry (bsc#1266895).\n- CVE-2026-45912: ext4: don't cache extent during splitting extent (bsc#1266899).\n- CVE-2026-45940: net: stmmac: fix oops when split header is enabled (bsc#1266916).\n- CVE-2026-45948: ext4: fix memory leak in ext4_ext_shift_extents() (bsc#1266929).\n- CVE-2026-45961: gfs2: fix memory leaks in gfs2_fill_super error path (bsc#1266933).\n- CVE-2026-45964: SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path (bsc#1266698).\n- CVE-2026-45965: apparmor: fix invalid deref of rawdata when export_binary is unset (bsc#1267208).\n- CVE-2026-45974: btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found (bsc#1266922).\n- CVE-2026-45985: ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O (bsc#1266700).\n- CVE-2026-46005: xfs: fix a resource leak in xfs_alloc_buftarg() (bsc#1267431).\n- CVE-2026-46028: crypto: algif_aead - snapshot IV for async AEAD requests (bsc#1267430).\n- CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267361).\n- CVE-2026-46053: net: rds: fix MR cleanup on copy error (bsc#1267427).\n- CVE-2026-46063: x86/shstk: Prevent deadlock during shstk sigreturn (bsc#1267228).\n- CVE-2026-46065: fbdev: defio: Disconnect deferred I/O from the lifetime of struct (bsc#1267458).\n- CVE-2026-46069: wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() (bsc#1267437).\n- CVE-2026-46071: KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 (bsc#1267591).\n- CVE-2026-46076: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (bsc#1267365).\n- CVE-2026-46101: netfilter: reject zero shift in nft_bitwise (bsc#1266878).\n- CVE-2026-46112: RDMA/hns: Fix unlocked call to hns_roce_qp_remove() (bsc#1267582).\n- CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267369).\n- CVE-2026-46119: libceph: Fix slab-out-of-bounds access in auth message processing (bsc#1267628).\n- CVE-2026-46120: ip6_gre: Use cached t-\u003enet in ip6erspan_changelink() (bsc#1267640).\n- CVE-2026-46123: Bluetooth: virtio_bt: clamp rx length before skb_put (bsc#1267621).\n- CVE-2026-46124: isofs: validate block number from NFS file handle in isofs_export_iget (bsc#1266847).\n- CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).\n- CVE-2026-46150: fanotify: fix false positive on permission events.\n- CVE-2026-46160: btrfs: fix missing last_unlink_trans update when removing a directory (bsc#1267624).\n- CVE-2026-46162: ice: fix double free in ice_sf_eth_activate() error path (bsc#1266840).\n- CVE-2026-46172: ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() (bsc#1266903).\n- CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267722).\n- CVE-2026-46185: smb/client: fix out-of-bounds read in symlink_data() (bsc#1266830).\n- CVE-2026-46197: drm/amdkfd: validate SVM ioctl nattr against buffer size (bsc#1267381).\n- CVE-2026-46214: vsock/virtio: fix accept queue count leak on transport mismatch (bsc#1267717).\n- CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267697).\n- CVE-2026-46229: drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure (bsc#1267567).\n- CVE-2026-46244: netfilter: nft_inner: Fix IPv6 inner_thoff desync (bsc#1267654).\n- CVE-2026-46253: pstore/ram: fix buffer overflow in persistent_ram_save_old() (bsc#1267635).\n- CVE-2026-46254: AppArmor: Allow apparmor to handle unaligned dfa tables (bsc#1267637).\n- CVE-2026-46259: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (bsc#1267685).\n- CVE-2026-46266: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (bsc#1267684).\n- CVE-2026-46273: ibmveth: Disable GSO for packets with small MSS (bsc#1265211 bsc#1267651).\n- CVE-2026-46289: lib/scatterlist: fix length calculations in extract_kvec_to_sg (bsc#1267966).\n- CVE-2026-46291: crypto: caam - guard HMAC key hex dumps in hash_digest_key (bsc#1267937).\n- CVE-2026-46315: io_uring/waitid: clear waitid info before copying it to userspace (bsc#1267953).\n- CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268022).\n- CVE-2026-46320: tap: free page on error paths in tap_get_user_xdp() (bsc#1267993).\n- CVE-2026-46328: apparmor: fix rlimit for posix cpu timers (bsc#1268037).\n- CVE-2026-52908: RDMA: During rereg_mr ensure that REREG_ACCESS is compatible (bsc#1268661).\n- CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268660).\n- CVE-2026-52918: Bluetooth: serialize accept_q access (bsc#1269100).\n- CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269033).\n- CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269022).\n- CVE-2026-52954: libceph: handle rbtree insertion error in decode_choose_args() (bsc#1269137).\n- CVE-2026-52957: libceph: Fix potential null-ptr-deref in decode_choose_args() (bsc#1269103).\n- CVE-2026-52962: ceph: fix a buffer leak in __ceph_setxattr() (bsc#1269135).\n- CVE-2026-52969: KVM: Reject wrapped offset in kvm_reset_dirty_gfn() (bsc#1269184).\n- CVE-2026-52972: crypto: af_alg - Cap AEAD AD length to 0x80000000 (bsc#1269195).\n- CVE-2026-53016: crypto: ccp - copy IV using skcipher ivsize (bsc#1269090).\n- CVE-2026-53040: ocfs2: validate bg_bits during freefrag scan (bsc#1269397).\n- CVE-2026-53041: ocfs2: fix listxattr handling when the buffer is full (bsc#1269398).\n- CVE-2026-53052: ASoC: qcom: qdsp6: topology: check widget type before accessing data (bsc#1269314).\n- CVE-2026-53053: iommu/amd: Fix clone_alias() to use the original device's devid (bsc#1269310).\n- CVE-2026-53071: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (bsc#1269678).\n- CVE-2026-53072: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (bsc#1269681).\n- CVE-2026-53122: btrfs: fix deadlock between reflink and transaction commit when using flushoncommit (bsc#1269418).\n- CVE-2026-53133: RDMA/umem: Fix truncation for block sizes \u003e= 4G (bsc#1269821).\n- CVE-2026-53138: drm/amd/display: Bound VBIOS record-chain walk loops (bsc#1269281).\n- CVE-2026-53182: wifi: nl80211: reject oversized EMA RNR lists (bsc#1269884).\n- CVE-2026-53253: Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling (bsc#1269574).\n- CVE-2026-53266: netfilter: bridge: make ebt_snat ARP rewrite writable (bsc#1269136).\n- CVE-2026-53281: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (bsc#1269519).\n- CVE-2026-53287: audit: fix incorrect inheritable capability in CAPSET records (bsc#1269506).\n- CVE-2026-53359: KVM: x86: Fix shadow paging use-after-free due to unexpected role (bsc#1270059).\n- CVE-2026-53362: ipv6: account for fraggap on the paged allocation path (bsc#1269493).\n\nThe following non security issues were fixed:\n\n- accel/ivpu: Fix signed integer truncation in IPC receive (git-fixes).\n- ACPI: CPPC: Suppress UBSAN warning caused by field misuse (git-fixes).\n- ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() (git-fixes).\n- ACPI: IPMI: Fix message kref handling on dead device (git-fixes).\n- ACPI: NFIT: core: Fix possible NULL pointer dereference (git-fixes).\n- ACPI: resource: Amend kernel-doc style (git-fixes).\n- agp/amd64: Fix broken error propagation in agp_amd64_probe() (git-fixes).\n- ALSA: aloop: Drop superfluous break (git-fixes).\n- ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser (git-fixes).\n- ALSA: cmipci: check snd_ctl_new1() return value (git-fixes).\n- ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() (git-fixes).\n- ALSA: es1938: check snd_ctl_new1() return value (git-fixes).\n- ALSA: firewire: isight: bound the sample count to the packet payload (git-fixes).\n- ALSA: gus: check snd_ctl_new1() return value (git-fixes).\n- ALSA: hda/cs35l41: Fix firmware load work teardown (git-fixes).\n- ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 (stable-fixes).\n- ALSA: ice1712: check snd_ctl_new1() return value (git-fixes).\n- ALSA: seq: Clear variable event pointer on read (git-fixes).\n- ALSA: seq: Fix kernel heap address leak in bounce_error_event() (git-fixes).\n- ALSA: seq: Fix partial userptr event expansion (git-fixes).\n- ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() (git-fixes).\n- ALSA: seq: midi: Serialize output teardown with event_input (git-fixes).\n- ALSA: timer: Fix UAF at snd_timer_user_params() (stable-fixes).\n- ALSA: usb-audio: avoid kobject path lookup in DualSense match (git-fixes).\n- ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints (git-fixes).\n- ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() (git-fixes).\n- ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks (git-fixes).\n- ALSA: usb-audio: Roll back quirk control caches on write errors (git-fixes).\n- ALSA: usb-audio: Update Babyface Pro control caches only after successful writes (git-fixes).\n- ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes (git-fixes).\n- ALSA: virtio: Add missing 384 kHz PCM rate mapping (git-fixes).\n- ALSA: ymfpci: check snd_ctl_new1() return value (git-fixes).\n- ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO (git-fixes).\n- ASoC: codecs: hdac_hdmi: Validate written enum value (git-fixes).\n- ASoC: cs35l56: Cleanup if component_probe fails (git-fixes).\n- ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails (git-fixes).\n- ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() (git-fixes).\n- ASoC: fsl: fsl_audmix: Validate written enum values (git-fixes).\n- ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count (git-fixes).\n- ASoC: mediatek: mt8183: Release reserved memory on cleanup (git-fixes).\n- ASoC: mediatek: mt8192: Release reserved memory on cleanup (git-fixes).\n- ASoC: meson: aiu: Validate written enum values (git-fixes).\n- ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback (git-fixes).\n- ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (git-fixes).\n- ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (git-fixes).\n- ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc (git-fixes).\n- ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (git-fixes).\n- ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put (git-fixes).\n- ASoC: SOF: topology: validate vendor array size before parsing (git-fixes).\n- ASoC: tegra: tegra210_ahub: Validate written enum value (git-fixes).\n- ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode (git-fixes).\n- ASoC: topology: Check PCM and DAI name strings before use (git-fixes).\n- ASoC: wm_adsp: Fix NULL dereference when removing firmware controls (git-fixes).\n- batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE (git-fixes).\n- batman-adv: tp_meter: add only finished tp_vars to lists (git-fixes).\n- batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd (git-fixes).\n- batman-adv: tp_meter: avoid window underflow (git-fixes).\n- batman-adv: tp_meter: fix fast recovery precondition (git-fixes).\n- batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection (git-fixes).\n- batman-adv: tp_meter: initialize dec_cwnd explicitly (git-fixes).\n- batman-adv: tp_meter: initialize dup_acks explicitly (git-fixes).\n- batman-adv: tp_meter: keep unacked list in ascending ordered (git-fixes).\n- Bluetooth: btmtk: fix URB leak in alloc_mtk_intr_urb error path (git-fixes).\n- Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() (git-fixes).\n- Bluetooth: btusb: fix use-after-free on marvell probe failure (git-fixes).\n- Bluetooth: btusb: fix use-after-free on registration failure (git-fixes).\n- Bluetooth: btusb: fix wakeup irq devres lifetime (git-fixes).\n- Bluetooth: btusb: fix wakeup source leak on probe failure (git-fixes).\n- Bluetooth: eir: Fix stack OOB write when prepending the Flags AD (git-fixes).\n- Bluetooth: hci: validate codec capability element length (git-fixes).\n- Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device (git-fixes).\n- Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig (stable-fixes).\n- Bluetooth: vhci: validate devcoredump state before side effects (git-fixes).\n- bnxt_en: Fix NULL pointer dereference (bsc#1268307).\n- bus: mhi: ep: Add missing state_lock protection for mhi_state access (git-fixes).\n- bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() (git-fixes).\n- bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path (git-fixes).\n- char: tlclk: fix use-after-free in tlclk_cleanup() (git-fixes).\n- crypto: af_alg - Cap AEAD AD length to 0x80000000 (git-fixes).\n- crypto: amlogic - avoid double cleanup in meson_crypto_probe() (git-fixes).\n- crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents (git-fixes).\n- crypto: atmel-sha204a - fix blocking and non-blocking rng logic (git-fixes).\n- crypto: cavium/cpt - fix DMA cleanup using wrong loop index (git-fixes).\n- crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one (git-fixes).\n- crypto: ccp - Treat zero-length cert chain as query for blob lengths (git-fixes).\n- crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels (git-fixes).\n- crypto: drbg - Fix returning success on failure in CTR_DRBG (git-fixes).\n- crypto: drbg - Fix the fips_enabled priority boost (git-fixes).\n- crypto: ecc - Fix carry overflow in vli multiplication (git-fixes).\n- crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve (git-fixes).\n- crypto: hisilicon/qm - disable error report before flr (git-fixes).\n- crypto: marvell/octeontx - fix DMA cleanup using wrong loop index (git-fixes).\n- crypto: pcrypt - restore callback for non-parallel fallback (git-fixes).\n- crypto: qat - protect service table iterations with service_lock (git-fixes).\n- crypto: qat - validate RSA CRT component lengths (git-fixes).\n- crypto: rng - Free default RNG on module exit (git-fixes).\n- dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK (git-fixes).\n- dmaengine: Fix possible use after free (git-fixes).\n- dmaengine: imx-sdma: Refine spba bus searching in probe (git-fixes).\n- dmaengine: qcom: gpi: set DMA_PRIVATE capability (git-fixes).\n- dmaengine: tegra: Fix burst size calculation (git-fixes).\n- driver core: reject devices with unregistered buses (git-fixes).\n- driver core: use READ_ONCE() for dev-\u003edriver in dev_has_sync_state() (git-fixes).\n- Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs (git-fixes).\n- drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs (stable-fixes).\n- drm/amd/display: Add missing kdoc for ALLM parameters (git-fixes).\n- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (stable-fixes).\n- drm/amd/pm: fix smu13 power limit default/cap calculation (stable-fixes).\n- drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2 (stable-fixes).\n- drm/amd/pm: remove trailing semicolon from AMDGPU_PM_POLICY_ATTR macro (git-fixes).\n- drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in set_soft_freq_limited_range (stable-fixes).\n- drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT (git-fixes).\n- drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() (git-fixes).\n- drm/amdgpu: initialize irq.lock spinlock earlier (git-fixes).\n- drm/amdgpu: restart the CS if some parts of the VM are still invalidated (stable-fixes).\n- drm/amdgpu: set sub_block_index for mca ras sub-blocks (git-fixes).\n- drm/amdgpu: skip already suspended IP blocks in ip_suspend_phase2 (git-fixes).\n- drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 (git-fixes).\n- drm/amdkfd: always resume_all after suspend_all (git-fixes).\n- drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free (git-fixes).\n- drm/amdkfd: Check for pdd drm file first in CRIU restore path (stable-fixes).\n- drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm (git-fixes).\n- drm/amdkfd: fix NULL pointer bug in svm_range_set_attr (stable-fixes).\n- drm/amdkfd: Use exclusive bounds for SVM split alignment checks (git-fixes).\n- drm/amdkfd: Validate CRIU-restored IDs before idr_alloc (git-fixes).\n- drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() (git-fixes).\n- drm/dp/mst: fix buffer overflows in sideband chunk accumulation (git-fixes).\n- drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers (git-fixes).\n- drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers (git-fixes).\n- drm/dp: Add eDP 1.5 bit definition (stable-fixes).\n- drm/edid: fix OOB read in drm_parse_tiled_block() (git-fixes).\n- drm/gpuvm: Do not prepare NULL objects (git-fixes).\n- drm/hisilicon/hibmc: move display contrl config to hibmc_probe() (git-fixes).\n- drm/hisilicon/hibmc: use clock to look up the PLL value (git-fixes).\n- drm/hyperv: use VMBUS_RING_SIZE() (git-fixes).\n- drm/i915/gem: Add missing nospec on parallel submit slot (git-fixes).\n- drm/i915/gem: Fix phys BO pread/pwrite with offset (git-fixes).\n- drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register (stable-fixes).\n- drm/i915: clear CRTC color blob pointers after dropping refs (git-fixes).\n- drm/imagination: Count paired job fence as dependency in prepare_job() (git-fixes).\n- drm/imagination: Fit paired fragment job in the correct CCCB (git-fixes).\n- drm/msm/dp: fix HPD state status bit shift value (git-fixes).\n- drm/msm/dp: Fix the ISR_* enum values (git-fixes).\n- drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() (git-fixes).\n- drm/nouveau/bios: specify correct display fuse register for Ampere and Ada (git-fixes).\n- drm/nouveau: fix reversed error cleanup order in ucopy functions (git-fixes).\n- drm/panthor: Fix kernel-doc warning in panthor_sched.c (git-fixes).\n- drm/radeon: fix integer overflow in radeon_align_pitch() (git-fixes).\n- drm/radeon: fix memory leak in radeon_ring_restore() on lock failure (git-fixes).\n- drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() (git-fixes).\n- drm/syncobj: Fix memory leak in drm_syncobj_find_fence() (git-fixes).\n- drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() (git-fixes).\n- drm/tegra: Fix iommu_map_sgtable() return value check (git-fixes).\n- drm/tidss: Drop extra drm_mode_config_reset() call (git-fixes).\n- drm/tidss: Fix missing drm_bridge_add() call (git-fixes).\n- drm/vc4: fix krealloc() memory leak (git-fixes).\n- drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() (git-fixes).\n- drm/virtio: Fix driver removal with disabled KMS (git-fixes).\n- drm/xe: fix refcount leak in xe_range_fence_insert() (git-fixes).\n- drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay (git-fixes).\n- ethtool: provide customized dim profile management (bsc#1261256).\n- fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() (git-fixes).\n- fbdev: hecubafb: fix potential memory leak in hecubafb_probe() (git-fixes).\n- fbdev: i740fb: fix potential memory leak in i740fb_probe() (git-fixes).\n- fbdev: metronomefb: fix potential memory leak in metronomefb_probe() (git-fixes).\n- fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode (git-fixes).\n- fbdev: nvidia: fix potential memory leak in nvidiafb_probe() (git-fixes).\n- fbdev: radeon: fix potential memory leak in radeonfb_pci_register() (git-fixes).\n- fbdev: s3fb: fix potential memory leak in s3_pci_probe() (git-fixes).\n- fbdev: sm501fb: Fix buffer errors in OF binding code (git-fixes).\n- fbdev: sm712: Fix operator precedence in big_swap macro (git-fixes).\n- fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() (git-fixes).\n- fbdev: tridentfb: fix potential memory leak in trident_pci_probe() (git-fixes).\n- fbdev: uvesafb: fix potential memory leak in uvesafb_probe() (git-fixes).\n- fbdev: vesafb: fix memory leak in vesafb_probe() (git-fixes).\n- firmware: arm_scmi: Fix OOB in scmi_power_name_get() (git-fixes).\n- firmware: arm_scmi: Read sensor config as 32-bit value (git-fixes).\n- firmware_loader: fix device reference leak in firmware_upload_register() (git-fixes).\n- firmware_loader: Fix recursive lock in device_cache_fw_images() (git-fixes).\n- fpga: dfl: add bounds check in dfh_get_param_size() (git-fixes).\n- fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() (git-fixes).\n- fpga: region: fix use-after-free in child_regions_with_firmware() (git-fixes).\n- gpio: mvebu: fix NULL pointer dereference in suspend/resume (git-fixes).\n- gpu: host1x: Allow entries in BO caches to be freed (git-fixes).\n- gpu: host1x: Fix iommu_map_sgtable() return value check (git-fixes).\n- HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter (git-fixes).\n- HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse (stable-fixes).\n- HID: wacom: stop hardware after post-start probe failures (git-fixes).\n- HID: wiimote: Fix table layout and whitespace errors (git-fixes).\n- hv: utils: handle and propagate errors in kvp_register (git-fixes).\n- hv_balloon: Simplify data output in hv_balloon_debug_show() (git-fixes).\n- hwmon: (it87) Clamp negative values to zero in set_fan() (git-fixes).\n- hwrng: jh7110 - fix refcount leak in starfive_trng_read() (git-fixes).\n- hwrng: virtio: clamp device-reported used.len at copy_data() (git-fixes).\n- hyperv: Clean up and fix the guest ID comment in hvgdk.h (git-fixes).\n- i2c: core: fix irq domain leak on adapter registration failure (git-fixes).\n- i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl (stable-fixes).\n- i2c: mpc: Fix timeout calculations (git-fixes).\n- i2c: qcom-cci: Fix NULL pointer dereference in cci_remove() (git-fixes).\n- i2c: stm32f7: fix timing computation ignoring i2c-analog-filter (git-fixes).\n- i2c: stm32f7: truncate clock period instead of rounding it (git-fixes).\n- i2c: tegra: Fix NOIRQ suspend/resume (git-fixes).\n- i3c: master: Prevent reuse of dynamic address on device add failure (git-fixes).\n- ice: ptp: don't WARN when controlling PF is unavailable (bsc#1267251).\n- iio: accel: mma8452: handle I2C read error(s) in mma8452_read() (git-fixes).\n- iio: adc: npcm: Convert to platform remove callback returning void (stable-fixes).\n- iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling (git-fixes).\n- iio: chemical: scd30: Cleanup initializations and fix sign-extension bug (git-fixes).\n- iio: chemical: scd30: fix division by zero in write_raw (git-fixes).\n- iio: chemical: scd30: Use guard(mutex) to allow early returns (stable-fixes).\n- iio: gyro: bmg160: bail out when bandwidth/filter is not in table (git-fixes).\n- iio: gyro: bmg160: wait full startup time after mode change at probe (git-fixes).\n- iio: light: opt3001: fix missing state reset on timeout (git-fixes).\n- iio: light: si1133: prevent race condition on timeout (git-fixes).\n- iio: light: si1133: reset counter to prevent race condition (git-fixes).\n- iio: light: veml6030: fix channel type when pushing events (git-fixes).\n- iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call (git-fixes).\n- iio: magnetometer: ak8975: fix potential kernel stack memory leak (git-fixes).\n- iio: tcs3472: power down chip on probe failure (git-fixes).\n- iio: temperature: ltc2983: Fix reinit_completion() called after conversion start (git-fixes).\n- Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) (stable-fixes).\n- Input: elan_i2c - validate firmware size before use (stable-fixes).\n- Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 (stable-fixes).\n- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (git-fixes).\n- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (git-fixes).\n- Input: xpad - add 'Nova 2 Lite' from GameSir (stable-fixes).\n- Input: xpad - add support for ASUS ROG RAIKIRI II (stable-fixes).\n- iommu/s390: allow larger region tables (jsc#PED-15880).\n- iommu/s390: Fix memory corruption when using identity domain (jsc#PED-15880).\n- iommu/s390: handle IOAT registration based on domain (jsc#PED-15880).\n- iommu/s390: implement iommu passthrough via identity domain (jsc#PED-15880).\n- iommu/s390: set appropriate IOTA region type (jsc#PED-15880).\n- iommu/s390: support cleanup of additional table regions (jsc#PED-15880).\n- iommu/s390: support iova_to_phys for additional table regions (jsc#PED-15880).\n- iommu/s390: support map/unmap for additional table regions (jsc#PED-15880).\n- KVM: arm64: Discard PC update state on vcpu reset (git-fixes).\n- KVM: arm64: Guard against NULL vcpu on VHE hyp panic path (git-fixes).\n- KVM: arm64: PMU: Preserve AArch32 counter low bits (git-fixes).\n- KVM: arm64: Treat vCPU with pending SError as runnable (git-fixes).\n- KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits (git-fixes).\n- KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes).\n- KVM: arm64: Wake-up from WFI when iqrchip is in userspace (git-fixes).\n- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (git-fixes).\n- KVM: nSVM: Ensure AVIC is inhibited when restoring a vCPU to guest mode (git-fixes).\n- KVM: nSVM: Mark all of vmcb02 dirty when restoring nested state (git-fixes).\n- KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) (git-fixes).\n- KVM: s390: Limit adapter indicator access to mapped page (bsc#1268159).\n- KVM: SEV: Ignore MMIO requests of length '0' (git-fixes).\n- KVM: SEV: Ignore Port I/O requests of length '0' (git-fixes).\n- KVM: SVM: Allow KVM_SET_NESTED_STATE to clear GIF when SVME==0 (git-fixes).\n- KVM: SVM: check validity of VMCB controls when returning from SMM (git-fixes).\n- KVM: SVM: Don't set GIF when clearing EFER.SVME (git-fixes).\n- KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (git-fixes).\n- KVM: SVM: Flush the current TLB when transitioning from xAVIC =\u003e x2AVIC (git-fixes).\n- KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 (git-fixes).\n- KVM: SVM: Truncate INVLPGA address in compatibility mode (git-fixes).\n- KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode (git-fixes).\n- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (git-fixes).\n- KVM: x86/mmu: Fix UBSAN warning when reading nx_huge_pages parameter (git-fixes).\n- KVM: x86/mmu: Recursively zap orphaned nested TDP shadow pages on emulated writes (git-fixes).\n- KVM: x86: hyper-v: Bound the bank index when querying sparse banks (git-fixes).\n- KVM: x86: ioapic: Use old_dest_mode consistently in ioapic_write_indirect() (git-fixes).\n- KVM: x86: Move update_cr8_intercept() to lapic.c (git-fixes).\n- KVM: x86: Unconditionally recompute CR8 intercept on PPR update (git-fixes).\n- leds: uleds: Fix potential buffer overread (git-fixes).\n- linux/dim: move useful macros to .h file (bsc#1261256).\n- loadpin: Prevent SECURITY_LOADPIN_ENFORCE=y without module decompression (jsc#PED-16303).\n- loadpin: remove MODULE_COMPRESS_NONE as it is no longer supported (jsc#PED-16303).\n- mailbox: mtk-adsp: fix UAF during device teardown (git-fixes).\n- media: aspeed: fix missing of_reserved_mem_device_release() on probe failure (git-fixes).\n- media: cec: seco: unregister adapter on IR probe failure (git-fixes).\n- media: cedrus: Fix failure to clean up hardware on probe failure (git-fixes).\n- media: cedrus: Fix missing cleanup in error path (git-fixes).\n- media: cedrus: skip invalid H.264 reference list entries (git-fixes).\n- media: marvell-cam: fix missing pci_disable_device() on remove (git-fixes).\n- media: mtk-jpeg: cancel workqueue on release for supported platforms only (git-fixes).\n- media: pci: dm1105: Free allocated workqueue (git-fixes).\n- media: ti: vpe: unwind v4l2 device registration on probe error (git-fixes).\n- media: v4l2-ctrls: validate HEVC active reference counts (git-fixes).\n- media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si (git-fixes).\n- media: vidtv: fix reference leak on failed device registration (git-fixes).\n- media: vimc: fix reference leak on failed device registration (git-fixes).\n- media: vpif_capture: fix OF node reference imbalance (git-fixes).\n- misc: fastrpc: fix DMA address corruption due to find_vma misuse (git-fixes).\n- misc: fastrpc: Fix NULL pointer dereference in rpmsg callback (git-fixes).\n- misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context (git-fixes).\n- misc: fastrpc: fix use-after-free race in fastrpc_map_create (git-fixes).\n- module: fix init_module_from_file() error handling (jsc#PED-16303).\n- module: make waiting for a concurrent module loader interruptible (jsc#PED-16303).\n- module: Split modules_install compression and in-kernel decompression (jsc#PED-16303).\n- module: split up 'finit_module()' into init_module_from_file() helper (jsc#PED-16303).\n- module: warn about excessively long module waits (jsc#PED-16303).\n- modules: catch concurrent module loads, treat them as idempotent (jsc#PED-16303).\n- mtd: maps: vmu-flash: fix NULL pointer dereference in initialization (git-fixes).\n- mtd: rawnand: fix condition in 'nand_select_target()' (git-fixes).\n- mtd: rawnand: pl353: fix probe resource allocation (git-fixes).\n- mtd: slram: remove failed entries from the device list (git-fixes).\n- mtd: spi-nor: Drop duplicate Kconfig dependency (git-fixes).\n- mtd: spi-nor: swp: Improve locking user experience (git-fixes).\n- net: aquantia: Add missing descriptor cache invalidation on ATL2 (bsc#1268428).\n- net: ethtool: add ethtool COALESCE_RX_CQE_FRAMES/NSECS (bsc#1261256).\n- net: mana: Add ethtool counters for RX CQEs in coalesced type (bsc#1261256).\n- net: mana: Add support for PF device 0x00C1 (bsc#1268237).\n- net: mana: Add support for RX CQE Coalescing (bsc#1261256).\n- net: mana: Allocate interrupt context for each EQ when creating vPort (git-fixes).\n- net: mana: Create separate EQs for each vPort (git-fixes).\n- net: mana: Fall back to standard MTU when PF reports adapter_mtu of 0 (git-fixes).\n- net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check (git-fixes).\n- net: mana: initialize gdma queue id to INVALID_QUEUE_ID (git-fixes).\n- net: mana: Introduce GIC context with refcounting for interrupt management (git-fixes).\n- net: mana: Optimize irq affinity for low vcpu configs (git-fixes).\n- net: mana: Query device capabilities and configure MSI-X sharing for EQs (git-fixes).\n- net: mana: Use GIC functions to allocate global EQs (git-fixes).\n- nfc: hci: fix out-of-bounds read in HCP header parsing (git-fixes).\n- nfc: llcp: Fix use-after-free in llcp_sock_release() (git-fixes).\n- nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (git-fixes).\n- of: cpu: add check in __of_find_n_match_cpu_property() (git-fixes).\n- page_pool: Move pp_magic check into helper functions (bsc#1261562).\n- page_pool: Track DMA-mapped pages and unmap them when destroying the pool (bsc#1261562).\n- platform/x86: intel-hid: Protect ACPI notify handler against recursion (git-fixes).\n- platform/x86: xo15-ebook: Fix wakeup source and GPE handling (git-fixes).\n- PM: sleep: Use complete() in device_pm_sleep_init() (git-fixes).\n- power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() (git-fixes).\n- power: supply: charger-manager: fix refcount leak in is_full_charged() (git-fixes).\n- power: supply: core: fix supplied_from allocations (git-fixes).\n- power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak (git-fixes).\n- powerpc/boot: Allow text relocations for pseries wrapper with binutils 2.46+ (git-fixes).\n- powerpc/fadump: define MIN_RMA in bytes rather than MB (bsc#1236743 git-fixes).\n- RDMA/mana_ib: Allocate interrupt contexts on EQs (git-fixes).\n- RDMA/mana_ib: Use ib_get_eth_speed for reporting port speed (git-fixes).\n- rtc: abx80x: fix the RTC_VL_CLR clearing all status flags (git-fixes).\n- rtc: cmos: unregister HPET IRQ handler on probe failure (git-fixes).\n- rtc: ds1307: Fix off-by-one issue with wday for rx8130 (git-fixes).\n- rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 (git-fixes).\n- rtc: mpfs: fix counter upload completion condition (git-fixes).\n- rtc: msc313: fix NULL deref in shared IRQ handler at probe (git-fixes).\n- s390/pci: check for relaxed translation capability (jsc#PED-15880).\n- s390/pci: Fix dev.dma_range_map missing sentinel element (jsc#PED-15880).\n- s390/pci: store DMA offset in bus_dma_region (jsc#PED-15880).\n- scripts/submit_branch: add SLE15-SP7 submission script.\n- scsi: storvsc: Replace symbolic permissions with octal (git-fixes).\n- scsi: target: Fix hexadecimal CHAP_I handling (git-fixes).\n- selftests/bpf: Add BPF_STRICT_BUILD toggle (bsc#1269617).\n- selftests/bpf: Allow test_progs to link with a partial object set (bsc#1269617).\n- selftests/bpf: Fix test_kmods KDIR to honor O= and distro kernels (bsc#1269617).\n- selftests/bpf: Make skeleton headers order-only prerequisites of .test.d (bsc#1269617).\n- selftests/bpf: Provide weak definitions for cross-test functions (bsc#1269617).\n- selftests/bpf: Skip tests whose objects were not built (bsc#1269617).\n- selftests/bpf: Tolerate benchmark build failures (bsc#1269617).\n- selftests/bpf: Tolerate BPF and skeleton generation failures (bsc#1269617).\n- selftests/bpf: Tolerate missing files during install (bsc#1269617).\n- selftests/bpf: Tolerate test file compilation failures (bsc#1269617).\n- serdev: make serdev_bus_type const (stable-fixes).\n- serial: 8250: dispatch SysRq character in serial8250_handle_irq() (git-fixes).\n- serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq() (git-fixes).\n- slimbus: qcom-ngd-ctrl: fix OF node refcount (git-fixes).\n- soc: fsl: qe: panic on ioremap() failure in qe_reset() (git-fixes).\n- soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy (git-fixes).\n- spi: at91-usart: drop dead runtime pm support (git-fixes).\n- spi: dw: fix wrong BAUDR setting after resume (git-fixes).\n- spi: ep93xx: fix double-free of zeropage on DMA setup failure (git-fixes).\n- spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() (git-fixes).\n- spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (git-fixes).\n- spi: meson-spifc: fix runtime PM leak on remove (git-fixes).\n- spi: rpc-if: Use correct device for hardware reinitialization on resume (git-fixes).\n- spi: uniphier: Fix completion initialization order before devm_request_irq() (git-fixes).\n- spi: xilinx: use FIFO occupancy register to determine buffer size (git-fixes).\n- Split off kABI workaround for bsc#1267458 (bsc#1267458).\n- staging: most: video: avoid double free on video register failure (git-fixes).\n- staging: nvec: fix use-after-free in nvec_rx_completed() (git-fixes).\n- thermal: hwmon: Fix critical temperature attribute removal (git-fixes).\n- thermal: intel: Fix dangling resources on thermal_throttle_online() failure (git-fixes).\n- thunderbolt: Bound root directory content to block size (git-fixes).\n- thunderbolt: Clamp XDomain response data copy to allocation size (git-fixes).\n- thunderbolt: Limit XDomain response copy to actual frame size (git-fixes).\n- thunderbolt: Reject zero-length property entries in validator (git-fixes).\n- thunderbolt: Validate XDomain request packet size before type cast (git-fixes).\n- tpm: fix event_size output in tpm1_binary_bios_measurements_show (git-fixes).\n- tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() (git-fixes).\n- usb: core: Fix SuperSpeed root hub wMaxPacketSize (stable-fixes).\n- usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval (stable-fixes).\n- usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo (git-fixes).\n- usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() (git-fixes).\n- usb: host: max3421: Reject hub port requests for non-existent ports (git-fixes).\n- USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers (stable-fixes).\n- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (git-fixes).\n- USB: serial: io_ti: fix heap overflow in get_manuf_info() (git-fixes).\n- USB: serial: kl5kusb105: fix bulk-out buffer overflow (git-fixes).\n- USB: serial: option: add MeiG SRM813Q (stable-fixes).\n- USB: serial: option: add usb-id for Dell Wireless DW5826e-m (stable-fixes).\n- usb: storage: Add quirks for PNY Elite Portable SSD (stable-fixes).\n- usb: typec: altmodes/displayport: validate count before reading Status Update VDO (stable-fixes).\n- usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT (stable-fixes).\n- usb: typec: ucsi: ccg: reject firmware images without a ':' record header (stable-fixes).\n- usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (stable-fixes).\n- usb: typec: ucsi: validate connector number in ucsi_connector_change() (stable-fixes).\n- usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() (stable-fixes).\n- vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write (git-fixes).\n- watchdog/hpwdt: Refine hpwdt message for UV platform (bsc#1269199).\n- watchdog: apple: Add 'apple,t8103-wdt' compatible (git-fixes).\n- watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH (git-fixes).\n- watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure (git-fixes).\n- watchdog: unregister PM notifier on watchdog unregister (git-fixes).\n- wifi: ath9k: fix OOB access from firmware tx status queue ID (git-fixes).\n- wifi: ath11k: fix warning when unbinding (git-fixes).\n- wifi: cfg80211: fix grammar in MLO group key error message (git-fixes).\n- wifi: mac80211: fix monitor mode frame capture for real chanctx drivers (git-fixes).\n- wifi: mt76: fix argument to ieee80211_is_first_frag() (git-fixes).\n- wifi: mt76: mt7915: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7921: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7925: clean up DMA on probe failure (git-fixes).\n- wifi: mt76: mt7925: fix potential tx_retries underflow (git-fixes).\n- wifi: mt76: mt7996: fix potential tx_retries underflow (git-fixes).\n- wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor (git-fixes).\n- wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer (git-fixes).\n- wifi: rtw88: increase TX report timeout to fix race condition (git-fixes).\n- wifi: rtw88: usb: fix memory leaks on USB write failures (git-fixes).\n- wifi: rtw89: Correct data type for scan index to avoid infinite loop (git-fixes).\n- wifi: wcn36xx: fix heap overflow from oversized firmware HAL response (git-fixes).\n- wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication (git-fixes).\n- wifi: wcn36xx: fix OOB read from short trigger BA firmware response (git-fixes).\n- x86/platform/uv: Expose the uv_hub_type() interface (jsc#PED-16305).\n- x86/tsc: Disable clocksource watchdog checking on recent and future UV platforms (jsc#PED-16305).\n- X.509: Fix validation of ASN.1 certificate header (git-fixes).\n","status":"published","published":"2026-07-08T14:58:16Z","modified":"2026-07-09T10:00:04.592679052Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:2800-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2025-40216: io_uring/rsrc: don't rely on user vaddr alignment (bsc#1259764).\n- CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).\n- CVE-2025-71294: drm/amdgpu: fix NULL pointer issue buffer funcs (bsc#1264562).\n- CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).\n- CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).\n- CVE-2026-31462: drm/amdgpu: prevent immediate PASID reuse case (bsc#1262655).\n- CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).\n- CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).\n- CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).\n- CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).\n- CVE-2026-31677: crypto: af_alg - limit RX SG extraction by receive buffer budget (bsc#1263560).\n- CVE-2026-31697: crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (bsc#1264116).\n- CVE-2026-31698: crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (bsc#1263880).\n- CVE-2026-31699: crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (bsc#1263879).\n- CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).\n- CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).\n- CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).\n- CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).\n- CVE-2026-43053: xfs: close crash window in attr dabtree inactivation (bsc#1264084).\n- CVE-2026-43074: eventpoll: defer struct eventpoll free to RCU grace period (bsc#1264263).\n- CVE-2026-43079: perf/x86/intel/uncore: Skip discovery table for offline dies (bsc#1264228).\n- CVE-2026-43080: l2tp: Drop large packets with UDP encap (bsc#1264236).\n- CVE-2026-43081: net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ (bsc#1264241).\n- CVE-2026-43085: netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (bsc#1264230).\n- CVE-2026-43086: ipvs: fix NULL deref in ip_vs_add_service error path (bsc#1264286).\n- CVE-2026-43089: xfrm_user: fix info leak in build_mapping() (bsc#1264261).\n- CVE-2026-43093: xsk: tighten UMEM headroom validation to account for tailroom and min frame (bsc#1264254).\n- CVE-2026-43094: ixgbevf: add missing negotiate_features op to Hyper-V ops table (bsc#1264231).\n- CVE-2026-43107: xfrm: account XFRMA_IF_ID in aevent size calculation (bsc#1264258).\n- CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484).\n- CVE-2026-43128: RDMA/umem: Fix double dma_buf_unpin in failure path (bsc#1264612).\n- CVE-2026-43139: xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (bsc#1264294).\n- CVE-2026-43233: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (bsc#1264337).\n- CVE-2026-43238: net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (bsc#1264320).\n- CVE-2026-43303: mm/page_alloc: clear page-\u003eprivate in free_pages_prepare() (bsc#1264974).\n- CVE-2026-43336: lib/crypto: chacha: Zeroize permuted_state before it leaves scope (bsc#1265113).\n- CVE-2026-43420: ceph: fix i_nlink underrun during async unlink (bsc#1264814).\n- CVE-2026-43456: bonding: fix type confusion in bond_setup_by_slave() (bsc#1264734).\n- CVE-2026-43472: unshare: fix unshare_fs() handling (bsc#1264748).\n- CVE-2026-43492: lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() (bsc#1265629).\n- CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).\n- CVE-2026-45838: bpf: fix end-of-list detection in cgroup_storage_get_next_key() (bsc#1266396).\n- CVE-2026-45848: apparmor: fix NULL sock in aa_sock_file_perm (bsc#1266734).\n- CVE-2026-45891: net: hns3: fix double free issue for tx spare buffer (bsc#1266717).\n- CVE-2026-45912: ext4: don't cache extent during splitting extent (bsc#1266899).\n- CVE-2026-45948: ext4: fix memory leak in ext4_ext_shift_extents() (bsc#1266929).\n- CVE-2026-45985: ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O (bsc#1266700).\n- CVE-2026-46028: crypto: algif_aead - snapshot IV for async AEAD requests (bsc#1267430).\n- CVE-2026-46053: net: rds: fix MR cleanup on copy error (bsc#1267427).\n- CVE-2026-46063: x86/shstk: Prevent deadlock during shstk sigreturn (bsc#1267228).\n- CVE-2026-46065: fbdev: defio: Disconnect deferred I/O from the lifetime of struct (bsc#1267458).\n- CVE-2026-46069: wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() (bsc#1267437).\n- CVE-2026-46071: KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 (bsc#1267591).\n- CVE-2026-46076: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (bsc#1267365).\n- CVE-2026-46112: RDMA/hns: Fix unlocked call to hns_roce_qp_remove() (bsc#1267582).\n- CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267369).\n- CVE-2026-46120: ip6_gre: Use cached t-\u003enet in ip6erspan_changelink() (bsc#1267640).\n- CVE-2026-46124: isofs: validate block number from NFS file handle in isofs_export_iget (bsc#1266847).\n- CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).\n- CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267722).\n- CVE-2026-46185: smb/client: fix out-of-bounds read in symlink_data() (bsc#1266830).\n- CVE-2026-46197: drm/amdkfd: validate SVM ioctl nattr against buffer size (bsc#1267381).\n- CVE-2026-46214: vsock/virtio: fix accept queue count leak on transport mismatch (bsc#1267717).\n- CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267697).\n- CVE-2026-46229: drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure (bsc#1267567).\n- CVE-2026-46253: pstore/ram: fix buffer overflow in persistent_ram_save_old() (bsc#1267635).\n- CVE-2026-46254: AppArmor: Allow apparmor to handle unaligned dfa tables (bsc#1267637).\n- CVE-2026-46266: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (bsc#1267684).\n- CVE-2026-46289: lib/scatterlist: fix length calculations in extract_kvec_to_sg (bsc#1267966).\n- CVE-2026-46291: crypto: caam - guard HMAC key hex dumps in hash_digest_key (bsc#1267937).\n- CVE-2026-46315: io_uring/waitid: clear waitid info before copying it to userspace (bsc#1267953).\n- CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268022).\n- CVE-2026-46320: tap: free page on error paths in tap_get_user_xdp() (bsc#1267993).\n- CVE-2026-46328: apparmor: fix rlimit for posix cpu timers (bsc#1268037).\n- CVE-2026-46330: Revert 'net/smc: Introduce TCP ULP support' (bsc#1268049).\n- CVE-2026-46331: net/sched: fix pedit partial COW leading to page cache (bsc#1265421).\n- CVE-2026-52908: RDMA: During rereg_mr ensure that REREG_ACCESS is compatible (bsc#1268661).\n- CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268660).\n- CVE-2026-52918: Bluetooth: serialize accept_q access (bsc#1269100).\n- CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269033).\n- CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269022).\n- CVE-2026-52954: libceph: handle rbtree insertion error in decode_choose_args() (bsc#1269137).\n- CVE-2026-52957: libceph: Fix potential null-ptr-deref in decode_choose_args() (bsc#1269103).\n- CVE-2026-52962: ceph: fix a buffer leak in __ceph_setxattr() (bsc#1269135).\n- CVE-2026-52969: KVM: Reject wrapped offset in kvm_reset_dirty_gfn() (bsc#1269184).\n- CVE-2026-52972: crypto: af_alg - Cap AEAD AD length to 0x80000000 (bsc#1269195).\n- CVE-2026-53016: crypto: ccp - copy IV using skcipher ivsize (bsc#1269090).\n- CVE-2026-53040: ocfs2: validate bg_bits during freefrag scan (bsc#1269397).\n- CVE-2026-53041: ocfs2: fix listxattr handling when the buffer is full (bsc#1269398).\n- CVE-2026-53052: ASoC: qcom: qdsp6: topology: check widget type before accessing data (bsc#1269314).\n- CVE-2026-53053: iommu/amd: Fix clone_alias() to use the original device's devid (bsc#1269310).\n- CVE-2026-53071: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (bsc#1269678).\n- CVE-2026-53072: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (bsc#1269681).\n- CVE-2026-53122: btrfs: fix deadlock between reflink and transaction commit when using flushoncommit (bsc#1269418).\n- CVE-2026-53133: RDMA/umem: Fix truncation for block sizes \u003e= 4G (bsc#1269821).\n- CVE-2026-53138: drm/amd/display: Bound VBIOS record-chain walk loops (bsc#1269281).\n- CVE-2026-53182: wifi: nl80211: reject oversized EMA RNR lists (bsc#1269884).\n- CVE-2026-53253: Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling (bsc#1269574).\n- CVE-2026-53266: netfilter: bridge: make ebt_snat ARP rewrite writable (bsc#1269136).\n- CVE-2026-53281: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (bsc#1269519).\n- CVE-2026-53287: audit: fix incorrect inheritable capability in CAPSET records (bsc#1269506).\n- CVE-2026-53359: KVM: x86: Fix shadow paging use-after-free due to unexpected role (bsc#1270059).\n- CVE-2026-53362: ipv6: account for fraggap on the paged allocation path (bsc#1269493).\n\n\nThe following non security issues were fixed:\n\n- ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() (git-fixes).\n- ACPI: resource: Amend kernel-doc style (git-fixes).\n- ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser (git-fixes).\n- ALSA: firewire: isight: bound the sample count to the packet payload (git-fixes).\n- ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 (stable-fixes).\n- ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() (git-fixes).\n- ALSA: timer: Fix UAF at snd_timer_user_params() (stable-fixes).\n- ALSA: usb-audio: avoid kobject path lookup in DualSense match (git-fixes).\n- ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints (git-fixes).\n- ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count (git-fixes).\n- ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback (git-fixes).\n- ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode (git-fixes).\n- Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig (stable-fixes).\n- bnxt_en: Fix NULL pointer dereference (bsc#1268307).\n- bus: mhi: ep: Add missing state_lock protection for mhi_state access (git-fixes).\n- bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() (git-fixes).\n- bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path (git-fixes).\n- char: tlclk: fix use-after-free in tlclk_cleanup() (git-fixes).\n- dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK (git-fixes).\n- dmaengine: Fix possible use after free (git-fixes).\n- dmaengine: imx-sdma: Refine spba bus searching in probe (git-fixes).\n- dmaengine: qcom: gpi: set DMA_PRIVATE capability (git-fixes).\n- dmaengine: tegra: Fix burst size calculation (git-fixes).\n- Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs (git-fixes).\n- drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs (stable-fixes).\n- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (stable-fixes).\n- drm/amd/pm: fix smu13 power limit default/cap calculation (stable-fixes).\n- drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2 (stable-fixes).\n- drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in set_soft_freq_limited_range (stable-fixes).\n- drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT (git-fixes).\n- drm/amdgpu: initialize irq.lock spinlock earlier (git-fixes).\n- drm/amdgpu: restart the CS if some parts of the VM are still invalidated (stable-fixes).\n- drm/amdgpu: skip already suspended IP blocks in ip_suspend_phase2 (git-fixes).\n- drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1 (git-fixes).\n- drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free (git-fixes).\n- drm/amdkfd: Check for pdd drm file first in CRIU restore path (stable-fixes).\n- drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm (git-fixes).\n- drm/amdkfd: fix NULL pointer bug in svm_range_set_attr (stable-fixes).\n- drm/amdkfd: Use exclusive bounds for SVM split alignment checks (git-fixes).\n- drm/dp: Add eDP 1.5 bit definition (stable-fixes).\n- drm/edid: fix OOB read in drm_parse_tiled_block() (git-fixes).\n- drm/i915/gem: Add missing nospec on parallel submit slot (git-fixes).\n- drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register (stable-fixes).\n- drm/i915: clear CRTC color blob pointers after dropping refs (git-fixes).\n- drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() (git-fixes).\n- drm/nouveau: fix reversed error cleanup order in ucopy functions (git-fixes).\n- ethtool: provide customized dim profile management (bsc#1261256).\n- fpga: dfl: add bounds check in dfh_get_param_size() (git-fixes).\n- fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() (git-fixes).\n- fpga: region: fix use-after-free in child_regions_with_firmware() (git-fixes).\n- HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter (git-fixes).\n- HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse (stable-fixes).\n- HID: wacom: stop hardware after post-start probe failures (git-fixes).\n- HID: wiimote: Fix table layout and whitespace errors (git-fixes).\n- hv: utils: handle and propagate errors in kvp_register (git-fixes).\n- hv_balloon: Simplify data output in hv_balloon_debug_show() (git-fixes).\n- hyperv: Clean up and fix the guest ID comment in hvgdk.h (git-fixes).\n- i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl (stable-fixes).\n- i2c: mpc: Fix timeout calculations (git-fixes).\n- i2c: stm32f7: truncate clock period instead of rounding it (git-fixes).\n- i3c: master: Prevent reuse of dynamic address on device add failure (git-fixes).\n- iio: accel: mma8452: handle I2C read error(s) in mma8452_read() (git-fixes).\n- iio: adc: npcm: Convert to platform remove callback returning void (stable-fixes).\n- iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling (git-fixes).\n- iio: chemical: scd30: Cleanup initializations and fix sign-extension bug (git-fixes).\n- iio: chemical: scd30: fix division by zero in write_raw (git-fixes).\n- iio: chemical: scd30: Use guard(mutex) to allow early returns (stable-fixes).\n- iio: gyro: bmg160: bail out when bandwidth/filter is not in table (git-fixes).\n- iio: gyro: bmg160: wait full startup time after mode change at probe (git-fixes).\n- iio: light: opt3001: fix missing state reset on timeout (git-fixes).\n- iio: light: si1133: prevent race condition on timeout (git-fixes).\n- iio: light: si1133: reset counter to prevent race condition (git-fixes).\n- iio: light: veml6030: fix channel type when pushing events (git-fixes).\n- iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call (git-fixes).\n- iio: magnetometer: ak8975: fix potential kernel stack memory leak (git-fixes).\n- iio: tcs3472: power down chip on probe failure (git-fixes).\n- iio: temperature: ltc2983: Fix reinit_completion() called after conversion start (git-fixes).\n- Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK) (stable-fixes).\n- Input: elan_i2c - validate firmware size before use (stable-fixes).\n- Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490 (stable-fixes).\n- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (git-fixes).\n- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (git-fixes).\n- Input: xpad - add 'Nova 2 Lite' from GameSir (stable-fixes).\n- Input: xpad - add support for ASUS ROG RAIKIRI II (stable-fixes).\n- iommu/s390: allow larger region tables (jsc#PED-15880).\n- iommu/s390: Fix memory corruption when using identity domain (jsc#PED-15880).\n- iommu/s390: handle IOAT registration based on domain (jsc#PED-15880).\n- iommu/s390: implement iommu passthrough via identity domain (jsc#PED-15880).\n- iommu/s390: set appropriate IOTA region type (jsc#PED-15880).\n- iommu/s390: support cleanup of additional table regions (jsc#PED-15880).\n- iommu/s390: support iova_to_phys for additional table regions (jsc#PED-15880).\n- iommu/s390: support map/unmap for additional table regions (jsc#PED-15880).\n- KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN) (git-fixes).\n- KVM: s390: Limit adapter indicator access to mapped page (bsc#1268159).\n- KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (git-fixes).\n- KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 (git-fixes).\n- KVM: SVM: Truncate INVLPGA address in compatibility mode (git-fixes).\n- KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode (git-fixes).\n- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (git-fixes).\n- KVM: x86/mmu: Recursively zap orphaned nested TDP shadow pages on emulated writes (git-fixes).\n- KVM: x86: hyper-v: Bound the bank index when querying sparse banks (git-fixes).\n- KVM: x86: ioapic: Use old_dest_mode consistently in ioapic_write_indirect() (git-fixes).\n- KVM: x86: Move update_cr8_intercept() to lapic.c (git-fixes).\n- KVM: x86: Unconditionally recompute CR8 intercept on PPR update (git-fixes).\n- leds: uleds: Fix potential buffer overread (git-fixes).\n- linux/dim: move useful macros to .h file (bsc#1261256).\n- loadpin: Prevent SECURITY_LOADPIN_ENFORCE=y without module decompression (jsc#PED-16303).\n- loadpin: remove MODULE_COMPRESS_NONE as it is no longer supported (jsc#PED-16303).\n- mailbox: mtk-adsp: fix UAF during device teardown (git-fixes).\n- media: aspeed: fix missing of_reserved_mem_device_release() on probe failure (git-fixes).\n- media: cec: seco: unregister adapter on IR probe failure (git-fixes).\n- media: cedrus: Fix failure to clean up hardware on probe failure (git-fixes).\n- media: cedrus: Fix missing cleanup in error path (git-fixes).\n- media: cedrus: skip invalid H.264 reference list entries (git-fixes).\n- media: marvell-cam: fix missing pci_disable_device() on remove (git-fixes).\n- media: mtk-jpeg: cancel workqueue on release for supported platforms only (git-fixes).\n- media: pci: dm1105: Free allocated workqueue (git-fixes).\n- media: ti: vpe: unwind v4l2 device registration on probe error (git-fixes).\n- media: v4l2-ctrls: validate HEVC active reference counts (git-fixes).\n- media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si (git-fixes).\n- media: vidtv: fix reference leak on failed device registration (git-fixes).\n- media: vimc: fix reference leak on failed device registration (git-fixes).\n- media: vpif_capture: fix OF node reference imbalance (git-fixes).\n- module: fix init_module_from_file() error handling (jsc#PED-16303).\n- module: make waiting for a concurrent module loader interruptible (jsc#PED-16303).\n- module: Split modules_install compression and in-kernel decompression (jsc#PED-16303).\n- module: split up 'finit_module()' into init_module_from_file() helper (jsc#PED-16303).\n- module: warn about excessively long module waits (jsc#PED-16303).\n- modules: catch concurrent module loads, treat them as idempotent (jsc#PED-16303).\n- mtd: maps: vmu-flash: fix NULL pointer dereference in initialization (git-fixes).\n- mtd: rawnand: fix condition in 'nand_select_target()' (git-fixes).\n- mtd: rawnand: pl353: fix probe resource allocation (git-fixes).\n- mtd: slram: remove failed entries from the device list (git-fixes).\n- mtd: spi-nor: Drop duplicate Kconfig dependency (git-fixes).\n- mtd: spi-nor: swp: Improve locking user experience (git-fixes).\n- net: aquantia: Add missing descriptor cache invalidation on ATL2 (bsc#1268428).\n- net: ethtool: add ethtool COALESCE_RX_CQE_FRAMES/NSECS (bsc#1261256).\n- net: mana: Add ethtool counters for RX CQEs in coalesced type (bsc#1261256).\n- net: mana: Add support for PF device 0x00C1 (bsc#1268237).\n- net: mana: Add support for RX CQE Coalescing (bsc#1261256).\n- net: mana: Allocate interrupt context for each EQ when creating vPort (git-fixes).\n- net: mana: Create separate EQs for each vPort (git-fixes).\n- net: mana: Fall back to standard MTU when PF reports adapter_mtu of 0 (git-fixes).\n- net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check (git-fixes).\n- net: mana: initialize gdma queue id to INVALID_QUEUE_ID (git-fixes).\n- net: mana: Introduce GIC context with refcounting for interrupt management (git-fixes).\n- net: mana: Optimize irq affinity for low vcpu configs (git-fixes).\n- net: mana: Query device capabilities and configure MSI-X sharing for EQs (git-fixes).\n- net: mana: Use GIC functions to allocate global EQs (git-fixes).\n- nfc: hci: fix out-of-bounds read in HCP header parsing (git-fixes).\n- nfc: llcp: Fix use-after-free in llcp_sock_release() (git-fixes).\n- nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (git-fixes).\n- page_pool: Move pp_magic check into helper functions (bsc#1261562).\n- page_pool: Track DMA-mapped pages and unmap them when destroying the pool (bsc#1261562).\n- platform/x86: intel-hid: Protect ACPI notify handler against recursion (git-fixes).\n- platform/x86: xo15-ebook: Fix wakeup source and GPE handling (git-fixes).\n- power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() (git-fixes).\n- power: supply: charger-manager: fix refcount leak in is_full_charged() (git-fixes).\n- power: supply: core: fix supplied_from allocations (git-fixes).\n- power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak (git-fixes).\n- powerpc/boot: Allow text relocations for pseries wrapper with binutils 2.46+ (git-fixes).\n- powerpc/fadump: define MIN_RMA in bytes rather than MB (bsc#1236743 git-fixes).\n- RDMA/mana_ib: Allocate interrupt contexts on EQs (git-fixes).\n- RDMA/mana_ib: Use ib_get_eth_speed for reporting port speed (git-fixes).\n- rtc: abx80x: fix the RTC_VL_CLR clearing all status flags (git-fixes).\n- rtc: cmos: unregister HPET IRQ handler on probe failure (git-fixes).\n- rtc: ds1307: Fix off-by-one issue with wday for rx8130 (git-fixes).\n- rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 (git-fixes).\n- rtc: mpfs: fix counter upload completion condition (git-fixes).\n- rtc: msc313: fix NULL deref in shared IRQ handler at probe (git-fixes).\n- s390/pci: check for relaxed translation capability (jsc#PED-15880).\n- s390/pci: Fix dev.dma_range_map missing sentinel element (jsc#PED-15880).\n- s390/pci: store DMA offset in bus_dma_region (jsc#PED-15880).\n- scsi: storvsc: Replace symbolic permissions with octal (git-fixes).\n- scsi: target: Fix hexadecimal CHAP_I handling (git-fixes).\n- selftests/bpf: Add BPF_STRICT_BUILD toggle (bsc#1269617).\n- selftests/bpf: Allow test_progs to link with a partial object set (bsc#1269617).\n- selftests/bpf: Fix test_kmods KDIR to honor O= and distro kernels (bsc#1269617).\n- selftests/bpf: Make skeleton headers order-only prerequisites of .test.d (bsc#1269617).\n- selftests/bpf: Provide weak definitions for cross-test functions (bsc#1269617).\n- selftests/bpf: Skip tests whose objects were not built (bsc#1269617).\n- selftests/bpf: Tolerate benchmark build failures (bsc#1269617).\n- selftests/bpf: Tolerate BPF and skeleton generation failures (bsc#1269617).\n- selftests/bpf: Tolerate missing files during install (bsc#1269617).\n- selftests/bpf: Tolerate test file compilation failures (bsc#1269617).\n- serdev: make serdev_bus_type const (stable-fixes).\n- spi: dw: fix wrong BAUDR setting after resume (git-fixes).\n- spi: rpc-if: Use correct device for hardware reinitialization on resume (git-fixes).\n- spi: uniphier: Fix completion initialization order before devm_request_irq() (git-fixes).\n- Split off kABI workaround for bsc#1267458 (bsc#1267458).\n- staging: most: video: avoid double free on video register failure (git-fixes).\n- staging: nvec: fix use-after-free in nvec_rx_completed() (git-fixes).\n- thermal: intel: Fix dangling resources on thermal_throttle_online() failure (git-fixes).\n- tpm: fix event_size output in tpm1_binary_bios_measurements_show (git-fixes).\n- tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() (git-fixes).\n- usb: core: Fix SuperSpeed root hub wMaxPacketSize (stable-fixes).\n- usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval (stable-fixes).\n- usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo (git-fixes).\n- usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() (git-fixes).\n- usb: host: max3421: Reject hub port requests for non-existent ports (git-fixes).\n- USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers (stable-fixes).\n- USB: serial: option: add MeiG SRM813Q (stable-fixes).\n- USB: serial: option: add usb-id for Dell Wireless DW5826e-m (stable-fixes).\n- usb: storage: Add quirks for PNY Elite Portable SSD (stable-fixes).\n- usb: typec: altmodes/displayport: validate count before reading Status Update VDO (stable-fixes).\n- usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT (stable-fixes).\n- usb: typec: ucsi: ccg: reject firmware images without a ':' record header (stable-fixes).\n- usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (stable-fixes).\n- usb: typec: ucsi: validate connector number in ucsi_connector_change() (stable-fixes).\n- usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() (stable-fixes).\n- vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write (git-fixes).\n- watchdog/hpwdt: Refine hpwdt message for UV platform (bsc#1269199).\n- x86/platform/uv: Expose the uv_hub_type() interface (jsc#PED-16305).\n- x86/tsc: Disable clocksource watchdog checking on recent and future UV platforms (jsc#PED-16305).\n","status":"published","published":"2026-07-08T14:59:38Z","modified":"2026-07-09T10:00:04.592425347Z","updated_at":"2026-11-02T15:54:04.987808Z"}]}}