{"id":"CVE-2025-68265","aliases":["AZL-72490","BELL-CVE-2025-68265","CLSA-2026-1787305050","DEBIAN-CVE-2025-68265","EUVD-2025-203749","GHSA-2rf6-4xf4-32wc","OESA-2026-1759","OESA-2026-1760","OESA-2026-1761","ROOT-OS-DEBIAN-12-CVE-2025-68265","ROOT-OS-UBUNTU-2204-CVE-2025-68265","ROOT-OS-UBUNTU-2404-CVE-2025-68265","SUSE-SU-2026:21834-1","SUSE-SU-2026:21841-1","SUSE-SU-2026:21845-1","SUSE-SU-2026:21860-1","UBUNTU-CVE-2025-68265","USN-8094-1","USN-8094-2","USN-8094-3","USN-8094-4","USN-8094-5","USN-8152-1","USN-8179-1","USN-8179-2","USN-8179-3","USN-8179-4","USN-8184-1","USN-8185-1","USN-8185-2","USN-8203-1","USN-8204-1","USN-8258-1","USN-8261-1","USN-8265-1","USN-8440-1","openSUSE-SU-2026:20826-1"],"status":"published","title":"nvme: fix admin request_queue lifetime","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: fix admin request_queue lifetime\n\nThe namespaces can access the controller's admin request_queue, and\nstale references on the namespaces may exist after tearing down the\ncontroller. Ensure the admin request_queue is active by moving the\ncontroller's 'put' to after all controller references have been released\nto ensure no one is can access the request_queue. This fixes a reported\nuse-after-free bug:\n\n  BUG: KASAN: slab-use-after-free in blk_queue_enter+0x41c/0x4a0\n  Read of size 8 at addr ffff88c0a53819f8 by task nvme/3287\n  CPU: 67 UID: 0 PID: 3287 Comm: nvme Tainted: G            E       6.13.2-ga1582f1a031e #15\n  Tainted: [E]=UNSIGNED_MODULE\n  Hardware name: Jabil /EGS 2S MB1, BIOS 1.00 06/18/2025\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x4f/0x60\n   print_report+0xc4/0x620\n   ? _raw_spin_lock_irqsave+0x70/0xb0\n   ? _raw_read_unlock_irqrestore+0x30/0x30\n   ? blk_queue_enter+0x41c/0x4a0\n   kasan_report+0xab/0xe0\n   ? blk_queue_enter+0x41c/0x4a0\n   blk_queue_enter+0x41c/0x4a0\n   ? __irq_work_queue_local+0x75/0x1d0\n   ? blk_queue_start_drain+0x70/0x70\n   ? irq_work_queue+0x18/0x20\n   ? vprintk_emit.part.0+0x1cc/0x350\n   ? wake_up_klogd_work_func+0x60/0x60\n   blk_mq_alloc_request+0x2b7/0x6b0\n   ? __blk_mq_alloc_requests+0x1060/0x1060\n   ? __switch_to+0x5b7/0x1060\n   nvme_submit_user_cmd+0xa9/0x330\n   nvme_user_cmd.isra.0+0x240/0x3f0\n   ? force_sigsegv+0xe0/0xe0\n   ? nvme_user_cmd64+0x400/0x400\n   ? vfs_fileattr_set+0x9b0/0x9b0\n   ? cgroup_update_frozen_flag+0x24/0x1c0\n   ? cgroup_leave_frozen+0x204/0x330\n   ? nvme_ioctl+0x7c/0x2c0\n   blkdev_ioctl+0x1a8/0x4d0\n   ? blkdev_common_ioctl+0x1930/0x1930\n   ? fdget+0x54/0x380\n   __x64_sys_ioctl+0x129/0x190\n   do_syscall_64+0x5b/0x160\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n  RIP: 0033:0x7f765f703b0b\n  Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 8b 0d dd 52 0f 00 f7 d8 64 89 01 48\n  RSP: 002b:00007ffe2cefe808 EFLAGS: 00000202 ORIG_RAX: 0000000000000010\n  RAX: ffffffffffffffda RBX: 00007ffe2cefe860 RCX: 00007f765f703b0b\n  RDX: 00007ffe2cefe860 RSI: 00000000c0484e41 RDI: 0000000000000003\n  RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000000\n  R10: 00007f765f611d50 R11: 0000000000000202 R12: 0000000000000003\n  R13: 00000000c0484e41 R14: 0000000000000001 R15: 00007ffe2cefea60\n   \u003c/TASK\u003e","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00157,"percentile":0.04873,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2025-12-16T14:47:05Z","modified":"2026-11-10T12:38:02Z","fixes":[{"ecosystem":"Azure Linux:3","package":"kernel","fixed_in":["6.6.121.1-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"linux-lts","fixed_in":["6.1.168-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"linux-lts","fixed_in":["6.12.65-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"linux-lts","fixed_in":["6.18.35-r1"],"sources":["osv"]},{"ecosystem":"Linux","package":"Kernel","fixed_in":["6.1.168","6.6.120","6.12.62","6.17.12"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"linux","fixed_in":["6.1.170-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["6.12.63-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["6.17.12-1"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"linux","fixed_in":["6.1.190-1.aikido.167"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-linux","fixed_in":["6.1.190-1.aikido.167"],"sources":["osv"]},{"ecosystem":"Root:Ubuntu:22.04","package":"linux","fixed_in":["5.15.0-203.213.aikido.119"],"sources":["osv"]},{"ecosystem":"Root:Ubuntu:22.04","package":"rootio-linux","fixed_in":["5.15.0-203.213.aikido.119"],"sources":["osv"]},{"ecosystem":"Root:Ubuntu:24.04","package":"linux","fixed_in":["6.8.0-149.149.aikido.91"],"sources":["osv"]},{"ecosystem":"Root:Ubuntu:24.04","package":"rootio-linux","fixed_in":["6.8.0-149.149.aikido.91"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.8","fixed_in":["6.8.0-1052.55~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.8","fixed_in":["6.8.0-1059.65~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-6.8","fixed_in":["6.8.0-1058.65~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.8","fixed_in":["6.8.0-1054.57~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.8","fixed_in":["6.8.0-110.110~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-ibm-6.8","fixed_in":["6.8.0-1051.51~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.8","fixed_in":["6.8.0-110.110.1~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.8","fixed_in":["6.8.0-1051.54~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.8","fixed_in":["6.8.0-1049.50~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-6.8","fixed_in":["6.8.0-110.110~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:Realtime:22.04:LTS","package":"linux-realtime-6.8","fixed_in":["6.8.1-1047.48~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux","fixed_in":["6.8.0-110.110"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws","fixed_in":["6.8.0-1052.55"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws-6.17","fixed_in":["6.17.0-1009.9~24.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure","fixed_in":["6.8.0-1054.60"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.17","fixed_in":["6.17.0-1010.10~24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-fde","fixed_in":["6.8.0-1058.65"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp","fixed_in":["6.8.0-1054.57"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.17","fixed_in":["6.17.0-1009.9~24.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-gke","fixed_in":["6.8.0-1050.56"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-gkeop","fixed_in":["6.8.0-1037.40"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-hwe-6.17","fixed_in":["6.17.0-19.19~24.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-ibm","fixed_in":["6.8.0-1051.51"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency","fixed_in":["6.8.0-110.110.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia","fixed_in":["6.8.0-1051.54"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-6.17","fixed_in":["6.17.0-1018.18"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-lowlatency","fixed_in":["6.8.0-1051.54.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-tegra","fixed_in":["6.8.0-1022.22"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.17","fixed_in":["6.17.0-1017.17"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle","fixed_in":["6.8.0-1049.50"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle-6.17","fixed_in":["6.17.0-1009.9~24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi","fixed_in":["6.8.0-1052.56"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv-6.17","fixed_in":["6.17.0-19.19.1~24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-xilinx","fixed_in":["6.8.0-1028.29"],"sources":["osv"]},{"ecosystem":"Ubuntu:Nvidia-BlueField:24.04:LTS","package":"linux-bluefield","fixed_in":["6.8.0-1017.21"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-raspi-realtime","fixed_in":["6.8.0-2042.43"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime","fixed_in":["6.8.1-1047.48"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime-6.17","fixed_in":["6.17.0-1008.9~24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-aws-fips","fixed_in":["6.8.0-1052.55+fips1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-azure-fips","fixed_in":["6.8.0-1053.59+fips1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-fips","fixed_in":["6.8.0-110.110+fips2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-gcp-fips","fixed_in":["6.8.0-1054.57+fips1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"linux","fixed_in":["6.17.0-19.19"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"linux-aws","fixed_in":["6.17.0-1009.9"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"linux-azure","fixed_in":["6.17.0-1010.10"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"linux-gcp","fixed_in":["6.17.0-1009.9"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"linux-oracle","fixed_in":["6.17.0-1009.9"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"linux-raspi","fixed_in":["6.17.0-1010.10"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"linux-realtime","fixed_in":["6.17.0-1008.9"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"linux-riscv","fixed_in":["6.17.0-19.19.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.121.1-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"linux-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.167-r0"},{"fixed":"6.1.168-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"linux-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.12.61-r0"},{"fixed":"6.12.65-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"linux-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.12.92-r1"},{"fixed":"6.18.35-r1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-abi-stablelists","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-cross-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-debug-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-debug-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-debug-devel-matched","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-debug-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-debug-modules-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-debug-modules-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-debug-modules-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-debug-modules-partner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-debug-uki-virt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-debug-uki-virt-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-devel-matched","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-ipaclones-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-modules-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-modules-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-modules-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-modules-partner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-debug-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-debug-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-debug-devel-matched","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-debug-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-debug-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-debug-modules-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-debug-modules-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-debug-modules-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-debug-modules-partner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-devel-matched","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-modules-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-modules-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-modules-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-modules-partner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-selftests-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-tools-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-tools-libs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-uki-virt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-uki-virt-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libperf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libperf-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3-perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rtla","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els12"}]}],"bundled":87},{"source":"osv","ecosystem":"Linux","package":"Kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.0"},{"fixed":"6.1.168"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.120"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.62"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.17.12"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.170-1"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.112-1","6.1.115-1","6.1.119-1","6.1.123-1","6.1.124-1","6.1.128-1","6.1.129-1","6.1.133-1","6.1.135-1","6.1.137-1","6.1.139-1","6.1.140-1","6.1.147-1","6.1.148-1","6.1.153-1","6.1.158-1","6.1.159-1","6.1.162-1","6.1.164-1","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.63-1"}]}],"versions":["6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.57-1","6.12.57-1~bpo12+1","6.12.63-1~bpo12+1"]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.12-1"}]}],"versions":["6.12.100-1","6.12.101-1","6.12.105-1","6.12.107-1","6.12.111-1","6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.57-1","6.12.57-1~bpo12+1","6.12.63-1","6.12.63-1~bpo12+1","6.12.69-1","6.12.69-1~bpo12+1","6.12.73-1","6.12.73-1~bpo12+1","6.12.74-1","6.12.74-2","6.12.74-2~bpo12+1","6.12.85-1","6.12.85-1~bpo12+1","6.12.86-1","6.12.86-1~bpo12+1","6.12.88-1","6.12.88-1~bpo12+1","6.12.90-1","6.12.90-1~bpo12+1","6.12.90-2","6.12.90-2~bpo12+1","6.12.94-1","6.12.94-1~bpo12+1","6.12.95-1","6.12.95-1~bpo12+1","6.12.96-1","6.13.10-1~exp1","6.13.11-1~exp1","6.13.2-1~exp1","6.13.3-1~exp1","6.13.4-1~exp1","6.13.5-1~exp1","6.13.6-1~exp1","6.13.7-1~exp1","6.13.8-1~exp1","6.13.9-1~exp1","6.13~rc6-1~exp1","6.13~rc7-1~exp1","6.14.3-1~exp1","6.14.5-1~exp1","6.14.6-1~exp1","6.15-1~exp1","6.15.1-1~exp1","6.15.2-1~exp1","6.15.3-1~exp1","6.15.4-1~exp1","6.15.5-1~exp1","6.15.6-1~exp1","6.15~rc7-1~exp1","6.16-1~exp1","6.16.1-1~exp1","6.16.10-1","6.16.11-1","6.16.12-1","6.16.12-1~bpo13+1","6.16.12-2","6.16.3-1","6.16.3-1~bpo13+1","6.16.5-1","6.16.6-1","6.16.7-1","6.16.8-1","6.16.9-1","6.16~rc7-1~exp1","6.17.10-1","6.17.11-1","6.17.2-1~exp1","6.17.5-1~exp1","6.17.6-1","6.17.7-1","6.17.7-2","6.17.8-1","6.17.8-1~bpo13+1","6.17.9-1"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.0-144.0.0.127.oe2403"}]}],"bundled":85},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.0-144.0.0.139.oe2403sp1"}]}],"bundled":122},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.0-144.0.0.140.oe2403sp2"}]}],"bundled":85},{"source":"osv","ecosystem":"Root:Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.190-1.aikido.167"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.190-1.aikido.167"}]}]},{"source":"osv","ecosystem":"Root:Ubuntu:22.04","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-203.213.aikido.119"}]}]},{"source":"osv","ecosystem":"Root:Ubuntu:22.04","package":"rootio-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-203.213.aikido.119"}]}]},{"source":"osv","ecosystem":"Root:Ubuntu:24.04","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-149.149.aikido.91"}]}]},{"source":"osv","ecosystem":"Root:Ubuntu:24.04","package":"rootio-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-149.149.aikido.91"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro Extras 6.2","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.33.1"}]}],"bundled":206},{"source":"osv","ecosystem":"SUSE:Linux Micro Extras 6.2","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.33.1"}]}],"bundled":206},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.0-28.30~16.04.1","4.8.0-30.32~16.04.1","4.8.0-32.34~16.04.1","4.8.0-34.36~16.04.1","4.10.0-14.16~16.04.1","4.10.0-19.21~16.04.1","4.10.0-20.22~16.04.1","4.10.0-21.23~16.04.1","4.10.0-22.24~16.04.1","4.10.0-24.28~16.04.1","4.10.0-26.30~16.04.1","4.11.0-13.19~16.04.1","4.11.0-14.20~16.04.1","4.13.0-16.19~16.04.3","4.13.0-17.20~16.04.1","4.13.0-19.22~16.04.1","4.13.0-21.24~16.04.1","4.13.0-25.29~16.04.2","4.15.0-13.14~16.04.1","4.15.0-15.16~16.04.1","4.15.0-20.21~16.04.1","4.15.0-22.24~16.04.1","4.15.0-23.25~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1021.24~18.04.1","5.0.0-1022.25~18.04.1","5.0.0-1023.26~18.04.1","5.0.0-1024.27~18.04.1","5.0.0-1025.28","5.0.0-1027.30"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1019.21~18.04.1","5.3.0-1023.25~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.2","5.3.0-1033.35","5.3.0-1034.36","5.3.0-1035.37"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.2","4.15.0-1003.3","4.15.0-1004.4","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1012.12","4.15.0-1013.13","4.15.0-1014.14","4.15.0-1018.18","4.15.0-1019.19","4.15.0-1021.21","4.15.0-1022.23","4.15.0-1023.24","4.15.0-1025.26","4.15.0-1028.29","4.15.0-1030.31","4.15.0-1031.32","4.15.0-1032.33","4.15.0-1035.36","4.15.0-1036.38","4.15.0-1037.39","4.18.0-1011.11~18.04.1","4.18.0-1013.13~18.04.1","4.18.0-1014.14~18.04.1","4.18.0-1018.18~18.04.1","4.18.0-1019.19~18.04.1","4.18.0-1020.20~18.04.1","4.18.0-1023.24~18.04.1","4.18.0-1024.25~18.04.1","4.18.0-1025.27~18.04.1","5.0.0-1014.14~18.04.1","5.0.0-1016.17~18.04.1","5.0.0-1018.19~18.04.1","5.0.0-1020.21~18.04.1","5.0.0-1022.23~18.04.1","5.0.0-1023.24~18.04.1","5.0.0-1025.27~18.04.1","5.0.0-1027.29~18.04.1","5.0.0-1028.30~18.04.1","5.0.0-1029.31~18.04.1","5.0.0-1031.33","5.0.0-1032.34","5.0.0-1035.37","5.0.0-1036.38"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8~18.04.1","5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1019.20~18.04.1","5.3.0-1020.21~18.04.1","5.3.0-1022.23~18.04.1","5.3.0-1028.29~18.04.1","5.3.0-1031.32~18.04.1","5.3.0-1032.33~18.04.1","5.3.0-1034.35~18.04.1","5.3.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-1006.6~18.04.1","4.18.0-1007.7~18.04.1","4.18.0-1008.8~18.04.1","5.0.0-1012.12~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1001.1","4.15.0-1003.3","4.15.0-1005.5","4.15.0-1006.6","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1010.10","4.15.0-1014.14","4.15.0-1015.15","4.15.0-1017.18","4.15.0-1018.19","4.15.0-1019.20","4.15.0-1021.22","4.15.0-1023.24","4.15.0-1024.25","4.15.0-1025.26","4.15.0-1026.27","4.15.0-1027.28","4.15.0-1028.29","4.15.0-1029.31","4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1042.45","4.15.0-1044.70","5.0.0-1020.20~18.04.1","5.0.0-1021.21~18.04.1","5.0.0-1025.26~18.04.1","5.0.0-1026.27~18.04.1","5.0.0-1028.29~18.04.1","5.0.0-1029.30~18.04.1","5.0.0-1031.32","5.0.0-1033.34","5.0.0-1034.35"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1020.22~18.04.1","5.3.0-1026.28~18.04.1","5.3.0-1029.31~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-4.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1041.43","4.15.0-1042.44","4.15.0-1044.46","4.15.0-1045.48","4.15.0-1046.49","4.15.0-1048.51","4.15.0-1049.52","4.15.0-1050.53","4.15.0-1052.55","4.15.0-1055.58","4.15.0-1057.60","4.15.0-1058.61","4.15.0-1059.62","4.15.0-1063.66","4.15.0-1064.67","4.15.0-1066.69","4.15.0-1067.70","4.15.0-1069.72","4.15.0-1070.73","4.15.0-1072.76","4.15.0-1073.78","4.15.0-1074.79","4.15.0-1076.81","4.15.0-1077.82","4.15.0-1078.83","4.15.0-1079.84"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1025.25~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.31~18.04.1","5.4.0-1030.32~18.04.1","5.4.0-1032.34~18.04.1","5.4.0-1033.35~18.04.1","5.4.0-1035.37~18.04.1","5.4.0-1036.38~18.04.1","5.4.0-1037.39~18.04.1","5.4.0-1039.41~18.04.1","5.4.0-1040.42~18.04.1","5.4.0-1042.44~18.04.1","5.4.0-1043.45~18.04.1","5.4.0-1044.46~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1","5.4.0-1052.55~18.04.1","5.4.0-1053.56~18.04.1","5.4.0-1054.57~18.04.1","5.4.0-1055.58~18.04.1","5.4.0-1056.59~18.04.1","5.4.0-1057.60~18.04.1","5.4.0-1059.62~18.04.1","5.4.0-1061.64~18.04.1","5.4.0-1062.65~18.04.1","5.4.0-1063.66~18.04.1","5.4.0-1065.68~18.04.1","5.4.0-1066.69~18.04.1","5.4.0-1067.70~18.04.1","5.4.0-1068.71~18.04.1","5.4.0-1071.76~18.04.3","5.4.0-1072.77~18.04.1","5.4.0-1074.79~18.04.1","5.4.0-1076.82~18.04.1","5.4.0-1078.84~18.04.1","5.4.0-1080.86~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gkeop-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1001.1","5.4.0-1003.3","5.4.0-1004.5","5.4.0-1005.6","5.4.0-1007.8~18.04.1","5.4.0-1008.9~18.04.1","5.4.0-1009.10~18.04.1","5.4.0-1010.11~18.04.1","5.4.0-1011.12~18.04.2","5.4.0-1012.13~18.04.1","5.4.0-1013.14~18.04.1","5.4.0-1014.15~18.04.1","5.4.0-1015.16~18.04.1","5.4.0-1016.17~18.04.1","5.4.0-1018.19~18.04.1","5.4.0-1021.22~18.04.1","5.4.0-1022.23~18.04.1","5.4.0-1023.24~18.04.1","5.4.0-1024.25~18.04.1","5.4.0-1025.26~18.04.1","5.4.0-1026.27~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.30~18.04.2","5.4.0-1031.32~18.04.1","5.4.0-1032.33~18.04.1","5.4.0-1033.34~18.04.1","5.4.0-1034.35~18.04.1","5.4.0-1036.37~18.04.1","5.4.0-1037.38~18.04.1","5.4.0-1038.39~18.04.1","5.4.0-1039.40~18.04.1","5.4.0-1040.41~18.04.1","5.4.0-1043.44~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1048.51~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-13.14~18.04.1","4.18.0-14.15~18.04.1","4.18.0-15.16~18.04.1","4.18.0-16.17~18.04.1","4.18.0-17.18~18.04.1","4.18.0-18.19~18.04.1","4.18.0-20.21~18.04.1","4.18.0-21.22~18.04.1","4.18.0-22.23~18.04.1","4.18.0-24.25~18.04.1","4.18.0-25.26~18.04.1","5.0.0-23.24~18.04.1","5.0.0-25.26~18.04.1","5.0.0-27.28~18.04.1","5.0.0-29.31~18.04.1","5.0.0-31.33~18.04.1","5.0.0-32.34~18.04.2","5.0.0-35.38~18.04.1","5.0.0-36.39~18.04.1","5.0.0-37.40~18.04.1","5.3.0-26.28~18.04.1","5.3.0-28.30~18.04.1","5.3.0-40.32~18.04.1","5.3.0-42.34~18.04.1","5.3.0-45.37~18.04.1","5.3.0-46.38~18.04.1","5.3.0-51.44~18.04.2","5.3.0-53.47~18.04.1","5.3.0-59.53~18.04.1","5.3.0-61.55~18.04.1","5.3.0-62.56~18.04.1","5.3.0-64.58~18.04.1","5.3.0-65.59","5.3.0-66.60","5.3.0-67.61","5.3.0-68.63","5.3.0-69.65","5.3.0-70.66","5.3.0-72.68","5.3.0-73.69","5.3.0-74.70","5.3.0-75.71","5.3.0-76.72"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-15.16~18.04.1","5.0.0-16.17~18.04.1","5.0.0-17.18~18.04.1","5.0.0-19.20~18.04.1","5.0.0-20.21~18.04.1","5.3.0-19.20~18.04.2","5.3.0-22.24~18.04.1","5.3.0-23.25~18.04.1","5.3.0-23.25~18.04.2","5.3.0-24.26~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.3","4.15.0-1004.5","4.15.0-1006.9","4.15.0-1008.11","4.15.0-1009.12","4.15.0-1012.15","4.15.0-1013.16","4.15.0-1015.18","4.15.0-1017.20","4.15.0-1018.21","4.15.0-1021.24","4.15.0-1024.29","4.15.0-1026.31","4.15.0-1028.33","4.15.0-1030.35","4.15.0-1033.38","4.15.0-1034.39","4.15.0-1035.40","4.15.0-1036.41","4.15.0-1038.43","4.15.0-1039.44","4.15.0-1043.48","4.15.0-1045.50","4.15.0-1050.57","4.15.0-1056.65","4.15.0-1057.66","4.15.0-1059.68","4.15.0-1063.72","4.15.0-1064.73","4.15.0-1065.75","4.15.0-1066.76","4.15.0-1067.77","4.15.0-1069.79","4.15.0-1073.83","4.15.0-1076.86","4.15.0-1079.89","4.15.0-1080.90","4.15.0-1081.91","4.15.0-1087.97","4.15.0-1090.100","4.15.0-1091.101","4.15.0-1093.103","4.15.0-1094.104","4.15.0-1096.106","4.15.0-1097.107","4.15.0-1099.109","4.15.0-1100.110","4.15.0-1101.112","4.15.0-1102.113","4.15.0-1103.114"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1007.12~18.04.1","5.0.0-1008.13~18.04.1","5.0.0-1009.14~18.04.1","5.0.0-1010.15~18.04.1","5.0.0-1011.16","5.0.0-1013.18","5.0.0-1014.19"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1011.12~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.18~18.04.1","5.3.0-1018.20~18.04.1","5.3.0-1024.26~18.04.1","5.3.0-1027.29~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.9~20.04.2","5.11.0-1014.15~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.2","5.11.0-1021.22~20.04.2","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.2","5.13.0-1011.12~20.04.1","5.13.0-1012.13~20.04.1","5.13.0-1014.15~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1019.21~20.04.1","5.13.0-1021.23~20.04.2","5.13.0-1022.24~20.04.1","5.13.0-1023.25~20.04.1","5.13.0-1025.27~20.04.1","5.13.0-1028.31~20.04.1","5.13.0-1029.32~20.04.1","5.13.0-1031.35~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1041.43~20.04.1","5.8.0-1042.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1007.7~20.04.2","5.11.0-1012.13~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10~20.04.2","5.13.0-1012.14~20.04.1","5.13.0-1013.15~20.04.1","5.13.0-1014.16~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1021.24~20.04.1","5.13.0-1022.26~20.04.1","5.13.0-1023.27~20.04.1","5.13.0-1025.29~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1029.34~20.04.1","5.13.0-1031.37~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1033.35~20.04.1","5.8.0-1036.38~20.04.1","5.8.0-1039.42~20.04.1","5.8.0-1040.43~20.04.1","5.8.0-1041.44~20.04.1","5.8.0-1042.45~20.04.1","5.8.0-1043.46~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1063.66+cvm2.2","5.4.0-1063.66+cvm3.2","5.4.0-1064.67+cvm1.1","5.4.0-1065.68+cvm2.1","5.4.0-1067.70+cvm1.1","5.4.0-1068.71+cvm1.1","5.4.0-1069.72+cvm1.1","5.4.0-1070.73+cvm1.1","5.4.0-1072.75+cvm1.1","5.4.0-1073.76+cvm1.1","5.4.0-1074.77+cvm1.1","5.4.0-1076.79+cvm1.1","5.4.0-1078.81+cvm1.1","5.4.0-1080.83+cvm1.1","5.4.0-1083.87+cvm1.1","5.4.0-1085.90+cvm1.1","5.4.0-1085.90+cvm2.1","5.4.0-1086.91+cvm1.1","5.4.0-1089.94+cvm1.2","5.4.0-1090.95+cvm1.1","5.4.0-1091.96+cvm1.1","5.4.0-1092.97+cvm1.1","5.4.0-1095.101+cvm1.1","5.4.0-1098.104+cvm1.1","5.4.0-1100.106+cvm1.1","5.4.0-1103.109+cvm1.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.10~20.04.1","5.11.0-1014.16~20.04.1","5.11.0-1017.19~20.04.1","5.11.0-1018.20~20.04.2","5.11.0-1020.22~20.04.1","5.11.0-1021.23~20.04.1","5.11.0-1022.24~20.04.1","5.11.0-1023.25~20.04.1","5.11.0-1024.26~20.04.1","5.11.0-1026.29~20.04.1","5.11.0-1028.32~20.04.1","5.11.0-1029.33~20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.3","5.13.0-1012.15~20.04.1","5.13.0-1013.16~20.04.1","5.13.0-1015.18~20.04.1","5.13.0-1019.23~20.04.1","5.13.0-1021.25~20.04.1","5.13.0-1023.28~20.04.1","5.13.0-1024.29~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1030.36~20.04.1","5.13.0-1031.37~20.04.1","5.13.0-1033.40~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1032.34~20.04.1","5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1039.41"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1033.35","5.4.0-1035.37","5.4.0-1036.38","5.4.0-1037.39","5.4.0-1039.41","5.4.0-1041.43","5.4.0-1042.44","5.4.0-1043.45","5.4.0-1044.46","5.4.0-1046.48","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1055.58","5.4.0-1056.59","5.4.0-1057.60","5.4.0-1059.62","5.4.0-1061.64","5.4.0-1062.65","5.4.0-1063.66","5.4.0-1065.68","5.4.0-1066.69","5.4.0-1067.70","5.4.0-1068.71","5.4.0-1071.76","5.4.0-1072.77","5.4.0-1074.79","5.4.0-1076.82","5.4.0-1078.84","5.4.0-1080.86","5.4.0-1081.87","5.4.0-1083.89","5.4.0-1084.90","5.4.0-1086.93","5.4.0-1087.94","5.4.0-1090.97","5.4.0-1091.98","5.4.0-1094.101","5.4.0-1095.102","5.4.0-1096.103","5.4.0-1097.104","5.4.0-1098.105","5.4.0-1099.106","5.4.0-1100.107","5.4.0-1101.108","5.4.0-1102.109","5.4.0-1103.110","5.4.0-1104.111","5.4.0-1105.112"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1011.14~20.04.1","5.15.0-1014.17~20.04.1","5.15.0-1015.18~20.04.1","5.15.0-1016.19~20.04.1","5.15.0-1019.23~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1023.28~20.04.2","5.15.0-1027.32~20.04.1","5.15.0-1028.33~20.04.1","5.15.0-1029.34~20.04.1","5.15.0-1031.36~20.04.1","5.15.0-1032.37~20.04.1","5.15.0-1033.38~20.04.1","5.15.0-1034.39~20.04.1","5.15.0-1036.41~20.04.1","5.15.0-1037.42~20.04.1","5.15.0-1038.43~20.04.1","5.15.0-1039.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1008.9","5.4.0-1009.10","5.4.0-1010.11","5.4.0-1011.12","5.4.0-1012.13","5.4.0-1013.14","5.4.0-1014.15","5.4.0-1015.16","5.4.0-1016.17","5.4.0-1018.19","5.4.0-1021.22","5.4.0-1022.23","5.4.0-1023.24","5.4.0-1024.25","5.4.0-1025.26","5.4.0-1026.27","5.4.0-1027.28","5.4.0-1029.30","5.4.0-1031.32","5.4.0-1032.33","5.4.0-1033.34","5.4.0-1034.35","5.4.0-1036.37","5.4.0-1037.38","5.4.0-1038.39","5.4.0-1039.40","5.4.0-1040.41","5.4.0-1043.44","5.4.0-1046.48","5.4.0-1048.51","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1056.60","5.4.0-1057.61","5.4.0-1060.64","5.4.0-1061.65","5.4.0-1062.66","5.4.0-1064.68","5.4.0-1065.69","5.4.0-1066.70","5.4.0-1067.71","5.4.0-1068.72","5.4.0-1069.73","5.4.0-1070.74","5.4.0-1071.75","5.4.0-1072.76","5.4.0-1073.77","5.4.0-1074.78","5.4.0-1075.79","5.4.0-1076.80","5.4.0-1077.81","5.4.0-1078.82","5.4.0-1079.83","5.4.0-1080.84","5.4.0-1081.85","5.4.0-1083.87","5.4.0-1084.88","5.4.0-1085.89","5.4.0-1086.90","5.4.0-1087.91","5.4.0-1088.92","5.4.0-1089.93","5.4.0-1090.94","5.4.0-1091.95","5.4.0-1092.96","5.4.0-1093.97","5.4.0-1094.98","5.4.0-1095.99","5.4.0-1096.100","5.4.0-1097.101","5.4.0-1098.102","5.4.0-1099.103","5.4.0-1100.104","5.4.0-1101.105","5.4.0-1102.106"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gkeop-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1003.5~20.04.2","5.15.0-1005.7~20.04.1","5.15.0-1007.10~20.04.1","5.15.0-1008.12~20.04.1","5.15.0-1011.15~20.04.2","5.15.0-1012.16~20.04.1","5.15.0-1013.17~20.04.1","5.15.0-1015.19~20.04.1","5.15.0-1016.21~20.04.1","5.15.0-1017.22~20.04.1","5.15.0-1018.23~20.04.1","5.15.0-1019.24~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1021.26~20.04.1","5.15.0-1022.27~20.04.1","5.15.0-1023.28~20.04.1","5.15.0-1024.29~20.04.1","5.15.0-1025.30~20.04.1","5.15.0-1026.31~20.04.1","5.15.0-1027.32~20.04.1","5.15.0-1028.33~20.04.1","5.15.0-1030.35~20.04.1","5.15.0-1031.37~20.04.1","5.15.0-1032.38~20.04.1","5.15.0-1033.39~20.04.1","5.15.0-1034.40~20.04.1","5.15.0-1035.41~20.04.1","5.15.0-1036.42~20.04.1","5.15.0-1037.43~20.04.1","5.15.0-1038.44~20.04.1","5.15.0-1039.45~20.04.1","5.15.0-1040.46~20.04.1","5.15.0-1043.50~20.04.1","5.15.0-1044.51~20.04.1","5.15.0-1045.52~20.04.1","5.15.0-1046.53~20.04.1","5.15.0-1047.54~20.04.1","5.15.0-1048.55~20.04.1","5.15.0-1049.56~20.04.1","5.15.0-1050.57~20.04.1","5.15.0-1051.58~20.04.1","5.15.0-1052.59~20.04.1","5.15.0-1053.60~20.04.1","5.15.0-1054.61~20.04.1","5.15.0-1055.62~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-22.23~20.04.1","5.11.0-25.27~20.04.1","5.11.0-27.29~20.04.1","5.11.0-34.36~20.04.1","5.11.0-36.40~20.04.1","5.11.0-37.41~20.04.2","5.11.0-38.42~20.04.1","5.11.0-40.44~20.04.2","5.11.0-41.45~20.04.1","5.11.0-43.47~20.04.2","5.11.0-44.48~20.04.2","5.11.0-46.51~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-21.21~20.04.1","5.13.0-22.22~20.04.1","5.13.0-23.23~20.04.2","5.13.0-25.26~20.04.1","5.13.0-27.29~20.04.1","5.13.0-28.31~20.04.1","5.13.0-30.33~20.04.1","5.13.0-35.40~20.04.1","5.13.0-37.42~20.04.1","5.13.0-39.44~20.04.1","5.13.0-40.45~20.04.1","5.13.0-41.46~20.04.1","5.13.0-44.49~20.04.1","5.13.0-48.54~20.04.1","5.13.0-51.58~20.04.1","5.13.0-52.59~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-23.24~20.04.1","5.8.0-25.26~20.04.1","5.8.0-28.30~20.04.1","5.8.0-29.31~20.04.1","5.8.0-31.33~20.04.1","5.8.0-33.36~20.04.1","5.8.0-34.37~20.04.2","5.8.0-36.40~20.04.1","5.8.0-38.43~20.04.1","5.8.0-40.45~20.04.1","5.8.0-41.46~20.04.1","5.8.0-43.49~20.04.1","5.8.0-44.50~20.04.1","5.8.0-45.51~20.04.1","5.8.0-48.54~20.04.1","5.8.0-49.55~20.04.1","5.8.0-50.56~20.04.1","5.8.0-53.60~20.04.1","5.8.0-55.62~20.04.1","5.8.0-59.66~20.04.1","5.8.0-63.71~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-intel-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1007.7","5.13.0-1008.8","5.13.0-1009.9","5.13.0-1010.10","5.13.0-1011.11","5.13.0-1014.15","5.13.0-1017.19"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.10.0-1008.9","5.10.0-1011.12","5.10.0-1013.14","5.10.0-1014.15","5.10.0-1016.17","5.10.0-1017.18","5.10.0-1019.20","5.10.0-1021.22","5.10.0-1022.23","5.10.0-1023.24","5.10.0-1025.26","5.10.0-1026.27","5.10.0-1029.30","5.10.0-1032.33","5.10.0-1033.34","5.10.0-1034.35","5.10.0-1038.40","5.10.0-1044.46","5.10.0-1045.47","5.10.0-1049.51","5.10.0-1050.52","5.10.0-1051.53","5.10.0-1052.54","5.10.0-1053.55","5.10.0-1055.58","5.10.0-1057.61"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10","5.13.0-1010.11","5.13.0-1012.16","5.13.0-1014.18","5.13.0-1017.21","5.13.0-1019.23","5.13.0-1020.24","5.13.0-1021.25","5.13.0-1022.26","5.13.0-1026.32","5.13.0-1028.35","5.13.0-1029.36"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.14.0-1004.4","5.14.0-1005.5","5.14.0-1007.7","5.14.0-1008.8","5.14.0-1010.10","5.14.0-1011.11","5.14.0-1013.13","5.14.0-1018.19","5.14.0-1020.22","5.14.0-1022.24","5.14.0-1024.26","5.14.0-1027.30","5.14.0-1029.32","5.14.0-1031.34","5.14.0-1032.35","5.14.0-1033.36","5.14.0-1034.37","5.14.0-1036.40","5.14.0-1038.42","5.14.0-1042.47","5.14.0-1044.49","5.14.0-1045.51","5.14.0-1046.53","5.14.0-1047.54","5.14.0-1048.55","5.14.0-1049.56","5.14.0-1050.57","5.14.0-1051.58","5.14.0-1052.59","5.14.0-1054.61","5.14.0-1055.62","5.14.0-1056.63","5.14.0-1057.64","5.14.0-1058.66","5.14.0-1059.67"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.6.0-1007.7","5.6.0-1008.8","5.6.0-1010.10","5.6.0-1011.11","5.6.0-1013.13","5.6.0-1017.17","5.6.0-1018.18","5.6.0-1020.20","5.6.0-1021.21","5.6.0-1023.23","5.6.0-1026.26","5.6.0-1027.27","5.6.0-1028.28","5.6.0-1031.32","5.6.0-1032.33","5.6.0-1033.35","5.6.0-1034.36","5.6.0-1035.37","5.6.0-1036.39","5.6.0-1039.43","5.6.0-1042.46","5.6.0-1047.51","5.6.0-1048.52","5.6.0-1050.54","5.6.0-1052.56","5.6.0-1053.57","5.6.0-1054.58","5.6.0-1055.59","5.6.0-1056.60"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1008.8~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1011.13~20.04.2","5.13.0-1015.19~20.04.1","5.13.0-1016.20~20.04.1","5.13.0-1018.22~20.04.1","5.13.0-1021.26~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1030.35~20.04.1","5.13.0-1033.39~20.04.1","5.13.0-1034.40~20.04.1","5.13.0-1036.43~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1031.32~20.04.2","5.8.0-1033.34~20.04.1","5.8.0-1034.35~20.04.2","5.8.0-1037.38~20.04.1","5.8.0-1038.39~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8","5.3.0-1014.16","5.3.0-1015.17","5.3.0-1017.19","5.4.0-1004.4","5.4.0-1006.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-24.28","5.4.0-26.30","5.4.0-27.31","5.4.0-28.32","5.4.0-30.34","5.4.0-31.35","5.4.0-33.37","5.4.0-34.38","5.4.0-36.41","5.4.0-37.42","5.4.0-39.44","5.4.0-40.45"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1018.19~20.04.2","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1024.25~20.04.1","5.11.0-1026.28~20.04.1","5.11.0-1028.31~20.04.1","5.11.0-1029.32~20.04.1","5.11.0-1030.34","5.11.0-1031.35"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-14.16~20.04.1","5.8.0-14.16~20.04.3","5.8.0-16.18~20.04.1","5.8.0-17.19~20.04.1","5.8.0-18.20~20.04.1","5.8.0-20.22~20.04.1","5.8.0-22.24~20.04.1","5.8.0-25.27~20.04.1","5.8.0-26.28~20.04.1","5.8.0-29.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-allwinner-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1007.7~22.04.1","5.19.0-1009.9~22.04.1","5.19.0-1010.10~22.04.1","5.19.0-1011.11~22.04.1","5.19.0-1012.12~22.04.1","5.19.0-1013.13~22.04.1","5.19.0-1014.14~22.04.1","5.19.0-1015.15~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1019.20~22.04.1","5.19.0-1020.21~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1026.27~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1029.30~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1008.8~22.04.1","6.5.0-1010.10~22.04.1","6.5.0-1011.11~22.04.1","6.5.0-1012.12~22.04.1","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.2","6.5.0-1018.18~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1021.21~22.04.1","6.5.0-1022.22~22.04.1","6.5.0-1023.23~22.04.1","6.5.0-1024.24~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1052.55~22.04.1"}]}],"versions":["6.8.0-1009.9~22.04.2","6.8.0-1010.10~22.04.2","6.8.0-1011.12~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.15~22.04.1","6.8.0-1015.16~22.04.1","6.8.0-1016.17~22.04.2","6.8.0-1017.18~22.04.1","6.8.0-1018.19~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1023.25~22.04.1","6.8.0-1024.26~22.04.1","6.8.0-1027.29~22.04.1","6.8.0-1028.30~22.04.1","6.8.0-1029.31~22.04.1","6.8.0-1030.32~22.04.1","6.8.0-1031.33~22.04.1","6.8.0-1032.34~22.04.1","6.8.0-1033.35~22.04.1","6.8.0-1035.37~22.04.1","6.8.0-1036.38~22.04.1","6.8.0-1039.41~22.04.1","6.8.0-1040.42~22.04.1","6.8.0-1041.43~22.04.1","6.8.0-1042.44~22.04.1","6.8.0-1043.45~22.04.1","6.8.0-1044.46~22.04.1","6.8.0-1045.47~22.04.1","6.8.0-1046.49~22.04.1","6.8.0-1047.50~22.04.1","6.8.0-1050.53~22.04.1","6.8.0-1051.54~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.21~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1025.28~22.04.1","5.19.0-1026.29~22.04.1","5.19.0-1027.30~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1","6.2.0-1019.19~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.7~22.04.1","6.5.0-1009.9~22.04.1","6.5.0-1010.10~22.04.1","6.5.0-1011.11~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.1","6.5.0-1018.19~22.04.2","6.5.0-1019.20~22.04.1","6.5.0-1021.22~22.04.1","6.5.0-1022.23~22.04.1","6.5.0-1023.24~22.04.1","6.5.0-1024.25~22.04.1","6.5.0-1025.26~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1059.65~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1009.9~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1012.14~22.04.1","6.8.0-1013.15~22.04.1","6.8.0-1014.16~22.04.1","6.8.0-1015.17~22.04.2","6.8.0-1017.20~22.04.1","6.8.0-1018.21~22.04.1","6.8.0-1020.23~22.04.1","6.8.0-1021.25~22.04.1","6.8.0-1025.30~22.04.1","6.8.0-1026.31~22.04.1","6.8.0-1027.32~22.04.1","6.8.0-1028.33~22.04.1","6.8.0-1029.34~22.04.1","6.8.0-1030.35~22.04.1","6.8.0-1031.36~22.04.1","6.8.0-1034.39~22.04.1","6.8.0-1036.42~22.04.1","6.8.0-1040.46~22.04.1","6.8.0-1041.47~22.04.1","6.8.0-1044.50~22.04.1","6.8.0-1051.57~22.04.1","6.8.0-1052.58~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1025.28~22.04.1.1","5.19.0-1026.29~22.04.1.1","5.19.0-1027.30~22.04.2.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1.1","6.2.0-1009.9~22.04.3.1","6.2.0-1011.11~22.04.1.1","6.2.0-1012.12~22.04.1.1","6.2.0-1014.14~22.04.1.1","6.2.0-1015.15~22.04.1.1","6.2.0-1016.16~22.04.1.1","6.2.0-1017.17~22.04.1.1","6.2.0-1018.18~22.04.1.1","6.2.0-1019.19~22.04.1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1058.65~22.04.1"}]}],"versions":["6.8.0-1041.48~22.04.1","6.8.0-1042.49~22.04.1","6.8.0-1044.51~22.04.1","6.8.0-1046.53~22.04.1","6.8.0-1053.60~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.22~22.04.2","5.19.0-1021.23~22.04.1","5.19.0-1022.24~22.04.1","5.19.0-1024.26~22.04.1","5.19.0-1025.27~22.04.1","5.19.0-1026.28~22.04.1","5.19.0-1027.29~22.04.1","5.19.0-1030.32~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1011.11~22.04.3","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1016.18~22.04.1","6.2.0-1017.19~22.04.1","6.2.0-1018.20~22.04.1","6.2.0-1019.21~22.04.1","6.2.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1010.10~22.04.3","6.5.0-1011.11~22.04.1","6.5.0-1013.13~22.04.1","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.1","6.5.0-1018.18~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1022.24~22.04.1","6.5.0-1023.25~22.04.1","6.5.0-1024.26~22.04.1","6.5.0-1025.27~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1054.57~22.04.1"}]}],"versions":["6.8.0-1010.11~22.04.1","6.8.0-1011.12~22.04.1","6.8.0-1012.13~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.16~22.04.1","6.8.0-1015.17~22.04.1","6.8.0-1016.18~22.04.1","6.8.0-1017.19~22.04.1","6.8.0-1018.20~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1024.26~22.04.1","6.8.0-1025.27~22.04.1","6.8.0-1026.28~22.04.1","6.8.0-1027.29~22.04.1","6.8.0-1028.30~22.04.1","6.8.0-1029.31~22.04.1","6.8.0-1030.32~22.04.1","6.8.0-1031.33~22.04.1","6.8.0-1032.34~22.04.1","6.8.0-1033.35~22.04.1","6.8.0-1034.36~22.04.2","6.8.0-1036.38~22.04.1","6.8.0-1037.39~22.04.1","6.8.0-1040.42~22.04.1","6.8.0-1041.43~22.04.1","6.8.0-1042.45~22.04.1","6.8.0-1043.46~22.04.1","6.8.0-1044.47~22.04.1","6.8.0-1045.48~22.04.1","6.8.0-1046.49~22.04.1","6.8.0-1047.50~22.04.2","6.8.0-1048.51~22.04.1","6.8.0-1052.55~22.04.1","6.8.0-1053.56~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-28.29~22.04.1","5.19.0-32.33~22.04.1","5.19.0-35.36~22.04.1","5.19.0-38.39~22.04.1","5.19.0-40.41~22.04.1","5.19.0-41.42~22.04.1","5.19.0-42.43~22.04.1","5.19.0-43.44~22.04.1","5.19.0-45.46~22.04.1","5.19.0-46.47~22.04.1","5.19.0-50.50"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-25.25~22.04.2","6.2.0-26.26~22.04.1","6.2.0-31.31~22.04.1","6.2.0-32.32~22.04.1","6.2.0-33.33~22.04.1","6.2.0-34.34~22.04.1","6.2.0-35.35~22.04.1","6.2.0-36.37~22.04.1","6.2.0-37.38~22.04.1","6.2.0-39.40~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-14.14~22.04.1","6.5.0-15.15~22.04.1","6.5.0-17.17~22.04.1","6.5.0-18.18~22.04.1","6.5.0-21.21~22.04.1","6.5.0-25.25~22.04.1","6.5.0-26.26~22.04.1","6.5.0-27.28~22.04.1","6.5.0-28.29~22.04.1","6.5.0-35.35~22.04.1","6.5.0-41.41~22.04.2","6.5.0-44.44~22.04.1","6.5.0-45.45~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-110.110~22.04.1"}]}],"versions":["6.8.0-38.38~22.04.1","6.8.0-39.39~22.04.1","6.8.0-40.40~22.04.3","6.8.0-45.45~22.04.1","6.8.0-47.47~22.04.1","6.8.0-48.48~22.04.1","6.8.0-49.49~22.04.1","6.8.0-50.51~22.04.1","6.8.0-51.52~22.04.1","6.8.0-52.53~22.04.1","6.8.0-57.59~22.04.1","6.8.0-58.60~22.04.1","6.8.0-59.61~22.04.1","6.8.0-60.63~22.04.1","6.8.0-64.67~22.04.1","6.8.0-65.68~22.04.1","6.8.0-78.78~22.04.1","6.8.0-79.79~22.04.1","6.8.0-83.83~22.04.1","6.8.0-84.84~22.04.1","6.8.0-85.85~22.04.1","6.8.0-86.87~22.04.1","6.8.0-87.88~22.04.1","6.8.0-88.89~22.04.2","6.8.0-90.91~22.04.1","6.8.0-94.96~22.04.1","6.8.0-100.100~22.04.1","6.8.0-101.101~22.04.1","6.8.0-106.106~22.04.1","6.8.0-107.107~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-ibm-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1051.51~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.13~22.04.1","6.8.0-1014.14~22.04.1","6.8.0-1015.15~22.04.1","6.8.0-1016.16~22.04.1","6.8.0-1017.17~22.04.1","6.8.0-1018.18~22.04.1","6.8.0-1019.19~22.04.1","6.8.0-1023.23~22.04.1","6.8.0-1024.24~22.04.1","6.8.0-1025.25~22.04.1","6.8.0-1026.26~22.04.1","6.8.0-1027.27~22.04.1","6.8.0-1028.28~22.04.1","6.8.0-1029.29~22.04.1","6.8.0-1030.30~22.04.1","6.8.0-1033.33~22.04.1","6.8.0-1036.36~22.04.1","6.8.0-1037.37~22.04.1","6.8.0-1038.38~22.04.1","6.8.0-1039.39~22.04.1","6.8.0-1040.40~22.04.1","6.8.0-1041.41~22.04.1","6.8.0-1042.42~22.04.1","6.8.0-1043.43~22.04.1","6.8.0-1044.44~22.04.1","6.8.0-1045.45~22.04.1","6.8.0-1049.49~22.04.1","6.8.0-1050.50~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-intel-iot-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1073.75"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1030.30"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-14.14.1~22.04.1","6.5.0-15.15.1.1~22.04.1","6.5.0-17.17.1.1.1~22.04.1","6.5.0-21.21.1~22.04.1","6.5.0-25.25.1~22.04.1","6.5.0-26.26.1~22.04.1","6.5.0-27.28.1~22.04.1","6.5.0-28.29.1~22.04.1","6.5.0-35.35.1~22.04.1","6.5.0-41.41.1~22.04.1","6.5.0-42.42.1~22.04.1","6.5.0-44.44.1~22.04.1","6.5.0-45.45.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-110.110.1~22.04.1"}]}],"versions":["6.8.0-38.38.1~22.04.2","6.8.0-40.40.1~22.04.1","6.8.0-44.44.1~22.04.1","6.8.0-45.45.1~22.04.1","6.8.0-47.47.1~22.04.1","6.8.0-48.48.3~22.04.1","6.8.0-49.49.1~22.04.1","6.8.0-50.51.1~22.04.1","6.8.0-51.52.1~22.04.1","6.8.0-52.53.1~22.04.1","6.8.0-54.56.1~22.04.1","6.8.0-55.57.1~22.04.1","6.8.0-56.58.1~22.04.1","6.8.0-57.59.1~22.04.1","6.8.0-58.60.1~22.04.1","6.8.0-59.61.1~22.04.1","6.8.0-60.63.1~22.04.1","6.8.0-62.65.1~22.04.1","6.8.0-63.66.1~22.04.1","6.8.0-64.67.1~22.04.1","6.8.0-65.68.1~22.04.1","6.8.0-78.78.1~22.04.1","6.8.0-79.79.1~22.04.1","6.8.0-83.83.1~22.04.1","6.8.0-84.84.1~22.04.1","6.8.0-85.85.1~22.04.1","6.8.0-86.87.1~22.04.1","6.8.0-87.88.1~22.04.1","6.8.0-88.89.1~22.04.1","6.8.0-90.91.1~22.04.1","6.8.0-94.96.1~22.04.1","6.8.0-100.100.1~22.04.1","6.8.0-101.101.1~22.04.1","6.8.0-106.106.1~22.04.1","6.8.0-107.107.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1003.3~22.04.1","6.2.0-1009.9","6.2.0-1010.10","6.2.0-1011.11","6.2.0-1012.12","6.2.0-1013.13","6.2.0-1015.15"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1004.4","6.5.0-1007.7","6.5.0-1013.13","6.5.0-1014.14","6.5.0-1015.15","6.5.0-1018.18","6.5.0-1019.19","6.5.0-1021.22","6.5.0-1022.23","6.5.0-1023.24","6.5.0-1024.25"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1051.54~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1009.9~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.15~22.04.1","6.8.0-1015.16~22.04.1","6.8.0-1017.19~22.04.1","6.8.0-1018.20~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1022.25~22.04.2","6.8.0-1023.26~22.04.1","6.8.0-1024.27~22.04.1","6.8.0-1025.28~22.04.1","6.8.0-1026.29~22.04.1","6.8.0-1027.30~22.04.1","6.8.0-1028.31~22.04.1","6.8.0-1029.32~22.04.1","6.8.0-1030.33~22.04.1","6.8.0-1031.34~22.04.1","6.8.0-1032.35~22.04.1","6.8.0-1035.38~22.04.1","6.8.0-1036.39~22.04.1","6.8.0-1038.41~22.04.1","6.8.0-1039.42~22.04.1","6.8.0-1040.43~22.04.1","6.8.0-1041.44~22.04.2","6.8.0-1042.45~22.04.1","6.8.0-1043.46~22.04.1","6.8.0-1044.47~22.04.1","6.8.0-1045.48~22.04.1","6.8.0-1046.49~22.04.1","6.8.0-1047.50~22.04.1","6.8.0-1049.52~22.04.1","6.8.0-1050.53~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-5.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.17.0-1003.3","5.17.0-1004.4","5.17.0-1006.6","5.17.0-1011.12","5.17.0-1012.13","5.17.0-1013.14","5.17.0-1014.15","5.17.0-1015.16","5.17.0-1016.17","5.17.0-1017.18","5.17.0-1018.19","5.17.0-1019.20","5.17.0-1020.21","5.17.0-1021.22","5.17.0-1024.25","5.17.0-1025.26","5.17.0-1026.27","5.17.0-1027.28","5.17.0-1028.29","5.17.0-1029.30","5.17.0-1030.31","5.17.0-1031.32","5.17.0-1032.33","5.17.0-1033.34","5.17.0-1034.35","5.17.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.0-1006.6","6.0.0-1007.7","6.0.0-1008.8","6.0.0-1009.9","6.0.0-1010.10","6.0.0-1011.11","6.0.0-1012.12","6.0.0-1013.13","6.0.0-1014.14","6.0.0-1015.15","6.0.0-1016.16","6.0.0-1017.17","6.0.0-1018.18","6.0.0-1019.19","6.0.0-1020.20","6.0.0-1021.21"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.0-1004.4","6.1.0-1006.6","6.1.0-1007.7","6.1.0-1008.8","6.1.0-1009.9","6.1.0-1010.10","6.1.0-1012.12","6.1.0-1013.13","6.1.0-1014.14","6.1.0-1015.15","6.1.0-1016.16","6.1.0-1017.17","6.1.0-1019.19","6.1.0-1020.20","6.1.0-1021.21","6.1.0-1022.22","6.1.0-1023.23","6.1.0-1024.24","6.1.0-1025.25","6.1.0-1026.26","6.1.0-1027.27","6.1.0-1028.28","6.1.0-1029.29","6.1.0-1033.33","6.1.0-1034.34","6.1.0-1035.35","6.1.0-1036.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1003.3","6.5.0-1004.4","6.5.0-1006.6","6.5.0-1007.7","6.5.0-1008.8","6.5.0-1009.10","6.5.0-1011.12","6.5.0-1013.14","6.5.0-1014.15","6.5.0-1015.16","6.5.0-1016.17","6.5.0-1018.19","6.5.0-1019.20","6.5.0-1020.21","6.5.0-1022.23","6.5.0-1023.24","6.5.0-1024.25","6.5.0-1025.26","6.5.0-1027.28"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1013.13~22.04.4","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1018.18~22.04.1","6.5.0-1019.19~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1021.21~22.04.1","6.5.0-1023.23~22.04.1","6.5.0-1024.24~22.04.1","6.5.0-1025.25~22.04.1","6.5.0-1026.26~22.04.1","6.5.0-1027.27~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1049.50~22.04.1"}]}],"versions":["6.8.0-1006.6~22.04.3","6.8.0-1008.8~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.13~22.04.1","6.8.0-1014.14~22.04.1","6.8.0-1015.15~22.04.1","6.8.0-1016.17~22.04.1","6.8.0-1017.18~22.04.1","6.8.0-1018.19~22.04.1","6.8.0-1019.20~22.04.1","6.8.0-1020.21~22.04.1","6.8.0-1021.22~22.04.1","6.8.0-1022.23~22.04.1","6.8.0-1023.24~22.04.1","6.8.0-1024.25~22.04.1","6.8.0-1025.26~22.04.1","6.8.0-1026.27~22.04.1","6.8.0-1027.28~22.04.1","6.8.0-1028.29~22.04.1","6.8.0-1029.30~22.04.1","6.8.0-1030.31~22.04.1","6.8.0-1032.33~22.04.1","6.8.0-1033.34~22.04.1","6.8.0-1035.36~22.04.1","6.8.0-1037.38~22.04.1","6.8.0-1038.39~22.04.1","6.8.0-1039.40~22.04.1","6.8.0-1040.41~22.04.1","6.8.0-1041.42~22.04.1","6.8.0-1042.43~22.04.1","6.8.0-1043.44~22.04.1","6.8.0-1044.45~22.04.1","6.8.0-1047.48~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1032.35"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1004.4","5.13.0-1006.6+22.04.1","5.13.0-1007.7+22.04.1","5.13.0-1010.11+22.04.1","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1006.6","5.15.0-1007.7","5.15.0-1008.8","5.15.0-1011.12","5.15.0-1012.13","5.15.0-1014.16","5.15.0-1015.17","5.15.0-1016.18","5.15.0-1017.19","5.15.0-1018.21","5.15.0-1019.22","5.15.0-1020.23","5.15.0-1022.26","5.15.0-1023.27","5.15.0-1026.30","5.15.0-1027.31","5.15.0-1028.32"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1012.13~22.04.1","5.19.0-1015.16~22.04.1","5.19.0-1016.17~22.04.1","5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1","5.19.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-17.17.1.1~22.04.1","6.5.0-21.21.1~22.04.1","6.5.0-25.25.1~22.04.1","6.5.0-26.26.1~22.04.1","6.5.0-27.28.1~22.04.1","6.5.0-28.29.1~22.04.1","6.5.0-35.35.1~22.04.1","6.5.0-40.40.1~22.04.1","6.5.0-42.42.1~22.04.1","6.5.0-45.45.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-110.110~22.04.1"}]}],"versions":["6.8.0-38.38.1~22.04.1","6.8.0-39.39.1~22.04.1","6.8.0-40.40.1~22.04.1","6.8.0-41.41.1~22.04.1","6.8.0-44.44.1~22.04.1","6.8.0-47.47.1~22.04.1","6.8.0-48.48.1~22.04.2","6.8.0-49.49.1~22.04.1","6.8.0-50.51.1~22.04.1","6.8.0-51.52.1~22.04.1","6.8.0-52.53.1~22.04.1","6.8.0-53.55.1~22.04.1","6.8.0-55.57.1~22.04.1","6.8.0-56.58.1~22.04.1","6.8.0-57.59.1~22.04.1","6.8.0-58.60.1~22.04.1","6.8.0-59.61.1~22.04.1","6.8.0-62.65~22.04.1","6.8.0-63.66~22.04.1","6.8.0-64.67~22.04.1","6.8.0-71.71~22.04.1","6.8.0-78.78~22.04.1","6.8.0-79.79~22.04.1","6.8.0-83.83~22.04.1","6.8.0-84.84~22.04.1","6.8.0-86.87~22.04.1","6.8.0-87.88~22.04.1","6.8.0-88.89~22.04.1","6.8.0-90.91~22.04.1","6.8.0-94.96~22.04.1","6.8.0-100.100~22.04.1","6.8.0-101.101~22.04.1","6.8.0-106.106~22.04.1","6.8.0-107.107~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1014.16~22.04.1","5.19.0-1015.17~22.04.1","5.19.0-1016.18~22.04.1","5.19.0-1017.19~22.04.1","5.19.0-1018.20~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1006.7~22.04.1","6.2.0-1007.8~22.04.1","6.2.0-1009.10~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.8~22.04.1","6.5.0-1008.9~22.04.1","6.5.0-1009.10~22.04.1","6.5.0-1010.11~22.04.1","6.5.0-1011.12~22.04.1","6.5.0-1012.13~22.04.1","6.5.0-1014.15~22.04.1","6.5.0-1015.16~22.04.1","6.5.0-1016.17~22.04.1","6.5.0-1017.18~22.04.1","6.5.0-1018.19~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:22.04:LTS","package":"linux-realtime-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.1-1047.48~22.04.1"}]}],"versions":["6.8.1-1004.4~22.04.1","6.8.1-1005.5~22.04.2","6.8.1-1006.6~22.04.1","6.8.1-1007.7~22.04.1","6.8.1-1008.8~22.04.1","6.8.1-1009.9~22.04.1","6.8.1-1010.10~22.04.1","6.8.1-1011.11~22.04.1","6.8.1-1012.12~22.04.1","6.8.1-1013.14~22.04.1","6.8.1-1014.15~22.04.1","6.8.1-1015.16~22.04.1","6.8.1-1016.17~22.04.1","6.8.1-1017.18~22.04.1","6.8.1-1018.19~22.04.1","6.8.1-1019.20~22.04.1","6.8.1-1020.21~22.04.1","6.8.1-1021.22~22.04.1","6.8.1-1022.23~22.04.1","6.8.1-1023.24~22.04.1","6.8.1-1024.25~22.04.1","6.8.1-1025.26~22.04.1","6.8.1-1026.27~22.04.1","6.8.1-1030.31~22.04.1","6.8.1-1031.32~22.04.1","6.8.1-1034.35~22.04.1","6.8.1-1035.36~22.04.1","6.8.1-1036.37~22.04.1","6.8.1-1037.38~22.04.1","6.8.1-1038.39~22.04.1","6.8.1-1039.40~22.04.1","6.8.1-1040.41~22.04.1","6.8.1-1041.42~22.04.1","6.8.1-1042.43~22.04.1","6.8.1-1045.46~22.04.1","6.8.1-1046.47~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-110.110"}]}],"versions":["6.5.0-9.9","6.6.0-14.14","6.8.0-11.11","6.8.0-20.20","6.8.0-22.22","6.8.0-28.28","6.8.0-31.31","6.8.0-35.35","6.8.0-36.36","6.8.0-38.38","6.8.0-39.39","6.8.0-40.40","6.8.0-41.41","6.8.0-44.44","6.8.0-45.45","6.8.0-47.47","6.8.0-48.48","6.8.0-49.49","6.8.0-50.51","6.8.0-51.52","6.8.0-52.53","6.8.0-53.55","6.8.0-54.56","6.8.0-55.57","6.8.0-56.58","6.8.0-57.59","6.8.0-58.60","6.8.0-59.61","6.8.0-60.63","6.8.0-62.65","6.8.0-63.66","6.8.0-64.67","6.8.0-71.71","6.8.0-78.78","6.8.0-79.79","6.8.0-83.83","6.8.0-84.84","6.8.0-85.85","6.8.0-86.87","6.8.0-87.88","6.8.0-88.89","6.8.0-90.91","6.8.0-94.96","6.8.0-100.100","6.8.0-101.101","6.8.0-106.106","6.8.0-107.107"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1052.55"}]}],"versions":["6.5.0-1008.8","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1006.6","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1016.17","6.8.0-1017.18","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1023.25","6.8.0-1024.26","6.8.0-1025.27","6.8.0-1026.28","6.8.0-1027.29","6.8.0-1028.30","6.8.0-1029.31","6.8.0-1030.32","6.8.0-1031.33","6.8.0-1032.34","6.8.0-1033.35","6.8.0-1035.37","6.8.0-1036.38","6.8.0-1038.40","6.8.0-1039.41","6.8.0-1040.42","6.8.0-1041.43","6.8.0-1042.44","6.8.0-1043.45","6.8.0-1044.46","6.8.0-1045.47","6.8.0-1046.49","6.8.0-1047.50","6.8.0-1050.53","6.8.0-1051.54"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1009.9~24.04.1","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1016.16~24.04.1","6.14.0-1017.17~24.04.1","6.14.0-1018.18~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1009.9~24.04.2"}]}],"versions":["6.17.0-1005.5~24.04.2","6.17.0-1007.7~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1054.60"}]}],"versions":["6.5.0-1007.7","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1012.14","6.8.0-1013.15","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.20","6.8.0-1018.21","6.8.0-1020.23","6.8.0-1021.25","6.8.0-1025.30","6.8.0-1026.31","6.8.0-1027.32","6.8.0-1028.33","6.8.0-1029.34","6.8.0-1030.35","6.8.0-1031.36","6.8.0-1034.39","6.8.0-1038.44","6.8.0-1040.46","6.8.0-1041.47","6.8.0-1042.48","6.8.0-1044.50","6.8.0-1046.52","6.8.0-1051.57","6.8.0-1052.58"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1008.8~24.04.1","6.11.0-1012.12~24.04.1","6.11.0-1013.13~24.04.1","6.11.0-1014.14~24.04.1","6.11.0-1015.15~24.04.1","6.11.0-1017.17~24.04.1","6.11.0-1018.18~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1010.10~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1010.10~24.04.1"}]}],"versions":["6.17.0-1008.8~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1058.65"}]}],"versions":["6.8.0-1041.48","6.8.0-1044.51","6.8.0-1046.53","6.8.0-1053.60"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-fde-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-nvidia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1013.14","6.8.0-1014.15","6.8.0-1016.17","6.8.0-1018.19","6.8.0-1019.20","6.8.0-1022.23","6.8.0-1025.27","6.8.0-1027.30","6.8.0-1029.32","6.8.0-1039.42"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-nvidia-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1003.3","6.14.0-1006.6","6.14.0-1007.7"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1054.57"}]}],"versions":["6.5.0-1007.7","6.6.0-1001.1","6.8.0-1002.2","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.9","6.8.0-1009.10","6.8.0-1010.11","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1024.26","6.8.0-1025.27","6.8.0-1026.28","6.8.0-1027.29","6.8.0-1028.30","6.8.0-1029.31","6.8.0-1030.32","6.8.0-1031.33","6.8.0-1032.34","6.8.0-1033.35","6.8.0-1034.36","6.8.0-1036.38","6.8.0-1037.39","6.8.0-1039.41","6.8.0-1040.42","6.8.0-1041.43","6.8.0-1042.45","6.8.0-1043.46","6.8.0-1044.47","6.8.0-1045.48","6.8.0-1046.49","6.8.0-1047.50","6.8.0-1048.51","6.8.0-1052.55","6.8.0-1053.56"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1006.6~24.04.2","6.11.0-1011.11~24.04.1","6.11.0-1013.13~24.04.1","6.11.0-1014.14~24.04.1","6.11.0-1015.15~24.04.1","6.11.0-1016.16~24.04.1","6.11.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1014.15~24.04.1","6.14.0-1015.16~24.04.1","6.14.0-1016.17~24.04.1","6.14.0-1017.18~24.04.1","6.14.0-1018.19~24.04.1","6.14.0-1019.20~24.04.1","6.14.0-1020.21~24.04.1","6.14.0-1021.22~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1009.9~24.04.3"}]}],"versions":["6.17.0-1004.4~24.04.3","6.17.0-1008.8~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1050.56"}]}],"versions":["6.8.0-1003.5","6.8.0-1004.7","6.8.0-1005.8","6.8.0-1006.9","6.8.0-1007.10","6.8.0-1008.11","6.8.0-1009.12","6.8.0-1010.13","6.8.0-1011.14","6.8.0-1012.15","6.8.0-1013.17","6.8.0-1014.18","6.8.0-1015.19","6.8.0-1016.20","6.8.0-1017.21","6.8.0-1019.23","6.8.0-1020.24","6.8.0-1021.25","6.8.0-1022.26","6.8.0-1023.27","6.8.0-1024.28","6.8.0-1025.29","6.8.0-1026.30","6.8.0-1027.31","6.8.0-1028.32","6.8.0-1029.33","6.8.0-1032.36","6.8.0-1033.37","6.8.0-1035.39","6.8.0-1036.40","6.8.0-1037.41","6.8.0-1038.43","6.8.0-1039.44","6.8.0-1040.45","6.8.0-1041.46","6.8.0-1042.47","6.8.0-1043.48","6.8.0-1044.49","6.8.0-1048.53","6.8.0-1049.54"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1037.40"}]}],"versions":["6.8.0-1001.3","6.8.0-1002.4","6.8.0-1003.5","6.8.0-1004.6","6.8.0-1006.8","6.8.0-1007.9","6.8.0-1008.10","6.8.0-1009.11","6.8.0-1010.12","6.8.0-1011.13","6.8.0-1012.14","6.8.0-1013.15","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1022.24","6.8.0-1023.25","6.8.0-1024.26","6.8.0-1025.28","6.8.0-1026.29","6.8.0-1027.30","6.8.0-1028.31","6.8.0-1029.32","6.8.0-1030.33","6.8.0-1031.34","6.8.0-1035.38","6.8.0-1036.39"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-hwe-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-17.17~24.04.2","6.11.0-19.19~24.04.1","6.11.0-21.21~24.04.1","6.11.0-24.24~24.04.1","6.11.0-25.25~24.04.1","6.11.0-26.26~24.04.1","6.11.0-28.28~24.04.1","6.11.0-29.29~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-hwe-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-24.24~24.04.3","6.14.0-27.27~24.04.1","6.14.0-28.28~24.04.1","6.14.0-29.29~24.04.1","6.14.0-32.32~24.04.1","6.14.0-33.33~24.04.1","6.14.0-34.34~24.04.1","6.14.0-35.35~24.04.1","6.14.0-36.36~24.04.1","6.14.0-37.37~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-hwe-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-19.19~24.04.2"}]}],"versions":["6.17.0-14.14~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1051.51"}]}],"versions":["6.5.0-1009.9","6.8.0-1001.1","6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1015.15","6.8.0-1016.16","6.8.0-1017.17","6.8.0-1018.18","6.8.0-1019.19","6.8.0-1022.22","6.8.0-1023.23","6.8.0-1024.24","6.8.0-1025.25","6.8.0-1026.26","6.8.0-1027.27","6.8.0-1028.28","6.8.0-1029.29","6.8.0-1030.30","6.8.0-1033.33","6.8.0-1036.36","6.8.0-1037.37","6.8.0-1038.38","6.8.0-1039.39","6.8.0-1040.40","6.8.0-1041.41","6.8.0-1042.42","6.8.0-1043.43","6.8.0-1044.44","6.8.0-1045.45","6.8.0-1049.49","6.8.0-1050.50"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-110.110.1"}]}],"versions":["6.5.0-9.9.1","6.6.0-14.14.1","6.8.0-7.7.1","6.8.0-25.25.3","6.8.0-28.28.1","6.8.0-31.31.1","6.8.0-35.35.1","6.8.0-36.36.1","6.8.0-38.38.1","6.8.0-39.39.1","6.8.0-40.40.1","6.8.0-41.41.1","6.8.0-44.44.1","6.8.0-45.45.1","6.8.0-47.47.1","6.8.0-48.48.3","6.8.0-49.49.1","6.8.0-50.51.1","6.8.0-51.52.1","6.8.0-52.53.1","6.8.0-53.55.2","6.8.0-54.56.1","6.8.0-55.57.1","6.8.0-56.58.1","6.8.0-57.59.1","6.8.0-58.60.1","6.8.0-59.61.1","6.8.0-60.63.1","6.8.0-62.65.1","6.8.0-63.66.1","6.8.0-64.67.1","6.8.0-65.68.1","6.8.0-78.78.1","6.8.0-79.79.1","6.8.0-83.83.1","6.8.0-84.84.1","6.8.0-85.85.1","6.8.0-86.87.1","6.8.0-87.88.1","6.8.0-88.89.1","6.8.0-90.91.1","6.8.0-94.96.1","6.8.0-100.100.1","6.8.0-101.101.1","6.8.0-106.106.1","6.8.0-107.107.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency-hwe-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1009.10~24.04.1","6.11.0-1011.12~24.04.1","6.11.0-1012.13~24.04.1","6.11.0-1013.14~24.04.1","6.11.0-1014.15~24.04.1","6.11.0-1015.16~24.04.2","6.11.0-1016.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1051.54"}]}],"versions":["6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1022.25","6.8.0-1023.26","6.8.0-1024.27","6.8.0-1025.28","6.8.0-1026.29","6.8.0-1027.30","6.8.0-1028.31","6.8.0-1029.32","6.8.0-1030.33","6.8.0-1031.34","6.8.0-1032.35","6.8.0-1035.38","6.8.0-1036.39","6.8.0-1038.41","6.8.0-1039.42","6.8.0-1040.43","6.8.0-1041.44","6.8.0-1042.45","6.8.0-1043.46","6.8.0-1044.47","6.8.0-1045.48","6.8.0-1046.49","6.8.0-1047.50","6.8.0-1049.52","6.8.0-1050.53"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1002.2","6.11.0-1003.3","6.11.0-1007.7","6.11.0-1010.10","6.11.0-1011.11","6.11.0-1012.12","6.11.0-1013.13","6.11.0-1016.16"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1018.18"}]}],"versions":["6.17.0-1004.4","6.17.0-1008.8","6.17.0-1014.14"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1051.54.1"}]}],"versions":["6.8.0-1009.9.1","6.8.0-1011.11.1","6.8.0-1012.12.1","6.8.0-1013.14.1","6.8.0-1014.15.1","6.8.0-1015.16.1","6.8.0-1017.19.1","6.8.0-1018.20.1","6.8.0-1019.21.1","6.8.0-1020.22.1","6.8.0-1021.23.1","6.8.0-1022.25.2","6.8.0-1023.26.1","6.8.0-1024.27.1","6.8.0-1025.28.1","6.8.0-1026.29.1","6.8.0-1027.30.1","6.8.0-1028.31.1","6.8.0-1029.32.1","6.8.0-1030.33.1","6.8.0-1031.34.1","6.8.0-1032.35.1","6.8.0-1035.38.1","6.8.0-1036.39.1","6.8.0-1038.41.1","6.8.0-1039.42.1","6.8.0-1040.43.1","6.8.0-1041.44.1","6.8.0-1042.45.1","6.8.0-1043.46.1","6.8.0-1044.47.1","6.8.0-1045.48.1","6.8.0-1046.49.1","6.8.0-1047.50.1","6.8.0-1049.52.1","6.8.0-1050.53.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-tegra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1022.22"}]}],"versions":["6.8.0-1003.3","6.8.0-1004.4","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1016.16","6.8.0-1019.19","6.8.0-1020.20","6.8.0-1021.21"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1007.7","6.11.0-1008.8","6.11.0-1009.9","6.11.0-1010.10","6.11.0-1011.11","6.11.0-1012.12","6.11.0-1013.13","6.11.0-1015.15","6.11.0-1016.16","6.11.0-1017.17","6.11.0-1018.18","6.11.0-1020.20","6.11.0-1021.21","6.11.0-1022.22","6.11.0-1023.23","6.11.0-1024.24","6.11.0-1025.25","6.11.0-1027.27"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1004.4","6.14.0-1005.5","6.14.0-1006.6","6.14.0-1007.7","6.14.0-1008.8","6.14.0-1010.10","6.14.0-1011.11","6.14.0-1012.12","6.14.0-1013.13","6.14.0-1014.14","6.14.0-1015.15","6.14.0-1016.16","6.14.0-1017.17","6.14.0-1018.18","6.14.0-1019.19","6.14.0-1020.20"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1017.17"}]}],"versions":["6.17.0-1005.5","6.17.0-1006.6","6.17.0-1007.7","6.17.0-1008.8","6.17.0-1009.9","6.17.0-1010.10","6.17.0-1011.11","6.17.0-1012.12"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1016.16","6.8.0-1017.17","6.8.0-1018.18","6.8.0-1019.19","6.8.0-1020.20","6.8.0-1024.24","6.8.0-1025.25","6.8.0-1026.26","6.8.0-1027.27","6.8.0-1028.28","6.8.0-1029.29","6.8.0-1030.30","6.8.0-1031.31","6.8.0-1032.32"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1049.50"}]}],"versions":["6.5.0-1010.10","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1008.8","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1015.16","6.8.0-1016.17","6.8.0-1017.18","6.8.0-1018.19","6.8.0-1019.20","6.8.0-1020.21","6.8.0-1021.22","6.8.0-1022.23","6.8.0-1023.24","6.8.0-1024.25","6.8.0-1025.26","6.8.0-1026.27","6.8.0-1027.28","6.8.0-1028.29","6.8.0-1029.30","6.8.0-1030.31","6.8.0-1032.33","6.8.0-1033.34","6.8.0-1035.36","6.8.0-1037.38","6.8.0-1038.39","6.8.0-1039.40","6.8.0-1040.41","6.8.0-1041.42","6.8.0-1042.43","6.8.0-1043.44","6.8.0-1044.45","6.8.0-1047.48"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1009.9~24.04.1","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1016.16~24.04.1","6.14.0-1017.17~24.04.1","6.14.0-1018.18~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1009.9~24.04.1"}]}],"versions":["6.17.0-1004.4~24.04.2","6.17.0-1007.7~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1052.56"}]}],"versions":["6.5.0-1005.7","6.7.0-1001.1","6.8.0-1001.1","6.8.0-1002.2","6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.10","6.8.0-1010.11","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.23","6.8.0-1020.24","6.8.0-1024.28","6.8.0-1028.32","6.8.0-1029.33","6.8.0-1030.34","6.8.0-1031.35","6.8.0-1032.36","6.8.0-1035.39","6.8.0-1036.40","6.8.0-1038.42","6.8.0-1039.43","6.8.0-1040.44","6.8.0-1041.45","6.8.0-1042.46","6.8.0-1043.47","6.8.0-1044.48","6.8.0-1045.49","6.8.0-1047.51","6.8.0-1048.52","6.8.0-1050.54","6.8.0-1051.55"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-2019.20"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.1-1015.16"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-9.9.1","6.8.0-20.20.1","6.8.0-28.28.1","6.8.0-31.31.1","6.8.0-35.35.1","6.8.0-36.36.1","6.8.0-38.38.1","6.8.0-39.39.1","6.8.0-40.40.1","6.8.0-41.41.1","6.8.0-44.44.1","6.8.0-47.47.1","6.8.0-48.48.1","6.8.0-49.49.1","6.8.0-50.51.1","6.8.0-51.52.1","6.8.0-52.53.1","6.8.0-53.55.1","6.8.0-55.57.1","6.8.0-56.58.1","6.8.0-57.59.1","6.8.0-58.60.1","6.8.0-59.61.1","6.8.0-60.63.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-22.22.1~24.04.1","6.14.0-23.23.1~24.04.1","6.14.0-24.24.1~24.04.1","6.14.0-27.27.1~24.04.1","6.14.0-28.28.1~24.04.1","6.14.0-29.29.1~24.04.1","6.14.0-32.32.1~24.04.1","6.14.0-33.33.1~24.04.1","6.14.0-34.34.1~24.04.1","6.14.0-35.35.1~24.04.1","6.14.0-36.36.1~24.04.1","6.14.0-37.37.1~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-19.19.1~24.04.1"}]}],"versions":["6.17.0-14.14.1~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-xilinx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1028.29"}]}],"versions":["6.8.0-1008.9","6.8.0-1009.10","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1017.18","6.8.0-1018.19","6.8.0-1019.20","6.8.0-1020.21","6.8.0-1021.22","6.8.0-1022.23","6.8.0-1023.24","6.8.0-1024.25"]},{"source":"osv","ecosystem":"Ubuntu:Nvidia-BlueField:24.04:LTS","package":"linux-bluefield","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1017.21"}]}],"versions":["6.8.0-1011.15","6.8.0-1012.16","6.8.0-1013.17","6.8.0-1014.18","6.8.0-1016.20"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-raspi-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-2042.43"}]}],"versions":["6.7.0-2001.1","6.8.0-2001.1","6.8.0-2002.2","6.8.0-2004.4","6.8.0-2005.5","6.8.0-2006.6","6.8.0-2007.7","6.8.0-2008.8","6.8.0-2009.9","6.8.0-2010.10","6.8.0-2011.11","6.8.0-2012.12","6.8.0-2013.14","6.8.0-2014.15","6.8.0-2015.16","6.8.0-2016.17","6.8.0-2017.18","6.8.0-2018.19","6.8.0-2019.20","6.8.0-2022.23","6.8.0-2023.24","6.8.0-2024.25","6.8.0-2025.26","6.8.0-2026.27","6.8.0-2028.29","6.8.0-2029.30","6.8.0-2030.31","6.8.0-2031.32","6.8.0-2032.33","6.8.0-2033.34","6.8.0-2034.35","6.8.0-2035.36","6.8.0-2036.37","6.8.0-2037.38","6.8.0-2038.39","6.8.0-2040.41","6.8.0-2041.42"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.1-1047.48"}]}],"versions":["6.8.0-1008.19","6.8.1-1001.1","6.8.1-1002.2","6.8.1-1003.3","6.8.1-1004.4","6.8.1-1005.5","6.8.1-1006.6","6.8.1-1007.7","6.8.1-1008.8","6.8.1-1009.9","6.8.1-1010.10","6.8.1-1011.11","6.8.1-1012.12","6.8.1-1013.14","6.8.1-1014.15","6.8.1-1015.16","6.8.1-1016.17","6.8.1-1017.18","6.8.1-1018.19","6.8.1-1019.20","6.8.1-1020.21","6.8.1-1021.22","6.8.1-1022.23","6.8.1-1023.24","6.8.1-1024.25","6.8.1-1025.26","6.8.1-1026.27","6.8.1-1030.31","6.8.1-1031.32","6.8.1-1033.34","6.8.1-1034.35","6.8.1-1035.36","6.8.1-1036.37","6.8.1-1037.38","6.8.1-1038.39","6.8.1-1039.40","6.8.1-1040.41","6.8.1-1041.42","6.8.1-1042.43","6.8.1-1045.46","6.8.1-1046.47"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1003.3~24.04.3","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1016.16~24.04.1","6.14.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1008.9~24.04.1"}]}],"versions":["6.17.0-1004.5~24.04.2","6.17.0-1006.7~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-aws-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1052.55+fips1"}]}],"versions":["6.8.0-1035.37+fips1","6.8.0-1036.38+fips1","6.8.0-1038.40+fips1","6.8.0-1039.41+fips1","6.8.0-1040.42+fips1","6.8.0-1041.43+fips1","6.8.0-1042.44+fips1","6.8.0-1043.45+fips1","6.8.0-1044.46+fips1","6.8.0-1045.47+fips1","6.8.0-1046.49+fips1","6.8.0-1047.50+fips1","6.8.0-1050.53+fips1","6.8.0-1051.54+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-azure-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1053.59+fips1"}]}],"versions":["6.8.0-1034.39+fips1","6.8.0-1040.46+fips1","6.8.0-1044.50+fips1","6.8.0-1046.52+fips1","6.8.0-1047.53+fips1","6.8.0-1052.58+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-110.110+fips2"}]}],"versions":["6.8.0-38.38+fips4","6.8.0-78.78+fips1","6.8.0-79.79+fips1","6.8.0-83.83+fips1","6.8.0-84.84+fips1","6.8.0-85.85+fips1","6.8.0-86.87+fips1","6.8.0-87.88+fips1","6.8.0-88.89+fips1","6.8.0-90.91+fips1","6.8.0-94.96+fips1","6.8.0-100.100+fips1","6.8.0-101.101+fips1","6.8.0-106.106+fips1","6.8.0-107.107+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-gcp-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1054.57+fips1"}]}],"versions":["6.8.0-1036.38+fips1","6.8.0-1037.39+fips1","6.8.0-1039.41+fips1","6.8.0-1040.42+fips1","6.8.0-1041.43+fips1","6.8.0-1042.45+fips1","6.8.0-1043.46+fips1","6.8.0-1044.47+fips1","6.8.0-1045.48+fips1","6.8.0-1046.49+fips1","6.8.0-1047.50+fips1","6.8.0-1048.51+fips1","6.8.0-1052.55+fips1","6.8.0-1053.56+fips1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-19.19"}]}],"versions":["6.14.0-15.15","6.15.0-3.3","6.15.0-4.4","6.16.0-13.13","6.16.0-16.16","6.17.0-3.3","6.17.0-4.4","6.17.0-5.5","6.17.0-6.6","6.17.0-7.7","6.17.0-8.8","6.17.0-12.12","6.17.0-14.14"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1009.9"}]}],"versions":["6.14.0-1005.5","6.14.0-1007.7+25.10.2","6.16.0-1001.1","6.17.0-1001.1","6.17.0-1002.2","6.17.0-1003.3","6.17.0-1004.4","6.17.0-1005.5","6.17.0-1006.6","6.17.0-1007.7"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1010.10"}]}],"versions":["6.14.0-1004.4","6.14.0-1007.7+25.10.1","6.16.0-1001.1","6.17.0-1002.2","6.17.0-1003.3","6.17.0-1004.4","6.17.0-1006.6","6.17.0-1007.7","6.17.0-1008.8"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1003.3","6.17.0-1004.4","6.17.0-1005.5","6.17.0-1007.7","6.17.0-1008.8","6.17.0-1010.10","6.17.0-1012.12","6.17.0-1014.14","6.17.0-1015.15","6.17.0-1017.17"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1009.9"}]}],"versions":["6.14.0-1006.6","6.14.0-1009.9+25.10.1","6.16.0-1001.1","6.17.0-1001.1","6.17.0-1002.2","6.17.0-1003.3","6.17.0-1004.4","6.17.0-1005.5","6.17.0-1006.6","6.17.0-1007.7"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1009.9"}]}],"versions":["6.14.0-1005.5","6.14.0-1007.7+25.10.1","6.16.0-1001.1","6.17.0-1001.1","6.17.0-1002.2","6.17.0-1003.3","6.17.0-1005.5","6.17.0-1006.6","6.17.0-1007.7"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-raspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1010.10"}]}],"versions":["6.14.0-1005.5","6.17.0-1003.3","6.17.0-1004.4","6.17.0-1005.5","6.17.0-1006.6","6.17.0-1007.7","6.17.0-1008.8"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1008.9"}]}],"versions":["6.14.0-1002.2","6.17.0-1001.2","6.17.0-1002.3","6.17.0-1003.4","6.17.0-1004.5","6.17.0-1005.6","6.17.0-1006.7"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-19.19.1"}]}],"versions":["6.14.0-13.13.2","6.17.0-4.4.1","6.17.0-5.5.1","6.17.0-6.6.1","6.17.0-7.7.1","6.17.0-8.8.1","6.17.0-12.12.1","6.17.0-14.14.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1009.9~24.04.2"}]}],"versions":["6.17.0-1005.5~24.04.2","6.17.0-1007.7~24.04.1"],"bundled":172},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-hwe-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-19.19~24.04.2"}]}],"versions":["6.17.0-14.14~24.04.1"],"bundled":172},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1009.9~24.04.1"}]}],"versions":["6.17.0-1004.4~24.04.2","6.17.0-1007.7~24.04.1"],"bundled":172},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-19.19"}]}],"versions":["6.14.0-15.15","6.15.0-3.3","6.15.0-4.4","6.16.0-13.13","6.16.0-16.16","6.17.0-3.3","6.17.0-4.4","6.17.0-5.5","6.17.0-6.6","6.17.0-7.7","6.17.0-8.8","6.17.0-12.12","6.17.0-14.14"],"bundled":172},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1009.9"}]}],"versions":["6.14.0-1005.5","6.14.0-1007.7+25.10.2","6.16.0-1001.1","6.17.0-1001.1","6.17.0-1002.2","6.17.0-1003.3","6.17.0-1004.4","6.17.0-1005.5","6.17.0-1006.6","6.17.0-1007.7"],"bundled":172},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1009.9"}]}],"versions":["6.14.0-1006.6","6.14.0-1009.9+25.10.1","6.16.0-1001.1","6.17.0-1001.1","6.17.0-1002.2","6.17.0-1003.3","6.17.0-1004.4","6.17.0-1005.5","6.17.0-1006.6","6.17.0-1007.7"],"bundled":172},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1009.9"}]}],"versions":["6.14.0-1005.5","6.14.0-1007.7+25.10.1","6.16.0-1001.1","6.17.0-1001.1","6.17.0-1002.2","6.17.0-1003.3","6.17.0-1005.5","6.17.0-1006.6","6.17.0-1007.7"],"bundled":172},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1009.9~24.04.3"}]}],"versions":["6.17.0-1004.4~24.04.3","6.17.0-1008.8~24.04.1"],"bundled":172},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1008.9"}]}],"versions":["6.14.0-1002.2","6.17.0-1001.2","6.17.0-1002.3","6.17.0-1003.4","6.17.0-1004.5","6.17.0-1005.6","6.17.0-1006.7"],"bundled":172},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1008.9~24.04.1"}]}],"versions":["6.17.0-1004.5~24.04.2","6.17.0-1006.7~24.04.1"],"bundled":172},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1010.10~24.04.1"}]}],"versions":["6.17.0-1008.8~24.04.1"],"bundled":172},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1010.10"}]}],"versions":["6.14.0-1004.4","6.14.0-1007.7+25.10.1","6.16.0-1001.1","6.17.0-1002.2","6.17.0-1003.3","6.17.0-1004.4","6.17.0-1006.6","6.17.0-1007.7","6.17.0-1008.8"],"bundled":172},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-raspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1010.10"}]}],"versions":["6.14.0-1005.5","6.17.0-1003.3","6.17.0-1004.4","6.17.0-1005.5","6.17.0-1006.6","6.17.0-1007.7","6.17.0-1008.8"],"bundled":172},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1017.17"}]}],"versions":["6.17.0-1005.5","6.17.0-1006.6","6.17.0-1007.7","6.17.0-1008.8","6.17.0-1009.9","6.17.0-1010.10","6.17.0-1011.11","6.17.0-1012.12"],"bundled":186},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1052.55~22.04.1"}]}],"versions":["6.8.0-1009.9~22.04.2","6.8.0-1010.10~22.04.2","6.8.0-1011.12~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.15~22.04.1","6.8.0-1015.16~22.04.1","6.8.0-1016.17~22.04.2","6.8.0-1017.18~22.04.1","6.8.0-1018.19~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1023.25~22.04.1","6.8.0-1024.26~22.04.1","6.8.0-1027.29~22.04.1","6.8.0-1028.30~22.04.1","6.8.0-1029.31~22.04.1","6.8.0-1030.32~22.04.1","6.8.0-1031.33~22.04.1","6.8.0-1032.34~22.04.1","6.8.0-1033.35~22.04.1","6.8.0-1035.37~22.04.1","6.8.0-1036.38~22.04.1","6.8.0-1039.41~22.04.1","6.8.0-1040.42~22.04.1","6.8.0-1041.43~22.04.1","6.8.0-1042.44~22.04.1","6.8.0-1043.45~22.04.1","6.8.0-1044.46~22.04.1","6.8.0-1045.47~22.04.1","6.8.0-1046.49~22.04.1","6.8.0-1047.50~22.04.1","6.8.0-1050.53~22.04.1","6.8.0-1051.54~22.04.1"],"bundled":174},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-110.110.1~22.04.1"}]}],"versions":["6.8.0-38.38.1~22.04.2","6.8.0-40.40.1~22.04.1","6.8.0-44.44.1~22.04.1","6.8.0-45.45.1~22.04.1","6.8.0-47.47.1~22.04.1","6.8.0-48.48.3~22.04.1","6.8.0-49.49.1~22.04.1","6.8.0-50.51.1~22.04.1","6.8.0-51.52.1~22.04.1","6.8.0-52.53.1~22.04.1","6.8.0-54.56.1~22.04.1","6.8.0-55.57.1~22.04.1","6.8.0-56.58.1~22.04.1","6.8.0-57.59.1~22.04.1","6.8.0-58.60.1~22.04.1","6.8.0-59.61.1~22.04.1","6.8.0-60.63.1~22.04.1","6.8.0-62.65.1~22.04.1","6.8.0-63.66.1~22.04.1","6.8.0-64.67.1~22.04.1","6.8.0-65.68.1~22.04.1","6.8.0-78.78.1~22.04.1","6.8.0-79.79.1~22.04.1","6.8.0-83.83.1~22.04.1","6.8.0-84.84.1~22.04.1","6.8.0-85.85.1~22.04.1","6.8.0-86.87.1~22.04.1","6.8.0-87.88.1~22.04.1","6.8.0-88.89.1~22.04.1","6.8.0-90.91.1~22.04.1","6.8.0-94.96.1~22.04.1","6.8.0-100.100.1~22.04.1","6.8.0-101.101.1~22.04.1","6.8.0-106.106.1~22.04.1","6.8.0-107.107.1~22.04.1"],"bundled":174},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-110.110"}]}],"versions":["6.5.0-9.9","6.6.0-14.14","6.8.0-11.11","6.8.0-20.20","6.8.0-22.22","6.8.0-28.28","6.8.0-31.31","6.8.0-35.35","6.8.0-36.36","6.8.0-38.38","6.8.0-39.39","6.8.0-40.40","6.8.0-41.41","6.8.0-44.44","6.8.0-45.45","6.8.0-47.47","6.8.0-48.48","6.8.0-49.49","6.8.0-50.51","6.8.0-51.52","6.8.0-52.53","6.8.0-53.55","6.8.0-54.56","6.8.0-55.57","6.8.0-56.58","6.8.0-57.59","6.8.0-58.60","6.8.0-59.61","6.8.0-60.63","6.8.0-62.65","6.8.0-63.66","6.8.0-64.67","6.8.0-71.71","6.8.0-78.78","6.8.0-79.79","6.8.0-83.83","6.8.0-84.84","6.8.0-85.85","6.8.0-86.87","6.8.0-87.88","6.8.0-88.89","6.8.0-90.91","6.8.0-94.96","6.8.0-100.100","6.8.0-101.101","6.8.0-106.106","6.8.0-107.107"],"bundled":174},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1052.55"}]}],"versions":["6.5.0-1008.8","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1006.6","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1016.17","6.8.0-1017.18","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1023.25","6.8.0-1024.26","6.8.0-1025.27","6.8.0-1026.28","6.8.0-1027.29","6.8.0-1028.30","6.8.0-1029.31","6.8.0-1030.32","6.8.0-1031.33","6.8.0-1032.34","6.8.0-1033.35","6.8.0-1035.37","6.8.0-1036.38","6.8.0-1038.40","6.8.0-1039.41","6.8.0-1040.42","6.8.0-1041.43","6.8.0-1042.44","6.8.0-1043.45","6.8.0-1044.46","6.8.0-1045.47","6.8.0-1046.49","6.8.0-1047.50","6.8.0-1050.53","6.8.0-1051.54"],"bundled":174},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1054.57"}]}],"versions":["6.5.0-1007.7","6.6.0-1001.1","6.8.0-1002.2","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.9","6.8.0-1009.10","6.8.0-1010.11","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1024.26","6.8.0-1025.27","6.8.0-1026.28","6.8.0-1027.29","6.8.0-1028.30","6.8.0-1029.31","6.8.0-1030.32","6.8.0-1031.33","6.8.0-1032.34","6.8.0-1033.35","6.8.0-1034.36","6.8.0-1036.38","6.8.0-1037.39","6.8.0-1039.41","6.8.0-1040.42","6.8.0-1041.43","6.8.0-1042.45","6.8.0-1043.46","6.8.0-1044.47","6.8.0-1045.48","6.8.0-1046.49","6.8.0-1047.50","6.8.0-1048.51","6.8.0-1052.55","6.8.0-1053.56"],"bundled":174},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1050.56"}]}],"versions":["6.8.0-1003.5","6.8.0-1004.7","6.8.0-1005.8","6.8.0-1006.9","6.8.0-1007.10","6.8.0-1008.11","6.8.0-1009.12","6.8.0-1010.13","6.8.0-1011.14","6.8.0-1012.15","6.8.0-1013.17","6.8.0-1014.18","6.8.0-1015.19","6.8.0-1016.20","6.8.0-1017.21","6.8.0-1019.23","6.8.0-1020.24","6.8.0-1021.25","6.8.0-1022.26","6.8.0-1023.27","6.8.0-1024.28","6.8.0-1025.29","6.8.0-1026.30","6.8.0-1027.31","6.8.0-1028.32","6.8.0-1029.33","6.8.0-1032.36","6.8.0-1033.37","6.8.0-1035.39","6.8.0-1036.40","6.8.0-1037.41","6.8.0-1038.43","6.8.0-1039.44","6.8.0-1040.45","6.8.0-1041.46","6.8.0-1042.47","6.8.0-1043.48","6.8.0-1044.49","6.8.0-1048.53","6.8.0-1049.54"],"bundled":174},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1037.40"}]}],"versions":["6.8.0-1001.3","6.8.0-1002.4","6.8.0-1003.5","6.8.0-1004.6","6.8.0-1006.8","6.8.0-1007.9","6.8.0-1008.10","6.8.0-1009.11","6.8.0-1010.12","6.8.0-1011.13","6.8.0-1012.14","6.8.0-1013.15","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1022.24","6.8.0-1023.25","6.8.0-1024.26","6.8.0-1025.28","6.8.0-1026.29","6.8.0-1027.30","6.8.0-1028.31","6.8.0-1029.32","6.8.0-1030.33","6.8.0-1031.34","6.8.0-1035.38","6.8.0-1036.39"],"bundled":174},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1051.51"}]}],"versions":["6.5.0-1009.9","6.8.0-1001.1","6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1015.15","6.8.0-1016.16","6.8.0-1017.17","6.8.0-1018.18","6.8.0-1019.19","6.8.0-1022.22","6.8.0-1023.23","6.8.0-1024.24","6.8.0-1025.25","6.8.0-1026.26","6.8.0-1027.27","6.8.0-1028.28","6.8.0-1029.29","6.8.0-1030.30","6.8.0-1033.33","6.8.0-1036.36","6.8.0-1037.37","6.8.0-1038.38","6.8.0-1039.39","6.8.0-1040.40","6.8.0-1041.41","6.8.0-1042.42","6.8.0-1043.43","6.8.0-1044.44","6.8.0-1045.45","6.8.0-1049.49","6.8.0-1050.50"],"bundled":174},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-110.110.1"}]}],"versions":["6.5.0-9.9.1","6.6.0-14.14.1","6.8.0-7.7.1","6.8.0-25.25.3","6.8.0-28.28.1","6.8.0-31.31.1","6.8.0-35.35.1","6.8.0-36.36.1","6.8.0-38.38.1","6.8.0-39.39.1","6.8.0-40.40.1","6.8.0-41.41.1","6.8.0-44.44.1","6.8.0-45.45.1","6.8.0-47.47.1","6.8.0-48.48.3","6.8.0-49.49.1","6.8.0-50.51.1","6.8.0-51.52.1","6.8.0-52.53.1","6.8.0-53.55.2","6.8.0-54.56.1","6.8.0-55.57.1","6.8.0-56.58.1","6.8.0-57.59.1","6.8.0-58.60.1","6.8.0-59.61.1","6.8.0-60.63.1","6.8.0-62.65.1","6.8.0-63.66.1","6.8.0-64.67.1","6.8.0-65.68.1","6.8.0-78.78.1","6.8.0-79.79.1","6.8.0-83.83.1","6.8.0-84.84.1","6.8.0-85.85.1","6.8.0-86.87.1","6.8.0-87.88.1","6.8.0-88.89.1","6.8.0-90.91.1","6.8.0-94.96.1","6.8.0-100.100.1","6.8.0-101.101.1","6.8.0-106.106.1","6.8.0-107.107.1"],"bundled":174},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-aws-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1052.55+fips1"}]}],"versions":["6.8.0-1035.37+fips1","6.8.0-1036.38+fips1","6.8.0-1038.40+fips1","6.8.0-1039.41+fips1","6.8.0-1040.42+fips1","6.8.0-1041.43+fips1","6.8.0-1042.44+fips1","6.8.0-1043.45+fips1","6.8.0-1044.46+fips1","6.8.0-1045.47+fips1","6.8.0-1046.49+fips1","6.8.0-1047.50+fips1","6.8.0-1050.53+fips1","6.8.0-1051.54+fips1"],"bundled":174},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-110.110+fips2"}]}],"versions":["6.8.0-38.38+fips4","6.8.0-78.78+fips1","6.8.0-79.79+fips1","6.8.0-83.83+fips1","6.8.0-84.84+fips1","6.8.0-85.85+fips1","6.8.0-86.87+fips1","6.8.0-87.88+fips1","6.8.0-88.89+fips1","6.8.0-90.91+fips1","6.8.0-94.96+fips1","6.8.0-100.100+fips1","6.8.0-101.101+fips1","6.8.0-106.106+fips1","6.8.0-107.107+fips1"],"bundled":174},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-gcp-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1054.57+fips1"}]}],"versions":["6.8.0-1036.38+fips1","6.8.0-1037.39+fips1","6.8.0-1039.41+fips1","6.8.0-1040.42+fips1","6.8.0-1041.43+fips1","6.8.0-1042.45+fips1","6.8.0-1043.46+fips1","6.8.0-1044.47+fips1","6.8.0-1045.48+fips1","6.8.0-1046.49+fips1","6.8.0-1047.50+fips1","6.8.0-1048.51+fips1","6.8.0-1052.55+fips1","6.8.0-1053.56+fips1"],"bundled":174},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-110.110~22.04.1"}]}],"versions":["6.8.0-38.38~22.04.1","6.8.0-39.39~22.04.1","6.8.0-40.40~22.04.3","6.8.0-45.45~22.04.1","6.8.0-47.47~22.04.1","6.8.0-48.48~22.04.1","6.8.0-49.49~22.04.1","6.8.0-50.51~22.04.1","6.8.0-51.52~22.04.1","6.8.0-52.53~22.04.1","6.8.0-57.59~22.04.1","6.8.0-58.60~22.04.1","6.8.0-59.61~22.04.1","6.8.0-60.63~22.04.1","6.8.0-64.67~22.04.1","6.8.0-65.68~22.04.1","6.8.0-78.78~22.04.1","6.8.0-79.79~22.04.1","6.8.0-83.83~22.04.1","6.8.0-84.84~22.04.1","6.8.0-85.85~22.04.1","6.8.0-86.87~22.04.1","6.8.0-87.88~22.04.1","6.8.0-88.89~22.04.2","6.8.0-90.91~22.04.1","6.8.0-94.96~22.04.1","6.8.0-100.100~22.04.1","6.8.0-101.101~22.04.1","6.8.0-106.106~22.04.1","6.8.0-107.107~22.04.1"],"bundled":174},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-ibm-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1051.51~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.13~22.04.1","6.8.0-1014.14~22.04.1","6.8.0-1015.15~22.04.1","6.8.0-1016.16~22.04.1","6.8.0-1017.17~22.04.1","6.8.0-1018.18~22.04.1","6.8.0-1019.19~22.04.1","6.8.0-1023.23~22.04.1","6.8.0-1024.24~22.04.1","6.8.0-1025.25~22.04.1","6.8.0-1026.26~22.04.1","6.8.0-1027.27~22.04.1","6.8.0-1028.28~22.04.1","6.8.0-1029.29~22.04.1","6.8.0-1030.30~22.04.1","6.8.0-1033.33~22.04.1","6.8.0-1036.36~22.04.1","6.8.0-1037.37~22.04.1","6.8.0-1038.38~22.04.1","6.8.0-1039.39~22.04.1","6.8.0-1040.40~22.04.1","6.8.0-1041.41~22.04.1","6.8.0-1042.42~22.04.1","6.8.0-1043.43~22.04.1","6.8.0-1044.44~22.04.1","6.8.0-1045.45~22.04.1","6.8.0-1049.49~22.04.1","6.8.0-1050.50~22.04.1"],"bundled":174},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1052.56"}]}],"versions":["6.5.0-1005.7","6.7.0-1001.1","6.8.0-1001.1","6.8.0-1002.2","6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.10","6.8.0-1010.11","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.23","6.8.0-1020.24","6.8.0-1024.28","6.8.0-1028.32","6.8.0-1029.33","6.8.0-1030.34","6.8.0-1031.35","6.8.0-1032.36","6.8.0-1035.39","6.8.0-1036.40","6.8.0-1038.42","6.8.0-1039.43","6.8.0-1040.44","6.8.0-1041.45","6.8.0-1042.46","6.8.0-1043.47","6.8.0-1044.48","6.8.0-1045.49","6.8.0-1047.51","6.8.0-1048.52","6.8.0-1050.54","6.8.0-1051.55"],"bundled":174},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1054.57~22.04.1"}]}],"versions":["6.8.0-1010.11~22.04.1","6.8.0-1011.12~22.04.1","6.8.0-1012.13~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.16~22.04.1","6.8.0-1015.17~22.04.1","6.8.0-1016.18~22.04.1","6.8.0-1017.19~22.04.1","6.8.0-1018.20~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1024.26~22.04.1","6.8.0-1025.27~22.04.1","6.8.0-1026.28~22.04.1","6.8.0-1027.29~22.04.1","6.8.0-1028.30~22.04.1","6.8.0-1029.31~22.04.1","6.8.0-1030.32~22.04.1","6.8.0-1031.33~22.04.1","6.8.0-1032.34~22.04.1","6.8.0-1033.35~22.04.1","6.8.0-1034.36~22.04.2","6.8.0-1036.38~22.04.1","6.8.0-1037.39~22.04.1","6.8.0-1040.42~22.04.1","6.8.0-1041.43~22.04.1","6.8.0-1042.45~22.04.1","6.8.0-1043.46~22.04.1","6.8.0-1044.47~22.04.1","6.8.0-1045.48~22.04.1","6.8.0-1046.49~22.04.1","6.8.0-1047.50~22.04.2","6.8.0-1048.51~22.04.1","6.8.0-1052.55~22.04.1","6.8.0-1053.56~22.04.1"],"bundled":174},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:22.04:LTS","package":"linux-realtime-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.1-1047.48~22.04.1"}]}],"versions":["6.8.1-1004.4~22.04.1","6.8.1-1005.5~22.04.2","6.8.1-1006.6~22.04.1","6.8.1-1007.7~22.04.1","6.8.1-1008.8~22.04.1","6.8.1-1009.9~22.04.1","6.8.1-1010.10~22.04.1","6.8.1-1011.11~22.04.1","6.8.1-1012.12~22.04.1","6.8.1-1013.14~22.04.1","6.8.1-1014.15~22.04.1","6.8.1-1015.16~22.04.1","6.8.1-1016.17~22.04.1","6.8.1-1017.18~22.04.1","6.8.1-1018.19~22.04.1","6.8.1-1019.20~22.04.1","6.8.1-1020.21~22.04.1","6.8.1-1021.22~22.04.1","6.8.1-1022.23~22.04.1","6.8.1-1023.24~22.04.1","6.8.1-1024.25~22.04.1","6.8.1-1025.26~22.04.1","6.8.1-1026.27~22.04.1","6.8.1-1030.31~22.04.1","6.8.1-1031.32~22.04.1","6.8.1-1034.35~22.04.1","6.8.1-1035.36~22.04.1","6.8.1-1036.37~22.04.1","6.8.1-1037.38~22.04.1","6.8.1-1038.39~22.04.1","6.8.1-1039.40~22.04.1","6.8.1-1040.41~22.04.1","6.8.1-1041.42~22.04.1","6.8.1-1042.43~22.04.1","6.8.1-1045.46~22.04.1","6.8.1-1046.47~22.04.2"],"bundled":175},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.1-1047.48"}]}],"versions":["6.8.0-1008.19","6.8.1-1001.1","6.8.1-1002.2","6.8.1-1003.3","6.8.1-1004.4","6.8.1-1005.5","6.8.1-1006.6","6.8.1-1007.7","6.8.1-1008.8","6.8.1-1009.9","6.8.1-1010.10","6.8.1-1011.11","6.8.1-1012.12","6.8.1-1013.14","6.8.1-1014.15","6.8.1-1015.16","6.8.1-1016.17","6.8.1-1017.18","6.8.1-1018.19","6.8.1-1019.20","6.8.1-1020.21","6.8.1-1021.22","6.8.1-1022.23","6.8.1-1023.24","6.8.1-1024.25","6.8.1-1025.26","6.8.1-1026.27","6.8.1-1030.31","6.8.1-1031.32","6.8.1-1033.34","6.8.1-1034.35","6.8.1-1035.36","6.8.1-1036.37","6.8.1-1037.38","6.8.1-1038.39","6.8.1-1039.40","6.8.1-1040.41","6.8.1-1041.42","6.8.1-1042.43","6.8.1-1045.46","6.8.1-1046.47"],"bundled":175},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1051.54~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1009.9~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.15~22.04.1","6.8.0-1015.16~22.04.1","6.8.0-1017.19~22.04.1","6.8.0-1018.20~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1022.25~22.04.2","6.8.0-1023.26~22.04.1","6.8.0-1024.27~22.04.1","6.8.0-1025.28~22.04.1","6.8.0-1026.29~22.04.1","6.8.0-1027.30~22.04.1","6.8.0-1028.31~22.04.1","6.8.0-1029.32~22.04.1","6.8.0-1030.33~22.04.1","6.8.0-1031.34~22.04.1","6.8.0-1032.35~22.04.1","6.8.0-1035.38~22.04.1","6.8.0-1036.39~22.04.1","6.8.0-1038.41~22.04.1","6.8.0-1039.42~22.04.1","6.8.0-1040.43~22.04.1","6.8.0-1041.44~22.04.2","6.8.0-1042.45~22.04.1","6.8.0-1043.46~22.04.1","6.8.0-1044.47~22.04.1","6.8.0-1045.48~22.04.1","6.8.0-1046.49~22.04.1","6.8.0-1047.50~22.04.1","6.8.0-1049.52~22.04.1","6.8.0-1050.53~22.04.1"],"bundled":173},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1051.54"}]}],"versions":["6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1022.25","6.8.0-1023.26","6.8.0-1024.27","6.8.0-1025.28","6.8.0-1026.29","6.8.0-1027.30","6.8.0-1028.31","6.8.0-1029.32","6.8.0-1030.33","6.8.0-1031.34","6.8.0-1032.35","6.8.0-1035.38","6.8.0-1036.39","6.8.0-1038.41","6.8.0-1039.42","6.8.0-1040.43","6.8.0-1041.44","6.8.0-1042.45","6.8.0-1043.46","6.8.0-1044.47","6.8.0-1045.48","6.8.0-1046.49","6.8.0-1047.50","6.8.0-1049.52","6.8.0-1050.53"],"bundled":173},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1051.54.1"}]}],"versions":["6.8.0-1009.9.1","6.8.0-1011.11.1","6.8.0-1012.12.1","6.8.0-1013.14.1","6.8.0-1014.15.1","6.8.0-1015.16.1","6.8.0-1017.19.1","6.8.0-1018.20.1","6.8.0-1019.21.1","6.8.0-1020.22.1","6.8.0-1021.23.1","6.8.0-1022.25.2","6.8.0-1023.26.1","6.8.0-1024.27.1","6.8.0-1025.28.1","6.8.0-1026.29.1","6.8.0-1027.30.1","6.8.0-1028.31.1","6.8.0-1029.32.1","6.8.0-1030.33.1","6.8.0-1031.34.1","6.8.0-1032.35.1","6.8.0-1035.38.1","6.8.0-1036.39.1","6.8.0-1038.41.1","6.8.0-1039.42.1","6.8.0-1040.43.1","6.8.0-1041.44.1","6.8.0-1042.45.1","6.8.0-1043.46.1","6.8.0-1044.47.1","6.8.0-1045.48.1","6.8.0-1046.49.1","6.8.0-1047.50.1","6.8.0-1049.52.1","6.8.0-1050.53.1"],"bundled":173},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1049.50~22.04.1"}]}],"versions":["6.8.0-1006.6~22.04.3","6.8.0-1008.8~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.13~22.04.1","6.8.0-1014.14~22.04.1","6.8.0-1015.15~22.04.1","6.8.0-1016.17~22.04.1","6.8.0-1017.18~22.04.1","6.8.0-1018.19~22.04.1","6.8.0-1019.20~22.04.1","6.8.0-1020.21~22.04.1","6.8.0-1021.22~22.04.1","6.8.0-1022.23~22.04.1","6.8.0-1023.24~22.04.1","6.8.0-1024.25~22.04.1","6.8.0-1025.26~22.04.1","6.8.0-1026.27~22.04.1","6.8.0-1027.28~22.04.1","6.8.0-1028.29~22.04.1","6.8.0-1029.30~22.04.1","6.8.0-1030.31~22.04.1","6.8.0-1032.33~22.04.1","6.8.0-1033.34~22.04.1","6.8.0-1035.36~22.04.1","6.8.0-1037.38~22.04.1","6.8.0-1038.39~22.04.1","6.8.0-1039.40~22.04.1","6.8.0-1040.41~22.04.1","6.8.0-1041.42~22.04.1","6.8.0-1042.43~22.04.1","6.8.0-1043.44~22.04.1","6.8.0-1044.45~22.04.1","6.8.0-1047.48~22.04.1"],"bundled":177},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1049.50"}]}],"versions":["6.5.0-1010.10","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1008.8","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1015.16","6.8.0-1016.17","6.8.0-1017.18","6.8.0-1018.19","6.8.0-1019.20","6.8.0-1020.21","6.8.0-1021.22","6.8.0-1022.23","6.8.0-1023.24","6.8.0-1024.25","6.8.0-1025.26","6.8.0-1026.27","6.8.0-1027.28","6.8.0-1028.29","6.8.0-1029.30","6.8.0-1030.31","6.8.0-1032.33","6.8.0-1033.34","6.8.0-1035.36","6.8.0-1037.38","6.8.0-1038.39","6.8.0-1039.40","6.8.0-1040.41","6.8.0-1041.42","6.8.0-1042.43","6.8.0-1043.44","6.8.0-1044.45","6.8.0-1047.48"],"bundled":177},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-raspi-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-2042.43"}]}],"versions":["6.7.0-2001.1","6.8.0-2001.1","6.8.0-2002.2","6.8.0-2004.4","6.8.0-2005.5","6.8.0-2006.6","6.8.0-2007.7","6.8.0-2008.8","6.8.0-2009.9","6.8.0-2010.10","6.8.0-2011.11","6.8.0-2012.12","6.8.0-2013.14","6.8.0-2014.15","6.8.0-2015.16","6.8.0-2016.17","6.8.0-2017.18","6.8.0-2018.19","6.8.0-2019.20","6.8.0-2022.23","6.8.0-2023.24","6.8.0-2024.25","6.8.0-2025.26","6.8.0-2026.27","6.8.0-2028.29","6.8.0-2029.30","6.8.0-2030.31","6.8.0-2031.32","6.8.0-2032.33","6.8.0-2033.34","6.8.0-2034.35","6.8.0-2035.36","6.8.0-2036.37","6.8.0-2037.38","6.8.0-2038.39","6.8.0-2040.41","6.8.0-2041.42"],"bundled":175},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1054.60"}]}],"versions":["6.5.0-1007.7","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1012.14","6.8.0-1013.15","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.20","6.8.0-1018.21","6.8.0-1020.23","6.8.0-1021.25","6.8.0-1025.30","6.8.0-1026.31","6.8.0-1027.32","6.8.0-1028.33","6.8.0-1029.34","6.8.0-1030.35","6.8.0-1031.36","6.8.0-1034.39","6.8.0-1038.44","6.8.0-1040.46","6.8.0-1041.47","6.8.0-1042.48","6.8.0-1044.50","6.8.0-1046.52","6.8.0-1051.57","6.8.0-1052.58"],"bundled":176},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-xilinx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1029.30"}]}],"versions":["6.8.0-1008.9","6.8.0-1009.10","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1017.18","6.8.0-1018.19","6.8.0-1019.20","6.8.0-1020.21","6.8.0-1021.22","6.8.0-1022.23","6.8.0-1023.24","6.8.0-1024.25","6.8.0-1028.29"],"bundled":609},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-tegra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1022.22"}]}],"versions":["6.8.0-1003.3","6.8.0-1004.4","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1016.16","6.8.0-1019.19","6.8.0-1020.20","6.8.0-1021.21"],"bundled":174},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1059.65~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1009.9~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1012.14~22.04.1","6.8.0-1013.15~22.04.1","6.8.0-1014.16~22.04.1","6.8.0-1015.17~22.04.2","6.8.0-1017.20~22.04.1","6.8.0-1018.21~22.04.1","6.8.0-1020.23~22.04.1","6.8.0-1021.25~22.04.1","6.8.0-1025.30~22.04.1","6.8.0-1026.31~22.04.1","6.8.0-1027.32~22.04.1","6.8.0-1028.33~22.04.1","6.8.0-1029.34~22.04.1","6.8.0-1030.35~22.04.1","6.8.0-1031.36~22.04.1","6.8.0-1034.39~22.04.1","6.8.0-1036.42~22.04.1","6.8.0-1040.46~22.04.1","6.8.0-1041.47~22.04.1","6.8.0-1044.50~22.04.1","6.8.0-1051.57~22.04.1","6.8.0-1052.58~22.04.1"],"bundled":393}],"products":[{"vendor":"linux","product":"linux"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0)"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0)"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp (6es7518-4fx00-1ab0)"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp (6es7518-4fx00-1ac0)"},{"vendor":"siemens","product":"simatic s7-1500 tm mfp - gnu/linux subsystem"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp (6ag1518-4ax00-4ac0)"}],"references":[{"url":"https://git.kernel.org/stable/c/4896491c497226022626c3acc46044fd182f943c","tags":["web"]},{"url":"https://git.kernel.org/stable/c/a505f0ba36ab24176c300d7ff56aff85c2977e6c","tags":["web"]},{"url":"https://git.kernel.org/stable/c/e8061d02b49c5c901980f58d91e96580e9a14acf","tags":["web","report"]},{"url":"https://git.kernel.org/stable/c/e7dac681790556c131854b97551337aa8042215b","tags":["web","report"]},{"url":"https://git.kernel.org/stable/c/03b3bcd319b3ab5182bc9aaa0421351572c78ac0","tags":["web","report"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68265","tags":["web","advisory"]},{"url":"https://git.kernel.org/stable/c/ff037b5f47eeccc1636c03f84cd47db094eb73c9"},{"url":"https://github.com/advisories/GHSA-2rf6-4xf4-32wc"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-68265","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1787305050.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49940","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53079","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21836","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21901","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-23137","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-23154","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37744","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39830","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39834","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39956","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39959","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39969","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39978","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40187","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40200","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40204","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68218","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68245","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68291","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68312","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68740","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68764","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71295","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23054","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23230","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23274","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23282","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23297","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23313","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31389","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31392","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31473","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31530","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31693","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31698","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31786","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43010","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43325","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43350","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43383","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43408","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43487","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45880","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45925","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46005","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46115","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46137","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46327","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52909","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52981","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53205","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53206","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53221","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53251","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53291","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53321","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64097","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64166","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64225","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64237","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64266","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64279","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64298","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64564","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68110","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68121","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68138","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68143","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68153","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68158","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68250","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68251","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68286","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68300","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68309","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68320","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68324","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68336","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68365","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68397","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68402","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68426","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68430","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68433","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68439","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68444","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68265.json","tags":["advisory"]},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-68265","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1759","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53232","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37900","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37954","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38083","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38373","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38556","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38591","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38659","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38730","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39713","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39961","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40030","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40096","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40215","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40220","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40237","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40242","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40251","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40271","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40272","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40277","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40294","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40301","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40308","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40318","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40341","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40342","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40343","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40346","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40351","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40358","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40359","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40361","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68171","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68173","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68174","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68176","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68188","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68200","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68206","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68208","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68214","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68235","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68259","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68261","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68264","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68297","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68309","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68331","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68337","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68349","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68354","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68356","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68362","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68363","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68376","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68378","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68724","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68725","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68734","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68741","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68744","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68745","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68756","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68780","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68782","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68794","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68803","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68814","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68816","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68818","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71072","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71104","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71116","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71131","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71147","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71149","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71150","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22996","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22998","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23000","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23005","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23035","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23138","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1760","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68817","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71077","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71134","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71152","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71154","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71238","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22978","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22980","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22990","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22992","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23060","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23069","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23071","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23086","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23099","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23103","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23105","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23111","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23120","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23124","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23126","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23133","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23136","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23137","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23139","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23145","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23154","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23156","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23169","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23173","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23191","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23198","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23204","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23208","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23212","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23221","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1761","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68301","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621834-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1215199","tags":["report"]},{"url":"https://bugzilla.suse.com/1234634","tags":["report"]},{"url":"https://bugzilla.suse.com/1241259","tags":["report"]},{"url":"https://bugzilla.suse.com/1243603","tags":["report"]},{"url":"https://bugzilla.suse.com/1248754","tags":["report"]},{"url":"https://bugzilla.suse.com/1249104","tags":["report"]},{"url":"https://bugzilla.suse.com/1250951","tags":["report"]},{"url":"https://bugzilla.suse.com/1253471","tags":["report"]},{"url":"https://bugzilla.suse.com/1254518","tags":["report"]},{"url":"https://bugzilla.suse.com/1255160","tags":["report"]},{"url":"https://bugzilla.suse.com/1255360","tags":["report"]},{"url":"https://bugzilla.suse.com/1255459","tags":["report"]},{"url":"https://bugzilla.suse.com/1255752","tags":["report"]},{"url":"https://bugzilla.suse.com/1256288","tags":["report"]},{"url":"https://bugzilla.suse.com/1256865","tags":["report"]},{"url":"https://bugzilla.suse.com/1256867","tags":["report"]},{"url":"https://bugzilla.suse.com/1258518","tags":["report"]},{"url":"https://bugzilla.suse.com/1258718","tags":["report"]},{"url":"https://bugzilla.suse.com/1258826","tags":["report"]},{"url":"https://bugzilla.suse.com/1258849","tags":["report"]},{"url":"https://bugzilla.suse.com/1258850","tags":["report"]},{"url":"https://bugzilla.suse.com/1258854","tags":["report"]},{"url":"https://bugzilla.suse.com/1258855","tags":["report"]},{"url":"https://bugzilla.suse.com/1258856","tags":["report"]},{"url":"https://bugzilla.suse.com/1258857","tags":["report"]},{"url":"https://bugzilla.suse.com/1258933","tags":["report"]},{"url":"https://bugzilla.suse.com/1258961","tags":["report"]},{"url":"https://bugzilla.suse.com/1259186","tags":["report"]},{"url":"https://bugzilla.suse.com/1259199","tags":["report"]},{"url":"https://bugzilla.suse.com/1259222","tags":["report"]},{"url":"https://bugzilla.suse.com/1259420","tags":["report"]},{"url":"https://bugzilla.suse.com/1259461","tags":["report"]},{"url":"https://bugzilla.suse.com/1259535","tags":["report"]},{"url":"https://bugzilla.suse.com/1259672","tags":["report"]},{"url":"https://bugzilla.suse.com/1259799","tags":["report"]},{"url":"https://bugzilla.suse.com/1259806","tags":["report"]},{"url":"https://bugzilla.suse.com/1259857","tags":["report"]},{"url":"https://bugzilla.suse.com/1259865","tags":["report"]},{"url":"https://bugzilla.suse.com/1259868","tags":["report"]},{"url":"https://bugzilla.suse.com/1259869","tags":["report"]},{"url":"https://bugzilla.suse.com/1259871","tags":["report"]},{"url":"https://bugzilla.suse.com/1259873","tags":["report"]},{"url":"https://bugzilla.suse.com/1259878","tags":["report"]},{"url":"https://bugzilla.suse.com/1259889","tags":["report"]},{"url":"https://bugzilla.suse.com/1259994","tags":["report"]},{"url":"https://bugzilla.suse.com/1260010","tags":["report"]},{"url":"https://bugzilla.suse.com/1260012","tags":["report"]},{"url":"https://bugzilla.suse.com/1260018","tags":["report"]},{"url":"https://bugzilla.suse.com/1260428","tags":["report"]},{"url":"https://bugzilla.suse.com/1260468","tags":["report"]},{"url":"https://bugzilla.suse.com/1260483","tags":["report"]},{"url":"https://bugzilla.suse.com/1260484","tags":["report"]},{"url":"https://bugzilla.suse.com/1260485","tags":["report"]},{"url":"https://bugzilla.suse.com/1260489","tags":["report"]},{"url":"https://bugzilla.suse.com/1260504","tags":["report"]},{"url":"https://bugzilla.suse.com/1260505","tags":["report"]},{"url":"https://bugzilla.suse.com/1260507","tags":["report"]},{"url":"https://bugzilla.suse.com/1260514","tags":["report"]},{"url":"https://bugzilla.suse.com/1260523","tags":["report"]},{"url":"https://bugzilla.suse.com/1260526","tags":["report"]},{"url":"https://bugzilla.suse.com/1260528","tags":["report"]},{"url":"https://bugzilla.suse.com/1260529","tags":["report"]},{"url":"https://bugzilla.suse.com/1260530","tags":["report"]},{"url":"https://bugzilla.suse.com/1260531","tags":["report"]},{"url":"https://bugzilla.suse.com/1260532","tags":["report"]},{"url":"https://bugzilla.suse.com/1260533","tags":["report"]},{"url":"https://bugzilla.suse.com/1260536","tags":["report"]},{"url":"https://bugzilla.suse.com/1260537","tags":["report"]},{"url":"https://bugzilla.suse.com/1260538","tags":["report"]},{"url":"https://bugzilla.suse.com/1260541","tags":["report"]},{"url":"https://bugzilla.suse.com/1260546","tags":["report"]},{"url":"https://bugzilla.suse.com/1260549","tags":["report"]},{"url":"https://bugzilla.suse.com/1260551","tags":["report"]},{"url":"https://bugzilla.suse.com/1260552","tags":["report"]},{"url":"https://bugzilla.suse.com/1260555","tags":["report"]},{"url":"https://bugzilla.suse.com/1260561","tags":["report"]},{"url":"https://bugzilla.suse.com/1260562","tags":["report"]},{"url":"https://bugzilla.suse.com/1260566","tags":["report"]},{"url":"https://bugzilla.suse.com/1260571","tags":["report"]},{"url":"https://bugzilla.suse.com/1260572","tags":["report"]},{"url":"https://bugzilla.suse.com/1260573","tags":["report"]},{"url":"https://bugzilla.suse.com/1260576","tags":["report"]},{"url":"https://bugzilla.suse.com/1260580","tags":["report"]},{"url":"https://bugzilla.suse.com/1260581","tags":["report"]},{"url":"https://bugzilla.suse.com/1260593","tags":["report"]},{"url":"https://bugzilla.suse.com/1260613","tags":["report"]},{"url":"https://bugzilla.suse.com/1260728","tags":["report"]},{"url":"https://bugzilla.suse.com/1260729","tags":["report"]},{"url":"https://bugzilla.suse.com/1260731","tags":["report"]},{"url":"https://bugzilla.suse.com/1260798","tags":["report"]},{"url":"https://bugzilla.suse.com/1260800","tags":["report"]},{"url":"https://bugzilla.suse.com/1260801","tags":["report"]},{"url":"https://bugzilla.suse.com/1260807","tags":["report"]},{"url":"https://bugzilla.suse.com/1260811","tags":["report"]},{"url":"https://bugzilla.suse.com/1260996","tags":["report"]},{"url":"https://bugzilla.suse.com/1261020","tags":["report"]},{"url":"https://bugzilla.suse.com/1261149","tags":["report"]},{"url":"https://bugzilla.suse.com/1261287","tags":["report"]},{"url":"https://bugzilla.suse.com/1261288","tags":["report"]},{"url":"https://bugzilla.suse.com/1261295","tags":["report"]},{"url":"https://bugzilla.suse.com/1261348","tags":["report"]},{"url":"https://bugzilla.suse.com/1261410","tags":["report"]},{"url":"https://bugzilla.suse.com/1261503","tags":["report"]},{"url":"https://bugzilla.suse.com/1261504","tags":["report"]},{"url":"https://bugzilla.suse.com/1261505","tags":["report"]},{"url":"https://bugzilla.suse.com/1261550","tags":["report"]},{"url":"https://bugzilla.suse.com/1261555","tags":["report"]},{"url":"https://bugzilla.suse.com/1261581","tags":["report"]},{"url":"https://bugzilla.suse.com/1261582","tags":["report"]},{"url":"https://bugzilla.suse.com/1261584","tags":["report"]},{"url":"https://bugzilla.suse.com/1261585","tags":["report"]},{"url":"https://bugzilla.suse.com/1261592","tags":["report"]},{"url":"https://bugzilla.suse.com/1261601","tags":["report"]},{"url":"https://bugzilla.suse.com/1261602","tags":["report"]},{"url":"https://bugzilla.suse.com/1261617","tags":["report"]},{"url":"https://bugzilla.suse.com/1261618","tags":["report"]},{"url":"https://bugzilla.suse.com/1261629","tags":["report"]},{"url":"https://bugzilla.suse.com/1261632","tags":["report"]},{"url":"https://bugzilla.suse.com/1261635","tags":["report"]},{"url":"https://bugzilla.suse.com/1261636","tags":["report"]},{"url":"https://bugzilla.suse.com/1261637","tags":["report"]},{"url":"https://bugzilla.suse.com/1261638","tags":["report"]},{"url":"https://bugzilla.suse.com/1261641","tags":["report"]},{"url":"https://bugzilla.suse.com/1261644","tags":["report"]},{"url":"https://bugzilla.suse.com/1261645","tags":["report"]},{"url":"https://bugzilla.suse.com/1261648","tags":["report"]},{"url":"https://bugzilla.suse.com/1261679","tags":["report"]},{"url":"https://bugzilla.suse.com/1261685","tags":["report"]},{"url":"https://bugzilla.suse.com/1261686","tags":["report"]},{"url":"https://bugzilla.suse.com/1261687","tags":["report"]},{"url":"https://bugzilla.suse.com/1261692","tags":["report"]},{"url":"https://bugzilla.suse.com/1261694","tags":["report"]},{"url":"https://bugzilla.suse.com/1261700","tags":["report"]},{"url":"https://bugzilla.suse.com/1261702","tags":["report"]},{"url":"https://bugzilla.suse.com/1261703","tags":["report"]},{"url":"https://bugzilla.suse.com/1261707","tags":["report"]},{"url":"https://bugzilla.suse.com/1261710","tags":["report"]},{"url":"https://bugzilla.suse.com/1261713","tags":["report"]},{"url":"https://bugzilla.suse.com/1261714","tags":["report"]},{"url":"https://bugzilla.suse.com/1261719","tags":["report"]},{"url":"https://bugzilla.suse.com/1261738","tags":["report"]},{"url":"https://bugzilla.suse.com/1261750","tags":["report"]},{"url":"https://bugzilla.suse.com/1261751","tags":["report"]},{"url":"https://bugzilla.suse.com/1261752","tags":["report"]},{"url":"https://bugzilla.suse.com/1261768","tags":["report"]},{"url":"https://bugzilla.suse.com/1261778","tags":["report"]},{"url":"https://bugzilla.suse.com/1261779","tags":["report"]},{"url":"https://bugzilla.suse.com/1261780","tags":["report"]},{"url":"https://bugzilla.suse.com/1261781","tags":["report"]},{"url":"https://bugzilla.suse.com/1261786","tags":["report"]},{"url":"https://bugzilla.suse.com/1261788","tags":["report"]},{"url":"https://bugzilla.suse.com/1261789","tags":["report"]},{"url":"https://bugzilla.suse.com/1261796","tags":["report"]},{"url":"https://bugzilla.suse.com/1261797","tags":["report"]},{"url":"https://bugzilla.suse.com/1261896","tags":["report"]},{"url":"https://bugzilla.suse.com/1262019","tags":["report"]},{"url":"https://bugzilla.suse.com/1262053","tags":["report"]},{"url":"https://bugzilla.suse.com/1262054","tags":["report"]},{"url":"https://bugzilla.suse.com/1262055","tags":["report"]},{"url":"https://bugzilla.suse.com/1262061","tags":["report"]},{"url":"https://bugzilla.suse.com/1262063","tags":["report"]},{"url":"https://bugzilla.suse.com/1262074","tags":["report"]},{"url":"https://bugzilla.suse.com/1262078","tags":["report"]},{"url":"https://bugzilla.suse.com/1262086","tags":["report"]},{"url":"https://bugzilla.suse.com/1262087","tags":["report"]},{"url":"https://bugzilla.suse.com/1262099","tags":["report"]},{"url":"https://bugzilla.suse.com/1262100","tags":["report"]},{"url":"https://bugzilla.suse.com/1262101","tags":["report"]},{"url":"https://bugzilla.suse.com/1262179","tags":["report"]},{"url":"https://bugzilla.suse.com/1262181","tags":["report"]},{"url":"https://bugzilla.suse.com/1262245","tags":["report"]},{"url":"https://bugzilla.suse.com/1262250","tags":["report"]},{"url":"https://bugzilla.suse.com/1262480","tags":["report"]},{"url":"https://bugzilla.suse.com/1262601","tags":["report"]},{"url":"https://bugzilla.suse.com/1262616","tags":["report"]},{"url":"https://bugzilla.suse.com/1262617","tags":["report"]},{"url":"https://bugzilla.suse.com/1262627","tags":["report"]},{"url":"https://bugzilla.suse.com/1262662","tags":["report"]},{"url":"https://bugzilla.suse.com/1262665","tags":["report"]},{"url":"https://bugzilla.suse.com/1262671","tags":["report"]},{"url":"https://bugzilla.suse.com/1262673","tags":["report"]},{"url":"https://bugzilla.suse.com/1262709","tags":["report"]},{"url":"https://bugzilla.suse.com/1262725","tags":["report"]},{"url":"https://bugzilla.suse.com/1262731","tags":["report"]},{"url":"https://bugzilla.suse.com/1262750","tags":["report"]},{"url":"https://bugzilla.suse.com/1262752","tags":["report"]},{"url":"https://bugzilla.suse.com/1262758","tags":["report"]},{"url":"https://bugzilla.suse.com/1263001","tags":["report"]},{"url":"https://bugzilla.suse.com/1263012","tags":["report"]},{"url":"https://bugzilla.suse.com/1263018","tags":["report"]},{"url":"https://bugzilla.suse.com/1263044","tags":["report"]},{"url":"https://bugzilla.suse.com/1263048","tags":["report"]},{"url":"https://bugzilla.suse.com/1263052","tags":["report"]},{"url":"https://bugzilla.suse.com/1263064","tags":["report"]},{"url":"https://bugzilla.suse.com/1263074","tags":["report"]},{"url":"https://bugzilla.suse.com/1263077","tags":["report"]},{"url":"https://bugzilla.suse.com/1263085","tags":["report"]},{"url":"https://bugzilla.suse.com/1263093","tags":["report"]},{"url":"https://bugzilla.suse.com/1263095","tags":["report"]},{"url":"https://bugzilla.suse.com/1263104","tags":["report"]},{"url":"https://bugzilla.suse.com/1263107","tags":["report"]},{"url":"https://bugzilla.suse.com/1263131","tags":["report"]},{"url":"https://bugzilla.suse.com/1263135","tags":["report"]},{"url":"https://bugzilla.suse.com/1263138","tags":["report"]},{"url":"https://bugzilla.suse.com/1263140","tags":["report"]},{"url":"https://bugzilla.suse.com/1263141","tags":["report"]},{"url":"https://bugzilla.suse.com/1263165","tags":["report"]},{"url":"https://bugzilla.suse.com/1263176","tags":["report"]},{"url":"https://bugzilla.suse.com/1263255","tags":["report"]},{"url":"https://bugzilla.suse.com/1263556","tags":["report"]},{"url":"https://bugzilla.suse.com/1263562","tags":["report"]},{"url":"https://bugzilla.suse.com/1263582","tags":["report"]},{"url":"https://bugzilla.suse.com/1263592","tags":["report"]},{"url":"https://bugzilla.suse.com/1263593","tags":["report"]},{"url":"https://bugzilla.suse.com/1263595","tags":["report"]},{"url":"https://bugzilla.suse.com/1263596","tags":["report"]},{"url":"https://bugzilla.suse.com/1263604","tags":["report"]},{"url":"https://bugzilla.suse.com/1263668","tags":["report"]},{"url":"https://bugzilla.suse.com/1263815","tags":["report"]},{"url":"https://bugzilla.suse.com/1263882","tags":["report"]},{"url":"https://bugzilla.suse.com/1263901","tags":["report"]},{"url":"https://bugzilla.suse.com/1263931","tags":["report"]},{"url":"https://bugzilla.suse.com/1263933","tags":["report"]},{"url":"https://bugzilla.suse.com/1263942","tags":["report"]},{"url":"https://bugzilla.suse.com/1263995","tags":["report"]},{"url":"https://bugzilla.suse.com/1264014","tags":["report"]},{"url":"https://bugzilla.suse.com/1264059","tags":["report"]},{"url":"https://bugzilla.suse.com/1264082","tags":["report"]},{"url":"https://bugzilla.suse.com/1264097","tags":["report"]},{"url":"https://bugzilla.suse.com/1264183","tags":["report"]},{"url":"https://bugzilla.suse.com/1264233","tags":["report"]},{"url":"https://bugzilla.suse.com/1264427","tags":["report"]},{"url":"https://bugzilla.suse.com/1264469","tags":["report"]},{"url":"https://bugzilla.suse.com/1264586","tags":["report"]},{"url":"https://bugzilla.suse.com/1264674","tags":["report"]},{"url":"https://bugzilla.suse.com/1264837","tags":["report"]},{"url":"https://bugzilla.suse.com/1264848","tags":["report"]},{"url":"https://bugzilla.suse.com/1265085","tags":["report"]},{"url":"https://bugzilla.suse.com/1265116","tags":["report"]},{"url":"https://bugzilla.suse.com/1265119","tags":["report"]},{"url":"https://bugzilla.suse.com/1265144","tags":["report"]},{"url":"https://bugzilla.suse.com/1265308","tags":["report"]},{"url":"https://bugzilla.suse.com/1265421","tags":["report"]},{"url":"https://bugzilla.suse.com/1265449","tags":["report"]},{"url":"https://bugzilla.suse.com/1265456","tags":["report"]},{"url":"https://bugzilla.suse.com/1265626","tags":["report"]},{"url":"https://bugzilla.suse.com/1265846","tags":["report"]},{"url":"https://bugzilla.suse.com/1265960","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-2058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-14027","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68310","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71269","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71302","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23260","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23261","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23266","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23269","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23273","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23279","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23290","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23298","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23307","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23317","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23321","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23324","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23334","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23347","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23363","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23365","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23367","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23368","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23369","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23370","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23372","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23373","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23378","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23395","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23396","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23397","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23411","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23417","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23420","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23437","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23440","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23442","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23443","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23450","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23455","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23457","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23458","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23461","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23462","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23463","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23464","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23472","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23474","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31389","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31394","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31395","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31400","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31411","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31415","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31417","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31420","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31422","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31423","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31424","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31428","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31453","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31503","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31504","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31515","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31519","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31528","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31533","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31554","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31565","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31579","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31588","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31644","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31649","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31658","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31666","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31668","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31675","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31682","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31684","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31685","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31691","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31694","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31700","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31738","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31787","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43009","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43025","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43027","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43060","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43082","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43365","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43366","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43503","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46333","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621841-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621845-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621860-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-68265","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-68265","tags":["report"]},{"url":"https://git.kernel.org/linus/03b3bcd319b3ab5182bc9aaa0421351572c78ac0","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8094-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8094-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8094-3","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8094-4","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8094-5","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8152-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8179-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8184-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8179-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8185-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8179-3","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8203-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8204-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8185-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8179-4","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8258-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8260-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8261-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8265-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8440-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-40246","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40247","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40248","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40249","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40250","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40251","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40252","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40253","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40254","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40255","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40257","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40258","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40259","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40260","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40261","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40262","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40263","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40264","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40265","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40266","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40290","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40345","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-62626","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68212","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68213","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68214","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68215","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68217","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68218","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68219","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68220","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68221","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68222","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68223","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68225","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68227","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68228","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68229","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68230","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68231","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68232","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68233","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68234","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68235","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68236","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68237","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68238","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68254","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68255","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68256","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68257","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68258","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68259","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68261","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68262","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68263","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68264","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68266","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68281","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68282","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68283","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68284","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68285","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68286","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68287","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68288","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68289","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68290","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68292","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68293","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68294","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68295","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68296","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68297","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68298","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68299","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68300","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68301","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68302","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68303","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68304","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68305","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68306","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68307","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68308","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68323","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68324","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68325","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68326","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68327","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68328","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68329","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68330","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68331","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68332","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68333","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68334","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68335","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68336","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68337","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68338","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68339","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68340","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68341","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68342","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68343","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68344","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68345","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68346","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68347","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68348","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68349","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68352","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68354","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68356","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68358","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68359","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68360","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68361","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68362","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68363","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68364","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68366","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68367","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68369","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68370","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68371","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68372","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68373","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68374","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68375","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68376","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68378","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68379","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68380","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68724","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68726","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68727","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68728","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68729","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68730","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68732","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68733","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68735","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68738","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68739","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68740","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68741","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68742","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68743","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68744","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68746","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68747","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68748","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68749","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68751","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68752","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68753","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68754","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68755","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68756","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68757","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68758","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68759","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68760","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68762","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68763","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68764","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68765","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68766","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71128","tags":["report"]},{"url":"https://launchpad.net/bugs/2143853","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23060","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23074","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23111","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23268","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23269","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23403","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23404","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23405","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23406","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23407","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23408","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23409","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23410","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23411","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-36347","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57795","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22022","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22111","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38022","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38234","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40164","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40325","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68206","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68291","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68767","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68769","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68770","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68771","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68772","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68773","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68774","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68775","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68776","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68777","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68778","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68780","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68782","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68783","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68785","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68786","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68787","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68788","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68794","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68795","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68796","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68797","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68798","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68799","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68800","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68801","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68804","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68806","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68808","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68809","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68810","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68811","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68813","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68814","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68815","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68816","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68817","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68818","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68819","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68820","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68821","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71064","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71065","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71066","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71067","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71068","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71069","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71071","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71072","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71075","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71077","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71078","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71079","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71081","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71082","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71083","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71084","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71085","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71086","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71087","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71088","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71089","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71091","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71093","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71094","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71095","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71096","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71097","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71098","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71101","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71102","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71104","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71105","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71107","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71108","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71109","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71111","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71112","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71113","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71114","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71116","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71118","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71119","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71120","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71121","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71122","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71123","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71125","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71126","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71127","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71130","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71131","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71132","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71133","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71135","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71136","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71137","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71138","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71140","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71141","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71143","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71144","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71147","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71148","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71149","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71150","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71151","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71153","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71154","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23209","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71080","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23112","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23231","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21833","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22103","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22105","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22106","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22107","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22113","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22121","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22124","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22125","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23129","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23130","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23133","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23143","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37860","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38105","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38502","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38556","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38627","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38643","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38709","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39678","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39697","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39805","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39806","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39807","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39808","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39810","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39811","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39812","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39813","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39815","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39817","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39819","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39823","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39824","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39825","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39826","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39827","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39828","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39829","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39832","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39835","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39836","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39838","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39839","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39841","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39842","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39843","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39844","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39845","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39846","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39847","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39848","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39849","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39850","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39851","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39852","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39853","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39854","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39857","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39860","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39861","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39863","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39864","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39865","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39866","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39869","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39870","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39871","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39873","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39876","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39877","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39880","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39881","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39883","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39885","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39886","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39891","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39894","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39895","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39899","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39901","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39902","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39907","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39909","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39911","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39913","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39914","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39916","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39920","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39923","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39927","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39929","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39931","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39932","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39934","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39937","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39938","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39940","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39942","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39943","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39944","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39945","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39947","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39948","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39949","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39950","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39951","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39952","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39953","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39955","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39957","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39961","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39965","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39967","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39968","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39969","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39970","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39971","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39972","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39973","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39977","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39978","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39980","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39981","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39982","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39985","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39986","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39987","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39988","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39991","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39992","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39994","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39995","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39996","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39998","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40000","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40001","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40006","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40008","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40009","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40010","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40011","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40013","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40016","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40020","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40021","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40024","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40026","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40027","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40029","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40030","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40031","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40032","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40033","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40035","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40036","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40037","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40038","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40042","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40043","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40044","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40047","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40048","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40049","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40051","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40052","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40053","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40055","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40056","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40057","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40058","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40059","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40060","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40061","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40062","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40067","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40068","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40070","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40071","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40077","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40078","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40079","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40080","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40081","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40083","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40084","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40085","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40087","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40088","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40092","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40093","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40094","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40095","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40096","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40099","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40100","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40101","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40103","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40104","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40105","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40106","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40107","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40109","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40110","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40111","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40112","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40115","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40116","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40118","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40120","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40121","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40123","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40124","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40125","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40126","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40127","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40129","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40134","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40137","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40140","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40141","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40153","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40154","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40155","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40156","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40159","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40160","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40165","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40166","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40167","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40169","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40171","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40172","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40173","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40176","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40178","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40179","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40180","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40183","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40187","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40188","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40192","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40193","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40194","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40196","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40198","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40200","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40201","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40202","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40204","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40205","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40206","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40207","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40211","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40218","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40219","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40220","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40221","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40223","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40226","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40231","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40233","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40235","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40237","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40238","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40240","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40242","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40243","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40244","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40245","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40268","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40269","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40271","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40272","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40273","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40275","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40277","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40278","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40279","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40280","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40281","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40282","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40283","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40284","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40285","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40286","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40287","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40288","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40289","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40292","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40293","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40294","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40301","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40303","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40304","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40305","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40306","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40307","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40308","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40309","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40310","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40311","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40312","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40313","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40314","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40315","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40317","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40318","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40319","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40320","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40321","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40322","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40323","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40324","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40328","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40329","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40331","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40333","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40337","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40339","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40341","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40342","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40343","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40346","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40347","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40349","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40350","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40351","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40353","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40358","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40360","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40363","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68168","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68171","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68172","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68173","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68176","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68177","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68178","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68179","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68180","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68183","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68184","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68185","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68190","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68191","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68192","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68194","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68198","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68200","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68201","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68204","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68208","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68241","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68244","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68245","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68246","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68249","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68310","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68311","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68312","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68313","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68315","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68320","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68321","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68322","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68734","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23273","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-50004","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58096","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-58097","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37926","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38201","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38591","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40039","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40082","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40149","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68351","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68365","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68725","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68803","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68823","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71160","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71162","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71163","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71180","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71182","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71183","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71184","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71185","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71186","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71188","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71189","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71190","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71191","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71192","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71193","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71194","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71195","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71196","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71197","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71198","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71199","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71200","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71220","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71222","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71224","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71225","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71268","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-22976","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-22977","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-22978","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-22979","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-22980","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-22982","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-22984","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-22990","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-22991","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-22992","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-22994","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-22996","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-22997","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-22998","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-22999","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23000","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23001","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23003","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23005","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23006","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23010","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23011","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23019","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23020","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23021","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23025","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23026","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23030","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23031","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23032","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23033","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23035","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23037","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23038","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23047","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23049","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23050","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23053","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23054","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23056","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23057","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23058","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23059","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23061","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23062","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23063","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23064","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23065","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23068","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23069","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23071","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23073","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23075","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23076","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23078","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23080","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23083","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23084","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23085","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23086","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23087","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23088","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23089","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23090","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23091","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23093","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23094","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23095","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23096","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23097","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23098","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23099","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23101","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23102","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23103","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23105","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23107","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23108","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23110","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23113","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23116","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23119","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23120","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23121","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23123","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23124","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23125","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23126","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23128","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23129","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23131","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23133","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23135","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23136","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23139","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23140","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23141","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23142","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23144","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23145","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23146","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23148","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23150","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23151","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23156","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23159","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23160","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23163","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23164","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23166","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23167","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23168","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23170","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23172","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23173","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23176","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23178","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23179","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23180","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23182","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23187","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23190","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23191","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23193","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23198","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23204","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23205","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23206","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23212","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23213","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23214","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23215","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23216","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23254","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23256","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23257","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23258","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23260","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23261","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23262","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23264","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23274","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23351","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23394","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31419","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31431","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31504","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31533","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31676","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43033","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43077","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43078","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43284","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43362","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43494","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43500","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43503","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45998","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46000","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46028","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46300","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46323","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46333","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-47326","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-47327","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-47328","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-47329","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-47330","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-47331","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-47332","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-47333","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-47334","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-47335","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-47336","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-47337","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-68265","title":"nvme: fix admin request_queue lifetime","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: fix admin request_queue lifetime\n\nThe namespaces can access the controller's admin request_queue, and\nstale references on the namespaces may exist after tearing down the\ncontroller. Ensure the admin request_queue is active by moving the\ncontroller's 'put' to after all controller references have been released\nto ensure no one is can access the request_queue. This fixes a reported\nuse-after-free bug:\n\n  BUG: KASAN: slab-use-after-free in blk_queue_enter+0x41c/0x4a0\n  Read of size 8 at addr ffff88c0a53819f8 by task nvme/3287\n  CPU: 67 UID: 0 PID: 3287 Comm: nvme Tainted: G            E       6.13.2-ga1582f1a031e #15\n  Tainted: [E]=UNSIGNED_MODULE\n  Hardware name: Jabil /EGS 2S MB1, BIOS 1.00 06/18/2025\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x4f/0x60\n   print_report+0xc4/0x620\n   ? _raw_spin_lock_irqsave+0x70/0xb0\n   ? _raw_read_unlock_irqrestore+0x30/0x30\n   ? blk_queue_enter+0x41c/0x4a0\n   kasan_report+0xab/0xe0\n   ? blk_queue_enter+0x41c/0x4a0\n   blk_queue_enter+0x41c/0x4a0\n   ? __irq_work_queue_local+0x75/0x1d0\n   ? blk_queue_start_drain+0x70/0x70\n   ? irq_work_queue+0x18/0x20\n   ? vprintk_emit.part.0+0x1cc/0x350\n   ? wake_up_klogd_work_func+0x60/0x60\n   blk_mq_alloc_request+0x2b7/0x6b0\n   ? __blk_mq_alloc_requests+0x1060/0x1060\n   ? __switch_to+0x5b7/0x1060\n   nvme_submit_user_cmd+0xa9/0x330\n   nvme_user_cmd.isra.0+0x240/0x3f0\n   ? force_sigsegv+0xe0/0xe0\n   ? nvme_user_cmd64+0x400/0x400\n   ? vfs_fileattr_set+0x9b0/0x9b0\n   ? cgroup_update_frozen_flag+0x24/0x1c0\n   ? cgroup_leave_frozen+0x204/0x330\n   ? nvme_ioctl+0x7c/0x2c0\n   blkdev_ioctl+0x1a8/0x4d0\n   ? blkdev_common_ioctl+0x1930/0x1930\n   ? fdget+0x54/0x380\n   __x64_sys_ioctl+0x129/0x190\n   do_syscall_64+0x5b/0x160\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n  RIP: 0033:0x7f765f703b0b\n  Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 8b 0d dd 52 0f 00 f7 d8 64 89 01 48\n  RSP: 002b:00007ffe2cefe808 EFLAGS: 00000202 ORIG_RAX: 0000000000000010\n  RAX: ffffffffffffffda RBX: 00007ffe2cefe860 RCX: 00007f765f703b0b\n  RDX: 00007ffe2cefe860 RSI: 00000000c0484e41 RDI: 0000000000000003\n  RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000000\n  R10: 00007f765f611d50 R11: 0000000000000202 R12: 0000000000000003\n  R13: 00000000c0484e41 R14: 0000000000000001 R15: 00007ffe2cefea60\n   \u003c/TASK\u003e","status":"published","published":"2025-12-16T14:47:05.303Z","modified":"2026-11-10T12:38:02.068Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"updated_at":"2026-11-10T13:38:44.039016Z"}],"euvd":[{"id":"EUVD-2025-203749","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: fix admin request_queue lifetime\n\nThe namespaces can access the controller's admin request_queue, and\nstale references on the namespaces may exist after tearing down the\ncontroller. Ensure the admin request_queue is active by moving the\ncontroller's 'put' to after all controller references have been released\nto ensure no one is can access the request_queue. This fixes a reported\nuse-after-free bug:\n\n  BUG: KASAN: slab-use-after-free in blk_queue_enter+0x41c/0x4a0\n  Read of size 8 at addr ffff88c0a53819f8 by task nvme/3287\n  CPU: 67 UID: 0 PID: 3287 Comm: nvme Tainted: G            E       6.13.2-ga1582f1a031e #15\n  Tainted: [E]=UNSIGNED_MODULE\n  Hardware name: Jabil /EGS 2S MB1, BIOS 1.00 06/18/2025\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x4f/0x60\n   print_report+0xc4/0x620\n   ? _raw_spin_lock_irqsave+0x70/0xb0\n   ? _raw_read_unlock_irqrestore+0x30/0x30\n   ? blk_queue_enter+0x41c/0x4a0\n   kasan_report+0xab/0xe0\n   ? blk_queue_enter+0x41c/0x4a0\n   blk_queue_enter+0x41c/0x4a0\n   ? __irq_work_queue_local+0x75/0x1d0\n   ? blk_queue_start_drain+0x70/0x70\n   ? irq_work_queue+0x18/0x20\n   ? vprintk_emit.part.0+0x1cc/0x350\n   ? wake_up_klogd_work_func+0x60/0x60\n   blk_mq_alloc_request+0x2b7/0x6b0\n   ? __blk_mq_alloc_requests+0x1060/0x1060\n   ? __switch_to+0x5b7/0x1060\n   nvme_submit_user_cmd+0xa9/0x330\n   nvme_user_cmd.isra.0+0x240/0x3f0\n   ? force_sigsegv+0xe0/0xe0\n   ? nvme_user_cmd64+0x400/0x400\n   ? vfs_fileattr_set+0x9b0/0x9b0\n   ? cgroup_update_frozen_flag+0x24/0x1c0\n   ? cgroup_leave_frozen+0x204/0x330\n   ? nvme_ioctl+0x7c/0x2c0\n   blkdev_ioctl+0x1a8/0x4d0\n   ? blkdev_common_ioctl+0x1930/0x1930\n   ? fdget+0x54/0x380\n   __x64_sys_ioctl+0x129/0x190\n   do_syscall_64+0x5b/0x160\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n  RIP: 0033:0x7f765f703b0b\n  Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 8b 0d dd 52 0f 00 f7 d8 64 89 01 48\n  RSP: 002b:00007ffe2cefe808 EFLAGS: 00000202 ORIG_RAX: 0000000000000010\n  RAX: ffffffffffffffda RBX: 00007ffe2cefe860 RCX: 00007f765f703b0b\n  RDX: 00007ffe2cefe860 RSI: 00000000c0484e41 RDI: 0000000000000003\n  RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000000\n  R10: 00007f765f611d50 R11: 0000000000000202 R12: 0000000000000003\n  R13: 00000000c0484e41 R14: 0000000000000001 R15: 00007ffe2cefea60\n   \u003c/TASK\u003e","status":"published","published":"2025-12-16T14:47:05Z","modified":"2026-11-10T12:38:02Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-10T14:21:12.343171Z"}],"ghsa":[{"id":"GHSA-2rf6-4xf4-32wc","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: fix admin...","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: fix admin request_queue lifetime\n\nThe namespaces can access the controller's admin request_queue, and\nstale references on the namespaces may exist after tearing down the\ncontroller. Ensure the admin request_queue is active by moving the\ncontroller's 'put' to after all controller references have been released\nto ensure no one is can access the request_queue. This fixes a reported\nuse-after-free bug:\n\n  BUG: KASAN: slab-use-after-free in blk_queue_enter+0x41c/0x4a0\n  Read of size 8 at addr ffff88c0a53819f8 by task nvme/3287\n  CPU: 67 UID: 0 PID: 3287 Comm: nvme Tainted: G            E       6.13.2-ga1582f1a031e #15\n  Tainted: [E]=UNSIGNED_MODULE\n  Hardware name: Jabil /EGS 2S MB1, BIOS 1.00 06/18/2025\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x4f/0x60\n   print_report+0xc4/0x620\n   ? _raw_spin_lock_irqsave+0x70/0xb0\n   ? _raw_read_unlock_irqrestore+0x30/0x30\n   ? blk_queue_enter+0x41c/0x4a0\n   kasan_report+0xab/0xe0\n   ? blk_queue_enter+0x41c/0x4a0\n   blk_queue_enter+0x41c/0x4a0\n   ? __irq_work_queue_local+0x75/0x1d0\n   ? blk_queue_start_drain+0x70/0x70\n   ? irq_work_queue+0x18/0x20\n   ? vprintk_emit.part.0+0x1cc/0x350\n   ? wake_up_klogd_work_func+0x60/0x60\n   blk_mq_alloc_request+0x2b7/0x6b0\n   ? __blk_mq_alloc_requests+0x1060/0x1060\n   ? __switch_to+0x5b7/0x1060\n   nvme_submit_user_cmd+0xa9/0x330\n   nvme_user_cmd.isra.0+0x240/0x3f0\n   ? force_sigsegv+0xe0/0xe0\n   ? nvme_user_cmd64+0x400/0x400\n   ? vfs_fileattr_set+0x9b0/0x9b0\n   ? cgroup_update_frozen_flag+0x24/0x1c0\n   ? cgroup_leave_frozen+0x204/0x330\n   ? nvme_ioctl+0x7c/0x2c0\n   blkdev_ioctl+0x1a8/0x4d0\n   ? blkdev_common_ioctl+0x1930/0x1930\n   ? fdget+0x54/0x380\n   __x64_sys_ioctl+0x129/0x190\n   do_syscall_64+0x5b/0x160\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n  RIP: 0033:0x7f765f703b0b\n  Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 8b 0d dd 52 0f 00 f7 d8 64 89 01 48\n  RSP: 002b:00007ffe2cefe808 EFLAGS: 00000202 ORIG_RAX: 0000000000000010\n  RAX: ffffffffffffffda RBX: 00007ffe2cefe860 RCX: 00007f765f703b0b\n  RDX: 00007ffe2cefe860 RSI: 00000000c0484e41 RDI: 0000000000000003\n  RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000000\n  R10: 00007f765f611d50 R11: 0000000000000202 R12: 0000000000000003\n  R13: 00000000c0484e41 R14: 0000000000000001 R15: 00007ffe2cefea60\n   \u003c/TASK\u003e","status":"published","published":"2025-12-16T15:30:47Z","modified":"2026-10-15T03:35:00Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:13:31.944762Z"}],"nvd":[{"id":"CVE-2025-68265","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: fix admin request_queue lifetime\n\nThe namespaces can access the controller's admin request_queue, and\nstale references on the namespaces may exist after tearing down the\ncontroller. Ensure the admin request_queue is active by moving the\ncontroller's 'put' to after all controller references have been released\nto ensure no one is can access the request_queue. This fixes a reported\nuse-after-free bug:\n\n  BUG: KASAN: slab-use-after-free in blk_queue_enter+0x41c/0x4a0\n  Read of size 8 at addr ffff88c0a53819f8 by task nvme/3287\n  CPU: 67 UID: 0 PID: 3287 Comm: nvme Tainted: G            E       6.13.2-ga1582f1a031e #15\n  Tainted: [E]=UNSIGNED_MODULE\n  Hardware name: Jabil /EGS 2S MB1, BIOS 1.00 06/18/2025\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x4f/0x60\n   print_report+0xc4/0x620\n   ? _raw_spin_lock_irqsave+0x70/0xb0\n   ? _raw_read_unlock_irqrestore+0x30/0x30\n   ? blk_queue_enter+0x41c/0x4a0\n   kasan_report+0xab/0xe0\n   ? blk_queue_enter+0x41c/0x4a0\n   blk_queue_enter+0x41c/0x4a0\n   ? __irq_work_queue_local+0x75/0x1d0\n   ? blk_queue_start_drain+0x70/0x70\n   ? irq_work_queue+0x18/0x20\n   ? vprintk_emit.part.0+0x1cc/0x350\n   ? wake_up_klogd_work_func+0x60/0x60\n   blk_mq_alloc_request+0x2b7/0x6b0\n   ? __blk_mq_alloc_requests+0x1060/0x1060\n   ? __switch_to+0x5b7/0x1060\n   nvme_submit_user_cmd+0xa9/0x330\n   nvme_user_cmd.isra.0+0x240/0x3f0\n   ? force_sigsegv+0xe0/0xe0\n   ? nvme_user_cmd64+0x400/0x400\n   ? vfs_fileattr_set+0x9b0/0x9b0\n   ? cgroup_update_frozen_flag+0x24/0x1c0\n   ? cgroup_leave_frozen+0x204/0x330\n   ? nvme_ioctl+0x7c/0x2c0\n   blkdev_ioctl+0x1a8/0x4d0\n   ? blkdev_common_ioctl+0x1930/0x1930\n   ? fdget+0x54/0x380\n   __x64_sys_ioctl+0x129/0x190\n   do_syscall_64+0x5b/0x160\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n  RIP: 0033:0x7f765f703b0b\n  Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 8b 0d dd 52 0f 00 f7 d8 64 89 01 48\n  RSP: 002b:00007ffe2cefe808 EFLAGS: 00000202 ORIG_RAX: 0000000000000010\n  RAX: ffffffffffffffda RBX: 00007ffe2cefe860 RCX: 00007f765f703b0b\n  RDX: 00007ffe2cefe860 RSI: 00000000c0484e41 RDI: 0000000000000003\n  RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000000\n  R10: 00007f765f611d50 R11: 0000000000000202 R12: 0000000000000003\n  R13: 00000000c0484e41 R14: 0000000000000001 R15: 00007ffe2cefea60\n   \u003c/TASK\u003e","status":"published","published":"2025-12-16T15:15:56.03Z","modified":"2026-11-10T13:17:57.39Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"updated_at":"2026-11-10T16:19:45.477914Z"}],"osv":[{"id":"BELL-CVE-2025-68265","status":"published","published":"2025-12-17T06:06:14.365409Z","modified":"2026-07-31T07:19:19.079592828Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:22.77042Z"},{"id":"CVE-2025-68265","title":"nvme: fix admin request_queue lifetime","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: fix admin request_queue lifetime\n\nThe namespaces can access the controller's admin request_queue, and\nstale references on the namespaces may exist after tearing down the\ncontroller. Ensure the admin request_queue is active by moving the\ncontroller's 'put' to after all controller references have been released\nto ensure no one is can access the request_queue. This fixes a reported\nuse-after-free bug:\n\n  BUG: KASAN: slab-use-after-free in blk_queue_enter+0x41c/0x4a0\n  Read of size 8 at addr ffff88c0a53819f8 by task nvme/3287\n  CPU: 67 UID: 0 PID: 3287 Comm: nvme Tainted: G            E       6.13.2-ga1582f1a031e #15\n  Tainted: [E]=UNSIGNED_MODULE\n  Hardware name: Jabil /EGS 2S MB1, BIOS 1.00 06/18/2025\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x4f/0x60\n   print_report+0xc4/0x620\n   ? _raw_spin_lock_irqsave+0x70/0xb0\n   ? _raw_read_unlock_irqrestore+0x30/0x30\n   ? blk_queue_enter+0x41c/0x4a0\n   kasan_report+0xab/0xe0\n   ? blk_queue_enter+0x41c/0x4a0\n   blk_queue_enter+0x41c/0x4a0\n   ? __irq_work_queue_local+0x75/0x1d0\n   ? blk_queue_start_drain+0x70/0x70\n   ? irq_work_queue+0x18/0x20\n   ? vprintk_emit.part.0+0x1cc/0x350\n   ? wake_up_klogd_work_func+0x60/0x60\n   blk_mq_alloc_request+0x2b7/0x6b0\n   ? __blk_mq_alloc_requests+0x1060/0x1060\n   ? __switch_to+0x5b7/0x1060\n   nvme_submit_user_cmd+0xa9/0x330\n   nvme_user_cmd.isra.0+0x240/0x3f0\n   ? force_sigsegv+0xe0/0xe0\n   ? nvme_user_cmd64+0x400/0x400\n   ? vfs_fileattr_set+0x9b0/0x9b0\n   ? cgroup_update_frozen_flag+0x24/0x1c0\n   ? cgroup_leave_frozen+0x204/0x330\n   ? nvme_ioctl+0x7c/0x2c0\n   blkdev_ioctl+0x1a8/0x4d0\n   ? blkdev_common_ioctl+0x1930/0x1930\n   ? fdget+0x54/0x380\n   __x64_sys_ioctl+0x129/0x190\n   do_syscall_64+0x5b/0x160\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n  RIP: 0033:0x7f765f703b0b\n  Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 8b 0d dd 52 0f 00 f7 d8 64 89 01 48\n  RSP: 002b:00007ffe2cefe808 EFLAGS: 00000202 ORIG_RAX: 0000000000000010\n  RAX: ffffffffffffffda RBX: 00007ffe2cefe860 RCX: 00007f765f703b0b\n  RDX: 00007ffe2cefe860 RSI: 00000000c0484e41 RDI: 0000000000000003\n  RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000000\n  R10: 00007f765f611d50 R11: 0000000000000202 R12: 0000000000000003\n  R13: 00000000c0484e41 R14: 0000000000000001 R15: 00007ffe2cefea60\n   \u003c/TASK\u003e","status":"published","published":"2025-12-16T14:47:05.303Z","modified":"2026-10-28T02:30:42.442613163Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:52.53036Z"},{"id":"DEBIAN-CVE-2025-68265","description":"In the Linux kernel, the following vulnerability has been resolved:  nvme: fix admin request_queue lifetime  The namespaces can access the controller's admin request_queue, and stale references on the namespaces may exist after tearing down the controller. Ensure the admin request_queue is active by moving the controller's 'put' to after all controller references have been released to ensure no one is can access the request_queue. This fixes a reported use-after-free bug:    BUG: KASAN: slab-use-after-free in blk_queue_enter+0x41c/0x4a0   Read of size 8 at addr ffff88c0a53819f8 by task nvme/3287   CPU: 67 UID: 0 PID: 3287 Comm: nvme Tainted: G            E       6.13.2-ga1582f1a031e #15   Tainted: [E]=UNSIGNED_MODULE   Hardware name: Jabil /EGS 2S MB1, BIOS 1.00 06/18/2025   Call Trace:    \u003cTASK\u003e    dump_stack_lvl+0x4f/0x60    print_report+0xc4/0x620    ? _raw_spin_lock_irqsave+0x70/0xb0    ? _raw_read_unlock_irqrestore+0x30/0x30    ? blk_queue_enter+0x41c/0x4a0    kasan_report+0xab/0xe0    ? blk_queue_enter+0x41c/0x4a0    blk_queue_enter+0x41c/0x4a0    ? __irq_work_queue_local+0x75/0x1d0    ? blk_queue_start_drain+0x70/0x70    ? irq_work_queue+0x18/0x20    ? vprintk_emit.part.0+0x1cc/0x350    ? wake_up_klogd_work_func+0x60/0x60    blk_mq_alloc_request+0x2b7/0x6b0    ? __blk_mq_alloc_requests+0x1060/0x1060    ? __switch_to+0x5b7/0x1060    nvme_submit_user_cmd+0xa9/0x330    nvme_user_cmd.isra.0+0x240/0x3f0    ? force_sigsegv+0xe0/0xe0    ? nvme_user_cmd64+0x400/0x400    ? vfs_fileattr_set+0x9b0/0x9b0    ? cgroup_update_frozen_flag+0x24/0x1c0    ? cgroup_leave_frozen+0x204/0x330    ? nvme_ioctl+0x7c/0x2c0    blkdev_ioctl+0x1a8/0x4d0    ? blkdev_common_ioctl+0x1930/0x1930    ? fdget+0x54/0x380    __x64_sys_ioctl+0x129/0x190    do_syscall_64+0x5b/0x160    entry_SYSCALL_64_after_hwframe+0x4b/0x53   RIP: 0033:0x7f765f703b0b   Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 8b 0d dd 52 0f 00 f7 d8 64 89 01 48   RSP: 002b:00007ffe2cefe808 EFLAGS: 00000202 ORIG_RAX: 0000000000000010   RAX: ffffffffffffffda RBX: 00007ffe2cefe860 RCX: 00007f765f703b0b   RDX: 00007ffe2cefe860 RSI: 00000000c0484e41 RDI: 0000000000000003   RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000000   R10: 00007f765f611d50 R11: 0000000000000202 R12: 0000000000000003   R13: 00000000c0484e41 R14: 0000000000000001 R15: 00007ffe2cefea60    \u003c/TASK\u003e","status":"published","published":"2025-12-16T15:15:56.03Z","modified":"2026-10-16T09:47:23.024250567Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:48.025964Z"},{"id":"OESA-2026-1759","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niommu/s390: Implement blocking domain\n\nThis fixes a crash when surprise hot-unplugging a PCI device. This crash\nhappens because during hot-unplug __iommu_group_set_domain_nofail()\nattaching the default domain fails when the platform no longer\nrecognizes the device as it has already been removed and we end up with\na NULL domain pointer and UAF. This is exactly the case referred to in\nthe second comment in __iommu_device_set_domain() and just as stated\nthere if we can instead attach the blocking domain the UAF is prevented\nas this can handle the already removed device. Implement the blocking\ndomain to use this handling.  With this change, the crash is fixed but\nwe still hit a warning attempting to change DMA ownership on a blocked\ndevice.(CVE-2024-53232)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niommu: Fix two issues in iommu_copy_struct_from_user()\n\nIn the review for iommu_copy_struct_to_user() helper, Matt pointed out that\na NULL pointer should be rejected prior to dereferencing it:\nhttps://lore.kernel.org/all/(CVE-2025-37900)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: Avoid race in open_cached_dir with lease breaks\n\nA pre-existing valid cfid returned from find_or_create_cached_dir might\nrace with a lease break, meaning open_cached_dir doesn\u0026apos;t consider it\nvalid, and thinks it\u0026apos;s newly-constructed. This leaks a dentry reference\nif the allocation occurs before the queued lease break work runs.\n\nAvoid the race by extending holding the cfid_list_lock across\nfind_or_create_cached_dir and when the result is checked.(CVE-2025-37954)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: prio: fix a race in prio_tune()\n\nGerrard Tai reported a race condition in PRIO, whenever SFQ perturb timer\nfires at the wrong time.\n\nThe race is as follows:\n\nCPU 0                                 CPU 1\n[1]: lock root\n[2]: qdisc_tree_flush_backlog()\n[3]: unlock root\n |\n |                                    [5]: lock root\n |                                    [6]: rehash\n |                                    [7]: qdisc_tree_reduce_backlog()\n |\n[4]: qdisc_put()\n\nThis can be abused to underflow a parent\u0026apos;s qlen.\n\nCalling qdisc_purge_queue() instead of qdisc_tree_flush_backlog()\nshould fix the race, because all packets will be purged from the qdisc\nbefore releasing the lock.(CVE-2025-38083)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nIB/mlx5: Fix potential deadlock in MR deregistration\n\nThe issue arises when kzalloc() is invoked while holding umem_mutex or\nany other lock acquired under umem_mutex. This is problematic because\nkzalloc() can trigger fs_reclaim_aqcuire(), which may, in turn, invoke\nmmu_notifier_invalidate_range_start(). This function can lead to\nmlx5_ib_invalidate_range(), which attempts to acquire umem_mutex again,\nresulting in a deadlock.\n\nThe problematic flow:\n             CPU0                      |              CPU1\n---------------------------------------|------------------------------------------------\nmlx5_ib_dereg_mr()                     |\n → revoke_mr()                         |\n   → mutex_lock(\u0026amp;umem_odp-\u0026gt;umem_mutex) |\n                                       | mlx5_mkey_cache_init()\n                                       |  → mutex_lock(\u0026amp;dev-\u0026gt;cache.rb_lock)\n                                       |  → mlx5r_cache_create_ent_locked()\n                                       |    → kzalloc(GFP_KERNEL)\n                                       |      → fs_reclaim()\n                                       |        → mmu_notifier_invalidate_range_start()\n                                       |          → mlx5_ib_invalidate_range()\n                                       |            → mutex_lock(\u0026amp;umem_odp-\u0026gt;umem_mutex)\n   → cache_ent_find_and_store()        |\n     → mutex_lock(\u0026amp;dev-\u0026gt;cache.rb_lock) |\n\nAdditionally, when kzalloc() is called from within\ncache_ent_find_and_store(), we encounter the same deadlock due to\nre-acquisition of umem_mutex.\n\nSolve by releasing umem_mutex in dereg_mr() after umr_revoke_mr()\nand before acquiring rb_lock. This ensures that we don\u0026apos;t hold\numem_mutex while performing memory allocations that could trigger\nthe reclaim path.\n\nThis change prevents the deadlock by ensuring proper lock ordering and\navoiding holding locks during memory allocation operations that could\ntrigger the reclaim path.\n\nThe following lockdep warning demonstrates the deadlock:\n\n python3/20557 is trying to acquire lock:\n ffff888387542128 (\u0026amp;umem_odp-\u0026gt;umem_mutex){+.+.}-{4:4}, at:\n mlx5_ib_invalidate_range+0x5b/0x550 [mlx5_ib]\n\n but task is already holding lock:\n ffffffff82f6b840 (mmu_notifier_invalidate_range_start){+.+.}-{0:0}, at:\n unmap_vmas+0x7b/0x1a0\n\n which lock already depends on the new lock.\n\n the existing dependency chain (in reverse order) is:\n\n -\u0026gt; #3 (mmu_notifier_invalidate_range_start){+.+.}-{0:0}:\n       fs_reclaim_acquire+0x60/0xd0\n       mem_cgroup_css_alloc+0x6f/0x9b0\n       cgroup_init_subsys+0xa4/0x240\n       cgroup_init+0x1c8/0x510\n       start_kernel+0x747/0x760\n       x86_64_start_reservations+0x25/0x30\n       x86_64_start_kernel+0x73/0x80\n       common_startup_64+0x129/0x138\n\n -\u0026gt; #2 (fs_reclaim){+.+.}-{0:0}:\n       fs_reclaim_acquire+0x91/0xd0\n       __kmalloc_cache_noprof+0x4d/0x4c0\n       mlx5r_cache_create_ent_locked+0x75/0x620 [mlx5_ib]\n       mlx5_mkey_cache_init+0x186/0x360 [mlx5_ib]\n       mlx5_ib_stage_post_ib_reg_umr_init+0x3c/0x60 [mlx5_ib]\n       __mlx5_ib_add+0x4b/0x190 [mlx5_ib]\n       mlx5r_probe+0xd9/0x320 [mlx5_ib]\n       auxiliary_bus_probe+0x42/0x70\n       really_probe+0xdb/0x360\n       __driver_probe_device+0x8f/0x130\n       driver_probe_device+0x1f/0xb0\n       __driver_attach+0xd4/0x1f0\n       bus_for_each_dev+0x79/0xd0\n       bus_add_driver+0xf0/0x200\n       driver_register+0x6e/0xc0\n       __auxiliary_driver_register+0x6a/0xc0\n       do_one_initcall+0x5e/0x390\n       do_init_module+0x88/0x240\n       init_module_from_file+0x85/0xc0\n       idempotent_init_module+0x104/0x300\n       __x64_sys_finit_module+0x68/0xc0\n       do_syscall_64+0x6d/0x140\n       entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\n -\u0026gt; #1 (\u0026amp;dev-\u0026gt;cache.rb_lock){+.+.}-{4:4}:\n       __mutex_lock+0x98/0xf10\n       __mlx5_ib_dereg_mr+0x6f2/0x890 [mlx5_ib]\n       mlx5_ib_dereg_mr+0x21/0x110 [mlx5_ib]\n       ib_dereg_mr_user+0x85/0x1f0 [ib_core]\n  \n---truncated---(CVE-2025-38373)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: Harden s32ton() against conversion to 0 bits\n\nTesting by the syzbot fuzzer showed that the HID core gets a\nshift-out-of-bounds exception when it tries to convert a 32-bit\nquantity to a 0-bit quantity.  Ideally this should never occur, but\nthere are buggy devices and some might have a report field with size\nset to zero; we shouldn\u0026apos;t reject the report or the device just because\nof that.\n\nInstead, harden the s32ton() routine so that it returns a reasonable\nresult instead of crashing when it is called with the number of bits\nset to 0 -- the same as what snto32() does.(CVE-2025-38556)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject narrower access to pointer ctx fields\n\nThe following BPF program, simplified from a syzkaller repro, causes a\nkernel warning:\n\n    r0 = *(u8 *)(r1 + 169);\n    exit;\n\nWith pointer field sk being at offset 168 in __sk_buff. This access is\ndetected as a narrower read in bpf_skb_is_valid_access because it\ndoesn\u0026apos;t match offsetof(struct __sk_buff, sk). It is therefore allowed\nand later proceeds to bpf_convert_ctx_access. Note that for the\n\u0026quot;is_narrower_load\u0026quot; case in the convert_ctx_accesses(), the insn-\u0026gt;off\nis aligned, so the cnt may not be 0 because it matches the\noffsetof(struct __sk_buff, sk) in the bpf_convert_ctx_access. However,\nthe target_size stays 0 and the verifier errors with a kernel warning:\n\n    verifier bug: error during ctx access conversion(1)\n\nThis patch fixes that to return a proper \u0026quot;invalid bpf_context access\noff=X size=Y\u0026quot; error on the load instruction.\n\nThe same issue affects multiple other fields in context structures that\nallow narrow access. Some other non-affected fields (for sk_msg,\nsk_lookup, and sockopt) were also changed to use bpf_ctx_range_ptr for\nconsistency.\n\nNote this syzkaller crash was reported in the \u0026quot;Closes\u0026quot; link below, which\nused to be about a different bug, fixed in\ncommit fce7bd8e385a (\u0026quot;bpf/verifier: Handle BPF_LOAD_ACQ instructions\nin insn_def_regno()\u0026quot;). Because syzbot somehow confused the two bugs,\nthe new crash and repro didn\u0026apos;t get reported to the mailing list.(CVE-2025-38591)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: No more self recovery\n\nWhen a node withdraws and it turns out that it is the only node that has\nthe filesystem mounted, gfs2 currently tries to replay the local journal\nto bring the filesystem back into a consistent state.  Not only is that\na very bad idea, it has also never worked because gfs2_recover_func()\nwill refuse to do anything during a withdraw.\n\nHowever, before even getting to this point, gfs2_recover_func()\ndereferences sdp-\u0026gt;sd_jdesc-\u0026gt;jd_inode.  This was a use-after-free before\ncommit 04133b607a78 (\u0026quot;gfs2: Prevent double iput for journal on error\u0026quot;)\nand is a NULL pointer dereference since then.\n\nSimply get rid of self recovery to fix that.(CVE-2025-38659)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/net: commit partial buffers on retry\n\nRing provided buffers are potentially only valid within the single\nexecution context in which they were acquired. io_uring deals with this\nand invalidates them on retry. But on the networking side, if\nMSG_WAITALL is set, or if the socket is of the streaming type and too\nlittle was processed, then it will hang on to the buffer rather than\nrecycle or commit it. This is problematic for two reasons:\n\n1) If someone unregisters the provided buffer ring before a later retry,\n   then the req-\u0026gt;buf_list will no longer be valid.\n\n2) If multiple sockers are using the same buffer group, then multiple\n   receives can consume the same memory. This can cause data corruption\n   in the application, as either receive could land in the same\n   userspace buffer.\n\nFix this by disallowing partial retries from pinning a provided buffer\nacross multiple executions, if ring provided buffers are used.(CVE-2025-38730)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmedia: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()\n\nIn the interrupt handler rain_interrupt(), the buffer full check on\nrain-\u0026gt;buf_len is performed before acquiring rain-\u0026gt;buf_lock. This\ncreates a Time-of-Check to Time-of-Use (TOCTOU) race condition, as\nrain-\u0026gt;buf_len is concurrently accessed and modified in the work\nhandler rain_irq_work_handler() under the same lock.\n\nMultiple interrupt invocations can race, with each reading buf_len\nbefore it becomes full and then proceeding. This can lead to both\ninterrupts attempting to write to the buffer, incrementing buf_len\nbeyond its capacity (DATA_SIZE) and causing a buffer overflow.\n\nFix this bug by moving the spin_lock() to before the buffer full\ncheck. This ensures that the check and the subsequent buffer modification\nare performed atomically, preventing the race condition. An corresponding\nspin_unlock() is added to the overflow path to correctly release the\nlock.\n\nThis possible bug was found by an experimental static analysis tool\ndeveloped by our team.(CVE-2025-39713)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niommu/amd/pgtbl: Fix possible race while increase page table level\n\nThe AMD IOMMU host page table implementation supports dynamic page table levels\n(up to 6 levels), starting with a 3-level configuration that expands based on\nIOVA address. The kernel maintains a root pointer and current page table level\nto enable proper page table walks in alloc_pte()/fetch_pte() operations.\n\nThe IOMMU IOVA allocator initially starts with 32-bit address and onces its\nexhuasted it switches to 64-bit address (max address is determined based\non IOMMU and device DMA capability). To support larger IOVA, AMD IOMMU\ndriver increases page table level.\n\nBut in unmap path (iommu_v1_unmap_pages()), fetch_pte() reads\npgtable-\u0026gt;[root/mode] without lock. So its possible that in exteme corner case,\nwhen increase_address_space() is updating pgtable-\u0026gt;[root/mode], fetch_pte()\nreads wrong page table level (pgtable-\u0026gt;mode). It does compare the value with\nlevel encoded in page table and returns NULL. This will result is\niommu_unmap ops to fail and upper layer may retry/log WARN_ON.\n\nCPU 0                                         CPU 1\n------                                       ------\nmap pages                                    unmap pages\nalloc_pte() -\u0026gt; increase_address_space()      iommu_v1_unmap_pages() -\u0026gt; fetch_pte()\n  pgtable-\u0026gt;root = pte (new root value)\n                                             READ pgtable-\u0026gt;[mode/root]\n\t\t\t\t\t       Reads new root, old mode\n  Updates mode (pgtable-\u0026gt;mode += 1)\n\nSince Page table level updates are infrequent and already synchronized with a\nspinlock, implement seqcount to enable lock-free read operations on the read path.(CVE-2025-39961)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: check the return value of pinmux_ops::get_function_name()\n\nWhile the API contract in docs doesn\u0026apos;t specify it explicitly, the\ngeneric implementation of the get_function_name() callback from struct\npinmux_ops - pinmux_generic_get_function_name() - can fail and return\nNULL. This is already checked in pinmux_check_ops() so add a similar\ncheck in pinmux_func_name_to_selector() instead of passing the returned\npointer right down to strcmp() where the NULL can get dereferenced. This\nis normal operation when adding new pinfunctions.(CVE-2025-40030)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies\n\nWhen adding dependencies with drm_sched_job_add_dependency(), that\nfunction consumes the fence reference both on success and failure, so in\nthe latter case the dma_fence_put() on the error path (xarray failed to\nexpand) is a double free.\n\nInterestingly this bug appears to have been present ever since\ncommit ebd5f74255b9 (\u0026quot;drm/sched: Add dependency tracking\u0026quot;), since the code\nback then looked like this:\n\ndrm_sched_job_add_implicit_dependencies():\n...\n       for (i = 0; i \u0026lt; fence_count; i++) {\n               ret = drm_sched_job_add_dependency(job, fences[i]);\n               if (ret)\n                       break;\n       }\n\n       for (; i \u0026lt; fence_count; i++)\n               dma_fence_put(fences[i]);\n\nWhich means for the failing \u0026apos;i\u0026apos; the dma_fence_put was already a double\nfree. Possibly there were no users at that time, or the test cases were\ninsufficient to hit it.\n\nThe bug was then only noticed and fixed after\ncommit 9c2ba265352a (\u0026quot;drm/scheduler: use new iterator in drm_sched_job_add_implicit_dependencies v2\u0026quot;)\nlanded, with its fixup of\ncommit 4eaf02d6076c (\u0026quot;drm/scheduler: fix drm_sched_job_add_implicit_dependencies\u0026quot;).\n\nAt that point it was a slightly different flavour of a double free, which\ncommit 963d0b356935 (\u0026quot;drm/scheduler: fix drm_sched_job_add_implicit_dependencies harder\u0026quot;)\nnoticed and attempted to fix.\n\nBut it only moved the double free from happening inside the\ndrm_sched_job_add_dependency(), when releasing the reference not yet\nobtained, to the caller, when releasing the reference already released by\nthe former in the failure case.\n\nAs such it is not easy to identify the right target for the fixes tag so\nlets keep it simple and just continue the chain.\n\nWhile fixing we also improve the comment and explain the reason for taking\nthe reference and not dropping it.(CVE-2025-40096)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: delete x-\u0026gt;tunnel as we delete x\n\nThe ipcomp fallback tunnels currently get deleted (from the various\nlists and hashtables) as the last user state that needed that fallback\nis destroyed (not deleted). If a reference to that user state still\nexists, the fallback state will remain on the hashtables/lists,\ntriggering the WARN in xfrm_state_fini. Because of those remaining\nreferences, the fix in commit f75a2804da39 (\u0026quot;xfrm: destroy xfrm_state\nsynchronously on net exit path\u0026quot;) is not complete.\n\nWe recently fixed one such situation in TCP due to defered freeing of\nskbs (commit 9b6412e6979f (\u0026quot;tcp: drop secpath at the same time as we\ncurrently drop dst\u0026quot;)). This can also happen due to IP reassembly: skbs\nwith a secpath remain on the reassembly queue until netns\ndestruction. If we can\u0026apos;t guarantee that the queues are flushed by the\ntime xfrm_state_fini runs, there may still be references to a (user)\nxfrm_state, preventing the timely deletion of the corresponding\nfallback state.\n\nInstead of chasing each instance of skbs holding a secpath one by one,\nthis patch fixes the issue directly within xfrm, by deleting the\nfallback state as soon as the last user state depending on it has been\ndeleted. Destruction will still happen when the final reference is\ndropped.\n\nA separate lockdep class for the fallback state is required since\nwe\u0026apos;re going to lock x-\u0026gt;tunnel while x is locked.(CVE-2025-40215)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfuse: fix livelock in synchronous file put from fuseblk workers\n\nI observed a hang when running generic/323 against a fuseblk server.\nThis test opens a file, initiates a lot of AIO writes to that file\ndescriptor, and closes the file descriptor before the writes complete.\nUnsurprisingly, the AIO exerciser threads are mostly stuck waiting for\nresponses from the fuseblk server:\n\n# cat /proc/372265/task/372313/stack\n[\u0026lt;0\u0026gt;] request_wait_answer+0x1fe/0x2a0 [fuse]\n[\u0026lt;0\u0026gt;] __fuse_simple_request+0xd3/0x2b0 [fuse]\n[\u0026lt;0\u0026gt;] fuse_do_getattr+0xfc/0x1f0 [fuse]\n[\u0026lt;0\u0026gt;] fuse_file_read_iter+0xbe/0x1c0 [fuse]\n[\u0026lt;0\u0026gt;] aio_read+0x130/0x1e0\n[\u0026lt;0\u0026gt;] io_submit_one+0x542/0x860\n[\u0026lt;0\u0026gt;] __x64_sys_io_submit+0x98/0x1a0\n[\u0026lt;0\u0026gt;] do_syscall_64+0x37/0xf0\n[\u0026lt;0\u0026gt;] entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\nBut the /weird/ part is that the fuseblk server threads are waiting for\nresponses from itself:\n\n# cat /proc/372210/task/372232/stack\n[\u0026lt;0\u0026gt;] request_wait_answer+0x1fe/0x2a0 [fuse]\n[\u0026lt;0\u0026gt;] __fuse_simple_request+0xd3/0x2b0 [fuse]\n[\u0026lt;0\u0026gt;] fuse_file_put+0x9a/0xd0 [fuse]\n[\u0026lt;0\u0026gt;] fuse_release+0x36/0x50 [fuse]\n[\u0026lt;0\u0026gt;] __fput+0xec/0x2b0\n[\u0026lt;0\u0026gt;] task_work_run+0x55/0x90\n[\u0026lt;0\u0026gt;] syscall_exit_to_user_mode+0xe9/0x100\n[\u0026lt;0\u0026gt;] do_syscall_64+0x43/0xf0\n[\u0026lt;0\u0026gt;] entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\nThe fuseblk server is fuse2fs so there\u0026apos;s nothing all that exciting in\nthe server itself.  So why is the fuse server calling fuse_file_put?\nThe commit message for the fstest sheds some light on that:\n\n\u0026quot;By closing the file descriptor before calling io_destroy, you pretty\nmuch guarantee that the last put on the ioctx will be done in interrupt\ncontext (during I/O completion).\n\nAha.  AIO fgets a new struct file from the fd when it queues the ioctx.\nThe completion of the FUSE_WRITE command from userspace causes the fuse\nserver to call the AIO completion function.  The completion puts the\nstruct file, queuing a delayed fput to the fuse server task.  When the\nfuse server task returns to userspace, it has to run the delayed fput,\nwhich in the case of a fuseblk server, it does synchronously.\n\nSending the FUSE_RELEASE command sychronously from fuse server threads\nis a bad idea because a client program can initiate enough simultaneous\nAIOs such that all the fuse server threads end up in delayed_fput, and\nnow there aren\u0026apos;t any threads left to handle the queued fuse commands.\n\nFix this by only using asynchronous fputs when closing files, and leave\na comment explaining why.(CVE-2025-40220)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfs/notify: call exportfs_encode_fid with s_umount\n\nCalling intotify_show_fdinfo() on fd watching an overlayfs inode, while\nthe overlayfs is being unmounted, can lead to dereferencing NULL ptr.\n\nThis issue was found by syzkaller.\n\nRace Condition Diagram:\n\nThread 1                           Thread 2\n--------                           --------\n\ngeneric_shutdown_super()\n shrink_dcache_for_umount\n  sb-\u0026gt;s_root = NULL\n\n                    |\n                    |             vfs_read()\n                    |              inotify_fdinfo()\n                    |               * inode get from mark *\n                    |               show_mark_fhandle(m, inode)\n                    |                exportfs_encode_fid(inode, ..)\n                    |                 ovl_encode_fh(inode, ..)\n                    |                  ovl_check_encode_origin(inode)\n                    |                   * deref i_sb-\u0026gt;s_root *\n                    |\n                    |\n                    v\n fsnotify_sb_delete(sb)\n\nWhich then leads to:\n\n[   32.133461] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI\n[   32.134438] KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]\n[   32.135032] CPU: 1 UID: 0 PID: 4468 Comm: systemd-coredum Not tainted 6.17.0-rc6 #22 PREEMPT(none)\n\n\u0026lt;snip registers, unreliable trace\u0026gt;\n\n[   32.143353] Call Trace:\n[   32.143732]  ovl_encode_fh+0xd5/0x170\n[   32.144031]  exportfs_encode_inode_fh+0x12f/0x300\n[   32.144425]  show_mark_fhandle+0xbe/0x1f0\n[   32.145805]  inotify_fdinfo+0x226/0x2d0\n[   32.146442]  inotify_show_fdinfo+0x1c5/0x350\n[   32.147168]  seq_show+0x530/0x6f0\n[   32.147449]  seq_read_iter+0x503/0x12a0\n[   32.148419]  seq_read+0x31f/0x410\n[   32.150714]  vfs_read+0x1f0/0x9e0\n[   32.152297]  ksys_read+0x125/0x240\n\nIOW ovl_check_encode_origin derefs inode-\u0026gt;i_sb-\u0026gt;s_root, after it was set\nto NULL in the unmount path.\n\nFix it by protecting calling exportfs_encode_fid() from\nshow_mark_fhandle() with s_umount lock.\n\nThis form of fix was suggested by Amir in [1].\n\n[1]: https://lore.kernel.org/all/CAOQ4uxhbDwhb+2Brs1UdkoF0a3NSdBAOQPNfEHjahrgoKJpLEw@mail.gmail.com/(CVE-2025-40237)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Fix unlikely race in gdlm_put_lock\n\nIn gdlm_put_lock(), there is a small window of time in which the\nDFL_UNMOUNT flag has been set but the lockspace hasn\u0026apos;t been released,\nyet.  In that window, dlm may still call gdlm_ast() and gdlm_bast().\nTo prevent it from dereferencing freed glock objects, only free the\nglock if the lockspace has actually been released.(CVE-2025-40242)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndevlink: rate: Unset parent pointer in devl_rate_nodes_destroy\n\nThe function devl_rate_nodes_destroy is documented to \u0026quot;Unset parent for\nall rate objects\u0026quot;. However, it was only calling the driver-specific\n`rate_leaf_parent_set` or `rate_node_parent_set` ops and decrementing\nthe parent\u0026apos;s refcount, without actually setting the\n`devlink_rate-\u0026gt;parent` pointer to NULL.\n\nThis leaves a dangling pointer in the `devlink_rate` struct, which cause\nrefcount error in netdevsim[1] and mlx5[2]. In addition, this is\ninconsistent with the behavior of `devlink_nl_rate_parent_node_set`,\nwhere the parent pointer is correctly cleared.\n\nThis patch fixes the issue by explicitly setting `devlink_rate-\u0026gt;parent`\nto NULL after notifying the driver, thus fulfilling the function\u0026apos;s\ndocumented behavior for all rate objects.\n\n[1]\nrepro steps:\necho 1 \u0026gt; /sys/bus/netdevsim/new_device\ndevlink dev eswitch set netdevsim/netdevsim1 mode switchdev\necho 1 \u0026gt; /sys/bus/netdevsim/devices/netdevsim1/sriov_numvfs\ndevlink port function rate add netdevsim/netdevsim1/test_node\ndevlink port function rate set netdevsim/netdevsim1/128 parent test_node\necho 1 \u0026gt; /sys/bus/netdevsim/del_device\n\ndmesg:\nrefcount_t: decrement hit 0; leaking memory.\nWARNING: CPU: 8 PID: 1530 at lib/refcount.c:31 refcount_warn_saturate+0x42/0xe0\nCPU: 8 UID: 0 PID: 1530 Comm: bash Not tainted 6.18.0-rc4+ #1 NONE\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\nRIP: 0010:refcount_warn_saturate+0x42/0xe0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n devl_rate_leaf_destroy+0x8d/0x90\n __nsim_dev_port_del+0x6c/0x70 [netdevsim]\n nsim_dev_reload_destroy+0x11c/0x140 [netdevsim]\n nsim_drv_remove+0x2b/0xb0 [netdevsim]\n device_release_driver_internal+0x194/0x1f0\n bus_remove_device+0xc6/0x130\n device_del+0x159/0x3c0\n device_unregister+0x1a/0x60\n del_device_store+0x111/0x170 [netdevsim]\n kernfs_fop_write_iter+0x12e/0x1e0\n vfs_write+0x215/0x3d0\n ksys_write+0x5f/0xd0\n do_syscall_64+0x55/0x10f0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\n[2]\ndevlink dev eswitch set pci/0000:08:00.0 mode switchdev\ndevlink port add pci/0000:08:00.0 flavour pcisf pfnum 0 sfnum 1000\ndevlink port function rate add pci/0000:08:00.0/group1\ndevlink port function rate set pci/0000:08:00.0/32768 parent group1\nmodprobe -r mlx5_ib mlx5_fwctl mlx5_core\n\ndmesg:\nrefcount_t: decrement hit 0; leaking memory.\nWARNING: CPU: 7 PID: 16151 at lib/refcount.c:31 refcount_warn_saturate+0x42/0xe0\nCPU: 7 UID: 0 PID: 16151 Comm: bash Not tainted 6.17.0-rc7_for_upstream_min_debug_2025_10_02_12_44 #1 NONE\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\nRIP: 0010:refcount_warn_saturate+0x42/0xe0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n devl_rate_leaf_destroy+0x8d/0x90\n mlx5_esw_offloads_devlink_port_unregister+0x33/0x60 [mlx5_core]\n mlx5_esw_offloads_unload_rep+0x3f/0x50 [mlx5_core]\n mlx5_eswitch_unload_sf_vport+0x40/0x90 [mlx5_core]\n mlx5_sf_esw_event+0xc4/0x120 [mlx5_core]\n notifier_call_chain+0x33/0xa0\n blocking_notifier_call_chain+0x3b/0x50\n mlx5_eswitch_disable_locked+0x50/0x110 [mlx5_core]\n mlx5_eswitch_disable+0x63/0x90 [mlx5_core]\n mlx5_unload+0x1d/0x170 [mlx5_core]\n mlx5_uninit_one+0xa2/0x130 [mlx5_core]\n remove_one+0x78/0xd0 [mlx5_core]\n pci_device_remove+0x39/0xa0\n device_release_driver_internal+0x194/0x1f0\n unbind_store+0x99/0xa0\n kernfs_fop_write_iter+0x12e/0x1e0\n vfs_write+0x215/0x3d0\n ksys_write+0x5f/0xd0\n do_syscall_64+0x53/0x1f0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53(CVE-2025-40251)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfs/proc: fix uaf in proc_readdir_de()\n\nPde is erased from subdir rbtree through rb_erase(), but not set the node\nto EMPTY, which may result in uaf access.  We should use RB_CLEAR_NODE()\nset the erased node to EMPTY, then pde_subdir_next() will return NULL to\navoid uaf access.\n\nWe found an uaf issue while using stress-ng testing, need to run testcase\ngetdent and tun in the same time.  The steps of the issue is as follows:\n\n1) use getdent to traverse dir /proc/pid/net/dev_snmp6/, and current\n   pde is tun3;\n\n2) in the [time windows] unregister netdevice tun3 and tun2, and erase\n   them from rbtree.  erase tun3 first, and then erase tun2.  the\n   pde(tun2) will be released to slab;\n\n3) continue to getdent process, then pde_subdir_next() will return\n   pde(tun2) which is released, it will case uaf access.\n\nCPU 0                                      |    CPU 1\n-------------------------------------------------------------------------\ntraverse dir /proc/pid/net/dev_snmp6/      |   unregister_netdevice(tun-\u0026gt;dev)   //tun3 tun2\nsys_getdents64()                           |\n  iterate_dir()                            |\n    proc_readdir()                         |\n      proc_readdir_de()                    |     snmp6_unregister_dev()\n        pde_get(de);                       |       proc_remove()\n        read_unlock(\u0026amp;proc_subdir_lock);    |         remove_proc_subtree()\n                                           |           write_lock(\u0026amp;proc_subdir_lock);\n        [time window]                      |           rb_erase(\u0026amp;root-\u0026gt;subdir_node, \u0026amp;parent-\u0026gt;subdir);\n                                           |           write_unlock(\u0026amp;proc_subdir_lock);\n        read_lock(\u0026amp;proc_subdir_lock);      |\n        next = pde_subdir_next(de);        |\n        pde_put(de);                       |\n        de = next;    //UAF                |\n\nrbtree of dev_snmp6\n                        |\n                    pde(tun3)\n                     /    \\\n                  NULL  pde(tun2)(CVE-2025-40271)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/secretmem: fix use-after-free race in fault handler\n\nWhen a page fault occurs in a secret memory file created with\n`memfd_secret(2)`, the kernel will allocate a new folio for it, mark the\nunderlying page as not-present in the direct map, and add it to the file\nmapping.\n\nIf two tasks cause a fault in the same page concurrently, both could end\nup allocating a folio and removing the page from the direct map, but only\none would succeed in adding the folio to the file mapping.  The task that\nfailed undoes the effects of its attempt by (a) freeing the folio again\nand (b) putting the page back into the direct map.  However, by doing\nthese two operations in this order, the page becomes available to the\nallocator again before it is placed back in the direct mapping.\n\nIf another task attempts to allocate the page between (a) and (b), and the\nkernel tries to access it via the direct map, it would result in a\nsupervisor not-present page fault.\n\nFix the ordering to restore the direct map before the folio is freed.(CVE-2025-40272)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE\n\nThis data originates from userspace and is used in buffer offset\ncalculations which could potentially overflow causing an out-of-bounds\naccess.(CVE-2025-40277)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern()\n\nIn the parse_adv_monitor_pattern() function, the value of\nthe \u0026apos;length\u0026apos; variable is currently limited to HCI_MAX_EXT_AD_LENGTH(251).\nThe size of the \u0026apos;value\u0026apos; array in the mgmt_adv_pattern structure is 31.\nIf the value of \u0026apos;pattern[i].length\u0026apos; is set in the user space\nand exceeds 31, the \u0026apos;patterns[i].value\u0026apos; array can be accessed\nout of bound when copied.\n\nIncreasing the size of the \u0026apos;value\u0026apos; array in\nthe \u0026apos;mgmt_adv_pattern\u0026apos; structure will break the userspace.\nConsidering this, and to avoid OOB access revert the limits for \u0026apos;offset\u0026apos;\nand \u0026apos;length\u0026apos; back to the value of HCI_MAX_AD_LENGTH.\n\nFound by InfoTeCS on behalf of Linux Verification Center\n(linuxtesting.org) with SVACE.(CVE-2025-40294)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: validate skb length for unknown CC opcode\n\nIn hci_cmd_complete_evt(), if the command complete event has an unknown\nopcode, we assume the first byte of the remaining skb-\u0026gt;data contains the\nreturn status. However, parameter data has previously been pulled in\nhci_event_func(), which may leave the skb empty. If so, using skb-\u0026gt;data[0]\nfor the return status uses un-init memory.\n\nThe fix is to check skb-\u0026gt;len before using skb-\u0026gt;data.(CVE-2025-40301)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: bcsp: receive data only if registered\n\nCurrently, bcsp_recv() can be called even when the BCSP protocol has not\nbeen registered. This leads to a NULL pointer dereference, as shown in\nthe following stack trace:\n\n    KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f]\n    RIP: 0010:bcsp_recv+0x13d/0x1740 drivers/bluetooth/hci_bcsp.c:590\n    Call Trace:\n     \u0026lt;TASK\u0026gt;\n     hci_uart_tty_receive+0x194/0x220 drivers/bluetooth/hci_ldisc.c:627\n     tiocsti+0x23c/0x2c0 drivers/tty/tty_io.c:2290\n     tty_ioctl+0x626/0xde0 drivers/tty/tty_io.c:2706\n     vfs_ioctl fs/ioctl.c:51 [inline]\n     __do_sys_ioctl fs/ioctl.c:907 [inline]\n     __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893\n     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n     do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94\n     entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nTo prevent this, ensure that the HCI_UART_REGISTERED flag is set before\nprocessing received data. If the protocol is not registered, return\n-EUNATCH.(CVE-2025-40308)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once\n\nhci_cmd_sync_dequeue_once() does lookup and then cancel\nthe entry under two separate lock sections. Meanwhile,\nhci_cmd_sync_work() can also delete the same entry,\nleading to double list_del() and \u0026quot;UAF\u0026quot;.\n\nFix this by holding cmd_sync_work_lock across both\nlookup and cancel, so that the entry cannot be removed\nconcurrently.(CVE-2025-40318)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Don\u0026apos;t leak robust_list pointer on exec race\n\nsys_get_robust_list() and compat_get_robust_list() use ptrace_may_access()\nto check if the calling task is allowed to access another task\u0026apos;s\nrobust_list pointer. This check is racy against a concurrent exec() in the\ntarget process.\n\nDuring exec(), a task may transition from a non-privileged binary to a\nprivileged one (e.g., setuid binary) and its credentials/memory mappings\nmay change. If get_robust_list() performs ptrace_may_access() before\nthis transition, it may erroneously allow access to sensitive information\nafter the target becomes privileged.\n\nA racy access allows an attacker to exploit a window during which\nptrace_may_access() passes before a target process transitions to a\nprivileged state via exec().\n\nFor example, consider a non-privileged task T that is about to execute a\nsetuid-root binary. An attacker task A calls get_robust_list(T) while T\nis still unprivileged. Since ptrace_may_access() checks permissions\nbased on current credentials, it succeeds. However, if T begins exec\nimmediately afterwards, it becomes privileged and may change its memory\nmappings. Because get_robust_list() proceeds to access T-\u0026gt;robust_list\nwithout synchronizing with exec() it may read user-space pointers from a\nnow-privileged process.\n\nThis violates the intended post-exec access restrictions and could\nexpose sensitive memory addresses or be used as a primitive in a larger\nexploit chain. Consequently, the race can lead to unauthorized\ndisclosure of information across privilege boundaries and poses a\npotential security risk.\n\nTake a read lock on signal-\u0026gt;exec_update_lock prior to invoking\nptrace_may_access() and accessing the robust_list/compat_robust_list.\nThis ensures that the target task\u0026apos;s exec state remains stable during the\ncheck, allowing for consistent and synchronized validation of\ncredentials.(CVE-2025-40341)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvme-fc: use lock accessing port_state and rport state\n\nnvme_fc_unregister_remote removes the remote port on a lport object at\nany point in time when there is no active association. This races with\nwith the reconnect logic, because nvme_fc_create_association is not\ntaking a lock to check the port_state and atomically increase the\nactive count on the rport.(CVE-2025-40342)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-fc: avoid scheduling association deletion twice\n\nWhen forcefully shutting down a port via the configfs interface,\nnvmet_port_subsys_drop_link() first calls nvmet_port_del_ctrls() and\nthen nvmet_disable_port(). Both functions will eventually schedule all\nremaining associations for deletion.\n\nThe current implementation checks whether an association is about to be\nremoved, but only after the work item has already been scheduled. As a\nresult, it is possible for the first scheduled work item to free all\nresources, and then for the same work item to be scheduled again for\ndeletion.\n\nBecause the association list is an RCU list, it is not possible to take\na lock and remove the list entry directly, so it cannot be looked up\nagain. Instead, a flag (terminating) must be used to determine whether\nthe association is already in the process of being deleted.(CVE-2025-40343)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\narch_topology: Fix incorrect error check in topology_parse_cpu_capacity()\n\nFix incorrect use of PTR_ERR_OR_ZERO() in topology_parse_cpu_capacity()\nwhich causes the code to proceed with NULL clock pointers. The current\nlogic uses !PTR_ERR_OR_ZERO(cpu_clk) which evaluates to true for both\nvalid pointers and NULL, leading to potential NULL pointer dereference\nin clk_get_rate().\n\nPer include/linux/err.h documentation, PTR_ERR_OR_ZERO(ptr) returns:\n\u0026quot;The error code within @ptr if it is an error pointer; 0 otherwise.\u0026quot;\n\nThis means PTR_ERR_OR_ZERO() returns 0 for both valid pointers AND NULL\npointers. Therefore !PTR_ERR_OR_ZERO(cpu_clk) evaluates to true (proceed)\nwhen cpu_clk is either valid or NULL, causing clk_get_rate(NULL) to be\ncalled when of_clk_get() returns NULL.\n\nReplace with !IS_ERR_OR_NULL(cpu_clk) which only proceeds for valid\npointers, preventing potential NULL pointer dereference in clk_get_rate().(CVE-2025-40346)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nhfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat()\n\nThe syzbot reported issue in hfsplus_delete_cat():\n\n[   70.682285][ T9333] =====================================================\n[   70.682943][ T9333] BUG: KMSAN: uninit-value in hfsplus_subfolders_dec+0x1d7/0x220\n[   70.683640][ T9333]  hfsplus_subfolders_dec+0x1d7/0x220\n[   70.684141][ T9333]  hfsplus_delete_cat+0x105d/0x12b0\n[   70.684621][ T9333]  hfsplus_rmdir+0x13d/0x310\n[   70.685048][ T9333]  vfs_rmdir+0x5ba/0x810\n[   70.685447][ T9333]  do_rmdir+0x964/0xea0\n[   70.685833][ T9333]  __x64_sys_rmdir+0x71/0xb0\n[   70.686260][ T9333]  x64_sys_call+0xcd8/0x3cf0\n[   70.686695][ T9333]  do_syscall_64+0xd9/0x1d0\n[   70.687119][ T9333]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[   70.687646][ T9333]\n[   70.687856][ T9333] Uninit was stored to memory at:\n[   70.688311][ T9333]  hfsplus_subfolders_inc+0x1c2/0x1d0\n[   70.688779][ T9333]  hfsplus_create_cat+0x148e/0x1800\n[   70.689231][ T9333]  hfsplus_mknod+0x27f/0x600\n[   70.689730][ T9333]  hfsplus_mkdir+0x5a/0x70\n[   70.690146][ T9333]  vfs_mkdir+0x483/0x7a0\n[   70.690545][ T9333]  do_mkdirat+0x3f2/0xd30\n[   70.690944][ T9333]  __x64_sys_mkdir+0x9a/0xf0\n[   70.691380][ T9333]  x64_sys_call+0x2f89/0x3cf0\n[   70.691816][ T9333]  do_syscall_64+0xd9/0x1d0\n[   70.692229][ T9333]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[   70.692773][ T9333]\n[   70.692990][ T9333] Uninit was stored to memory at:\n[   70.693469][ T9333]  hfsplus_subfolders_inc+0x1c2/0x1d0\n[   70.693960][ T9333]  hfsplus_create_cat+0x148e/0x1800\n[   70.694438][ T9333]  hfsplus_fill_super+0x21c1/0x2700\n[   70.694911][ T9333]  mount_bdev+0x37b/0x530\n[   70.695320][ T9333]  hfsplus_mount+0x4d/0x60\n[   70.695729][ T9333]  legacy_get_tree+0x113/0x2c0\n[   70.696167][ T9333]  vfs_get_tree+0xb3/0x5c0\n[   70.696588][ T9333]  do_new_mount+0x73e/0x1630\n[   70.697013][ T9333]  path_mount+0x6e3/0x1eb0\n[   70.697425][ T9333]  __se_sys_mount+0x733/0x830\n[   70.697857][ T9333]  __x64_sys_mount+0xe4/0x150\n[   70.698269][ T9333]  x64_sys_call+0x2691/0x3cf0\n[   70.698704][ T9333]  do_syscall_64+0xd9/0x1d0\n[   70.699117][ T9333]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[   70.699730][ T9333]\n[   70.699946][ T9333] Uninit was created at:\n[   70.700378][ T9333]  __alloc_pages_noprof+0x714/0xe60\n[   70.700843][ T9333]  alloc_pages_mpol_noprof+0x2a2/0x9b0\n[   70.701331][ T9333]  alloc_pages_noprof+0xf8/0x1f0\n[   70.701774][ T9333]  allocate_slab+0x30e/0x1390\n[   70.702194][ T9333]  ___slab_alloc+0x1049/0x33a0\n[   70.702635][ T9333]  kmem_cache_alloc_lru_noprof+0x5ce/0xb20\n[   70.703153][ T9333]  hfsplus_alloc_inode+0x5a/0xd0\n[   70.703598][ T9333]  alloc_inode+0x82/0x490\n[   70.703984][ T9333]  iget_locked+0x22e/0x1320\n[   70.704428][ T9333]  hfsplus_iget+0x5c/0xba0\n[   70.704827][ T9333]  hfsplus_btree_open+0x135/0x1dd0\n[   70.705291][ T9333]  hfsplus_fill_super+0x1132/0x2700\n[   70.705776][ T9333]  mount_bdev+0x37b/0x530\n[   70.706171][ T9333]  hfsplus_mount+0x4d/0x60\n[   70.706579][ T9333]  legacy_get_tree+0x113/0x2c0\n[   70.707019][ T9333]  vfs_get_tree+0xb3/0x5c0\n[   70.707444][ T9333]  do_new_mount+0x73e/0x1630\n[   70.707865][ T9333]  path_mount+0x6e3/0x1eb0\n[   70.708270][ T9333]  __se_sys_mount+0x733/0x830\n[   70.708711][ T9333]  __x64_sys_mount+0xe4/0x150\n[   70.709158][ T9333]  x64_sys_call+0x2691/0x3cf0\n[   70.709630][ T9333]  do_syscall_64+0xd9/0x1d0\n[   70.710053][ T9333]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[   70.710611][ T9333]\n[   70.710842][ T9333] CPU: 3 UID: 0 PID: 9333 Comm: repro Not tainted 6.12.0-rc6-dirty #17\n[   70.711568][ T9333] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[   70.712490][ T9333] =====================================================\n[   70.713085][ T9333] Disabling lock debugging due to kernel taint\n[   70.713618][ T9333] Kernel panic - not syncing: kmsan.panic set ...\n[   70.714159][ T9333] \n---truncated---(CVE-2025-40351)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nriscv: stacktrace: Disable KASAN checks for non-current tasks\n\nUnwinding the stack of a task other than current, KASAN would report\n\u0026quot;BUG: KASAN: out-of-bounds in walk_stackframe+0x41c/0x460\u0026quot;\n\nThere is a same issue on x86 and has been resolved by the commit\n84936118bdf3 (\u0026quot;x86/unwind: Disable KASAN checks for non-current tasks\u0026quot;)\nThe solution could be applied to RISC-V too.\n\nThis patch also can solve the issue:\nhttps://seclists.org/oss-sec/2025/q4/23\n\n[(CVE-2025-40358)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/intel: Fix KASAN global-out-of-bounds warning\n\nWhen running \u0026quot;perf mem record\u0026quot; command on CWF, the below KASAN\nglobal-out-of-bounds warning is seen.\n\n  ==================================================================\n  BUG: KASAN: global-out-of-bounds in cmt_latency_data+0x176/0x1b0\n  Read of size 4 at addr ffffffffb721d000 by task dtlb/9850\n\n  Call Trace:\n\n   kasan_report+0xb8/0xf0\n   cmt_latency_data+0x176/0x1b0\n   setup_arch_pebs_sample_data+0xf49/0x2560\n   intel_pmu_drain_arch_pebs+0x577/0xb00\n   handle_pmi_common+0x6c4/0xc80\n\nThe issue is caused by below code in __grt_latency_data(). The code\ntries to access x86_hybrid_pmu structure which doesn\u0026apos;t exist on\nnon-hybrid platform like CWF.\n\n        WARN_ON_ONCE(hybrid_pmu(event-\u0026gt;pmu)-\u0026gt;pmu_type == hybrid_big)\n\nSo add is_hybrid() check before calling this WARN_ON_ONCE to fix the\nglobal-out-of-bounds access issue.(CVE-2025-40359)\n\nRejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.(CVE-2025-40361)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nx86/fpu: Ensure XFD state on signal delivery\n\nSean reported [1] the following splat when running KVM tests:\n\n   WARNING: CPU: 232 PID: 15391 at xfd_validate_state+0x65/0x70\n   Call Trace:\n    \u0026lt;TASK\u0026gt;\n    fpu__clear_user_states+0x9c/0x100\n    arch_do_signal_or_restart+0x142/0x210\n    exit_to_user_mode_loop+0x55/0x100\n    do_syscall_64+0x205/0x2c0\n    entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\nChao further identified [2] a reproducible scenario involving signal\ndelivery: a non-AMX task is preempted by an AMX-enabled task which\nmodifies the XFD MSR.\n\nWhen the non-AMX task resumes and reloads XSTATE with init values,\na warning is triggered due to a mismatch between fpstate::xfd and the\nCPU\u0026apos;s current XFD state. fpu__clear_user_states() does not currently\nre-synchronize the XFD state after such preemption.\n\nInvoke xfd_update_state() which detects and corrects the mismatch if\nthere is a dynamic feature.\n\nThis also benefits the sigreturn path, as fpu__restore_sig() may call\nfpu__clear_user_states() when the sigframe is inaccessible.\n\n[ dhansen: minor changelog munging ](CVE-2025-68171)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Fix softlockup in ftrace_module_enable\n\nA soft lockup was observed when loading amdgpu module.\nIf a module has a lot of tracable functions, multiple calls\nto kallsyms_lookup can spend too much time in RCU critical\nsection and with disabled preemption, causing kernel panic.\nThis is the same issue that was fixed in\ncommit d0b24b4e91fc (\u0026quot;ftrace: Prevent RCU stall on PREEMPT_VOLUNTARY\nkernels\u0026quot;) and commit 42ea22e754ba (\u0026quot;ftrace: Add cond_resched() to\nftrace_graph_set_hash()\u0026quot;).\n\nFix it the same way by adding cond_resched() in ftrace_module_enable.(CVE-2025-68173)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\namd/amdkfd: enhance kfd process check in switch partition\n\ncurrent switch partition only check if kfd_processes_table is empty.\nkfd_prcesses_table entry is deleted in kfd_process_notifier_release, but\nkfd_process tear down is in kfd_process_wq_release.\n\nconsider two processes:\n\nProcess A (workqueue) -\u0026gt; kfd_process_wq_release -\u0026gt; Access kfd_node member\nProcess B switch partition -\u0026gt; amdgpu_xcp_pre_partition_switch -\u0026gt; amdgpu_amdkfd_device_fini_sw\n-\u0026gt; kfd_node tear down.\n\nProcess A and B may trigger a race as shown in dmesg log.\n\nThis patch is to resolve the race by adding an atomic kfd_process counter\nkfd_processes_count, it increment as create kfd process, decrement as\nfinish kfd_process_wq_release.\n\nv2: Put kfd_processes_count per kfd_dev, move decrement to kfd_process_destroy_pdds\nand bug fix. (Philip Yang)\n\n[3966658.307702] divide error: 0000 [#1] SMP NOPTI\n[3966658.350818]  i10nm_edac\n[3966658.356318] CPU: 124 PID: 38435 Comm: kworker/124:0 Kdump: loaded Tainted\n[3966658.356890] Workqueue: kfd_process_wq kfd_process_wq_release [amdgpu]\n[3966658.362839]  nfit\n[3966658.366457] RIP: 0010:kfd_get_num_sdma_engines+0x17/0x40 [amdgpu]\n[3966658.366460] Code: 00 00 e9 ac 81 02 00 66 66 2e 0f 1f 84 00 00 00 00 00 90 0f 1f 44 00 00 48 8b 4f 08 48 8b b7 00 01 00 00 8b 81 58 26 03 00 99 \u0026lt;f7\u0026gt; be b8 01 00 00 80 b9 70 2e 00 00 00 74 0b 83 f8 02 ba 02 00 00\n[3966658.380967]  x86_pkg_temp_thermal\n[3966658.391529] RSP: 0018:ffffc900a0edfdd8 EFLAGS: 00010246\n[3966658.391531] RAX: 0000000000000008 RBX: ffff8974e593b800 RCX: ffff888645900000\n[3966658.391531] RDX: 0000000000000000 RSI: ffff888129154400 RDI: ffff888129151c00\n[3966658.391532] RBP: ffff8883ad79d400 R08: 0000000000000000 R09: ffff8890d2750af4\n[3966658.391532] R10: 0000000000000018 R11: 0000000000000018 R12: 0000000000000000\n[3966658.391533] R13: ffff8883ad79d400 R14: ffffe87ff662ba00 R15: ffff8974e593b800\n[3966658.391533] FS:  0000000000000000(0000) GS:ffff88fe7f600000(0000) knlGS:0000000000000000\n[3966658.391534] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[3966658.391534] CR2: 0000000000d71000 CR3: 000000dd0e970004 CR4: 0000000002770ee0\n[3966658.391535] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[3966658.391535] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400\n[3966658.391536] PKRU: 55555554\n[3966658.391536] Call Trace:\n[3966658.391674]  deallocate_sdma_queue+0x38/0xa0 [amdgpu]\n[3966658.391762]  process_termination_cpsch+0x1ed/0x480 [amdgpu]\n[3966658.399754]  intel_powerclamp\n[3966658.402831]  kfd_process_dequeue_from_all_devices+0x5b/0xc0 [amdgpu]\n[3966658.402908]  kfd_process_wq_release+0x1a/0x1a0 [amdgpu]\n[3966658.410516]  coretemp\n[3966658.434016]  process_one_work+0x1ad/0x380\n[3966658.434021]  worker_thread+0x49/0x310\n[3966658.438963]  kvm_intel\n[3966658.446041]  ? process_one_work+0x380/0x380\n[3966658.446045]  kthread+0x118/0x140\n[3966658.446047]  ? __kthread_bind_mask+0x60/0x60\n[3966658.446050]  ret_from_fork+0x1f/0x30\n[3966658.446053] Modules linked in: kpatch_20765354(OEK)\n[3966658.455310]  kvm\n[3966658.464534]  mptcp_diag xsk_diag raw_diag unix_diag af_packet_diag netlink_diag udp_diag act_pedit act_mirred act_vlan cls_flower kpatch_21951273(OEK) kpatch_18424469(OEK) kpatch_19749756(OEK)\n[3966658.473462]  idxd_mdev\n[3966658.482306]  kpatch_17971294(OEK) sch_ingress xt_conntrack amdgpu(OE) amdxcp(OE) amddrm_buddy(OE) amd_sched(OE) amdttm(OE) amdkcl(OE) intel_ifs iptable_mangle tcm_loop target_core_pscsi tcp_diag target_core_file inet_diag target_core_iblock target_core_user target_core_mod coldpgs kpatch_18383292(OEK) ip6table_nat ip6table_filter ip6_tables ip_set_hash_ipportip ip_set_hash_ipportnet ip_set_hash_ipport ip_set_bitmap_port xt_comment iptable_nat nf_nat iptable_filter ip_tables ip_set ip_vs_sh ip_vs_wrr ip_vs_rr ip_vs nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 sn_core_odd(OE) i40e overlay binfmt_misc tun bonding(OE) aisqos(OE) aisqo\n---truncated---(CVE-2025-68174)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nPCI: cadence: Check for the existence of cdns_pcie::ops before using it\n\ncdns_pcie::ops might not be populated by all the Cadence glue drivers. This\nis going to be true for the upcoming Sophgo platform which doesn\u0026apos;t set the\nops.\n\nHence, add a check to prevent NULL pointer dereference.\n\n[mani: reworded subject and description](CVE-2025-68176)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check()\n\nUse RCU to avoid a pair of atomic operations and a potential\nUAF on dst_dev()-\u0026gt;flags.(CVE-2025-68188)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Add bpf_prog_run_data_pointers()\n\nsyzbot found that cls_bpf_classify() is able to change\ntc_skb_cb(skb)-\u0026gt;drop_reason triggering a warning in sk_skb_reason_drop().\n\nWARNING: CPU: 0 PID: 5965 at net/core/skbuff.c:1192 __sk_skb_reason_drop net/core/skbuff.c:1189 [inline]\nWARNING: CPU: 0 PID: 5965 at net/core/skbuff.c:1192 sk_skb_reason_drop+0x76/0x170 net/core/skbuff.c:1214\n\nstruct tc_skb_cb has been added in commit ec624fe740b4 (\u0026quot;net/sched:\nExtend qdisc control block with tc control block\u0026quot;), which added a wrong\ninteraction with db58ba459202 (\u0026quot;bpf: wire in data and data_end for\ncls_act_bpf\u0026quot;).\n\ndrop_reason was added later.\n\nAdd bpf_prog_run_data_pointers() helper to save/restore the net_sched\nstorage colliding with BPF data_meta/data_end.(CVE-2025-68200)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_ct: add seqadj extension for natted connections\n\nSequence adjustment may be required for FTP traffic with PASV/EPSV modes.\ndue to need to re-write packet payload (IP, port) on the ftp control\nconnection. This can require changes to the TCP length and expected\nseq / ack_seq.\n\nThe easiest way to reproduce this issue is with PASV mode.\nExample ruleset:\ntable inet ftp_nat {\n        ct helper ftp_helper {\n                type \u0026quot;ftp\u0026quot; protocol tcp\n                l3proto inet\n        }\n\n        chain prerouting {\n                type filter hook prerouting priority 0; policy accept;\n                tcp dport 21 ct state new ct helper set \u0026quot;ftp_helper\u0026quot;\n        }\n}\ntable ip nat {\n        chain prerouting {\n                type nat hook prerouting priority -100; policy accept;\n                tcp dport 21 dnat ip prefix to ip daddr map {\n\t\t\t192.168.100.1 : 192.168.13.2/32 }\n        }\n\n        chain postrouting {\n                type nat hook postrouting priority 100 ; policy accept;\n                tcp sport 21 snat ip prefix to ip saddr map {\n\t\t\t192.168.13.2 : 192.168.100.1/32 }\n        }\n}\n\nNote that the ftp helper gets assigned *after* the dnat setup.\n\nThe inverse (nat after helper assign) is handled by an existing\ncheck in nf_nat_setup_info() and will not show the problem.\n\nTopoloy:\n\n +-------------------+     +----------------------------------+\n | FTP: 192.168.13.2 | \u0026lt;-\u0026gt; | NAT: 192.168.13.3, 192.168.100.1 |\n +-------------------+     +----------------------------------+\n                                      |\n                         +-----------------------+\n                         | Client: 192.168.100.2 |\n                         +-----------------------+\n\nftp nat changes do not work as expected in this case:\nConnected to 192.168.100.1.\n[..]\nftp\u0026gt; epsv\nEPSV/EPRT on IPv4 off.\nftp\u0026gt; ls\n227 Entering passive mode (192,168,100,1,209,129).\n421 Service not available, remote server has closed connection.\n\nKernel logs:\nMissing nfct_seqadj_ext_add() setup call\nWARNING: CPU: 1 PID: 0 at net/netfilter/nf_conntrack_seqadj.c:41\n[..]\n __nf_nat_mangle_tcp_packet+0x100/0x160 [nf_nat]\n nf_nat_ftp+0x142/0x280 [nf_nat_ftp]\n help+0x4d1/0x880 [nf_conntrack_ftp]\n nf_confirm+0x122/0x2e0 [nf_conntrack]\n nf_hook_slow+0x3c/0xb0\n ..\n\nFix this by adding the required extension when a conntrack helper is assigned\nto a connection that has a nat binding.(CVE-2025-68206)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: account for current allocated stack depth in widen_imprecise_scalars()\n\nThe usage pattern for widen_imprecise_scalars() looks as follows:\n\n    prev_st = find_prev_entry(env, ...);\n    queued_st = push_stack(...);\n    widen_imprecise_scalars(env, prev_st, queued_st);\n\nWhere prev_st is an ancestor of the queued_st in the explored states\ntree. This ancestor is not guaranteed to have same allocated stack\ndepth as queued_st. E.g. in the following case:\n\n    def main():\n      for i in 1..2:\n        foo(i)        // same callsite, differnt param\n\n    def foo(i):\n      if i == 1:\n        use 128 bytes of stack\n      iterator based loop\n\nHere, for a second \u0026apos;foo\u0026apos; call prev_st-\u0026gt;allocated_stack is 128,\nwhile queued_st-\u0026gt;allocated_stack is much smaller.\nwiden_imprecise_scalars() needs to take this into account and avoid\naccessing bpf_verifier_state-\u0026gt;frame[*]-\u0026gt;stack out of bounds.(CVE-2025-68208)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntimers: Fix NULL function pointer race in timer_shutdown_sync()\n\nThere is a race condition between timer_shutdown_sync() and timer\nexpiration that can lead to hitting a WARN_ON in expire_timers().\n\nThe issue occurs when timer_shutdown_sync() clears the timer function\nto NULL while the timer is still running on another CPU. The race\nscenario looks like this:\n\nCPU0\t\t\t\t\tCPU1\n\t\t\t\t\t\u0026lt;SOFTIRQ\u0026gt;\n\t\t\t\t\tlock_timer_base()\n\t\t\t\t\texpire_timers()\n\t\t\t\t\tbase-\u0026gt;running_timer = timer;\n\t\t\t\t\tunlock_timer_base()\n\t\t\t\t\t[call_timer_fn enter]\n\t\t\t\t\tmod_timer()\n\t\t\t\t\t...\ntimer_shutdown_sync()\nlock_timer_base()\n// For now, will not detach the timer but only clear its function to NULL\nif (base-\u0026gt;running_timer != timer)\n\tret = detach_if_pending(timer, base, true);\nif (shutdown)\n\ttimer-\u0026gt;function = NULL;\nunlock_timer_base()\n\t\t\t\t\t[call_timer_fn exit]\n\t\t\t\t\tlock_timer_base()\n\t\t\t\t\tbase-\u0026gt;running_timer = NULL;\n\t\t\t\t\tunlock_timer_base()\n\t\t\t\t\t...\n\t\t\t\t\t// Now timer is pending while its function set to NULL.\n\t\t\t\t\t// next timer trigger\n\t\t\t\t\t\u0026lt;SOFTIRQ\u0026gt;\n\t\t\t\t\texpire_timers()\n\t\t\t\t\tWARN_ON_ONCE(!fn) // hit\n\t\t\t\t\t...\nlock_timer_base()\n// Now timer will detach\nif (base-\u0026gt;running_timer != timer)\n\tret = detach_if_pending(timer, base, true);\nif (shutdown)\n\ttimer-\u0026gt;function = NULL;\nunlock_timer_base()\n\nThe problem is that timer_shutdown_sync() clears the timer function\nregardless of whether the timer is currently running. This can leave a\npending timer with a NULL function pointer, which triggers the\nWARN_ON_ONCE(!fn) check in expire_timers().\n\nFix this by only clearing the timer function when actually detaching the\ntimer. If the timer is running, leave the function pointer intact, which is\nsafe because the timer will be properly detached when it finishes running.(CVE-2025-68214)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot\n\nnvkm_falcon_fw::boot is allocated, but no one frees it. This causes a\nkmemleak warning.\n\nMake sure this data is deallocated.(CVE-2025-68235)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Don\u0026apos;t skip unrelated instruction if INT3/INTO is replaced\n\nWhen re-injecting a soft interrupt from an INT3, INT0, or (select) INTn\ninstruction, discard the exception and retry the instruction if the code\nstream is changed (e.g. by a different vCPU) between when the CPU\nexecutes the instruction and when KVM decodes the instruction to get the\nnext RIP.\n\nAs effectively predicted by commit 6ef88d6e36c2 (\u0026quot;KVM: SVM: Re-inject\nINT3/INTO instead of retrying the instruction\u0026quot;), failure to verify that\nthe correct INTn instruction was decoded can effectively clobber guest\nstate due to decoding the wrong instruction and thus specifying the\nwrong next RIP.\n\nThe bug most often manifests as \u0026quot;Oops: int3\u0026quot; panics on static branch\nchecks in Linux guests.  Enabling or disabling a static branch in Linux\nuses the kernel\u0026apos;s \u0026quot;text poke\u0026quot; code patching mechanism.  To modify code\nwhile other CPUs may be executing that code, Linux (temporarily)\nreplaces the first byte of the original instruction with an int3 (opcode\n0xcc), then patches in the new code stream except for the first byte,\nand finally replaces the int3 with the first byte of the new code\nstream.  If a CPU hits the int3, i.e. executes the code while it\u0026apos;s being\nmodified, then the guest kernel must look up the RIP to determine how to\nhandle the #BP, e.g. by emulating the new instruction.  If the RIP is\nincorrect, then this lookup fails and the guest kernel panics.\n\nThe bug reproduces almost instantly by hacking the guest kernel to\nrepeatedly check a static branch[1] while running a drgn script[2] on\nthe host to constantly swap out the memory containing the guest\u0026apos;s TSS.\n\n[1]: https://gist.github.com/osandov/44d17c51c28c0ac998ea0334edf90b5a\n[2]: https://gist.github.com/osandov/10e45e45afa29b11e0c7209247afc00b(CVE-2025-68259)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\next4: add i_data_sem protection in ext4_destroy_inline_data_nolock()\n\nFix a race between inline data destruction and block mapping.\n\nThe function ext4_destroy_inline_data_nolock() changes the inode data\nlayout by clearing EXT4_INODE_INLINE_DATA and setting EXT4_INODE_EXTENTS.\nAt the same time, another thread may execute ext4_map_blocks(), which\ntests EXT4_INODE_EXTENTS to decide whether to call ext4_ext_map_blocks()\nor ext4_ind_map_blocks().\n\nWithout i_data_sem protection, ext4_ind_map_blocks() may receive inode\nwith EXT4_INODE_EXTENTS flag and triggering assert.\n\nkernel BUG at fs/ext4/indirect.c:546!\nEXT4-fs (loop2): unmounting filesystem.\ninvalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014\nRIP: 0010:ext4_ind_map_blocks.cold+0x2b/0x5a fs/ext4/indirect.c:546\n\nCall Trace:\n \u0026lt;TASK\u0026gt;\n ext4_map_blocks+0xb9b/0x16f0 fs/ext4/inode.c:681\n _ext4_get_block+0x242/0x590 fs/ext4/inode.c:822\n ext4_block_write_begin+0x48b/0x12c0 fs/ext4/inode.c:1124\n ext4_write_begin+0x598/0xef0 fs/ext4/inode.c:1255\n ext4_da_write_begin+0x21e/0x9c0 fs/ext4/inode.c:3000\n generic_perform_write+0x259/0x5d0 mm/filemap.c:3846\n ext4_buffered_write_iter+0x15b/0x470 fs/ext4/file.c:285\n ext4_file_write_iter+0x8e0/0x17f0 fs/ext4/file.c:679\n call_write_iter include/linux/fs.h:2271 [inline]\n do_iter_readv_writev+0x212/0x3c0 fs/read_write.c:735\n do_iter_write+0x186/0x710 fs/read_write.c:861\n vfs_iter_write+0x70/0xa0 fs/read_write.c:902\n iter_file_splice_write+0x73b/0xc90 fs/splice.c:685\n do_splice_from fs/splice.c:763 [inline]\n direct_splice_actor+0x10f/0x170 fs/splice.c:950\n splice_direct_to_actor+0x33a/0xa10 fs/splice.c:896\n do_splice_direct+0x1a9/0x280 fs/splice.c:1002\n do_sendfile+0xb13/0x12c0 fs/read_write.c:1255\n __do_sys_sendfile64 fs/read_write.c:1323 [inline]\n __se_sys_sendfile64 fs/read_write.c:1309 [inline]\n __x64_sys_sendfile64+0x1cf/0x210 fs/read_write.c:1309\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81\n entry_SYSCALL_64_after_hwframe+0x6e/0xd8(CVE-2025-68261)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\next4: refresh inline data size before write operations\n\nThe cached ei-\u0026gt;i_inline_size can become stale between the initial size\ncheck and when ext4_update_inline_data()/ext4_create_inline_data() use\nit. Although ext4_get_max_inline_size() reads the correct value at the\ntime of the check, concurrent xattr operations can modify i_inline_size\nbefore ext4_write_lock_xattr() is acquired.\n\nThis causes ext4_update_inline_data() and ext4_create_inline_data() to\nwork with stale capacity values, leading to a BUG_ON() crash in\next4_write_inline_data():\n\n  kernel BUG at fs/ext4/inline.c:1331!\n  BUG_ON(pos + len \u0026gt; EXT4_I(inode)-\u0026gt;i_inline_size);\n\nThe race window:\n1. ext4_get_max_inline_size() reads i_inline_size = 60 (correct)\n2. Size check passes for 50-byte write\n3. [Another thread adds xattr, i_inline_size changes to 40]\n4. ext4_write_lock_xattr() acquires lock\n5. ext4_update_inline_data() uses stale i_inline_size = 60\n6. Attempts to write 50 bytes but only 40 bytes actually available\n7. BUG_ON() triggers\n\nFix this by recalculating i_inline_size via ext4_find_inline_data_nolock()\nimmediately after acquiring xattr_sem. This ensures ext4_update_inline_data()\nand ext4_create_inline_data() work with current values that are protected\nfrom concurrent modifications.\n\nThis is similar to commit a54c4613dac1 (\u0026quot;ext4: fix race writing to an\ninline_data file while its xattrs are changing\u0026quot;) which fixed i_inline_off\nstaleness. This patch addresses the related i_inline_size staleness issue.(CVE-2025-68264)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvme: fix admin request_queue lifetime\n\nThe namespaces can access the controller\u0026apos;s admin request_queue, and\nstale references on the namespaces may exist after tearing down the\ncontroller. Ensure the admin request_queue is active by moving the\ncontroller\u0026apos;s \u0026apos;put\u0026apos; to after all controller references have been released\nto ensure no one is can access the request_queue. This fixes a reported\nuse-after-free bug:\n\n  BUG: KASAN: slab-use-after-free in blk_queue_enter+0x41c/0x4a0\n  Read of size 8 at addr ffff88c0a53819f8 by task nvme/3287\n  CPU: 67 UID: 0 PID: 3287 Comm: nvme Tainted: G            E       6.13.2-ga1582f1a031e #15\n  Tainted: [E]=UNSIGNED_MODULE\n  Hardware name: Jabil /EGS 2S MB1, BIOS 1.00 06/18/2025\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   dump_stack_lvl+0x4f/0x60\n   print_report+0xc4/0x620\n   ? _raw_spin_lock_irqsave+0x70/0xb0\n   ? _raw_read_unlock_irqrestore+0x30/0x30\n   ? blk_queue_enter+0x41c/0x4a0\n   kasan_report+0xab/0xe0\n   ? blk_queue_enter+0x41c/0x4a0\n   blk_queue_enter+0x41c/0x4a0\n   ? __irq_work_queue_local+0x75/0x1d0\n   ? blk_queue_start_drain+0x70/0x70\n   ? irq_work_queue+0x18/0x20\n   ? vprintk_emit.part.0+0x1cc/0x350\n   ? wake_up_klogd_work_func+0x60/0x60\n   blk_mq_alloc_request+0x2b7/0x6b0\n   ? __blk_mq_alloc_requests+0x1060/0x1060\n   ? __switch_to+0x5b7/0x1060\n   nvme_submit_user_cmd+0xa9/0x330\n   nvme_user_cmd.isra.0+0x240/0x3f0\n   ? force_sigsegv+0xe0/0xe0\n   ? nvme_user_cmd64+0x400/0x400\n   ? vfs_fileattr_set+0x9b0/0x9b0\n   ? cgroup_update_frozen_flag+0x24/0x1c0\n   ? cgroup_leave_frozen+0x204/0x330\n   ? nvme_ioctl+0x7c/0x2c0\n   blkdev_ioctl+0x1a8/0x4d0\n   ? blkdev_common_ioctl+0x1930/0x1930\n   ? fdget+0x54/0x380\n   __x64_sys_ioctl+0x129/0x190\n   do_syscall_64+0x5b/0x160\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n  RIP: 0033:0x7f765f703b0b\n  Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 8b 0d dd 52 0f 00 f7 d8 64 89 01 48\n  RSP: 002b:00007ffe2cefe808 EFLAGS: 00000202 ORIG_RAX: 0000000000000010\n  RAX: ffffffffffffffda RBX: 00007ffe2cefe860 RCX: 00007f765f703b0b\n  RDX: 00007ffe2cefe860 RSI: 00000000c0484e41 RDI: 0000000000000003\n  RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000000\n  R10: 00007f765f611d50 R11: 0000000000000202 R12: 0000000000000003\n  R13: 00000000c0484e41 R14: 0000000000000001 R15: 00007ffe2cefea60\n   \u0026lt;/TASK\u0026gt;(CVE-2025-68265)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix crash in process_v2_sparse_read() for encrypted directories\n\nThe crash in process_v2_sparse_read() for fscrypt-encrypted directories\nhas been reported. Issue takes place for Ceph msgr2 protocol in secure\nmode. It can be reproduced by the steps:\n\nsudo mount -t ceph :/ /mnt/cephfs/ -o name=admin,fs=cephfs,ms_mode=secure\n\n(1) mkdir /mnt/cephfs/fscrypt-test-3\n(2) cp area_decrypted.tar /mnt/cephfs/fscrypt-test-3\n(3) fscrypt encrypt --source=raw_key --key=./my.key /mnt/cephfs/fscrypt-test-3\n(4) fscrypt lock /mnt/cephfs/fscrypt-test-3\n(5) fscrypt unlock --key=my.key /mnt/cephfs/fscrypt-test-3\n(6) cat /mnt/cephfs/fscrypt-test-3/area_decrypted.tar\n(7) Issue has been triggered\n\n[  408.072247] ------------[ cut here ]------------\n[  408.072251] WARNING: CPU: 1 PID: 392 at net/ceph/messenger_v2.c:865\nceph_con_v2_try_read+0x4b39/0x72f0\n[  408.072267] Modules linked in: intel_rapl_msr intel_rapl_common\nintel_uncore_frequency_common intel_pmc_core pmt_telemetry pmt_discovery\npmt_class intel_pmc_ssram_telemetry intel_vsec kvm_intel joydev kvm irqbypass\npolyval_clmulni ghash_clmulni_intel aesni_intel rapl input_leds psmouse\nserio_raw i2c_piix4 vga16fb bochs vgastate i2c_smbus floppy mac_hid qemu_fw_cfg\npata_acpi sch_fq_codel rbd msr parport_pc ppdev lp parport efi_pstore\n[  408.072304] CPU: 1 UID: 0 PID: 392 Comm: kworker/1:3 Not tainted 6.17.0-rc7+\n[  408.072307] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\n1.17.0-5.fc42 04/01/2014\n[  408.072310] Workqueue: ceph-msgr ceph_con_workfn\n[  408.072314] RIP: 0010:ceph_con_v2_try_read+0x4b39/0x72f0\n[  408.072317] Code: c7 c1 20 f0 d4 ae 50 31 d2 48 c7 c6 60 27 d5 ae 48 c7 c7 f8\n8e 6f b0 68 60 38 d5 ae e8 00 47 61 fe 48 83 c4 18 e9 ac fc ff ff \u0026lt;0f\u0026gt; 0b e9 06\nfe ff ff 4c 8b 9d 98 fd ff ff 0f 84 64 e7 ff ff 89 85\n[  408.072319] RSP: 0018:ffff88811c3e7a30 EFLAGS: 00010246\n[  408.072322] RAX: ffffed1024874c6f RBX: ffffea00042c2b40 RCX: 0000000000000f38\n[  408.072324] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\n[  408.072325] RBP: ffff88811c3e7ca8 R08: 0000000000000000 R09: 00000000000000c8\n[  408.072326] R10: 00000000000000c8 R11: 0000000000000000 R12: 00000000000000c8\n[  408.072327] R13: dffffc0000000000 R14: ffff8881243a6030 R15: 0000000000003000\n[  408.072329] FS:  0000000000000000(0000) GS:ffff88823eadf000(0000)\nknlGS:0000000000000000\n[  408.072331] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  408.072332] CR2: 000000c0003c6000 CR3: 000000010c106005 CR4: 0000000000772ef0\n[  408.072336] PKRU: 55555554\n[  408.072337] Call Trace:\n[  408.072338]  \u0026lt;TASK\u0026gt;\n[  408.072340]  ? sched_clock_noinstr+0x9/0x10\n[  408.072344]  ? __pfx_ceph_con_v2_try_read+0x10/0x10\n[  408.072347]  ? _raw_spin_unlock+0xe/0x40\n[  408.072349]  ? finish_task_switch.isra.0+0x15d/0x830\n[  408.072353]  ? __kasan_check_write+0x14/0x30\n[  408.072357]  ? mutex_lock+0x84/0xe0\n[  408.072359]  ? __pfx_mutex_lock+0x10/0x10\n[  408.072361]  ceph_con_workfn+0x27e/0x10e0\n[  408.072364]  ? metric_delayed_work+0x311/0x2c50\n[  408.072367]  process_one_work+0x611/0xe20\n[  408.072371]  ? __kasan_check_write+0x14/0x30\n[  408.072373]  worker_thread+0x7e3/0x1580\n[  408.072375]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n[  408.072378]  ? __pfx_worker_thread+0x10/0x10\n[  408.072381]  kthread+0x381/0x7a0\n[  408.072383]  ? __pfx__raw_spin_lock_irq+0x10/0x10\n[  408.072385]  ? __pfx_kthread+0x10/0x10\n[  408.072387]  ? __kasan_check_write+0x14/0x30\n[  408.072389]  ? recalc_sigpending+0x160/0x220\n[  408.072392]  ? _raw_spin_unlock_irq+0xe/0x50\n[  408.072394]  ? calculate_sigpending+0x78/0xb0\n[  408.072395]  ? __pfx_kthread+0x10/0x10\n[  408.072397]  ret_from_fork+0x2b6/0x380\n[  408.072400]  ? __pfx_kthread+0x10/0x10\n[  408.072402]  ret_from_fork_asm+0x1a/0x30\n[  408.072406]  \u0026lt;/TASK\u0026gt;\n[  408.072407] ---[ end trace 0000000000000000 ]---\n[  408.072418] Oops: general protection fault, probably for non-canonical\naddress 0xdffffc00000000\n---truncated---(CVE-2025-68297)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nPCI/AER: Fix NULL pointer access by aer_info\n\nThe kzalloc(GFP_KERNEL) may return NULL, so all accesses to aer_info-\u0026gt;xxx\nwill result in kernel panic. Fix it.(CVE-2025-68309)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer\n\nWhen a UAS device is unplugged during data transfer, there is\na probability of a system panic occurring. The root cause is\nan access to an invalid memory address during URB callback handling.\nSpecifically, this happens when the dma_direct_unmap_sg() function\nis called within the usb_hcd_unmap_urb_for_dma() interface, but the\nsg-\u0026gt;dma_address field is 0 and the sg data structure has already been\nfreed.\n\nThe SCSI driver sends transfer commands by invoking uas_queuecommand_lck()\nin uas.c, using the uas_submit_urbs() function to submit requests to USB.\nWithin the uas_submit_urbs() implementation, three URBs (sense_urb,\ndata_urb, and cmd_urb) are sequentially submitted. Device removal may\noccur at any point during uas_submit_urbs execution, which may result\nin URB submission failure. However, some URBs might have been successfully\nsubmitted before the failure, and uas_submit_urbs will return the -ENODEV\nerror code in this case. The current error handling directly calls\nscsi_done(). In the SCSI driver, this eventually triggers scsi_complete()\nto invoke scsi_end_request() for releasing the sgtable. The successfully\nsubmitted URBs, when being unlinked to giveback, call\nusb_hcd_unmap_urb_for_dma() in hcd.c, leading to exceptions during sg\nunmapping operations since the sg data structure has already been freed.\n\nThis patch modifies the error condition check in the uas_submit_urbs()\nfunction. When a UAS device is removed but one or more URBs have already\nbeen successfully submitted to USB, it avoids immediately invoking\nscsi_done() and save the cmnd to devinfo-\u0026gt;cmnd array. If the successfully\nsubmitted URBs is completed before devinfo-\u0026gt;resetting being set, then\nthe scsi_done() function will be called within uas_try_complete() after\nall pending URB operations are finalized. Otherwise, the scsi_done()\nfunction will be called within uas_zap_pending(), which is executed after\nusb_kill_anchored_urbs().\n\nThe error handling only takes effect when uas_queuecommand_lck() calls\nuas_submit_urbs() and returns the error value -ENODEV . In this case,\nthe device is disconnected, and the flow proceeds to uas_disconnect(),\nwhere uas_zap_pending() is invoked to call uas_try_complete().(CVE-2025-68331)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\njbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted\n\nThere\u0026apos;s issue when file system corrupted:\n------------[ cut here ]------------\nkernel BUG at fs/jbd2/transaction.c:1289!\nOops: invalid opcode: 0000 [#1] SMP KASAN PTI\nCPU: 5 UID: 0 PID: 2031 Comm: mkdir Not tainted 6.18.0-rc1-next\nRIP: 0010:jbd2_journal_get_create_access+0x3b6/0x4d0\nRSP: 0018:ffff888117aafa30 EFLAGS: 00010202\nRAX: 0000000000000000 RBX: ffff88811a86b000 RCX: ffffffff89a63534\nRDX: 1ffff110200ec602 RSI: 0000000000000004 RDI: ffff888100763010\nRBP: ffff888100763000 R08: 0000000000000001 R09: ffff888100763028\nR10: 0000000000000003 R11: 0000000000000000 R12: 0000000000000000\nR13: ffff88812c432000 R14: ffff88812c608000 R15: ffff888120bfc000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f91d6970c99 CR3: 00000001159c4000 CR4: 00000000000006f0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n __ext4_journal_get_create_access+0x42/0x170\n ext4_getblk+0x319/0x6f0\n ext4_bread+0x11/0x100\n ext4_append+0x1e6/0x4a0\n ext4_init_new_dir+0x145/0x1d0\n ext4_mkdir+0x326/0x920\n vfs_mkdir+0x45c/0x740\n do_mkdirat+0x234/0x2f0\n __x64_sys_mkdir+0xd6/0x120\n do_syscall_64+0x5f/0xfa0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nThe above issue occurs with us in errors=continue mode when accompanied by\nstorage failures. There have been many inconsistencies in the file system\ndata.\nIn the case of file system data inconsistency, for example, if the block\nbitmap of a referenced block is not set, it can lead to the situation where\na block being committed is allocated and used again. As a result, the\nfollowing condition will not be satisfied then trigger BUG_ON. Of course,\nit is entirely possible to construct a problematic image that can trigger\nthis BUG_ON through specific operations. In fact, I have constructed such\nan image and easily reproduced this issue.\nTherefore, J_ASSERT() holds true only under ideal conditions, but it may\nnot necessarily be satisfied in exceptional scenarios. Using J_ASSERT()\ndirectly in abnormal situations would cause the system to crash, which is\nclearly not what we want. So here we directly trigger a JBD abort instead\nof immediately invoking BUG_ON.(CVE-2025-68337)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid\n\nFixes a crash when layout is null during this call stack:\n\nwrite_inode\n    -\u0026gt; nfs4_write_inode\n        -\u0026gt; pnfs_layoutcommit_inode\n\npnfs_set_layoutcommit relies on the lseg refcount to keep the layout\naround. Need to clear NFS_INO_LAYOUTCOMMIT otherwise we might attempt\nto reference a null layout.(CVE-2025-68349)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nregulator: core: Protect regulator_supply_alias_list with regulator_list_mutex\n\nregulator_supply_alias_list was accessed without any locking in\nregulator_supply_alias(), regulator_register_supply_alias(), and\nregulator_unregister_supply_alias(). Concurrent registration,\nunregistration and lookups can race, leading to:\n\n1 use-after-free if an alias entry is removed while being read,\n2 duplicate entries when two threads register the same alias,\n3 inconsistent alias mappings observed by consumers.\n\nProtect all traversals, insertions and deletions on\nregulator_supply_alias_list with the existing regulator_list_mutex.(CVE-2025-68354)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Prevent recursive memory reclaim\n\nFunction new_inode() returns a new inode with inode-\u0026gt;i_mapping-\u0026gt;gfp_mask\nset to GFP_HIGHUSER_MOVABLE.  This value includes the __GFP_FS flag, so\nallocations in that address space can recurse into filesystem memory\nreclaim.  We don\u0026apos;t want that to happen because it can consume a\nsignificant amount of stack memory.\n\nWorse than that is that it can also deadlock: for example, in several\nplaces, gfs2_unstuff_dinode() is called inside filesystem transactions.\nThis calls filemap_grab_folio(), which can allocate a new folio, which\ncan trigger memory reclaim.  If memory reclaim recurses into the\nfilesystem and starts another transaction, a deadlock will ensue.\n\nTo fix these kinds of problems, prevent memory reclaim from recursing\ninto filesystem code by making sure that the gfp_mask of inode address\nspaces doesn\u0026apos;t include __GFP_FS.\n\nThe \u0026quot;meta\u0026quot; and resource group address spaces were already using GFP_NOFS\nas their gfp_mask (which doesn\u0026apos;t include __GFP_FS).  The default value\nof GFP_HIGHUSER_MOVABLE is less restrictive than GFP_NOFS, though.  To\navoid being overly limiting, use the default value and only knock off\nthe __GFP_FS flag.  I\u0026apos;m not sure if this will actually make a\ndifference, but it also shouldn\u0026apos;t hurt.\n\nThis patch is loosely based on commit ad22c7a043c2 (\u0026quot;xfs: prevent stack\noverflows from page cache allocation\u0026quot;).\n\nFixes xfstest generic/273.(CVE-2025-68356)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb()\n\nThe rtl8187_rx_cb() calculates the rx descriptor header address\nby subtracting its size from the skb tail pointer.\nHowever, it does not validate if the received packet\n(skb-\u0026gt;len from urb-\u0026gt;actual_length) is large enough to contain this\nheader.\n\nIf a truncated packet is received, this will lead to a buffer\nunderflow, reading memory before the start of the skb data area,\nand causing a kernel panic.\n\nAdd length checks for both rtl8187 and rtl8187b descriptor headers\nbefore attempting to access them, dropping the packet cleanly if the\ncheck fails.(CVE-2025-68362)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Check skb-\u0026gt;transport_header is set in bpf_skb_check_mtu\n\nThe bpf_skb_check_mtu helper needs to use skb-\u0026gt;transport_header when\nthe BPF_MTU_CHK_SEGS flag is used:\n\n\tbpf_skb_check_mtu(skb, ifindex, \u0026amp;mtu_len, 0, BPF_MTU_CHK_SEGS)\n\nThe transport_header is not always set. There is a WARN_ON_ONCE\nreport when CONFIG_DEBUG_NET is enabled + skb-\u0026gt;gso_size is set +\nbpf_prog_test_run is used:\n\nWARNING: CPU: 1 PID: 2216 at ./include/linux/skbuff.h:3071\n skb_gso_validate_network_len\n bpf_skb_check_mtu\n bpf_prog_3920e25740a41171_tc_chk_segs_flag # A test in the next patch\n bpf_test_run\n bpf_prog_test_run_skb\n\nFor a normal ingress skb (not test_run), skb_reset_transport_header\nis performed but there is plan to avoid setting it as described in\ncommit 2170a1f09148 (\u0026quot;net: no longer reset transport_header in __netif_receive_skb_core()\u0026quot;).\n\nThis patch fixes the bpf helper by checking\nskb_transport_header_was_set(). The check is done just before\nskb-\u0026gt;transport_header is used, to avoid breaking the existing bpf prog.\nThe WARN_ON_ONCE is limited to bpf_prog_test_run, so targeting bpf-next.(CVE-2025-68363)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncoresight: ETR: Fix ETR buffer use-after-free issue\n\nWhen ETR is enabled as CS_MODE_SYSFS, if the buffer size is changed\nand enabled again, currently sysfs_buf will point to the newly\nallocated memory(buf_new) and free the old memory(buf_old). But the\netr_buf that is being used by the ETR remains pointed to buf_old, not\nupdated to buf_new. In this case, it will result in a memory\nuse-after-free issue.\n\nFix this by checking ETR\u0026apos;s mode before updating and releasing buf_old,\nif the mode is CS_MODE_SYSFS, then skip updating and releasing it.(CVE-2025-68376)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix stackmap overflow check in __bpf_get_stackid()\n\nSyzkaller reported a KASAN slab-out-of-bounds write in __bpf_get_stackid()\nwhen copying stack trace data. The issue occurs when the perf trace\n contains more stack entries than the stack map bucket can hold,\n leading to an out-of-bounds write in the bucket\u0026apos;s data array.(CVE-2025-68378)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id\n\nUse check_add_overflow() to guard against potential integer overflows\nwhen adding the binary blob lengths and the size of an asymmetric_key_id\nstructure and return ERR_PTR(-EOVERFLOW) accordingly. This prevents a\npossible buffer overflow when copying data from potentially malicious\nX.509 certificate fields that can be arbitrarily large, such as ASN.1\nINTEGER serial numbers, issuer names, etc.(CVE-2025-68724)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Do not let BPF test infra emit invalid GSO types to stack\n\nYinhao et al. reported that their fuzzer tool was able to trigger a\nskb_warn_bad_offload() from netif_skb_features() -\u0026gt; gso_features_check().\nWhen a BPF program - triggered via BPF test infra - pushes the packet\nto the loopback device via bpf_clone_redirect() then mentioned offload\nwarning can be seen. GSO-related features are then rightfully disabled.\n\nWe get into this situation due to convert___skb_to_skb() setting\ngso_segs and gso_size but not gso_type. Technically, it makes sense\nthat this warning triggers since the GSO properties are malformed due\nto the gso_type. Potentially, the gso_type could be marked non-trustworthy\nthrough setting it at least to SKB_GSO_DODGY without any other specific\nassumptions, but that also feels wrong given we should not go further\ninto the GSO engine in the first place.\n\nThe checks were added in 121d57af308d (\u0026quot;gso: validate gso_type in GSO\nhandlers\u0026quot;) because there were malicious (syzbot) senders that combine\na protocol with a non-matching gso_type. If we would want to drop such\npackets, gso_features_check() currently only returns feature flags via\nnetif_skb_features(), so one location for potentially dropping such skbs\ncould be validate_xmit_unreadable_skb(), but then otoh it would be\nan additional check in the fast-path for a very corner case. Given\nbpf_clone_redirect() is the only place where BPF test infra could emit\nsuch packets, lets reject them right there.(CVE-2025-68725)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nisdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe()\n\nIn hfcsusb_probe(), the memory allocated for ctrl_urb gets leaked when\nsetup_instance() fails with an error code. Fix that by freeing the urb\nbefore freeing the hw structure. Also change the error paths to use the\ngoto ladder style.\n\nCompile tested only. Issue found using a prototype static analysis tool.(CVE-2025-68734)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix improper freeing of purex item\n\nIn qla2xxx_process_purls_iocb(), an item is allocated via\nqla27xx_copy_multiple_pkt(), which internally calls\nqla24xx_alloc_purex_item().\n\nThe qla24xx_alloc_purex_item() function may return a pre-allocated item\nfrom a per-adapter pool for small allocations, instead of dynamically\nallocating memory with kzalloc().\n\nAn error handling path in qla2xxx_process_purls_iocb() incorrectly uses\nkfree() to release the item. If the item was from the pre-allocated\npool, calling kfree() on it is a bug that can lead to memory corruption.\n\nFix this by using the correct deallocation function,\nqla24xx_free_purex_item(), which properly handles both dynamically\nallocated and pre-allocated items.(CVE-2025-68741)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Free special fields when update [lru_,]percpu_hash maps\n\nAs [lru_,]percpu_hash maps support BPF_KPTR_{REF,PERCPU}, missing\ncalls to \u0026apos;bpf_obj_free_fields()\u0026apos; in \u0026apos;pcpu_copy_value()\u0026apos; could cause the\nmemory referenced by BPF_KPTR_{REF,PERCPU} fields to be held until the\nmap gets freed.\n\nFix this by calling \u0026apos;bpf_obj_free_fields()\u0026apos; after\n\u0026apos;copy_map_value[,_long]()\u0026apos; in \u0026apos;pcpu_copy_value()\u0026apos;.(CVE-2025-68744)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Clear cmds after chip reset\n\nCommit aefed3e5548f (\u0026quot;scsi: qla2xxx: target: Fix offline port handling\nand host reset handling\u0026quot;) caused two problems:\n\n1. Commands sent to FW, after chip reset got stuck and never freed as FW\n   is not going to respond to them anymore.\n\n2. BUG_ON(cmd-\u0026gt;sg_mapped) in qlt_free_cmd().  Commit 26f9ce53817a\n   (\u0026quot;scsi: qla2xxx: Fix missed DMA unmap for aborted commands\u0026quot;)\n   attempted to fix this, but introduced another bug under different\n   circumstances when two different CPUs were racing to call\n   qlt_unmap_sg() at the same time: BUG_ON(!valid_dma_direction(dir)) in\n   dma_unmap_sg_attrs().\n\nSo revert \u0026quot;scsi: qla2xxx: Fix missed DMA unmap for aborted commands\u0026quot; and\npartially revert \u0026quot;scsi: qla2xxx: target: Fix offline port handling and\nhost reset handling\u0026quot; at __qla2x00_abort_all_cmds.(CVE-2025-68745)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nblock: Use RCU in blk_mq_[un]quiesce_tagset() instead of set-\u0026gt;tag_list_lock\n\nblk_mq_{add,del}_queue_tag_set() functions add and remove queues from\ntagset, the functions make sure that tagset and queues are marked as\nshared when two or more queues are attached to the same tagset.\nInitially a tagset starts as unshared and when the number of added\nqueues reaches two, blk_mq_add_queue_tag_set() marks it as shared along\nwith all the queues attached to it. When the number of attached queues\ndrops to 1 blk_mq_del_queue_tag_set() need to mark both the tagset and\nthe remaining queues as unshared.\n\nBoth functions need to freeze current queues in tagset before setting on\nunsetting BLK_MQ_F_TAG_QUEUE_SHARED flag. While doing so, both functions\nhold set-\u0026gt;tag_list_lock mutex, which makes sense as we do not want\nqueues to be added or deleted in the process. This used to work fine\nuntil commit 98d81f0df70c (\u0026quot;nvme: use blk_mq_[un]quiesce_tagset\u0026quot;)\nmade the nvme driver quiesce tagset instead of quiscing individual\nqueues. blk_mq_quiesce_tagset() does the job and quiesce the queues in\nset-\u0026gt;tag_list while holding set-\u0026gt;tag_list_lock also.\n\nThis results in deadlock between two threads with these stacktraces:\n\n  __schedule+0x47c/0xbb0\n  ? timerqueue_add+0x66/0xb0\n  schedule+0x1c/0xa0\n  schedule_preempt_disabled+0xa/0x10\n  __mutex_lock.constprop.0+0x271/0x600\n  blk_mq_quiesce_tagset+0x25/0xc0\n  nvme_dev_disable+0x9c/0x250\n  nvme_timeout+0x1fc/0x520\n  blk_mq_handle_expired+0x5c/0x90\n  bt_iter+0x7e/0x90\n  blk_mq_queue_tag_busy_iter+0x27e/0x550\n  ? __blk_mq_complete_request_remote+0x10/0x10\n  ? __blk_mq_complete_request_remote+0x10/0x10\n  ? __call_rcu_common.constprop.0+0x1c0/0x210\n  blk_mq_timeout_work+0x12d/0x170\n  process_one_work+0x12e/0x2d0\n  worker_thread+0x288/0x3a0\n  ? rescuer_thread+0x480/0x480\n  kthread+0xb8/0xe0\n  ? kthread_park+0x80/0x80\n  ret_from_fork+0x2d/0x50\n  ? kthread_park+0x80/0x80\n  ret_from_fork_asm+0x11/0x20\n\n  __schedule+0x47c/0xbb0\n  ? xas_find+0x161/0x1a0\n  schedule+0x1c/0xa0\n  blk_mq_freeze_queue_wait+0x3d/0x70\n  ? destroy_sched_domains_rcu+0x30/0x30\n  blk_mq_update_tag_set_shared+0x44/0x80\n  blk_mq_exit_queue+0x141/0x150\n  del_gendisk+0x25a/0x2d0\n  nvme_ns_remove+0xc9/0x170\n  nvme_remove_namespaces+0xc7/0x100\n  nvme_remove+0x62/0x150\n  pci_device_remove+0x23/0x60\n  device_release_driver_internal+0x159/0x200\n  unbind_store+0x99/0xa0\n  kernfs_fop_write_iter+0x112/0x1e0\n  vfs_write+0x2b1/0x3d0\n  ksys_write+0x4e/0xb0\n  do_syscall_64+0x5b/0x160\n  entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\nThe top stacktrace is showing nvme_timeout() called to handle nvme\ncommand timeout. timeout handler is trying to disable the controller and\nas a first step, it needs to blk_mq_quiesce_tagset() to tell blk-mq not\nto call queue callback handlers. The thread is stuck waiting for\nset-\u0026gt;tag_list_lock as it tries to walk the queues in set-\u0026gt;tag_list.\n\nThe lock is held by the second thread in the bottom stack which is\nwaiting for one of queues to be frozen. The queue usage counter will\ndrop to zero after nvme_timeout() finishes, and this will not happen\nbecause the thread will wait for this mutex forever.\n\nGiven that [un]quiescing queue is an operation that does not need to\nsleep, update blk_mq_[un]quiesce_tagset() to use RCU instead of taking\nset-\u0026gt;tag_list_lock, update blk_mq_{add,del}_queue_tag_set() to use RCU\nsafe list operations. Also, delete INIT_LIST_HEAD(\u0026amp;q-\u0026gt;tag_set_list)\nin blk_mq_del_queue_tag_set() because we can not re-initialize it while\nthe list is being traversed under RCU. The deleted queue will not be\nadded/deleted to/from a tagset and it will be freed in blk_free_queue()\nafter the end of RCU grace period.(CVE-2025-68756)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsched/deadline: only set free_cpus for online runqueues\n\nCommit 16b269436b72 (\u0026quot;sched/deadline: Modify cpudl::free_cpus\nto reflect rd-\u0026gt;online\u0026quot;) introduced the cpudl_set/clear_freecpu\nfunctions to allow the cpu_dl::free_cpus mask to be manipulated\nby the deadline scheduler class rq_on/offline callbacks so the\nmask would also reflect this state.\n\nCommit 9659e1eeee28 (\u0026quot;sched/deadline: Remove cpu_active_mask\nfrom cpudl_find()\u0026quot;) removed the check of the cpu_active_mask to\nsave some processing on the premise that the cpudl::free_cpus\nmask already reflected the runqueue online state.\n\nUnfortunately, there are cases where it is possible for the\ncpudl_clear function to set the free_cpus bit for a CPU when the\ndeadline runqueue is offline. When this occurs while a CPU is\nconnected to the default root domain the flag may retain the bad\nstate after the CPU has been unplugged. Later, a different CPU\nthat is transitioning through the default root domain may push a\ndeadline task to the powered down CPU when cpudl_find sees its\nfree_cpus bit is set. If this happens the task will not have the\nopportunity to run.\n\nOne example is outlined here:\nhttps://lore.kernel.org/lkml/(CVE-2025-68780)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: Reset t_task_cdb pointer in error case\n\nIf allocation of cmd-\u0026gt;t_task_cdb fails, it remains NULL but is later\ndereferenced in the \u0026apos;err\u0026apos; path.\n\nIn case of error, reset NULL t_task_cdb value to point at the default\nfixed-size buffer.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2025-68782)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niomap: adjust read range correctly for non-block-aligned positions\n\niomap_adjust_read_range() assumes that the position and length passed in\nare block-aligned. This is not always the case however, as shown in the\nsyzbot generated case for erofs. This causes too many bytes to be\nskipped for uptodate blocks, which results in returning the incorrect\nposition and length to read in. If all the blocks are uptodate, this\nunderflows length and returns a position beyond the folio.\n\nFix the calculation to also take into account the block offset when\ncalculating how many bytes can be skipped for uptodate blocks.(CVE-2025-68794)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: NFSv4 file creation neglects setting ACL\n\nAn NFSv4 client that sets an ACL with a named principal during file\ncreation retrieves the ACL afterwards, and finds that it is only a\ndefault ACL (based on the mode bits) and not the ACL that was\nrequested during file creation. This violates RFC 8881 section\n6.4.1.3: \u0026quot;the ACL attribute is set as given\u0026quot;.\n\nThe issue occurs in nfsd_create_setattr(), which calls\nnfsd_attrs_valid() to determine whether to call nfsd_setattr().\nHowever, nfsd_attrs_valid() checks only for iattr changes and\nsecurity labels, but not POSIX ACLs. When only an ACL is present,\nthe function returns false, nfsd_setattr() is skipped, and the\nPOSIX ACL is never applied to the inode.\n\nSubsequently, when the client retrieves the ACL, the server finds\nno POSIX ACL on the inode and returns one generated from the file\u0026apos;s\nmode bits rather than returning the originally-specified ACL.(CVE-2025-68803)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nio_uring: fix filename leak in __io_openat_prep()\n\n __io_openat_prep() allocates a struct filename using getname(). However,\nfor the condition of the file being installed in the fixed file table as\nwell as having O_CLOEXEC flag set, the function returns early. At that\npoint, the request doesn\u0026apos;t have REQ_F_NEED_CLEANUP flag set. Due to this,\nthe memory for the newly allocated struct filename is not cleaned up,\ncausing a memory leak.\n\nFix this by setting the REQ_F_NEED_CLEANUP for the request just after the\nsuccessful getname() call, so that when the request is torn down, the\nfilename will be cleaned up, along with other resources needing cleanup.(CVE-2025-68814)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: fw_tracer, Validate format string parameters\n\nAdd validation for format string parameters in the firmware tracer to\nprevent potential security vulnerabilities and crashes from malformed\nformat strings received from firmware.\n\nThe firmware tracer receives format strings from the device firmware and\nuses them to format trace messages. Without proper validation, bad\nfirmware could provide format strings with invalid format specifiers\n(e.g., %s, %p, %n) that could lead to crashes, or other undefined\nbehavior.\n\nAdd mlx5_tracer_validate_params() to validate that all format specifiers\nin trace strings are limited to safe integer/hex formats (%x, %d, %i,\n%u, %llx, %lx, etc.). Reject strings containing other format types that\ncould be used to access arbitrary memory or cause crashes.\nInvalid format strings are added to the trace output for visibility with\n\u0026quot;BAD_FORMAT: \u0026quot; prefix.(CVE-2025-68816)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: Revert \u0026quot;scsi: qla2xxx: Perform lockless command completion in abort path\u0026quot;\n\nThis reverts commit 0367076b0817d5c75dfb83001ce7ce5c64d803a9.\n\nThe commit being reverted added code to __qla2x00_abort_all_cmds() to\ncall sp-\u0026gt;done() without holding a spinlock.  But unlike the older code\nbelow it, this new code failed to check sp-\u0026gt;cmd_type and just assumed\nTYPE_SRB, which results in a jump to an invalid pointer in target-mode\nwith TYPE_TGT_CMD:\n\nqla2xxx [0000:65:00.0]-d034:8: qla24xx_do_nack_work create sess success\n  0000000009f7a79b\nqla2xxx [0000:65:00.0]-5003:8: ISP System Error - mbx1=1ff5h mbx2=10h\n  mbx3=0h mbx4=0h mbx5=191h mbx6=0h mbx7=0h.\nqla2xxx [0000:65:00.0]-d01e:8: -\u0026gt; fwdump no buffer\nqla2xxx [0000:65:00.0]-f03a:8: qla_target(0): System error async event\n  0x8002 occurred\nqla2xxx [0000:65:00.0]-00af:8: Performing ISP error recovery -\n  ha=0000000058183fda.\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nPF: supervisor instruction fetch in kernel mode\nPF: error_code(0x0010) - not-present page\nPGD 0 P4D 0\nOops: 0010 [#1] SMP\nCPU: 2 PID: 9446 Comm: qla2xxx_8_dpc Tainted: G           O       6.1.133 #1\nHardware name: Supermicro Super Server/X11SPL-F, BIOS 4.2 12/15/2023\nRIP: 0010:0x0\nCode: Unable to access opcode bytes at 0xffffffffffffffd6.\nRSP: 0018:ffffc90001f93dc8 EFLAGS: 00010206\nRAX: 0000000000000282 RBX: 0000000000000355 RCX: ffff88810d16a000\nRDX: ffff88810dbadaa8 RSI: 0000000000080000 RDI: ffff888169dc38c0\nRBP: ffff888169dc38c0 R08: 0000000000000001 R09: 0000000000000045\nR10: ffffffffa034bdf0 R11: 0000000000000000 R12: ffff88810800bb40\nR13: 0000000000001aa8 R14: ffff888100136610 R15: ffff8881070f7400\nFS:  0000000000000000(0000) GS:ffff88bf80080000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffffffffffffffd6 CR3: 000000010c8ff006 CR4: 00000000003706e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u0026lt;TASK\u0026gt;\n ? __die+0x4d/0x8b\n ? page_fault_oops+0x91/0x180\n ? trace_buffer_unlock_commit_regs+0x38/0x1a0\n ? exc_page_fault+0x391/0x5e0\n ? asm_exc_page_fault+0x22/0x30\n __qla2x00_abort_all_cmds+0xcb/0x3e0 [qla2xxx_scst]\n qla2x00_abort_all_cmds+0x50/0x70 [qla2xxx_scst]\n qla2x00_abort_isp_cleanup+0x3b7/0x4b0 [qla2xxx_scst]\n qla2x00_abort_isp+0xfd/0x860 [qla2xxx_scst]\n qla2x00_do_dpc+0x581/0xa40 [qla2xxx_scst]\n kthread+0xa8/0xd0\n \u0026lt;/TASK\u0026gt;\n\nThen commit 4475afa2646d (\u0026quot;scsi: qla2xxx: Complete command early within\nlock\u0026quot;) added the spinlock back, because not having the lock caused a\nrace and a crash.  But qla2x00_abort_srb() in the switch below already\nchecks for qla2x00_chip_is_down() and handles it the same way, so the\ncode above the switch is now redundant and still buggy in target-mode.\nRemove it.(CVE-2025-68818)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nshmem: fix recovery on rename failures\n\nmaple_tree insertions can fail if we are seriously short on memory;\nsimple_offset_rename() does not recover well if it runs into that.\nThe same goes for simple_offset_rename_exchange().\n\nMoreover, shmem_whiteout() expects that if it succeeds, the caller will\nprogress to d_move(), i.e. that shmem_rename2() won\u0026apos;t fail past the\nsuccessful call of shmem_whiteout().\n\nNot hard to fix, fortunately - mtree_store() can\u0026apos;t fail if the index we\nare trying to store into is already present in the tree as a singleton.\n\nFor simple_offset_rename_exchange() that\u0026apos;s enough - we just need to be\ncareful about the order of operations.\n\nFor simple_offset_rename() solution is to preinsert the target into the\ntree for new_dir; the rest can be done without any potentially failing\noperations.\n\nThat preinsertion has to be done in shmem_rename2() rather than in\nsimple_offset_rename() itself - otherwise we\u0026apos;d need to deal with the\npossibility of failure after successful shmem_whiteout().(CVE-2025-71072)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer\n\nWhen advancing the target expiration for the guest\u0026apos;s APIC timer in periodic\nmode, set the expiration to \u0026quot;now\u0026quot; if the target expiration is in the past\n(similar to what is done in update_target_expiration()).  Blindly adding\nthe period to the previous target expiration can result in KVM generating\na practically unbounded number of hrtimer IRQs due to programming an\nexpired timer over and over.  In extreme scenarios, e.g. if userspace\npauses/suspends a VM for an extended duration, this can even cause hard\nlockups in the host.\n\nCurrently, the bug only affects Intel CPUs when using the hypervisor timer\n(HV timer), a.k.a. the VMX preemption timer.  Unlike the software timer,\na.k.a. hrtimer, which KVM keeps running even on exits to userspace, the\nHV timer only runs while the guest is active.  As a result, if the vCPU\ndoes not run for an extended duration, there will be a huge gap between\nthe target expiration and the current time the vCPU resumes running.\nBecause the target expiration is incremented by only one period on each\ntimer expiration, this leads to a series of timer expirations occurring\nrapidly after the vCPU/VM resumes.\n\nMore critically, when the vCPU first triggers a periodic HV timer\nexpiration after resuming, advancing the expiration by only one period\nwill result in a target expiration in the past.  As a result, the delta\nmay be calculated as a negative value.  When the delta is converted into\nan absolute value (tscdeadline is an unsigned u64), the resulting value\ncan overflow what the HV timer is capable of programming.  I.e. the large\nvalue will exceed the VMX Preemption Timer\u0026apos;s maximum bit width of\ncpu_preemption_timer_multi + 32, and thus cause KVM to switch from the\nHV timer to the software timer (hrtimers).\n\nAfter switching to the software timer, periodic timer expiration callbacks\nmay be executed consecutively within a single clock interrupt handler,\nbecause hrtimers honors KVM\u0026apos;s request for an expiration in the past and\nimmediately re-invokes KVM\u0026apos;s callback after reprogramming.  And because\nthe interrupt handler runs with IRQs disabled, restarting KVM\u0026apos;s hrtimer\nover and over until the target expiration is advanced to \u0026quot;now\u0026quot; can result\nin a hard lockup.\n\nE.g. the following hard lockup was triggered in the host when running a\nWindows VM (only relevant because it used the APIC timer in periodic mode)\nafter resuming the VM from a long suspend (in the host).\n\n  NMI watchdog: Watchdog detected hard LOCKUP on cpu 45\n  ...\n  RIP: 0010:advance_periodic_target_expiration+0x4d/0x80 [kvm]\n  ...\n  RSP: 0018:ff4f88f5d98d8ef0 EFLAGS: 00000046\n  RAX: fff0103f91be678e RBX: fff0103f91be678e RCX: 00843a7d9e127bcc\n  RDX: 0000000000000002 RSI: 0052ca4003697505 RDI: ff440d5bfbdbd500\n  RBP: ff440d5956f99200 R08: ff2ff2a42deb6a84 R09: 000000000002a6c0\n  R10: 0122d794016332b3 R11: 0000000000000000 R12: ff440db1af39cfc0\n  R13: ff440db1af39cfc0 R14: ffffffffc0d4a560 R15: ff440db1af39d0f8\n  FS:  00007f04a6ffd700(0000) GS:ff440db1af380000(0000) knlGS:000000e38a3b8000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 000000d5651feff8 CR3: 000000684e038002 CR4: 0000000000773ee0\n  PKRU: 55555554\n  Call Trace:\n   \u0026lt;IRQ\u0026gt;\n   apic_timer_fn+0x31/0x50 [kvm]\n   __hrtimer_run_queues+0x100/0x280\n   hrtimer_interrupt+0x100/0x210\n   ? ttwu_do_wakeup+0x19/0x160\n   smp_apic_timer_interrupt+0x6a/0x130\n   apic_timer_interrupt+0xf/0x20\n   \u0026lt;/IRQ\u0026gt;\n\nMoreover, if the suspend duration of the virtual machine is not long enough\nto trigger a hard lockup in this scenario, since commit 98c25ead5eda\n(\u0026quot;KVM: VMX: Move preemption timer \u0026lt;=\u0026gt; hrtimer dance to common x86\u0026quot;), KVM\nwill continue using the software timer until the guest reprograms the APIC\ntimer in some way.  Since the periodic timer does not require frequent APIC\ntimer register programming, the guest may continue to use the software\ntimer in \n---truncated---(CVE-2025-71104)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: make decode_pool() more resilient against corrupted osdmaps\n\nIf the osdmap is (maliciously) corrupted such that the encoded length\nof ceph_pg_pool envelope is less than what is expected for a particular\nencoding version, out-of-bounds reads may ensue because the only bounds\ncheck that is there is based on that length value.\n\nThis patch adds explicit bounds checks for each field that is decoded\nor skipped.(CVE-2025-71116)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: seqiv - Do not use req-\u0026gt;iv after crypto_aead_encrypt\n\nAs soon as crypto_aead_encrypt is called, the underlying request\nmay be freed by an asynchronous completion.  Thus dereferencing\nreq-\u0026gt;iv after it returns is invalid.\n\nInstead of checking req-\u0026gt;iv against info, create a new variable\nunaligned_info and use it for that purpose instead.(CVE-2025-71131)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKEYS: trusted: Fix a memory leak in tpm2_load_cmd\n\n\u0026apos;tpm2_load_cmd\u0026apos; allocates a tempoary blob indirectly via \u0026apos;tpm2_key_decode\u0026apos;\nbut it is not freed in the failure paths. Address this by wrapping the blob\ninto with a cleanup helper.(CVE-2025-71147)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/poll: correctly handle io_poll_add() return value on update\n\nWhen the core of io_uring was updated to handle completions\nconsistently and with fixed return codes, the POLL_REMOVE opcode\nwith updates got slightly broken. If a POLL_ADD is pending and\nthen POLL_REMOVE is used to update the events of that request, if that\nupdate causes the POLL_ADD to now trigger, then that completion is lost\nand a CQE is never posted.\n\nAdditionally, ensure that if an update does cause an existing POLL_ADD\nto complete, that the completion value isn\u0026apos;t always overwritten with\n-ECANCELED. For that case, whatever io_poll_add() set the value to\nshould just be retained.(CVE-2025-71149)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: Fix refcount leak when invalid session is found on session lookup\n\nWhen a session is found but its state is not SMB2_SESSION_VALID, It\nindicates that no valid session was found, but it is missing to decrement\nthe reference count acquired by the session lookup, which results in\na reference count leak. This patch fixes the issue by explicitly calling\nksmbd_user_session_put to release the reference to the session.(CVE-2025-71150)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Don\u0026apos;t store mlx5e_priv in mlx5e_dev devlink priv\n\nmlx5e_priv is an unstable structure that can be memset(0) if profile\nattaching fails, mlx5e_priv in mlx5e_dev devlink private is used to\nreference the netdev and mdev associated with that struct. Instead,\nstore netdev directly into mlx5e_dev and get mdev from the containing\nmlx5_adev aux device structure.\n\nThis fixes a kernel oops in mlx5e_remove when switchdev mode fails due\nto change profile failure.\n\n$ devlink dev eswitch set pci/0000:00:03.0 mode switchdev\nError: mlx5_core: Failed setting eswitch to offloads.\ndmesg:\nworkqueue: Failed to create a rescuer kthread for wq \u0026quot;mlx5e\u0026quot;: -EINTR\nmlx5_core 0012:03:00.1: mlx5e_netdev_init_profile:6214:(pid 37199): mlx5e_priv_init failed, err=-12\nmlx5_core 0012:03:00.1 gpu3rdma1: mlx5e_netdev_change_profile: new profile init failed, -12\nworkqueue: Failed to create a rescuer kthread for wq \u0026quot;mlx5e\u0026quot;: -EINTR\nmlx5_core 0012:03:00.1: mlx5e_netdev_init_profile:6214:(pid 37199): mlx5e_priv_init failed, err=-12\nmlx5_core 0012:03:00.1 gpu3rdma1: mlx5e_netdev_change_profile: failed to rollback to orig profile, -12\n\n$ devlink dev reload pci/0000:00:03.0 ==\u0026gt; oops\n\nBUG: kernel NULL pointer dereference, address: 0000000000000520\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\nPGD 0 P4D 0\nOops: Oops: 0000 [#1] SMP NOPTI\nCPU: 3 UID: 0 PID: 521 Comm: devlink Not tainted 6.18.0-rc5+ #117 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014\nRIP: 0010:mlx5e_remove+0x68/0x130\nRSP: 0018:ffffc900034838f0 EFLAGS: 00010246\nRAX: ffff88810283c380 RBX: ffff888101874400 RCX: ffffffff826ffc45\nRDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000\nRBP: ffff888102d789c0 R08: ffff8881007137f0 R09: ffff888100264e10\nR10: ffffc90003483898 R11: ffffc900034838a0 R12: ffff888100d261a0\nR13: ffff888100d261a0 R14: ffff8881018749a0 R15: ffff888101874400\nFS:  00007f8565fea740(0000) GS:ffff88856a759000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000520 CR3: 000000010b11a004 CR4: 0000000000370ef0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n device_release_driver_internal+0x19c/0x200\n bus_remove_device+0xc6/0x130\n device_del+0x160/0x3d0\n ? devl_param_driverinit_value_get+0x2d/0x90\n mlx5_detach_device+0x89/0xe0\n mlx5_unload_one_devl_locked+0x3a/0x70\n mlx5_devlink_reload_down+0xc8/0x220\n devlink_reload+0x7d/0x260\n devlink_nl_reload_doit+0x45b/0x5a0\n genl_family_rcv_msg_doit+0xe8/0x140(CVE-2026-22996)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec\n\nCommit efa56305908b (\u0026quot;nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length\u0026quot;)\nadded ttag bounds checking and data_offset\nvalidation in nvmet_tcp_handle_h2c_data_pdu(), but it did not validate\nwhether the command\u0026apos;s data structures (cmd-\u0026gt;req.sg and cmd-\u0026gt;iov) have\nbeen properly initialized before processing H2C_DATA PDUs.\n\nThe nvmet_tcp_build_pdu_iovec() function dereferences these pointers\nwithout NULL checks. This can be triggered by sending H2C_DATA PDU\nimmediately after the ICREQ/ICRESP handshake, before\nsending a CONNECT command or NVMe write command.\n\nAttack vectors that trigger NULL pointer dereferences:\n1. H2C_DATA PDU sent before CONNECT → both pointers NULL\n2. H2C_DATA PDU for READ command → cmd-\u0026gt;req.sg allocated, cmd-\u0026gt;iov NULL\n3. H2C_DATA PDU for uninitialized command slot → both pointers NULL\n\nThe fix validates both cmd-\u0026gt;req.sg and cmd-\u0026gt;iov before calling\nnvmet_tcp_build_pdu_iovec(). Both checks are required because:\n- Uninitialized commands: both NULL\n- READ commands: cmd-\u0026gt;req.sg allocated, cmd-\u0026gt;iov NULL\n- WRITE commands: both allocated(CVE-2026-22998)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix crash on profile change rollback failure\n\nmlx5e_netdev_change_profile can fail to attach a new profile and can\nfail to rollback to old profile, in such case, we could end up with a\ndangling netdev with a fully reset netdev_priv. A retry to change\nprofile, e.g. another attempt to call mlx5e_netdev_change_profile via\nswitchdev mode change, will crash trying to access the now NULL\npriv-\u0026gt;mdev.\n\nThis fix allows mlx5e_netdev_change_profile() to handle previous\nfailures and an empty priv, by not assuming priv is valid.\n\nPass netdev and mdev to all flows requiring\nmlx5e_netdev_change_profile() and avoid passing priv.\nIn mlx5e_netdev_change_profile() check if current priv is valid, and if\nnot, just attach the new profile without trying to access the old one.\n\nThis fixes the following oops, when enabling switchdev mode for the 2nd\ntime after first time failure:\n\n ## Enabling switchdev mode first time:\n\nmlx5_core 0012:03:00.1: E-Switch: Supported tc chains and prios offload\nworkqueue: Failed to create a rescuer kthread for wq \u0026quot;mlx5e\u0026quot;: -EINTR\nmlx5_core 0012:03:00.1: mlx5e_netdev_init_profile:6214:(pid 37199): mlx5e_priv_init failed, err=-12\nmlx5_core 0012:03:00.1 gpu3rdma1: mlx5e_netdev_change_profile: new profile init failed, -12\nworkqueue: Failed to create a rescuer kthread for wq \u0026quot;mlx5e\u0026quot;: -EINTR\nmlx5_core 0012:03:00.1: mlx5e_netdev_init_profile:6214:(pid 37199): mlx5e_priv_init failed, err=-12\nmlx5_core 0012:03:00.1 gpu3rdma1: mlx5e_netdev_change_profile: failed to rollback to orig profile, -12\n                                                                         ^^^^^^^^\nmlx5_core 0000:00:03.0: E-Switch: Disable: mode(LEGACY), nvfs(0), necvfs(0), active vports(0)\n\n ## retry: Enabling switchdev mode 2nd time:\n\nmlx5_core 0000:00:03.0: E-Switch: Supported tc chains and prios offload\nBUG: kernel NULL pointer dereference, address: 0000000000000038\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\nPGD 0 P4D 0\nOops: Oops: 0000 [#1] SMP NOPTI\nCPU: 13 UID: 0 PID: 520 Comm: devlink Not tainted 6.18.0-rc4+ #91 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014\nRIP: 0010:mlx5e_detach_netdev+0x3c/0x90\nCode: 50 00 00 f0 80 4f 78 02 48 8b bf e8 07 00 00 48 85 ff 74 16 48 8b 73 78 48 d1 ee 83 e6 01 83 f6 01 40 0f b6 f6 e8 c4 42 00 00 \u0026lt;48\u0026gt; 8b 45 38 48 85 c0 74 08 48 89 df e8 cc 47 40 1e 48 8b bb f0 07\nRSP: 0018:ffffc90000673890 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: ffff8881036a89c0 RCX: 0000000000000000\nRDX: ffff888113f63800 RSI: ffffffff822fe720 RDI: 0000000000000000\nRBP: 0000000000000000 R08: 0000000000002dcd R09: 0000000000000000\nR10: ffffc900006738e8 R11: 00000000ffffffff R12: 0000000000000000\nR13: 0000000000000000 R14: ffff8881036a89c0 R15: 0000000000000000\nFS:  00007fdfb8384740(0000) GS:ffff88856a9d6000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000038 CR3: 0000000112ae0005 CR4: 0000000000370ef0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n mlx5e_netdev_change_profile+0x45/0xb0\n mlx5e_vport_rep_load+0x27b/0x2d0\n mlx5_esw_offloads_rep_load+0x72/0xf0\n esw_offloads_enable+0x5d0/0x970\n mlx5_eswitch_enable_locked+0x349/0x430\n ? is_mp_supported+0x57/0xb0\n mlx5_devlink_eswitch_mode_set+0x26b/0x430\n devlink_nl_eswitch_set_doit+0x6f/0xf0\n genl_family_rcv_msg_doit+0xe8/0x140\n genl_rcv_msg+0x18b/0x290\n ? __pfx_devlink_nl_pre_doit+0x10/0x10\n ? __pfx_devlink_nl_eswitch_set_doit+0x10/0x10\n ? __pfx_devlink_nl_post_doit+0x10/0x10\n ? __pfx_genl_rcv_msg+0x10/0x10\n netlink_rcv_skb+0x52/0x100\n genl_rcv+0x28/0x40\n netlink_unicast+0x282/0x3e0\n ? __alloc_skb+0xd6/0x190\n netlink_sendmsg+0x1f7/0x430\n __sys_sendto+0x213/0x220\n ? __sys_recvmsg+0x6a/0xd0\n __x64_sys_sendto+0x24/0x30\n do_syscall_64+0x50/0x1f0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\nRIP: 0033:0x7fdfb8495047(CVE-2026-23000)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nx86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1\n\nWhen loading guest XSAVE state via KVM_SET_XSAVE, and when updating XFD in\nresponse to a guest WRMSR, clear XFD-disabled features in the saved (or to\nbe restored) XSTATE_BV to ensure KVM doesn\u0026apos;t attempt to load state for\nfeatures that are disabled via the guest\u0026apos;s XFD.  Because the kernel\nexecutes XRSTOR with the guest\u0026apos;s XFD, saving XSTATE_BV[i]=1 with XFD[i]=1\nwill cause XRSTOR to #NM and panic the kernel.\n\nE.g. if fpu_update_guest_xfd() sets XFD without clearing XSTATE_BV:\n\n  ------------[ cut here ]------------\n  WARNING: arch/x86/kernel/traps.c:1524 at exc_device_not_available+0x101/0x110, CPU#29: amx_test/848\n  Modules linked in: kvm_intel kvm irqbypass\n  CPU: 29 UID: 1000 PID: 848 Comm: amx_test Not tainted 6.19.0-rc2-ffa07f7fd437-x86_amx_nm_xfd_non_init-vm #171 NONE\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n  RIP: 0010:exc_device_not_available+0x101/0x110\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   asm_exc_device_not_available+0x1a/0x20\n  RIP: 0010:restore_fpregs_from_fpstate+0x36/0x90\n   switch_fpu_return+0x4a/0xb0\n   kvm_arch_vcpu_ioctl_run+0x1245/0x1e40 [kvm]\n   kvm_vcpu_ioctl+0x2c3/0x8f0 [kvm]\n   __x64_sys_ioctl+0x8f/0xd0\n   do_syscall_64+0x62/0x940\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n   \u0026lt;/TASK\u0026gt;\n  ---[ end trace 0000000000000000 ]---\n\nThis can happen if the guest executes WRMSR(MSR_IA32_XFD) to set XFD[18] = 1,\nand a host IRQ triggers kernel_fpu_begin() prior to the vmexit handler\u0026apos;s\ncall to fpu_update_guest_xfd().\n\nand if userspace stuffs XSTATE_BV[i]=1 via KVM_SET_XSAVE:\n\n  ------------[ cut here ]------------\n  WARNING: arch/x86/kernel/traps.c:1524 at exc_device_not_available+0x101/0x110, CPU#14: amx_test/867\n  Modules linked in: kvm_intel kvm irqbypass\n  CPU: 14 UID: 1000 PID: 867 Comm: amx_test Not tainted 6.19.0-rc2-2dace9faccd6-x86_amx_nm_xfd_non_init-vm #168 NONE\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n  RIP: 0010:exc_device_not_available+0x101/0x110\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   asm_exc_device_not_available+0x1a/0x20\n  RIP: 0010:restore_fpregs_from_fpstate+0x36/0x90\n   fpu_swap_kvm_fpstate+0x6b/0x120\n   kvm_load_guest_fpu+0x30/0x80 [kvm]\n   kvm_arch_vcpu_ioctl_run+0x85/0x1e40 [kvm]\n   kvm_vcpu_ioctl+0x2c3/0x8f0 [kvm]\n   __x64_sys_ioctl+0x8f/0xd0\n   do_syscall_64+0x62/0x940\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n   \u0026lt;/TASK\u0026gt;\n  ---[ end trace 0000000000000000 ]---\n\nThe new behavior is consistent with the AMX architecture.  Per Intel\u0026apos;s SDM,\nXSAVE saves XSTATE_BV as \u0026apos;0\u0026apos; for components that are disabled via XFD\n(and non-compacted XSAVE saves the initial configuration of the state\ncomponent):\n\n  If XSAVE, XSAVEC, XSAVEOPT, or XSAVES is saving the state component i,\n  the instruction does not generate #NM when XCR0[i] = IA32_XFD[i] = 1;\n  instead, it operates as if XINUSE[i] = 0 (and the state component was\n  in its initial state): it saves bit i of XSTATE_BV field of the XSAVE\n  header as 0; in addition, XSAVE saves the initial configuration of the\n  state component (the other instructions do not save state component i).\n\nAlternatively, KVM could always do XRSTOR with XFD=0, e.g. by using\na constant XFD based on the set of enabled features when XSAVEing for\na struct fpu_guest.  However, having XSTATE_BV[i]=1 for XFD-disabled\nfeatures can only happen in the above interrupt case, or in similar\nscenarios involving preemption on preemptible kernels, because\nfpu_swap_kvm_fpstate()\u0026apos;s call to save_fpregs_to_fpstate() saves the\noutgoing FPU state with the current XFD; and that is (on all but the\nfirst WRMSR to XFD) the guest XFD.\n\nTherefore, XFD can only go out of sync with XSTATE_BV in the above\ninterrupt case, or in similar scenarios involving preemption on\npreemptible kernels, and it we can consider it (de facto) part of KVM\nABI that KVM_GET_XSAVE returns XSTATE_BV[i]=0 for XFD-disabled features.\n\n[Move clea\n---truncated---(CVE-2026-23005)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv\n\nmlx5e_priv is an unstable structure that can be memset(0) if profile\nattaching fails.\n\nPass netdev to mlx5e_destroy_netdev() to guarantee it will work on a\nvalid netdev.\n\nOn mlx5e_remove: Check validity of priv-\u0026gt;profile, before attempting\nto cleanup any resources that might be not there.\n\nThis fixes a kernel oops in mlx5e_remove when switchdev mode fails due\nto change profile failure.\n\n$ devlink dev eswitch set pci/0000:00:03.0 mode switchdev\nError: mlx5_core: Failed setting eswitch to offloads.\ndmesg:\nworkqueue: Failed to create a rescuer kthread for wq \u0026quot;mlx5e\u0026quot;: -EINTR\nmlx5_core 0012:03:00.1: mlx5e_netdev_init_profile:6214:(pid 37199): mlx5e_priv_init failed, err=-12\nmlx5_core 0012:03:00.1 gpu3rdma1: mlx5e_netdev_change_profile: new profile init failed, -12\nworkqueue: Failed to create a rescuer kthread for wq \u0026quot;mlx5e\u0026quot;: -EINTR\nmlx5_core 0012:03:00.1: mlx5e_netdev_init_profile:6214:(pid 37199): mlx5e_priv_init failed, err=-12\nmlx5_core 0012:03:00.1 gpu3rdma1: mlx5e_netdev_change_profile: failed to rollback to orig profile, -12\n\n$ devlink dev reload pci/0000:00:03.0 ==\u0026gt; oops\n\nBUG: kernel NULL pointer dereference, address: 0000000000000370\nPGD 0 P4D 0\nOops: Oops: 0000 [#1] SMP NOPTI\nCPU: 15 UID: 0 PID: 520 Comm: devlink Not tainted 6.18.0-rc5+ #115 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014\nRIP: 0010:mlx5e_dcbnl_dscp_app+0x23/0x100\nRSP: 0018:ffffc9000083f8b8 EFLAGS: 00010286\nRAX: ffff8881126fc380 RBX: ffff8881015ac400 RCX: ffffffff826ffc45\nRDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8881035109c0\nRBP: ffff8881035109c0 R08: ffff888101e3e838 R09: ffff888100264e10\nR10: ffffc9000083f898 R11: ffffc9000083f8a0 R12: ffff888101b921a0\nR13: ffff888101b921a0 R14: ffff8881015ac9a0 R15: ffff8881015ac400\nFS:  00007f789a3c8740(0000) GS:ffff88856aa59000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000370 CR3: 000000010b6c0001 CR4: 0000000000370ef0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n mlx5e_remove+0x57/0x110\n device_release_driver_internal+0x19c/0x200\n bus_remove_device+0xc6/0x130\n device_del+0x160/0x3d0\n ? devl_param_driverinit_value_get+0x2d/0x90\n mlx5_detach_device+0x89/0xe0\n mlx5_unload_one_devl_locked+0x3a/0x70\n mlx5_devlink_reload_down+0xc8/0x220\n devlink_reload+0x7d/0x260\n devlink_nl_reload_doit+0x45b/0x5a0\n genl_family_rcv_msg_doit+0xe8/0x140(CVE-2026-23035)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Add recursion protection in kernel stack trace recording\n\nA bug was reported about an infinite recursion caused by tracing the rcu\nevents with the kernel stack trace trigger enabled. The stack trace code\ncalled back into RCU which then called the stack trace again.\n\nExpand the ftrace recursion protection to add a set of bits to protect\nevents from recursion. Each bit represents the context that the event is\nin (normal, softirq, interrupt and NMI).\n\nHave the stack trace code use the interrupt context to protect against\nrecursion.\n\nNote, the bug showed an issue in both the RCU code as well as the tracing\nstacktrace code. This only handles the tracing stack trace side of the\nbug. The RCU fix will be handled separately.(CVE-2026-23138)","status":"published","published":"2026-03-27T11:10:47Z","modified":"2026-08-18T01:19:44.306450654Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1760","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niommu/s390: Implement blocking domain\n\nThis fixes a crash when surprise hot-unplugging a PCI device. This crash\nhappens because during hot-unplug __iommu_group_set_domain_nofail()\nattaching the default domain fails when the platform no longer\nrecognizes the device as it has already been removed and we end up with\na NULL domain pointer and UAF. This is exactly the case referred to in\nthe second comment in __iommu_device_set_domain() and just as stated\nthere if we can instead attach the blocking domain the UAF is prevented\nas this can handle the already removed device. Implement the blocking\ndomain to use this handling.  With this change, the crash is fixed but\nwe still hit a warning attempting to change DMA ownership on a blocked\ndevice.(CVE-2024-53232)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niommu: Fix two issues in iommu_copy_struct_from_user()\n\nIn the review for iommu_copy_struct_to_user() helper, Matt pointed out that\na NULL pointer should be rejected prior to dereferencing it:\nhttps://lore.kernel.org/all/(CVE-2025-37900)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: Avoid race in open_cached_dir with lease breaks\n\nA pre-existing valid cfid returned from find_or_create_cached_dir might\nrace with a lease break, meaning open_cached_dir doesn\u0026apos;t consider it\nvalid, and thinks it\u0026apos;s newly-constructed. This leaks a dentry reference\nif the allocation occurs before the queued lease break work runs.\n\nAvoid the race by extending holding the cfid_list_lock across\nfind_or_create_cached_dir and when the result is checked.(CVE-2025-37954)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: prio: fix a race in prio_tune()\n\nGerrard Tai reported a race condition in PRIO, whenever SFQ perturb timer\nfires at the wrong time.\n\nThe race is as follows:\n\nCPU 0                                 CPU 1\n[1]: lock root\n[2]: qdisc_tree_flush_backlog()\n[3]: unlock root\n |\n |                                    [5]: lock root\n |                                    [6]: rehash\n |                                    [7]: qdisc_tree_reduce_backlog()\n |\n[4]: qdisc_put()\n\nThis can be abused to underflow a parent\u0026apos;s qlen.\n\nCalling qdisc_purge_queue() instead of qdisc_tree_flush_backlog()\nshould fix the race, because all packets will be purged from the qdisc\nbefore releasing the lock.(CVE-2025-38083)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nIB/mlx5: Fix potential deadlock in MR deregistration\n\nThe issue arises when kzalloc() is invoked while holding umem_mutex or\nany other lock acquired under umem_mutex. This is problematic because\nkzalloc() can trigger fs_reclaim_aqcuire(), which may, in turn, invoke\nmmu_notifier_invalidate_range_start(). This function can lead to\nmlx5_ib_invalidate_range(), which attempts to acquire umem_mutex again,\nresulting in a deadlock.\n\nThe problematic flow:\n             CPU0                      |              CPU1\n---------------------------------------|------------------------------------------------\nmlx5_ib_dereg_mr()                     |\n → revoke_mr()                         |\n   → mutex_lock(\u0026amp;umem_odp-\u0026gt;umem_mutex) |\n                                       | mlx5_mkey_cache_init()\n                                       |  → mutex_lock(\u0026amp;dev-\u0026gt;cache.rb_lock)\n                                       |  → mlx5r_cache_create_ent_locked()\n                                       |    → kzalloc(GFP_KERNEL)\n                                       |      → fs_reclaim()\n                                       |        → mmu_notifier_invalidate_range_start()\n                                       |          → mlx5_ib_invalidate_range()\n                                       |            → mutex_lock(\u0026amp;umem_odp-\u0026gt;umem_mutex)\n   → cache_ent_find_and_store()        |\n     → mutex_lock(\u0026amp;dev-\u0026gt;cache.rb_lock) |\n\nAdditionally, when kzalloc() is called from within\ncache_ent_find_and_store(), we encounter the same deadlock due to\nre-acquisition of umem_mutex.\n\nSolve by releasing umem_mutex in dereg_mr() after umr_revoke_mr()\nand before acquiring rb_lock. This ensures that we don\u0026apos;t hold\numem_mutex while performing memory allocations that could trigger\nthe reclaim path.\n\nThis change prevents the deadlock by ensuring proper lock ordering and\navoiding holding locks during memory allocation operations that could\ntrigger the reclaim path.\n\nThe following lockdep warning demonstrates the deadlock:\n\n python3/20557 is trying to acquire lock:\n ffff888387542128 (\u0026amp;umem_odp-\u0026gt;umem_mutex){+.+.}-{4:4}, at:\n mlx5_ib_invalidate_range+0x5b/0x550 [mlx5_ib]\n\n but task is already holding lock:\n ffffffff82f6b840 (mmu_notifier_invalidate_range_start){+.+.}-{0:0}, at:\n unmap_vmas+0x7b/0x1a0\n\n which lock already depends on the new lock.\n\n the existing dependency chain (in reverse order) is:\n\n -\u0026gt; #3 (mmu_notifier_invalidate_range_start){+.+.}-{0:0}:\n       fs_reclaim_acquire+0x60/0xd0\n       mem_cgroup_css_alloc+0x6f/0x9b0\n       cgroup_init_subsys+0xa4/0x240\n       cgroup_init+0x1c8/0x510\n       start_kernel+0x747/0x760\n       x86_64_start_reservations+0x25/0x30\n       x86_64_start_kernel+0x73/0x80\n       common_startup_64+0x129/0x138\n\n -\u0026gt; #2 (fs_reclaim){+.+.}-{0:0}:\n       fs_reclaim_acquire+0x91/0xd0\n       __kmalloc_cache_noprof+0x4d/0x4c0\n       mlx5r_cache_create_ent_locked+0x75/0x620 [mlx5_ib]\n       mlx5_mkey_cache_init+0x186/0x360 [mlx5_ib]\n       mlx5_ib_stage_post_ib_reg_umr_init+0x3c/0x60 [mlx5_ib]\n       __mlx5_ib_add+0x4b/0x190 [mlx5_ib]\n       mlx5r_probe+0xd9/0x320 [mlx5_ib]\n       auxiliary_bus_probe+0x42/0x70\n       really_probe+0xdb/0x360\n       __driver_probe_device+0x8f/0x130\n       driver_probe_device+0x1f/0xb0\n       __driver_attach+0xd4/0x1f0\n       bus_for_each_dev+0x79/0xd0\n       bus_add_driver+0xf0/0x200\n       driver_register+0x6e/0xc0\n       __auxiliary_driver_register+0x6a/0xc0\n       do_one_initcall+0x5e/0x390\n       do_init_module+0x88/0x240\n       init_module_from_file+0x85/0xc0\n       idempotent_init_module+0x104/0x300\n       __x64_sys_finit_module+0x68/0xc0\n       do_syscall_64+0x6d/0x140\n       entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\n -\u0026gt; #1 (\u0026amp;dev-\u0026gt;cache.rb_lock){+.+.}-{4:4}:\n       __mutex_lock+0x98/0xf10\n       __mlx5_ib_dereg_mr+0x6f2/0x890 [mlx5_ib]\n       mlx5_ib_dereg_mr+0x21/0x110 [mlx5_ib]\n       ib_dereg_mr_user+0x85/0x1f0 [ib_core]\n  \n---truncated---(CVE-2025-38373)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: Harden s32ton() against conversion to 0 bits\n\nTesting by the syzbot fuzzer showed that the HID core gets a\nshift-out-of-bounds exception when it tries to convert a 32-bit\nquantity to a 0-bit quantity.  Ideally this should never occur, but\nthere are buggy devices and some might have a report field with size\nset to zero; we shouldn\u0026apos;t reject the report or the device just because\nof that.\n\nInstead, harden the s32ton() routine so that it returns a reasonable\nresult instead of crashing when it is called with the number of bits\nset to 0 -- the same as what snto32() does.(CVE-2025-38556)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject narrower access to pointer ctx fields\n\nThe following BPF program, simplified from a syzkaller repro, causes a\nkernel warning:\n\n    r0 = *(u8 *)(r1 + 169);\n    exit;\n\nWith pointer field sk being at offset 168 in __sk_buff. This access is\ndetected as a narrower read in bpf_skb_is_valid_access because it\ndoesn\u0026apos;t match offsetof(struct __sk_buff, sk). It is therefore allowed\nand later proceeds to bpf_convert_ctx_access. Note that for the\n\u0026quot;is_narrower_load\u0026quot; case in the convert_ctx_accesses(), the insn-\u0026gt;off\nis aligned, so the cnt may not be 0 because it matches the\noffsetof(struct __sk_buff, sk) in the bpf_convert_ctx_access. However,\nthe target_size stays 0 and the verifier errors with a kernel warning:\n\n    verifier bug: error during ctx access conversion(1)\n\nThis patch fixes that to return a proper \u0026quot;invalid bpf_context access\noff=X size=Y\u0026quot; error on the load instruction.\n\nThe same issue affects multiple other fields in context structures that\nallow narrow access. Some other non-affected fields (for sk_msg,\nsk_lookup, and sockopt) were also changed to use bpf_ctx_range_ptr for\nconsistency.\n\nNote this syzkaller crash was reported in the \u0026quot;Closes\u0026quot; link below, which\nused to be about a different bug, fixed in\ncommit fce7bd8e385a (\u0026quot;bpf/verifier: Handle BPF_LOAD_ACQ instructions\nin insn_def_regno()\u0026quot;). Because syzbot somehow confused the two bugs,\nthe new crash and repro didn\u0026apos;t get reported to the mailing list.(CVE-2025-38591)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: No more self recovery\n\nWhen a node withdraws and it turns out that it is the only node that has\nthe filesystem mounted, gfs2 currently tries to replay the local journal\nto bring the filesystem back into a consistent state.  Not only is that\na very bad idea, it has also never worked because gfs2_recover_func()\nwill refuse to do anything during a withdraw.\n\nHowever, before even getting to this point, gfs2_recover_func()\ndereferences sdp-\u0026gt;sd_jdesc-\u0026gt;jd_inode.  This was a use-after-free before\ncommit 04133b607a78 (\u0026quot;gfs2: Prevent double iput for journal on error\u0026quot;)\nand is a NULL pointer dereference since then.\n\nSimply get rid of self recovery to fix that.(CVE-2025-38659)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/net: commit partial buffers on retry\n\nRing provided buffers are potentially only valid within the single\nexecution context in which they were acquired. io_uring deals with this\nand invalidates them on retry. But on the networking side, if\nMSG_WAITALL is set, or if the socket is of the streaming type and too\nlittle was processed, then it will hang on to the buffer rather than\nrecycle or commit it. This is problematic for two reasons:\n\n1) If someone unregisters the provided buffer ring before a later retry,\n   then the req-\u0026gt;buf_list will no longer be valid.\n\n2) If multiple sockers are using the same buffer group, then multiple\n   receives can consume the same memory. This can cause data corruption\n   in the application, as either receive could land in the same\n   userspace buffer.\n\nFix this by disallowing partial retries from pinning a provided buffer\nacross multiple executions, if ring provided buffers are used.(CVE-2025-38730)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmedia: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()\n\nIn the interrupt handler rain_interrupt(), the buffer full check on\nrain-\u0026gt;buf_len is performed before acquiring rain-\u0026gt;buf_lock. This\ncreates a Time-of-Check to Time-of-Use (TOCTOU) race condition, as\nrain-\u0026gt;buf_len is concurrently accessed and modified in the work\nhandler rain_irq_work_handler() under the same lock.\n\nMultiple interrupt invocations can race, with each reading buf_len\nbefore it becomes full and then proceeding. This can lead to both\ninterrupts attempting to write to the buffer, incrementing buf_len\nbeyond its capacity (DATA_SIZE) and causing a buffer overflow.\n\nFix this bug by moving the spin_lock() to before the buffer full\ncheck. This ensures that the check and the subsequent buffer modification\nare performed atomically, preventing the race condition. An corresponding\nspin_unlock() is added to the overflow path to correctly release the\nlock.\n\nThis possible bug was found by an experimental static analysis tool\ndeveloped by our team.(CVE-2025-39713)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niommu/amd/pgtbl: Fix possible race while increase page table level\n\nThe AMD IOMMU host page table implementation supports dynamic page table levels\n(up to 6 levels), starting with a 3-level configuration that expands based on\nIOVA address. The kernel maintains a root pointer and current page table level\nto enable proper page table walks in alloc_pte()/fetch_pte() operations.\n\nThe IOMMU IOVA allocator initially starts with 32-bit address and onces its\nexhuasted it switches to 64-bit address (max address is determined based\non IOMMU and device DMA capability). To support larger IOVA, AMD IOMMU\ndriver increases page table level.\n\nBut in unmap path (iommu_v1_unmap_pages()), fetch_pte() reads\npgtable-\u0026gt;[root/mode] without lock. So its possible that in exteme corner case,\nwhen increase_address_space() is updating pgtable-\u0026gt;[root/mode], fetch_pte()\nreads wrong page table level (pgtable-\u0026gt;mode). It does compare the value with\nlevel encoded in page table and returns NULL. This will result is\niommu_unmap ops to fail and upper layer may retry/log WARN_ON.\n\nCPU 0                                         CPU 1\n------                                       ------\nmap pages                                    unmap pages\nalloc_pte() -\u0026gt; increase_address_space()      iommu_v1_unmap_pages() -\u0026gt; fetch_pte()\n  pgtable-\u0026gt;root = pte (new root value)\n                                             READ pgtable-\u0026gt;[mode/root]\n\t\t\t\t\t       Reads new root, old mode\n  Updates mode (pgtable-\u0026gt;mode += 1)\n\nSince Page table level updates are infrequent and already synchronized with a\nspinlock, implement seqcount to enable lock-free read operations on the read path.(CVE-2025-39961)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: check the return value of pinmux_ops::get_function_name()\n\nWhile the API contract in docs doesn\u0026apos;t specify it explicitly, the\ngeneric implementation of the get_function_name() callback from struct\npinmux_ops - pinmux_generic_get_function_name() - can fail and return\nNULL. This is already checked in pinmux_check_ops() so add a similar\ncheck in pinmux_func_name_to_selector() instead of passing the returned\npointer right down to strcmp() where the NULL can get dereferenced. This\nis normal operation when adding new pinfunctions.(CVE-2025-40030)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies\n\nWhen adding dependencies with drm_sched_job_add_dependency(), that\nfunction consumes the fence reference both on success and failure, so in\nthe latter case the dma_fence_put() on the error path (xarray failed to\nexpand) is a double free.\n\nInterestingly this bug appears to have been present ever since\ncommit ebd5f74255b9 (\u0026quot;drm/sched: Add dependency tracking\u0026quot;), since the code\nback then looked like this:\n\ndrm_sched_job_add_implicit_dependencies():\n...\n       for (i = 0; i \u0026lt; fence_count; i++) {\n               ret = drm_sched_job_add_dependency(job, fences[i]);\n               if (ret)\n                       break;\n       }\n\n       for (; i \u0026lt; fence_count; i++)\n               dma_fence_put(fences[i]);\n\nWhich means for the failing \u0026apos;i\u0026apos; the dma_fence_put was already a double\nfree. Possibly there were no users at that time, or the test cases were\ninsufficient to hit it.\n\nThe bug was then only noticed and fixed after\ncommit 9c2ba265352a (\u0026quot;drm/scheduler: use new iterator in drm_sched_job_add_implicit_dependencies v2\u0026quot;)\nlanded, with its fixup of\ncommit 4eaf02d6076c (\u0026quot;drm/scheduler: fix drm_sched_job_add_implicit_dependencies\u0026quot;).\n\nAt that point it was a slightly different flavour of a double free, which\ncommit 963d0b356935 (\u0026quot;drm/scheduler: fix drm_sched_job_add_implicit_dependencies harder\u0026quot;)\nnoticed and attempted to fix.\n\nBut it only moved the double free from happening inside the\ndrm_sched_job_add_dependency(), when releasing the reference not yet\nobtained, to the caller, when releasing the reference already released by\nthe former in the failure case.\n\nAs such it is not easy to identify the right target for the fixes tag so\nlets keep it simple and just continue the chain.\n\nWhile fixing we also improve the comment and explain the reason for taking\nthe reference and not dropping it.(CVE-2025-40096)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: delete x-\u0026gt;tunnel as we delete x\n\nThe ipcomp fallback tunnels currently get deleted (from the various\nlists and hashtables) as the last user state that needed that fallback\nis destroyed (not deleted). If a reference to that user state still\nexists, the fallback state will remain on the hashtables/lists,\ntriggering the WARN in xfrm_state_fini. Because of those remaining\nreferences, the fix in commit f75a2804da39 (\u0026quot;xfrm: destroy xfrm_state\nsynchronously on net exit path\u0026quot;) is not complete.\n\nWe recently fixed one such situation in TCP due to defered freeing of\nskbs (commit 9b6412e6979f (\u0026quot;tcp: drop secpath at the same time as we\ncurrently drop dst\u0026quot;)). This can also happen due to IP reassembly: skbs\nwith a secpath remain on the reassembly queue until netns\ndestruction. If we can\u0026apos;t guarantee that the queues are flushed by the\ntime xfrm_state_fini runs, there may still be references to a (user)\nxfrm_state, preventing the timely deletion of the corresponding\nfallback state.\n\nInstead of chasing each instance of skbs holding a secpath one by one,\nthis patch fixes the issue directly within xfrm, by deleting the\nfallback state as soon as the last user state depending on it has been\ndeleted. Destruction will still happen when the final reference is\ndropped.\n\nA separate lockdep class for the fallback state is required since\nwe\u0026apos;re going to lock x-\u0026gt;tunnel while x is locked.(CVE-2025-40215)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfuse: fix livelock in synchronous file put from fuseblk workers\n\nI observed a hang when running generic/323 against a fuseblk server.\nThis test opens a file, initiates a lot of AIO writes to that file\ndescriptor, and closes the file descriptor before the writes complete.\nUnsurprisingly, the AIO exerciser threads are mostly stuck waiting for\nresponses from the fuseblk server:\n\n# cat /proc/372265/task/372313/stack\n[\u0026lt;0\u0026gt;] request_wait_answer+0x1fe/0x2a0 [fuse]\n[\u0026lt;0\u0026gt;] __fuse_simple_request+0xd3/0x2b0 [fuse]\n[\u0026lt;0\u0026gt;] fuse_do_getattr+0xfc/0x1f0 [fuse]\n[\u0026lt;0\u0026gt;] fuse_file_read_iter+0xbe/0x1c0 [fuse]\n[\u0026lt;0\u0026gt;] aio_read+0x130/0x1e0\n[\u0026lt;0\u0026gt;] io_submit_one+0x542/0x860\n[\u0026lt;0\u0026gt;] __x64_sys_io_submit+0x98/0x1a0\n[\u0026lt;0\u0026gt;] do_syscall_64+0x37/0xf0\n[\u0026lt;0\u0026gt;] entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\nBut the /weird/ part is that the fuseblk server threads are waiting for\nresponses from itself:\n\n# cat /proc/372210/task/372232/stack\n[\u0026lt;0\u0026gt;] request_wait_answer+0x1fe/0x2a0 [fuse]\n[\u0026lt;0\u0026gt;] __fuse_simple_request+0xd3/0x2b0 [fuse]\n[\u0026lt;0\u0026gt;] fuse_file_put+0x9a/0xd0 [fuse]\n[\u0026lt;0\u0026gt;] fuse_release+0x36/0x50 [fuse]\n[\u0026lt;0\u0026gt;] __fput+0xec/0x2b0\n[\u0026lt;0\u0026gt;] task_work_run+0x55/0x90\n[\u0026lt;0\u0026gt;] syscall_exit_to_user_mode+0xe9/0x100\n[\u0026lt;0\u0026gt;] do_syscall_64+0x43/0xf0\n[\u0026lt;0\u0026gt;] entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\nThe fuseblk server is fuse2fs so there\u0026apos;s nothing all that exciting in\nthe server itself.  So why is the fuse server calling fuse_file_put?\nThe commit message for the fstest sheds some light on that:\n\n\u0026quot;By closing the file descriptor before calling io_destroy, you pretty\nmuch guarantee that the last put on the ioctx will be done in interrupt\ncontext (during I/O completion).\n\nAha.  AIO fgets a new struct file from the fd when it queues the ioctx.\nThe completion of the FUSE_WRITE command from userspace causes the fuse\nserver to call the AIO completion function.  The completion puts the\nstruct file, queuing a delayed fput to the fuse server task.  When the\nfuse server task returns to userspace, it has to run the delayed fput,\nwhich in the case of a fuseblk server, it does synchronously.\n\nSending the FUSE_RELEASE command sychronously from fuse server threads\nis a bad idea because a client program can initiate enough simultaneous\nAIOs such that all the fuse server threads end up in delayed_fput, and\nnow there aren\u0026apos;t any threads left to handle the queued fuse commands.\n\nFix this by only using asynchronous fputs when closing files, and leave\na comment explaining why.(CVE-2025-40220)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfs/notify: call exportfs_encode_fid with s_umount\n\nCalling intotify_show_fdinfo() on fd watching an overlayfs inode, while\nthe overlayfs is being unmounted, can lead to dereferencing NULL ptr.\n\nThis issue was found by syzkaller.\n\nRace Condition Diagram:\n\nThread 1                           Thread 2\n--------                           --------\n\ngeneric_shutdown_super()\n shrink_dcache_for_umount\n  sb-\u0026gt;s_root = NULL\n\n                    |\n                    |             vfs_read()\n                    |              inotify_fdinfo()\n                    |               * inode get from mark *\n                    |               show_mark_fhandle(m, inode)\n                    |                exportfs_encode_fid(inode, ..)\n                    |                 ovl_encode_fh(inode, ..)\n                    |                  ovl_check_encode_origin(inode)\n                    |                   * deref i_sb-\u0026gt;s_root *\n                    |\n                    |\n                    v\n fsnotify_sb_delete(sb)\n\nWhich then leads to:\n\n[   32.133461] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI\n[   32.134438] KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]\n[   32.135032] CPU: 1 UID: 0 PID: 4468 Comm: systemd-coredum Not tainted 6.17.0-rc6 #22 PREEMPT(none)\n\n\u0026lt;snip registers, unreliable trace\u0026gt;\n\n[   32.143353] Call Trace:\n[   32.143732]  ovl_encode_fh+0xd5/0x170\n[   32.144031]  exportfs_encode_inode_fh+0x12f/0x300\n[   32.144425]  show_mark_fhandle+0xbe/0x1f0\n[   32.145805]  inotify_fdinfo+0x226/0x2d0\n[   32.146442]  inotify_show_fdinfo+0x1c5/0x350\n[   32.147168]  seq_show+0x530/0x6f0\n[   32.147449]  seq_read_iter+0x503/0x12a0\n[   32.148419]  seq_read+0x31f/0x410\n[   32.150714]  vfs_read+0x1f0/0x9e0\n[   32.152297]  ksys_read+0x125/0x240\n\nIOW ovl_check_encode_origin derefs inode-\u0026gt;i_sb-\u0026gt;s_root, after it was set\nto NULL in the unmount path.\n\nFix it by protecting calling exportfs_encode_fid() from\nshow_mark_fhandle() with s_umount lock.\n\nThis form of fix was suggested by Amir in [1].\n\n[1]: https://lore.kernel.org/all/CAOQ4uxhbDwhb+2Brs1UdkoF0a3NSdBAOQPNfEHjahrgoKJpLEw@mail.gmail.com/(CVE-2025-40237)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Fix unlikely race in gdlm_put_lock\n\nIn gdlm_put_lock(), there is a small window of time in which the\nDFL_UNMOUNT flag has been set but the lockspace hasn\u0026apos;t been released,\nyet.  In that window, dlm may still call gdlm_ast() and gdlm_bast().\nTo prevent it from dereferencing freed glock objects, only free the\nglock if the lockspace has actually been released.(CVE-2025-40242)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndevlink: rate: Unset parent pointer in devl_rate_nodes_destroy\n\nThe function devl_rate_nodes_destroy is documented to \u0026quot;Unset parent for\nall rate objects\u0026quot;. However, it was only calling the driver-specific\n`rate_leaf_parent_set` or `rate_node_parent_set` ops and decrementing\nthe parent\u0026apos;s refcount, without actually setting the\n`devlink_rate-\u0026gt;parent` pointer to NULL.\n\nThis leaves a dangling pointer in the `devlink_rate` struct, which cause\nrefcount error in netdevsim[1] and mlx5[2]. In addition, this is\ninconsistent with the behavior of `devlink_nl_rate_parent_node_set`,\nwhere the parent pointer is correctly cleared.\n\nThis patch fixes the issue by explicitly setting `devlink_rate-\u0026gt;parent`\nto NULL after notifying the driver, thus fulfilling the function\u0026apos;s\ndocumented behavior for all rate objects.\n\n[1]\nrepro steps:\necho 1 \u0026gt; /sys/bus/netdevsim/new_device\ndevlink dev eswitch set netdevsim/netdevsim1 mode switchdev\necho 1 \u0026gt; /sys/bus/netdevsim/devices/netdevsim1/sriov_numvfs\ndevlink port function rate add netdevsim/netdevsim1/test_node\ndevlink port function rate set netdevsim/netdevsim1/128 parent test_node\necho 1 \u0026gt; /sys/bus/netdevsim/del_device\n\ndmesg:\nrefcount_t: decrement hit 0; leaking memory.\nWARNING: CPU: 8 PID: 1530 at lib/refcount.c:31 refcount_warn_saturate+0x42/0xe0\nCPU: 8 UID: 0 PID: 1530 Comm: bash Not tainted 6.18.0-rc4+ #1 NONE\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\nRIP: 0010:refcount_warn_saturate+0x42/0xe0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n devl_rate_leaf_destroy+0x8d/0x90\n __nsim_dev_port_del+0x6c/0x70 [netdevsim]\n nsim_dev_reload_destroy+0x11c/0x140 [netdevsim]\n nsim_drv_remove+0x2b/0xb0 [netdevsim]\n device_release_driver_internal+0x194/0x1f0\n bus_remove_device+0xc6/0x130\n device_del+0x159/0x3c0\n device_unregister+0x1a/0x60\n del_device_store+0x111/0x170 [netdevsim]\n kernfs_fop_write_iter+0x12e/0x1e0\n vfs_write+0x215/0x3d0\n ksys_write+0x5f/0xd0\n do_syscall_64+0x55/0x10f0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\n[2]\ndevlink dev eswitch set pci/0000:08:00.0 mode switchdev\ndevlink port add pci/0000:08:00.0 flavour pcisf pfnum 0 sfnum 1000\ndevlink port function rate add pci/0000:08:00.0/group1\ndevlink port function rate set pci/0000:08:00.0/32768 parent group1\nmodprobe -r mlx5_ib mlx5_fwctl mlx5_core\n\ndmesg:\nrefcount_t: decrement hit 0; leaking memory.\nWARNING: CPU: 7 PID: 16151 at lib/refcount.c:31 refcount_warn_saturate+0x42/0xe0\nCPU: 7 UID: 0 PID: 16151 Comm: bash Not tainted 6.17.0-rc7_for_upstream_min_debug_2025_10_02_12_44 #1 NONE\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\nRIP: 0010:refcount_warn_saturate+0x42/0xe0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n devl_rate_leaf_destroy+0x8d/0x90\n mlx5_esw_offloads_devlink_port_unregister+0x33/0x60 [mlx5_core]\n mlx5_esw_offloads_unload_rep+0x3f/0x50 [mlx5_core]\n mlx5_eswitch_unload_sf_vport+0x40/0x90 [mlx5_core]\n mlx5_sf_esw_event+0xc4/0x120 [mlx5_core]\n notifier_call_chain+0x33/0xa0\n blocking_notifier_call_chain+0x3b/0x50\n mlx5_eswitch_disable_locked+0x50/0x110 [mlx5_core]\n mlx5_eswitch_disable+0x63/0x90 [mlx5_core]\n mlx5_unload+0x1d/0x170 [mlx5_core]\n mlx5_uninit_one+0xa2/0x130 [mlx5_core]\n remove_one+0x78/0xd0 [mlx5_core]\n pci_device_remove+0x39/0xa0\n device_release_driver_internal+0x194/0x1f0\n unbind_store+0x99/0xa0\n kernfs_fop_write_iter+0x12e/0x1e0\n vfs_write+0x215/0x3d0\n ksys_write+0x5f/0xd0\n do_syscall_64+0x53/0x1f0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53(CVE-2025-40251)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfs/proc: fix uaf in proc_readdir_de()\n\nPde is erased from subdir rbtree through rb_erase(), but not set the node\nto EMPTY, which may result in uaf access.  We should use RB_CLEAR_NODE()\nset the erased node to EMPTY, then pde_subdir_next() will return NULL to\navoid uaf access.\n\nWe found an uaf issue while using stress-ng testing, need to run testcase\ngetdent and tun in the same time.  The steps of the issue is as follows:\n\n1) use getdent to traverse dir /proc/pid/net/dev_snmp6/, and current\n   pde is tun3;\n\n2) in the [time windows] unregister netdevice tun3 and tun2, and erase\n   them from rbtree.  erase tun3 first, and then erase tun2.  the\n   pde(tun2) will be released to slab;\n\n3) continue to getdent process, then pde_subdir_next() will return\n   pde(tun2) which is released, it will case uaf access.\n\nCPU 0                                      |    CPU 1\n-------------------------------------------------------------------------\ntraverse dir /proc/pid/net/dev_snmp6/      |   unregister_netdevice(tun-\u0026gt;dev)   //tun3 tun2\nsys_getdents64()                           |\n  iterate_dir()                            |\n    proc_readdir()                         |\n      proc_readdir_de()                    |     snmp6_unregister_dev()\n        pde_get(de);                       |       proc_remove()\n        read_unlock(\u0026amp;proc_subdir_lock);    |         remove_proc_subtree()\n                                           |           write_lock(\u0026amp;proc_subdir_lock);\n        [time window]                      |           rb_erase(\u0026amp;root-\u0026gt;subdir_node, \u0026amp;parent-\u0026gt;subdir);\n                                           |           write_unlock(\u0026amp;proc_subdir_lock);\n        read_lock(\u0026amp;proc_subdir_lock);      |\n        next = pde_subdir_next(de);        |\n        pde_put(de);                       |\n        de = next;    //UAF                |\n\nrbtree of dev_snmp6\n                        |\n                    pde(tun3)\n                     /    \\\n                  NULL  pde(tun2)(CVE-2025-40271)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/secretmem: fix use-after-free race in fault handler\n\nWhen a page fault occurs in a secret memory file created with\n`memfd_secret(2)`, the kernel will allocate a new folio for it, mark the\nunderlying page as not-present in the direct map, and add it to the file\nmapping.\n\nIf two tasks cause a fault in the same page concurrently, both could end\nup allocating a folio and removing the page from the direct map, but only\none would succeed in adding the folio to the file mapping.  The task that\nfailed undoes the effects of its attempt by (a) freeing the folio again\nand (b) putting the page back into the direct map.  However, by doing\nthese two operations in this order, the page becomes available to the\nallocator again before it is placed back in the direct mapping.\n\nIf another task attempts to allocate the page between (a) and (b), and the\nkernel tries to access it via the direct map, it would result in a\nsupervisor not-present page fault.\n\nFix the ordering to restore the direct map before the folio is freed.(CVE-2025-40272)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE\n\nThis data originates from userspace and is used in buffer offset\ncalculations which could potentially overflow causing an out-of-bounds\naccess.(CVE-2025-40277)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern()\n\nIn the parse_adv_monitor_pattern() function, the value of\nthe \u0026apos;length\u0026apos; variable is currently limited to HCI_MAX_EXT_AD_LENGTH(251).\nThe size of the \u0026apos;value\u0026apos; array in the mgmt_adv_pattern structure is 31.\nIf the value of \u0026apos;pattern[i].length\u0026apos; is set in the user space\nand exceeds 31, the \u0026apos;patterns[i].value\u0026apos; array can be accessed\nout of bound when copied.\n\nIncreasing the size of the \u0026apos;value\u0026apos; array in\nthe \u0026apos;mgmt_adv_pattern\u0026apos; structure will break the userspace.\nConsidering this, and to avoid OOB access revert the limits for \u0026apos;offset\u0026apos;\nand \u0026apos;length\u0026apos; back to the value of HCI_MAX_AD_LENGTH.\n\nFound by InfoTeCS on behalf of Linux Verification Center\n(linuxtesting.org) with SVACE.(CVE-2025-40294)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: validate skb length for unknown CC opcode\n\nIn hci_cmd_complete_evt(), if the command complete event has an unknown\nopcode, we assume the first byte of the remaining skb-\u0026gt;data contains the\nreturn status. However, parameter data has previously been pulled in\nhci_event_func(), which may leave the skb empty. If so, using skb-\u0026gt;data[0]\nfor the return status uses un-init memory.\n\nThe fix is to check skb-\u0026gt;len before using skb-\u0026gt;data.(CVE-2025-40301)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: bcsp: receive data only if registered\n\nCurrently, bcsp_recv() can be called even when the BCSP protocol has not\nbeen registered. This leads to a NULL pointer dereference, as shown in\nthe following stack trace:\n\n    KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f]\n    RIP: 0010:bcsp_recv+0x13d/0x1740 drivers/bluetooth/hci_bcsp.c:590\n    Call Trace:\n     \u0026lt;TASK\u0026gt;\n     hci_uart_tty_receive+0x194/0x220 drivers/bluetooth/hci_ldisc.c:627\n     tiocsti+0x23c/0x2c0 drivers/tty/tty_io.c:2290\n     tty_ioctl+0x626/0xde0 drivers/tty/tty_io.c:2706\n     vfs_ioctl fs/ioctl.c:51 [inline]\n     __do_sys_ioctl fs/ioctl.c:907 [inline]\n     __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893\n     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n     do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94\n     entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nTo prevent this, ensure that the HCI_UART_REGISTERED flag is set before\nprocessing received data. If the protocol is not registered, return\n-EUNATCH.(CVE-2025-40308)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once\n\nhci_cmd_sync_dequeue_once() does lookup and then cancel\nthe entry under two separate lock sections. Meanwhile,\nhci_cmd_sync_work() can also delete the same entry,\nleading to double list_del() and \u0026quot;UAF\u0026quot;.\n\nFix this by holding cmd_sync_work_lock across both\nlookup and cancel, so that the entry cannot be removed\nconcurrently.(CVE-2025-40318)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Don\u0026apos;t leak robust_list pointer on exec race\n\nsys_get_robust_list() and compat_get_robust_list() use ptrace_may_access()\nto check if the calling task is allowed to access another task\u0026apos;s\nrobust_list pointer. This check is racy against a concurrent exec() in the\ntarget process.\n\nDuring exec(), a task may transition from a non-privileged binary to a\nprivileged one (e.g., setuid binary) and its credentials/memory mappings\nmay change. If get_robust_list() performs ptrace_may_access() before\nthis transition, it may erroneously allow access to sensitive information\nafter the target becomes privileged.\n\nA racy access allows an attacker to exploit a window during which\nptrace_may_access() passes before a target process transitions to a\nprivileged state via exec().\n\nFor example, consider a non-privileged task T that is about to execute a\nsetuid-root binary. An attacker task A calls get_robust_list(T) while T\nis still unprivileged. Since ptrace_may_access() checks permissions\nbased on current credentials, it succeeds. However, if T begins exec\nimmediately afterwards, it becomes privileged and may change its memory\nmappings. Because get_robust_list() proceeds to access T-\u0026gt;robust_list\nwithout synchronizing with exec() it may read user-space pointers from a\nnow-privileged process.\n\nThis violates the intended post-exec access restrictions and could\nexpose sensitive memory addresses or be used as a primitive in a larger\nexploit chain. Consequently, the race can lead to unauthorized\ndisclosure of information across privilege boundaries and poses a\npotential security risk.\n\nTake a read lock on signal-\u0026gt;exec_update_lock prior to invoking\nptrace_may_access() and accessing the robust_list/compat_robust_list.\nThis ensures that the target task\u0026apos;s exec state remains stable during the\ncheck, allowing for consistent and synchronized validation of\ncredentials.(CVE-2025-40341)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvme-fc: use lock accessing port_state and rport state\n\nnvme_fc_unregister_remote removes the remote port on a lport object at\nany point in time when there is no active association. This races with\nwith the reconnect logic, because nvme_fc_create_association is not\ntaking a lock to check the port_state and atomically increase the\nactive count on the rport.(CVE-2025-40342)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-fc: avoid scheduling association deletion twice\n\nWhen forcefully shutting down a port via the configfs interface,\nnvmet_port_subsys_drop_link() first calls nvmet_port_del_ctrls() and\nthen nvmet_disable_port(). Both functions will eventually schedule all\nremaining associations for deletion.\n\nThe current implementation checks whether an association is about to be\nremoved, but only after the work item has already been scheduled. As a\nresult, it is possible for the first scheduled work item to free all\nresources, and then for the same work item to be scheduled again for\ndeletion.\n\nBecause the association list is an RCU list, it is not possible to take\na lock and remove the list entry directly, so it cannot be looked up\nagain. Instead, a flag (terminating) must be used to determine whether\nthe association is already in the process of being deleted.(CVE-2025-40343)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\narch_topology: Fix incorrect error check in topology_parse_cpu_capacity()\n\nFix incorrect use of PTR_ERR_OR_ZERO() in topology_parse_cpu_capacity()\nwhich causes the code to proceed with NULL clock pointers. The current\nlogic uses !PTR_ERR_OR_ZERO(cpu_clk) which evaluates to true for both\nvalid pointers and NULL, leading to potential NULL pointer dereference\nin clk_get_rate().\n\nPer include/linux/err.h documentation, PTR_ERR_OR_ZERO(ptr) returns:\n\u0026quot;The error code within @ptr if it is an error pointer; 0 otherwise.\u0026quot;\n\nThis means PTR_ERR_OR_ZERO() returns 0 for both valid pointers AND NULL\npointers. Therefore !PTR_ERR_OR_ZERO(cpu_clk) evaluates to true (proceed)\nwhen cpu_clk is either valid or NULL, causing clk_get_rate(NULL) to be\ncalled when of_clk_get() returns NULL.\n\nReplace with !IS_ERR_OR_NULL(cpu_clk) which only proceeds for valid\npointers, preventing potential NULL pointer dereference in clk_get_rate().(CVE-2025-40346)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nhfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat()\n\nThe syzbot reported issue in hfsplus_delete_cat():\n\n[   70.682285][ T9333] =====================================================\n[   70.682943][ T9333] BUG: KMSAN: uninit-value in hfsplus_subfolders_dec+0x1d7/0x220\n[   70.683640][ T9333]  hfsplus_subfolders_dec+0x1d7/0x220\n[   70.684141][ T9333]  hfsplus_delete_cat+0x105d/0x12b0\n[   70.684621][ T9333]  hfsplus_rmdir+0x13d/0x310\n[   70.685048][ T9333]  vfs_rmdir+0x5ba/0x810\n[   70.685447][ T9333]  do_rmdir+0x964/0xea0\n[   70.685833][ T9333]  __x64_sys_rmdir+0x71/0xb0\n[   70.686260][ T9333]  x64_sys_call+0xcd8/0x3cf0\n[   70.686695][ T9333]  do_syscall_64+0xd9/0x1d0\n[   70.687119][ T9333]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[   70.687646][ T9333]\n[   70.687856][ T9333] Uninit was stored to memory at:\n[   70.688311][ T9333]  hfsplus_subfolders_inc+0x1c2/0x1d0\n[   70.688779][ T9333]  hfsplus_create_cat+0x148e/0x1800\n[   70.689231][ T9333]  hfsplus_mknod+0x27f/0x600\n[   70.689730][ T9333]  hfsplus_mkdir+0x5a/0x70\n[   70.690146][ T9333]  vfs_mkdir+0x483/0x7a0\n[   70.690545][ T9333]  do_mkdirat+0x3f2/0xd30\n[   70.690944][ T9333]  __x64_sys_mkdir+0x9a/0xf0\n[   70.691380][ T9333]  x64_sys_call+0x2f89/0x3cf0\n[   70.691816][ T9333]  do_syscall_64+0xd9/0x1d0\n[   70.692229][ T9333]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[   70.692773][ T9333]\n[   70.692990][ T9333] Uninit was stored to memory at:\n[   70.693469][ T9333]  hfsplus_subfolders_inc+0x1c2/0x1d0\n[   70.693960][ T9333]  hfsplus_create_cat+0x148e/0x1800\n[   70.694438][ T9333]  hfsplus_fill_super+0x21c1/0x2700\n[   70.694911][ T9333]  mount_bdev+0x37b/0x530\n[   70.695320][ T9333]  hfsplus_mount+0x4d/0x60\n[   70.695729][ T9333]  legacy_get_tree+0x113/0x2c0\n[   70.696167][ T9333]  vfs_get_tree+0xb3/0x5c0\n[   70.696588][ T9333]  do_new_mount+0x73e/0x1630\n[   70.697013][ T9333]  path_mount+0x6e3/0x1eb0\n[   70.697425][ T9333]  __se_sys_mount+0x733/0x830\n[   70.697857][ T9333]  __x64_sys_mount+0xe4/0x150\n[   70.698269][ T9333]  x64_sys_call+0x2691/0x3cf0\n[   70.698704][ T9333]  do_syscall_64+0xd9/0x1d0\n[   70.699117][ T9333]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[   70.699730][ T9333]\n[   70.699946][ T9333] Uninit was created at:\n[   70.700378][ T9333]  __alloc_pages_noprof+0x714/0xe60\n[   70.700843][ T9333]  alloc_pages_mpol_noprof+0x2a2/0x9b0\n[   70.701331][ T9333]  alloc_pages_noprof+0xf8/0x1f0\n[   70.701774][ T9333]  allocate_slab+0x30e/0x1390\n[   70.702194][ T9333]  ___slab_alloc+0x1049/0x33a0\n[   70.702635][ T9333]  kmem_cache_alloc_lru_noprof+0x5ce/0xb20\n[   70.703153][ T9333]  hfsplus_alloc_inode+0x5a/0xd0\n[   70.703598][ T9333]  alloc_inode+0x82/0x490\n[   70.703984][ T9333]  iget_locked+0x22e/0x1320\n[   70.704428][ T9333]  hfsplus_iget+0x5c/0xba0\n[   70.704827][ T9333]  hfsplus_btree_open+0x135/0x1dd0\n[   70.705291][ T9333]  hfsplus_fill_super+0x1132/0x2700\n[   70.705776][ T9333]  mount_bdev+0x37b/0x530\n[   70.706171][ T9333]  hfsplus_mount+0x4d/0x60\n[   70.706579][ T9333]  legacy_get_tree+0x113/0x2c0\n[   70.707019][ T9333]  vfs_get_tree+0xb3/0x5c0\n[   70.707444][ T9333]  do_new_mount+0x73e/0x1630\n[   70.707865][ T9333]  path_mount+0x6e3/0x1eb0\n[   70.708270][ T9333]  __se_sys_mount+0x733/0x830\n[   70.708711][ T9333]  __x64_sys_mount+0xe4/0x150\n[   70.709158][ T9333]  x64_sys_call+0x2691/0x3cf0\n[   70.709630][ T9333]  do_syscall_64+0xd9/0x1d0\n[   70.710053][ T9333]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[   70.710611][ T9333]\n[   70.710842][ T9333] CPU: 3 UID: 0 PID: 9333 Comm: repro Not tainted 6.12.0-rc6-dirty #17\n[   70.711568][ T9333] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[   70.712490][ T9333] =====================================================\n[   70.713085][ T9333] Disabling lock debugging due to kernel taint\n[   70.713618][ T9333] Kernel panic - not syncing: kmsan.panic set ...\n[   70.714159][ T9333] \n---truncated---(CVE-2025-40351)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nriscv: stacktrace: Disable KASAN checks for non-current tasks\n\nUnwinding the stack of a task other than current, KASAN would report\n\u0026quot;BUG: KASAN: out-of-bounds in walk_stackframe+0x41c/0x460\u0026quot;\n\nThere is a same issue on x86 and has been resolved by the commit\n84936118bdf3 (\u0026quot;x86/unwind: Disable KASAN checks for non-current tasks\u0026quot;)\nThe solution could be applied to RISC-V too.\n\nThis patch also can solve the issue:\nhttps://seclists.org/oss-sec/2025/q4/23\n\n[(CVE-2025-40358)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/intel: Fix KASAN global-out-of-bounds warning\n\nWhen running \u0026quot;perf mem record\u0026quot; command on CWF, the below KASAN\nglobal-out-of-bounds warning is seen.\n\n  ==================================================================\n  BUG: KASAN: global-out-of-bounds in cmt_latency_data+0x176/0x1b0\n  Read of size 4 at addr ffffffffb721d000 by task dtlb/9850\n\n  Call Trace:\n\n   kasan_report+0xb8/0xf0\n   cmt_latency_data+0x176/0x1b0\n   setup_arch_pebs_sample_data+0xf49/0x2560\n   intel_pmu_drain_arch_pebs+0x577/0xb00\n   handle_pmi_common+0x6c4/0xc80\n\nThe issue is caused by below code in __grt_latency_data(). The code\ntries to access x86_hybrid_pmu structure which doesn\u0026apos;t exist on\nnon-hybrid platform like CWF.\n\n        WARN_ON_ONCE(hybrid_pmu(event-\u0026gt;pmu)-\u0026gt;pmu_type == hybrid_big)\n\nSo add is_hybrid() check before calling this WARN_ON_ONCE to fix the\nglobal-out-of-bounds access issue.(CVE-2025-40359)\n\nRejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.(CVE-2025-40361)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nx86/fpu: Ensure XFD state on signal delivery\n\nSean reported [1] the following splat when running KVM tests:\n\n   WARNING: CPU: 232 PID: 15391 at xfd_validate_state+0x65/0x70\n   Call Trace:\n    \u0026lt;TASK\u0026gt;\n    fpu__clear_user_states+0x9c/0x100\n    arch_do_signal_or_restart+0x142/0x210\n    exit_to_user_mode_loop+0x55/0x100\n    do_syscall_64+0x205/0x2c0\n    entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\nChao further identified [2] a reproducible scenario involving signal\ndelivery: a non-AMX task is preempted by an AMX-enabled task which\nmodifies the XFD MSR.\n\nWhen the non-AMX task resumes and reloads XSTATE with init values,\na warning is triggered due to a mismatch between fpstate::xfd and the\nCPU\u0026apos;s current XFD state. fpu__clear_user_states() does not currently\nre-synchronize the XFD state after such preemption.\n\nInvoke xfd_update_state() which detects and corrects the mismatch if\nthere is a dynamic feature.\n\nThis also benefits the sigreturn path, as fpu__restore_sig() may call\nfpu__clear_user_states() when the sigframe is inaccessible.\n\n[ dhansen: minor changelog munging ](CVE-2025-68171)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Fix softlockup in ftrace_module_enable\n\nA soft lockup was observed when loading amdgpu module.\nIf a module has a lot of tracable functions, multiple calls\nto kallsyms_lookup can spend too much time in RCU critical\nsection and with disabled preemption, causing kernel panic.\nThis is the same issue that was fixed in\ncommit d0b24b4e91fc (\u0026quot;ftrace: Prevent RCU stall on PREEMPT_VOLUNTARY\nkernels\u0026quot;) and commit 42ea22e754ba (\u0026quot;ftrace: Add cond_resched() to\nftrace_graph_set_hash()\u0026quot;).\n\nFix it the same way by adding cond_resched() in ftrace_module_enable.(CVE-2025-68173)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\namd/amdkfd: enhance kfd process check in switch partition\n\ncurrent switch partition only check if kfd_processes_table is empty.\nkfd_prcesses_table entry is deleted in kfd_process_notifier_release, but\nkfd_process tear down is in kfd_process_wq_release.\n\nconsider two processes:\n\nProcess A (workqueue) -\u0026gt; kfd_process_wq_release -\u0026gt; Access kfd_node member\nProcess B switch partition -\u0026gt; amdgpu_xcp_pre_partition_switch -\u0026gt; amdgpu_amdkfd_device_fini_sw\n-\u0026gt; kfd_node tear down.\n\nProcess A and B may trigger a race as shown in dmesg log.\n\nThis patch is to resolve the race by adding an atomic kfd_process counter\nkfd_processes_count, it increment as create kfd process, decrement as\nfinish kfd_process_wq_release.\n\nv2: Put kfd_processes_count per kfd_dev, move decrement to kfd_process_destroy_pdds\nand bug fix. (Philip Yang)\n\n[3966658.307702] divide error: 0000 [#1] SMP NOPTI\n[3966658.350818]  i10nm_edac\n[3966658.356318] CPU: 124 PID: 38435 Comm: kworker/124:0 Kdump: loaded Tainted\n[3966658.356890] Workqueue: kfd_process_wq kfd_process_wq_release [amdgpu]\n[3966658.362839]  nfit\n[3966658.366457] RIP: 0010:kfd_get_num_sdma_engines+0x17/0x40 [amdgpu]\n[3966658.366460] Code: 00 00 e9 ac 81 02 00 66 66 2e 0f 1f 84 00 00 00 00 00 90 0f 1f 44 00 00 48 8b 4f 08 48 8b b7 00 01 00 00 8b 81 58 26 03 00 99 \u0026lt;f7\u0026gt; be b8 01 00 00 80 b9 70 2e 00 00 00 74 0b 83 f8 02 ba 02 00 00\n[3966658.380967]  x86_pkg_temp_thermal\n[3966658.391529] RSP: 0018:ffffc900a0edfdd8 EFLAGS: 00010246\n[3966658.391531] RAX: 0000000000000008 RBX: ffff8974e593b800 RCX: ffff888645900000\n[3966658.391531] RDX: 0000000000000000 RSI: ffff888129154400 RDI: ffff888129151c00\n[3966658.391532] RBP: ffff8883ad79d400 R08: 0000000000000000 R09: ffff8890d2750af4\n[3966658.391532] R10: 0000000000000018 R11: 0000000000000018 R12: 0000000000000000\n[3966658.391533] R13: ffff8883ad79d400 R14: ffffe87ff662ba00 R15: ffff8974e593b800\n[3966658.391533] FS:  0000000000000000(0000) GS:ffff88fe7f600000(0000) knlGS:0000000000000000\n[3966658.391534] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[3966658.391534] CR2: 0000000000d71000 CR3: 000000dd0e970004 CR4: 0000000002770ee0\n[3966658.391535] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[3966658.391535] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400\n[3966658.391536] PKRU: 55555554\n[3966658.391536] Call Trace:\n[3966658.391674]  deallocate_sdma_queue+0x38/0xa0 [amdgpu]\n[3966658.391762]  process_termination_cpsch+0x1ed/0x480 [amdgpu]\n[3966658.399754]  intel_powerclamp\n[3966658.402831]  kfd_process_dequeue_from_all_devices+0x5b/0xc0 [amdgpu]\n[3966658.402908]  kfd_process_wq_release+0x1a/0x1a0 [amdgpu]\n[3966658.410516]  coretemp\n[3966658.434016]  process_one_work+0x1ad/0x380\n[3966658.434021]  worker_thread+0x49/0x310\n[3966658.438963]  kvm_intel\n[3966658.446041]  ? process_one_work+0x380/0x380\n[3966658.446045]  kthread+0x118/0x140\n[3966658.446047]  ? __kthread_bind_mask+0x60/0x60\n[3966658.446050]  ret_from_fork+0x1f/0x30\n[3966658.446053] Modules linked in: kpatch_20765354(OEK)\n[3966658.455310]  kvm\n[3966658.464534]  mptcp_diag xsk_diag raw_diag unix_diag af_packet_diag netlink_diag udp_diag act_pedit act_mirred act_vlan cls_flower kpatch_21951273(OEK) kpatch_18424469(OEK) kpatch_19749756(OEK)\n[3966658.473462]  idxd_mdev\n[3966658.482306]  kpatch_17971294(OEK) sch_ingress xt_conntrack amdgpu(OE) amdxcp(OE) amddrm_buddy(OE) amd_sched(OE) amdttm(OE) amdkcl(OE) intel_ifs iptable_mangle tcm_loop target_core_pscsi tcp_diag target_core_file inet_diag target_core_iblock target_core_user target_core_mod coldpgs kpatch_18383292(OEK) ip6table_nat ip6table_filter ip6_tables ip_set_hash_ipportip ip_set_hash_ipportnet ip_set_hash_ipport ip_set_bitmap_port xt_comment iptable_nat nf_nat iptable_filter ip_tables ip_set ip_vs_sh ip_vs_wrr ip_vs_rr ip_vs nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 sn_core_odd(OE) i40e overlay binfmt_misc tun bonding(OE) aisqos(OE) aisqo\n---truncated---(CVE-2025-68174)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nPCI: cadence: Check for the existence of cdns_pcie::ops before using it\n\ncdns_pcie::ops might not be populated by all the Cadence glue drivers. This\nis going to be true for the upcoming Sophgo platform which doesn\u0026apos;t set the\nops.\n\nHence, add a check to prevent NULL pointer dereference.\n\n[mani: reworded subject and description](CVE-2025-68176)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check()\n\nUse RCU to avoid a pair of atomic operations and a potential\nUAF on dst_dev()-\u0026gt;flags.(CVE-2025-68188)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Add bpf_prog_run_data_pointers()\n\nsyzbot found that cls_bpf_classify() is able to change\ntc_skb_cb(skb)-\u0026gt;drop_reason triggering a warning in sk_skb_reason_drop().\n\nWARNING: CPU: 0 PID: 5965 at net/core/skbuff.c:1192 __sk_skb_reason_drop net/core/skbuff.c:1189 [inline]\nWARNING: CPU: 0 PID: 5965 at net/core/skbuff.c:1192 sk_skb_reason_drop+0x76/0x170 net/core/skbuff.c:1214\n\nstruct tc_skb_cb has been added in commit ec624fe740b4 (\u0026quot;net/sched:\nExtend qdisc control block with tc control block\u0026quot;), which added a wrong\ninteraction with db58ba459202 (\u0026quot;bpf: wire in data and data_end for\ncls_act_bpf\u0026quot;).\n\ndrop_reason was added later.\n\nAdd bpf_prog_run_data_pointers() helper to save/restore the net_sched\nstorage colliding with BPF data_meta/data_end.(CVE-2025-68200)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_ct: add seqadj extension for natted connections\n\nSequence adjustment may be required for FTP traffic with PASV/EPSV modes.\ndue to need to re-write packet payload (IP, port) on the ftp control\nconnection. This can require changes to the TCP length and expected\nseq / ack_seq.\n\nThe easiest way to reproduce this issue is with PASV mode.\nExample ruleset:\ntable inet ftp_nat {\n        ct helper ftp_helper {\n                type \u0026quot;ftp\u0026quot; protocol tcp\n                l3proto inet\n        }\n\n        chain prerouting {\n                type filter hook prerouting priority 0; policy accept;\n                tcp dport 21 ct state new ct helper set \u0026quot;ftp_helper\u0026quot;\n        }\n}\ntable ip nat {\n        chain prerouting {\n                type nat hook prerouting priority -100; policy accept;\n                tcp dport 21 dnat ip prefix to ip daddr map {\n\t\t\t192.168.100.1 : 192.168.13.2/32 }\n        }\n\n        chain postrouting {\n                type nat hook postrouting priority 100 ; policy accept;\n                tcp sport 21 snat ip prefix to ip saddr map {\n\t\t\t192.168.13.2 : 192.168.100.1/32 }\n        }\n}\n\nNote that the ftp helper gets assigned *after* the dnat setup.\n\nThe inverse (nat after helper assign) is handled by an existing\ncheck in nf_nat_setup_info() and will not show the problem.\n\nTopoloy:\n\n +-------------------+     +----------------------------------+\n | FTP: 192.168.13.2 | \u0026lt;-\u0026gt; | NAT: 192.168.13.3, 192.168.100.1 |\n +-------------------+     +----------------------------------+\n                                      |\n                         +-----------------------+\n                         | Client: 192.168.100.2 |\n                         +-----------------------+\n\nftp nat changes do not work as expected in this case:\nConnected to 192.168.100.1.\n[..]\nftp\u0026gt; epsv\nEPSV/EPRT on IPv4 off.\nftp\u0026gt; ls\n227 Entering passive mode (192,168,100,1,209,129).\n421 Service not available, remote server has closed connection.\n\nKernel logs:\nMissing nfct_seqadj_ext_add() setup call\nWARNING: CPU: 1 PID: 0 at net/netfilter/nf_conntrack_seqadj.c:41\n[..]\n __nf_nat_mangle_tcp_packet+0x100/0x160 [nf_nat]\n nf_nat_ftp+0x142/0x280 [nf_nat_ftp]\n help+0x4d1/0x880 [nf_conntrack_ftp]\n nf_confirm+0x122/0x2e0 [nf_conntrack]\n nf_hook_slow+0x3c/0xb0\n ..\n\nFix this by adding the required extension when a conntrack helper is assigned\nto a connection that has a nat binding.(CVE-2025-68206)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: account for current allocated stack depth in widen_imprecise_scalars()\n\nThe usage pattern for widen_imprecise_scalars() looks as follows:\n\n    prev_st = find_prev_entry(env, ...);\n    queued_st = push_stack(...);\n    widen_imprecise_scalars(env, prev_st, queued_st);\n\nWhere prev_st is an ancestor of the queued_st in the explored states\ntree. This ancestor is not guaranteed to have same allocated stack\ndepth as queued_st. E.g. in the following case:\n\n    def main():\n      for i in 1..2:\n        foo(i)        // same callsite, differnt param\n\n    def foo(i):\n      if i == 1:\n        use 128 bytes of stack\n      iterator based loop\n\nHere, for a second \u0026apos;foo\u0026apos; call prev_st-\u0026gt;allocated_stack is 128,\nwhile queued_st-\u0026gt;allocated_stack is much smaller.\nwiden_imprecise_scalars() needs to take this into account and avoid\naccessing bpf_verifier_state-\u0026gt;frame[*]-\u0026gt;stack out of bounds.(CVE-2025-68208)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntimers: Fix NULL function pointer race in timer_shutdown_sync()\n\nThere is a race condition between timer_shutdown_sync() and timer\nexpiration that can lead to hitting a WARN_ON in expire_timers().\n\nThe issue occurs when timer_shutdown_sync() clears the timer function\nto NULL while the timer is still running on another CPU. The race\nscenario looks like this:\n\nCPU0\t\t\t\t\tCPU1\n\t\t\t\t\t\u0026lt;SOFTIRQ\u0026gt;\n\t\t\t\t\tlock_timer_base()\n\t\t\t\t\texpire_timers()\n\t\t\t\t\tbase-\u0026gt;running_timer = timer;\n\t\t\t\t\tunlock_timer_base()\n\t\t\t\t\t[call_timer_fn enter]\n\t\t\t\t\tmod_timer()\n\t\t\t\t\t...\ntimer_shutdown_sync()\nlock_timer_base()\n// For now, will not detach the timer but only clear its function to NULL\nif (base-\u0026gt;running_timer != timer)\n\tret = detach_if_pending(timer, base, true);\nif (shutdown)\n\ttimer-\u0026gt;function = NULL;\nunlock_timer_base()\n\t\t\t\t\t[call_timer_fn exit]\n\t\t\t\t\tlock_timer_base()\n\t\t\t\t\tbase-\u0026gt;running_timer = NULL;\n\t\t\t\t\tunlock_timer_base()\n\t\t\t\t\t...\n\t\t\t\t\t// Now timer is pending while its function set to NULL.\n\t\t\t\t\t// next timer trigger\n\t\t\t\t\t\u0026lt;SOFTIRQ\u0026gt;\n\t\t\t\t\texpire_timers()\n\t\t\t\t\tWARN_ON_ONCE(!fn) // hit\n\t\t\t\t\t...\nlock_timer_base()\n// Now timer will detach\nif (base-\u0026gt;running_timer != timer)\n\tret = detach_if_pending(timer, base, true);\nif (shutdown)\n\ttimer-\u0026gt;function = NULL;\nunlock_timer_base()\n\nThe problem is that timer_shutdown_sync() clears the timer function\nregardless of whether the timer is currently running. This can leave a\npending timer with a NULL function pointer, which triggers the\nWARN_ON_ONCE(!fn) check in expire_timers().\n\nFix this by only clearing the timer function when actually detaching the\ntimer. If the timer is running, leave the function pointer intact, which is\nsafe because the timer will be properly detached when it finishes running.(CVE-2025-68214)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot\n\nnvkm_falcon_fw::boot is allocated, but no one frees it. This causes a\nkmemleak warning.\n\nMake sure this data is deallocated.(CVE-2025-68235)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Don\u0026apos;t skip unrelated instruction if INT3/INTO is replaced\n\nWhen re-injecting a soft interrupt from an INT3, INT0, or (select) INTn\ninstruction, discard the exception and retry the instruction if the code\nstream is changed (e.g. by a different vCPU) between when the CPU\nexecutes the instruction and when KVM decodes the instruction to get the\nnext RIP.\n\nAs effectively predicted by commit 6ef88d6e36c2 (\u0026quot;KVM: SVM: Re-inject\nINT3/INTO instead of retrying the instruction\u0026quot;), failure to verify that\nthe correct INTn instruction was decoded can effectively clobber guest\nstate due to decoding the wrong instruction and thus specifying the\nwrong next RIP.\n\nThe bug most often manifests as \u0026quot;Oops: int3\u0026quot; panics on static branch\nchecks in Linux guests.  Enabling or disabling a static branch in Linux\nuses the kernel\u0026apos;s \u0026quot;text poke\u0026quot; code patching mechanism.  To modify code\nwhile other CPUs may be executing that code, Linux (temporarily)\nreplaces the first byte of the original instruction with an int3 (opcode\n0xcc), then patches in the new code stream except for the first byte,\nand finally replaces the int3 with the first byte of the new code\nstream.  If a CPU hits the int3, i.e. executes the code while it\u0026apos;s being\nmodified, then the guest kernel must look up the RIP to determine how to\nhandle the #BP, e.g. by emulating the new instruction.  If the RIP is\nincorrect, then this lookup fails and the guest kernel panics.\n\nThe bug reproduces almost instantly by hacking the guest kernel to\nrepeatedly check a static branch[1] while running a drgn script[2] on\nthe host to constantly swap out the memory containing the guest\u0026apos;s TSS.\n\n[1]: https://gist.github.com/osandov/44d17c51c28c0ac998ea0334edf90b5a\n[2]: https://gist.github.com/osandov/10e45e45afa29b11e0c7209247afc00b(CVE-2025-68259)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\next4: add i_data_sem protection in ext4_destroy_inline_data_nolock()\n\nFix a race between inline data destruction and block mapping.\n\nThe function ext4_destroy_inline_data_nolock() changes the inode data\nlayout by clearing EXT4_INODE_INLINE_DATA and setting EXT4_INODE_EXTENTS.\nAt the same time, another thread may execute ext4_map_blocks(), which\ntests EXT4_INODE_EXTENTS to decide whether to call ext4_ext_map_blocks()\nor ext4_ind_map_blocks().\n\nWithout i_data_sem protection, ext4_ind_map_blocks() may receive inode\nwith EXT4_INODE_EXTENTS flag and triggering assert.\n\nkernel BUG at fs/ext4/indirect.c:546!\nEXT4-fs (loop2): unmounting filesystem.\ninvalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014\nRIP: 0010:ext4_ind_map_blocks.cold+0x2b/0x5a fs/ext4/indirect.c:546\n\nCall Trace:\n \u0026lt;TASK\u0026gt;\n ext4_map_blocks+0xb9b/0x16f0 fs/ext4/inode.c:681\n _ext4_get_block+0x242/0x590 fs/ext4/inode.c:822\n ext4_block_write_begin+0x48b/0x12c0 fs/ext4/inode.c:1124\n ext4_write_begin+0x598/0xef0 fs/ext4/inode.c:1255\n ext4_da_write_begin+0x21e/0x9c0 fs/ext4/inode.c:3000\n generic_perform_write+0x259/0x5d0 mm/filemap.c:3846\n ext4_buffered_write_iter+0x15b/0x470 fs/ext4/file.c:285\n ext4_file_write_iter+0x8e0/0x17f0 fs/ext4/file.c:679\n call_write_iter include/linux/fs.h:2271 [inline]\n do_iter_readv_writev+0x212/0x3c0 fs/read_write.c:735\n do_iter_write+0x186/0x710 fs/read_write.c:861\n vfs_iter_write+0x70/0xa0 fs/read_write.c:902\n iter_file_splice_write+0x73b/0xc90 fs/splice.c:685\n do_splice_from fs/splice.c:763 [inline]\n direct_splice_actor+0x10f/0x170 fs/splice.c:950\n splice_direct_to_actor+0x33a/0xa10 fs/splice.c:896\n do_splice_direct+0x1a9/0x280 fs/splice.c:1002\n do_sendfile+0xb13/0x12c0 fs/read_write.c:1255\n __do_sys_sendfile64 fs/read_write.c:1323 [inline]\n __se_sys_sendfile64 fs/read_write.c:1309 [inline]\n __x64_sys_sendfile64+0x1cf/0x210 fs/read_write.c:1309\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81\n entry_SYSCALL_64_after_hwframe+0x6e/0xd8(CVE-2025-68261)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\next4: refresh inline data size before write operations\n\nThe cached ei-\u0026gt;i_inline_size can become stale between the initial size\ncheck and when ext4_update_inline_data()/ext4_create_inline_data() use\nit. Although ext4_get_max_inline_size() reads the correct value at the\ntime of the check, concurrent xattr operations can modify i_inline_size\nbefore ext4_write_lock_xattr() is acquired.\n\nThis causes ext4_update_inline_data() and ext4_create_inline_data() to\nwork with stale capacity values, leading to a BUG_ON() crash in\next4_write_inline_data():\n\n  kernel BUG at fs/ext4/inline.c:1331!\n  BUG_ON(pos + len \u0026gt; EXT4_I(inode)-\u0026gt;i_inline_size);\n\nThe race window:\n1. ext4_get_max_inline_size() reads i_inline_size = 60 (correct)\n2. Size check passes for 50-byte write\n3. [Another thread adds xattr, i_inline_size changes to 40]\n4. ext4_write_lock_xattr() acquires lock\n5. ext4_update_inline_data() uses stale i_inline_size = 60\n6. Attempts to write 50 bytes but only 40 bytes actually available\n7. BUG_ON() triggers\n\nFix this by recalculating i_inline_size via ext4_find_inline_data_nolock()\nimmediately after acquiring xattr_sem. This ensures ext4_update_inline_data()\nand ext4_create_inline_data() work with current values that are protected\nfrom concurrent modifications.\n\nThis is similar to commit a54c4613dac1 (\u0026quot;ext4: fix race writing to an\ninline_data file while its xattrs are changing\u0026quot;) which fixed i_inline_off\nstaleness. This patch addresses the related i_inline_size staleness issue.(CVE-2025-68264)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvme: fix admin request_queue lifetime\n\nThe namespaces can access the controller\u0026apos;s admin request_queue, and\nstale references on the namespaces may exist after tearing down the\ncontroller. Ensure the admin request_queue is active by moving the\ncontroller\u0026apos;s \u0026apos;put\u0026apos; to after all controller references have been released\nto ensure no one is can access the request_queue. This fixes a reported\nuse-after-free bug:\n\n  BUG: KASAN: slab-use-after-free in blk_queue_enter+0x41c/0x4a0\n  Read of size 8 at addr ffff88c0a53819f8 by task nvme/3287\n  CPU: 67 UID: 0 PID: 3287 Comm: nvme Tainted: G            E       6.13.2-ga1582f1a031e #15\n  Tainted: [E]=UNSIGNED_MODULE\n  Hardware name: Jabil /EGS 2S MB1, BIOS 1.00 06/18/2025\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   dump_stack_lvl+0x4f/0x60\n   print_report+0xc4/0x620\n   ? _raw_spin_lock_irqsave+0x70/0xb0\n   ? _raw_read_unlock_irqrestore+0x30/0x30\n   ? blk_queue_enter+0x41c/0x4a0\n   kasan_report+0xab/0xe0\n   ? blk_queue_enter+0x41c/0x4a0\n   blk_queue_enter+0x41c/0x4a0\n   ? __irq_work_queue_local+0x75/0x1d0\n   ? blk_queue_start_drain+0x70/0x70\n   ? irq_work_queue+0x18/0x20\n   ? vprintk_emit.part.0+0x1cc/0x350\n   ? wake_up_klogd_work_func+0x60/0x60\n   blk_mq_alloc_request+0x2b7/0x6b0\n   ? __blk_mq_alloc_requests+0x1060/0x1060\n   ? __switch_to+0x5b7/0x1060\n   nvme_submit_user_cmd+0xa9/0x330\n   nvme_user_cmd.isra.0+0x240/0x3f0\n   ? force_sigsegv+0xe0/0xe0\n   ? nvme_user_cmd64+0x400/0x400\n   ? vfs_fileattr_set+0x9b0/0x9b0\n   ? cgroup_update_frozen_flag+0x24/0x1c0\n   ? cgroup_leave_frozen+0x204/0x330\n   ? nvme_ioctl+0x7c/0x2c0\n   blkdev_ioctl+0x1a8/0x4d0\n   ? blkdev_common_ioctl+0x1930/0x1930\n   ? fdget+0x54/0x380\n   __x64_sys_ioctl+0x129/0x190\n   do_syscall_64+0x5b/0x160\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n  RIP: 0033:0x7f765f703b0b\n  Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 8b 0d dd 52 0f 00 f7 d8 64 89 01 48\n  RSP: 002b:00007ffe2cefe808 EFLAGS: 00000202 ORIG_RAX: 0000000000000010\n  RAX: ffffffffffffffda RBX: 00007ffe2cefe860 RCX: 00007f765f703b0b\n  RDX: 00007ffe2cefe860 RSI: 00000000c0484e41 RDI: 0000000000000003\n  RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000000\n  R10: 00007f765f611d50 R11: 0000000000000202 R12: 0000000000000003\n  R13: 00000000c0484e41 R14: 0000000000000001 R15: 00007ffe2cefea60\n   \u0026lt;/TASK\u0026gt;(CVE-2025-68265)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix crash in process_v2_sparse_read() for encrypted directories\n\nThe crash in process_v2_sparse_read() for fscrypt-encrypted directories\nhas been reported. Issue takes place for Ceph msgr2 protocol in secure\nmode. It can be reproduced by the steps:\n\nsudo mount -t ceph :/ /mnt/cephfs/ -o name=admin,fs=cephfs,ms_mode=secure\n\n(1) mkdir /mnt/cephfs/fscrypt-test-3\n(2) cp area_decrypted.tar /mnt/cephfs/fscrypt-test-3\n(3) fscrypt encrypt --source=raw_key --key=./my.key /mnt/cephfs/fscrypt-test-3\n(4) fscrypt lock /mnt/cephfs/fscrypt-test-3\n(5) fscrypt unlock --key=my.key /mnt/cephfs/fscrypt-test-3\n(6) cat /mnt/cephfs/fscrypt-test-3/area_decrypted.tar\n(7) Issue has been triggered\n\n[  408.072247] ------------[ cut here ]------------\n[  408.072251] WARNING: CPU: 1 PID: 392 at net/ceph/messenger_v2.c:865\nceph_con_v2_try_read+0x4b39/0x72f0\n[  408.072267] Modules linked in: intel_rapl_msr intel_rapl_common\nintel_uncore_frequency_common intel_pmc_core pmt_telemetry pmt_discovery\npmt_class intel_pmc_ssram_telemetry intel_vsec kvm_intel joydev kvm irqbypass\npolyval_clmulni ghash_clmulni_intel aesni_intel rapl input_leds psmouse\nserio_raw i2c_piix4 vga16fb bochs vgastate i2c_smbus floppy mac_hid qemu_fw_cfg\npata_acpi sch_fq_codel rbd msr parport_pc ppdev lp parport efi_pstore\n[  408.072304] CPU: 1 UID: 0 PID: 392 Comm: kworker/1:3 Not tainted 6.17.0-rc7+\n[  408.072307] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\n1.17.0-5.fc42 04/01/2014\n[  408.072310] Workqueue: ceph-msgr ceph_con_workfn\n[  408.072314] RIP: 0010:ceph_con_v2_try_read+0x4b39/0x72f0\n[  408.072317] Code: c7 c1 20 f0 d4 ae 50 31 d2 48 c7 c6 60 27 d5 ae 48 c7 c7 f8\n8e 6f b0 68 60 38 d5 ae e8 00 47 61 fe 48 83 c4 18 e9 ac fc ff ff \u0026lt;0f\u0026gt; 0b e9 06\nfe ff ff 4c 8b 9d 98 fd ff ff 0f 84 64 e7 ff ff 89 85\n[  408.072319] RSP: 0018:ffff88811c3e7a30 EFLAGS: 00010246\n[  408.072322] RAX: ffffed1024874c6f RBX: ffffea00042c2b40 RCX: 0000000000000f38\n[  408.072324] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\n[  408.072325] RBP: ffff88811c3e7ca8 R08: 0000000000000000 R09: 00000000000000c8\n[  408.072326] R10: 00000000000000c8 R11: 0000000000000000 R12: 00000000000000c8\n[  408.072327] R13: dffffc0000000000 R14: ffff8881243a6030 R15: 0000000000003000\n[  408.072329] FS:  0000000000000000(0000) GS:ffff88823eadf000(0000)\nknlGS:0000000000000000\n[  408.072331] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  408.072332] CR2: 000000c0003c6000 CR3: 000000010c106005 CR4: 0000000000772ef0\n[  408.072336] PKRU: 55555554\n[  408.072337] Call Trace:\n[  408.072338]  \u0026lt;TASK\u0026gt;\n[  408.072340]  ? sched_clock_noinstr+0x9/0x10\n[  408.072344]  ? __pfx_ceph_con_v2_try_read+0x10/0x10\n[  408.072347]  ? _raw_spin_unlock+0xe/0x40\n[  408.072349]  ? finish_task_switch.isra.0+0x15d/0x830\n[  408.072353]  ? __kasan_check_write+0x14/0x30\n[  408.072357]  ? mutex_lock+0x84/0xe0\n[  408.072359]  ? __pfx_mutex_lock+0x10/0x10\n[  408.072361]  ceph_con_workfn+0x27e/0x10e0\n[  408.072364]  ? metric_delayed_work+0x311/0x2c50\n[  408.072367]  process_one_work+0x611/0xe20\n[  408.072371]  ? __kasan_check_write+0x14/0x30\n[  408.072373]  worker_thread+0x7e3/0x1580\n[  408.072375]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n[  408.072378]  ? __pfx_worker_thread+0x10/0x10\n[  408.072381]  kthread+0x381/0x7a0\n[  408.072383]  ? __pfx__raw_spin_lock_irq+0x10/0x10\n[  408.072385]  ? __pfx_kthread+0x10/0x10\n[  408.072387]  ? __kasan_check_write+0x14/0x30\n[  408.072389]  ? recalc_sigpending+0x160/0x220\n[  408.072392]  ? _raw_spin_unlock_irq+0xe/0x50\n[  408.072394]  ? calculate_sigpending+0x78/0xb0\n[  408.072395]  ? __pfx_kthread+0x10/0x10\n[  408.072397]  ret_from_fork+0x2b6/0x380\n[  408.072400]  ? __pfx_kthread+0x10/0x10\n[  408.072402]  ret_from_fork_asm+0x1a/0x30\n[  408.072406]  \u0026lt;/TASK\u0026gt;\n[  408.072407] ---[ end trace 0000000000000000 ]---\n[  408.072418] Oops: general protection fault, probably for non-canonical\naddress 0xdffffc00000000\n---truncated---(CVE-2025-68297)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nPCI/AER: Fix NULL pointer access by aer_info\n\nThe kzalloc(GFP_KERNEL) may return NULL, so all accesses to aer_info-\u0026gt;xxx\nwill result in kernel panic. Fix it.(CVE-2025-68309)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer\n\nWhen a UAS device is unplugged during data transfer, there is\na probability of a system panic occurring. The root cause is\nan access to an invalid memory address during URB callback handling.\nSpecifically, this happens when the dma_direct_unmap_sg() function\nis called within the usb_hcd_unmap_urb_for_dma() interface, but the\nsg-\u0026gt;dma_address field is 0 and the sg data structure has already been\nfreed.\n\nThe SCSI driver sends transfer commands by invoking uas_queuecommand_lck()\nin uas.c, using the uas_submit_urbs() function to submit requests to USB.\nWithin the uas_submit_urbs() implementation, three URBs (sense_urb,\ndata_urb, and cmd_urb) are sequentially submitted. Device removal may\noccur at any point during uas_submit_urbs execution, which may result\nin URB submission failure. However, some URBs might have been successfully\nsubmitted before the failure, and uas_submit_urbs will return the -ENODEV\nerror code in this case. The current error handling directly calls\nscsi_done(). In the SCSI driver, this eventually triggers scsi_complete()\nto invoke scsi_end_request() for releasing the sgtable. The successfully\nsubmitted URBs, when being unlinked to giveback, call\nusb_hcd_unmap_urb_for_dma() in hcd.c, leading to exceptions during sg\nunmapping operations since the sg data structure has already been freed.\n\nThis patch modifies the error condition check in the uas_submit_urbs()\nfunction. When a UAS device is removed but one or more URBs have already\nbeen successfully submitted to USB, it avoids immediately invoking\nscsi_done() and save the cmnd to devinfo-\u0026gt;cmnd array. If the successfully\nsubmitted URBs is completed before devinfo-\u0026gt;resetting being set, then\nthe scsi_done() function will be called within uas_try_complete() after\nall pending URB operations are finalized. Otherwise, the scsi_done()\nfunction will be called within uas_zap_pending(), which is executed after\nusb_kill_anchored_urbs().\n\nThe error handling only takes effect when uas_queuecommand_lck() calls\nuas_submit_urbs() and returns the error value -ENODEV . In this case,\nthe device is disconnected, and the flow proceeds to uas_disconnect(),\nwhere uas_zap_pending() is invoked to call uas_try_complete().(CVE-2025-68331)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\njbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted\n\nThere\u0026apos;s issue when file system corrupted:\n------------[ cut here ]------------\nkernel BUG at fs/jbd2/transaction.c:1289!\nOops: invalid opcode: 0000 [#1] SMP KASAN PTI\nCPU: 5 UID: 0 PID: 2031 Comm: mkdir Not tainted 6.18.0-rc1-next\nRIP: 0010:jbd2_journal_get_create_access+0x3b6/0x4d0\nRSP: 0018:ffff888117aafa30 EFLAGS: 00010202\nRAX: 0000000000000000 RBX: ffff88811a86b000 RCX: ffffffff89a63534\nRDX: 1ffff110200ec602 RSI: 0000000000000004 RDI: ffff888100763010\nRBP: ffff888100763000 R08: 0000000000000001 R09: ffff888100763028\nR10: 0000000000000003 R11: 0000000000000000 R12: 0000000000000000\nR13: ffff88812c432000 R14: ffff88812c608000 R15: ffff888120bfc000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f91d6970c99 CR3: 00000001159c4000 CR4: 00000000000006f0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n __ext4_journal_get_create_access+0x42/0x170\n ext4_getblk+0x319/0x6f0\n ext4_bread+0x11/0x100\n ext4_append+0x1e6/0x4a0\n ext4_init_new_dir+0x145/0x1d0\n ext4_mkdir+0x326/0x920\n vfs_mkdir+0x45c/0x740\n do_mkdirat+0x234/0x2f0\n __x64_sys_mkdir+0xd6/0x120\n do_syscall_64+0x5f/0xfa0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nThe above issue occurs with us in errors=continue mode when accompanied by\nstorage failures. There have been many inconsistencies in the file system\ndata.\nIn the case of file system data inconsistency, for example, if the block\nbitmap of a referenced block is not set, it can lead to the situation where\na block being committed is allocated and used again. As a result, the\nfollowing condition will not be satisfied then trigger BUG_ON. Of course,\nit is entirely possible to construct a problematic image that can trigger\nthis BUG_ON through specific operations. In fact, I have constructed such\nan image and easily reproduced this issue.\nTherefore, J_ASSERT() holds true only under ideal conditions, but it may\nnot necessarily be satisfied in exceptional scenarios. Using J_ASSERT()\ndirectly in abnormal situations would cause the system to crash, which is\nclearly not what we want. So here we directly trigger a JBD abort instead\nof immediately invoking BUG_ON.(CVE-2025-68337)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid\n\nFixes a crash when layout is null during this call stack:\n\nwrite_inode\n    -\u0026gt; nfs4_write_inode\n        -\u0026gt; pnfs_layoutcommit_inode\n\npnfs_set_layoutcommit relies on the lseg refcount to keep the layout\naround. Need to clear NFS_INO_LAYOUTCOMMIT otherwise we might attempt\nto reference a null layout.(CVE-2025-68349)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nregulator: core: Protect regulator_supply_alias_list with regulator_list_mutex\n\nregulator_supply_alias_list was accessed without any locking in\nregulator_supply_alias(), regulator_register_supply_alias(), and\nregulator_unregister_supply_alias(). Concurrent registration,\nunregistration and lookups can race, leading to:\n\n1 use-after-free if an alias entry is removed while being read,\n2 duplicate entries when two threads register the same alias,\n3 inconsistent alias mappings observed by consumers.\n\nProtect all traversals, insertions and deletions on\nregulator_supply_alias_list with the existing regulator_list_mutex.(CVE-2025-68354)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Prevent recursive memory reclaim\n\nFunction new_inode() returns a new inode with inode-\u0026gt;i_mapping-\u0026gt;gfp_mask\nset to GFP_HIGHUSER_MOVABLE.  This value includes the __GFP_FS flag, so\nallocations in that address space can recurse into filesystem memory\nreclaim.  We don\u0026apos;t want that to happen because it can consume a\nsignificant amount of stack memory.\n\nWorse than that is that it can also deadlock: for example, in several\nplaces, gfs2_unstuff_dinode() is called inside filesystem transactions.\nThis calls filemap_grab_folio(), which can allocate a new folio, which\ncan trigger memory reclaim.  If memory reclaim recurses into the\nfilesystem and starts another transaction, a deadlock will ensue.\n\nTo fix these kinds of problems, prevent memory reclaim from recursing\ninto filesystem code by making sure that the gfp_mask of inode address\nspaces doesn\u0026apos;t include __GFP_FS.\n\nThe \u0026quot;meta\u0026quot; and resource group address spaces were already using GFP_NOFS\nas their gfp_mask (which doesn\u0026apos;t include __GFP_FS).  The default value\nof GFP_HIGHUSER_MOVABLE is less restrictive than GFP_NOFS, though.  To\navoid being overly limiting, use the default value and only knock off\nthe __GFP_FS flag.  I\u0026apos;m not sure if this will actually make a\ndifference, but it also shouldn\u0026apos;t hurt.\n\nThis patch is loosely based on commit ad22c7a043c2 (\u0026quot;xfs: prevent stack\noverflows from page cache allocation\u0026quot;).\n\nFixes xfstest generic/273.(CVE-2025-68356)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb()\n\nThe rtl8187_rx_cb() calculates the rx descriptor header address\nby subtracting its size from the skb tail pointer.\nHowever, it does not validate if the received packet\n(skb-\u0026gt;len from urb-\u0026gt;actual_length) is large enough to contain this\nheader.\n\nIf a truncated packet is received, this will lead to a buffer\nunderflow, reading memory before the start of the skb data area,\nand causing a kernel panic.\n\nAdd length checks for both rtl8187 and rtl8187b descriptor headers\nbefore attempting to access them, dropping the packet cleanly if the\ncheck fails.(CVE-2025-68362)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Check skb-\u0026gt;transport_header is set in bpf_skb_check_mtu\n\nThe bpf_skb_check_mtu helper needs to use skb-\u0026gt;transport_header when\nthe BPF_MTU_CHK_SEGS flag is used:\n\n\tbpf_skb_check_mtu(skb, ifindex, \u0026amp;mtu_len, 0, BPF_MTU_CHK_SEGS)\n\nThe transport_header is not always set. There is a WARN_ON_ONCE\nreport when CONFIG_DEBUG_NET is enabled + skb-\u0026gt;gso_size is set +\nbpf_prog_test_run is used:\n\nWARNING: CPU: 1 PID: 2216 at ./include/linux/skbuff.h:3071\n skb_gso_validate_network_len\n bpf_skb_check_mtu\n bpf_prog_3920e25740a41171_tc_chk_segs_flag # A test in the next patch\n bpf_test_run\n bpf_prog_test_run_skb\n\nFor a normal ingress skb (not test_run), skb_reset_transport_header\nis performed but there is plan to avoid setting it as described in\ncommit 2170a1f09148 (\u0026quot;net: no longer reset transport_header in __netif_receive_skb_core()\u0026quot;).\n\nThis patch fixes the bpf helper by checking\nskb_transport_header_was_set(). The check is done just before\nskb-\u0026gt;transport_header is used, to avoid breaking the existing bpf prog.\nThe WARN_ON_ONCE is limited to bpf_prog_test_run, so targeting bpf-next.(CVE-2025-68363)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncoresight: ETR: Fix ETR buffer use-after-free issue\n\nWhen ETR is enabled as CS_MODE_SYSFS, if the buffer size is changed\nand enabled again, currently sysfs_buf will point to the newly\nallocated memory(buf_new) and free the old memory(buf_old). But the\netr_buf that is being used by the ETR remains pointed to buf_old, not\nupdated to buf_new. In this case, it will result in a memory\nuse-after-free issue.\n\nFix this by checking ETR\u0026apos;s mode before updating and releasing buf_old,\nif the mode is CS_MODE_SYSFS, then skip updating and releasing it.(CVE-2025-68376)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix stackmap overflow check in __bpf_get_stackid()\n\nSyzkaller reported a KASAN slab-out-of-bounds write in __bpf_get_stackid()\nwhen copying stack trace data. The issue occurs when the perf trace\n contains more stack entries than the stack map bucket can hold,\n leading to an out-of-bounds write in the bucket\u0026apos;s data array.(CVE-2025-68378)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id\n\nUse check_add_overflow() to guard against potential integer overflows\nwhen adding the binary blob lengths and the size of an asymmetric_key_id\nstructure and return ERR_PTR(-EOVERFLOW) accordingly. This prevents a\npossible buffer overflow when copying data from potentially malicious\nX.509 certificate fields that can be arbitrarily large, such as ASN.1\nINTEGER serial numbers, issuer names, etc.(CVE-2025-68724)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Do not let BPF test infra emit invalid GSO types to stack\n\nYinhao et al. reported that their fuzzer tool was able to trigger a\nskb_warn_bad_offload() from netif_skb_features() -\u0026gt; gso_features_check().\nWhen a BPF program - triggered via BPF test infra - pushes the packet\nto the loopback device via bpf_clone_redirect() then mentioned offload\nwarning can be seen. GSO-related features are then rightfully disabled.\n\nWe get into this situation due to convert___skb_to_skb() setting\ngso_segs and gso_size but not gso_type. Technically, it makes sense\nthat this warning triggers since the GSO properties are malformed due\nto the gso_type. Potentially, the gso_type could be marked non-trustworthy\nthrough setting it at least to SKB_GSO_DODGY without any other specific\nassumptions, but that also feels wrong given we should not go further\ninto the GSO engine in the first place.\n\nThe checks were added in 121d57af308d (\u0026quot;gso: validate gso_type in GSO\nhandlers\u0026quot;) because there were malicious (syzbot) senders that combine\na protocol with a non-matching gso_type. If we would want to drop such\npackets, gso_features_check() currently only returns feature flags via\nnetif_skb_features(), so one location for potentially dropping such skbs\ncould be validate_xmit_unreadable_skb(), but then otoh it would be\nan additional check in the fast-path for a very corner case. Given\nbpf_clone_redirect() is the only place where BPF test infra could emit\nsuch packets, lets reject them right there.(CVE-2025-68725)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nisdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe()\n\nIn hfcsusb_probe(), the memory allocated for ctrl_urb gets leaked when\nsetup_instance() fails with an error code. Fix that by freeing the urb\nbefore freeing the hw structure. Also change the error paths to use the\ngoto ladder style.\n\nCompile tested only. Issue found using a prototype static analysis tool.(CVE-2025-68734)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix improper freeing of purex item\n\nIn qla2xxx_process_purls_iocb(), an item is allocated via\nqla27xx_copy_multiple_pkt(), which internally calls\nqla24xx_alloc_purex_item().\n\nThe qla24xx_alloc_purex_item() function may return a pre-allocated item\nfrom a per-adapter pool for small allocations, instead of dynamically\nallocating memory with kzalloc().\n\nAn error handling path in qla2xxx_process_purls_iocb() incorrectly uses\nkfree() to release the item. If the item was from the pre-allocated\npool, calling kfree() on it is a bug that can lead to memory corruption.\n\nFix this by using the correct deallocation function,\nqla24xx_free_purex_item(), which properly handles both dynamically\nallocated and pre-allocated items.(CVE-2025-68741)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Free special fields when update [lru_,]percpu_hash maps\n\nAs [lru_,]percpu_hash maps support BPF_KPTR_{REF,PERCPU}, missing\ncalls to \u0026apos;bpf_obj_free_fields()\u0026apos; in \u0026apos;pcpu_copy_value()\u0026apos; could cause the\nmemory referenced by BPF_KPTR_{REF,PERCPU} fields to be held until the\nmap gets freed.\n\nFix this by calling \u0026apos;bpf_obj_free_fields()\u0026apos; after\n\u0026apos;copy_map_value[,_long]()\u0026apos; in \u0026apos;pcpu_copy_value()\u0026apos;.(CVE-2025-68744)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Clear cmds after chip reset\n\nCommit aefed3e5548f (\u0026quot;scsi: qla2xxx: target: Fix offline port handling\nand host reset handling\u0026quot;) caused two problems:\n\n1. Commands sent to FW, after chip reset got stuck and never freed as FW\n   is not going to respond to them anymore.\n\n2. BUG_ON(cmd-\u0026gt;sg_mapped) in qlt_free_cmd().  Commit 26f9ce53817a\n   (\u0026quot;scsi: qla2xxx: Fix missed DMA unmap for aborted commands\u0026quot;)\n   attempted to fix this, but introduced another bug under different\n   circumstances when two different CPUs were racing to call\n   qlt_unmap_sg() at the same time: BUG_ON(!valid_dma_direction(dir)) in\n   dma_unmap_sg_attrs().\n\nSo revert \u0026quot;scsi: qla2xxx: Fix missed DMA unmap for aborted commands\u0026quot; and\npartially revert \u0026quot;scsi: qla2xxx: target: Fix offline port handling and\nhost reset handling\u0026quot; at __qla2x00_abort_all_cmds.(CVE-2025-68745)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nblock: Use RCU in blk_mq_[un]quiesce_tagset() instead of set-\u0026gt;tag_list_lock\n\nblk_mq_{add,del}_queue_tag_set() functions add and remove queues from\ntagset, the functions make sure that tagset and queues are marked as\nshared when two or more queues are attached to the same tagset.\nInitially a tagset starts as unshared and when the number of added\nqueues reaches two, blk_mq_add_queue_tag_set() marks it as shared along\nwith all the queues attached to it. When the number of attached queues\ndrops to 1 blk_mq_del_queue_tag_set() need to mark both the tagset and\nthe remaining queues as unshared.\n\nBoth functions need to freeze current queues in tagset before setting on\nunsetting BLK_MQ_F_TAG_QUEUE_SHARED flag. While doing so, both functions\nhold set-\u0026gt;tag_list_lock mutex, which makes sense as we do not want\nqueues to be added or deleted in the process. This used to work fine\nuntil commit 98d81f0df70c (\u0026quot;nvme: use blk_mq_[un]quiesce_tagset\u0026quot;)\nmade the nvme driver quiesce tagset instead of quiscing individual\nqueues. blk_mq_quiesce_tagset() does the job and quiesce the queues in\nset-\u0026gt;tag_list while holding set-\u0026gt;tag_list_lock also.\n\nThis results in deadlock between two threads with these stacktraces:\n\n  __schedule+0x47c/0xbb0\n  ? timerqueue_add+0x66/0xb0\n  schedule+0x1c/0xa0\n  schedule_preempt_disabled+0xa/0x10\n  __mutex_lock.constprop.0+0x271/0x600\n  blk_mq_quiesce_tagset+0x25/0xc0\n  nvme_dev_disable+0x9c/0x250\n  nvme_timeout+0x1fc/0x520\n  blk_mq_handle_expired+0x5c/0x90\n  bt_iter+0x7e/0x90\n  blk_mq_queue_tag_busy_iter+0x27e/0x550\n  ? __blk_mq_complete_request_remote+0x10/0x10\n  ? __blk_mq_complete_request_remote+0x10/0x10\n  ? __call_rcu_common.constprop.0+0x1c0/0x210\n  blk_mq_timeout_work+0x12d/0x170\n  process_one_work+0x12e/0x2d0\n  worker_thread+0x288/0x3a0\n  ? rescuer_thread+0x480/0x480\n  kthread+0xb8/0xe0\n  ? kthread_park+0x80/0x80\n  ret_from_fork+0x2d/0x50\n  ? kthread_park+0x80/0x80\n  ret_from_fork_asm+0x11/0x20\n\n  __schedule+0x47c/0xbb0\n  ? xas_find+0x161/0x1a0\n  schedule+0x1c/0xa0\n  blk_mq_freeze_queue_wait+0x3d/0x70\n  ? destroy_sched_domains_rcu+0x30/0x30\n  blk_mq_update_tag_set_shared+0x44/0x80\n  blk_mq_exit_queue+0x141/0x150\n  del_gendisk+0x25a/0x2d0\n  nvme_ns_remove+0xc9/0x170\n  nvme_remove_namespaces+0xc7/0x100\n  nvme_remove+0x62/0x150\n  pci_device_remove+0x23/0x60\n  device_release_driver_internal+0x159/0x200\n  unbind_store+0x99/0xa0\n  kernfs_fop_write_iter+0x112/0x1e0\n  vfs_write+0x2b1/0x3d0\n  ksys_write+0x4e/0xb0\n  do_syscall_64+0x5b/0x160\n  entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\nThe top stacktrace is showing nvme_timeout() called to handle nvme\ncommand timeout. timeout handler is trying to disable the controller and\nas a first step, it needs to blk_mq_quiesce_tagset() to tell blk-mq not\nto call queue callback handlers. The thread is stuck waiting for\nset-\u0026gt;tag_list_lock as it tries to walk the queues in set-\u0026gt;tag_list.\n\nThe lock is held by the second thread in the bottom stack which is\nwaiting for one of queues to be frozen. The queue usage counter will\ndrop to zero after nvme_timeout() finishes, and this will not happen\nbecause the thread will wait for this mutex forever.\n\nGiven that [un]quiescing queue is an operation that does not need to\nsleep, update blk_mq_[un]quiesce_tagset() to use RCU instead of taking\nset-\u0026gt;tag_list_lock, update blk_mq_{add,del}_queue_tag_set() to use RCU\nsafe list operations. Also, delete INIT_LIST_HEAD(\u0026amp;q-\u0026gt;tag_set_list)\nin blk_mq_del_queue_tag_set() because we can not re-initialize it while\nthe list is being traversed under RCU. The deleted queue will not be\nadded/deleted to/from a tagset and it will be freed in blk_free_queue()\nafter the end of RCU grace period.(CVE-2025-68756)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsched/deadline: only set free_cpus for online runqueues\n\nCommit 16b269436b72 (\u0026quot;sched/deadline: Modify cpudl::free_cpus\nto reflect rd-\u0026gt;online\u0026quot;) introduced the cpudl_set/clear_freecpu\nfunctions to allow the cpu_dl::free_cpus mask to be manipulated\nby the deadline scheduler class rq_on/offline callbacks so the\nmask would also reflect this state.\n\nCommit 9659e1eeee28 (\u0026quot;sched/deadline: Remove cpu_active_mask\nfrom cpudl_find()\u0026quot;) removed the check of the cpu_active_mask to\nsave some processing on the premise that the cpudl::free_cpus\nmask already reflected the runqueue online state.\n\nUnfortunately, there are cases where it is possible for the\ncpudl_clear function to set the free_cpus bit for a CPU when the\ndeadline runqueue is offline. When this occurs while a CPU is\nconnected to the default root domain the flag may retain the bad\nstate after the CPU has been unplugged. Later, a different CPU\nthat is transitioning through the default root domain may push a\ndeadline task to the powered down CPU when cpudl_find sees its\nfree_cpus bit is set. If this happens the task will not have the\nopportunity to run.\n\nOne example is outlined here:\nhttps://lore.kernel.org/lkml/(CVE-2025-68780)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: Reset t_task_cdb pointer in error case\n\nIf allocation of cmd-\u0026gt;t_task_cdb fails, it remains NULL but is later\ndereferenced in the \u0026apos;err\u0026apos; path.\n\nIn case of error, reset NULL t_task_cdb value to point at the default\nfixed-size buffer.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2025-68782)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niomap: adjust read range correctly for non-block-aligned positions\n\niomap_adjust_read_range() assumes that the position and length passed in\nare block-aligned. This is not always the case however, as shown in the\nsyzbot generated case for erofs. This causes too many bytes to be\nskipped for uptodate blocks, which results in returning the incorrect\nposition and length to read in. If all the blocks are uptodate, this\nunderflows length and returns a position beyond the folio.\n\nFix the calculation to also take into account the block offset when\ncalculating how many bytes can be skipped for uptodate blocks.(CVE-2025-68794)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: NFSv4 file creation neglects setting ACL\n\nAn NFSv4 client that sets an ACL with a named principal during file\ncreation retrieves the ACL afterwards, and finds that it is only a\ndefault ACL (based on the mode bits) and not the ACL that was\nrequested during file creation. This violates RFC 8881 section\n6.4.1.3: \u0026quot;the ACL attribute is set as given\u0026quot;.\n\nThe issue occurs in nfsd_create_setattr(), which calls\nnfsd_attrs_valid() to determine whether to call nfsd_setattr().\nHowever, nfsd_attrs_valid() checks only for iattr changes and\nsecurity labels, but not POSIX ACLs. When only an ACL is present,\nthe function returns false, nfsd_setattr() is skipped, and the\nPOSIX ACL is never applied to the inode.\n\nSubsequently, when the client retrieves the ACL, the server finds\nno POSIX ACL on the inode and returns one generated from the file\u0026apos;s\nmode bits rather than returning the originally-specified ACL.(CVE-2025-68803)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nio_uring: fix filename leak in __io_openat_prep()\n\n __io_openat_prep() allocates a struct filename using getname(). However,\nfor the condition of the file being installed in the fixed file table as\nwell as having O_CLOEXEC flag set, the function returns early. At that\npoint, the request doesn\u0026apos;t have REQ_F_NEED_CLEANUP flag set. Due to this,\nthe memory for the newly allocated struct filename is not cleaned up,\ncausing a memory leak.\n\nFix this by setting the REQ_F_NEED_CLEANUP for the request just after the\nsuccessful getname() call, so that when the request is torn down, the\nfilename will be cleaned up, along with other resources needing cleanup.(CVE-2025-68814)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: fw_tracer, Validate format string parameters\n\nAdd validation for format string parameters in the firmware tracer to\nprevent potential security vulnerabilities and crashes from malformed\nformat strings received from firmware.\n\nThe firmware tracer receives format strings from the device firmware and\nuses them to format trace messages. Without proper validation, bad\nfirmware could provide format strings with invalid format specifiers\n(e.g., %s, %p, %n) that could lead to crashes, or other undefined\nbehavior.\n\nAdd mlx5_tracer_validate_params() to validate that all format specifiers\nin trace strings are limited to safe integer/hex formats (%x, %d, %i,\n%u, %llx, %lx, etc.). Reject strings containing other format types that\ncould be used to access arbitrary memory or cause crashes.\nInvalid format strings are added to the trace output for visibility with\n\u0026quot;BAD_FORMAT: \u0026quot; prefix.(CVE-2025-68816)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency\n\nUnder high concurrency, A tree-connection object (tcon) is freed on\na disconnect path while another path still holds a reference and later\nexecutes *_put()/write on it.(CVE-2025-68817)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: Revert \u0026quot;scsi: qla2xxx: Perform lockless command completion in abort path\u0026quot;\n\nThis reverts commit 0367076b0817d5c75dfb83001ce7ce5c64d803a9.\n\nThe commit being reverted added code to __qla2x00_abort_all_cmds() to\ncall sp-\u0026gt;done() without holding a spinlock.  But unlike the older code\nbelow it, this new code failed to check sp-\u0026gt;cmd_type and just assumed\nTYPE_SRB, which results in a jump to an invalid pointer in target-mode\nwith TYPE_TGT_CMD:\n\nqla2xxx [0000:65:00.0]-d034:8: qla24xx_do_nack_work create sess success\n  0000000009f7a79b\nqla2xxx [0000:65:00.0]-5003:8: ISP System Error - mbx1=1ff5h mbx2=10h\n  mbx3=0h mbx4=0h mbx5=191h mbx6=0h mbx7=0h.\nqla2xxx [0000:65:00.0]-d01e:8: -\u0026gt; fwdump no buffer\nqla2xxx [0000:65:00.0]-f03a:8: qla_target(0): System error async event\n  0x8002 occurred\nqla2xxx [0000:65:00.0]-00af:8: Performing ISP error recovery -\n  ha=0000000058183fda.\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nPF: supervisor instruction fetch in kernel mode\nPF: error_code(0x0010) - not-present page\nPGD 0 P4D 0\nOops: 0010 [#1] SMP\nCPU: 2 PID: 9446 Comm: qla2xxx_8_dpc Tainted: G           O       6.1.133 #1\nHardware name: Supermicro Super Server/X11SPL-F, BIOS 4.2 12/15/2023\nRIP: 0010:0x0\nCode: Unable to access opcode bytes at 0xffffffffffffffd6.\nRSP: 0018:ffffc90001f93dc8 EFLAGS: 00010206\nRAX: 0000000000000282 RBX: 0000000000000355 RCX: ffff88810d16a000\nRDX: ffff88810dbadaa8 RSI: 0000000000080000 RDI: ffff888169dc38c0\nRBP: ffff888169dc38c0 R08: 0000000000000001 R09: 0000000000000045\nR10: ffffffffa034bdf0 R11: 0000000000000000 R12: ffff88810800bb40\nR13: 0000000000001aa8 R14: ffff888100136610 R15: ffff8881070f7400\nFS:  0000000000000000(0000) GS:ffff88bf80080000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffffffffffffffd6 CR3: 000000010c8ff006 CR4: 00000000003706e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u0026lt;TASK\u0026gt;\n ? __die+0x4d/0x8b\n ? page_fault_oops+0x91/0x180\n ? trace_buffer_unlock_commit_regs+0x38/0x1a0\n ? exc_page_fault+0x391/0x5e0\n ? asm_exc_page_fault+0x22/0x30\n __qla2x00_abort_all_cmds+0xcb/0x3e0 [qla2xxx_scst]\n qla2x00_abort_all_cmds+0x50/0x70 [qla2xxx_scst]\n qla2x00_abort_isp_cleanup+0x3b7/0x4b0 [qla2xxx_scst]\n qla2x00_abort_isp+0xfd/0x860 [qla2xxx_scst]\n qla2x00_do_dpc+0x581/0xa40 [qla2xxx_scst]\n kthread+0xa8/0xd0\n \u0026lt;/TASK\u0026gt;\n\nThen commit 4475afa2646d (\u0026quot;scsi: qla2xxx: Complete command early within\nlock\u0026quot;) added the spinlock back, because not having the lock caused a\nrace and a crash.  But qla2x00_abort_srb() in the switch below already\nchecks for qla2x00_chip_is_down() and handles it the same way, so the\ncode above the switch is now redundant and still buggy in target-mode.\nRemove it.(CVE-2025-68818)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nshmem: fix recovery on rename failures\n\nmaple_tree insertions can fail if we are seriously short on memory;\nsimple_offset_rename() does not recover well if it runs into that.\nThe same goes for simple_offset_rename_exchange().\n\nMoreover, shmem_whiteout() expects that if it succeeds, the caller will\nprogress to d_move(), i.e. that shmem_rename2() won\u0026apos;t fail past the\nsuccessful call of shmem_whiteout().\n\nNot hard to fix, fortunately - mtree_store() can\u0026apos;t fail if the index we\nare trying to store into is already present in the tree as a singleton.\n\nFor simple_offset_rename_exchange() that\u0026apos;s enough - we just need to be\ncareful about the order of operations.\n\nFor simple_offset_rename() solution is to preinsert the target into the\ntree for new_dir; the rest can be done without any potentially failing\noperations.\n\nThat preinsertion has to be done in shmem_rename2() rather than in\nsimple_offset_rename() itself - otherwise we\u0026apos;d need to deal with the\npossibility of failure after successful shmem_whiteout().(CVE-2025-71072)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntpm: Cap the number of PCR banks\n\ntpm2_get_pcr_allocation() does not cap any upper limit for the number of\nbanks. Cap the limit to eight banks so that out of bounds values coming\nfrom external I/O cause on only limited harm.(CVE-2025-71077)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer\n\nWhen advancing the target expiration for the guest\u0026apos;s APIC timer in periodic\nmode, set the expiration to \u0026quot;now\u0026quot; if the target expiration is in the past\n(similar to what is done in update_target_expiration()).  Blindly adding\nthe period to the previous target expiration can result in KVM generating\na practically unbounded number of hrtimer IRQs due to programming an\nexpired timer over and over.  In extreme scenarios, e.g. if userspace\npauses/suspends a VM for an extended duration, this can even cause hard\nlockups in the host.\n\nCurrently, the bug only affects Intel CPUs when using the hypervisor timer\n(HV timer), a.k.a. the VMX preemption timer.  Unlike the software timer,\na.k.a. hrtimer, which KVM keeps running even on exits to userspace, the\nHV timer only runs while the guest is active.  As a result, if the vCPU\ndoes not run for an extended duration, there will be a huge gap between\nthe target expiration and the current time the vCPU resumes running.\nBecause the target expiration is incremented by only one period on each\ntimer expiration, this leads to a series of timer expirations occurring\nrapidly after the vCPU/VM resumes.\n\nMore critically, when the vCPU first triggers a periodic HV timer\nexpiration after resuming, advancing the expiration by only one period\nwill result in a target expiration in the past.  As a result, the delta\nmay be calculated as a negative value.  When the delta is converted into\nan absolute value (tscdeadline is an unsigned u64), the resulting value\ncan overflow what the HV timer is capable of programming.  I.e. the large\nvalue will exceed the VMX Preemption Timer\u0026apos;s maximum bit width of\ncpu_preemption_timer_multi + 32, and thus cause KVM to switch from the\nHV timer to the software timer (hrtimers).\n\nAfter switching to the software timer, periodic timer expiration callbacks\nmay be executed consecutively within a single clock interrupt handler,\nbecause hrtimers honors KVM\u0026apos;s request for an expiration in the past and\nimmediately re-invokes KVM\u0026apos;s callback after reprogramming.  And because\nthe interrupt handler runs with IRQs disabled, restarting KVM\u0026apos;s hrtimer\nover and over until the target expiration is advanced to \u0026quot;now\u0026quot; can result\nin a hard lockup.\n\nE.g. the following hard lockup was triggered in the host when running a\nWindows VM (only relevant because it used the APIC timer in periodic mode)\nafter resuming the VM from a long suspend (in the host).\n\n  NMI watchdog: Watchdog detected hard LOCKUP on cpu 45\n  ...\n  RIP: 0010:advance_periodic_target_expiration+0x4d/0x80 [kvm]\n  ...\n  RSP: 0018:ff4f88f5d98d8ef0 EFLAGS: 00000046\n  RAX: fff0103f91be678e RBX: fff0103f91be678e RCX: 00843a7d9e127bcc\n  RDX: 0000000000000002 RSI: 0052ca4003697505 RDI: ff440d5bfbdbd500\n  RBP: ff440d5956f99200 R08: ff2ff2a42deb6a84 R09: 000000000002a6c0\n  R10: 0122d794016332b3 R11: 0000000000000000 R12: ff440db1af39cfc0\n  R13: ff440db1af39cfc0 R14: ffffffffc0d4a560 R15: ff440db1af39d0f8\n  FS:  00007f04a6ffd700(0000) GS:ff440db1af380000(0000) knlGS:000000e38a3b8000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 000000d5651feff8 CR3: 000000684e038002 CR4: 0000000000773ee0\n  PKRU: 55555554\n  Call Trace:\n   \u0026lt;IRQ\u0026gt;\n   apic_timer_fn+0x31/0x50 [kvm]\n   __hrtimer_run_queues+0x100/0x280\n   hrtimer_interrupt+0x100/0x210\n   ? ttwu_do_wakeup+0x19/0x160\n   smp_apic_timer_interrupt+0x6a/0x130\n   apic_timer_interrupt+0xf/0x20\n   \u0026lt;/IRQ\u0026gt;\n\nMoreover, if the suspend duration of the virtual machine is not long enough\nto trigger a hard lockup in this scenario, since commit 98c25ead5eda\n(\u0026quot;KVM: VMX: Move preemption timer \u0026lt;=\u0026gt; hrtimer dance to common x86\u0026quot;), KVM\nwill continue using the software timer until the guest reprograms the APIC\ntimer in some way.  Since the periodic timer does not require frequent APIC\ntimer register programming, the guest may continue to use the software\ntimer in \n---truncated---(CVE-2025-71104)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: make decode_pool() more resilient against corrupted osdmaps\n\nIf the osdmap is (maliciously) corrupted such that the encoded length\nof ceph_pg_pool envelope is less than what is expected for a particular\nencoding version, out-of-bounds reads may ensue because the only bounds\ncheck that is there is based on that length value.\n\nThis patch adds explicit bounds checks for each field that is decoded\nor skipped.(CVE-2025-71116)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: seqiv - Do not use req-\u0026gt;iv after crypto_aead_encrypt\n\nAs soon as crypto_aead_encrypt is called, the underlying request\nmay be freed by an asynchronous completion.  Thus dereferencing\nreq-\u0026gt;iv after it returns is invalid.\n\nInstead of checking req-\u0026gt;iv against info, create a new variable\nunaligned_info and use it for that purpose instead.(CVE-2025-71131)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/page_alloc: change all pageblocks migrate type on coalescing\n\nWhen a page is freed it coalesces with a buddy into a higher order page\nwhile possible.  When the buddy page migrate type differs, it is expected\nto be updated to match the one of the page being freed.\n\nHowever, only the first pageblock of the buddy page is updated, while the\nrest of the pageblocks are left unchanged.\n\nThat causes warnings in later expand() and other code paths (like below),\nsince an inconsistency between migration type of the list containing the\npage and the page-owned pageblocks migration types is introduced.\n\n[  308.986589] ------------[ cut here ]------------\n[  308.987227] page type is 0, passed migratetype is 1 (nr=256)\n[  308.987275] WARNING: CPU: 1 PID: 5224 at mm/page_alloc.c:812 expand+0x23c/0x270\n[  308.987293] Modules linked in: algif_hash(E) af_alg(E) nft_fib_inet(E) nft_fib_ipv4(E) nft_fib_ipv6(E) nft_fib(E) nft_reject_inet(E) nf_reject_ipv4(E) nf_reject_ipv6(E) nft_reject(E) nft_ct(E) nft_chain_nat(E) nf_nat(E) nf_conntrack(E) nf_defrag_ipv6(E) nf_defrag_ipv4(E) nf_tables(E) s390_trng(E) vfio_ccw(E) mdev(E) vfio_iommu_type1(E) vfio(E) sch_fq_codel(E) drm(E) i2c_core(E) drm_panel_orientation_quirks(E) loop(E) nfnetlink(E) vsock_loopback(E) vmw_vsock_virtio_transport_common(E) vsock(E) ctcm(E) fsm(E) diag288_wdt(E) watchdog(E) zfcp(E) scsi_transport_fc(E) ghash_s390(E) prng(E) aes_s390(E) des_generic(E) des_s390(E) libdes(E) sha3_512_s390(E) sha3_256_s390(E) sha_common(E) paes_s390(E) crypto_engine(E) pkey_cca(E) pkey_ep11(E) zcrypt(E) rng_core(E) pkey_pckmo(E) pkey(E) autofs4(E)\n[  308.987439] Unloaded tainted modules: hmac_s390(E):2\n[  308.987650] CPU: 1 UID: 0 PID: 5224 Comm: mempig_verify Kdump: loaded Tainted: G            E       6.18.0-gcc-bpf-debug #431 PREEMPT\n[  308.987657] Tainted: [E]=UNSIGNED_MODULE\n[  308.987661] Hardware name: IBM 3906 M04 704 (z/VM 7.3.0)\n[  308.987666] Krnl PSW : 0404f00180000000 00000349976fa600 (expand+0x240/0x270)\n[  308.987676]            R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:3 PM:0 RI:0 EA:3\n[  308.987682] Krnl GPRS: 0000034980000004 0000000000000005 0000000000000030 000003499a0e6d88\n[  308.987688]            0000000000000005 0000034980000005 000002be803ac000 0000023efe6c8300\n[  308.987692]            0000000000000008 0000034998d57290 000002be00000100 0000023e00000008\n[  308.987696]            0000000000000000 0000000000000000 00000349976fa5fc 000002c99b1eb6f0\n[  308.987708] Krnl Code: 00000349976fa5f0: c020008a02f2\tlarl\t%r2,000003499883abd4\n                          00000349976fa5f6: c0e5ffe3f4b5\tbrasl\t%r14,0000034997378f60\n                         #00000349976fa5fc: af000000\t\tmc\t0,0\n                         \u0026gt;00000349976fa600: a7f4ff4c\t\tbrc\t15,00000349976fa498\n                          00000349976fa604: b9040026\t\tlgr\t%r2,%r6\n                          00000349976fa608: c0300088317f\tlarl\t%r3,0000034998800906\n                          00000349976fa60e: c0e5fffdb6e1\tbrasl\t%r14,00000349976b13d0\n                          00000349976fa614: af000000\t\tmc\t0,0\n[  308.987734] Call Trace:\n[  308.987738]  [\u0026lt;00000349976fa600\u0026gt;] expand+0x240/0x270\n[  308.987744] ([\u0026lt;00000349976fa5fc\u0026gt;] expand+0x23c/0x270)\n[  308.987749]  [\u0026lt;00000349976ff95e\u0026gt;] rmqueue_bulk+0x71e/0x940\n[  308.987754]  [\u0026lt;00000349976ffd7e\u0026gt;] __rmqueue_pcplist+0x1fe/0x2a0\n[  308.987759]  [\u0026lt;0000034997700966\u0026gt;] rmqueue.isra.0+0xb46/0xf40\n[  308.987763]  [\u0026lt;0000034997703ec8\u0026gt;] get_page_from_freelist+0x198/0x8d0\n[  308.987768]  [\u0026lt;0000034997706fa8\u0026gt;] __alloc_frozen_pages_noprof+0x198/0x400\n[  308.987774]  [\u0026lt;00000349977536f8\u0026gt;] alloc_pages_mpol+0xb8/0x220\n[  308.987781]  [\u0026lt;0000034997753bf6\u0026gt;] folio_alloc_mpol_noprof+0x26/0xc0\n[  308.987786]  [\u0026lt;0000034997753e4c\u0026gt;] vma_alloc_folio_noprof+0x6c/0xa0\n[  308.987791]  [\u0026lt;0000034997775b22\u0026gt;] vma_alloc_anon_folio_pmd+0x42/0x240\n[  308.987799]  [\u0026lt;000003499777bfea\u0026gt;] __do_huge_pmd_anonymous_page+0x3a/0x210\n[  308.987804]  [\u0026lt;00000349976cb0\n---truncated---(CVE-2025-71134)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKEYS: trusted: Fix a memory leak in tpm2_load_cmd\n\n\u0026apos;tpm2_load_cmd\u0026apos; allocates a tempoary blob indirectly via \u0026apos;tpm2_key_decode\u0026apos;\nbut it is not freed in the failure paths. Address this by wrapping the blob\ninto with a cleanup helper.(CVE-2025-71147)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/poll: correctly handle io_poll_add() return value on update\n\nWhen the core of io_uring was updated to handle completions\nconsistently and with fixed return codes, the POLL_REMOVE opcode\nwith updates got slightly broken. If a POLL_ADD is pending and\nthen POLL_REMOVE is used to update the events of that request, if that\nupdate causes the POLL_ADD to now trigger, then that completion is lost\nand a CQE is never posted.\n\nAdditionally, ensure that if an update does cause an existing POLL_ADD\nto complete, that the completion value isn\u0026apos;t always overwritten with\n-ECANCELED. For that case, whatever io_poll_add() set the value to\nshould just be retained.(CVE-2025-71149)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: Fix refcount leak when invalid session is found on session lookup\n\nWhen a session is found but its state is not SMB2_SESSION_VALID, It\nindicates that no valid session was found, but it is missing to decrement\nthe reference count acquired by the session lookup, which results in\na reference count leak. This patch fixes the issue by explicitly calling\nksmbd_user_session_put to release the reference to the session.(CVE-2025-71150)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: properly keep track of conduit reference\n\nProblem description\n-------------------\n\nDSA has a mumbo-jumbo of reference handling of the conduit net device\nand its kobject which, sadly, is just wrong and doesn\u0026apos;t make sense.\n\nThere are two distinct problems.\n\n1. The OF path, which uses of_find_net_device_by_node(), never releases\n   the elevated refcount on the conduit\u0026apos;s kobject. Nominally, the OF and\n   non-OF paths should result in objects having identical reference\n   counts taken, and it is already suspicious that\n   dsa_dev_to_net_device() has a put_device() call which is missing in\n   dsa_port_parse_of(), but we can actually even verify that an issue\n   exists. With CONFIG_DEBUG_KOBJECT_RELEASE=y, if we run this command\n   \u0026quot;before\u0026quot; and \u0026quot;after\u0026quot; applying this patch:\n\n(unbind the conduit driver for net device eno2)\necho 0000:00:00.2 \u0026gt; /sys/bus/pci/drivers/fsl_enetc/unbind\n\nwe see these lines in the output diff which appear only with the patch\napplied:\n\nkobject: \u0026apos;eno2\u0026apos; (ffff002009a3a6b8): kobject_release, parent 0000000000000000 (delayed 1000)\nkobject: \u0026apos;109\u0026apos; (ffff0020099d59a0): kobject_release, parent 0000000000000000 (delayed 1000)\n\n2. After we find the conduit interface one way (OF) or another (non-OF),\n   it can get unregistered at any time, and DSA remains with a long-lived,\n   but in this case stale, cpu_dp-\u0026gt;conduit pointer. Holding the net\n   device\u0026apos;s underlying kobject isn\u0026apos;t actually of much help, it just\n   prevents it from being freed (but we never need that kobject\n   directly). What helps us to prevent the net device from being\n   unregistered is the parallel netdev reference mechanism (dev_hold()\n   and dev_put()).\n\nActually we actually use that netdev tracker mechanism implicitly on\nuser ports since commit 2f1e8ea726e9 (\u0026quot;net: dsa: link interfaces with\nthe DSA master to get rid of lockdep warnings\u0026quot;), via netdev_upper_dev_link().\nBut time still passes at DSA switch probe time between the initial\nof_find_net_device_by_node() code and the user port creation time, time\nduring which the conduit could unregister itself and DSA wouldn\u0026apos;t know\nabout it.\n\nSo we have to run of_find_net_device_by_node() under rtnl_lock() to\nprevent that from happening, and release the lock only with the netdev\ntracker having acquired the reference.\n\nDo we need to keep the reference until dsa_unregister_switch() /\ndsa_switch_shutdown()?\n1: Maybe yes. A switch device will still be registered even if all user\n   ports failed to probe, see commit 86f8b1c01a0a (\u0026quot;net: dsa: Do not\n   make user port errors fatal\u0026quot;), and the cpu_dp-\u0026gt;conduit pointers\n   remain valid.  I haven\u0026apos;t audited all call paths to see whether they\n   will actually use the conduit in lack of any user port, but if they\n   do, it seems safer to not rely on user ports for that reference.\n2. Definitely yes. We support changing the conduit which a user port is\n   associated to, and we can get into a situation where we\u0026apos;ve moved all\n   user ports away from a conduit, thus no longer hold any reference to\n   it via the net device tracker. But we shouldn\u0026apos;t let it go nonetheless\n   - see the next change in relation to dsa_tree_find_first_conduit()\n   and LAG conduits which disappear.\n   We have to be prepared to return to the physical conduit, so the CPU\n   port must explicitly keep another reference to it. This is also to\n   say: the user ports and their CPU ports may not always keep a\n   reference to the same conduit net device, and both are needed.\n\nAs for the conduit\u0026apos;s kobject for the /sys/class/net/ entry, we don\u0026apos;t\ncare about it, we can release it as soon as we hold the net device\nobject itself.\n\nHistory and blame attribution\n-----------------------------\n\nThe code has been refactored so many times, it is very difficult to\nfollow and properly attribute a blame, but I\u0026apos;ll try to make a short\nhistory which I hope to be correct.\n\nWe have two distinct probing paths:\n- one for OF, introduced in 2016 i\n---truncated---(CVE-2025-71152)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: rtl8150: fix memory leak on usb_submit_urb() failure\n\nIn async_set_registers(), when usb_submit_urb() fails, the allocated\n  async_req structure and URB are not freed, causing a memory leak.\n\n  The completion callback async_set_reg_cb() is responsible for freeing\n  these allocations, but it is only called after the URB is successfully\n  submitted and completes (successfully or with error). If submission\n  fails, the callback never runs and the memory is leaked.\n\n  Fix this by freeing both the URB and the request structure in the error\n  path when usb_submit_urb() fails.(CVE-2025-71154)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix bsg_done() causing double free\n\nKernel panic observed on system,\n\n[5353358.825191] BUG: unable to handle page fault for address: ff5f5e897b024000\n[5353358.825194] #PF: supervisor write access in kernel mode\n[5353358.825195] #PF: error_code(0x0002) - not-present page\n[5353358.825196] PGD 100006067 P4D 0\n[5353358.825198] Oops: 0002 [#1] PREEMPT SMP NOPTI\n[5353358.825200] CPU: 5 PID: 2132085 Comm: qlafwupdate.sub Kdump: loaded Tainted: G        W    L    -------  ---  5.14.0-503.34.1.el9_5.x86_64 #1\n[5353358.825203] Hardware name: HPE ProLiant DL360 Gen11/ProLiant DL360 Gen11, BIOS 2.44 01/17/2025\n[5353358.825204] RIP: 0010:memcpy_erms+0x6/0x10\n[5353358.825211] RSP: 0018:ff591da8f4f6b710 EFLAGS: 00010246\n[5353358.825212] RAX: ff5f5e897b024000 RBX: 0000000000007090 RCX: 0000000000001000\n[5353358.825213] RDX: 0000000000001000 RSI: ff591da8f4fed090 RDI: ff5f5e897b024000\n[5353358.825214] RBP: 0000000000010000 R08: ff5f5e897b024000 R09: 0000000000000000\n[5353358.825215] R10: ff46cf8c40517000 R11: 0000000000000001 R12: 0000000000008090\n[5353358.825216] R13: ff591da8f4f6b720 R14: 0000000000001000 R15: 0000000000000000\n[5353358.825218] FS:  00007f1e88d47740(0000) GS:ff46cf935f940000(0000) knlGS:0000000000000000\n[5353358.825219] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[5353358.825220] CR2: ff5f5e897b024000 CR3: 0000000231532004 CR4: 0000000000771ef0\n[5353358.825221] PKRU: 55555554\n[5353358.825222] Call Trace:\n[5353358.825223]  \u0026lt;TASK\u0026gt;\n[5353358.825224]  ? show_trace_log_lvl+0x1c4/0x2df\n[5353358.825229]  ? show_trace_log_lvl+0x1c4/0x2df\n[5353358.825232]  ? sg_copy_buffer+0xc8/0x110\n[5353358.825236]  ? __die_body.cold+0x8/0xd\n[5353358.825238]  ? page_fault_oops+0x134/0x170\n[5353358.825242]  ? kernelmode_fixup_or_oops+0x84/0x110\n[5353358.825244]  ? exc_page_fault+0xa8/0x150\n[5353358.825247]  ? asm_exc_page_fault+0x22/0x30\n[5353358.825252]  ? memcpy_erms+0x6/0x10\n[5353358.825253]  sg_copy_buffer+0xc8/0x110\n[5353358.825259]  qla2x00_process_vendor_specific+0x652/0x1320 [qla2xxx]\n[5353358.825317]  qla24xx_bsg_request+0x1b2/0x2d0 [qla2xxx]\n\nMost routines in qla_bsg.c call bsg_done() only for success cases.\nHowever a few invoke it for failure case as well leading to a double\nfree. Validate before calling bsg_done().(CVE-2025-71238)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: avoid kernel-infoleak from struct iw_point\n\nstruct iw_point has a 32bit hole on 64bit arches.\n\nstruct iw_point {\n  void __user   *pointer;       /* Pointer to the data  (in user space) */\n  __u16         length;         /* number of fields or size in bytes */\n  __u16         flags;          /* Optional params */\n};\n\nMake sure to zero the structure to avoid disclosing 32bits of kernel data\nto user space.(CVE-2026-22978)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: provide locking for v4_end_grace\n\nWriting to v4_end_grace can race with server shutdown and result in\nmemory being accessed after it was freed - reclaim_str_hashtbl in\nparticularly.\n\nWe cannot hold nfsd_mutex across the nfsd4_end_grace() call as that is\nheld while client_tracking_op-\u0026gt;init() is called and that can wait for\nan upcall to nfsdcltrack which can write to v4_end_grace, resulting in a\ndeadlock.\n\nnfsd4_end_grace() is also called by the landromat work queue and this\ndoesn\u0026apos;t require locking as server shutdown will stop the work and wait\nfor it before freeing anything that nfsd4_end_grace() might access.\n\nHowever, we must be sure that writing to v4_end_grace doesn\u0026apos;t restart\nthe work item after shutdown has already waited for it.  For this we\nadd a new flag protected with nn-\u0026gt;client_lock.  It is set only while it\nis safe to make client tracking calls, and v4_end_grace only schedules\nwork while the flag is set with the spinlock held.\n\nSo this patch adds a nfsd_net field \u0026quot;client_tracking_active\u0026quot; which is\nset as described.  Another field \u0026quot;grace_end_forced\u0026quot;, is set when\nv4_end_grace is written.  After this is set, and providing\nclient_tracking_active is set, the laundromat is scheduled.\nThis \u0026quot;grace_end_forced\u0026quot; field bypasses other checks for whether the\ngrace period has finished.\n\nThis resolves a race which can result in use-after-free.(CVE-2026-22980)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: replace overzealous BUG_ON in osdmap_apply_incremental()\n\nIf the osdmap is (maliciously) corrupted such that the incremental\nosdmap epoch is different from what is expected, there is no need to\nBUG.  Instead, just declare the incremental osdmap to be invalid.(CVE-2026-22990)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: return the handler error from mon_handle_auth_done()\n\nCurrently any error from ceph_auth_handle_reply_done() is propagated\nvia finish_auth() but isn\u0026apos;t returned from mon_handle_auth_done().  This\nresults in higher layers learning that (despite the monitor considering\nus to be successfully authenticated) something went wrong in the\nauthentication phase and reacting accordingly, but msgr2 still trying\nto proceed with establishing the session in the background.  In the\ncase of secure mode this can trigger a WARN in setup_crypto() and later\nlead to a NULL pointer dereference inside of prepare_auth_signature().(CVE-2026-22992)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Don\u0026apos;t store mlx5e_priv in mlx5e_dev devlink priv\n\nmlx5e_priv is an unstable structure that can be memset(0) if profile\nattaching fails, mlx5e_priv in mlx5e_dev devlink private is used to\nreference the netdev and mdev associated with that struct. Instead,\nstore netdev directly into mlx5e_dev and get mdev from the containing\nmlx5_adev aux device structure.\n\nThis fixes a kernel oops in mlx5e_remove when switchdev mode fails due\nto change profile failure.\n\n$ devlink dev eswitch set pci/0000:00:03.0 mode switchdev\nError: mlx5_core: Failed setting eswitch to offloads.\ndmesg:\nworkqueue: Failed to create a rescuer kthread for wq \u0026quot;mlx5e\u0026quot;: -EINTR\nmlx5_core 0012:03:00.1: mlx5e_netdev_init_profile:6214:(pid 37199): mlx5e_priv_init failed, err=-12\nmlx5_core 0012:03:00.1 gpu3rdma1: mlx5e_netdev_change_profile: new profile init failed, -12\nworkqueue: Failed to create a rescuer kthread for wq \u0026quot;mlx5e\u0026quot;: -EINTR\nmlx5_core 0012:03:00.1: mlx5e_netdev_init_profile:6214:(pid 37199): mlx5e_priv_init failed, err=-12\nmlx5_core 0012:03:00.1 gpu3rdma1: mlx5e_netdev_change_profile: failed to rollback to orig profile, -12\n\n$ devlink dev reload pci/0000:00:03.0 ==\u0026gt; oops\n\nBUG: kernel NULL pointer dereference, address: 0000000000000520\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\nPGD 0 P4D 0\nOops: Oops: 0000 [#1] SMP NOPTI\nCPU: 3 UID: 0 PID: 521 Comm: devlink Not tainted 6.18.0-rc5+ #117 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014\nRIP: 0010:mlx5e_remove+0x68/0x130\nRSP: 0018:ffffc900034838f0 EFLAGS: 00010246\nRAX: ffff88810283c380 RBX: ffff888101874400 RCX: ffffffff826ffc45\nRDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000\nRBP: ffff888102d789c0 R08: ffff8881007137f0 R09: ffff888100264e10\nR10: ffffc90003483898 R11: ffffc900034838a0 R12: ffff888100d261a0\nR13: ffff888100d261a0 R14: ffff8881018749a0 R15: ffff888101874400\nFS:  00007f8565fea740(0000) GS:ffff88856a759000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000520 CR3: 000000010b11a004 CR4: 0000000000370ef0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n device_release_driver_internal+0x19c/0x200\n bus_remove_device+0xc6/0x130\n device_del+0x160/0x3d0\n ? devl_param_driverinit_value_get+0x2d/0x90\n mlx5_detach_device+0x89/0xe0\n mlx5_unload_one_devl_locked+0x3a/0x70\n mlx5_devlink_reload_down+0xc8/0x220\n devlink_reload+0x7d/0x260\n devlink_nl_reload_doit+0x45b/0x5a0\n genl_family_rcv_msg_doit+0xe8/0x140(CVE-2026-22996)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec\n\nCommit efa56305908b (\u0026quot;nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length\u0026quot;)\nadded ttag bounds checking and data_offset\nvalidation in nvmet_tcp_handle_h2c_data_pdu(), but it did not validate\nwhether the command\u0026apos;s data structures (cmd-\u0026gt;req.sg and cmd-\u0026gt;iov) have\nbeen properly initialized before processing H2C_DATA PDUs.\n\nThe nvmet_tcp_build_pdu_iovec() function dereferences these pointers\nwithout NULL checks. This can be triggered by sending H2C_DATA PDU\nimmediately after the ICREQ/ICRESP handshake, before\nsending a CONNECT command or NVMe write command.\n\nAttack vectors that trigger NULL pointer dereferences:\n1. H2C_DATA PDU sent before CONNECT → both pointers NULL\n2. H2C_DATA PDU for READ command → cmd-\u0026gt;req.sg allocated, cmd-\u0026gt;iov NULL\n3. H2C_DATA PDU for uninitialized command slot → both pointers NULL\n\nThe fix validates both cmd-\u0026gt;req.sg and cmd-\u0026gt;iov before calling\nnvmet_tcp_build_pdu_iovec(). Both checks are required because:\n- Uninitialized commands: both NULL\n- READ commands: cmd-\u0026gt;req.sg allocated, cmd-\u0026gt;iov NULL\n- WRITE commands: both allocated(CVE-2026-22998)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix crash on profile change rollback failure\n\nmlx5e_netdev_change_profile can fail to attach a new profile and can\nfail to rollback to old profile, in such case, we could end up with a\ndangling netdev with a fully reset netdev_priv. A retry to change\nprofile, e.g. another attempt to call mlx5e_netdev_change_profile via\nswitchdev mode change, will crash trying to access the now NULL\npriv-\u0026gt;mdev.\n\nThis fix allows mlx5e_netdev_change_profile() to handle previous\nfailures and an empty priv, by not assuming priv is valid.\n\nPass netdev and mdev to all flows requiring\nmlx5e_netdev_change_profile() and avoid passing priv.\nIn mlx5e_netdev_change_profile() check if current priv is valid, and if\nnot, just attach the new profile without trying to access the old one.\n\nThis fixes the following oops, when enabling switchdev mode for the 2nd\ntime after first time failure:\n\n ## Enabling switchdev mode first time:\n\nmlx5_core 0012:03:00.1: E-Switch: Supported tc chains and prios offload\nworkqueue: Failed to create a rescuer kthread for wq \u0026quot;mlx5e\u0026quot;: -EINTR\nmlx5_core 0012:03:00.1: mlx5e_netdev_init_profile:6214:(pid 37199): mlx5e_priv_init failed, err=-12\nmlx5_core 0012:03:00.1 gpu3rdma1: mlx5e_netdev_change_profile: new profile init failed, -12\nworkqueue: Failed to create a rescuer kthread for wq \u0026quot;mlx5e\u0026quot;: -EINTR\nmlx5_core 0012:03:00.1: mlx5e_netdev_init_profile:6214:(pid 37199): mlx5e_priv_init failed, err=-12\nmlx5_core 0012:03:00.1 gpu3rdma1: mlx5e_netdev_change_profile: failed to rollback to orig profile, -12\n                                                                         ^^^^^^^^\nmlx5_core 0000:00:03.0: E-Switch: Disable: mode(LEGACY), nvfs(0), necvfs(0), active vports(0)\n\n ## retry: Enabling switchdev mode 2nd time:\n\nmlx5_core 0000:00:03.0: E-Switch: Supported tc chains and prios offload\nBUG: kernel NULL pointer dereference, address: 0000000000000038\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\nPGD 0 P4D 0\nOops: Oops: 0000 [#1] SMP NOPTI\nCPU: 13 UID: 0 PID: 520 Comm: devlink Not tainted 6.18.0-rc4+ #91 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014\nRIP: 0010:mlx5e_detach_netdev+0x3c/0x90\nCode: 50 00 00 f0 80 4f 78 02 48 8b bf e8 07 00 00 48 85 ff 74 16 48 8b 73 78 48 d1 ee 83 e6 01 83 f6 01 40 0f b6 f6 e8 c4 42 00 00 \u0026lt;48\u0026gt; 8b 45 38 48 85 c0 74 08 48 89 df e8 cc 47 40 1e 48 8b bb f0 07\nRSP: 0018:ffffc90000673890 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: ffff8881036a89c0 RCX: 0000000000000000\nRDX: ffff888113f63800 RSI: ffffffff822fe720 RDI: 0000000000000000\nRBP: 0000000000000000 R08: 0000000000002dcd R09: 0000000000000000\nR10: ffffc900006738e8 R11: 00000000ffffffff R12: 0000000000000000\nR13: 0000000000000000 R14: ffff8881036a89c0 R15: 0000000000000000\nFS:  00007fdfb8384740(0000) GS:ffff88856a9d6000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000038 CR3: 0000000112ae0005 CR4: 0000000000370ef0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n mlx5e_netdev_change_profile+0x45/0xb0\n mlx5e_vport_rep_load+0x27b/0x2d0\n mlx5_esw_offloads_rep_load+0x72/0xf0\n esw_offloads_enable+0x5d0/0x970\n mlx5_eswitch_enable_locked+0x349/0x430\n ? is_mp_supported+0x57/0xb0\n mlx5_devlink_eswitch_mode_set+0x26b/0x430\n devlink_nl_eswitch_set_doit+0x6f/0xf0\n genl_family_rcv_msg_doit+0xe8/0x140\n genl_rcv_msg+0x18b/0x290\n ? __pfx_devlink_nl_pre_doit+0x10/0x10\n ? __pfx_devlink_nl_eswitch_set_doit+0x10/0x10\n ? __pfx_devlink_nl_post_doit+0x10/0x10\n ? __pfx_genl_rcv_msg+0x10/0x10\n netlink_rcv_skb+0x52/0x100\n genl_rcv+0x28/0x40\n netlink_unicast+0x282/0x3e0\n ? __alloc_skb+0xd6/0x190\n netlink_sendmsg+0x1f7/0x430\n __sys_sendto+0x213/0x220\n ? __sys_recvmsg+0x6a/0xd0\n __x64_sys_sendto+0x24/0x30\n do_syscall_64+0x50/0x1f0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\nRIP: 0033:0x7fdfb8495047(CVE-2026-23000)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nx86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1\n\nWhen loading guest XSAVE state via KVM_SET_XSAVE, and when updating XFD in\nresponse to a guest WRMSR, clear XFD-disabled features in the saved (or to\nbe restored) XSTATE_BV to ensure KVM doesn\u0026apos;t attempt to load state for\nfeatures that are disabled via the guest\u0026apos;s XFD.  Because the kernel\nexecutes XRSTOR with the guest\u0026apos;s XFD, saving XSTATE_BV[i]=1 with XFD[i]=1\nwill cause XRSTOR to #NM and panic the kernel.\n\nE.g. if fpu_update_guest_xfd() sets XFD without clearing XSTATE_BV:\n\n  ------------[ cut here ]------------\n  WARNING: arch/x86/kernel/traps.c:1524 at exc_device_not_available+0x101/0x110, CPU#29: amx_test/848\n  Modules linked in: kvm_intel kvm irqbypass\n  CPU: 29 UID: 1000 PID: 848 Comm: amx_test Not tainted 6.19.0-rc2-ffa07f7fd437-x86_amx_nm_xfd_non_init-vm #171 NONE\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n  RIP: 0010:exc_device_not_available+0x101/0x110\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   asm_exc_device_not_available+0x1a/0x20\n  RIP: 0010:restore_fpregs_from_fpstate+0x36/0x90\n   switch_fpu_return+0x4a/0xb0\n   kvm_arch_vcpu_ioctl_run+0x1245/0x1e40 [kvm]\n   kvm_vcpu_ioctl+0x2c3/0x8f0 [kvm]\n   __x64_sys_ioctl+0x8f/0xd0\n   do_syscall_64+0x62/0x940\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n   \u0026lt;/TASK\u0026gt;\n  ---[ end trace 0000000000000000 ]---\n\nThis can happen if the guest executes WRMSR(MSR_IA32_XFD) to set XFD[18] = 1,\nand a host IRQ triggers kernel_fpu_begin() prior to the vmexit handler\u0026apos;s\ncall to fpu_update_guest_xfd().\n\nand if userspace stuffs XSTATE_BV[i]=1 via KVM_SET_XSAVE:\n\n  ------------[ cut here ]------------\n  WARNING: arch/x86/kernel/traps.c:1524 at exc_device_not_available+0x101/0x110, CPU#14: amx_test/867\n  Modules linked in: kvm_intel kvm irqbypass\n  CPU: 14 UID: 1000 PID: 867 Comm: amx_test Not tainted 6.19.0-rc2-2dace9faccd6-x86_amx_nm_xfd_non_init-vm #168 NONE\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n  RIP: 0010:exc_device_not_available+0x101/0x110\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   asm_exc_device_not_available+0x1a/0x20\n  RIP: 0010:restore_fpregs_from_fpstate+0x36/0x90\n   fpu_swap_kvm_fpstate+0x6b/0x120\n   kvm_load_guest_fpu+0x30/0x80 [kvm]\n   kvm_arch_vcpu_ioctl_run+0x85/0x1e40 [kvm]\n   kvm_vcpu_ioctl+0x2c3/0x8f0 [kvm]\n   __x64_sys_ioctl+0x8f/0xd0\n   do_syscall_64+0x62/0x940\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n   \u0026lt;/TASK\u0026gt;\n  ---[ end trace 0000000000000000 ]---\n\nThe new behavior is consistent with the AMX architecture.  Per Intel\u0026apos;s SDM,\nXSAVE saves XSTATE_BV as \u0026apos;0\u0026apos; for components that are disabled via XFD\n(and non-compacted XSAVE saves the initial configuration of the state\ncomponent):\n\n  If XSAVE, XSAVEC, XSAVEOPT, or XSAVES is saving the state component i,\n  the instruction does not generate #NM when XCR0[i] = IA32_XFD[i] = 1;\n  instead, it operates as if XINUSE[i] = 0 (and the state component was\n  in its initial state): it saves bit i of XSTATE_BV field of the XSAVE\n  header as 0; in addition, XSAVE saves the initial configuration of the\n  state component (the other instructions do not save state component i).\n\nAlternatively, KVM could always do XRSTOR with XFD=0, e.g. by using\na constant XFD based on the set of enabled features when XSAVEing for\na struct fpu_guest.  However, having XSTATE_BV[i]=1 for XFD-disabled\nfeatures can only happen in the above interrupt case, or in similar\nscenarios involving preemption on preemptible kernels, because\nfpu_swap_kvm_fpstate()\u0026apos;s call to save_fpregs_to_fpstate() saves the\noutgoing FPU state with the current XFD; and that is (on all but the\nfirst WRMSR to XFD) the guest XFD.\n\nTherefore, XFD can only go out of sync with XSTATE_BV in the above\ninterrupt case, or in similar scenarios involving preemption on\npreemptible kernels, and it we can consider it (de facto) part of KVM\nABI that KVM_GET_XSAVE returns XSTATE_BV[i]=0 for XFD-disabled features.\n\n[Move clea\n---truncated---(CVE-2026-23005)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv\n\nmlx5e_priv is an unstable structure that can be memset(0) if profile\nattaching fails.\n\nPass netdev to mlx5e_destroy_netdev() to guarantee it will work on a\nvalid netdev.\n\nOn mlx5e_remove: Check validity of priv-\u0026gt;profile, before attempting\nto cleanup any resources that might be not there.\n\nThis fixes a kernel oops in mlx5e_remove when switchdev mode fails due\nto change profile failure.\n\n$ devlink dev eswitch set pci/0000:00:03.0 mode switchdev\nError: mlx5_core: Failed setting eswitch to offloads.\ndmesg:\nworkqueue: Failed to create a rescuer kthread for wq \u0026quot;mlx5e\u0026quot;: -EINTR\nmlx5_core 0012:03:00.1: mlx5e_netdev_init_profile:6214:(pid 37199): mlx5e_priv_init failed, err=-12\nmlx5_core 0012:03:00.1 gpu3rdma1: mlx5e_netdev_change_profile: new profile init failed, -12\nworkqueue: Failed to create a rescuer kthread for wq \u0026quot;mlx5e\u0026quot;: -EINTR\nmlx5_core 0012:03:00.1: mlx5e_netdev_init_profile:6214:(pid 37199): mlx5e_priv_init failed, err=-12\nmlx5_core 0012:03:00.1 gpu3rdma1: mlx5e_netdev_change_profile: failed to rollback to orig profile, -12\n\n$ devlink dev reload pci/0000:00:03.0 ==\u0026gt; oops\n\nBUG: kernel NULL pointer dereference, address: 0000000000000370\nPGD 0 P4D 0\nOops: Oops: 0000 [#1] SMP NOPTI\nCPU: 15 UID: 0 PID: 520 Comm: devlink Not tainted 6.18.0-rc5+ #115 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014\nRIP: 0010:mlx5e_dcbnl_dscp_app+0x23/0x100\nRSP: 0018:ffffc9000083f8b8 EFLAGS: 00010286\nRAX: ffff8881126fc380 RBX: ffff8881015ac400 RCX: ffffffff826ffc45\nRDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8881035109c0\nRBP: ffff8881035109c0 R08: ffff888101e3e838 R09: ffff888100264e10\nR10: ffffc9000083f898 R11: ffffc9000083f8a0 R12: ffff888101b921a0\nR13: ffff888101b921a0 R14: ffff8881015ac9a0 R15: ffff8881015ac400\nFS:  00007f789a3c8740(0000) GS:ffff88856aa59000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000370 CR3: 000000010b6c0001 CR4: 0000000000370ef0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n mlx5e_remove+0x57/0x110\n device_release_driver_internal+0x19c/0x200\n bus_remove_device+0xc6/0x130\n device_del+0x160/0x3d0\n ? devl_param_driverinit_value_get+0x2d/0x90\n mlx5_detach_device+0x89/0xe0\n mlx5_unload_one_devl_locked+0x3a/0x70\n mlx5_devlink_reload_down+0xc8/0x220\n devlink_reload+0x7d/0x260\n devlink_nl_reload_doit+0x45b/0x5a0\n genl_family_rcv_msg_doit+0xe8/0x140(CVE-2026-23035)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: authencesn - reject too-short AAD (assoclen\u0026lt;8) to match ESP/ESN spec\n\nauthencesn assumes an ESP/ESN-formatted AAD. When assoclen is shorter than\nthe minimum expected length, crypto_authenc_esn_decrypt() can advance past\nthe end of the destination scatterlist and trigger a NULL pointer dereference\nin scatterwalk_map_and_copy(), leading to a kernel panic (DoS).\n\nAdd a minimum AAD length check to fail fast on invalid inputs.(CVE-2026-23060)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvsock/virtio: fix potential underflow in virtio_transport_get_credit()\n\nThe credit calculation in virtio_transport_get_credit() uses unsigned\narithmetic:\n\n  ret = vvs-\u0026gt;peer_buf_alloc - (vvs-\u0026gt;tx_cnt - vvs-\u0026gt;peer_fwd_cnt);\n\nIf the peer shrinks its advertised buffer (peer_buf_alloc) while bytes\nare in flight, the subtraction can underflow and produce a large\npositive value, potentially allowing more data to be queued than the\npeer can handle.\n\nReuse virtio_transport_has_space() which already handles this case and\nadd a comment to make it clear why we are doing that.\n\n[Stefano: use virtio_transport_has_space() instead of duplicating the code]\n[Stefano: tweak the commit message](CVE-2026-23069)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nregmap: Fix race condition in hwspinlock irqsave routine\n\nPreviously, the address of the shared member \u0026apos;\u0026amp;map-\u0026gt;spinlock_flags\u0026apos; was\npassed directly to \u0026apos;hwspin_lock_timeout_irqsave\u0026apos;. This creates a race\ncondition where multiple contexts contending for the lock could overwrite\nthe shared flags variable, potentially corrupting the state for the\ncurrent lock owner.\n\nFix this by using a local stack variable \u0026apos;flags\u0026apos; to store the IRQ state\ntemporarily.(CVE-2026-23071)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvsock/virtio: cap TX credit to local buffer size\n\nThe virtio transports derives its TX credit directly from peer_buf_alloc,\nwhich is set from the remote endpoint\u0026apos;s SO_VM_SOCKETS_BUFFER_SIZE value.\n\nOn the host side this means that the amount of data we are willing to\nqueue for a connection is scaled by a guest-chosen buffer size, rather\nthan the host\u0026apos;s own vsock configuration. A malicious guest can advertise\na large buffer and read slowly, causing the host to allocate a\ncorrespondingly large amount of sk_buff memory.\nThe same thing would happen in the guest with a malicious host, since\nvirtio transports share the same code base.\n\nIntroduce a small helper, virtio_transport_tx_buf_size(), that\nreturns min(peer_buf_alloc, buf_alloc), and use it wherever we consume\npeer_buf_alloc.\n\nThis ensures the effective TX window is bounded by both the peer\u0026apos;s\nadvertised buffer and our own buf_alloc (already clamped to\nbuffer_max_size via SO_VM_SOCKETS_BUFFER_MAX_SIZE), so a remote peer\ncannot force the other to queue more data than allowed by its own\nvsock settings.\n\nOn an unpatched Ubuntu 22.04 host (~64 GiB RAM), running a PoC with\n32 guest vsock connections advertising 2 GiB each and reading slowly\ndrove Slab/SUnreclaim from ~0.5 GiB to ~57 GiB; the system only\nrecovered after killing the QEMU process. That said, if QEMU memory is\nlimited with cgroups, the maximum memory used will be limited.\n\nWith this patch applied:\n\n  Before:\n    MemFree:        ~61.6 GiB\n    Slab:           ~142 MiB\n    SUnreclaim:     ~117 MiB\n\n  After 32 high-credit connections:\n    MemFree:        ~61.5 GiB\n    Slab:           ~178 MiB\n    SUnreclaim:     ~152 MiB\n\nOnly ~35 MiB increase in Slab/SUnreclaim, no host OOM, and the guest\nremains responsive.\n\nCompatibility with non-virtio transports:\n\n  - VMCI uses the AF_VSOCK buffer knobs to size its queue pairs per\n    socket based on the local vsk-\u0026gt;buffer_* values; the remote side\n    cannot enlarge those queues beyond what the local endpoint\n    configured.\n\n  - Hyper-V\u0026apos;s vsock transport uses fixed-size VMBus ring buffers and\n    an MTU bound; there is no peer-controlled credit field comparable\n    to peer_buf_alloc, and the remote endpoint cannot drive in-flight\n    kernel memory above those ring sizes.\n\n  - The loopback path reuses virtio_transport_common.c, so it\n    naturally follows the same semantics as the virtio transport.\n\nThis change is limited to virtio_transport_common.c and thus affects\nvirtio-vsock, vhost-vsock, and loopback, bringing them in line with the\n\u0026quot;remote window intersected with local policy\u0026quot; behaviour that VMCI and\nHyper-V already effectively have.\n\n[Stefano: small adjustments after changing the previous patch]\n[Stefano: tweak the commit message](CVE-2026-23086)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbonding: limit BOND_MODE_8023AD to Ethernet devices\n\nBOND_MODE_8023AD makes sense for ARPHRD_ETHER only.\n\nsyzbot reported:\n\n BUG: KASAN: global-out-of-bounds in __hw_addr_create net/core/dev_addr_lists.c:63 [inline]\n BUG: KASAN: global-out-of-bounds in __hw_addr_add_ex+0x25d/0x760 net/core/dev_addr_lists.c:118\nRead of size 16 at addr ffffffff8bf94040 by task syz.1.3580/19497\n\nCPU: 1 UID: 0 PID: 19497 Comm: syz.1.3580 Tainted: G             L      syzkaller #0 PREEMPT(full)\nTainted: [L]=SOFTLOCKUP\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025\nCall Trace:\n \u0026lt;TASK\u0026gt;\n  dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120\n  print_address_description mm/kasan/report.c:378 [inline]\n  print_report+0xca/0x240 mm/kasan/report.c:482\n  kasan_report+0x118/0x150 mm/kasan/report.c:595\n check_region_inline mm/kasan/generic.c:-1 [inline]\n  kasan_check_range+0x2b0/0x2c0 mm/kasan/generic.c:200\n  __asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105\n  __hw_addr_create net/core/dev_addr_lists.c:63 [inline]\n  __hw_addr_add_ex+0x25d/0x760 net/core/dev_addr_lists.c:118\n  __dev_mc_add net/core/dev_addr_lists.c:868 [inline]\n  dev_mc_add+0xa1/0x120 net/core/dev_addr_lists.c:886\n  bond_enslave+0x2b8b/0x3ac0 drivers/net/bonding/bond_main.c:2180\n  do_set_master+0x533/0x6d0 net/core/rtnetlink.c:2963\n  do_setlink+0xcf0/0x41c0 net/core/rtnetlink.c:3165\n  rtnl_changelink net/core/rtnetlink.c:3776 [inline]\n  __rtnl_newlink net/core/rtnetlink.c:3935 [inline]\n  rtnl_newlink+0x161c/0x1c90 net/core/rtnetlink.c:4072\n  rtnetlink_rcv_msg+0x7cf/0xb70 net/core/rtnetlink.c:6958\n  netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2550\n  netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]\n  netlink_unicast+0x82f/0x9e0 net/netlink/af_netlink.c:1344\n  netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1894\n  sock_sendmsg_nosec net/socket.c:727 [inline]\n  __sock_sendmsg+0x21c/0x270 net/socket.c:742\n  ____sys_sendmsg+0x505/0x820 net/socket.c:2592\n  ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2646\n  __sys_sendmsg+0x164/0x220 net/socket.c:2678\n  do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]\n  __do_fast_syscall_32+0x1dc/0x560 arch/x86/entry/syscall_32.c:307\n  do_fast_syscall_32+0x34/0x80 arch/x86/entry/syscall_32.c:332\n entry_SYSENTER_compat_after_hwframe+0x84/0x8e\n \u0026lt;/TASK\u0026gt;\n\nThe buggy address belongs to the variable:\n lacpdu_mcast_addr+0x0/0x40(CVE-2026-23099)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipvlan: Make the addrs_lock be per port\n\nMake the addrs_lock be per port, not per ipvlan dev.\n\nInitial code seems to be written in the assumption,\nthat any address change must occur under RTNL.\nBut it is not so for the case of IPv6. So\n\n1) Introduce per-port addrs_lock.\n\n2) It was needed to fix places where it was forgotten\nto take lock (ipvlan_open/ipvlan_close)\n\nThis appears to be a very minor problem though.\nSince it\u0026apos;s highly unlikely that ipvlan_add_addr() will\nbe called on 2 CPU simultaneously. But nevertheless,\nthis could cause:\n\n1) False-negative of ipvlan_addr_busy(): one interface\niterated through all port-\u0026gt;ipvlans + ipvlan-\u0026gt;addrs\nunder some ipvlan spinlock, and another added IP\nunder its own lock. Though this is only possible\nfor IPv6, since looks like only ipvlan_addr6_event() can be\ncalled without rtnl_lock.\n\n2) Race since ipvlan_ht_addr_add(port) is called under\ndifferent ipvlan-\u0026gt;addrs_lock locks\n\nThis should not affect performance, since add/remove IP\nis a rare situation and spinlock is not taken on fast\npaths.(CVE-2026-23103)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag\n\nThis is more of a preventive patch to make the code more consistent and\nto prevent possible exploits that employ child qlen manipulations on qfq.\nuse cl_is_active instead of relying on the child qdisc\u0026apos;s qlen to determine\nclass activation.(CVE-2026-23105)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()\n\nnft_map_catchall_activate() has an inverted element activity check\ncompared to its non-catchall counterpart nft_mapelem_activate() and\ncompared to what is logically required.\n\nnft_map_catchall_activate() is called from the abort path to re-activate\ncatchall map elements that were deactivated during a failed transaction.\nIt should skip elements that are already active (they don\u0026apos;t need\nre-activation) and process elements that are inactive (they need to be\nrestored). Instead, the current code does the opposite: it skips inactive\nelements and processes active ones.\n\nCompare the non-catchall activate callback, which is correct:\n\n  nft_mapelem_activate():\n    if (nft_set_elem_active(ext, iter-\u0026gt;genmask))\n        return 0;   /* skip active, process inactive */\n\nWith the buggy catchall version:\n\n  nft_map_catchall_activate():\n    if (!nft_set_elem_active(ext, genmask))\n        continue;   /* skip inactive, process active */\n\nThe consequence is that when a DELSET operation is aborted,\nnft_setelem_data_activate() is never called for the catchall element.\nFor NFT_GOTO verdict elements, this means nft_data_hold() is never\ncalled to restore the chain-\u0026gt;use reference count. Each abort cycle\npermanently decrements chain-\u0026gt;use. Once chain-\u0026gt;use reaches zero,\nDELCHAIN succeeds and frees the chain while catchall verdict elements\nstill reference it, resulting in a use-after-free.\n\nThis is exploitable for local privilege escalation from an unprivileged\nuser via user namespaces + nftables on distributions that enable\nCONFIG_USER_NS and CONFIG_NF_TABLES.\n\nFix by removing the negation so the check matches nft_mapelem_activate():\nskip active elements, process inactive ones.(CVE-2026-23111)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nl2tp: avoid one data-race in l2tp_tunnel_del_work()\n\nWe should read sk-\u0026gt;sk_socket only when dealing with kernel sockets.\n\nsyzbot reported the following data-race:\n\nBUG: KCSAN: data-race in l2tp_tunnel_del_work / sk_common_release\n\nwrite to 0xffff88811c182b20 of 8 bytes by task 5365 on cpu 0:\n  sk_set_socket include/net/sock.h:2092 [inline]\n  sock_orphan include/net/sock.h:2118 [inline]\n  sk_common_release+0xae/0x230 net/core/sock.c:4003\n  udp_lib_close+0x15/0x20 include/net/udp.h:325\n  inet_release+0xce/0xf0 net/ipv4/af_inet.c:437\n  __sock_release net/socket.c:662 [inline]\n  sock_close+0x6b/0x150 net/socket.c:1455\n  __fput+0x29b/0x650 fs/file_table.c:468\n  ____fput+0x1c/0x30 fs/file_table.c:496\n  task_work_run+0x131/0x1a0 kernel/task_work.c:233\n  resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]\n  __exit_to_user_mode_loop kernel/entry/common.c:44 [inline]\n  exit_to_user_mode_loop+0x1fe/0x740 kernel/entry/common.c:75\n  __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]\n  syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]\n  syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]\n  syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]\n  do_syscall_64+0x1e1/0x2b0 arch/x86/entry/syscall_64.c:100\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nread to 0xffff88811c182b20 of 8 bytes by task 827 on cpu 1:\n  l2tp_tunnel_del_work+0x2f/0x1a0 net/l2tp/l2tp_core.c:1418\n  process_one_work kernel/workqueue.c:3257 [inline]\n  process_scheduled_works+0x4ce/0x9d0 kernel/workqueue.c:3340\n  worker_thread+0x582/0x770 kernel/workqueue.c:3421\n  kthread+0x489/0x510 kernel/kthread.c:463\n  ret_from_fork+0x149/0x290 arch/x86/kernel/process.c:158\n  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246\n\nvalue changed: 0xffff88811b818000 -\u0026gt; 0x0000000000000000(CVE-2026-23120)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv6: annotate data-race in ndisc_router_discovery()\n\nsyzbot found that ndisc_router_discovery() could read and write\nin6_dev-\u0026gt;ra_mtu without holding a lock [1]\n\nThis looks fine, IFLA_INET6_RA_MTU is best effort.\n\nAdd READ_ONCE()/WRITE_ONCE() to document the race.\n\nNote that we might also reject illegal MTU values\n(mtu \u0026lt; IPV6_MIN_MTU || mtu \u0026gt; skb-\u0026gt;dev-\u0026gt;mtu) in a future patch.\n\n[1]\nBUG: KCSAN: data-race in ndisc_router_discovery / ndisc_router_discovery\n\nread to 0xffff888119809c20 of 4 bytes by task 25817 on cpu 1:\n  ndisc_router_discovery+0x151d/0x1c90 net/ipv6/ndisc.c:1558\n  ndisc_rcv+0x2ad/0x3d0 net/ipv6/ndisc.c:1841\n  icmpv6_rcv+0xe5a/0x12f0 net/ipv6/icmp.c:989\n  ip6_protocol_deliver_rcu+0xb2a/0x10d0 net/ipv6/ip6_input.c:438\n  ip6_input_finish+0xf0/0x1d0 net/ipv6/ip6_input.c:489\n  NF_HOOK include/linux/netfilter.h:318 [inline]\n  ip6_input+0x5e/0x140 net/ipv6/ip6_input.c:500\n  ip6_mc_input+0x27c/0x470 net/ipv6/ip6_input.c:590\n  dst_input include/net/dst.h:474 [inline]\n  ip6_rcv_finish+0x336/0x340 net/ipv6/ip6_input.c:79\n...\n\nwrite to 0xffff888119809c20 of 4 bytes by task 25816 on cpu 0:\n  ndisc_router_discovery+0x155a/0x1c90 net/ipv6/ndisc.c:1559\n  ndisc_rcv+0x2ad/0x3d0 net/ipv6/ndisc.c:1841\n  icmpv6_rcv+0xe5a/0x12f0 net/ipv6/icmp.c:989\n  ip6_protocol_deliver_rcu+0xb2a/0x10d0 net/ipv6/ip6_input.c:438\n  ip6_input_finish+0xf0/0x1d0 net/ipv6/ip6_input.c:489\n  NF_HOOK include/linux/netfilter.h:318 [inline]\n  ip6_input+0x5e/0x140 net/ipv6/ip6_input.c:500\n  ip6_mc_input+0x27c/0x470 net/ipv6/ip6_input.c:590\n  dst_input include/net/dst.h:474 [inline]\n  ip6_rcv_finish+0x336/0x340 net/ipv6/ip6_input.c:79\n...\n\nvalue changed: 0x00000000 -\u0026gt; 0xe5400659(CVE-2026-23124)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetdevsim: fix a race issue related to the operation on bpf_bound_progs list\n\nThe netdevsim driver lacks a protection mechanism for operations on the\nbpf_bound_progs list. When the nsim_bpf_create_prog() performs\nlist_add_tail, it is possible that nsim_bpf_destroy_prog() is\nsimultaneously performs list_del. Concurrent operations on the list may\nlead to list corruption and trigger a kernel crash as follows:\n\n[  417.290971] kernel BUG at lib/list_debug.c:62!\n[  417.290983] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI\n[  417.290992] CPU: 10 PID: 168 Comm: kworker/10:1 Kdump: loaded Not tainted 6.19.0-rc5 #1\n[  417.291003] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[  417.291007] Workqueue: events bpf_prog_free_deferred\n[  417.291021] RIP: 0010:__list_del_entry_valid_or_report+0xa7/0xc0\n[  417.291034] Code: a8 ff 0f 0b 48 89 fe 48 89 ca 48 c7 c7 48 a1 eb ae e8 ed fb a8 ff 0f 0b 48 89 fe 48 89 c2 48 c7 c7 80 a1 eb ae e8 d9 fb a8 ff \u0026lt;0f\u0026gt; 0b 48 89 d1 48 c7 c7 d0 a1 eb ae 48 89 f2 48 89 c6 e8 c2 fb a8\n[  417.291040] RSP: 0018:ffffb16a40807df8 EFLAGS: 00010246\n[  417.291046] RAX: 000000000000006d RBX: ffff8e589866f500 RCX: 0000000000000000\n[  417.291051] RDX: 0000000000000000 RSI: ffff8e59f7b23180 RDI: ffff8e59f7b23180\n[  417.291055] RBP: ffffb16a412c9000 R08: 0000000000000000 R09: 0000000000000003\n[  417.291059] R10: ffffb16a40807c80 R11: ffffffffaf9edce8 R12: ffff8e594427ac20\n[  417.291063] R13: ffff8e59f7b44780 R14: ffff8e58800b7a05 R15: 0000000000000000\n[  417.291074] FS:  0000000000000000(0000) GS:ffff8e59f7b00000(0000) knlGS:0000000000000000\n[  417.291079] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  417.291083] CR2: 00007fc4083efe08 CR3: 00000001c3626006 CR4: 0000000000770ee0\n[  417.291088] PKRU: 55555554\n[  417.291091] Call Trace:\n[  417.291096]  \u0026lt;TASK\u0026gt;\n[  417.291103]  nsim_bpf_destroy_prog+0x31/0x80 [netdevsim]\n[  417.291154]  __bpf_prog_offload_destroy+0x2a/0x80\n[  417.291163]  bpf_prog_dev_bound_destroy+0x6f/0xb0\n[  417.291171]  bpf_prog_free_deferred+0x18e/0x1a0\n[  417.291178]  process_one_work+0x18a/0x3a0\n[  417.291188]  worker_thread+0x27b/0x3a0\n[  417.291197]  ? __pfx_worker_thread+0x10/0x10\n[  417.291207]  kthread+0xe5/0x120\n[  417.291214]  ? __pfx_kthread+0x10/0x10\n[  417.291221]  ret_from_fork+0x31/0x50\n[  417.291230]  ? __pfx_kthread+0x10/0x10\n[  417.291236]  ret_from_fork_asm+0x1a/0x30\n[  417.291246]  \u0026lt;/TASK\u0026gt;\n\nAdd a mutex lock, to prevent simultaneous addition and deletion operations\non the list.(CVE-2026-23126)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath10k: fix dma_free_coherent() pointer\n\ndma_alloc_coherent() allocates a DMA mapped buffer and stores the\naddresses in XXX_unaligned fields.  Those should be reused when freeing\nthe buffer rather than the aligned addresses.(CVE-2026-23133)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: reset sparse-read state in osd_fault()\n\nWhen a fault occurs, the connection is abandoned, reestablished, and any\npending operations are retried. The OSD client tracks the progress of a\nsparse-read reply using a separate state machine, largely independent of\nthe messenger\u0026apos;s state.\n\nIf a connection is lost mid-payload or the sparse-read state machine\nreturns an error, the sparse-read state is not reset. The OSD client\nwill then interpret the beginning of a new reply as the continuation of\nthe old one. If this makes the sparse-read machinery enter a failure\nstate, it may never recover, producing loops like:\n\n  libceph:  [0] got 0 extents\n  libceph: data len 142248331 != extent len 0\n  libceph: osd0 (1)...:6801 socket error on read\n  libceph: data len 142248331 != extent len 0\n  libceph: osd0 (1)...:6801 socket error on read\n\nTherefore, reset the sparse-read state in osd_fault(), ensuring retries\nstart from a clean state.(CVE-2026-23136)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nof: unittest: Fix memory leak in unittest_data_add()\n\nIn unittest_data_add(), if of_resolve_phandles() fails, the allocated\nunittest_data is not freed, leading to a memory leak.\n\nFix this by using scope-based cleanup helper __free(kfree) for automatic\nresource cleanup. This ensures unittest_data is automatically freed when\nit goes out of scope in error paths.\n\nFor the success path, use retain_and_null_ptr() to transfer ownership\nof the memory to the device tree and prevent double freeing.(CVE-2026-23137)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Add recursion protection in kernel stack trace recording\n\nA bug was reported about an infinite recursion caused by tracing the rcu\nevents with the kernel stack trace trigger enabled. The stack trace code\ncalled back into RCU which then called the stack trace again.\n\nExpand the ftrace recursion protection to add a set of bits to protect\nevents from recursion. Each bit represents the context that the event is\nin (normal, softirq, interrupt and NMI).\n\nHave the stack trace code use the interrupt context to protect against\nrecursion.\n\nNote, the bug showed an issue in both the RCU code as well as the tracing\nstacktrace code. This only handles the tracing stack trace side of the\nbug. The RCU fix will be handled separately.(CVE-2026-23138)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conncount: update last_gc only when GC has been performed\n\nCurrently last_gc is being updated everytime a new connection is\ntracked, that means that it is updated even if a GC wasn\u0026apos;t performed.\nWith a sufficiently high packet rate, it is possible to always bypass\nthe GC, causing the list to grow infinitely.\n\nUpdate the last_gc value only when a GC has been actually performed.(CVE-2026-23139)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\next4: fix iloc.bh leak in ext4_xattr_inode_update_ref\n\nThe error branch for ext4_xattr_inode_update_ref forget to release the\nrefcount for iloc.bh. Find this when review code.(CVE-2026-23145)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix segmentation of forwarding fraglist GRO\n\nThis patch enhances GSO segment handling by properly checking\nthe SKB_GSO_DODGY flag for frag_list GSO packets, addressing\nlow throughput issues observed when a station accesses IPv4\nservers via hotspots with an IPv6-only upstream interface.\n\nSpecifically, it fixes a bug in GSO segmentation when forwarding\nGRO packets containing a frag_list. The function skb_segment_list\ncannot correctly process GRO skbs that have been converted by XLAT,\nsince XLAT only translates the header of the head skb. Consequently,\nskbs in the frag_list may remain untranslated, resulting in protocol\ninconsistencies and reduced throughput.\n\nTo address this, the patch explicitly sets the SKB_GSO_DODGY flag\nfor GSO packets in XLAT\u0026apos;s IPv4/IPv6 protocol translation helpers\n(bpf_skb_proto_4_to_6 and bpf_skb_proto_6_to_4). This marks GSO\npackets as potentially modified after protocol translation. As a\nresult, GSO segmentation will avoid using skb_segment_list and\ninstead falls back to skb_segment for packets with the SKB_GSO_DODGY\nflag. This ensures that only safe and fully translated frag_list\npackets are processed by skb_segment_list, resolving protocol\ninconsistencies and improving throughput when forwarding GRO packets\nconverted by XLAT.(CVE-2026-23154)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nefivarfs: fix error propagation in efivar_entry_get()\n\nefivar_entry_get() always returns success even if the underlying\n__efivar_entry_get() fails, masking errors.\n\nThis may result in uninitialized heap memory being copied to userspace\nin the efivarfs_file_read() path.\n\nFix it by returning the error from __efivar_entry_get().(CVE-2026-23156)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix race in mptcp_pm_nl_flush_addrs_doit()\n\nsyzbot and Eulgyu Kim reported crashes in mptcp_pm_nl_get_local_id()\nand/or mptcp_pm_nl_is_backup()\n\nRoot cause is list_splice_init() in mptcp_pm_nl_flush_addrs_doit()\nwhich is not RCU ready.\n\nlist_splice_init_rcu() can not be called here while holding pernet-\u0026gt;lock\nspinlock.\n\nMany thanks to Eulgyu Kim for providing a repro and testing our patches.(CVE-2026-23169)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: TC, delete flows only for existing peers\n\nWhen deleting TC steering flows, iterate only over actual devcom\npeers instead of assuming all possible ports exist. This avoids\ntouching non-existent peers and ensures cleanup is limited to\ndevices the driver is currently connected to.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000008\n #PF: supervisor write access in kernel mode\n #PF: error_code(0x0002) - not-present page\n PGD 133c8a067 P4D 0\n Oops: Oops: 0002 [#1] SMP\n CPU: 19 UID: 0 PID: 2169 Comm: tc Not tainted 6.18.0+ #156 NONE\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\n RIP: 0010:mlx5e_tc_del_fdb_peers_flow+0xbe/0x200 [mlx5_core]\n Code: 00 00 a8 08 74 a8 49 8b 46 18 f6 c4 02 74 9f 4c 8d bf a0 12 00 00 4c 89 ff e8 0e e7 96 e1 49 8b 44 24 08 49 8b 0c 24 4c 89 ff \u0026lt;48\u0026gt; 89 41 08 48 89 08 49 89 2c 24 49 89 5c 24 08 e8 7d ce 96 e1 49\n RSP: 0018:ff11000143867528 EFLAGS: 00010246\n RAX: 0000000000000000 RBX: dead000000000122 RCX: 0000000000000000\n RDX: ff11000143691580 RSI: ff110001026e5000 RDI: ff11000106f3d2a0\n RBP: dead000000000100 R08: 00000000000003fd R09: 0000000000000002\n R10: ff11000101c75690 R11: ff1100085faea178 R12: ff11000115f0ae78\n R13: 0000000000000000 R14: ff11000115f0a800 R15: ff11000106f3d2a0\n FS:  00007f35236bf740(0000) GS:ff110008dc809000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 0000000000000008 CR3: 0000000157a01001 CR4: 0000000000373eb0\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  mlx5e_tc_del_flow+0x46/0x270 [mlx5_core]\n  mlx5e_flow_put+0x25/0x50 [mlx5_core]\n  mlx5e_delete_flower+0x2a6/0x3e0 [mlx5_core]\n  tc_setup_cb_reoffload+0x20/0x80\n  fl_reoffload+0x26f/0x2f0 [cls_flower]\n  ? mlx5e_tc_reoffload_flows_work+0xc0/0xc0 [mlx5_core]\n  ? mlx5e_tc_reoffload_flows_work+0xc0/0xc0 [mlx5_core]\n  tcf_block_playback_offloads+0x9e/0x1c0\n  tcf_block_unbind+0x7b/0xd0\n  tcf_block_setup+0x186/0x1d0\n  tcf_block_offload_cmd.isra.0+0xef/0x130\n  tcf_block_offload_unbind+0x43/0x70\n  __tcf_block_put+0x85/0x160\n  ingress_destroy+0x32/0x110 [sch_ingress]\n  __qdisc_destroy+0x44/0x100\n  qdisc_graft+0x22b/0x610\n  tc_get_qdisc+0x183/0x4d0\n  rtnetlink_rcv_msg+0x2d7/0x3d0\n  ? rtnl_calcit.isra.0+0x100/0x100\n  netlink_rcv_skb+0x53/0x100\n  netlink_unicast+0x249/0x320\n  ? __alloc_skb+0x102/0x1f0\n  netlink_sendmsg+0x1e3/0x420\n  __sock_sendmsg+0x38/0x60\n  ____sys_sendmsg+0x1ef/0x230\n  ? copy_msghdr_from_user+0x6c/0xa0\n  ___sys_sendmsg+0x7f/0xc0\n  ? ___sys_recvmsg+0x8a/0xc0\n  ? __sys_sendto+0x119/0x180\n  __sys_sendmsg+0x61/0xb0\n  do_syscall_64+0x55/0x640\n  entry_SYSCALL_64_after_hwframe+0x4b/0x53\n RIP: 0033:0x7f35238bb764\n Code: 15 b9 86 0c 00 f7 d8 64 89 02 b8 ff ff ff ff eb bf 0f 1f 44 00 00 f3 0f 1e fa 80 3d e5 08 0d 00 00 74 13 b8 2e 00 00 00 0f 05 \u0026lt;48\u0026gt; 3d 00 f0 ff ff 77 4c c3 0f 1f 00 55 48 89 e5 48 83 ec 20 89 55\n RSP: 002b:00007ffed4c35638 EFLAGS: 00000202 ORIG_RAX: 000000000000002e\n RAX: ffffffffffffffda RBX: 000055a2efcc75e0 RCX: 00007f35238bb764\n RDX: 0000000000000000 RSI: 00007ffed4c356a0 RDI: 0000000000000003\n RBP: 00007ffed4c35710 R08: 0000000000000010 R09: 00007f3523984b20\n R10: 0000000000000004 R11: 0000000000000202 R12: 00007ffed4c35790\n R13: 000000006947df8f R14: 000055a2efcc75e0 R15: 00007ffed4c35780(CVE-2026-23173)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nALSA: aloop: Fix racy access at PCM trigger\n\nThe PCM trigger callback of aloop driver tries to check the PCM state\nand stop the stream of the tied substream in the corresponding cable.\nSince both check and stop operations are performed outside the cable\nlock, this may result in UAF when a program attempts to trigger\nfrequently while opening/closing the tied stream, as spotted by\nfuzzers.\n\nFor addressing the UAF, this patch changes two things:\n- It covers the most of code in loopback_check_format() with\n  cable-\u0026gt;lock spinlock, and add the proper NULL checks.  This avoids\n  already some racy accesses.\n- In addition, now we try to check the state of the capture PCM stream\n  that may be stopped in this function, which was the major pain point\n  leading to UAF.(CVE-2026-23191)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKVM: Don\u0026apos;t clobber irqfd routing type when deassigning irqfd\n\nWhen deassigning a KVM_IRQFD, don\u0026apos;t clobber the irqfd\u0026apos;s copy of the IRQ\u0026apos;s\nrouting entry as doing so breaks kvm_arch_irq_bypass_del_producer() on x86\nand arm64, which explicitly look for KVM_IRQ_ROUTING_MSI.  Instead, to\nhandle a concurrent routing update, verify that the irqfd is still active\nbefore consuming the routing information.  As evidenced by the x86 and\narm64 bugs, and another bug in kvm_arch_update_irqfd_routing() (see below),\nclobbering the entry type without notifying arch code is surprising and\nerror prone.\n\nAs a bonus, checking that the irqfd is active provides a convenient\nlocation for documenting _why_ KVM must not consume the routing entry for\nan irqfd that is in the process of being deassigned: once the irqfd is\ndeleted from the list (which happens *before* the eventfd is detached), it\nwill no longer receive updates via kvm_irq_routing_update(), and so KVM\ncould deliver an event using stale routing information (relative to\nKVM_SET_GSI_ROUTING returning to userspace).\n\nAs an even better bonus, explicitly checking for the irqfd being active\nfixes a similar bug to the one the clobbering is trying to prevent: if an\nirqfd is deactivated, and then its routing is changed,\nkvm_irq_routing_update() won\u0026apos;t invoke kvm_arch_update_irqfd_routing()\n(because the irqfd isn\u0026apos;t in the list).  And so if the irqfd is in bypass\nmode, IRQs will continue to be posted using the old routing information.\n\nAs for kvm_arch_irq_bypass_del_producer(), clobbering the routing type\nresults in KVM incorrectly keeping the IRQ in bypass mode, which is\nespecially problematic on AMD as KVM tracks IRQs that are being posted to\na vCPU in a list whose lifetime is tied to the irqfd.\n\nWithout the help of KASAN to detect use-after-free, the most common\nsympton on AMD is a NULL pointer deref in amd_iommu_update_ga() due to\nthe memory for irqfd structure being re-allocated and zeroed, resulting\nin irqfd-\u0026gt;irq_bypass_data being NULL when read by\navic_update_iommu_vcpu_affinity():\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000018\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  PGD 40cf2b9067 P4D 40cf2b9067 PUD 408362a067 PMD 0\n  Oops: Oops: 0000 [#1] SMP\n  CPU: 6 UID: 0 PID: 40383 Comm: vfio_irq_test\n  Tainted: G     U  W  O        6.19.0-smp--5dddc257e6b2-irqfd #31 NONE\n  Tainted: [U]=USER, [W]=WARN, [O]=OOT_MODULE\n  Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 34.78.2-0 09/05/2025\n  RIP: 0010:amd_iommu_update_ga+0x19/0xe0\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   avic_update_iommu_vcpu_affinity+0x3d/0x90 [kvm_amd]\n   __avic_vcpu_load+0xf4/0x130 [kvm_amd]\n   kvm_arch_vcpu_load+0x89/0x210 [kvm]\n   vcpu_load+0x30/0x40 [kvm]\n   kvm_arch_vcpu_ioctl_run+0x45/0x620 [kvm]\n   kvm_vcpu_ioctl+0x571/0x6a0 [kvm]\n   __se_sys_ioctl+0x6d/0xb0\n   do_syscall_64+0x6f/0x9d0\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n  RIP: 0033:0x46893b\n    \u0026lt;/TASK\u0026gt;\n  ---[ end trace 0000000000000000 ]---\n\nIf AVIC is inhibited when the irfd is deassigned, the bug will manifest as\nlist corruption, e.g. on the next irqfd assignment.\n\n  list_add corruption. next-\u0026gt;prev should be prev (ffff8d474d5cd588),\n                       but was 0000000000000000. (next=ffff8d8658f86530).\n  ------------[ cut here ]------------\n  kernel BUG at lib/list_debug.c:31!\n  Oops: invalid opcode: 0000 [#1] SMP\n  CPU: 128 UID: 0 PID: 80818 Comm: vfio_irq_test\n  Tainted: G     U  W  O        6.19.0-smp--f19dc4d680ba-irqfd #28 NONE\n  Tainted: [U]=USER, [W]=WARN, [O]=OOT_MODULE\n  Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 34.78.2-0 09/05/2025\n  RIP: 0010:__list_add_valid_or_report+0x97/0xc0\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   avic_pi_update_irte+0x28e/0x2b0 [kvm_amd]\n   kvm_pi_update_irte+0xbf/0x190 [kvm]\n   kvm_arch_irq_bypass_add_producer+0x72/0x90 [kvm]\n   irq_bypass_register_consumer+0xcd/0x170 [irqbypa\n---truncated---(CVE-2026-23198)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_u32: use skb_header_pointer_careful()\n\nskb_header_pointer() does not fully validate negative @offset values.\n\nUse skb_header_pointer_careful() instead.\n\nGangMin Kim provided a report and a repro fooling u32_classify():\n\nBUG: KASAN: slab-out-of-bounds in u32_classify+0x1180/0x11b0\nnet/sched/cls_u32.c:221(CVE-2026-23204)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Prevent excessive number of frames\n\nIn this case, the user constructed the parameters with maxpacksize 40\nfor rate 22050 / pps 1000, and packsize[0] 22 packsize[1] 23. The buffer\nsize for each data URB is maxpacksize * packets, which in this example\nis 40 * 6 = 240; When the user performs a write operation to send audio\ndata into the ALSA PCM playback stream, the calculated number of frames\nis packsize[0] * packets = 264, which exceeds the allocated URB buffer\nsize, triggering the out-of-bounds (OOB) issue reported by syzbot [1].\n\nAdded a check for the number of single data URB frames when calculating\nthe number of frames to prevent [1].\n\n[1]\nBUG: KASAN: slab-out-of-bounds in copy_to_urb+0x261/0x460 sound/usb/pcm.c:1487\nWrite of size 264 at addr ffff88804337e800 by task syz.0.17/5506\nCall Trace:\n copy_to_urb+0x261/0x460 sound/usb/pcm.c:1487\n prepare_playback_urb+0x953/0x13d0 sound/usb/pcm.c:1611\n prepare_outbound_urb+0x377/0xc50 sound/usb/endpoint.c:333(CVE-2026-23208)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbonding: annotate data-races around slave-\u0026gt;last_rx\n\nslave-\u0026gt;last_rx and slave-\u0026gt;target_last_arp_rx[...] can be read and written\nlocklessly. Add READ_ONCE() and WRITE_ONCE() annotations.\n\nsyzbot reported:\n\nBUG: KCSAN: data-race in bond_rcv_validate / bond_rcv_validate\n\nwrite to 0xffff888149f0d428 of 8 bytes by interrupt on cpu 1:\n  bond_rcv_validate+0x202/0x7a0 drivers/net/bonding/bond_main.c:3335\n  bond_handle_frame+0xde/0x5e0 drivers/net/bonding/bond_main.c:1533\n  __netif_receive_skb_core+0x5b1/0x1950 net/core/dev.c:6039\n  __netif_receive_skb_one_core net/core/dev.c:6150 [inline]\n  __netif_receive_skb+0x59/0x270 net/core/dev.c:6265\n  netif_receive_skb_internal net/core/dev.c:6351 [inline]\n  netif_receive_skb+0x4b/0x2d0 net/core/dev.c:6410\n...\n\nwrite to 0xffff888149f0d428 of 8 bytes by interrupt on cpu 0:\n  bond_rcv_validate+0x202/0x7a0 drivers/net/bonding/bond_main.c:3335\n  bond_handle_frame+0xde/0x5e0 drivers/net/bonding/bond_main.c:1533\n  __netif_receive_skb_core+0x5b1/0x1950 net/core/dev.c:6039\n  __netif_receive_skb_one_core net/core/dev.c:6150 [inline]\n  __netif_receive_skb+0x59/0x270 net/core/dev.c:6265\n  netif_receive_skb_internal net/core/dev.c:6351 [inline]\n  netif_receive_skb+0x4b/0x2d0 net/core/dev.c:6410\n  br_netif_receive_skb net/bridge/br_input.c:30 [inline]\n  NF_HOOK include/linux/netfilter.h:318 [inline]\n...\n\nvalue changed: 0x0000000100005365 -\u0026gt; 0x0000000100005366(CVE-2026-23212)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbus: fsl-mc: fix use-after-free in driver_override_show()\n\nThe driver_override_show() function reads the driver_override string\nwithout holding the device_lock. However, driver_override_store() uses\ndriver_set_override(), which modifies and frees the string while holding\nthe device_lock.\n\nThis can result in a concurrent use-after-free if the string is freed\nby the store function while being read by the show function.\n\nFix this by holding the device_lock around the read operation.(CVE-2026-23221)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: split cached_fid bitfields to avoid shared-byte RMW races\n\nis_open, has_lease and on_list are stored in the same bitfield byte in\nstruct cached_fid but are updated in different code paths that may run\nconcurrently. Bitfield assignments generate byte read–modify–write\noperations (e.g. `orb $mask, addr` on x86_64), so updating one flag can\nrestore stale values of the others.\n\nA possible interleaving is:\n    CPU1: load old byte (has_lease=1, on_list=1)\n    CPU2: clear both flags (store 0)\n    CPU1: RMW store (old | IS_OPEN) -\u0026gt; reintroduces cleared bits\n\nTo avoid this class of races, convert these flags to separate bool\nfields.(CVE-2026-23230)","status":"published","published":"2026-03-27T11:10:47Z","modified":"2026-08-18T01:19:55.317925454Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1761","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niommu/s390: Implement blocking domain\n\nThis fixes a crash when surprise hot-unplugging a PCI device. This crash\nhappens because during hot-unplug __iommu_group_set_domain_nofail()\nattaching the default domain fails when the platform no longer\nrecognizes the device as it has already been removed and we end up with\na NULL domain pointer and UAF. This is exactly the case referred to in\nthe second comment in __iommu_device_set_domain() and just as stated\nthere if we can instead attach the blocking domain the UAF is prevented\nas this can handle the already removed device. Implement the blocking\ndomain to use this handling.  With this change, the crash is fixed but\nwe still hit a warning attempting to change DMA ownership on a blocked\ndevice.(CVE-2024-53232)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niommu: Fix two issues in iommu_copy_struct_from_user()\n\nIn the review for iommu_copy_struct_to_user() helper, Matt pointed out that\na NULL pointer should be rejected prior to dereferencing it:\nhttps://lore.kernel.org/all/(CVE-2025-37900)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: Avoid race in open_cached_dir with lease breaks\n\nA pre-existing valid cfid returned from find_or_create_cached_dir might\nrace with a lease break, meaning open_cached_dir doesn\u0026apos;t consider it\nvalid, and thinks it\u0026apos;s newly-constructed. This leaks a dentry reference\nif the allocation occurs before the queued lease break work runs.\n\nAvoid the race by extending holding the cfid_list_lock across\nfind_or_create_cached_dir and when the result is checked.(CVE-2025-37954)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: prio: fix a race in prio_tune()\n\nGerrard Tai reported a race condition in PRIO, whenever SFQ perturb timer\nfires at the wrong time.\n\nThe race is as follows:\n\nCPU 0                                 CPU 1\n[1]: lock root\n[2]: qdisc_tree_flush_backlog()\n[3]: unlock root\n |\n |                                    [5]: lock root\n |                                    [6]: rehash\n |                                    [7]: qdisc_tree_reduce_backlog()\n |\n[4]: qdisc_put()\n\nThis can be abused to underflow a parent\u0026apos;s qlen.\n\nCalling qdisc_purge_queue() instead of qdisc_tree_flush_backlog()\nshould fix the race, because all packets will be purged from the qdisc\nbefore releasing the lock.(CVE-2025-38083)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nIB/mlx5: Fix potential deadlock in MR deregistration\n\nThe issue arises when kzalloc() is invoked while holding umem_mutex or\nany other lock acquired under umem_mutex. This is problematic because\nkzalloc() can trigger fs_reclaim_aqcuire(), which may, in turn, invoke\nmmu_notifier_invalidate_range_start(). This function can lead to\nmlx5_ib_invalidate_range(), which attempts to acquire umem_mutex again,\nresulting in a deadlock.\n\nThe problematic flow:\n             CPU0                      |              CPU1\n---------------------------------------|------------------------------------------------\nmlx5_ib_dereg_mr()                     |\n → revoke_mr()                         |\n   → mutex_lock(\u0026amp;umem_odp-\u0026gt;umem_mutex) |\n                                       | mlx5_mkey_cache_init()\n                                       |  → mutex_lock(\u0026amp;dev-\u0026gt;cache.rb_lock)\n                                       |  → mlx5r_cache_create_ent_locked()\n                                       |    → kzalloc(GFP_KERNEL)\n                                       |      → fs_reclaim()\n                                       |        → mmu_notifier_invalidate_range_start()\n                                       |          → mlx5_ib_invalidate_range()\n                                       |            → mutex_lock(\u0026amp;umem_odp-\u0026gt;umem_mutex)\n   → cache_ent_find_and_store()        |\n     → mutex_lock(\u0026amp;dev-\u0026gt;cache.rb_lock) |\n\nAdditionally, when kzalloc() is called from within\ncache_ent_find_and_store(), we encounter the same deadlock due to\nre-acquisition of umem_mutex.\n\nSolve by releasing umem_mutex in dereg_mr() after umr_revoke_mr()\nand before acquiring rb_lock. This ensures that we don\u0026apos;t hold\numem_mutex while performing memory allocations that could trigger\nthe reclaim path.\n\nThis change prevents the deadlock by ensuring proper lock ordering and\navoiding holding locks during memory allocation operations that could\ntrigger the reclaim path.\n\nThe following lockdep warning demonstrates the deadlock:\n\n python3/20557 is trying to acquire lock:\n ffff888387542128 (\u0026amp;umem_odp-\u0026gt;umem_mutex){+.+.}-{4:4}, at:\n mlx5_ib_invalidate_range+0x5b/0x550 [mlx5_ib]\n\n but task is already holding lock:\n ffffffff82f6b840 (mmu_notifier_invalidate_range_start){+.+.}-{0:0}, at:\n unmap_vmas+0x7b/0x1a0\n\n which lock already depends on the new lock.\n\n the existing dependency chain (in reverse order) is:\n\n -\u0026gt; #3 (mmu_notifier_invalidate_range_start){+.+.}-{0:0}:\n       fs_reclaim_acquire+0x60/0xd0\n       mem_cgroup_css_alloc+0x6f/0x9b0\n       cgroup_init_subsys+0xa4/0x240\n       cgroup_init+0x1c8/0x510\n       start_kernel+0x747/0x760\n       x86_64_start_reservations+0x25/0x30\n       x86_64_start_kernel+0x73/0x80\n       common_startup_64+0x129/0x138\n\n -\u0026gt; #2 (fs_reclaim){+.+.}-{0:0}:\n       fs_reclaim_acquire+0x91/0xd0\n       __kmalloc_cache_noprof+0x4d/0x4c0\n       mlx5r_cache_create_ent_locked+0x75/0x620 [mlx5_ib]\n       mlx5_mkey_cache_init+0x186/0x360 [mlx5_ib]\n       mlx5_ib_stage_post_ib_reg_umr_init+0x3c/0x60 [mlx5_ib]\n       __mlx5_ib_add+0x4b/0x190 [mlx5_ib]\n       mlx5r_probe+0xd9/0x320 [mlx5_ib]\n       auxiliary_bus_probe+0x42/0x70\n       really_probe+0xdb/0x360\n       __driver_probe_device+0x8f/0x130\n       driver_probe_device+0x1f/0xb0\n       __driver_attach+0xd4/0x1f0\n       bus_for_each_dev+0x79/0xd0\n       bus_add_driver+0xf0/0x200\n       driver_register+0x6e/0xc0\n       __auxiliary_driver_register+0x6a/0xc0\n       do_one_initcall+0x5e/0x390\n       do_init_module+0x88/0x240\n       init_module_from_file+0x85/0xc0\n       idempotent_init_module+0x104/0x300\n       __x64_sys_finit_module+0x68/0xc0\n       do_syscall_64+0x6d/0x140\n       entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\n -\u0026gt; #1 (\u0026amp;dev-\u0026gt;cache.rb_lock){+.+.}-{4:4}:\n       __mutex_lock+0x98/0xf10\n       __mlx5_ib_dereg_mr+0x6f2/0x890 [mlx5_ib]\n       mlx5_ib_dereg_mr+0x21/0x110 [mlx5_ib]\n       ib_dereg_mr_user+0x85/0x1f0 [ib_core]\n  \n---truncated---(CVE-2025-38373)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: Harden s32ton() against conversion to 0 bits\n\nTesting by the syzbot fuzzer showed that the HID core gets a\nshift-out-of-bounds exception when it tries to convert a 32-bit\nquantity to a 0-bit quantity.  Ideally this should never occur, but\nthere are buggy devices and some might have a report field with size\nset to zero; we shouldn\u0026apos;t reject the report or the device just because\nof that.\n\nInstead, harden the s32ton() routine so that it returns a reasonable\nresult instead of crashing when it is called with the number of bits\nset to 0 -- the same as what snto32() does.(CVE-2025-38556)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject narrower access to pointer ctx fields\n\nThe following BPF program, simplified from a syzkaller repro, causes a\nkernel warning:\n\n    r0 = *(u8 *)(r1 + 169);\n    exit;\n\nWith pointer field sk being at offset 168 in __sk_buff. This access is\ndetected as a narrower read in bpf_skb_is_valid_access because it\ndoesn\u0026apos;t match offsetof(struct __sk_buff, sk). It is therefore allowed\nand later proceeds to bpf_convert_ctx_access. Note that for the\n\u0026quot;is_narrower_load\u0026quot; case in the convert_ctx_accesses(), the insn-\u0026gt;off\nis aligned, so the cnt may not be 0 because it matches the\noffsetof(struct __sk_buff, sk) in the bpf_convert_ctx_access. However,\nthe target_size stays 0 and the verifier errors with a kernel warning:\n\n    verifier bug: error during ctx access conversion(1)\n\nThis patch fixes that to return a proper \u0026quot;invalid bpf_context access\noff=X size=Y\u0026quot; error on the load instruction.\n\nThe same issue affects multiple other fields in context structures that\nallow narrow access. Some other non-affected fields (for sk_msg,\nsk_lookup, and sockopt) were also changed to use bpf_ctx_range_ptr for\nconsistency.\n\nNote this syzkaller crash was reported in the \u0026quot;Closes\u0026quot; link below, which\nused to be about a different bug, fixed in\ncommit fce7bd8e385a (\u0026quot;bpf/verifier: Handle BPF_LOAD_ACQ instructions\nin insn_def_regno()\u0026quot;). Because syzbot somehow confused the two bugs,\nthe new crash and repro didn\u0026apos;t get reported to the mailing list.(CVE-2025-38591)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: No more self recovery\n\nWhen a node withdraws and it turns out that it is the only node that has\nthe filesystem mounted, gfs2 currently tries to replay the local journal\nto bring the filesystem back into a consistent state.  Not only is that\na very bad idea, it has also never worked because gfs2_recover_func()\nwill refuse to do anything during a withdraw.\n\nHowever, before even getting to this point, gfs2_recover_func()\ndereferences sdp-\u0026gt;sd_jdesc-\u0026gt;jd_inode.  This was a use-after-free before\ncommit 04133b607a78 (\u0026quot;gfs2: Prevent double iput for journal on error\u0026quot;)\nand is a NULL pointer dereference since then.\n\nSimply get rid of self recovery to fix that.(CVE-2025-38659)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/net: commit partial buffers on retry\n\nRing provided buffers are potentially only valid within the single\nexecution context in which they were acquired. io_uring deals with this\nand invalidates them on retry. But on the networking side, if\nMSG_WAITALL is set, or if the socket is of the streaming type and too\nlittle was processed, then it will hang on to the buffer rather than\nrecycle or commit it. This is problematic for two reasons:\n\n1) If someone unregisters the provided buffer ring before a later retry,\n   then the req-\u0026gt;buf_list will no longer be valid.\n\n2) If multiple sockers are using the same buffer group, then multiple\n   receives can consume the same memory. This can cause data corruption\n   in the application, as either receive could land in the same\n   userspace buffer.\n\nFix this by disallowing partial retries from pinning a provided buffer\nacross multiple executions, if ring provided buffers are used.(CVE-2025-38730)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmedia: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()\n\nIn the interrupt handler rain_interrupt(), the buffer full check on\nrain-\u0026gt;buf_len is performed before acquiring rain-\u0026gt;buf_lock. This\ncreates a Time-of-Check to Time-of-Use (TOCTOU) race condition, as\nrain-\u0026gt;buf_len is concurrently accessed and modified in the work\nhandler rain_irq_work_handler() under the same lock.\n\nMultiple interrupt invocations can race, with each reading buf_len\nbefore it becomes full and then proceeding. This can lead to both\ninterrupts attempting to write to the buffer, incrementing buf_len\nbeyond its capacity (DATA_SIZE) and causing a buffer overflow.\n\nFix this bug by moving the spin_lock() to before the buffer full\ncheck. This ensures that the check and the subsequent buffer modification\nare performed atomically, preventing the race condition. An corresponding\nspin_unlock() is added to the overflow path to correctly release the\nlock.\n\nThis possible bug was found by an experimental static analysis tool\ndeveloped by our team.(CVE-2025-39713)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niommu/amd/pgtbl: Fix possible race while increase page table level\n\nThe AMD IOMMU host page table implementation supports dynamic page table levels\n(up to 6 levels), starting with a 3-level configuration that expands based on\nIOVA address. The kernel maintains a root pointer and current page table level\nto enable proper page table walks in alloc_pte()/fetch_pte() operations.\n\nThe IOMMU IOVA allocator initially starts with 32-bit address and onces its\nexhuasted it switches to 64-bit address (max address is determined based\non IOMMU and device DMA capability). To support larger IOVA, AMD IOMMU\ndriver increases page table level.\n\nBut in unmap path (iommu_v1_unmap_pages()), fetch_pte() reads\npgtable-\u0026gt;[root/mode] without lock. So its possible that in exteme corner case,\nwhen increase_address_space() is updating pgtable-\u0026gt;[root/mode], fetch_pte()\nreads wrong page table level (pgtable-\u0026gt;mode). It does compare the value with\nlevel encoded in page table and returns NULL. This will result is\niommu_unmap ops to fail and upper layer may retry/log WARN_ON.\n\nCPU 0                                         CPU 1\n------                                       ------\nmap pages                                    unmap pages\nalloc_pte() -\u0026gt; increase_address_space()      iommu_v1_unmap_pages() -\u0026gt; fetch_pte()\n  pgtable-\u0026gt;root = pte (new root value)\n                                             READ pgtable-\u0026gt;[mode/root]\n\t\t\t\t\t       Reads new root, old mode\n  Updates mode (pgtable-\u0026gt;mode += 1)\n\nSince Page table level updates are infrequent and already synchronized with a\nspinlock, implement seqcount to enable lock-free read operations on the read path.(CVE-2025-39961)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: check the return value of pinmux_ops::get_function_name()\n\nWhile the API contract in docs doesn\u0026apos;t specify it explicitly, the\ngeneric implementation of the get_function_name() callback from struct\npinmux_ops - pinmux_generic_get_function_name() - can fail and return\nNULL. This is already checked in pinmux_check_ops() so add a similar\ncheck in pinmux_func_name_to_selector() instead of passing the returned\npointer right down to strcmp() where the NULL can get dereferenced. This\nis normal operation when adding new pinfunctions.(CVE-2025-40030)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies\n\nWhen adding dependencies with drm_sched_job_add_dependency(), that\nfunction consumes the fence reference both on success and failure, so in\nthe latter case the dma_fence_put() on the error path (xarray failed to\nexpand) is a double free.\n\nInterestingly this bug appears to have been present ever since\ncommit ebd5f74255b9 (\u0026quot;drm/sched: Add dependency tracking\u0026quot;), since the code\nback then looked like this:\n\ndrm_sched_job_add_implicit_dependencies():\n...\n       for (i = 0; i \u0026lt; fence_count; i++) {\n               ret = drm_sched_job_add_dependency(job, fences[i]);\n               if (ret)\n                       break;\n       }\n\n       for (; i \u0026lt; fence_count; i++)\n               dma_fence_put(fences[i]);\n\nWhich means for the failing \u0026apos;i\u0026apos; the dma_fence_put was already a double\nfree. Possibly there were no users at that time, or the test cases were\ninsufficient to hit it.\n\nThe bug was then only noticed and fixed after\ncommit 9c2ba265352a (\u0026quot;drm/scheduler: use new iterator in drm_sched_job_add_implicit_dependencies v2\u0026quot;)\nlanded, with its fixup of\ncommit 4eaf02d6076c (\u0026quot;drm/scheduler: fix drm_sched_job_add_implicit_dependencies\u0026quot;).\n\nAt that point it was a slightly different flavour of a double free, which\ncommit 963d0b356935 (\u0026quot;drm/scheduler: fix drm_sched_job_add_implicit_dependencies harder\u0026quot;)\nnoticed and attempted to fix.\n\nBut it only moved the double free from happening inside the\ndrm_sched_job_add_dependency(), when releasing the reference not yet\nobtained, to the caller, when releasing the reference already released by\nthe former in the failure case.\n\nAs such it is not easy to identify the right target for the fixes tag so\nlets keep it simple and just continue the chain.\n\nWhile fixing we also improve the comment and explain the reason for taking\nthe reference and not dropping it.(CVE-2025-40096)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: delete x-\u0026gt;tunnel as we delete x\n\nThe ipcomp fallback tunnels currently get deleted (from the various\nlists and hashtables) as the last user state that needed that fallback\nis destroyed (not deleted). If a reference to that user state still\nexists, the fallback state will remain on the hashtables/lists,\ntriggering the WARN in xfrm_state_fini. Because of those remaining\nreferences, the fix in commit f75a2804da39 (\u0026quot;xfrm: destroy xfrm_state\nsynchronously on net exit path\u0026quot;) is not complete.\n\nWe recently fixed one such situation in TCP due to defered freeing of\nskbs (commit 9b6412e6979f (\u0026quot;tcp: drop secpath at the same time as we\ncurrently drop dst\u0026quot;)). This can also happen due to IP reassembly: skbs\nwith a secpath remain on the reassembly queue until netns\ndestruction. If we can\u0026apos;t guarantee that the queues are flushed by the\ntime xfrm_state_fini runs, there may still be references to a (user)\nxfrm_state, preventing the timely deletion of the corresponding\nfallback state.\n\nInstead of chasing each instance of skbs holding a secpath one by one,\nthis patch fixes the issue directly within xfrm, by deleting the\nfallback state as soon as the last user state depending on it has been\ndeleted. Destruction will still happen when the final reference is\ndropped.\n\nA separate lockdep class for the fallback state is required since\nwe\u0026apos;re going to lock x-\u0026gt;tunnel while x is locked.(CVE-2025-40215)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfuse: fix livelock in synchronous file put from fuseblk workers\n\nI observed a hang when running generic/323 against a fuseblk server.\nThis test opens a file, initiates a lot of AIO writes to that file\ndescriptor, and closes the file descriptor before the writes complete.\nUnsurprisingly, the AIO exerciser threads are mostly stuck waiting for\nresponses from the fuseblk server:\n\n# cat /proc/372265/task/372313/stack\n[\u0026lt;0\u0026gt;] request_wait_answer+0x1fe/0x2a0 [fuse]\n[\u0026lt;0\u0026gt;] __fuse_simple_request+0xd3/0x2b0 [fuse]\n[\u0026lt;0\u0026gt;] fuse_do_getattr+0xfc/0x1f0 [fuse]\n[\u0026lt;0\u0026gt;] fuse_file_read_iter+0xbe/0x1c0 [fuse]\n[\u0026lt;0\u0026gt;] aio_read+0x130/0x1e0\n[\u0026lt;0\u0026gt;] io_submit_one+0x542/0x860\n[\u0026lt;0\u0026gt;] __x64_sys_io_submit+0x98/0x1a0\n[\u0026lt;0\u0026gt;] do_syscall_64+0x37/0xf0\n[\u0026lt;0\u0026gt;] entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\nBut the /weird/ part is that the fuseblk server threads are waiting for\nresponses from itself:\n\n# cat /proc/372210/task/372232/stack\n[\u0026lt;0\u0026gt;] request_wait_answer+0x1fe/0x2a0 [fuse]\n[\u0026lt;0\u0026gt;] __fuse_simple_request+0xd3/0x2b0 [fuse]\n[\u0026lt;0\u0026gt;] fuse_file_put+0x9a/0xd0 [fuse]\n[\u0026lt;0\u0026gt;] fuse_release+0x36/0x50 [fuse]\n[\u0026lt;0\u0026gt;] __fput+0xec/0x2b0\n[\u0026lt;0\u0026gt;] task_work_run+0x55/0x90\n[\u0026lt;0\u0026gt;] syscall_exit_to_user_mode+0xe9/0x100\n[\u0026lt;0\u0026gt;] do_syscall_64+0x43/0xf0\n[\u0026lt;0\u0026gt;] entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\nThe fuseblk server is fuse2fs so there\u0026apos;s nothing all that exciting in\nthe server itself.  So why is the fuse server calling fuse_file_put?\nThe commit message for the fstest sheds some light on that:\n\n\u0026quot;By closing the file descriptor before calling io_destroy, you pretty\nmuch guarantee that the last put on the ioctx will be done in interrupt\ncontext (during I/O completion).\n\nAha.  AIO fgets a new struct file from the fd when it queues the ioctx.\nThe completion of the FUSE_WRITE command from userspace causes the fuse\nserver to call the AIO completion function.  The completion puts the\nstruct file, queuing a delayed fput to the fuse server task.  When the\nfuse server task returns to userspace, it has to run the delayed fput,\nwhich in the case of a fuseblk server, it does synchronously.\n\nSending the FUSE_RELEASE command sychronously from fuse server threads\nis a bad idea because a client program can initiate enough simultaneous\nAIOs such that all the fuse server threads end up in delayed_fput, and\nnow there aren\u0026apos;t any threads left to handle the queued fuse commands.\n\nFix this by only using asynchronous fputs when closing files, and leave\na comment explaining why.(CVE-2025-40220)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfs/notify: call exportfs_encode_fid with s_umount\n\nCalling intotify_show_fdinfo() on fd watching an overlayfs inode, while\nthe overlayfs is being unmounted, can lead to dereferencing NULL ptr.\n\nThis issue was found by syzkaller.\n\nRace Condition Diagram:\n\nThread 1                           Thread 2\n--------                           --------\n\ngeneric_shutdown_super()\n shrink_dcache_for_umount\n  sb-\u0026gt;s_root = NULL\n\n                    |\n                    |             vfs_read()\n                    |              inotify_fdinfo()\n                    |               * inode get from mark *\n                    |               show_mark_fhandle(m, inode)\n                    |                exportfs_encode_fid(inode, ..)\n                    |                 ovl_encode_fh(inode, ..)\n                    |                  ovl_check_encode_origin(inode)\n                    |                   * deref i_sb-\u0026gt;s_root *\n                    |\n                    |\n                    v\n fsnotify_sb_delete(sb)\n\nWhich then leads to:\n\n[   32.133461] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI\n[   32.134438] KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]\n[   32.135032] CPU: 1 UID: 0 PID: 4468 Comm: systemd-coredum Not tainted 6.17.0-rc6 #22 PREEMPT(none)\n\n\u0026lt;snip registers, unreliable trace\u0026gt;\n\n[   32.143353] Call Trace:\n[   32.143732]  ovl_encode_fh+0xd5/0x170\n[   32.144031]  exportfs_encode_inode_fh+0x12f/0x300\n[   32.144425]  show_mark_fhandle+0xbe/0x1f0\n[   32.145805]  inotify_fdinfo+0x226/0x2d0\n[   32.146442]  inotify_show_fdinfo+0x1c5/0x350\n[   32.147168]  seq_show+0x530/0x6f0\n[   32.147449]  seq_read_iter+0x503/0x12a0\n[   32.148419]  seq_read+0x31f/0x410\n[   32.150714]  vfs_read+0x1f0/0x9e0\n[   32.152297]  ksys_read+0x125/0x240\n\nIOW ovl_check_encode_origin derefs inode-\u0026gt;i_sb-\u0026gt;s_root, after it was set\nto NULL in the unmount path.\n\nFix it by protecting calling exportfs_encode_fid() from\nshow_mark_fhandle() with s_umount lock.\n\nThis form of fix was suggested by Amir in [1].\n\n[1]: https://lore.kernel.org/all/CAOQ4uxhbDwhb+2Brs1UdkoF0a3NSdBAOQPNfEHjahrgoKJpLEw@mail.gmail.com/(CVE-2025-40237)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Fix unlikely race in gdlm_put_lock\n\nIn gdlm_put_lock(), there is a small window of time in which the\nDFL_UNMOUNT flag has been set but the lockspace hasn\u0026apos;t been released,\nyet.  In that window, dlm may still call gdlm_ast() and gdlm_bast().\nTo prevent it from dereferencing freed glock objects, only free the\nglock if the lockspace has actually been released.(CVE-2025-40242)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndevlink: rate: Unset parent pointer in devl_rate_nodes_destroy\n\nThe function devl_rate_nodes_destroy is documented to \u0026quot;Unset parent for\nall rate objects\u0026quot;. However, it was only calling the driver-specific\n`rate_leaf_parent_set` or `rate_node_parent_set` ops and decrementing\nthe parent\u0026apos;s refcount, without actually setting the\n`devlink_rate-\u0026gt;parent` pointer to NULL.\n\nThis leaves a dangling pointer in the `devlink_rate` struct, which cause\nrefcount error in netdevsim[1] and mlx5[2]. In addition, this is\ninconsistent with the behavior of `devlink_nl_rate_parent_node_set`,\nwhere the parent pointer is correctly cleared.\n\nThis patch fixes the issue by explicitly setting `devlink_rate-\u0026gt;parent`\nto NULL after notifying the driver, thus fulfilling the function\u0026apos;s\ndocumented behavior for all rate objects.\n\n[1]\nrepro steps:\necho 1 \u0026gt; /sys/bus/netdevsim/new_device\ndevlink dev eswitch set netdevsim/netdevsim1 mode switchdev\necho 1 \u0026gt; /sys/bus/netdevsim/devices/netdevsim1/sriov_numvfs\ndevlink port function rate add netdevsim/netdevsim1/test_node\ndevlink port function rate set netdevsim/netdevsim1/128 parent test_node\necho 1 \u0026gt; /sys/bus/netdevsim/del_device\n\ndmesg:\nrefcount_t: decrement hit 0; leaking memory.\nWARNING: CPU: 8 PID: 1530 at lib/refcount.c:31 refcount_warn_saturate+0x42/0xe0\nCPU: 8 UID: 0 PID: 1530 Comm: bash Not tainted 6.18.0-rc4+ #1 NONE\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\nRIP: 0010:refcount_warn_saturate+0x42/0xe0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n devl_rate_leaf_destroy+0x8d/0x90\n __nsim_dev_port_del+0x6c/0x70 [netdevsim]\n nsim_dev_reload_destroy+0x11c/0x140 [netdevsim]\n nsim_drv_remove+0x2b/0xb0 [netdevsim]\n device_release_driver_internal+0x194/0x1f0\n bus_remove_device+0xc6/0x130\n device_del+0x159/0x3c0\n device_unregister+0x1a/0x60\n del_device_store+0x111/0x170 [netdevsim]\n kernfs_fop_write_iter+0x12e/0x1e0\n vfs_write+0x215/0x3d0\n ksys_write+0x5f/0xd0\n do_syscall_64+0x55/0x10f0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\n[2]\ndevlink dev eswitch set pci/0000:08:00.0 mode switchdev\ndevlink port add pci/0000:08:00.0 flavour pcisf pfnum 0 sfnum 1000\ndevlink port function rate add pci/0000:08:00.0/group1\ndevlink port function rate set pci/0000:08:00.0/32768 parent group1\nmodprobe -r mlx5_ib mlx5_fwctl mlx5_core\n\ndmesg:\nrefcount_t: decrement hit 0; leaking memory.\nWARNING: CPU: 7 PID: 16151 at lib/refcount.c:31 refcount_warn_saturate+0x42/0xe0\nCPU: 7 UID: 0 PID: 16151 Comm: bash Not tainted 6.17.0-rc7_for_upstream_min_debug_2025_10_02_12_44 #1 NONE\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\nRIP: 0010:refcount_warn_saturate+0x42/0xe0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n devl_rate_leaf_destroy+0x8d/0x90\n mlx5_esw_offloads_devlink_port_unregister+0x33/0x60 [mlx5_core]\n mlx5_esw_offloads_unload_rep+0x3f/0x50 [mlx5_core]\n mlx5_eswitch_unload_sf_vport+0x40/0x90 [mlx5_core]\n mlx5_sf_esw_event+0xc4/0x120 [mlx5_core]\n notifier_call_chain+0x33/0xa0\n blocking_notifier_call_chain+0x3b/0x50\n mlx5_eswitch_disable_locked+0x50/0x110 [mlx5_core]\n mlx5_eswitch_disable+0x63/0x90 [mlx5_core]\n mlx5_unload+0x1d/0x170 [mlx5_core]\n mlx5_uninit_one+0xa2/0x130 [mlx5_core]\n remove_one+0x78/0xd0 [mlx5_core]\n pci_device_remove+0x39/0xa0\n device_release_driver_internal+0x194/0x1f0\n unbind_store+0x99/0xa0\n kernfs_fop_write_iter+0x12e/0x1e0\n vfs_write+0x215/0x3d0\n ksys_write+0x5f/0xd0\n do_syscall_64+0x53/0x1f0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53(CVE-2025-40251)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfs/proc: fix uaf in proc_readdir_de()\n\nPde is erased from subdir rbtree through rb_erase(), but not set the node\nto EMPTY, which may result in uaf access.  We should use RB_CLEAR_NODE()\nset the erased node to EMPTY, then pde_subdir_next() will return NULL to\navoid uaf access.\n\nWe found an uaf issue while using stress-ng testing, need to run testcase\ngetdent and tun in the same time.  The steps of the issue is as follows:\n\n1) use getdent to traverse dir /proc/pid/net/dev_snmp6/, and current\n   pde is tun3;\n\n2) in the [time windows] unregister netdevice tun3 and tun2, and erase\n   them from rbtree.  erase tun3 first, and then erase tun2.  the\n   pde(tun2) will be released to slab;\n\n3) continue to getdent process, then pde_subdir_next() will return\n   pde(tun2) which is released, it will case uaf access.\n\nCPU 0                                      |    CPU 1\n-------------------------------------------------------------------------\ntraverse dir /proc/pid/net/dev_snmp6/      |   unregister_netdevice(tun-\u0026gt;dev)   //tun3 tun2\nsys_getdents64()                           |\n  iterate_dir()                            |\n    proc_readdir()                         |\n      proc_readdir_de()                    |     snmp6_unregister_dev()\n        pde_get(de);                       |       proc_remove()\n        read_unlock(\u0026amp;proc_subdir_lock);    |         remove_proc_subtree()\n                                           |           write_lock(\u0026amp;proc_subdir_lock);\n        [time window]                      |           rb_erase(\u0026amp;root-\u0026gt;subdir_node, \u0026amp;parent-\u0026gt;subdir);\n                                           |           write_unlock(\u0026amp;proc_subdir_lock);\n        read_lock(\u0026amp;proc_subdir_lock);      |\n        next = pde_subdir_next(de);        |\n        pde_put(de);                       |\n        de = next;    //UAF                |\n\nrbtree of dev_snmp6\n                        |\n                    pde(tun3)\n                     /    \\\n                  NULL  pde(tun2)(CVE-2025-40271)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/secretmem: fix use-after-free race in fault handler\n\nWhen a page fault occurs in a secret memory file created with\n`memfd_secret(2)`, the kernel will allocate a new folio for it, mark the\nunderlying page as not-present in the direct map, and add it to the file\nmapping.\n\nIf two tasks cause a fault in the same page concurrently, both could end\nup allocating a folio and removing the page from the direct map, but only\none would succeed in adding the folio to the file mapping.  The task that\nfailed undoes the effects of its attempt by (a) freeing the folio again\nand (b) putting the page back into the direct map.  However, by doing\nthese two operations in this order, the page becomes available to the\nallocator again before it is placed back in the direct mapping.\n\nIf another task attempts to allocate the page between (a) and (b), and the\nkernel tries to access it via the direct map, it would result in a\nsupervisor not-present page fault.\n\nFix the ordering to restore the direct map before the folio is freed.(CVE-2025-40272)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE\n\nThis data originates from userspace and is used in buffer offset\ncalculations which could potentially overflow causing an out-of-bounds\naccess.(CVE-2025-40277)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern()\n\nIn the parse_adv_monitor_pattern() function, the value of\nthe \u0026apos;length\u0026apos; variable is currently limited to HCI_MAX_EXT_AD_LENGTH(251).\nThe size of the \u0026apos;value\u0026apos; array in the mgmt_adv_pattern structure is 31.\nIf the value of \u0026apos;pattern[i].length\u0026apos; is set in the user space\nand exceeds 31, the \u0026apos;patterns[i].value\u0026apos; array can be accessed\nout of bound when copied.\n\nIncreasing the size of the \u0026apos;value\u0026apos; array in\nthe \u0026apos;mgmt_adv_pattern\u0026apos; structure will break the userspace.\nConsidering this, and to avoid OOB access revert the limits for \u0026apos;offset\u0026apos;\nand \u0026apos;length\u0026apos; back to the value of HCI_MAX_AD_LENGTH.\n\nFound by InfoTeCS on behalf of Linux Verification Center\n(linuxtesting.org) with SVACE.(CVE-2025-40294)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: validate skb length for unknown CC opcode\n\nIn hci_cmd_complete_evt(), if the command complete event has an unknown\nopcode, we assume the first byte of the remaining skb-\u0026gt;data contains the\nreturn status. However, parameter data has previously been pulled in\nhci_event_func(), which may leave the skb empty. If so, using skb-\u0026gt;data[0]\nfor the return status uses un-init memory.\n\nThe fix is to check skb-\u0026gt;len before using skb-\u0026gt;data.(CVE-2025-40301)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: bcsp: receive data only if registered\n\nCurrently, bcsp_recv() can be called even when the BCSP protocol has not\nbeen registered. This leads to a NULL pointer dereference, as shown in\nthe following stack trace:\n\n    KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f]\n    RIP: 0010:bcsp_recv+0x13d/0x1740 drivers/bluetooth/hci_bcsp.c:590\n    Call Trace:\n     \u0026lt;TASK\u0026gt;\n     hci_uart_tty_receive+0x194/0x220 drivers/bluetooth/hci_ldisc.c:627\n     tiocsti+0x23c/0x2c0 drivers/tty/tty_io.c:2290\n     tty_ioctl+0x626/0xde0 drivers/tty/tty_io.c:2706\n     vfs_ioctl fs/ioctl.c:51 [inline]\n     __do_sys_ioctl fs/ioctl.c:907 [inline]\n     __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893\n     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n     do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94\n     entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nTo prevent this, ensure that the HCI_UART_REGISTERED flag is set before\nprocessing received data. If the protocol is not registered, return\n-EUNATCH.(CVE-2025-40308)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once\n\nhci_cmd_sync_dequeue_once() does lookup and then cancel\nthe entry under two separate lock sections. Meanwhile,\nhci_cmd_sync_work() can also delete the same entry,\nleading to double list_del() and \u0026quot;UAF\u0026quot;.\n\nFix this by holding cmd_sync_work_lock across both\nlookup and cancel, so that the entry cannot be removed\nconcurrently.(CVE-2025-40318)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Don\u0026apos;t leak robust_list pointer on exec race\n\nsys_get_robust_list() and compat_get_robust_list() use ptrace_may_access()\nto check if the calling task is allowed to access another task\u0026apos;s\nrobust_list pointer. This check is racy against a concurrent exec() in the\ntarget process.\n\nDuring exec(), a task may transition from a non-privileged binary to a\nprivileged one (e.g., setuid binary) and its credentials/memory mappings\nmay change. If get_robust_list() performs ptrace_may_access() before\nthis transition, it may erroneously allow access to sensitive information\nafter the target becomes privileged.\n\nA racy access allows an attacker to exploit a window during which\nptrace_may_access() passes before a target process transitions to a\nprivileged state via exec().\n\nFor example, consider a non-privileged task T that is about to execute a\nsetuid-root binary. An attacker task A calls get_robust_list(T) while T\nis still unprivileged. Since ptrace_may_access() checks permissions\nbased on current credentials, it succeeds. However, if T begins exec\nimmediately afterwards, it becomes privileged and may change its memory\nmappings. Because get_robust_list() proceeds to access T-\u0026gt;robust_list\nwithout synchronizing with exec() it may read user-space pointers from a\nnow-privileged process.\n\nThis violates the intended post-exec access restrictions and could\nexpose sensitive memory addresses or be used as a primitive in a larger\nexploit chain. Consequently, the race can lead to unauthorized\ndisclosure of information across privilege boundaries and poses a\npotential security risk.\n\nTake a read lock on signal-\u0026gt;exec_update_lock prior to invoking\nptrace_may_access() and accessing the robust_list/compat_robust_list.\nThis ensures that the target task\u0026apos;s exec state remains stable during the\ncheck, allowing for consistent and synchronized validation of\ncredentials.(CVE-2025-40341)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvme-fc: use lock accessing port_state and rport state\n\nnvme_fc_unregister_remote removes the remote port on a lport object at\nany point in time when there is no active association. This races with\nwith the reconnect logic, because nvme_fc_create_association is not\ntaking a lock to check the port_state and atomically increase the\nactive count on the rport.(CVE-2025-40342)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-fc: avoid scheduling association deletion twice\n\nWhen forcefully shutting down a port via the configfs interface,\nnvmet_port_subsys_drop_link() first calls nvmet_port_del_ctrls() and\nthen nvmet_disable_port(). Both functions will eventually schedule all\nremaining associations for deletion.\n\nThe current implementation checks whether an association is about to be\nremoved, but only after the work item has already been scheduled. As a\nresult, it is possible for the first scheduled work item to free all\nresources, and then for the same work item to be scheduled again for\ndeletion.\n\nBecause the association list is an RCU list, it is not possible to take\na lock and remove the list entry directly, so it cannot be looked up\nagain. Instead, a flag (terminating) must be used to determine whether\nthe association is already in the process of being deleted.(CVE-2025-40343)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\narch_topology: Fix incorrect error check in topology_parse_cpu_capacity()\n\nFix incorrect use of PTR_ERR_OR_ZERO() in topology_parse_cpu_capacity()\nwhich causes the code to proceed with NULL clock pointers. The current\nlogic uses !PTR_ERR_OR_ZERO(cpu_clk) which evaluates to true for both\nvalid pointers and NULL, leading to potential NULL pointer dereference\nin clk_get_rate().\n\nPer include/linux/err.h documentation, PTR_ERR_OR_ZERO(ptr) returns:\n\u0026quot;The error code within @ptr if it is an error pointer; 0 otherwise.\u0026quot;\n\nThis means PTR_ERR_OR_ZERO() returns 0 for both valid pointers AND NULL\npointers. Therefore !PTR_ERR_OR_ZERO(cpu_clk) evaluates to true (proceed)\nwhen cpu_clk is either valid or NULL, causing clk_get_rate(NULL) to be\ncalled when of_clk_get() returns NULL.\n\nReplace with !IS_ERR_OR_NULL(cpu_clk) which only proceeds for valid\npointers, preventing potential NULL pointer dereference in clk_get_rate().(CVE-2025-40346)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nhfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat()\n\nThe syzbot reported issue in hfsplus_delete_cat():\n\n[   70.682285][ T9333] =====================================================\n[   70.682943][ T9333] BUG: KMSAN: uninit-value in hfsplus_subfolders_dec+0x1d7/0x220\n[   70.683640][ T9333]  hfsplus_subfolders_dec+0x1d7/0x220\n[   70.684141][ T9333]  hfsplus_delete_cat+0x105d/0x12b0\n[   70.684621][ T9333]  hfsplus_rmdir+0x13d/0x310\n[   70.685048][ T9333]  vfs_rmdir+0x5ba/0x810\n[   70.685447][ T9333]  do_rmdir+0x964/0xea0\n[   70.685833][ T9333]  __x64_sys_rmdir+0x71/0xb0\n[   70.686260][ T9333]  x64_sys_call+0xcd8/0x3cf0\n[   70.686695][ T9333]  do_syscall_64+0xd9/0x1d0\n[   70.687119][ T9333]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[   70.687646][ T9333]\n[   70.687856][ T9333] Uninit was stored to memory at:\n[   70.688311][ T9333]  hfsplus_subfolders_inc+0x1c2/0x1d0\n[   70.688779][ T9333]  hfsplus_create_cat+0x148e/0x1800\n[   70.689231][ T9333]  hfsplus_mknod+0x27f/0x600\n[   70.689730][ T9333]  hfsplus_mkdir+0x5a/0x70\n[   70.690146][ T9333]  vfs_mkdir+0x483/0x7a0\n[   70.690545][ T9333]  do_mkdirat+0x3f2/0xd30\n[   70.690944][ T9333]  __x64_sys_mkdir+0x9a/0xf0\n[   70.691380][ T9333]  x64_sys_call+0x2f89/0x3cf0\n[   70.691816][ T9333]  do_syscall_64+0xd9/0x1d0\n[   70.692229][ T9333]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[   70.692773][ T9333]\n[   70.692990][ T9333] Uninit was stored to memory at:\n[   70.693469][ T9333]  hfsplus_subfolders_inc+0x1c2/0x1d0\n[   70.693960][ T9333]  hfsplus_create_cat+0x148e/0x1800\n[   70.694438][ T9333]  hfsplus_fill_super+0x21c1/0x2700\n[   70.694911][ T9333]  mount_bdev+0x37b/0x530\n[   70.695320][ T9333]  hfsplus_mount+0x4d/0x60\n[   70.695729][ T9333]  legacy_get_tree+0x113/0x2c0\n[   70.696167][ T9333]  vfs_get_tree+0xb3/0x5c0\n[   70.696588][ T9333]  do_new_mount+0x73e/0x1630\n[   70.697013][ T9333]  path_mount+0x6e3/0x1eb0\n[   70.697425][ T9333]  __se_sys_mount+0x733/0x830\n[   70.697857][ T9333]  __x64_sys_mount+0xe4/0x150\n[   70.698269][ T9333]  x64_sys_call+0x2691/0x3cf0\n[   70.698704][ T9333]  do_syscall_64+0xd9/0x1d0\n[   70.699117][ T9333]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[   70.699730][ T9333]\n[   70.699946][ T9333] Uninit was created at:\n[   70.700378][ T9333]  __alloc_pages_noprof+0x714/0xe60\n[   70.700843][ T9333]  alloc_pages_mpol_noprof+0x2a2/0x9b0\n[   70.701331][ T9333]  alloc_pages_noprof+0xf8/0x1f0\n[   70.701774][ T9333]  allocate_slab+0x30e/0x1390\n[   70.702194][ T9333]  ___slab_alloc+0x1049/0x33a0\n[   70.702635][ T9333]  kmem_cache_alloc_lru_noprof+0x5ce/0xb20\n[   70.703153][ T9333]  hfsplus_alloc_inode+0x5a/0xd0\n[   70.703598][ T9333]  alloc_inode+0x82/0x490\n[   70.703984][ T9333]  iget_locked+0x22e/0x1320\n[   70.704428][ T9333]  hfsplus_iget+0x5c/0xba0\n[   70.704827][ T9333]  hfsplus_btree_open+0x135/0x1dd0\n[   70.705291][ T9333]  hfsplus_fill_super+0x1132/0x2700\n[   70.705776][ T9333]  mount_bdev+0x37b/0x530\n[   70.706171][ T9333]  hfsplus_mount+0x4d/0x60\n[   70.706579][ T9333]  legacy_get_tree+0x113/0x2c0\n[   70.707019][ T9333]  vfs_get_tree+0xb3/0x5c0\n[   70.707444][ T9333]  do_new_mount+0x73e/0x1630\n[   70.707865][ T9333]  path_mount+0x6e3/0x1eb0\n[   70.708270][ T9333]  __se_sys_mount+0x733/0x830\n[   70.708711][ T9333]  __x64_sys_mount+0xe4/0x150\n[   70.709158][ T9333]  x64_sys_call+0x2691/0x3cf0\n[   70.709630][ T9333]  do_syscall_64+0xd9/0x1d0\n[   70.710053][ T9333]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[   70.710611][ T9333]\n[   70.710842][ T9333] CPU: 3 UID: 0 PID: 9333 Comm: repro Not tainted 6.12.0-rc6-dirty #17\n[   70.711568][ T9333] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[   70.712490][ T9333] =====================================================\n[   70.713085][ T9333] Disabling lock debugging due to kernel taint\n[   70.713618][ T9333] Kernel panic - not syncing: kmsan.panic set ...\n[   70.714159][ T9333] \n---truncated---(CVE-2025-40351)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nriscv: stacktrace: Disable KASAN checks for non-current tasks\n\nUnwinding the stack of a task other than current, KASAN would report\n\u0026quot;BUG: KASAN: out-of-bounds in walk_stackframe+0x41c/0x460\u0026quot;\n\nThere is a same issue on x86 and has been resolved by the commit\n84936118bdf3 (\u0026quot;x86/unwind: Disable KASAN checks for non-current tasks\u0026quot;)\nThe solution could be applied to RISC-V too.\n\nThis patch also can solve the issue:\nhttps://seclists.org/oss-sec/2025/q4/23\n\n[(CVE-2025-40358)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/intel: Fix KASAN global-out-of-bounds warning\n\nWhen running \u0026quot;perf mem record\u0026quot; command on CWF, the below KASAN\nglobal-out-of-bounds warning is seen.\n\n  ==================================================================\n  BUG: KASAN: global-out-of-bounds in cmt_latency_data+0x176/0x1b0\n  Read of size 4 at addr ffffffffb721d000 by task dtlb/9850\n\n  Call Trace:\n\n   kasan_report+0xb8/0xf0\n   cmt_latency_data+0x176/0x1b0\n   setup_arch_pebs_sample_data+0xf49/0x2560\n   intel_pmu_drain_arch_pebs+0x577/0xb00\n   handle_pmi_common+0x6c4/0xc80\n\nThe issue is caused by below code in __grt_latency_data(). The code\ntries to access x86_hybrid_pmu structure which doesn\u0026apos;t exist on\nnon-hybrid platform like CWF.\n\n        WARN_ON_ONCE(hybrid_pmu(event-\u0026gt;pmu)-\u0026gt;pmu_type == hybrid_big)\n\nSo add is_hybrid() check before calling this WARN_ON_ONCE to fix the\nglobal-out-of-bounds access issue.(CVE-2025-40359)\n\nRejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.(CVE-2025-40361)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nx86/fpu: Ensure XFD state on signal delivery\n\nSean reported [1] the following splat when running KVM tests:\n\n   WARNING: CPU: 232 PID: 15391 at xfd_validate_state+0x65/0x70\n   Call Trace:\n    \u0026lt;TASK\u0026gt;\n    fpu__clear_user_states+0x9c/0x100\n    arch_do_signal_or_restart+0x142/0x210\n    exit_to_user_mode_loop+0x55/0x100\n    do_syscall_64+0x205/0x2c0\n    entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\nChao further identified [2] a reproducible scenario involving signal\ndelivery: a non-AMX task is preempted by an AMX-enabled task which\nmodifies the XFD MSR.\n\nWhen the non-AMX task resumes and reloads XSTATE with init values,\na warning is triggered due to a mismatch between fpstate::xfd and the\nCPU\u0026apos;s current XFD state. fpu__clear_user_states() does not currently\nre-synchronize the XFD state after such preemption.\n\nInvoke xfd_update_state() which detects and corrects the mismatch if\nthere is a dynamic feature.\n\nThis also benefits the sigreturn path, as fpu__restore_sig() may call\nfpu__clear_user_states() when the sigframe is inaccessible.\n\n[ dhansen: minor changelog munging ](CVE-2025-68171)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Fix softlockup in ftrace_module_enable\n\nA soft lockup was observed when loading amdgpu module.\nIf a module has a lot of tracable functions, multiple calls\nto kallsyms_lookup can spend too much time in RCU critical\nsection and with disabled preemption, causing kernel panic.\nThis is the same issue that was fixed in\ncommit d0b24b4e91fc (\u0026quot;ftrace: Prevent RCU stall on PREEMPT_VOLUNTARY\nkernels\u0026quot;) and commit 42ea22e754ba (\u0026quot;ftrace: Add cond_resched() to\nftrace_graph_set_hash()\u0026quot;).\n\nFix it the same way by adding cond_resched() in ftrace_module_enable.(CVE-2025-68173)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\namd/amdkfd: enhance kfd process check in switch partition\n\ncurrent switch partition only check if kfd_processes_table is empty.\nkfd_prcesses_table entry is deleted in kfd_process_notifier_release, but\nkfd_process tear down is in kfd_process_wq_release.\n\nconsider two processes:\n\nProcess A (workqueue) -\u0026gt; kfd_process_wq_release -\u0026gt; Access kfd_node member\nProcess B switch partition -\u0026gt; amdgpu_xcp_pre_partition_switch -\u0026gt; amdgpu_amdkfd_device_fini_sw\n-\u0026gt; kfd_node tear down.\n\nProcess A and B may trigger a race as shown in dmesg log.\n\nThis patch is to resolve the race by adding an atomic kfd_process counter\nkfd_processes_count, it increment as create kfd process, decrement as\nfinish kfd_process_wq_release.\n\nv2: Put kfd_processes_count per kfd_dev, move decrement to kfd_process_destroy_pdds\nand bug fix. (Philip Yang)\n\n[3966658.307702] divide error: 0000 [#1] SMP NOPTI\n[3966658.350818]  i10nm_edac\n[3966658.356318] CPU: 124 PID: 38435 Comm: kworker/124:0 Kdump: loaded Tainted\n[3966658.356890] Workqueue: kfd_process_wq kfd_process_wq_release [amdgpu]\n[3966658.362839]  nfit\n[3966658.366457] RIP: 0010:kfd_get_num_sdma_engines+0x17/0x40 [amdgpu]\n[3966658.366460] Code: 00 00 e9 ac 81 02 00 66 66 2e 0f 1f 84 00 00 00 00 00 90 0f 1f 44 00 00 48 8b 4f 08 48 8b b7 00 01 00 00 8b 81 58 26 03 00 99 \u0026lt;f7\u0026gt; be b8 01 00 00 80 b9 70 2e 00 00 00 74 0b 83 f8 02 ba 02 00 00\n[3966658.380967]  x86_pkg_temp_thermal\n[3966658.391529] RSP: 0018:ffffc900a0edfdd8 EFLAGS: 00010246\n[3966658.391531] RAX: 0000000000000008 RBX: ffff8974e593b800 RCX: ffff888645900000\n[3966658.391531] RDX: 0000000000000000 RSI: ffff888129154400 RDI: ffff888129151c00\n[3966658.391532] RBP: ffff8883ad79d400 R08: 0000000000000000 R09: ffff8890d2750af4\n[3966658.391532] R10: 0000000000000018 R11: 0000000000000018 R12: 0000000000000000\n[3966658.391533] R13: ffff8883ad79d400 R14: ffffe87ff662ba00 R15: ffff8974e593b800\n[3966658.391533] FS:  0000000000000000(0000) GS:ffff88fe7f600000(0000) knlGS:0000000000000000\n[3966658.391534] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[3966658.391534] CR2: 0000000000d71000 CR3: 000000dd0e970004 CR4: 0000000002770ee0\n[3966658.391535] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[3966658.391535] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400\n[3966658.391536] PKRU: 55555554\n[3966658.391536] Call Trace:\n[3966658.391674]  deallocate_sdma_queue+0x38/0xa0 [amdgpu]\n[3966658.391762]  process_termination_cpsch+0x1ed/0x480 [amdgpu]\n[3966658.399754]  intel_powerclamp\n[3966658.402831]  kfd_process_dequeue_from_all_devices+0x5b/0xc0 [amdgpu]\n[3966658.402908]  kfd_process_wq_release+0x1a/0x1a0 [amdgpu]\n[3966658.410516]  coretemp\n[3966658.434016]  process_one_work+0x1ad/0x380\n[3966658.434021]  worker_thread+0x49/0x310\n[3966658.438963]  kvm_intel\n[3966658.446041]  ? process_one_work+0x380/0x380\n[3966658.446045]  kthread+0x118/0x140\n[3966658.446047]  ? __kthread_bind_mask+0x60/0x60\n[3966658.446050]  ret_from_fork+0x1f/0x30\n[3966658.446053] Modules linked in: kpatch_20765354(OEK)\n[3966658.455310]  kvm\n[3966658.464534]  mptcp_diag xsk_diag raw_diag unix_diag af_packet_diag netlink_diag udp_diag act_pedit act_mirred act_vlan cls_flower kpatch_21951273(OEK) kpatch_18424469(OEK) kpatch_19749756(OEK)\n[3966658.473462]  idxd_mdev\n[3966658.482306]  kpatch_17971294(OEK) sch_ingress xt_conntrack amdgpu(OE) amdxcp(OE) amddrm_buddy(OE) amd_sched(OE) amdttm(OE) amdkcl(OE) intel_ifs iptable_mangle tcm_loop target_core_pscsi tcp_diag target_core_file inet_diag target_core_iblock target_core_user target_core_mod coldpgs kpatch_18383292(OEK) ip6table_nat ip6table_filter ip6_tables ip_set_hash_ipportip ip_set_hash_ipportnet ip_set_hash_ipport ip_set_bitmap_port xt_comment iptable_nat nf_nat iptable_filter ip_tables ip_set ip_vs_sh ip_vs_wrr ip_vs_rr ip_vs nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 sn_core_odd(OE) i40e overlay binfmt_misc tun bonding(OE) aisqos(OE) aisqo\n---truncated---(CVE-2025-68174)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nPCI: cadence: Check for the existence of cdns_pcie::ops before using it\n\ncdns_pcie::ops might not be populated by all the Cadence glue drivers. This\nis going to be true for the upcoming Sophgo platform which doesn\u0026apos;t set the\nops.\n\nHence, add a check to prevent NULL pointer dereference.\n\n[mani: reworded subject and description](CVE-2025-68176)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check()\n\nUse RCU to avoid a pair of atomic operations and a potential\nUAF on dst_dev()-\u0026gt;flags.(CVE-2025-68188)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Add bpf_prog_run_data_pointers()\n\nsyzbot found that cls_bpf_classify() is able to change\ntc_skb_cb(skb)-\u0026gt;drop_reason triggering a warning in sk_skb_reason_drop().\n\nWARNING: CPU: 0 PID: 5965 at net/core/skbuff.c:1192 __sk_skb_reason_drop net/core/skbuff.c:1189 [inline]\nWARNING: CPU: 0 PID: 5965 at net/core/skbuff.c:1192 sk_skb_reason_drop+0x76/0x170 net/core/skbuff.c:1214\n\nstruct tc_skb_cb has been added in commit ec624fe740b4 (\u0026quot;net/sched:\nExtend qdisc control block with tc control block\u0026quot;), which added a wrong\ninteraction with db58ba459202 (\u0026quot;bpf: wire in data and data_end for\ncls_act_bpf\u0026quot;).\n\ndrop_reason was added later.\n\nAdd bpf_prog_run_data_pointers() helper to save/restore the net_sched\nstorage colliding with BPF data_meta/data_end.(CVE-2025-68200)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_ct: add seqadj extension for natted connections\n\nSequence adjustment may be required for FTP traffic with PASV/EPSV modes.\ndue to need to re-write packet payload (IP, port) on the ftp control\nconnection. This can require changes to the TCP length and expected\nseq / ack_seq.\n\nThe easiest way to reproduce this issue is with PASV mode.\nExample ruleset:\ntable inet ftp_nat {\n        ct helper ftp_helper {\n                type \u0026quot;ftp\u0026quot; protocol tcp\n                l3proto inet\n        }\n\n        chain prerouting {\n                type filter hook prerouting priority 0; policy accept;\n                tcp dport 21 ct state new ct helper set \u0026quot;ftp_helper\u0026quot;\n        }\n}\ntable ip nat {\n        chain prerouting {\n                type nat hook prerouting priority -100; policy accept;\n                tcp dport 21 dnat ip prefix to ip daddr map {\n\t\t\t192.168.100.1 : 192.168.13.2/32 }\n        }\n\n        chain postrouting {\n                type nat hook postrouting priority 100 ; policy accept;\n                tcp sport 21 snat ip prefix to ip saddr map {\n\t\t\t192.168.13.2 : 192.168.100.1/32 }\n        }\n}\n\nNote that the ftp helper gets assigned *after* the dnat setup.\n\nThe inverse (nat after helper assign) is handled by an existing\ncheck in nf_nat_setup_info() and will not show the problem.\n\nTopoloy:\n\n +-------------------+     +----------------------------------+\n | FTP: 192.168.13.2 | \u0026lt;-\u0026gt; | NAT: 192.168.13.3, 192.168.100.1 |\n +-------------------+     +----------------------------------+\n                                      |\n                         +-----------------------+\n                         | Client: 192.168.100.2 |\n                         +-----------------------+\n\nftp nat changes do not work as expected in this case:\nConnected to 192.168.100.1.\n[..]\nftp\u0026gt; epsv\nEPSV/EPRT on IPv4 off.\nftp\u0026gt; ls\n227 Entering passive mode (192,168,100,1,209,129).\n421 Service not available, remote server has closed connection.\n\nKernel logs:\nMissing nfct_seqadj_ext_add() setup call\nWARNING: CPU: 1 PID: 0 at net/netfilter/nf_conntrack_seqadj.c:41\n[..]\n __nf_nat_mangle_tcp_packet+0x100/0x160 [nf_nat]\n nf_nat_ftp+0x142/0x280 [nf_nat_ftp]\n help+0x4d1/0x880 [nf_conntrack_ftp]\n nf_confirm+0x122/0x2e0 [nf_conntrack]\n nf_hook_slow+0x3c/0xb0\n ..\n\nFix this by adding the required extension when a conntrack helper is assigned\nto a connection that has a nat binding.(CVE-2025-68206)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: account for current allocated stack depth in widen_imprecise_scalars()\n\nThe usage pattern for widen_imprecise_scalars() looks as follows:\n\n    prev_st = find_prev_entry(env, ...);\n    queued_st = push_stack(...);\n    widen_imprecise_scalars(env, prev_st, queued_st);\n\nWhere prev_st is an ancestor of the queued_st in the explored states\ntree. This ancestor is not guaranteed to have same allocated stack\ndepth as queued_st. E.g. in the following case:\n\n    def main():\n      for i in 1..2:\n        foo(i)        // same callsite, differnt param\n\n    def foo(i):\n      if i == 1:\n        use 128 bytes of stack\n      iterator based loop\n\nHere, for a second \u0026apos;foo\u0026apos; call prev_st-\u0026gt;allocated_stack is 128,\nwhile queued_st-\u0026gt;allocated_stack is much smaller.\nwiden_imprecise_scalars() needs to take this into account and avoid\naccessing bpf_verifier_state-\u0026gt;frame[*]-\u0026gt;stack out of bounds.(CVE-2025-68208)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot\n\nnvkm_falcon_fw::boot is allocated, but no one frees it. This causes a\nkmemleak warning.\n\nMake sure this data is deallocated.(CVE-2025-68235)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Don\u0026apos;t skip unrelated instruction if INT3/INTO is replaced\n\nWhen re-injecting a soft interrupt from an INT3, INT0, or (select) INTn\ninstruction, discard the exception and retry the instruction if the code\nstream is changed (e.g. by a different vCPU) between when the CPU\nexecutes the instruction and when KVM decodes the instruction to get the\nnext RIP.\n\nAs effectively predicted by commit 6ef88d6e36c2 (\u0026quot;KVM: SVM: Re-inject\nINT3/INTO instead of retrying the instruction\u0026quot;), failure to verify that\nthe correct INTn instruction was decoded can effectively clobber guest\nstate due to decoding the wrong instruction and thus specifying the\nwrong next RIP.\n\nThe bug most often manifests as \u0026quot;Oops: int3\u0026quot; panics on static branch\nchecks in Linux guests.  Enabling or disabling a static branch in Linux\nuses the kernel\u0026apos;s \u0026quot;text poke\u0026quot; code patching mechanism.  To modify code\nwhile other CPUs may be executing that code, Linux (temporarily)\nreplaces the first byte of the original instruction with an int3 (opcode\n0xcc), then patches in the new code stream except for the first byte,\nand finally replaces the int3 with the first byte of the new code\nstream.  If a CPU hits the int3, i.e. executes the code while it\u0026apos;s being\nmodified, then the guest kernel must look up the RIP to determine how to\nhandle the #BP, e.g. by emulating the new instruction.  If the RIP is\nincorrect, then this lookup fails and the guest kernel panics.\n\nThe bug reproduces almost instantly by hacking the guest kernel to\nrepeatedly check a static branch[1] while running a drgn script[2] on\nthe host to constantly swap out the memory containing the guest\u0026apos;s TSS.\n\n[1]: https://gist.github.com/osandov/44d17c51c28c0ac998ea0334edf90b5a\n[2]: https://gist.github.com/osandov/10e45e45afa29b11e0c7209247afc00b(CVE-2025-68259)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\next4: add i_data_sem protection in ext4_destroy_inline_data_nolock()\n\nFix a race between inline data destruction and block mapping.\n\nThe function ext4_destroy_inline_data_nolock() changes the inode data\nlayout by clearing EXT4_INODE_INLINE_DATA and setting EXT4_INODE_EXTENTS.\nAt the same time, another thread may execute ext4_map_blocks(), which\ntests EXT4_INODE_EXTENTS to decide whether to call ext4_ext_map_blocks()\nor ext4_ind_map_blocks().\n\nWithout i_data_sem protection, ext4_ind_map_blocks() may receive inode\nwith EXT4_INODE_EXTENTS flag and triggering assert.\n\nkernel BUG at fs/ext4/indirect.c:546!\nEXT4-fs (loop2): unmounting filesystem.\ninvalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014\nRIP: 0010:ext4_ind_map_blocks.cold+0x2b/0x5a fs/ext4/indirect.c:546\n\nCall Trace:\n \u0026lt;TASK\u0026gt;\n ext4_map_blocks+0xb9b/0x16f0 fs/ext4/inode.c:681\n _ext4_get_block+0x242/0x590 fs/ext4/inode.c:822\n ext4_block_write_begin+0x48b/0x12c0 fs/ext4/inode.c:1124\n ext4_write_begin+0x598/0xef0 fs/ext4/inode.c:1255\n ext4_da_write_begin+0x21e/0x9c0 fs/ext4/inode.c:3000\n generic_perform_write+0x259/0x5d0 mm/filemap.c:3846\n ext4_buffered_write_iter+0x15b/0x470 fs/ext4/file.c:285\n ext4_file_write_iter+0x8e0/0x17f0 fs/ext4/file.c:679\n call_write_iter include/linux/fs.h:2271 [inline]\n do_iter_readv_writev+0x212/0x3c0 fs/read_write.c:735\n do_iter_write+0x186/0x710 fs/read_write.c:861\n vfs_iter_write+0x70/0xa0 fs/read_write.c:902\n iter_file_splice_write+0x73b/0xc90 fs/splice.c:685\n do_splice_from fs/splice.c:763 [inline]\n direct_splice_actor+0x10f/0x170 fs/splice.c:950\n splice_direct_to_actor+0x33a/0xa10 fs/splice.c:896\n do_splice_direct+0x1a9/0x280 fs/splice.c:1002\n do_sendfile+0xb13/0x12c0 fs/read_write.c:1255\n __do_sys_sendfile64 fs/read_write.c:1323 [inline]\n __se_sys_sendfile64 fs/read_write.c:1309 [inline]\n __x64_sys_sendfile64+0x1cf/0x210 fs/read_write.c:1309\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81\n entry_SYSCALL_64_after_hwframe+0x6e/0xd8(CVE-2025-68261)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\next4: refresh inline data size before write operations\n\nThe cached ei-\u0026gt;i_inline_size can become stale between the initial size\ncheck and when ext4_update_inline_data()/ext4_create_inline_data() use\nit. Although ext4_get_max_inline_size() reads the correct value at the\ntime of the check, concurrent xattr operations can modify i_inline_size\nbefore ext4_write_lock_xattr() is acquired.\n\nThis causes ext4_update_inline_data() and ext4_create_inline_data() to\nwork with stale capacity values, leading to a BUG_ON() crash in\next4_write_inline_data():\n\n  kernel BUG at fs/ext4/inline.c:1331!\n  BUG_ON(pos + len \u0026gt; EXT4_I(inode)-\u0026gt;i_inline_size);\n\nThe race window:\n1. ext4_get_max_inline_size() reads i_inline_size = 60 (correct)\n2. Size check passes for 50-byte write\n3. [Another thread adds xattr, i_inline_size changes to 40]\n4. ext4_write_lock_xattr() acquires lock\n5. ext4_update_inline_data() uses stale i_inline_size = 60\n6. Attempts to write 50 bytes but only 40 bytes actually available\n7. BUG_ON() triggers\n\nFix this by recalculating i_inline_size via ext4_find_inline_data_nolock()\nimmediately after acquiring xattr_sem. This ensures ext4_update_inline_data()\nand ext4_create_inline_data() work with current values that are protected\nfrom concurrent modifications.\n\nThis is similar to commit a54c4613dac1 (\u0026quot;ext4: fix race writing to an\ninline_data file while its xattrs are changing\u0026quot;) which fixed i_inline_off\nstaleness. This patch addresses the related i_inline_size staleness issue.(CVE-2025-68264)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvme: fix admin request_queue lifetime\n\nThe namespaces can access the controller\u0026apos;s admin request_queue, and\nstale references on the namespaces may exist after tearing down the\ncontroller. Ensure the admin request_queue is active by moving the\ncontroller\u0026apos;s \u0026apos;put\u0026apos; to after all controller references have been released\nto ensure no one is can access the request_queue. This fixes a reported\nuse-after-free bug:\n\n  BUG: KASAN: slab-use-after-free in blk_queue_enter+0x41c/0x4a0\n  Read of size 8 at addr ffff88c0a53819f8 by task nvme/3287\n  CPU: 67 UID: 0 PID: 3287 Comm: nvme Tainted: G            E       6.13.2-ga1582f1a031e #15\n  Tainted: [E]=UNSIGNED_MODULE\n  Hardware name: Jabil /EGS 2S MB1, BIOS 1.00 06/18/2025\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   dump_stack_lvl+0x4f/0x60\n   print_report+0xc4/0x620\n   ? _raw_spin_lock_irqsave+0x70/0xb0\n   ? _raw_read_unlock_irqrestore+0x30/0x30\n   ? blk_queue_enter+0x41c/0x4a0\n   kasan_report+0xab/0xe0\n   ? blk_queue_enter+0x41c/0x4a0\n   blk_queue_enter+0x41c/0x4a0\n   ? __irq_work_queue_local+0x75/0x1d0\n   ? blk_queue_start_drain+0x70/0x70\n   ? irq_work_queue+0x18/0x20\n   ? vprintk_emit.part.0+0x1cc/0x350\n   ? wake_up_klogd_work_func+0x60/0x60\n   blk_mq_alloc_request+0x2b7/0x6b0\n   ? __blk_mq_alloc_requests+0x1060/0x1060\n   ? __switch_to+0x5b7/0x1060\n   nvme_submit_user_cmd+0xa9/0x330\n   nvme_user_cmd.isra.0+0x240/0x3f0\n   ? force_sigsegv+0xe0/0xe0\n   ? nvme_user_cmd64+0x400/0x400\n   ? vfs_fileattr_set+0x9b0/0x9b0\n   ? cgroup_update_frozen_flag+0x24/0x1c0\n   ? cgroup_leave_frozen+0x204/0x330\n   ? nvme_ioctl+0x7c/0x2c0\n   blkdev_ioctl+0x1a8/0x4d0\n   ? blkdev_common_ioctl+0x1930/0x1930\n   ? fdget+0x54/0x380\n   __x64_sys_ioctl+0x129/0x190\n   do_syscall_64+0x5b/0x160\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n  RIP: 0033:0x7f765f703b0b\n  Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 8b 0d dd 52 0f 00 f7 d8 64 89 01 48\n  RSP: 002b:00007ffe2cefe808 EFLAGS: 00000202 ORIG_RAX: 0000000000000010\n  RAX: ffffffffffffffda RBX: 00007ffe2cefe860 RCX: 00007f765f703b0b\n  RDX: 00007ffe2cefe860 RSI: 00000000c0484e41 RDI: 0000000000000003\n  RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000000\n  R10: 00007f765f611d50 R11: 0000000000000202 R12: 0000000000000003\n  R13: 00000000c0484e41 R14: 0000000000000001 R15: 00007ffe2cefea60\n   \u0026lt;/TASK\u0026gt;(CVE-2025-68265)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix crash in process_v2_sparse_read() for encrypted directories\n\nThe crash in process_v2_sparse_read() for fscrypt-encrypted directories\nhas been reported. Issue takes place for Ceph msgr2 protocol in secure\nmode. It can be reproduced by the steps:\n\nsudo mount -t ceph :/ /mnt/cephfs/ -o name=admin,fs=cephfs,ms_mode=secure\n\n(1) mkdir /mnt/cephfs/fscrypt-test-3\n(2) cp area_decrypted.tar /mnt/cephfs/fscrypt-test-3\n(3) fscrypt encrypt --source=raw_key --key=./my.key /mnt/cephfs/fscrypt-test-3\n(4) fscrypt lock /mnt/cephfs/fscrypt-test-3\n(5) fscrypt unlock --key=my.key /mnt/cephfs/fscrypt-test-3\n(6) cat /mnt/cephfs/fscrypt-test-3/area_decrypted.tar\n(7) Issue has been triggered\n\n[  408.072247] ------------[ cut here ]------------\n[  408.072251] WARNING: CPU: 1 PID: 392 at net/ceph/messenger_v2.c:865\nceph_con_v2_try_read+0x4b39/0x72f0\n[  408.072267] Modules linked in: intel_rapl_msr intel_rapl_common\nintel_uncore_frequency_common intel_pmc_core pmt_telemetry pmt_discovery\npmt_class intel_pmc_ssram_telemetry intel_vsec kvm_intel joydev kvm irqbypass\npolyval_clmulni ghash_clmulni_intel aesni_intel rapl input_leds psmouse\nserio_raw i2c_piix4 vga16fb bochs vgastate i2c_smbus floppy mac_hid qemu_fw_cfg\npata_acpi sch_fq_codel rbd msr parport_pc ppdev lp parport efi_pstore\n[  408.072304] CPU: 1 UID: 0 PID: 392 Comm: kworker/1:3 Not tainted 6.17.0-rc7+\n[  408.072307] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\n1.17.0-5.fc42 04/01/2014\n[  408.072310] Workqueue: ceph-msgr ceph_con_workfn\n[  408.072314] RIP: 0010:ceph_con_v2_try_read+0x4b39/0x72f0\n[  408.072317] Code: c7 c1 20 f0 d4 ae 50 31 d2 48 c7 c6 60 27 d5 ae 48 c7 c7 f8\n8e 6f b0 68 60 38 d5 ae e8 00 47 61 fe 48 83 c4 18 e9 ac fc ff ff \u0026lt;0f\u0026gt; 0b e9 06\nfe ff ff 4c 8b 9d 98 fd ff ff 0f 84 64 e7 ff ff 89 85\n[  408.072319] RSP: 0018:ffff88811c3e7a30 EFLAGS: 00010246\n[  408.072322] RAX: ffffed1024874c6f RBX: ffffea00042c2b40 RCX: 0000000000000f38\n[  408.072324] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\n[  408.072325] RBP: ffff88811c3e7ca8 R08: 0000000000000000 R09: 00000000000000c8\n[  408.072326] R10: 00000000000000c8 R11: 0000000000000000 R12: 00000000000000c8\n[  408.072327] R13: dffffc0000000000 R14: ffff8881243a6030 R15: 0000000000003000\n[  408.072329] FS:  0000000000000000(0000) GS:ffff88823eadf000(0000)\nknlGS:0000000000000000\n[  408.072331] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  408.072332] CR2: 000000c0003c6000 CR3: 000000010c106005 CR4: 0000000000772ef0\n[  408.072336] PKRU: 55555554\n[  408.072337] Call Trace:\n[  408.072338]  \u0026lt;TASK\u0026gt;\n[  408.072340]  ? sched_clock_noinstr+0x9/0x10\n[  408.072344]  ? __pfx_ceph_con_v2_try_read+0x10/0x10\n[  408.072347]  ? _raw_spin_unlock+0xe/0x40\n[  408.072349]  ? finish_task_switch.isra.0+0x15d/0x830\n[  408.072353]  ? __kasan_check_write+0x14/0x30\n[  408.072357]  ? mutex_lock+0x84/0xe0\n[  408.072359]  ? __pfx_mutex_lock+0x10/0x10\n[  408.072361]  ceph_con_workfn+0x27e/0x10e0\n[  408.072364]  ? metric_delayed_work+0x311/0x2c50\n[  408.072367]  process_one_work+0x611/0xe20\n[  408.072371]  ? __kasan_check_write+0x14/0x30\n[  408.072373]  worker_thread+0x7e3/0x1580\n[  408.072375]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n[  408.072378]  ? __pfx_worker_thread+0x10/0x10\n[  408.072381]  kthread+0x381/0x7a0\n[  408.072383]  ? __pfx__raw_spin_lock_irq+0x10/0x10\n[  408.072385]  ? __pfx_kthread+0x10/0x10\n[  408.072387]  ? __kasan_check_write+0x14/0x30\n[  408.072389]  ? recalc_sigpending+0x160/0x220\n[  408.072392]  ? _raw_spin_unlock_irq+0xe/0x50\n[  408.072394]  ? calculate_sigpending+0x78/0xb0\n[  408.072395]  ? __pfx_kthread+0x10/0x10\n[  408.072397]  ret_from_fork+0x2b6/0x380\n[  408.072400]  ? __pfx_kthread+0x10/0x10\n[  408.072402]  ret_from_fork_asm+0x1a/0x30\n[  408.072406]  \u0026lt;/TASK\u0026gt;\n[  408.072407] ---[ end trace 0000000000000000 ]---\n[  408.072418] Oops: general protection fault, probably for non-canonical\naddress 0xdffffc00000000\n---truncated---(CVE-2025-68297)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: atlantic: fix fragment overflow handling in RX path\n\nThe atlantic driver can receive packets with more than MAX_SKB_FRAGS (17)\nfragments when handling large multi-descriptor packets. This causes an\nout-of-bounds write in skb_add_rx_frag_netmem() leading to kernel panic.\n\nThe issue occurs because the driver doesn\u0026apos;t check the total number of\nfragments before calling skb_add_rx_frag(). When a packet requires more\nthan MAX_SKB_FRAGS fragments, the fragment index exceeds the array bounds.\n\nFix by assuming there will be an extra frag if buff-\u0026gt;len \u0026gt; AQ_CFG_RX_HDR_SIZE,\nthen all fragments are accounted for. And reusing the existing check to\nprevent the overflow earlier in the code path.\n\nThis crash occurred in production with an Aquantia AQC113 10G NIC.\n\nStack trace from production environment:\n```\nRIP: 0010:skb_add_rx_frag_netmem+0x29/0xd0\nCode: 90 f3 0f 1e fa 0f 1f 44 00 00 48 89 f8 41 89\nca 48 89 d7 48 63 ce 8b 90 c0 00 00 00 48 c1 e1 04 48 01 ca 48 03 90\nc8 00 00 00 \u0026lt;48\u0026gt; 89 7a 30 44 89 52 3c 44 89 42 38 40 f6 c7 01 75 74 48\n89 fa 83\nRSP: 0018:ffffa9bec02a8d50 EFLAGS: 00010287\nRAX: ffff925b22e80a00 RBX: ffff925ad38d2700 RCX:\nfffffffe0a0c8000\nRDX: ffff9258ea95bac0 RSI: ffff925ae0a0c800 RDI:\n0000000000037a40\nRBP: 0000000000000024 R08: 0000000000000000 R09:\n0000000000000021\nR10: 0000000000000848 R11: 0000000000000000 R12:\nffffa9bec02a8e24\nR13: ffff925ad8615570 R14: 0000000000000000 R15:\nffff925b22e80a00\nFS: 0000000000000000(0000)\nGS:ffff925e47880000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffff9258ea95baf0 CR3: 0000000166022004 CR4:\n0000000000f72ef0\nPKRU: 55555554\nCall Trace:\n\u0026lt;IRQ\u0026gt;\naq_ring_rx_clean+0x175/0xe60 [atlantic]\n? aq_ring_rx_clean+0x14d/0xe60 [atlantic]\n? aq_ring_tx_clean+0xdf/0x190 [atlantic]\n? kmem_cache_free+0x348/0x450\n? aq_vec_poll+0x81/0x1d0 [atlantic]\n? __napi_poll+0x28/0x1c0\n? net_rx_action+0x337/0x420\n```\n\nChanges in v4:\n- Add Fixes: tag to satisfy patch validation requirements.\n\nChanges in v3:\n- Fix by assuming there will be an extra frag if buff-\u0026gt;len \u0026gt; AQ_CFG_RX_HDR_SIZE,\n  then all fragments are accounted for.(CVE-2025-68301)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nPCI/AER: Fix NULL pointer access by aer_info\n\nThe kzalloc(GFP_KERNEL) may return NULL, so all accesses to aer_info-\u0026gt;xxx\nwill result in kernel panic. Fix it.(CVE-2025-68309)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer\n\nWhen a UAS device is unplugged during data transfer, there is\na probability of a system panic occurring. The root cause is\nan access to an invalid memory address during URB callback handling.\nSpecifically, this happens when the dma_direct_unmap_sg() function\nis called within the usb_hcd_unmap_urb_for_dma() interface, but the\nsg-\u0026gt;dma_address field is 0 and the sg data structure has already been\nfreed.\n\nThe SCSI driver sends transfer commands by invoking uas_queuecommand_lck()\nin uas.c, using the uas_submit_urbs() function to submit requests to USB.\nWithin the uas_submit_urbs() implementation, three URBs (sense_urb,\ndata_urb, and cmd_urb) are sequentially submitted. Device removal may\noccur at any point during uas_submit_urbs execution, which may result\nin URB submission failure. However, some URBs might have been successfully\nsubmitted before the failure, and uas_submit_urbs will return the -ENODEV\nerror code in this case. The current error handling directly calls\nscsi_done(). In the SCSI driver, this eventually triggers scsi_complete()\nto invoke scsi_end_request() for releasing the sgtable. The successfully\nsubmitted URBs, when being unlinked to giveback, call\nusb_hcd_unmap_urb_for_dma() in hcd.c, leading to exceptions during sg\nunmapping operations since the sg data structure has already been freed.\n\nThis patch modifies the error condition check in the uas_submit_urbs()\nfunction. When a UAS device is removed but one or more URBs have already\nbeen successfully submitted to USB, it avoids immediately invoking\nscsi_done() and save the cmnd to devinfo-\u0026gt;cmnd array. If the successfully\nsubmitted URBs is completed before devinfo-\u0026gt;resetting being set, then\nthe scsi_done() function will be called within uas_try_complete() after\nall pending URB operations are finalized. Otherwise, the scsi_done()\nfunction will be called within uas_zap_pending(), which is executed after\nusb_kill_anchored_urbs().\n\nThe error handling only takes effect when uas_queuecommand_lck() calls\nuas_submit_urbs() and returns the error value -ENODEV . In this case,\nthe device is disconnected, and the flow proceeds to uas_disconnect(),\nwhere uas_zap_pending() is invoked to call uas_try_complete().(CVE-2025-68331)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\njbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted\n\nThere\u0026apos;s issue when file system corrupted:\n------------[ cut here ]------------\nkernel BUG at fs/jbd2/transaction.c:1289!\nOops: invalid opcode: 0000 [#1] SMP KASAN PTI\nCPU: 5 UID: 0 PID: 2031 Comm: mkdir Not tainted 6.18.0-rc1-next\nRIP: 0010:jbd2_journal_get_create_access+0x3b6/0x4d0\nRSP: 0018:ffff888117aafa30 EFLAGS: 00010202\nRAX: 0000000000000000 RBX: ffff88811a86b000 RCX: ffffffff89a63534\nRDX: 1ffff110200ec602 RSI: 0000000000000004 RDI: ffff888100763010\nRBP: ffff888100763000 R08: 0000000000000001 R09: ffff888100763028\nR10: 0000000000000003 R11: 0000000000000000 R12: 0000000000000000\nR13: ffff88812c432000 R14: ffff88812c608000 R15: ffff888120bfc000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f91d6970c99 CR3: 00000001159c4000 CR4: 00000000000006f0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n __ext4_journal_get_create_access+0x42/0x170\n ext4_getblk+0x319/0x6f0\n ext4_bread+0x11/0x100\n ext4_append+0x1e6/0x4a0\n ext4_init_new_dir+0x145/0x1d0\n ext4_mkdir+0x326/0x920\n vfs_mkdir+0x45c/0x740\n do_mkdirat+0x234/0x2f0\n __x64_sys_mkdir+0xd6/0x120\n do_syscall_64+0x5f/0xfa0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nThe above issue occurs with us in errors=continue mode when accompanied by\nstorage failures. There have been many inconsistencies in the file system\ndata.\nIn the case of file system data inconsistency, for example, if the block\nbitmap of a referenced block is not set, it can lead to the situation where\na block being committed is allocated and used again. As a result, the\nfollowing condition will not be satisfied then trigger BUG_ON. Of course,\nit is entirely possible to construct a problematic image that can trigger\nthis BUG_ON through specific operations. In fact, I have constructed such\nan image and easily reproduced this issue.\nTherefore, J_ASSERT() holds true only under ideal conditions, but it may\nnot necessarily be satisfied in exceptional scenarios. Using J_ASSERT()\ndirectly in abnormal situations would cause the system to crash, which is\nclearly not what we want. So here we directly trigger a JBD abort instead\nof immediately invoking BUG_ON.(CVE-2025-68337)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid\n\nFixes a crash when layout is null during this call stack:\n\nwrite_inode\n    -\u0026gt; nfs4_write_inode\n        -\u0026gt; pnfs_layoutcommit_inode\n\npnfs_set_layoutcommit relies on the lseg refcount to keep the layout\naround. Need to clear NFS_INO_LAYOUTCOMMIT otherwise we might attempt\nto reference a null layout.(CVE-2025-68349)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nregulator: core: Protect regulator_supply_alias_list with regulator_list_mutex\n\nregulator_supply_alias_list was accessed without any locking in\nregulator_supply_alias(), regulator_register_supply_alias(), and\nregulator_unregister_supply_alias(). Concurrent registration,\nunregistration and lookups can race, leading to:\n\n1 use-after-free if an alias entry is removed while being read,\n2 duplicate entries when two threads register the same alias,\n3 inconsistent alias mappings observed by consumers.\n\nProtect all traversals, insertions and deletions on\nregulator_supply_alias_list with the existing regulator_list_mutex.(CVE-2025-68354)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Prevent recursive memory reclaim\n\nFunction new_inode() returns a new inode with inode-\u0026gt;i_mapping-\u0026gt;gfp_mask\nset to GFP_HIGHUSER_MOVABLE.  This value includes the __GFP_FS flag, so\nallocations in that address space can recurse into filesystem memory\nreclaim.  We don\u0026apos;t want that to happen because it can consume a\nsignificant amount of stack memory.\n\nWorse than that is that it can also deadlock: for example, in several\nplaces, gfs2_unstuff_dinode() is called inside filesystem transactions.\nThis calls filemap_grab_folio(), which can allocate a new folio, which\ncan trigger memory reclaim.  If memory reclaim recurses into the\nfilesystem and starts another transaction, a deadlock will ensue.\n\nTo fix these kinds of problems, prevent memory reclaim from recursing\ninto filesystem code by making sure that the gfp_mask of inode address\nspaces doesn\u0026apos;t include __GFP_FS.\n\nThe \u0026quot;meta\u0026quot; and resource group address spaces were already using GFP_NOFS\nas their gfp_mask (which doesn\u0026apos;t include __GFP_FS).  The default value\nof GFP_HIGHUSER_MOVABLE is less restrictive than GFP_NOFS, though.  To\navoid being overly limiting, use the default value and only knock off\nthe __GFP_FS flag.  I\u0026apos;m not sure if this will actually make a\ndifference, but it also shouldn\u0026apos;t hurt.\n\nThis patch is loosely based on commit ad22c7a043c2 (\u0026quot;xfs: prevent stack\noverflows from page cache allocation\u0026quot;).\n\nFixes xfstest generic/273.(CVE-2025-68356)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb()\n\nThe rtl8187_rx_cb() calculates the rx descriptor header address\nby subtracting its size from the skb tail pointer.\nHowever, it does not validate if the received packet\n(skb-\u0026gt;len from urb-\u0026gt;actual_length) is large enough to contain this\nheader.\n\nIf a truncated packet is received, this will lead to a buffer\nunderflow, reading memory before the start of the skb data area,\nand causing a kernel panic.\n\nAdd length checks for both rtl8187 and rtl8187b descriptor headers\nbefore attempting to access them, dropping the packet cleanly if the\ncheck fails.(CVE-2025-68362)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Check skb-\u0026gt;transport_header is set in bpf_skb_check_mtu\n\nThe bpf_skb_check_mtu helper needs to use skb-\u0026gt;transport_header when\nthe BPF_MTU_CHK_SEGS flag is used:\n\n\tbpf_skb_check_mtu(skb, ifindex, \u0026amp;mtu_len, 0, BPF_MTU_CHK_SEGS)\n\nThe transport_header is not always set. There is a WARN_ON_ONCE\nreport when CONFIG_DEBUG_NET is enabled + skb-\u0026gt;gso_size is set +\nbpf_prog_test_run is used:\n\nWARNING: CPU: 1 PID: 2216 at ./include/linux/skbuff.h:3071\n skb_gso_validate_network_len\n bpf_skb_check_mtu\n bpf_prog_3920e25740a41171_tc_chk_segs_flag # A test in the next patch\n bpf_test_run\n bpf_prog_test_run_skb\n\nFor a normal ingress skb (not test_run), skb_reset_transport_header\nis performed but there is plan to avoid setting it as described in\ncommit 2170a1f09148 (\u0026quot;net: no longer reset transport_header in __netif_receive_skb_core()\u0026quot;).\n\nThis patch fixes the bpf helper by checking\nskb_transport_header_was_set(). The check is done just before\nskb-\u0026gt;transport_header is used, to avoid breaking the existing bpf prog.\nThe WARN_ON_ONCE is limited to bpf_prog_test_run, so targeting bpf-next.(CVE-2025-68363)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncoresight: ETR: Fix ETR buffer use-after-free issue\n\nWhen ETR is enabled as CS_MODE_SYSFS, if the buffer size is changed\nand enabled again, currently sysfs_buf will point to the newly\nallocated memory(buf_new) and free the old memory(buf_old). But the\netr_buf that is being used by the ETR remains pointed to buf_old, not\nupdated to buf_new. In this case, it will result in a memory\nuse-after-free issue.\n\nFix this by checking ETR\u0026apos;s mode before updating and releasing buf_old,\nif the mode is CS_MODE_SYSFS, then skip updating and releasing it.(CVE-2025-68376)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix stackmap overflow check in __bpf_get_stackid()\n\nSyzkaller reported a KASAN slab-out-of-bounds write in __bpf_get_stackid()\nwhen copying stack trace data. The issue occurs when the perf trace\n contains more stack entries than the stack map bucket can hold,\n leading to an out-of-bounds write in the bucket\u0026apos;s data array.(CVE-2025-68378)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id\n\nUse check_add_overflow() to guard against potential integer overflows\nwhen adding the binary blob lengths and the size of an asymmetric_key_id\nstructure and return ERR_PTR(-EOVERFLOW) accordingly. This prevents a\npossible buffer overflow when copying data from potentially malicious\nX.509 certificate fields that can be arbitrarily large, such as ASN.1\nINTEGER serial numbers, issuer names, etc.(CVE-2025-68724)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Do not let BPF test infra emit invalid GSO types to stack\n\nYinhao et al. reported that their fuzzer tool was able to trigger a\nskb_warn_bad_offload() from netif_skb_features() -\u0026gt; gso_features_check().\nWhen a BPF program - triggered via BPF test infra - pushes the packet\nto the loopback device via bpf_clone_redirect() then mentioned offload\nwarning can be seen. GSO-related features are then rightfully disabled.\n\nWe get into this situation due to convert___skb_to_skb() setting\ngso_segs and gso_size but not gso_type. Technically, it makes sense\nthat this warning triggers since the GSO properties are malformed due\nto the gso_type. Potentially, the gso_type could be marked non-trustworthy\nthrough setting it at least to SKB_GSO_DODGY without any other specific\nassumptions, but that also feels wrong given we should not go further\ninto the GSO engine in the first place.\n\nThe checks were added in 121d57af308d (\u0026quot;gso: validate gso_type in GSO\nhandlers\u0026quot;) because there were malicious (syzbot) senders that combine\na protocol with a non-matching gso_type. If we would want to drop such\npackets, gso_features_check() currently only returns feature flags via\nnetif_skb_features(), so one location for potentially dropping such skbs\ncould be validate_xmit_unreadable_skb(), but then otoh it would be\nan additional check in the fast-path for a very corner case. Given\nbpf_clone_redirect() is the only place where BPF test infra could emit\nsuch packets, lets reject them right there.(CVE-2025-68725)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nisdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe()\n\nIn hfcsusb_probe(), the memory allocated for ctrl_urb gets leaked when\nsetup_instance() fails with an error code. Fix that by freeing the urb\nbefore freeing the hw structure. Also change the error paths to use the\ngoto ladder style.\n\nCompile tested only. Issue found using a prototype static analysis tool.(CVE-2025-68734)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix improper freeing of purex item\n\nIn qla2xxx_process_purls_iocb(), an item is allocated via\nqla27xx_copy_multiple_pkt(), which internally calls\nqla24xx_alloc_purex_item().\n\nThe qla24xx_alloc_purex_item() function may return a pre-allocated item\nfrom a per-adapter pool for small allocations, instead of dynamically\nallocating memory with kzalloc().\n\nAn error handling path in qla2xxx_process_purls_iocb() incorrectly uses\nkfree() to release the item. If the item was from the pre-allocated\npool, calling kfree() on it is a bug that can lead to memory corruption.\n\nFix this by using the correct deallocation function,\nqla24xx_free_purex_item(), which properly handles both dynamically\nallocated and pre-allocated items.(CVE-2025-68741)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Free special fields when update [lru_,]percpu_hash maps\n\nAs [lru_,]percpu_hash maps support BPF_KPTR_{REF,PERCPU}, missing\ncalls to \u0026apos;bpf_obj_free_fields()\u0026apos; in \u0026apos;pcpu_copy_value()\u0026apos; could cause the\nmemory referenced by BPF_KPTR_{REF,PERCPU} fields to be held until the\nmap gets freed.\n\nFix this by calling \u0026apos;bpf_obj_free_fields()\u0026apos; after\n\u0026apos;copy_map_value[,_long]()\u0026apos; in \u0026apos;pcpu_copy_value()\u0026apos;.(CVE-2025-68744)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Clear cmds after chip reset\n\nCommit aefed3e5548f (\u0026quot;scsi: qla2xxx: target: Fix offline port handling\nand host reset handling\u0026quot;) caused two problems:\n\n1. Commands sent to FW, after chip reset got stuck and never freed as FW\n   is not going to respond to them anymore.\n\n2. BUG_ON(cmd-\u0026gt;sg_mapped) in qlt_free_cmd().  Commit 26f9ce53817a\n   (\u0026quot;scsi: qla2xxx: Fix missed DMA unmap for aborted commands\u0026quot;)\n   attempted to fix this, but introduced another bug under different\n   circumstances when two different CPUs were racing to call\n   qlt_unmap_sg() at the same time: BUG_ON(!valid_dma_direction(dir)) in\n   dma_unmap_sg_attrs().\n\nSo revert \u0026quot;scsi: qla2xxx: Fix missed DMA unmap for aborted commands\u0026quot; and\npartially revert \u0026quot;scsi: qla2xxx: target: Fix offline port handling and\nhost reset handling\u0026quot; at __qla2x00_abort_all_cmds.(CVE-2025-68745)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nblock: Use RCU in blk_mq_[un]quiesce_tagset() instead of set-\u0026gt;tag_list_lock\n\nblk_mq_{add,del}_queue_tag_set() functions add and remove queues from\ntagset, the functions make sure that tagset and queues are marked as\nshared when two or more queues are attached to the same tagset.\nInitially a tagset starts as unshared and when the number of added\nqueues reaches two, blk_mq_add_queue_tag_set() marks it as shared along\nwith all the queues attached to it. When the number of attached queues\ndrops to 1 blk_mq_del_queue_tag_set() need to mark both the tagset and\nthe remaining queues as unshared.\n\nBoth functions need to freeze current queues in tagset before setting on\nunsetting BLK_MQ_F_TAG_QUEUE_SHARED flag. While doing so, both functions\nhold set-\u0026gt;tag_list_lock mutex, which makes sense as we do not want\nqueues to be added or deleted in the process. This used to work fine\nuntil commit 98d81f0df70c (\u0026quot;nvme: use blk_mq_[un]quiesce_tagset\u0026quot;)\nmade the nvme driver quiesce tagset instead of quiscing individual\nqueues. blk_mq_quiesce_tagset() does the job and quiesce the queues in\nset-\u0026gt;tag_list while holding set-\u0026gt;tag_list_lock also.\n\nThis results in deadlock between two threads with these stacktraces:\n\n  __schedule+0x47c/0xbb0\n  ? timerqueue_add+0x66/0xb0\n  schedule+0x1c/0xa0\n  schedule_preempt_disabled+0xa/0x10\n  __mutex_lock.constprop.0+0x271/0x600\n  blk_mq_quiesce_tagset+0x25/0xc0\n  nvme_dev_disable+0x9c/0x250\n  nvme_timeout+0x1fc/0x520\n  blk_mq_handle_expired+0x5c/0x90\n  bt_iter+0x7e/0x90\n  blk_mq_queue_tag_busy_iter+0x27e/0x550\n  ? __blk_mq_complete_request_remote+0x10/0x10\n  ? __blk_mq_complete_request_remote+0x10/0x10\n  ? __call_rcu_common.constprop.0+0x1c0/0x210\n  blk_mq_timeout_work+0x12d/0x170\n  process_one_work+0x12e/0x2d0\n  worker_thread+0x288/0x3a0\n  ? rescuer_thread+0x480/0x480\n  kthread+0xb8/0xe0\n  ? kthread_park+0x80/0x80\n  ret_from_fork+0x2d/0x50\n  ? kthread_park+0x80/0x80\n  ret_from_fork_asm+0x11/0x20\n\n  __schedule+0x47c/0xbb0\n  ? xas_find+0x161/0x1a0\n  schedule+0x1c/0xa0\n  blk_mq_freeze_queue_wait+0x3d/0x70\n  ? destroy_sched_domains_rcu+0x30/0x30\n  blk_mq_update_tag_set_shared+0x44/0x80\n  blk_mq_exit_queue+0x141/0x150\n  del_gendisk+0x25a/0x2d0\n  nvme_ns_remove+0xc9/0x170\n  nvme_remove_namespaces+0xc7/0x100\n  nvme_remove+0x62/0x150\n  pci_device_remove+0x23/0x60\n  device_release_driver_internal+0x159/0x200\n  unbind_store+0x99/0xa0\n  kernfs_fop_write_iter+0x112/0x1e0\n  vfs_write+0x2b1/0x3d0\n  ksys_write+0x4e/0xb0\n  do_syscall_64+0x5b/0x160\n  entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\nThe top stacktrace is showing nvme_timeout() called to handle nvme\ncommand timeout. timeout handler is trying to disable the controller and\nas a first step, it needs to blk_mq_quiesce_tagset() to tell blk-mq not\nto call queue callback handlers. The thread is stuck waiting for\nset-\u0026gt;tag_list_lock as it tries to walk the queues in set-\u0026gt;tag_list.\n\nThe lock is held by the second thread in the bottom stack which is\nwaiting for one of queues to be frozen. The queue usage counter will\ndrop to zero after nvme_timeout() finishes, and this will not happen\nbecause the thread will wait for this mutex forever.\n\nGiven that [un]quiescing queue is an operation that does not need to\nsleep, update blk_mq_[un]quiesce_tagset() to use RCU instead of taking\nset-\u0026gt;tag_list_lock, update blk_mq_{add,del}_queue_tag_set() to use RCU\nsafe list operations. Also, delete INIT_LIST_HEAD(\u0026amp;q-\u0026gt;tag_set_list)\nin blk_mq_del_queue_tag_set() because we can not re-initialize it while\nthe list is being traversed under RCU. The deleted queue will not be\nadded/deleted to/from a tagset and it will be freed in blk_free_queue()\nafter the end of RCU grace period.(CVE-2025-68756)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsched/deadline: only set free_cpus for online runqueues\n\nCommit 16b269436b72 (\u0026quot;sched/deadline: Modify cpudl::free_cpus\nto reflect rd-\u0026gt;online\u0026quot;) introduced the cpudl_set/clear_freecpu\nfunctions to allow the cpu_dl::free_cpus mask to be manipulated\nby the deadline scheduler class rq_on/offline callbacks so the\nmask would also reflect this state.\n\nCommit 9659e1eeee28 (\u0026quot;sched/deadline: Remove cpu_active_mask\nfrom cpudl_find()\u0026quot;) removed the check of the cpu_active_mask to\nsave some processing on the premise that the cpudl::free_cpus\nmask already reflected the runqueue online state.\n\nUnfortunately, there are cases where it is possible for the\ncpudl_clear function to set the free_cpus bit for a CPU when the\ndeadline runqueue is offline. When this occurs while a CPU is\nconnected to the default root domain the flag may retain the bad\nstate after the CPU has been unplugged. Later, a different CPU\nthat is transitioning through the default root domain may push a\ndeadline task to the powered down CPU when cpudl_find sees its\nfree_cpus bit is set. If this happens the task will not have the\nopportunity to run.\n\nOne example is outlined here:\nhttps://lore.kernel.org/lkml/(CVE-2025-68780)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: Reset t_task_cdb pointer in error case\n\nIf allocation of cmd-\u0026gt;t_task_cdb fails, it remains NULL but is later\ndereferenced in the \u0026apos;err\u0026apos; path.\n\nIn case of error, reset NULL t_task_cdb value to point at the default\nfixed-size buffer.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2025-68782)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niomap: adjust read range correctly for non-block-aligned positions\n\niomap_adjust_read_range() assumes that the position and length passed in\nare block-aligned. This is not always the case however, as shown in the\nsyzbot generated case for erofs. This causes too many bytes to be\nskipped for uptodate blocks, which results in returning the incorrect\nposition and length to read in. If all the blocks are uptodate, this\nunderflows length and returns a position beyond the folio.\n\nFix the calculation to also take into account the block offset when\ncalculating how many bytes can be skipped for uptodate blocks.(CVE-2025-68794)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: NFSv4 file creation neglects setting ACL\n\nAn NFSv4 client that sets an ACL with a named principal during file\ncreation retrieves the ACL afterwards, and finds that it is only a\ndefault ACL (based on the mode bits) and not the ACL that was\nrequested during file creation. This violates RFC 8881 section\n6.4.1.3: \u0026quot;the ACL attribute is set as given\u0026quot;.\n\nThe issue occurs in nfsd_create_setattr(), which calls\nnfsd_attrs_valid() to determine whether to call nfsd_setattr().\nHowever, nfsd_attrs_valid() checks only for iattr changes and\nsecurity labels, but not POSIX ACLs. When only an ACL is present,\nthe function returns false, nfsd_setattr() is skipped, and the\nPOSIX ACL is never applied to the inode.\n\nSubsequently, when the client retrieves the ACL, the server finds\nno POSIX ACL on the inode and returns one generated from the file\u0026apos;s\nmode bits rather than returning the originally-specified ACL.(CVE-2025-68803)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nio_uring: fix filename leak in __io_openat_prep()\n\n __io_openat_prep() allocates a struct filename using getname(). However,\nfor the condition of the file being installed in the fixed file table as\nwell as having O_CLOEXEC flag set, the function returns early. At that\npoint, the request doesn\u0026apos;t have REQ_F_NEED_CLEANUP flag set. Due to this,\nthe memory for the newly allocated struct filename is not cleaned up,\ncausing a memory leak.\n\nFix this by setting the REQ_F_NEED_CLEANUP for the request just after the\nsuccessful getname() call, so that when the request is torn down, the\nfilename will be cleaned up, along with other resources needing cleanup.(CVE-2025-68814)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: fw_tracer, Validate format string parameters\n\nAdd validation for format string parameters in the firmware tracer to\nprevent potential security vulnerabilities and crashes from malformed\nformat strings received from firmware.\n\nThe firmware tracer receives format strings from the device firmware and\nuses them to format trace messages. Without proper validation, bad\nfirmware could provide format strings with invalid format specifiers\n(e.g., %s, %p, %n) that could lead to crashes, or other undefined\nbehavior.\n\nAdd mlx5_tracer_validate_params() to validate that all format specifiers\nin trace strings are limited to safe integer/hex formats (%x, %d, %i,\n%u, %llx, %lx, etc.). Reject strings containing other format types that\ncould be used to access arbitrary memory or cause crashes.\nInvalid format strings are added to the trace output for visibility with\n\u0026quot;BAD_FORMAT: \u0026quot; prefix.(CVE-2025-68816)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: Revert \u0026quot;scsi: qla2xxx: Perform lockless command completion in abort path\u0026quot;\n\nThis reverts commit 0367076b0817d5c75dfb83001ce7ce5c64d803a9.\n\nThe commit being reverted added code to __qla2x00_abort_all_cmds() to\ncall sp-\u0026gt;done() without holding a spinlock.  But unlike the older code\nbelow it, this new code failed to check sp-\u0026gt;cmd_type and just assumed\nTYPE_SRB, which results in a jump to an invalid pointer in target-mode\nwith TYPE_TGT_CMD:\n\nqla2xxx [0000:65:00.0]-d034:8: qla24xx_do_nack_work create sess success\n  0000000009f7a79b\nqla2xxx [0000:65:00.0]-5003:8: ISP System Error - mbx1=1ff5h mbx2=10h\n  mbx3=0h mbx4=0h mbx5=191h mbx6=0h mbx7=0h.\nqla2xxx [0000:65:00.0]-d01e:8: -\u0026gt; fwdump no buffer\nqla2xxx [0000:65:00.0]-f03a:8: qla_target(0): System error async event\n  0x8002 occurred\nqla2xxx [0000:65:00.0]-00af:8: Performing ISP error recovery -\n  ha=0000000058183fda.\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nPF: supervisor instruction fetch in kernel mode\nPF: error_code(0x0010) - not-present page\nPGD 0 P4D 0\nOops: 0010 [#1] SMP\nCPU: 2 PID: 9446 Comm: qla2xxx_8_dpc Tainted: G           O       6.1.133 #1\nHardware name: Supermicro Super Server/X11SPL-F, BIOS 4.2 12/15/2023\nRIP: 0010:0x0\nCode: Unable to access opcode bytes at 0xffffffffffffffd6.\nRSP: 0018:ffffc90001f93dc8 EFLAGS: 00010206\nRAX: 0000000000000282 RBX: 0000000000000355 RCX: ffff88810d16a000\nRDX: ffff88810dbadaa8 RSI: 0000000000080000 RDI: ffff888169dc38c0\nRBP: ffff888169dc38c0 R08: 0000000000000001 R09: 0000000000000045\nR10: ffffffffa034bdf0 R11: 0000000000000000 R12: ffff88810800bb40\nR13: 0000000000001aa8 R14: ffff888100136610 R15: ffff8881070f7400\nFS:  0000000000000000(0000) GS:ffff88bf80080000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffffffffffffffd6 CR3: 000000010c8ff006 CR4: 00000000003706e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u0026lt;TASK\u0026gt;\n ? __die+0x4d/0x8b\n ? page_fault_oops+0x91/0x180\n ? trace_buffer_unlock_commit_regs+0x38/0x1a0\n ? exc_page_fault+0x391/0x5e0\n ? asm_exc_page_fault+0x22/0x30\n __qla2x00_abort_all_cmds+0xcb/0x3e0 [qla2xxx_scst]\n qla2x00_abort_all_cmds+0x50/0x70 [qla2xxx_scst]\n qla2x00_abort_isp_cleanup+0x3b7/0x4b0 [qla2xxx_scst]\n qla2x00_abort_isp+0xfd/0x860 [qla2xxx_scst]\n qla2x00_do_dpc+0x581/0xa40 [qla2xxx_scst]\n kthread+0xa8/0xd0\n \u0026lt;/TASK\u0026gt;\n\nThen commit 4475afa2646d (\u0026quot;scsi: qla2xxx: Complete command early within\nlock\u0026quot;) added the spinlock back, because not having the lock caused a\nrace and a crash.  But qla2x00_abort_srb() in the switch below already\nchecks for qla2x00_chip_is_down() and handles it the same way, so the\ncode above the switch is now redundant and still buggy in target-mode.\nRemove it.(CVE-2025-68818)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nshmem: fix recovery on rename failures\n\nmaple_tree insertions can fail if we are seriously short on memory;\nsimple_offset_rename() does not recover well if it runs into that.\nThe same goes for simple_offset_rename_exchange().\n\nMoreover, shmem_whiteout() expects that if it succeeds, the caller will\nprogress to d_move(), i.e. that shmem_rename2() won\u0026apos;t fail past the\nsuccessful call of shmem_whiteout().\n\nNot hard to fix, fortunately - mtree_store() can\u0026apos;t fail if the index we\nare trying to store into is already present in the tree as a singleton.\n\nFor simple_offset_rename_exchange() that\u0026apos;s enough - we just need to be\ncareful about the order of operations.\n\nFor simple_offset_rename() solution is to preinsert the target into the\ntree for new_dir; the rest can be done without any potentially failing\noperations.\n\nThat preinsertion has to be done in shmem_rename2() rather than in\nsimple_offset_rename() itself - otherwise we\u0026apos;d need to deal with the\npossibility of failure after successful shmem_whiteout().(CVE-2025-71072)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer\n\nWhen advancing the target expiration for the guest\u0026apos;s APIC timer in periodic\nmode, set the expiration to \u0026quot;now\u0026quot; if the target expiration is in the past\n(similar to what is done in update_target_expiration()).  Blindly adding\nthe period to the previous target expiration can result in KVM generating\na practically unbounded number of hrtimer IRQs due to programming an\nexpired timer over and over.  In extreme scenarios, e.g. if userspace\npauses/suspends a VM for an extended duration, this can even cause hard\nlockups in the host.\n\nCurrently, the bug only affects Intel CPUs when using the hypervisor timer\n(HV timer), a.k.a. the VMX preemption timer.  Unlike the software timer,\na.k.a. hrtimer, which KVM keeps running even on exits to userspace, the\nHV timer only runs while the guest is active.  As a result, if the vCPU\ndoes not run for an extended duration, there will be a huge gap between\nthe target expiration and the current time the vCPU resumes running.\nBecause the target expiration is incremented by only one period on each\ntimer expiration, this leads to a series of timer expirations occurring\nrapidly after the vCPU/VM resumes.\n\nMore critically, when the vCPU first triggers a periodic HV timer\nexpiration after resuming, advancing the expiration by only one period\nwill result in a target expiration in the past.  As a result, the delta\nmay be calculated as a negative value.  When the delta is converted into\nan absolute value (tscdeadline is an unsigned u64), the resulting value\ncan overflow what the HV timer is capable of programming.  I.e. the large\nvalue will exceed the VMX Preemption Timer\u0026apos;s maximum bit width of\ncpu_preemption_timer_multi + 32, and thus cause KVM to switch from the\nHV timer to the software timer (hrtimers).\n\nAfter switching to the software timer, periodic timer expiration callbacks\nmay be executed consecutively within a single clock interrupt handler,\nbecause hrtimers honors KVM\u0026apos;s request for an expiration in the past and\nimmediately re-invokes KVM\u0026apos;s callback after reprogramming.  And because\nthe interrupt handler runs with IRQs disabled, restarting KVM\u0026apos;s hrtimer\nover and over until the target expiration is advanced to \u0026quot;now\u0026quot; can result\nin a hard lockup.\n\nE.g. the following hard lockup was triggered in the host when running a\nWindows VM (only relevant because it used the APIC timer in periodic mode)\nafter resuming the VM from a long suspend (in the host).\n\n  NMI watchdog: Watchdog detected hard LOCKUP on cpu 45\n  ...\n  RIP: 0010:advance_periodic_target_expiration+0x4d/0x80 [kvm]\n  ...\n  RSP: 0018:ff4f88f5d98d8ef0 EFLAGS: 00000046\n  RAX: fff0103f91be678e RBX: fff0103f91be678e RCX: 00843a7d9e127bcc\n  RDX: 0000000000000002 RSI: 0052ca4003697505 RDI: ff440d5bfbdbd500\n  RBP: ff440d5956f99200 R08: ff2ff2a42deb6a84 R09: 000000000002a6c0\n  R10: 0122d794016332b3 R11: 0000000000000000 R12: ff440db1af39cfc0\n  R13: ff440db1af39cfc0 R14: ffffffffc0d4a560 R15: ff440db1af39d0f8\n  FS:  00007f04a6ffd700(0000) GS:ff440db1af380000(0000) knlGS:000000e38a3b8000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 000000d5651feff8 CR3: 000000684e038002 CR4: 0000000000773ee0\n  PKRU: 55555554\n  Call Trace:\n   \u0026lt;IRQ\u0026gt;\n   apic_timer_fn+0x31/0x50 [kvm]\n   __hrtimer_run_queues+0x100/0x280\n   hrtimer_interrupt+0x100/0x210\n   ? ttwu_do_wakeup+0x19/0x160\n   smp_apic_timer_interrupt+0x6a/0x130\n   apic_timer_interrupt+0xf/0x20\n   \u0026lt;/IRQ\u0026gt;\n\nMoreover, if the suspend duration of the virtual machine is not long enough\nto trigger a hard lockup in this scenario, since commit 98c25ead5eda\n(\u0026quot;KVM: VMX: Move preemption timer \u0026lt;=\u0026gt; hrtimer dance to common x86\u0026quot;), KVM\nwill continue using the software timer until the guest reprograms the APIC\ntimer in some way.  Since the periodic timer does not require frequent APIC\ntimer register programming, the guest may continue to use the software\ntimer in \n---truncated---(CVE-2025-71104)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: make decode_pool() more resilient against corrupted osdmaps\n\nIf the osdmap is (maliciously) corrupted such that the encoded length\nof ceph_pg_pool envelope is less than what is expected for a particular\nencoding version, out-of-bounds reads may ensue because the only bounds\ncheck that is there is based on that length value.\n\nThis patch adds explicit bounds checks for each field that is decoded\nor skipped.(CVE-2025-71116)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: seqiv - Do not use req-\u0026gt;iv after crypto_aead_encrypt\n\nAs soon as crypto_aead_encrypt is called, the underlying request\nmay be freed by an asynchronous completion.  Thus dereferencing\nreq-\u0026gt;iv after it returns is invalid.\n\nInstead of checking req-\u0026gt;iv against info, create a new variable\nunaligned_info and use it for that purpose instead.(CVE-2025-71131)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKEYS: trusted: Fix a memory leak in tpm2_load_cmd\n\n\u0026apos;tpm2_load_cmd\u0026apos; allocates a tempoary blob indirectly via \u0026apos;tpm2_key_decode\u0026apos;\nbut it is not freed in the failure paths. Address this by wrapping the blob\ninto with a cleanup helper.(CVE-2025-71147)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/poll: correctly handle io_poll_add() return value on update\n\nWhen the core of io_uring was updated to handle completions\nconsistently and with fixed return codes, the POLL_REMOVE opcode\nwith updates got slightly broken. If a POLL_ADD is pending and\nthen POLL_REMOVE is used to update the events of that request, if that\nupdate causes the POLL_ADD to now trigger, then that completion is lost\nand a CQE is never posted.\n\nAdditionally, ensure that if an update does cause an existing POLL_ADD\nto complete, that the completion value isn\u0026apos;t always overwritten with\n-ECANCELED. For that case, whatever io_poll_add() set the value to\nshould just be retained.(CVE-2025-71149)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: Fix refcount leak when invalid session is found on session lookup\n\nWhen a session is found but its state is not SMB2_SESSION_VALID, It\nindicates that no valid session was found, but it is missing to decrement\nthe reference count acquired by the session lookup, which results in\na reference count leak. This patch fixes the issue by explicitly calling\nksmbd_user_session_put to release the reference to the session.(CVE-2025-71150)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Don\u0026apos;t store mlx5e_priv in mlx5e_dev devlink priv\n\nmlx5e_priv is an unstable structure that can be memset(0) if profile\nattaching fails, mlx5e_priv in mlx5e_dev devlink private is used to\nreference the netdev and mdev associated with that struct. Instead,\nstore netdev directly into mlx5e_dev and get mdev from the containing\nmlx5_adev aux device structure.\n\nThis fixes a kernel oops in mlx5e_remove when switchdev mode fails due\nto change profile failure.\n\n$ devlink dev eswitch set pci/0000:00:03.0 mode switchdev\nError: mlx5_core: Failed setting eswitch to offloads.\ndmesg:\nworkqueue: Failed to create a rescuer kthread for wq \u0026quot;mlx5e\u0026quot;: -EINTR\nmlx5_core 0012:03:00.1: mlx5e_netdev_init_profile:6214:(pid 37199): mlx5e_priv_init failed, err=-12\nmlx5_core 0012:03:00.1 gpu3rdma1: mlx5e_netdev_change_profile: new profile init failed, -12\nworkqueue: Failed to create a rescuer kthread for wq \u0026quot;mlx5e\u0026quot;: -EINTR\nmlx5_core 0012:03:00.1: mlx5e_netdev_init_profile:6214:(pid 37199): mlx5e_priv_init failed, err=-12\nmlx5_core 0012:03:00.1 gpu3rdma1: mlx5e_netdev_change_profile: failed to rollback to orig profile, -12\n\n$ devlink dev reload pci/0000:00:03.0 ==\u0026gt; oops\n\nBUG: kernel NULL pointer dereference, address: 0000000000000520\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\nPGD 0 P4D 0\nOops: Oops: 0000 [#1] SMP NOPTI\nCPU: 3 UID: 0 PID: 521 Comm: devlink Not tainted 6.18.0-rc5+ #117 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014\nRIP: 0010:mlx5e_remove+0x68/0x130\nRSP: 0018:ffffc900034838f0 EFLAGS: 00010246\nRAX: ffff88810283c380 RBX: ffff888101874400 RCX: ffffffff826ffc45\nRDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000\nRBP: ffff888102d789c0 R08: ffff8881007137f0 R09: ffff888100264e10\nR10: ffffc90003483898 R11: ffffc900034838a0 R12: ffff888100d261a0\nR13: ffff888100d261a0 R14: ffff8881018749a0 R15: ffff888101874400\nFS:  00007f8565fea740(0000) GS:ffff88856a759000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000520 CR3: 000000010b11a004 CR4: 0000000000370ef0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n device_release_driver_internal+0x19c/0x200\n bus_remove_device+0xc6/0x130\n device_del+0x160/0x3d0\n ? devl_param_driverinit_value_get+0x2d/0x90\n mlx5_detach_device+0x89/0xe0\n mlx5_unload_one_devl_locked+0x3a/0x70\n mlx5_devlink_reload_down+0xc8/0x220\n devlink_reload+0x7d/0x260\n devlink_nl_reload_doit+0x45b/0x5a0\n genl_family_rcv_msg_doit+0xe8/0x140(CVE-2026-22996)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec\n\nCommit efa56305908b (\u0026quot;nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length\u0026quot;)\nadded ttag bounds checking and data_offset\nvalidation in nvmet_tcp_handle_h2c_data_pdu(), but it did not validate\nwhether the command\u0026apos;s data structures (cmd-\u0026gt;req.sg and cmd-\u0026gt;iov) have\nbeen properly initialized before processing H2C_DATA PDUs.\n\nThe nvmet_tcp_build_pdu_iovec() function dereferences these pointers\nwithout NULL checks. This can be triggered by sending H2C_DATA PDU\nimmediately after the ICREQ/ICRESP handshake, before\nsending a CONNECT command or NVMe write command.\n\nAttack vectors that trigger NULL pointer dereferences:\n1. H2C_DATA PDU sent before CONNECT → both pointers NULL\n2. H2C_DATA PDU for READ command → cmd-\u0026gt;req.sg allocated, cmd-\u0026gt;iov NULL\n3. H2C_DATA PDU for uninitialized command slot → both pointers NULL\n\nThe fix validates both cmd-\u0026gt;req.sg and cmd-\u0026gt;iov before calling\nnvmet_tcp_build_pdu_iovec(). Both checks are required because:\n- Uninitialized commands: both NULL\n- READ commands: cmd-\u0026gt;req.sg allocated, cmd-\u0026gt;iov NULL\n- WRITE commands: both allocated(CVE-2026-22998)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix crash on profile change rollback failure\n\nmlx5e_netdev_change_profile can fail to attach a new profile and can\nfail to rollback to old profile, in such case, we could end up with a\ndangling netdev with a fully reset netdev_priv. A retry to change\nprofile, e.g. another attempt to call mlx5e_netdev_change_profile via\nswitchdev mode change, will crash trying to access the now NULL\npriv-\u0026gt;mdev.\n\nThis fix allows mlx5e_netdev_change_profile() to handle previous\nfailures and an empty priv, by not assuming priv is valid.\n\nPass netdev and mdev to all flows requiring\nmlx5e_netdev_change_profile() and avoid passing priv.\nIn mlx5e_netdev_change_profile() check if current priv is valid, and if\nnot, just attach the new profile without trying to access the old one.\n\nThis fixes the following oops, when enabling switchdev mode for the 2nd\ntime after first time failure:\n\n ## Enabling switchdev mode first time:\n\nmlx5_core 0012:03:00.1: E-Switch: Supported tc chains and prios offload\nworkqueue: Failed to create a rescuer kthread for wq \u0026quot;mlx5e\u0026quot;: -EINTR\nmlx5_core 0012:03:00.1: mlx5e_netdev_init_profile:6214:(pid 37199): mlx5e_priv_init failed, err=-12\nmlx5_core 0012:03:00.1 gpu3rdma1: mlx5e_netdev_change_profile: new profile init failed, -12\nworkqueue: Failed to create a rescuer kthread for wq \u0026quot;mlx5e\u0026quot;: -EINTR\nmlx5_core 0012:03:00.1: mlx5e_netdev_init_profile:6214:(pid 37199): mlx5e_priv_init failed, err=-12\nmlx5_core 0012:03:00.1 gpu3rdma1: mlx5e_netdev_change_profile: failed to rollback to orig profile, -12\n                                                                         ^^^^^^^^\nmlx5_core 0000:00:03.0: E-Switch: Disable: mode(LEGACY), nvfs(0), necvfs(0), active vports(0)\n\n ## retry: Enabling switchdev mode 2nd time:\n\nmlx5_core 0000:00:03.0: E-Switch: Supported tc chains and prios offload\nBUG: kernel NULL pointer dereference, address: 0000000000000038\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\nPGD 0 P4D 0\nOops: Oops: 0000 [#1] SMP NOPTI\nCPU: 13 UID: 0 PID: 520 Comm: devlink Not tainted 6.18.0-rc4+ #91 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014\nRIP: 0010:mlx5e_detach_netdev+0x3c/0x90\nCode: 50 00 00 f0 80 4f 78 02 48 8b bf e8 07 00 00 48 85 ff 74 16 48 8b 73 78 48 d1 ee 83 e6 01 83 f6 01 40 0f b6 f6 e8 c4 42 00 00 \u0026lt;48\u0026gt; 8b 45 38 48 85 c0 74 08 48 89 df e8 cc 47 40 1e 48 8b bb f0 07\nRSP: 0018:ffffc90000673890 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: ffff8881036a89c0 RCX: 0000000000000000\nRDX: ffff888113f63800 RSI: ffffffff822fe720 RDI: 0000000000000000\nRBP: 0000000000000000 R08: 0000000000002dcd R09: 0000000000000000\nR10: ffffc900006738e8 R11: 00000000ffffffff R12: 0000000000000000\nR13: 0000000000000000 R14: ffff8881036a89c0 R15: 0000000000000000\nFS:  00007fdfb8384740(0000) GS:ffff88856a9d6000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000038 CR3: 0000000112ae0005 CR4: 0000000000370ef0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n mlx5e_netdev_change_profile+0x45/0xb0\n mlx5e_vport_rep_load+0x27b/0x2d0\n mlx5_esw_offloads_rep_load+0x72/0xf0\n esw_offloads_enable+0x5d0/0x970\n mlx5_eswitch_enable_locked+0x349/0x430\n ? is_mp_supported+0x57/0xb0\n mlx5_devlink_eswitch_mode_set+0x26b/0x430\n devlink_nl_eswitch_set_doit+0x6f/0xf0\n genl_family_rcv_msg_doit+0xe8/0x140\n genl_rcv_msg+0x18b/0x290\n ? __pfx_devlink_nl_pre_doit+0x10/0x10\n ? __pfx_devlink_nl_eswitch_set_doit+0x10/0x10\n ? __pfx_devlink_nl_post_doit+0x10/0x10\n ? __pfx_genl_rcv_msg+0x10/0x10\n netlink_rcv_skb+0x52/0x100\n genl_rcv+0x28/0x40\n netlink_unicast+0x282/0x3e0\n ? __alloc_skb+0xd6/0x190\n netlink_sendmsg+0x1f7/0x430\n __sys_sendto+0x213/0x220\n ? __sys_recvmsg+0x6a/0xd0\n __x64_sys_sendto+0x24/0x30\n do_syscall_64+0x50/0x1f0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\nRIP: 0033:0x7fdfb8495047(CVE-2026-23000)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nx86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1\n\nWhen loading guest XSAVE state via KVM_SET_XSAVE, and when updating XFD in\nresponse to a guest WRMSR, clear XFD-disabled features in the saved (or to\nbe restored) XSTATE_BV to ensure KVM doesn\u0026apos;t attempt to load state for\nfeatures that are disabled via the guest\u0026apos;s XFD.  Because the kernel\nexecutes XRSTOR with the guest\u0026apos;s XFD, saving XSTATE_BV[i]=1 with XFD[i]=1\nwill cause XRSTOR to #NM and panic the kernel.\n\nE.g. if fpu_update_guest_xfd() sets XFD without clearing XSTATE_BV:\n\n  ------------[ cut here ]------------\n  WARNING: arch/x86/kernel/traps.c:1524 at exc_device_not_available+0x101/0x110, CPU#29: amx_test/848\n  Modules linked in: kvm_intel kvm irqbypass\n  CPU: 29 UID: 1000 PID: 848 Comm: amx_test Not tainted 6.19.0-rc2-ffa07f7fd437-x86_amx_nm_xfd_non_init-vm #171 NONE\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n  RIP: 0010:exc_device_not_available+0x101/0x110\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   asm_exc_device_not_available+0x1a/0x20\n  RIP: 0010:restore_fpregs_from_fpstate+0x36/0x90\n   switch_fpu_return+0x4a/0xb0\n   kvm_arch_vcpu_ioctl_run+0x1245/0x1e40 [kvm]\n   kvm_vcpu_ioctl+0x2c3/0x8f0 [kvm]\n   __x64_sys_ioctl+0x8f/0xd0\n   do_syscall_64+0x62/0x940\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n   \u0026lt;/TASK\u0026gt;\n  ---[ end trace 0000000000000000 ]---\n\nThis can happen if the guest executes WRMSR(MSR_IA32_XFD) to set XFD[18] = 1,\nand a host IRQ triggers kernel_fpu_begin() prior to the vmexit handler\u0026apos;s\ncall to fpu_update_guest_xfd().\n\nand if userspace stuffs XSTATE_BV[i]=1 via KVM_SET_XSAVE:\n\n  ------------[ cut here ]------------\n  WARNING: arch/x86/kernel/traps.c:1524 at exc_device_not_available+0x101/0x110, CPU#14: amx_test/867\n  Modules linked in: kvm_intel kvm irqbypass\n  CPU: 14 UID: 1000 PID: 867 Comm: amx_test Not tainted 6.19.0-rc2-2dace9faccd6-x86_amx_nm_xfd_non_init-vm #168 NONE\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n  RIP: 0010:exc_device_not_available+0x101/0x110\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   asm_exc_device_not_available+0x1a/0x20\n  RIP: 0010:restore_fpregs_from_fpstate+0x36/0x90\n   fpu_swap_kvm_fpstate+0x6b/0x120\n   kvm_load_guest_fpu+0x30/0x80 [kvm]\n   kvm_arch_vcpu_ioctl_run+0x85/0x1e40 [kvm]\n   kvm_vcpu_ioctl+0x2c3/0x8f0 [kvm]\n   __x64_sys_ioctl+0x8f/0xd0\n   do_syscall_64+0x62/0x940\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n   \u0026lt;/TASK\u0026gt;\n  ---[ end trace 0000000000000000 ]---\n\nThe new behavior is consistent with the AMX architecture.  Per Intel\u0026apos;s SDM,\nXSAVE saves XSTATE_BV as \u0026apos;0\u0026apos; for components that are disabled via XFD\n(and non-compacted XSAVE saves the initial configuration of the state\ncomponent):\n\n  If XSAVE, XSAVEC, XSAVEOPT, or XSAVES is saving the state component i,\n  the instruction does not generate #NM when XCR0[i] = IA32_XFD[i] = 1;\n  instead, it operates as if XINUSE[i] = 0 (and the state component was\n  in its initial state): it saves bit i of XSTATE_BV field of the XSAVE\n  header as 0; in addition, XSAVE saves the initial configuration of the\n  state component (the other instructions do not save state component i).\n\nAlternatively, KVM could always do XRSTOR with XFD=0, e.g. by using\na constant XFD based on the set of enabled features when XSAVEing for\na struct fpu_guest.  However, having XSTATE_BV[i]=1 for XFD-disabled\nfeatures can only happen in the above interrupt case, or in similar\nscenarios involving preemption on preemptible kernels, because\nfpu_swap_kvm_fpstate()\u0026apos;s call to save_fpregs_to_fpstate() saves the\noutgoing FPU state with the current XFD; and that is (on all but the\nfirst WRMSR to XFD) the guest XFD.\n\nTherefore, XFD can only go out of sync with XSTATE_BV in the above\ninterrupt case, or in similar scenarios involving preemption on\npreemptible kernels, and it we can consider it (de facto) part of KVM\nABI that KVM_GET_XSAVE returns XSTATE_BV[i]=0 for XFD-disabled features.\n\n[Move clea\n---truncated---(CVE-2026-23005)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv\n\nmlx5e_priv is an unstable structure that can be memset(0) if profile\nattaching fails.\n\nPass netdev to mlx5e_destroy_netdev() to guarantee it will work on a\nvalid netdev.\n\nOn mlx5e_remove: Check validity of priv-\u0026gt;profile, before attempting\nto cleanup any resources that might be not there.\n\nThis fixes a kernel oops in mlx5e_remove when switchdev mode fails due\nto change profile failure.\n\n$ devlink dev eswitch set pci/0000:00:03.0 mode switchdev\nError: mlx5_core: Failed setting eswitch to offloads.\ndmesg:\nworkqueue: Failed to create a rescuer kthread for wq \u0026quot;mlx5e\u0026quot;: -EINTR\nmlx5_core 0012:03:00.1: mlx5e_netdev_init_profile:6214:(pid 37199): mlx5e_priv_init failed, err=-12\nmlx5_core 0012:03:00.1 gpu3rdma1: mlx5e_netdev_change_profile: new profile init failed, -12\nworkqueue: Failed to create a rescuer kthread for wq \u0026quot;mlx5e\u0026quot;: -EINTR\nmlx5_core 0012:03:00.1: mlx5e_netdev_init_profile:6214:(pid 37199): mlx5e_priv_init failed, err=-12\nmlx5_core 0012:03:00.1 gpu3rdma1: mlx5e_netdev_change_profile: failed to rollback to orig profile, -12\n\n$ devlink dev reload pci/0000:00:03.0 ==\u0026gt; oops\n\nBUG: kernel NULL pointer dereference, address: 0000000000000370\nPGD 0 P4D 0\nOops: Oops: 0000 [#1] SMP NOPTI\nCPU: 15 UID: 0 PID: 520 Comm: devlink Not tainted 6.18.0-rc5+ #115 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014\nRIP: 0010:mlx5e_dcbnl_dscp_app+0x23/0x100\nRSP: 0018:ffffc9000083f8b8 EFLAGS: 00010286\nRAX: ffff8881126fc380 RBX: ffff8881015ac400 RCX: ffffffff826ffc45\nRDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8881035109c0\nRBP: ffff8881035109c0 R08: ffff888101e3e838 R09: ffff888100264e10\nR10: ffffc9000083f898 R11: ffffc9000083f8a0 R12: ffff888101b921a0\nR13: ffff888101b921a0 R14: ffff8881015ac9a0 R15: ffff8881015ac400\nFS:  00007f789a3c8740(0000) GS:ffff88856aa59000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000370 CR3: 000000010b6c0001 CR4: 0000000000370ef0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n mlx5e_remove+0x57/0x110\n device_release_driver_internal+0x19c/0x200\n bus_remove_device+0xc6/0x130\n device_del+0x160/0x3d0\n ? devl_param_driverinit_value_get+0x2d/0x90\n mlx5_detach_device+0x89/0xe0\n mlx5_unload_one_devl_locked+0x3a/0x70\n mlx5_devlink_reload_down+0xc8/0x220\n devlink_reload+0x7d/0x260\n devlink_nl_reload_doit+0x45b/0x5a0\n genl_family_rcv_msg_doit+0xe8/0x140(CVE-2026-23035)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Add recursion protection in kernel stack trace recording\n\nA bug was reported about an infinite recursion caused by tracing the rcu\nevents with the kernel stack trace trigger enabled. The stack trace code\ncalled back into RCU which then called the stack trace again.\n\nExpand the ftrace recursion protection to add a set of bits to protect\nevents from recursion. Each bit represents the context that the event is\nin (normal, softirq, interrupt and NMI).\n\nHave the stack trace code use the interrupt context to protect against\nrecursion.\n\nNote, the bug showed an issue in both the RCU code as well as the tracing\nstacktrace code. This only handles the tracing stack trace side of the\nbug. The RCU fix will be handled separately.(CVE-2026-23138)","status":"published","published":"2026-03-27T11:10:47Z","modified":"2026-08-18T01:19:45.881631165Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2025-68265","title":"CVE-2025-68265 in linux - Patched by Root","description":"Root has patched CVE-2025-68265 in the linux package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-10-18T03:18:11Z","modified":"2026-10-18T04:17:26.549304843Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:31.514195Z"},{"id":"ROOT-OS-UBUNTU-2204-CVE-2025-68265","title":"CVE-2025-68265 in linux - Patched by Root","description":"Root has patched CVE-2025-68265 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.","status":"published","published":"2026-11-06T13:52:25Z","modified":"2026-11-06T14:17:04.722968195Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-06T14:57:22.237547Z"},{"id":"ROOT-OS-UBUNTU-2404-CVE-2025-68265","title":"CVE-2025-68265 in linux - Patched by Root","description":"Root has patched CVE-2025-68265 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.","status":"published","published":"2026-11-06T15:54:27Z","modified":"2026-11-06T16:18:04.101183152Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-06T16:59:13.24938Z"},{"id":"UBUNTU-CVE-2025-68265","description":"In the Linux kernel, the following vulnerability has been resolved: nvme: fix admin request_queue lifetime The namespaces can access the controller's admin request_queue, and stale references on the namespaces may exist after tearing down the controller. Ensure the admin request_queue is active by moving the controller's 'put' to after all controller references have been released to ensure no one is can access the request_queue. This fixes a reported use-after-free bug:   BUG: KASAN: slab-use-after-free in blk_queue_enter+0x41c/0x4a0   Read of size 8 at addr ffff88c0a53819f8 by task nvme/3287   CPU: 67 UID: 0 PID: 3287 Comm: nvme Tainted: G            E 6.13.2-ga1582f1a031e #15   Tainted: [E]=UNSIGNED_MODULE   Hardware name: Jabil /EGS 2S MB1, BIOS 1.00 06/18/2025   Call Trace:    \u003cTASK\u003e    dump_stack_lvl+0x4f/0x60    print_report+0xc4/0x620    ? _raw_spin_lock_irqsave+0x70/0xb0    ? _raw_read_unlock_irqrestore+0x30/0x30    ? blk_queue_enter+0x41c/0x4a0    kasan_report+0xab/0xe0    ? blk_queue_enter+0x41c/0x4a0    blk_queue_enter+0x41c/0x4a0    ? __irq_work_queue_local+0x75/0x1d0    ? blk_queue_start_drain+0x70/0x70    ? irq_work_queue+0x18/0x20    ? vprintk_emit.part.0+0x1cc/0x350    ? wake_up_klogd_work_func+0x60/0x60    blk_mq_alloc_request+0x2b7/0x6b0    ? __blk_mq_alloc_requests+0x1060/0x1060    ? __switch_to+0x5b7/0x1060    nvme_submit_user_cmd+0xa9/0x330    nvme_user_cmd.isra.0+0x240/0x3f0    ? force_sigsegv+0xe0/0xe0    ? nvme_user_cmd64+0x400/0x400    ? vfs_fileattr_set+0x9b0/0x9b0    ? cgroup_update_frozen_flag+0x24/0x1c0    ? cgroup_leave_frozen+0x204/0x330    ? nvme_ioctl+0x7c/0x2c0    blkdev_ioctl+0x1a8/0x4d0    ? blkdev_common_ioctl+0x1930/0x1930    ? fdget+0x54/0x380    __x64_sys_ioctl+0x129/0x190    do_syscall_64+0x5b/0x160    entry_SYSCALL_64_after_hwframe+0x4b/0x53   RIP: 0033:0x7f765f703b0b   Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 8b 0d dd 52 0f 00 f7 d8 64 89 01 48   RSP: 002b:00007ffe2cefe808 EFLAGS: 00000202 ORIG_RAX: 0000000000000010   RAX: ffffffffffffffda RBX: 00007ffe2cefe860 RCX: 00007f765f703b0b   RDX: 00007ffe2cefe860 RSI: 00000000c0484e41 RDI: 0000000000000003   RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000000   R10: 00007f765f611d50 R11: 0000000000000202 R12: 0000000000000003   R13: 00000000c0484e41 R14: 0000000000000001 R15: 00007ffe2cefea60    \u003c/TASK\u003e","status":"published","published":"2025-12-16T15:15:00Z","modified":"2026-10-08T12:53:35.310510429Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:52.345622Z"},{"id":"AZL-72490","title":"CVE-2025-68265 affecting package kernel for versions less than 6.6.121.1-1","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: fix admin request_queue lifetime\n\nThe namespaces can access the controller's admin request_queue, and\nstale references on the namespaces may exist after tearing down the\ncontroller. Ensure the admin request_queue is active by moving the\ncontroller's 'put' to after all controller references have been released\nto ensure no one is can access the request_queue. This fixes a reported\nuse-after-free bug:\n\n  BUG: KASAN: slab-use-after-free in blk_queue_enter+0x41c/0x4a0\n  Read of size 8 at addr ffff88c0a53819f8 by task nvme/3287\n  CPU: 67 UID: 0 PID: 3287 Comm: nvme Tainted: G            E       6.13.2-ga1582f1a031e #15\n  Tainted: [E]=UNSIGNED_MODULE\n  Hardware name: Jabil /EGS 2S MB1, BIOS 1.00 06/18/2025\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x4f/0x60\n   print_report+0xc4/0x620\n   ? _raw_spin_lock_irqsave+0x70/0xb0\n   ? _raw_read_unlock_irqrestore+0x30/0x30\n   ? blk_queue_enter+0x41c/0x4a0\n   kasan_report+0xab/0xe0\n   ? blk_queue_enter+0x41c/0x4a0\n   blk_queue_enter+0x41c/0x4a0\n   ? __irq_work_queue_local+0x75/0x1d0\n   ? blk_queue_start_drain+0x70/0x70\n   ? irq_work_queue+0x18/0x20\n   ? vprintk_emit.part.0+0x1cc/0x350\n   ? wake_up_klogd_work_func+0x60/0x60\n   blk_mq_alloc_request+0x2b7/0x6b0\n   ? __blk_mq_alloc_requests+0x1060/0x1060\n   ? __switch_to+0x5b7/0x1060\n   nvme_submit_user_cmd+0xa9/0x330\n   nvme_user_cmd.isra.0+0x240/0x3f0\n   ? force_sigsegv+0xe0/0xe0\n   ? nvme_user_cmd64+0x400/0x400\n   ? vfs_fileattr_set+0x9b0/0x9b0\n   ? cgroup_update_frozen_flag+0x24/0x1c0\n   ? cgroup_leave_frozen+0x204/0x330\n   ? nvme_ioctl+0x7c/0x2c0\n   blkdev_ioctl+0x1a8/0x4d0\n   ? blkdev_common_ioctl+0x1930/0x1930\n   ? fdget+0x54/0x380\n   __x64_sys_ioctl+0x129/0x190\n   do_syscall_64+0x5b/0x160\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n  RIP: 0033:0x7f765f703b0b\n  Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 8b 0d dd 52 0f 00 f7 d8 64 89 01 48\n  RSP: 002b:00007ffe2cefe808 EFLAGS: 00000202 ORIG_RAX: 0000000000000010\n  RAX: ffffffffffffffda RBX: 00007ffe2cefe860 RCX: 00007f765f703b0b\n  RDX: 00007ffe2cefe860 RSI: 00000000c0484e41 RDI: 0000000000000003\n  RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000000\n  R10: 00007f765f611d50 R11: 0000000000000202 R12: 0000000000000003\n  R13: 00000000c0484e41 R14: 0000000000000001 R15: 00007ffe2cefea60\n   \u003c/TASK\u003e","status":"published","published":"2025-12-16T15:15:56Z","modified":"2026-04-21T04:50:04.589521Z","updated_at":"2026-11-02T15:28:09.201912Z"},{"id":"CLSA-2026-1787305050","title":"kernel: Fix of 87 CVEs","description":"- sctp: don't free the ASCONF's own transport in DEL-IP processing {CVE-2026-64564}\n- net/sched: serialize qdisc_rtab_list against concurrent get/put {CVE-2026-68138}\n- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() {CVE-2025-40187}\n- sctp: auth: verify auth requirement when auth_chunk is NULL {CVE-2026-68300}\n- ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() {CVE-2026-53221}\n- cifs: some missing initializations on replay {CVE-2026-31693}\n- drop_monitor: perform u64_stats updates under IRQ-disabled section {CVE-2026-68286}\n- net/tcp-md5: Fix MAC comparison to be constant-time {CVE-2026-43383}\n- ima: Handle error code returned by ima_filter_rule_match() {CVE-2025-68740}\n- accel/ivpu: Add bounds check for firmware runtime memory {CVE-2026-53206}\n- ata: libata-core: Disable LPM on ST1000DM010-2EP102 {CVE-2026-43487}\n- ip6_vti: prevent moving the fallback device across netns {CVE-2026-52909}\n- NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags {CVE-2025-68764}\n- bonding: fix devconf_all NULL dereference when IPv6 is disabled {CVE-2026-68336}\n- mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose() {CVE-2025-68291}\n- octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() {CVE-2025-39978}\n- net: hv_netvsc: reject RSS hash key programming without RX indirection table {CVE-2026-23054}\n- spi: fix use-after-free on controller registration failure {CVE-2026-31389}\n- nvme: fix admin request_queue lifetime {CVE-2025-68265}\n- RDMA/bnxt_re: Add sanity checks on rdev validity {CVE-2025-21901}\n- smb: client: require a full NFS mode SID before reading mode bits {CVE-2026-43350}\n- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow {CVE-2025-39834}\n- sctp: Fix MAC comparison to be constant-time {CVE-2025-40204}\n- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path {CVE-2025-39830}\n- nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit() {CVE-2026-23297}\n- thermal/of: Fix reference leak in thermal_of_cm_lookup() {CVE-2026-45925}\n- usbnet: Prevents free active kevent {CVE-2025-68312}\n- smb: client: fix oops due to uninitialised var in smb2_unlink() {CVE-2026-23282}\n- fs/buffer: add alert in try_to_free_buffers() for folios without buffers {CVE-2025-71295}\n- cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update {CVE-2025-23137}\n- Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync {CVE-2026-53251}\n- wifi: iwlwifi: mvm: don't send a 6E related command when not supported {CVE-2026-43325}\n- io_uring/napi: cap busy_poll_to 10 msec {CVE-2026-53321}\n- io_uring/net: fix io_req_post_cqe abuse by send bundle {CVE-2025-23154}\n- xfs: fix a resource leak in xfs_alloc_buftarg() {CVE-2026-46005}\n- firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() {CVE-2026-68444}\n- i2c: core: fix adapter deregistration race {CVE-2026-64279}\n- wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv() {CVE-2026-68439}\n- firmware: arm_ffa: Check for NULL FF-A ID table while driver registration {CVE-2026-64166}\n- wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() {CVE-2026-68309}\n- pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}\n- fuse: re-lock request before returning from fuse_ref_folio() {CVE-2026-64266}\n- sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}\n- crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed {CVE-2026-31698}\n- ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408}\n- accel/ivpu: Add bounds checks for firmware log indices {CVE-2026-53205}\n- PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails {CVE-2026-45880}\n- nvme-multipath: fix lockdep WARN due to partition scan work {CVE-2025-68218}\n- dm: fix unlocked test for dm_suspended_md {CVE-2026-46327}\n- net: slip: serialize receive against buffer reallocation {CVE-2026-68143}\n- iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() {CVE-2026-68324}\n- net/iucv: take a reference on the socket found in afiucv_hs_rcv() {CVE-2026-68397}\n- i40e: Fix preempt count leak in napi poll tracepoint {CVE-2026-23313}\n- USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}\n- libceph: remove debugfs files before client teardown {CVE-2026-68153}\n- cxl/port: Fix use after free of parent_port in cxl_detach_ep() {CVE-2026-31530}\n- octeontx2-af: CGX: add bounds check to cgx_speed_mbps index {CVE-2026-64225}\n- netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels {CVE-2026-23274}\n- net: netpoll: fix incorrect refcount handling causing incorrect cleanup {CVE-2025-68245}\n- Squashfs: reject negative file sizes in squashfs_read_inode() {CVE-2025-40200}\n- igc: don't fail igc_probe() on LED setup error {CVE-2025-39956}\n- neigh: let neigh_xmit take skb ownership {CVE-2026-52981}\n- libceph: bound get_version reply decode to front len {CVE-2026-68433}\n- drm/amd/display: Validate GPIO pin LUT table size before iterating {CVE-2026-64097}\n- media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex {CVE-2026-31473}\n- smb: client: split cached_fid bitfields to avoid shared-byte RMW races {CVE-2026-23230}\n- i40e: fix validation of VF state in get resources {CVE-2025-39969}\n- libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}\n- NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298}\n- smb: client: fix krb5 mount with username option {CVE-2026-31392}\n- xfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment {CVE-2026-68426}\n- bpf: Reject sleepable kprobe_multi programs at attach time {CVE-2026-43010}\n- mptcp: pm: ADD_ADDR rtx: fix potential data-race {CVE-2026-46137}\n- wifi: ath12k: fix memory leak in ath12k_pci_remove() {CVE-2025-37744}\n- block: add pgmap check to biovec_phys_mergeable {CVE-2026-46115}\n- io_uring/kbuf: reallocate buf lists on upgrade {CVE-2025-21836}\n- ASoC: amd: acp: Fix incorrect retrival of acp_chip_info {CVE-2025-39959}\n- wifi: cfg80211: bound element ID read when checking non-inheritance {CVE-2026-68402}\n- ALSA: hda/conexant: Fix missing error check for jack detection {CVE-2026-53291}\n- l2tp: prevent possible tunnel refcount underflow {CVE-2024-49940}\n- mm/thp: fix deferred split unqueue naming and locking {CVE-2024-53079}\n- drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() {CVE-2026-68250}\n- drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() {CVE-2026-68251}\n- drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() {CVE-2026-68110}\n- drm/amdgpu/gfx8: drop unecessary BUG_ON() {CVE-2026-68430}\n- Buffer overflow in drivers/xen/sys-hypervisor.c {CVE-2026-31786}\n- Input: elan_i2c - validate firmware size before use {CVE-2026-64237}","status":"published","published":"2026-08-21T09:38:51Z","modified":"2026-10-26T09:43:58.253376474Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"openSUSE-SU-2026:20826-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).\n- CVE-2024-14027: xattr: switch to CLASS(fd) (bsc#1259420).\n- CVE-2025-40181: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (bsc#1253471).\n- CVE-2025-68265: nvme: fix admin request_queue lifetime (bsc#1255360).\n- CVE-2025-68310: s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (bsc#1255160).\n- CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).\n- CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).\n- CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).\n- CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).\n- CVE-2026-23276: net: add xmit recursion limit to tunnel xmit functions (bsc#1260012).\n- CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).\n- CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).\n- CVE-2026-23316: net: ipv4: fix ARM64 alignment fault in multipath hash seed (bsc#1260573).\n- CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).\n- CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).\n- CVE-2026-23346: arm64: io: Rename ioremap_prot() to __ioremap_prot() (bsc#1260529).\n- CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).\n- CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).\n- CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).\n- CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).\n- CVE-2026-23375: mm: thp: deny THP for files on anonymous inodes (bsc#1260576).\n- CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).\n- CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).\n- CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).\n- CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).\n- CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).\n- CVE-2026-23417: bpf: Fix constant blinding for PROBE_MEM32 stores (bsc#1261410).\n- CVE-2026-23436: net: add helpers for lookup and walking netdevs under netdev_lock() (bsc#1261617).\n- CVE-2026-23437: net: shaper: protect late read accesses to the hierarchy (bsc#1261635).\n- CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).\n- CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).\n- CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).\n- CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).\n- CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).\n- CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).\n- CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).\n- CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).\n- CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).\n- CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).\n- CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).\n- CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).\n- CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on wakeup race (bsc#1261694).\n- CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).\n- CVE-2026-31395: bnxt_en: fix OOB access in DBG_BUF_PRODUCER async event handler (bsc#1261786).\n- CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).\n- CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).\n- CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).\n- CVE-2026-31406: xfrm: Fix work re-schedule after cancel in xfrm_nat_keepalive_net_fini() (bsc#1261629).\n- CVE-2026-31407: netfilter: conntrack: add missing netlink policy validations (bsc#1261632).\n- CVE-2026-31411: net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (bsc#1261752).\n- CVE-2026-31415: ipv6: avoid overflows in ip6_datagram_send_ctl() (bsc#1262099).\n- CVE-2026-31416: netfilter: nfnetlink_log: account for netlink header size (bsc#1262100).\n- CVE-2026-31420: bridge: mrp: reject zero test interval to avoid OOM panic (bsc#1262055).\n- CVE-2026-31421: net/sched: cls_fw: fix NULL pointer dereference on shared blocks (bsc#1262061).\n- CVE-2026-31422: net/sched: cls_flow: fix NULL pointer dereference on shared blocks (bsc#1262054).\n- CVE-2026-31423: net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() (bsc#1262063).\n- CVE-2026-31424: netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (bsc#1262053).\n- CVE-2026-31425: rds: ib: reject FRMR registration before IB connection is established (bsc#1262074).\n- CVE-2026-31427: netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp (bsc#1262086).\n- CVE-2026-31428: netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (bsc#1262087).\n- CVE-2026-31435: netfs: Fix read abandonment during retry (bsc#1262601).\n- CVE-2026-31449: ext4: validate p_idx bounds in ext4_ext_correct_indexes (bsc#1262616).\n- CVE-2026-31453: xfs: avoid dereferencing log items after push callbacks (bsc#1262617).\n- CVE-2026-31456: mm/pagewalk: fix race between concurrent split and refault (bsc#1262627).\n- CVE-2026-31494: net: cadence: macb: Synchronize stats calculations (bsc#1262671).\n- CVE-2026-31496: netfilter: nf_conntrack_expect: skip expectations in other netns via proc (bsc#1262673).\n- CVE-2026-31503: udp: Fix wildcard bind conflict check when using hash2 (bsc#1263077).\n- CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263085).\n- CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263093).\n- CVE-2026-31507: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer (bsc#1263095).\n- CVE-2026-31515: af_key: validate families in pfkey_send_migrate() (bsc#1262752).\n- CVE-2026-31519: btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create (bsc#1263012).\n- CVE-2026-31525: bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN (bsc#1262725).\n- CVE-2026-31526: bpf: Fix exception exit lock checking for subprogs (bsc#1262662).\n- CVE-2026-31528: perf: Make sure to use pmu_ctx-\u003epmu for groups (bsc#1263001).\n- CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262758).\n- CVE-2026-31547: drm/xe: Fix missing runtime PM reference in ccs_mode_store (bsc#1263018).\n- CVE-2026-31550: pmdomain: bcm: bcm2835-power: Increase ASB control timeout (bsc#1263104).\n- CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263107).\n- CVE-2026-31565: RDMA/irdma: Fix deadlock during netdev reset with active connections (bsc#1263064).\n- CVE-2026-31579: wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit (bsc#1263074).\n- CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263176).\n- CVE-2026-31588: KVM: x86: Use scratch field in MMIO fragment to hold small write values (bsc#1263165).\n- CVE-2026-31644: net: lan966x: fix use-after-free and leak in lan966x_fdma_reload() (bsc#1263048).\n- CVE-2026-31649: net: stmmac: fix integer underflow in chain mode (bsc#1263582).\n- CVE-2026-31658: net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() (bsc#1263052).\n- CVE-2026-31662: tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (bsc#1263131).\n- CVE-2026-31666: btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref() (bsc#1263138).\n- CVE-2026-31668: seg6: separate dst_cache for input and output paths in seg6 lwtunnel (bsc#1263140).\n- CVE-2026-31669: mptcp: fix slab-use-after-free in __inet_lookup_established (bsc#1263141).\n- CVE-2026-31675: net/sched: sch_netem: fix out-of-bounds access in packet corruption (bsc#1263556).\n- CVE-2026-31678: openvswitch: defer tunnel netdev_put to RCU release (bsc#1263562).\n- CVE-2026-31679: openvswitch: validate MPLS set/set_masked payload length (bsc#1263592).\n- CVE-2026-31681: netfilter: xt_multiport: validate range encoding in checkentry (bsc#1263593).\n- CVE-2026-31682: bridge: br_nd_send: linearize skb before parsing ND options (bsc#1263595).\n- CVE-2026-31684: net: sched: act_csum: validate nested VLAN headers (bsc#1263596).\n- CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263668).\n- CVE-2026-31691: igb: remove napi_synchronize() in igb_down() (bsc#1263604).\n- CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263901).\n- CVE-2026-31700: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (bsc#1263882).\n- CVE-2026-31738: vxlan: validate ND option lengths in vxlan_na_create (bsc#1264059).\n- CVE-2026-31787: xen/privcmd: fix double free via VMA splitting (bsc#1262181).\n- CVE-2026-43009: bpf: Fix incorrect pruning due to atomic fetch precision tracking (bsc#1264014).\n- CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1263931).\n- CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1263933).\n- CVE-2026-43037: ip6_tunnel: clear skb2-\u003ecb in ip4ip6_err() (bsc#1263995).\n- CVE-2026-43038: ipv6: icmp: clear skb2-\u003ecb in ip6_err_gen_icmpv6_unreach() (bsc#1264097).\n- CVE-2026-43045: mshv: Refactor and rename memory region handling functions (bsc#1263942).\n- CVE-2026-43050: atm: lec: fix use-after-free in sock_def_readable() (bsc#1264082).\n- CVE-2026-43060: netfilter: nft_ct: drop pending enqueued packets on removal (bsc#1264183).\n- CVE-2026-43082: net: txgbe: leave space for null terminators on property_entry (bsc#1264233).\n- CVE-2026-43088: net: af_key: zero aligned sockaddr tail in PF_KEY exports (bsc#1264469).\n- CVE-2026-43153: xfs: remove xfs_attr_leaf_hasname (bsc#1264586).\n- CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264848).\n- CVE-2026-43265: KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block() (bsc#1264427).\n- CVE-2026-43329: netfilter: flowtable: strictly check for maximum number of actions (bsc#1265085).\n- CVE-2026-43365: xfs: fix undersized l_iclog_roundoff values (bsc#1265119).\n- CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265116).\n- CVE-2026-43441: net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1264674).\n- CVE-2026-43494: net/rds: reset op_nents when zerocopy page pin fails (bsc#1265626).\n- CVE-2026-43503: net: skbuff: propagate shared-frag marker through frag-transfer helpers (bsc#1265960).\n\nThe following non security issues were fixed:\n\n- accel/qaic: Add overflow check to remap_pfn_range during mmap (git-fixes).\n- ACPI: AGDI: fix missing newline in error message (git-fixes).\n- ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug (git-fixes).\n- ACPI: scan: Use acpi_dev_put() in object add error paths (git-fixes).\n- ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO (git-fixes).\n- ACPI: video: force native backlight on HP OMEN 16 (8A44) (stable-fixes).\n- ACPI: video: Move Lenovo Legion S7 15ACH6 quirk to the right section (git-fixes).\n- ALSA: 6fire: Fix input volume change detection (git-fixes).\n- ALSA: 6fire: fix use-after-free on disconnect (git-fixes).\n- ALSA: aoa: i2sbus: clear stale prepared state (git-fixes).\n- ALSA: aoa: i2sbus: fix OF node lifetime handling (git-fixes).\n- ALSA: aoa: Skip devices with no codecs in i2sbus_resume() (git-fixes).\n- ALSA: aoa: Use guard() for mutex locks (stable-fixes).\n- ALSA: asihpi: avoid write overflow check warning (stable-fixes).\n- ALSA: caiaq: Don't abort when no input device is available (git-fixes).\n- ALSA: caiaq: Fix control_put() result and cache rollback (git-fixes).\n- ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path (git-fixes).\n- ALSA: caiaq: fix usb_dev refcount leak on probe failure (git-fixes).\n- ALSA: caiaq: Handle probe errors properly (git-fixes).\n- ALSA: caiaq: take a reference on the USB device in create_card() (git-fixes).\n- ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() (git-fixes).\n- ALSA: core: Fix potential data race at fasync handling (git-fixes).\n- ALSA: core: Serialize deferred fasync state checks (git-fixes).\n- ALSA: core: Validate compress device numbers without dynamic minors (git-fixes).\n- ALSA: ctxfi: Add fallback to default RSR for S/PDIF (git-fixes).\n- ALSA: ctxfi: Fix missing SPDIFI1 index handling (stable-fixes).\n- ALSA: ctxfi: Limit PTP to a single page (git-fixes).\n- ALSA: firewire-tascam: Do not drop unread control events (git-fixes).\n- ALSA: fireworks: bound device-supplied status before string array lookup (git-fixes).\n- ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 (stable-fixes).\n- ALSA: hda/realtek - fixed speaker no sound update (git-fixes).\n- ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk (stable-fixes).\n- ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx (stable-fixes).\n- ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC (stable-fixes).\n- ALSA: hda/realtek: add quirk for Framework F111:000F (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 (stable-fixes).\n- ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') (git-fixes).\n- ALSA: hda: cs35l41: Put ACPI device on missing physical node (git-fixes).\n- ALSA: hda: cs35l56: Propagate ASP TX source control errors (git-fixes).\n- ALSA: hda: cs35l56: Put ACPI device after setting companion (git-fixes).\n- ALSA: hda: Fix NULL pointer dereference in snd_hda_ctl_add() (git-fixes).\n- ALSA: misc: Use guard() for spin locks (stable-fixes).\n- ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger (stable-fixes).\n- ALSA: pcmtest: fix reference leak on failed device registration (git-fixes).\n- ALSA: pcmtest: Fix resource leaks in module init error paths (git-fixes).\n- ALSA: pcmtest: Return -EFAULT on pattern read copy failure (git-fixes).\n- ALSA: sc6000: Keep the programmed board state in card-private data (git-fixes).\n- ALSA: scarlett2: Add missing error check when initialise Autogain Status (git-fixes).\n- ALSA: scarlett2: Add missing sentinel initializer field (git-fixes).\n- ALSA: seq: Notify client and port info changes (stable-fixes).\n- ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes (stable-fixes).\n- ALSA: usb-audio: apply quirk for MOONDROP JU Jiu (stable-fixes).\n- ALSA: usb-audio: Avoid false E-MU sample-rate notifications (git-fixes).\n- ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() (git-fixes).\n- ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans (git-fixes).\n- ALSA: usb-audio: Bound MIDI endpoint descriptor scans (git-fixes).\n- ALSA: usb-audio: Evaluate packsize caps at the right place (git-fixes).\n- ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch (git-fixes).\n- ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams (git-fixes).\n- ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex (stable-fixes).\n- ALSA: usb-audio: Fix UAC3 cluster descriptor size check (git-fixes).\n- ALSA: usb-audio: midi2: Restart output URBs on resume (git-fixes).\n- ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES (git-fixes).\n- ALSA: virtio: drop an extaneous kernel-doc comment (git-fixes).\n- amdgpu/jpeg: fix deepsleep register for jpeg 5_0_0 and 5_0_2 (stable-fixes).\n- ASoC: amd: acp: Add DMI quirk for Valve Steam Deck OLED (git-fixes).\n- ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF (stable-fixes).\n- ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table (stable-fixes).\n- ASoC: codecs: ab8500: Fix casting of private data (git-fixes).\n- ASoC: cs35l56: Destroy workqueue in probe error path (git-fixes).\n- ASoC: cs35l56: Don't use devres to unregister component (git-fixes).\n- ASoC: cs35l56: Fix hibernate write in runtime resume error path (git-fixes).\n- ASoC: fsl_easrc: Change the type for iec958 channel status controls (git-fixes).\n- ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() (git-fixes).\n- ASoC: fsl_easrc: fix comment typo (git-fixes).\n- ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() (git-fixes).\n- ASoC: fsl_micfil: Add access property for \"VAD Detected\" (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in micfil_quality_set() (git-fixes).\n- ASoC: fsl_xcvr: Fix event generation for cached controls (git-fixes).\n- ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() (git-fixes).\n- ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() (git-fixes).\n- ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error (git-fixes).\n- ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop (git-fixes).\n- ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens (git-fixes).\n- ASoC: qcom: q6apm: move component registration to unmanaged version (git-fixes).\n- ASoC: qcom: q6apm: remove child devices when apm is removed (git-fixes).\n- ASoC: qcom: qdsp6: topology: check widget type before accessing data (git-fixes).\n- ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list (stable-fixes).\n- ASoC: SOF: compress: return the configured codec from get_params (git-fixes).\n- ASoC: SOF: Don't allow pointer operations on unconfigured streams (git-fixes).\n- ASoC: SOF: Intel: hda: Place check before dereference (git-fixes).\n- ASoC: SOF: topology: reject invalid vendor array size in token parser (stable-fixes).\n- ASoC: sti: Return errors from regmap_field_alloc() (git-fixes).\n- ASoC: sti: use managed regmap_field allocations (git-fixes).\n- ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J (stable-fixes).\n- ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 (stable-fixes).\n- backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() (git-fixes).\n- batman-adv: bla: only purge non-released claims (git-fixes).\n- batman-adv: bla: prevent use-after-free when deleting claims (git-fixes).\n- batman-adv: bla: put backbone reference on failed claim hash insert (git-fixes).\n- batman-adv: fix integer overflow on buff_pos (git-fixes).\n- batman-adv: hold claim backbone gateways by reference (git-fixes).\n- batman-adv: reject new tp_meter sessions during teardown (git-fixes).\n- batman-adv: reject oversized global TT response buffers (git-fixes).\n- batman-adv: stop caching unowned originator pointers in BAT IV (git-fixes).\n- bitfield: Add FIELD_MODIFY() helper (jsc#PED-14238).\n- Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling (git-fixes).\n- Bluetooth: btmtk: validate WMT event SKB length before struct access (git-fixes).\n- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (bsc#1260996).\n- Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (git-fixes).\n- Bluetooth: hci_event: fix memset typo (git-fixes).\n- Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt (git-fixes).\n- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (git-fixes).\n- Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (git-fixes).\n- Bluetooth: HIDP: serialise l2cap_unregister_user via hidp_session_sem (git-fixes).\n- Bluetooth: ISO: Fix data-race on dst in iso_sock_connect() (git-fixes).\n- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (git-fixes).\n- Bluetooth: l2cap: fix MPS check in l2cap_ecred_reconf_req (git-fixes).\n- Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (git-fixes).\n- Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() (git-fixes).\n- Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU (git-fixes).\n- Bluetooth: RFCOMM: pull credit byte with skb_pull_data() (git-fixes).\n- Bluetooth: SCO: check for codecs-\u003enum_codecs == 1 before assigning to sco_pi(sk)-\u003ecodec (git-fixes).\n- Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready (git-fixes).\n- Bluetooth: SCO: hold sk properly in sco_conn_ready (git-fixes).\n- Bluetooth: virtio_bt: clamp rx length before skb_put (git-fixes).\n- Bluetooth: virtio_bt: validate rx pkt_type header length (git-fixes).\n- bpf: Add third round of bounds deduction (git-fixes).\n- bpf: Fix u32/s32 bounds when ranges cross min/max boundary (git-fixes).\n- bpf: Improve bounds when s64 crosses sign boundary (git-fixes).\n- bpf: Switch CONFIG_CFI_CLANG to CONFIG_CFI (git-fixes).\n- btrfs: qgroup: update all parent qgroups when doing quick inherit (bsc#1258933).\n- btrfs: reject root items with drop_progress and zero drop_level (git-fixes).\n- btrfs: replace BUG() with error handling in __btrfs_balance() (git-fixes).\n- bus: mhi: host: pci_generic: Switch to async power up to avoid boot delays (git-fixes).\n- bus: rifsc: fix RIF configuration check for peripherals (git-fixes).\n- can: mcp251x: add error handling for power enable in open and resume (stable-fixes).\n- can: raw: fix ro-\u003euniq use-after-free in raw_rcv() (git-fixes).\n- can: ucan: fix devres lifetime (git-fixes).\n- cdc-acm: new quirk for EPSON HMD (stable-fixes).\n- check-for-config-changes: Exclude CC_MS_EXTENSIONS.\n- check-for-config-changes: Exclude HAVE_CFI_ICALL_NORMALIZE_INTEGERS{,_RUSTC}.\n- comedi: dt2815: add hardware detection to prevent crash (stable-fixes).\n- cpufreq: intel_pstate: Drop Arrow Lake from \"scaling factor\" list (bsc#1249104).\n- crypto: af_alg - limit RX SG extraction by receive buffer budget (git-fixes).\n- crypto: algif_aead - Fix minimum RX size check for decryption (git-fixes).\n- crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup (git-fixes).\n- crypto: atmel-ecc - Release client on allocation failure (git-fixes).\n- crypto: atmel-sha204a - Fix error codes in OTP reads (git-fixes).\n- crypto: atmel-sha204a - Fix OTP sysfs read and error handling (git-fixes).\n- crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path (git-fixes).\n- crypto: atmel-sha204a - Fix uninitialized data access on OTP read error (git-fixes).\n- crypto: atmel-tdes - fix DMA sync direction (git-fixes).\n- crypto: ccp - copy IV using skcipher ivsize (git-fixes).\n- crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (git-fixes).\n- crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (git-fixes).\n- crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (git-fixes).\n- crypto: ccree - fix a memory leak in cc_mac_digest() (git-fixes).\n- crypto: drivers - Switch back to struct platform_driver::remove() (jsc#PED-14238).\n- crypto: drivers - Use str_enable_disable-like helpers (jsc#PED-14238).\n- crypto: hisilicon - Fix dma_unmap_single() direction (git-fixes).\n- crypto: iaa - Adjust workqueue allocation type (jsc#PED-14238).\n- crypto: iaa - fix per-node CPU counter reset in rebalance_wq_table() (git-fixes).\n- crypto: iaa - Move compression CRC into request object (jsc#PED-14238).\n- crypto: iaa - Optimize rebalance_wq_table() (jsc#PED-14238).\n- crypto: iaa - Remove potential infinite loop in check_completion() (jsc#PED-14238).\n- crypto: iaa - Remove unreachable pr_debug from iaa_crypto_cleanup_module (jsc#PED-14238).\n- crypto: iaa - Remove unused disable_async argument from iaa_decompress (jsc#PED-14238).\n- crypto: iaa - Replace sprintf with sysfs_emit in sysfs show functions (jsc#PED-14238).\n- crypto: iaa - Simplify init_iaa_device() (jsc#PED-14238).\n- crypto: jitterentropy - replace long-held spinlock with mutex (git-fixes).\n- crypto: nx - Fix packed layout in struct nx842_crypto_header (git-fixes).\n- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (git-fixes).\n- crypto: qat - #undef field_get() before local definition (jsc#PED-14238).\n- crypto: qat - add adf_rl_get_num_svc_aes() in rate limiting (jsc#PED-14238).\n- crypto: qat - add bank state save and restore for qat_420xx (jsc#PED-14238).\n- crypto: qat - add command queue telemetry counters for GEN6 (jsc#PED-14238).\n- crypto: qat - add compression slice count for rate limiting (jsc#PED-14238).\n- crypto: qat - add decompression service for rate limiting (jsc#PED-14238).\n- crypto: qat - add decompression service to telemetry (jsc#PED-14238).\n- crypto: qat - add firmware headers for GEN6 devices (jsc#PED-14238).\n- crypto: qat - add GEN6 firmware loader (jsc#PED-14238).\n- crypto: qat - add get_svc_slice_cnt() in device data structure (jsc#PED-14238).\n- crypto: qat - add live migration enablers for GEN6 devices (jsc#PED-14238).\n- crypto: qat - add macro to write 64-bit values to registers (jsc#PED-14238).\n- crypto: qat - add missing header inclusion (jsc#PED-14238).\n- crypto: qat - add qat_6xxx driver (jsc#PED-14238).\n- crypto: qat - add ring buffer idle telemetry counter for GEN6 (jsc#PED-14238).\n- crypto: qat - add support for decompression service to GEN6 devices (jsc#PED-14238).\n- crypto: qat - consolidate service enums (jsc#PED-14238).\n- crypto: qat - Constify struct pm_status_row (jsc#PED-14238).\n- crypto: qat - disable 4xxx AE cluster when lead engine is fused off (git-fixes).\n- crypto: qat - disable 420xx AE cluster when lead engine is fused off (git-fixes).\n- crypto: qat - do not export adf_cfg_services (jsc#PED-14238).\n- crypto: qat - enable power management debugfs for GEN6 devices (jsc#PED-14238).\n- crypto: qat - enable RAS support for GEN6 devices (jsc#PED-14238).\n- crypto: qat - enable rate limiting feature for GEN6 devices (jsc#PED-14238).\n- crypto: qat - enable reporting of error counters for GEN6 devices (jsc#PED-14238).\n- crypto: qat - enable telemetry for GEN6 devices (jsc#PED-14238).\n- crypto: qat - export adf_get_service_mask() (jsc#PED-14238).\n- crypto: qat - export adf_init_admin_pm() (jsc#PED-14238).\n- crypto: qat - expose configuration functions (jsc#PED-14238).\n- crypto: qat - fix compression instance leak (git-fixes).\n- crypto: qat - fix IRQ cleanup on 6xxx probe failure (git-fixes).\n- crypto: qat - fix object goals in Makefiles (jsc#PED-14238.\n- crypto: qat - fix type mismatch in RAS sysfs show functions (git-fixes).\n- crypto: qat - Fix typo \"accelaration\" (jsc#PED-14238).\n- crypto: qat - fix virtual channel configuration for GEN6 devices (jsc#PED-14238).\n- crypto: qat - include qat_common in top Makefile (jsc#PED-14238).\n- crypto: qat - introduce fuse array (jsc#PED-14238).\n- crypto: qat - make adf_dev_autoreset() static (jsc#PED-14238).\n- crypto: qat - optimize allocations for fw authentication (jsc#PED-14238).\n- crypto: qat - refactor compression template logic (jsc#PED-14238).\n- crypto: qat - refactor FW signing algorithm (jsc#PED-14238).\n- crypto: qat - refactor ring-related debug functions (jsc#PED-14238).\n- crypto: qat - refactor service parsing logic (jsc#PED-14238).\n- crypto: qat - relocate and rename bank state structure definition (jsc#PED-14238).\n- crypto: qat - relocate bank state helper functions (jsc#PED-14238).\n- crypto: qat - relocate power management debugfs helper APIs (jsc#PED-14238).\n- crypto: qat - relocate service related functions (jsc#PED-14238).\n- crypto: qat - remove BITS_IN_DWORD() (jsc#PED-14238).\n- crypto: qat - Remove dst_null support (jsc#PED-14238).\n- crypto: qat - remove duplicate masking for GEN6 devices (jsc#PED-14238).\n- crypto: qat - remove initialization in device class (jsc#PED-14238).\n- crypto: qat - remove redundant FW image size check (jsc#PED-14238).\n- crypto: qat - remove unused adf_devmgr_get_first (jsc#PED-14238).\n- crypto: qat - remove unused members in suof structure (jsc#PED-14238).\n- crypto: qat - rename and relocate timer logic (jsc#PED-14238).\n- crypto: qat - reorder objects in qat_common Makefile (jsc#PED-14238).\n- crypto: qat - replace CHECK_STAT macro with static inline function (jsc#PED-14238).\n- crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() (jsc#PED-14238).\n- crypto: qat - restore ASYM service support for GEN6 devices (jsc#PED-14238).\n- crypto: qat - Return pointer directly in adf_ctl_alloc_resources (jsc#PED-14238).\n- crypto: qat - set command ids as reserved (jsc#PED-14238).\n- crypto: qat - switch to standard pattern for PCI IDs (jsc#PED-14238).\n- crypto: qat - update firmware api (jsc#PED-14238).\n- crypto: qat - use pr_fmt() in adf_gen4_hw_data.c (jsc#PED-14238).\n- crypto: qat - use pr_fmt() in qat uclo.c (jsc#PED-14238).\n- crypto: qat - use simple_strtoull to improve qat_uclo_parse_num (jsc#PED-14238).\n- crypto: qat - use swab32 macro (git-fixes).\n- crypto: qat - validate service in rate limiting sysfs api (jsc#PED-14238).\n- crypto: qat/qat_6xxx - Fix NULL vs IS_ERR() check in adf_probe() (jsc#PED-14238).\n- crypto: sa2ul - Fix AEAD fallback algorithm names (git-fixes).\n- crypto: simd - reject compat registrations without __ prefixes (git-fixes).\n- crypto: talitos - fix SEC1 32k ahash request limitation (git-fixes).\n- crypto: tegra - Disable softirqs before finalizing request (git-fixes).\n- devres: fix missing node debug info in devm_krealloc() (git-fixes).\n- dmaengine: dw-axi-dmac: fix Alignment should match open parenthesis (git-fixes).\n- dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function (git-fixes).\n- dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() (git-fixes).\n- dpll: zl3073x: Add support to adjust phase (bsc#1255752).\n- dpll: zl3073x: Fix output pin phase adjustment sign (bsc#1255752).\n- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (bsc#1255752).\n- dpll: zl3073x: Specify phase adjustment granularity for pins (bsc#1255752).\n- drivers/base/memory: fix memory block reference leak in poison accounting (git-fixes).\n- drm/amd/display: Add NULL check for integrated_info in clk_mgr_construct (git-fixes).\n- drm/amd/display: Allow DCE link encoder without AUX registers (git-fixes).\n- drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths (git-fixes).\n- drm/amd/display: Change dither policy for 10 bpc output back to dithering (git-fixes).\n- drm/amd/display: Correct logic check error for fastboot (git-fixes).\n- drm/amd/display: Disable 10-bit truncation and dithering on DCE 6.x (git-fixes).\n- drm/amd/display: Disable fastboot on DCE 6 too (stable-fixes).\n- drm/amd/display: Read EDID from VBIOS embedded panel info (git-fixes).\n- drm/amd/pm/ci: Clear EnabledForActivity field for memory levels (git-fixes).\n- drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs (git-fixes).\n- drm/amd/pm/ci: Fill DW8 fields from SMC (git-fixes).\n- drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 (git-fixes).\n- drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled (git-fixes).\n- drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board (git-fixes).\n- drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock (git-fixes).\n- drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x (git-fixes).\n- drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) (git-fixes).\n- drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ (stable-fixes).\n- drm/amdgpu/gfx10: look at the right prop for gfx queue priority (git-fixes).\n- drm/amdgpu/gfx11: look at the right prop for gfx queue priority (git-fixes).\n- drm/amdgpu/gmc: Fix AMDGPU_GART_PLACEMENT_LOW to not overlap with VRAM (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.5 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.0 ring (git-fixes).\n- drm/amdgpu/pm: add missing revision check for CI (git-fixes).\n- drm/amdgpu/pm: align Hawaii mclk workaround with radeon (git-fixes).\n- drm/amdgpu/pm: drop SMU driver if version not matched messages (stable-fixes).\n- drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission (git-fixes).\n- drm/amdgpu/vce: Prevent partial address patches (stable-fixes).\n- drm/amdgpu/vcn3: Avoid overflow on msg bound check (git-fixes).\n- drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (stable-fixes).\n- drm/amdgpu/vcn4: Avoid overflow on msg bound check (git-fixes).\n- drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (stable-fixes).\n- drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (stable-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v4.0.5 enc ring (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v5.0.0 enc ring (git-fixes).\n- drm/amdgpu: Add bounds checking to ib_{get,set}_value (stable-fixes).\n- drm/amdgpu: Add default case in DVI mode validation (git-fixes).\n- drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG (git-fixes).\n- drm/amdgpu: fix zero-size GDS range init on RDNA4 (stable-fixes).\n- drm/amdgpu: gate VM CPU HDP flush on reset lock (stable-fixes).\n- drm/amdgpu: replace PASID IDR with XArray (git-fixes).\n- drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count (stable-fixes).\n- drm/amdgpu: zero-initialize GART table on allocation (stable-fixes).\n- drm/amdkfd: Add upper bound check for num_of_nodes (stable-fixes).\n- drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure (stable-fixes).\n- drm/amdkfd: Make all TLB-flushes heavy-weight (stable-fixes).\n- drm/amdkfd: validate SVM ioctl nattr against buffer size (stable-fixes).\n- drm/arcpgu: fix device node leak (git-fixes).\n- drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs (git-fixes).\n- drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check (git-fixes).\n- drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() (git-fixes).\n- drm/bridge: stm_lvds: Do not fail atomic_check on disabled connector (git-fixes).\n- drm/etnaviv: Fix armed job not being pushed to the DRM scheduler (git-fixes).\n- drm/exynos: remove bridge when component_add fails (git-fixes).\n- drm/fb-helper: Fix clipping when damage area spans a single scanline (git-fixes).\n- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (git-fixes).\n- drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup (git-fixes).\n- drm/gma500/oaktrail_lvds: fix hang on init failure (git-fixes).\n- drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init (git-fixes).\n- drm/i915/dp: Fix VSC dynamic range signaling for RGB formats (git-fixes).\n- drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (git-fixes).\n- drm/i915/wm: Verify the correct plane DDB entry (git-fixes).\n- drm/i915: skip __i915_request_skip() for already signaled requests (git-fixes).\n- drm/imagination: Switch reset_reason fields from enum to u32 (git-fixes).\n- drm/komeda: fix integer overflow in AFBC framebuffer size check (git-fixes).\n- drm/loongson: Use managed KMS polling (git-fixes).\n- drm/msm/a6xx: Fix dumping A650+ debugbus blocks (git-fixes).\n- drm/msm/a6xx: Fix HLSQ register dumping (git-fixes).\n- drm/msm/a6xx: Use barriers while updating HFI Q headers (git-fixes).\n- drm/msm/dpu: fix mismatch between power and frequency (git-fixes).\n- drm/msm/dsi: add the missing parameter description (git-fixes).\n- drm/msm/dsi: fix bits_per_pclk (git-fixes).\n- drm/msm/dsi: fix hdisplay calculation for CMD mode panel (git-fixes).\n- drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 (git-fixes).\n- drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata() (git-fixes).\n- drm/msm/shrinker: Fix can_block() logic (git-fixes).\n- drm/nouveau: fix nvkm_device leak on aperture removal failure (git-fixes).\n- drm/nouveau: fix u32 overflow in pushbuf reloc bounds check (git-fixes).\n- drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds (git-fixes).\n- drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds (git-fixes).\n- drm/panel: sharp-ls043t1le01: make use of prepare_prev_first (git-fixes).\n- drm/panel: simple: Correct G190EAN01 prepare timing (git-fixes).\n- drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() (git-fixes).\n- drm/panthor: Fix outdated function documentation (git-fixes).\n- drm/radeon: add missing revision check for CI (git-fixes).\n- drm/sun4i: backend: fix error pointer dereference (git-fixes).\n- drm/sun4i: Fix resource leaks (git-fixes).\n- drm/v3d: Handle error from drm_sched_entity_init() (git-fixes).\n- drm/vc4: Fix a memory leak in hang state error path (git-fixes).\n- drm/vc4: Fix memory leak of BO array in hang state (git-fixes).\n- drm/vc4: platform_get_irq_byname() returns an int (stable-fixes).\n- drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock (git-fixes).\n- drm/vc4: Release runtime PM reference after binding V3D (git-fixes).\n- drm/vram: remove DRM_VRAM_MM_FILE_OPERATIONS from docs (git-fixes).\n- drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked() (git-fixes).\n- drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked() (git-fixes).\n- drm/xe/debugfs: Correct printing of register whitelist ranges (git-fixes).\n- drm/xe/dma-buf: handle empty bo and UAF races (git-fixes).\n- drm/xe/gsc: Fix BO leak on error in query_compatibility_version() (git-fixes).\n- drm/xe/uapi: update used tracking kernel-doc (git-fixes).\n- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (git-fixes).\n- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (git-fixes).\n- dt-bindings: net: Fix Tegra234 MGBE PTP clock (git-fixes).\n- efi/capsule-loader: fix incorrect sizeof in phys array reallocation (git-fixes).\n- efi: pstore: Drop efivar lock when efi_pstore_open() returns with an error (git-fixes).\n- erofs: add GFP_NOIO in the bio completion if needed (git-fixes).\n- ext4: fix fsync(2) for nojournal mode (git-fixes).\n- ext4: make recently_deleted() properly work with lazy itable initialization (git-fixes).\n- ext4: reject mount if bigalloc with s_first_data_block != 0 (git-fixes).\n- extcon: Fixed sysfs duplicate filename issue (git-fixes).\n- extcon: ptn5150: handle pending IRQ events during system resume (git-fixes).\n- fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break (git-fixes).\n- fbdev: offb: fix PCI device reference leak on probe failure (git-fixes).\n- fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO (stable-fixes).\n- fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO (git-fixes).\n- firmware: arm_ffa: Use the correct buffer size during RXTX_MAP (git-fixes).\n- firmware: dmi: Correct an indexing error in dmi.h (git-fixes).\n- firmware: google: framebuffer: Do not mark framebuffer as busy (git-fixes).\n- firmware: google: framebuffer: Do not unregister platform device (git-fixes).\n- gpio: of: clear OF_POPULATED on hog nodes in remove path (git-fixes).\n- gpio: tegra: fix irq_release_resources calling enable instead of disable (git-fixes).\n- gtp: disable BH before calling udp_tunnel_xmit_skb() (git-fixes).\n- HID: alps: fix NULL pointer dereference in alps_raw_event() (git-fixes).\n- HID: amd_sfh: don't log error when device discovery fails with -EOPNOTSUPP (git-fixes).\n- HID: apple: ensure the keyboard backlight is off if suspending (git-fixes).\n- HID: asus: do not abort probe when not necessary (git-fixes).\n- HID: asus: make asus_resume adhere to linux kernel coding standards (git-fixes).\n- HID: core: clamp report_size in s32ton() to avoid undefined shift (stable-fixes).\n- HID: logitech-hidpp: Enable MX Master 4 over bluetooth (stable-fixes).\n- HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure (stable-fixes).\n- HID: multitouch: Check to ensure report responses match the request (stable-fixes).\n- HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 (stable-fixes).\n- HID: roccat: fix use-after-free in roccat_report_event (stable-fixes).\n- HID: usbhid: fix deadlock in hid_post_reset() (git-fixes).\n- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (stable-fixes).\n- hisi_acc_vfio_pci: add eq and aeq interruption restore (git-fixes).\n- hisi_acc_vfio_pci: bugfix cache write-back issue (git-fixes).\n- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (git-fixes).\n- hv_sock: fix ARM64 support (git-fixes).\n- hv_sock: update outdated comment for renamed vsock_stream_recvmsg() (git-fixes).\n- hwmon: (ads7871) Fix endianness bug in 16-bit register reads (git-fixes).\n- hwmon: (corsair-psu) Close HID device on probe errors (git-fixes).\n- hwmon: (lm63) Add locking to avoid TOCTOU (git-fixes).\n- hwmon: (ltc2992) Clamp threshold writes to hardware range (git-fixes).\n- hwmon: (ltc2992) Fix u32 overflow in power read path (git-fixes).\n- hwmon: (ltc4286) Add missing MODULE_IMPORT_NS(\"PMBUS\") (git-fixes).\n- hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt (git-fixes).\n- hwmon: (powerz) Fix use-after-free on USB disconnect (git-fixes).\n- hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data() (git-fixes).\n- i2c: s3c24xx: check the size of the SMBUS message before using it (stable-fixes).\n- i2c: smbus: reject oversized block transfers in the common path (git-fixes).\n- i2c: stm32f7: reinit_completion() per transfer not per msg (git-fixes).\n- i2c: stub: Reject I2C block transfers with invalid length (git-fixes).\n- i2c: tegra: Add HS mode support (bsc#1261550).\n- i2c: tegra: Add Tegra256 support (bsc#1261550).\n- i2c: tegra: Do not configure DMA if not supported (bsc#1261550).\n- i2c: tegra: Don't mark devices with pins as IRQ safe (stable-fixes).\n- i2c: tegra: Update Tegra256 timing parameters (bsc#1261550).\n- i2c: tegra: Use separate variables for fast and fastplus (bsc#1261550).\n- i3c: dw: Fix memory leak in dw_i3c_master_i3c_xfers() (git-fixes).\n- i3c: master: Fix error codes at send_ccc_cmd (git-fixes).\n- i3c: mipi-i3c-hci: fix IBI payload length calculation for final status (git-fixes).\n- ibmveth: Disable GSO for packets with small MSS (bsc#1265144).\n- iio: adc: ad7192: Revert \"properly check spi_get_device_match_data()\" (stable-fixes).\n- iio: adc: ad7768-1: fix one-shot mode data acquisition (git-fixes).\n- iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() (git-fixes).\n- iio: frequency: admv1013: add dev variable (stable-fixes).\n- iio: frequency: admv1013: fix NULL pointer dereference on str (git-fixes).\n- Input: bcm5974 - recover from failed mode switch (stable-fixes).\n- Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table (stable-fixes).\n- Input: uinput - fix circular locking dependency with ff-core (git-fixes).\n- Input: uinput - take event lock when submitting FF request \"event\" (stable-fixes).\n- Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode (stable-fixes).\n- Input: xpad - add support for Razer Wolverine V3 Pro (stable-fixes).\n- interconnect: debugfs: fix devm_kstrdup and kfree mismatch (git-fixes).\n- io_uring/timeout: check unused sqe fields (git-fixes).\n- iommu/amd: move wait_on_sem() out of spinlock (git-fixes bsc#1260593).\n- iommu/amd: serialize sequence allocation under concurrent TLB invalidations (git-fixes bsc#1260593).\n- iommu/vt-d: Remove LPIG from page group response descriptor (jsc#PED-16113).\n- ipmi: Add limits to event and receive message requests (git-fixes).\n- ipmi: Check event message buffer response for bad data (git-fixes).\n- ipmi: ssif_bmc: change log level to dbg in irq callback (git-fixes).\n- ipmi: ssif_bmc: fix message desynchronization after truncated response (git-fixes).\n- ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure (git-fixes).\n- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (git-fixes).\n- KVM: arm64: Allow cacheable stage 2 mapping using VMA flags (git-fixes).\n- KVM: arm64: Assume non-PFNMAP/MIXEDMAP VMAs can be mapped cacheable (git-fixes).\n- KVM: arm64: Block cacheable PFNMAP mapping (git-fixes).\n- KVM: arm64: Consolidate idreg callbacks (git-fixes).\n- KVM: arm64: Discard PC update state on vcpu reset (git-fixes).\n- KVM: arm64: Finalize ID registers only once per VM (git-fixes).\n- KVM: arm64: Fix MTE flag initialization for protected VMs (git-fixes).\n- KVM: arm64: Fix page leak in user_mem_abort() (git-fixes).\n- KVM: arm64: Fix Trace Buffer trap polarity for protected VMs (git-fixes).\n- KVM: arm64: Fix Trace Buffer trapping for protected VMs (git-fixes).\n- KVM: arm64: Fix vma_shift staleness on nested hwpoison path (git-fixes).\n- KVM: arm64: Hide S1POE from guests when not supported by the host (git-fixes).\n- KVM: arm64: Limit clearing of ID_{AA64PFR0,PFR1}_EL1.GIC to userspace irqchip (git-fixes).\n- KVM: arm64: Make all 32bit ID registers fully writable (git-fixes).\n- KVM: arm64: nv: Add trap config for DBGWCR\u003c15\u003e_EL1 (git-fixes).\n- KVM: arm64: nv: Return correct RES0 bits for FGT registers (git-fixes).\n- KVM: arm64: pkvm: Fallback to level-3 mapping on host stage-2 fault (git-fixes).\n- KVM: arm64: Read PMUVer as unsigned (git-fixes).\n- KVM: arm64: Rename the device variable to s2_force_noncacheable (git-fixes).\n- KVM: arm64: Return early from trace helpers when KVM isn't available (git-fixes).\n- KVM: arm64: Set ID_{AA64PFR0,PFR1}_EL1.GIC when GICv3 is configured (git-fixes).\n- KVM: arm64: vgic-v3: Release reserved slot outside of lpi_xa's lock (git-fixes).\n- KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes).\n- KVM: nSVM: Use vcpu-\u003earch.cr2 when updating vmcb12 on nested #VMEXIT (git-fixes).\n- KVM: nVMX: Add consistency check for TSC_MULTIPLIER=0 (git-fixes).\n- KVM: Reject wrapped offset in kvm_reset_dirty_gfn() (git-fixes).\n- KVM: SEV: Disallow LAUNCH_FINISH if vCPUs are actively being created (git-fixes).\n- KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (git-fixes).\n- KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish (git-fixes).\n- KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm-\u003elock (git-fixes).\n- KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU (git-fixes).\n- KVM: SVM: Disallow EFER.LMSLE when not supported by hardware (git-fixes).\n- KVM: SVM: Fix a missing kunmap_local() in sev_gmem_post_populate() (git-fixes).\n- KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC (git-fixes).\n- KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (git-fixes).\n- KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN (git-fixes).\n- KVM: SVM: Properly check RAX in the emulator for SVM instructions (git-fixes).\n- KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (git-fixes).\n- KVM: TDX: Explicitly set user-return MSRs that *may* be clobbered by the TDX-Module (git-fixes).\n- KVM: x86/mmu: Fix UBSAN warning when reading nx_huge_pages parameter (git-fixes).\n- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (git-fixes).\n- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (git-fixes).\n- KVM: x86: Advertise EferLmsleUnsupported to userspace (git-fixes).\n- KVM: x86: check for nEPT/nNPT in slow flush hypercalls (git-fixes).\n- KVM: X86: Fix array_index_nospec protection in __pv_send_ipi (git-fixes).\n- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (git-fixes).\n- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (git-fixes).\n- KVM: x86: Ignore cpuid faulting in SMM (git-fixes).\n- leds: lgm-sso: Remove duplicate assignments for priv-\u003emmap (git-fixes).\n- leds: qcom-lpg: Check for array overflow when selecting the high resolution (stable-fixes).\n- lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() (git-fixes).\n- md/raid1: fix the comparing region of interval tree (bsc#1261555).\n- md/raid1: serialize overlap io for writemostly disk (bsc#1261555).\n- media: amphion: Fix race between m2m job_abort and device_run (git-fixes).\n- media: as102: fix to not free memory after the device is registered in as102_usb_probe() (git-fixes).\n- media: chips-media: wave5: add missing spinlock protection for handle_dynamic_resolution_change() (git-fixes).\n- media: chips-media: wave5: add missing spinlock protection for send_eos_event() (git-fixes).\n- media: chips-media: wave5: fix a potential memory leak in wave5_vdi_init() (git-fixes).\n- media: dib8000: avoid division by 0 in dib8000_set_dds() (git-fixes).\n- media: em28xx: fix use-after-free in em28xx_v4l2_open() (git-fixes).\n- media: hackrf: fix to not free memory after the device is registered in hackrf_probe() (git-fixes).\n- media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() (git-fixes).\n- media: i2c: imx283: Enter full standby when stopping streaming (git-fixes).\n- media: i2c: imx283: Fix hang when going from large to small resolution (git-fixes).\n- media: i2c: imx412: Assert reset GPIO during probe (git-fixes).\n- media: i2c: ov08d10: fix image vertical start setting (git-fixes).\n- media: i2c: ov8856: free control handler on error in ov8856_init_controls() (git-fixes).\n- media: intel/ipu6: fix error pointer dereference (git-fixes).\n- media: mtk-jpeg: fix use-after-free in release path due to uncancelled work (git-fixes).\n- media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 (git-fixes).\n- media: omap3isp: drop the use count of v4l2 pipeline (git-fixes).\n- media: pci: zoran: fix potential memory leak in zoran_probe() (git-fixes).\n- media: rc: streamzap: Error handling in probe (git-fixes).\n- media: rc: xbox_remote: heed DMA restrictions (git-fixes).\n- media: saa7164: add ioremap return checks and cleanups (git-fixes).\n- media: staging: imx: configure src_mux in csi_start (git-fixes).\n- media: staging: imx: request mbus_config in csi_start (git-fixes).\n- media: uvcvideo: Enable VB2_DMABUF for metadata stream (git-fixes).\n- media: videobuf2: Set vma_flags in vb2_dma_sg_mmap (git-fixes).\n- media: vidtv: fix nfeeds state corruption on start_streaming failure (git-fixes).\n- media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections (git-fixes).\n- media: vidtv: fix pass-by-value structs causing MSAN warnings (git-fixes).\n- memory: tegra30-emc: Fix dll_change check (git-fixes).\n- memory: tegra124-emc: Fix dll_change check (git-fixes).\n- mfd: core: Preserve OF node when ACPI handle is present (git-fixes).\n- mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() (git-fixes).\n- mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused (git-fixes).\n- mkspec: Add signature to source list only when it exists.\n- mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration (git-fixes).\n- mmc: vub300: fix NULL-deref on disconnect (git-fixes).\n- modpost: Amend ppc64 save/restfpr symnames for -Os build (bsc#1215199).\n- mtd: docg3: fix use-after-free in docg3_release() (git-fixes).\n- mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions (git-fixes).\n- mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path (git-fixes).\n- mtd: physmap_of_gemini: Fix disabled pinctrl state check (git-fixes).\n- mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob (git-fixes).\n- mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations (git-fixes).\n- mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() (git-fixes).\n- mtd: spi-nor: sst: Fix write enable before AAI sequence (git-fixes).\n- mtd: spi-nor: swp: check SR_TB flag when getting tb_mask (git-fixes).\n- net-shapers: don't free reply skb after genlmsg_reply() (git-fixes).\n- net/mlx5: Fix HCA caps leak on notifier init failure (git-fixes).\n- net/rds: reset op_nents when zerocopy page pin fails (bsc#1265626).\n- net/sched: cls_fw: fix NULL dereference of \"old\" filters before change() (git-fixes).\n- net/sched: fix pedit partial COW leading to page cache corruption (bsc#1265421).\n- net: gro: don't merge zcopy skbs (git-fixes).\n- net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf (git-fixes).\n- net: mana: Add MAC address to vPort logs and clarify error messages (git-fixes).\n- net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq() (git-fixes).\n- net: mana: Don't overwrite port probe error with add_adev result (git-fixes).\n- net: mana: Fix crash from unvalidated SHM offset read from BAR0 during FLR (bsc#1265846).\n- net: mana: Fix EQ leak in mana_remove on NULL port (git-fixes).\n- net: mana: Fix RX skb truesize accounting (bsc#1248754).\n- net: mana: Guard mana_remove against double invocation (git-fixes).\n- net: mana: hardening: Validate adapter_mtu from MANA_QUERY_DEV_CONFIG (git-fixes).\n- net: mana: hardening: Validate doorbell ID from GDMA_REGISTER_DEVICE response (git-fixes).\n- net: mana: Init gf_stats_work before potential error paths in probe (git-fixes).\n- net: mana: Init link_change_work before potential error paths in probe (git-fixes).\n- net: mana: Move current_speed debugfs file to mana_init_port() (git-fixes).\n- net: mana: remove double CQ cleanup in mana_create_rxq error path (git-fixes).\n- net: mana: Set default number of queues to 16 (bsc#1261648).\n- net: mana: Skip WQ object destruction for uninitialized RXQ (git-fixes).\n- net: mana: Use at least SZ_4K in doorbell ID range check (git-fixes).\n- net: mana: Use pci_name() for debugfs directory naming (git-fixes).\n- net: phy: broadcom: Save PHY counters during suspend (git-fixes).\n- net: phy: DP83TC811: add reading of abilities (git-fixes).\n- net: phy: dp83869: fix setting CLK_O_SEL field (git-fixes).\n- net: phy: fix a return path in get_phy_c45_ids() (git-fixes).\n- net: phy: qcom: at803x: Use the correct bit to disable extended next page (git-fixes).\n- net: stmmac: Fix PTP ref clock for Tegra234 (git-fixes).\n- net: usb: asix: ax88772: re-add usbnet_link_change() in phylink callbacks (git-fixes).\n- net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() (git-fixes).\n- net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() (git-fixes).\n- net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit (git-fixes).\n- net: wan: fsl_ucc_hdlc: fix ucc_hdlc_remove (git-fixes).\n- net: wan: fsl_ucc_hdlc: fix uhdlc_memclean (git-fixes).\n- net: wan: fsl_ucc_hdlc: free tx_skbuff in uhdlc_memclean (git-fixes).\n- net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler (git-fixes).\n- NFC: digital: Bounds check NFC-A cascade depth in SDD response handler (git-fixes).\n- nfc: llcp: add missing return after LLCP_CLOSED checks (git-fixes).\n- nfc: pn533: allocate rx skb before consuming bytes (git-fixes).\n- nfc: s3fwrn5: allocate rx skb before consuming bytes (git-fixes).\n- NFC: trf7970a: Ignore antenna noise when checking for RF field (git-fixes).\n- nvme-apple: drop invalid put of admin queue reference count (git-fixes).\n- nvme-auth: Include SC_C in RVAL controller hash (bsc#1260428).\n- nvme-loop: do not cancel I/O and admin tagset during ctrl reset/shutdown (bsc#1262709).\n- nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 (git-fixes).\n- nvme: Allow reauth from sysfs (bsc#1259672).\n- nvme: Expose the tls_configured sysfs for secure concat connections (bsc#1259672).\n- nvme: expose TLS mode (bsc#1259672).\n- nvme: fix admin queue leak on controller reset (git-fixes).\n- nvme: fix PCIe subsystem reset controller state transition (bsc#1261738).\n- nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers (git-fixes).\n- ocfs2: fix possible deadlock between unlink and dio_end_io_write (bsc#1258718).\n- ocfs2: split transactions in dio completion to avoid credit exhaustion (bsc#1258718).\n- openvswitch: vport: fix self-deadlock on release of tunnel ports (git-fixes).\n- panic/printk: replace other_cpu_in_panic() with panic_on_other_cpu() (bsc#1261149).\n- panic/printk: replace this_cpu_in_panic() with panic_on_this_cpu() (bsc#1261149).\n- panic: introduce helper functions for panic state (bsc#1261149).\n- panic: use angle-bracket include for panic.h (bsc#1261149).\n- PCI/AER: Clear only error bits in PCIe Device Status (git-fixes).\n- PCI/AER: Stop ruling out unbound devices as error source (git-fixes).\n- PCI/ASPM: Fix pci_clear_and_set_config_dword() usage (git-fixes).\n- PCI/NPEM: Set LED_HW_PLUGGABLE for hotplug-capable ports (git-fixes).\n- PCI/TPH: Allow TPH enable for RCiEPs (git-fixes).\n- PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well (git-fixes).\n- PCI: dwc: rcar-gen4: Change EPC BAR alignment to 4K as per the documentation (git-fixes).\n- PCI: Enable AtomicOps only if Root Port supports them (git-fixes).\n- PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown (git-fixes).\n- PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup (git-fixes).\n- PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete (git-fixes).\n- PCI: hv: Set default NUMA node to 0 for devices without affinity info (bsc#1261648).\n- PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found (git-fixes).\n- PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion support (git-fixes).\n- PCI: tegra194: Allow system suspend when the Endpoint link is not up (git-fixes).\n- PCI: tegra194: Disable direct speed change for Endpoint mode (git-fixes).\n- PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down (git-fixes).\n- PCI: tegra194: Disable PERST# IRQ only in Endpoint mode (git-fixes).\n- PCI: tegra194: Fix CBB timeout caused by DBI access before core power-on (git-fixes).\n- PCI: tegra194: Fix polling delay for L2 state (git-fixes).\n- PCI: tegra194: Free up Endpoint resources during remove() (git-fixes).\n- PCI: tegra194: Increase LTSSM poll time on surprise link down (git-fixes).\n- PCI: tegra194: Set LTR message request before PCIe link up in Endpoint mode (git-fixes).\n- PCI: tegra194: Use devm_gpiod_get_optional() to parse \"nvidia,refclk-select\" (git-fixes).\n- PCI: tegra194: Use DWC IP core version (git-fixes).\n- pinctrl: abx500: Fix type of 'argument' variable (git-fixes).\n- pinctrl: Fix spelling problem (git-fixes).\n- pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) (stable-fixes).\n- pinctrl: pic32: change all cases of bare 'unsigned' to 'unsigned int' (git-fixes).\n- pinctrl: pic32: use consistent spacing around '+' (git-fixes).\n- pinctrl: pinctrl-pic32: Fix resource leak (git-fixes).\n- pinctrl: realtek: Fix function signature for config argument (git-fixes).\n- pinctrl: renesas: rzg2l: Fix save/restore of {IOLH,IEN,PUPD,SMT} registers (git-fixes).\n- platform/chrome: chromeos_tbmc: Drop wakeup source on remove (git-fixes).\n- platform/surface: surfacepro3_button: Drop wakeup source on remove (git-fixes).\n- platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug (stable-fixes).\n- platform/x86/intel-uncore-freq: Handle autonomous UFS status bit (git-fixes).\n- platform/x86: asus-wmi: adjust screenpad power/brightness handling (git-fixes).\n- platform/x86: asus-wmi: fix screenpad brightness range (git-fixes).\n- platform/x86: dell-wmi-sysman: bound enumeration string aggregation (git-fixes).\n- platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() (git-fixes).\n- platform/x86: hp-wmi: Ignore backlight and FnLock events (stable-fixes).\n- platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup (git-fixes).\n- power: supply: axp288_charger: Do not cancel work before initializing it (git-fixes).\n- power: supply: max17042: avoid overflow when determining health (git-fixes).\n- powerpc/crash: fix backup region offset update to elfcorehdr (bsc#1259535).\n- powerpc/crash: Update backup region offset in elfcorehdr on memory hotplug (bsc#1259535).\n- printk/nbcon/panic: Allow printk kthread to sleep when the system is in panic (bsc#1261149).\n- printk/nbcon: Block printk kthreads when any CPU is in an emergency context (bsc#1261149).\n- printk/nbcon: Release nbcon consoles ownership in atomic flush after each emitted record (bsc#1261149).\n- printk/nbcon: Restore IRQ in atomic flush after each emitted record (bsc#1261149).\n- printk/nbcon: use panic_on_this_cpu() helper (bsc#1261149).\n- printk: Allow printk_trigger_flush() to flush all types (bsc#1262750).\n- printk: Allow to use the printk kthread immediately even for 1st nbcon (jsc#PED-7912).\n- printk: Avoid irq_work for printk_deferred() on suspend (bsc#1262750).\n- printk: Avoid scheduling irq_work on suspend (bsc#1262750).\n- printk: console_flush_one_record() code cleanup (bsc#1261149).\n- printk: Introduce console_flush_one_record (bsc#1261149).\n- printk: Use console_flush_one_record for legacy printer kthread (bsc#1261149).\n- pwm: imx-tpm: Count the number of enabled channels in probe (git-fixes).\n- qat: don't mess with -\u003ed_name (jsc#PED-14238).\n- r8152: fix incorrect register write to USB_UPHY_XTAL (git-fixes).\n- RDMA/irdma: Fix double free related to rereg_user_mr (git-fixes).\n- RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() (git-fixes).\n- RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() (git-fixes).\n- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (git-fixes).\n- RDMA/mana: Validate rx_hash_key_len (git-fixes).\n- RDMA/mana_ib: cleanup the usage of mana_gd_send_request() (git-fixes).\n- RDMA/mana_ib: Disable RX steering on RSS QP destroy (git-fixes).\n- RDMA/mana_ib: Support memory windows (git-fixes).\n- regulator: act8945a: fix OF node reference imbalance (git-fixes).\n- regulator: bd9571mwv: fix OF node reference imbalance (git-fixes).\n- regulator: max77650: fix OF node reference imbalance (git-fixes).\n- regulator: mt6357: fix OF node reference imbalance (git-fixes).\n- regulator: rk808: fix OF node reference imbalance (git-fixes).\n- remoteproc: xlnx: Fix sram property parsing (git-fixes).\n- remoteproc: xlnx: Only access buffer information if IPI is buffered (git-fixes).\n- Revert \"ALSA: usb: Increase volume range that triggers a warning\" (git-fixes).\n- Revert \"serial: 8250: Revert \"drop lockdep annotation from serial8250_clear_IER()\"\" (bsc#1262480).\n- Revert \"serial: 8250: Switch to nbcon console\" (bsc#1262480).\n- rtc: abx80x: Disable alarm feature if no interrupt attached (git-fixes).\n- rtc: ntxec: fix OF node reference imbalance (git-fixes).\n- s390/dasd: Copy detected format information to secondary device (bsc#1259994).\n- s390/dasd: Fix gendisk parent after copy pair swap (bsc#1259994).\n- s390/dasd: Move quiesce state with pprc swap (bsc#1259994).\n- sched/fair: Change likelyhood of nohz.nr_cpus (bsc#1234634 bsc#1258961).\n- sched/fair: Move checking for nohz cpus after time check (bsc#1234634 bsc#1258961).\n- sched/fair: Remove nohz.nr_cpus and use weight of cpumask instead (bsc#1234634 bsc#1258961).\n- scsi: lpfc: Add clean up of aborted NVMe commands during PCI fcn reset (bsc#1262019).\n- scsi: lpfc: Add log messages to fabric login error labels (bsc#1262019).\n- scsi: lpfc: Add PCI ID support for LPe42100 series adapters (bsc#1262019).\n- scsi: lpfc: Add REG_VFI mailbox cmd error handling (bsc#1262019).\n- scsi: lpfc: Break out of IRQ affinity assignment when mask reaches nr_cpu_ids (bsc#1262019).\n- scsi: lpfc: Check ASIC_ID register to aid diagnostics during failed fw updates (bsc#1262019).\n- scsi: lpfc: Cleanup error exit paths in lpfc_fdmi_cmd() and associated messages (bsc#1262019).\n- scsi: lpfc: ELIMINATE kernel-doc warnings in lpfc.h (bsc#1262019).\n- scsi: lpfc: Fix incorrect txcmplq_cnt during cleanup in lpfc_sli_abort_ring() (bsc#1262019).\n- scsi: lpfc: Introduce 128G link speed selection and support (bsc#1262019).\n- scsi: lpfc: Log discarded and insufficient RQE buffer events (bsc#1262019).\n- scsi: lpfc: Log MCQE contents for mbox commands with no context (bsc#1262019).\n- scsi: lpfc: Properly set WC for DPP mapping (bsc#1262019).\n- scsi: lpfc: Reduce pointer chasing when accessing vmid_flag (bsc#1262019).\n- scsi: lpfc: Remove deprecated PBDE feature (bsc#1262019).\n- scsi: lpfc: Remove unnecessary ndlp kref get in lpfc_check_nlp_post_devloss (bsc#1262019).\n- scsi: lpfc: Restrict first burst to non-FCoE and SLI4 adapters only (bsc#1262019).\n- scsi: lpfc: Select mailbox rq_create cmd version based on SLI4 if_type (bsc#1262019).\n- scsi: lpfc: Update class of service bit field to 3 bits for WQE submissions (bsc#1262019).\n- scsi: lpfc: Update construction of SGL when XPSGL is enabled (bsc#1262019).\n- scsi: lpfc: Update copyright year string for 2026 (bsc#1262019).\n- scsi: lpfc: Update log message when ndlp kref get is unsuccessful (bsc#1262019).\n- scsi: lpfc: Update lpfc version to 14.4.0.14 (bsc#1262019).\n- scsi: lpfc: Update lpfc version to 15.0.0.0 (bsc#1262019).\n- scsi: lpfc: Update outdated comment for renamed lpfc_freenode() (bsc#1262019).\n- scsi: lpfc: Use min_t() instead of min() in lpfc_sli4_driver_resource_setup (bsc#1262019).\n- scsi: lpfc: Use the crc32c() function (bsc#1262019).\n- scsi: mpi3mr: Add NULL checks when resetting request and reply queues (git-fixes).\n- scsi: ses: Fix devices attaching to different hosts (git-fixes).\n- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (git-fixes).\n- scsi: target: iscsi: validate CHAP_R length before base64 decode (bsc#1265449).\n- scsi: ufs: ufs-pci: Add support for Intel Wildcat Lake (jsc#PED-13771).\n- selftests/bpf: Test cross-sign 64bits range refinement (git-fixes).\n- selftests/bpf: Test invariants on JSLT crossing sign (git-fixes).\n- selftests/bpf: test refining u32/s32 bounds when ranges cross min/max boundary (git-fixes).\n- selftests: net: build net/lib dependency in all target (bsc#1262245).\n- selinux: don't reserve xattr slot when we won't fill it (stable-fixes).\n- selinux: prune /sys/fs/selinux/disable (stable-fixes).\n- selinux: shrink critical section in sel_write_load() (stable-fixes).\n- serial: 8250: Add serial8250_handle_irq_locked() (bsc#1262480).\n- serial: 8250: Protect LCR write in shutdown (bsc#1262480).\n- serial: 8250_dw: Avoid unnecessary LCR writes (bsc#1262480).\n- serial: 8250_dw: Ensure BUSY is deasserted (bsc#1262480).\n- serial: 8250_dw: Rework dw8250_handle_irq() locking and IIR handling (bsc#1262480).\n- serial: 8250_dw: Rework IIR_NO_INT handling to stop interrupt storm (bsc#1262480).\n- Set CONFIG_INTEL_TSX_MODE to follow upstream AUTO default (bsc#1263044).\n- soc/tegra: cbb: Set ERD on resume for err interrupt (git-fixes).\n- soc: qcom: aoss: compare against normalized cooling state (git-fixes).\n- soc: qcom: llcc: fix v1 SB syndrome register offset (git-fixes).\n- soc: qcom: ocmem: make the core clock optional (git-fixes).\n- soc: qcom: ocmem: register reasons for probe deferrals (git-fixes).\n- soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available (git-fixes).\n- sound: ua101: fix division by zero at probe (git-fixes).\n- soundwire: bus: demote UNATTACHED state warnings to dev_dbg() (git-fixes).\n- soundwire: cadence: Clear message complete before signaling waiting thread (git-fixes).\n- soundwire: debugfs: initialize firmware_file to empty string (git-fixes).\n- spi: aspeed-smc: fix controller deregistration (git-fixes).\n- spi: at91-usart: fix controller deregistration (git-fixes).\n- spi: atmel: fix controller deregistration (git-fixes).\n- spi: bcm63xx: fix controller deregistration (git-fixes).\n- spi: bcmbca-hsspi: fix controller deregistration (git-fixes).\n- spi: cadence: fix controller deregistration (git-fixes).\n- spi: cadence: fix unclocked access on unbind (git-fixes).\n- spi: ch341: fix memory leaks on probe failures (git-fixes).\n- spi: coldfire-qspi: fix controller deregistration (git-fixes).\n- spi: dln2: fix controller deregistration (git-fixes).\n- spi: fix controller cleanup() documentation (git-fixes).\n- spi: fix misleading controller deregistration kernel-doc (git-fixes).\n- spi: fix misleading controller registration kernel-doc (git-fixes).\n- spi: fsl-espi: fix controller deregistration (git-fixes).\n- spi: fsl-qspi: Use reinit_completion() for repeated operations (git-fixes).\n- spi: fsl: fix controller deregistration (git-fixes).\n- spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo (git-fixes).\n- spi: img-spfi: fix controller deregistration (git-fixes).\n- spi: imx: fix runtime pm leak on probe deferral (git-fixes).\n- spi: imx: fix use-after-free on unbind (git-fixes).\n- spi: lantiq-ssc: fix controller deregistration (git-fixes).\n- spi: meson-spicc: fix controller deregistration (git-fixes).\n- spi: microchip-core-qspi: fix controller deregistration (git-fixes).\n- spi: mpc52xx: fix controller deregistration (git-fixes).\n- spi: mpc52xx: fix use-after-free on registration failure (git-fixes).\n- spi: mpc52xx: fix use-after-free on unbind (git-fixes).\n- spi: mtk-nor: fix controller deregistration (git-fixes).\n- spi: mtk-snfi: fix memory leak in probe (git-fixes).\n- spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback (git-fixes).\n- spi: mxic: fix controller deregistration (git-fixes).\n- spi: mxs: fix controller deregistration (git-fixes).\n- spi: npcm-pspi: fix controller deregistration (git-fixes).\n- spi: omap2-mcspi: fix controller deregistration (git-fixes).\n- spi: orion: fix clock imbalance on registration failure (git-fixes).\n- spi: orion: fix controller deregistration (git-fixes).\n- spi: orion: fix runtime pm leak on unbind (git-fixes).\n- spi: pic32-sqi: fix controller deregistration (git-fixes).\n- spi: pic32: fix controller deregistration (git-fixes).\n- spi: pl022: fix controller deregistration (git-fixes).\n- spi: qup: fix controller deregistration (git-fixes).\n- spi: rockchip: fix controller deregistration (git-fixes).\n- spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ (git-fixes).\n- spi: rspi: fix controller deregistration (git-fixes).\n- spi: s3c64xx: fix controller deregistration (git-fixes).\n- spi: s3c64xx: fix NULL-deref on driver unbind (git-fixes).\n- spi: sh-hspi: fix controller deregistration (git-fixes).\n- spi: sprd: fix controller deregistration (git-fixes).\n- spi: st-ssc4: fix controller deregistration (git-fixes).\n- spi: sun4i: fix controller deregistration (git-fixes).\n- spi: sun6i: fix controller deregistration (git-fixes).\n- spi: syncuacer: fix controller deregistration (git-fixes).\n- spi: ti-qspi: fix controller deregistration (git-fixes).\n- spi: topcliff-pch: fix controller deregistration (git-fixes).\n- spi: topcliff-pch: fix use-after-free on unbind (git-fixes).\n- spi: uniphier: fix controller deregistration (git-fixes).\n- spi: uniphier: Simplify clock handling with devm_clk_get_enabled() (stable-fixes).\n- spi: zynq-qspi: fix controller deregistration (git-fixes).\n- spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() (stable-fixes).\n- spi: zynqmp-gqspi: fix controller deregistration (git-fixes).\n- staging: media: atomisp: Disallow all private IOCTLs (git-fixes).\n- staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() (git-fixes).\n- staging: sm750fb: fix division by zero in ps_to_hz() (git-fixes).\n- staging: vme_user: fix root device leak on init failure (git-fixes).\n- tg3: replace placeholder MAC address with device property (git-fixes).\n- thermal/drivers/spear: Fix error condition for reading st,thermal-flags (git-fixes).\n- thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp (git-fixes).\n- thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata (git-fixes).\n- tools/power/turbostat: Fix microcode patch level output for AMD/Hygon (git-fixes).\n- tools: hv: Fix cross-compilation (git-fixes).\n- tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public() (git-fixes).\n- tpm: avoid -Wunused-but-set-variable (git-fixes).\n- tpm: Fix auth session leak in tpm2_get_random() error path (git-fixes).\n- tpm: tpm_tis: add error logging for data transfer (git-fixes).\n- tpm: tpm_tis: stop transmit if retries are exhausted (git-fixes).\n- tpm: Use kfree_sensitive() to free auth session in tpm_dev_release() (git-fixes).\n- tty: serial: ip22zilog: Fix section mispatch warning (git-fixes).\n- udp: Force compute_score to always inline (bsc#1241259).\n- unshare: fix unshare_fs() handling (git-fixes).\n- USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen (git-fixes).\n- usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (git-fixes).\n- usb: chipidea: otg: not wait vbus drop if use role_switch (git-fixes).\n- USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam (stable-fixes).\n- usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer (stable-fixes).\n- usb: gadget: f_hid: Add missing error code (git-fixes).\n- usb: gadget: f_hid: don't call cdev_init while cdev in use (git-fixes).\n- usb: gadget: f_hid: move list and spinlock inits from bind to alloc (stable-fixes).\n- usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() (git-fixes).\n- usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() (git-fixes).\n- usb: gadget: f_uac1_legacy: validate control request size (stable-fixes).\n- usb: gadget: renesas_usb3: validate endpoint index in standard request handlers (git-fixes).\n- usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo (git-fixes).\n- USB: omap_udc: DMA: Don't enable burst 4 mode (git-fixes).\n- usb: port: add delay after usb_hub_set_port_power() (git-fixes).\n- usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive (stable-fixes).\n- USB: serial: io_edgeport: add support for Blackbox IC135A (stable-fixes).\n- USB: serial: option: add MeiG Smart SRM825WN (stable-fixes).\n- USB: serial: option: add support for Rolling Wireless RW135R-GL (stable-fixes).\n- USB: serial: option: add Telit Cinterion FN990A MBIM composition (git-fixes).\n- USB: serial: option: add Telit Cinterion LE910Cx compositions (stable-fixes).\n- usb: storage: Expand range of matched versions for VL817 quirks entry (git-fixes).\n- usb: typec: tcpm: reset internal port states on soft reset AMS (git-fixes).\n- usb: ulpi: fix memory leak on ulpi_register() error paths (git-fixes).\n- usb: usblp: fix heap leak in IEEE 1284 device ID via short response (stable-fixes).\n- usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl (stable-fixes).\n- usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() (git-fixes).\n- usbip: validate number_of_packets in usbip_pack_ret_submit() (git-fixes).\n- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (git-fixes).\n- vfio/pds: Fix memory leak in pds_vfio_dirty_enable() (git-fixes).\n- vfio/pds: Fix missing detach_ioas op (git-fixes).\n- vfio/pds: replace bitmap_free with vfree (git-fixes).\n- vfio/type1: Fix error unwind in migration dirty bitmap allocation (git-fixes).\n- vfio: Fix unbalanced vfio_df_close call in no-iommu mode (git-fixes).\n- vfio: Prevent open_count decrement to negative (git-fixes).\n- virt: arm-cca-guest: fix error check for RSI_INCOMPLETE (git-fixes).\n- virt: sev-guest: Do not use host-controlled page order in cleanup path (git-fixes).\n- virt: tdx-guest: Fix handling of host controlled 'quote' buffer length (git-fixes).\n- virt: tdx-guest: Return error for GetQuote failures (git-fixes).\n- wifi: ath5k: do not access array OOB (git-fixes).\n- wifi: ath9k: Fix typo (git-fixes).\n- wifi: ath10k: fix station lookup failure during disconnect (git-fixes).\n- wifi: ath11k: fix memory leaks in beacon template setup (git-fixes).\n- wifi: ath12k: fix leak in some ath12k_wmi_xxx() functions (git-fixes).\n- wifi: ath12k: use lockdep_assert_in_rcu_read_lock() for RCU assertions (git-fixes).\n- wifi: b43: enforce bounds check on firmware key index in b43_rx() (git-fixes).\n- wifi: b43legacy: enforce bounds check on firmware key index in RX path (git-fixes).\n- wifi: brcmfmac: Fix error pointer dereference (git-fixes).\n- wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task (git-fixes).\n- wifi: brcmfmac: validate bsscfg indices in IF events (stable-fixes).\n- wifi: brcmsmac: Fix dma_free_coherent() size (git-fixes).\n- wifi: cw1200: Revert \"Fix locking in error paths\" (git-fixes).\n- wifi: libertas: notify firmware load wait on disconnect (git-fixes).\n- wifi: mac80211: check ieee80211_rx_data_set_link return in pubsta MLO path (git-fixes).\n- wifi: mac80211: check tdls flag in ieee80211_tdls_oper (stable-fixes).\n- wifi: mac80211: drop stray 'static' from fast-RX rx_result (git-fixes).\n- wifi: mac80211: handle VHT EXT NSS in ieee80211_determine_our_sta_mode() (git-fixes).\n- wifi: mac80211: remove station if connection prep fails (git-fixes).\n- wifi: mac80211: use safe list iteration in radar detect work (git-fixes).\n- wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req() (git-fixes).\n- wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor (stable-fixes).\n- wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling (git-fixes).\n- wifi: mt76: mt7615: fix use_cts_prot support (git-fixes).\n- wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() (git-fixes).\n- wifi: mt76: mt7915: fix use_cts_prot support (git-fixes).\n- wifi: mt76: mt7921: fix 6GHz regulatory update on connection (git-fixes).\n- wifi: mt76: mt7921: fix a potential clc buffer length underflow (git-fixes).\n- wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work (git-fixes).\n- wifi: mt76: mt7921: Place upper limit on station AID (git-fixes).\n- wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() (git-fixes).\n- wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr (git-fixes).\n- wifi: mt76: mt7925: fix incorrect length field in txpower command (git-fixes).\n- wifi: mt76: mt7925: Fix incorrect MLO mode in firmware control (git-fixes).\n- wifi: mt76: mt7925: fix incorrect TLV length in CLC command (git-fixes).\n- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_tx_check_aggr() (git-fixes).\n- wifi: mt76: mt7925: prevent NULL vif dereference in mt7925_mac_write_txwi (git-fixes).\n- wifi: mt76: mt7996: fix FCS error flag check in RX descriptor (git-fixes).\n- wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event (git-fixes).\n- wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work() (git-fixes).\n- wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() (git-fixes).\n- wifi: nl80211: fix NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST usage (git-fixes).\n- wifi: nl80211: require admin perm on SET_PMK / DEL_PMK (git-fixes).\n- wifi: rsi: fix kthread lifetime race between self-exit and external-stop (git-fixes).\n- wifi: rt2x00usb: fix devres lifetime (git-fixes).\n- wifi: rtl8xxxu: fix potential use of uninitialized value (git-fixes).\n- wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet (git-fixes).\n- wifi: rtw88: Add additional USB IDs for RTL8812BU (bsc#1263135).\n- wifi: rtw88: Add BUFFALO WI-U3-866DHP to the USB ID list (bsc#1263135).\n- wifi: rtw88: Add support for Mercusys MA30N and D-Link DWA-T185 rev. A1 (bsc#1263135).\n- wifi: rtw88: check for PCI upstream bridge existence (git-fixes).\n- wifi: rtw88: fix device leak on probe failure (git-fixes).\n- wifi: rtw88: rtw8822bu VID/PID for BUFFALO WI-U2-866DM (bsc#1263135).\n- wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() (git-fixes).\n- wifi: wl1251: validate packet IDs before indexing tx_frames (stable-fixes).\n- x86/acpi/boot: Correct acpi_is_processor_usable() check again (git-fixes).\n- x86/boot/sev: Avoid shared GHCB page for early memory acceptance (git-fixes).\n- x86/boot/sev: Support memory acceptance in the EFI stub under SVSM (git-fixes).\n- x86/boot: Fix page table access in 5-level to 4-level paging transition (git-fixes).\n- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (bsc#1263255).\n- x86/cpufeatures: Free up unused feature bits (bsc#1263255).\n- x86/fred: Fix early boot failures on SEV-ES/SNP guests (git-fixes).\n- x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (git-fixes).\n- x86/sev: Add missing RIP_REL_REF() invocations during sme_enable() (git-fixes).\n- x86/sev: Do not touch VMSA pages during SNP guest memory kdump (git-fixes).\n- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (git-fixes).\n- x86/sev: Fix operator precedence in GHCB_MSR_VMPL_REQ_LEVEL macro (git-fixes).\n- x86/sev: Improve handling of writes to intercepted TSC MSRs (git-fixes).\n- x86/sev: Make sure pages are not skipped during kdump (git-fixes).\n- x86/tsx: Get the tsx= command line parameter with early_param() (bsc#1250951 bsc#1263044).\n- x86/tsx: Make tsx_ctrl_state static (bsc#1250951 bsc#1263044).\n- x86/vmware: Parse MP tables for SEV-SNP enabled guests under VMware hypervisors (git-fixes).\n- X.509: Fix out-of-bounds access when parsing extensions (git-fixes).\n- Xarray: do not return sibling entries from xas_find_marked() (bsc#1263815).\n","status":"published","published":"2026-05-28T12:58:58Z","modified":"2026-05-31T18:24:29.154766683Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:21834-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).\n- CVE-2024-14027: xattr: switch to CLASS(fd) (bsc#1259420).\n- CVE-2025-40181: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (bsc#1253471).\n- CVE-2025-68265: nvme: fix admin request_queue lifetime (bsc#1255360).\n- CVE-2025-68310: s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (bsc#1255160).\n- CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).\n- CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).\n- CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).\n- CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).\n- CVE-2026-23276: net: add xmit recursion limit to tunnel xmit functions (bsc#1260012).\n- CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).\n- CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).\n- CVE-2026-23316: net: ipv4: fix ARM64 alignment fault in multipath hash seed (bsc#1260573).\n- CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).\n- CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).\n- CVE-2026-23346: arm64: io: Rename ioremap_prot() to __ioremap_prot() (bsc#1260529).\n- CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).\n- CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).\n- CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).\n- CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).\n- CVE-2026-23375: mm: thp: deny THP for files on anonymous inodes (bsc#1260576).\n- CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).\n- CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).\n- CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).\n- CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).\n- CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).\n- CVE-2026-23417: bpf: Fix constant blinding for PROBE_MEM32 stores (bsc#1261410).\n- CVE-2026-23436: net: add helpers for lookup and walking netdevs under netdev_lock() (bsc#1261617).\n- CVE-2026-23437: net: shaper: protect late read accesses to the hierarchy (bsc#1261635).\n- CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).\n- CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).\n- CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).\n- CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).\n- CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).\n- CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).\n- CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).\n- CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).\n- CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).\n- CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).\n- CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).\n- CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).\n- CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on wakeup race (bsc#1261694).\n- CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).\n- CVE-2026-31395: bnxt_en: fix OOB access in DBG_BUF_PRODUCER async event handler (bsc#1261786).\n- CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).\n- CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).\n- CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).\n- CVE-2026-31406: xfrm: Fix work re-schedule after cancel in xfrm_nat_keepalive_net_fini() (bsc#1261629).\n- CVE-2026-31407: netfilter: conntrack: add missing netlink policy validations (bsc#1261632).\n- CVE-2026-31411: net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (bsc#1261752).\n- CVE-2026-31415: ipv6: avoid overflows in ip6_datagram_send_ctl() (bsc#1262099).\n- CVE-2026-31416: netfilter: nfnetlink_log: account for netlink header size (bsc#1262100).\n- CVE-2026-31420: bridge: mrp: reject zero test interval to avoid OOM panic (bsc#1262055).\n- CVE-2026-31421: net/sched: cls_fw: fix NULL pointer dereference on shared blocks (bsc#1262061).\n- CVE-2026-31422: net/sched: cls_flow: fix NULL pointer dereference on shared blocks (bsc#1262054).\n- CVE-2026-31423: net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() (bsc#1262063).\n- CVE-2026-31424: netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (bsc#1262053).\n- CVE-2026-31425: rds: ib: reject FRMR registration before IB connection is established (bsc#1262074).\n- CVE-2026-31427: netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp (bsc#1262086).\n- CVE-2026-31428: netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (bsc#1262087).\n- CVE-2026-31435: netfs: Fix read abandonment during retry (bsc#1262601).\n- CVE-2026-31449: ext4: validate p_idx bounds in ext4_ext_correct_indexes (bsc#1262616).\n- CVE-2026-31453: xfs: avoid dereferencing log items after push callbacks (bsc#1262617).\n- CVE-2026-31456: mm/pagewalk: fix race between concurrent split and refault (bsc#1262627).\n- CVE-2026-31494: net: cadence: macb: Synchronize stats calculations (bsc#1262671).\n- CVE-2026-31496: netfilter: nf_conntrack_expect: skip expectations in other netns via proc (bsc#1262673).\n- CVE-2026-31503: udp: Fix wildcard bind conflict check when using hash2 (bsc#1263077).\n- CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263085).\n- CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263093).\n- CVE-2026-31507: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer (bsc#1263095).\n- CVE-2026-31515: af_key: validate families in pfkey_send_migrate() (bsc#1262752).\n- CVE-2026-31519: btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create (bsc#1263012).\n- CVE-2026-31525: bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN (bsc#1262725).\n- CVE-2026-31526: bpf: Fix exception exit lock checking for subprogs (bsc#1262662).\n- CVE-2026-31528: perf: Make sure to use pmu_ctx-\u003epmu for groups (bsc#1263001).\n- CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262758).\n- CVE-2026-31547: drm/xe: Fix missing runtime PM reference in ccs_mode_store (bsc#1263018).\n- CVE-2026-31550: pmdomain: bcm: bcm2835-power: Increase ASB control timeout (bsc#1263104).\n- CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263107).\n- CVE-2026-31565: RDMA/irdma: Fix deadlock during netdev reset with active connections (bsc#1263064).\n- CVE-2026-31579: wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit (bsc#1263074).\n- CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263176).\n- CVE-2026-31588: KVM: x86: Use scratch field in MMIO fragment to hold small write values (bsc#1263165).\n- CVE-2026-31644: net: lan966x: fix use-after-free and leak in lan966x_fdma_reload() (bsc#1263048).\n- CVE-2026-31649: net: stmmac: fix integer underflow in chain mode (bsc#1263582).\n- CVE-2026-31658: net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() (bsc#1263052).\n- CVE-2026-31662: tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (bsc#1263131).\n- CVE-2026-31666: btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref() (bsc#1263138).\n- CVE-2026-31668: seg6: separate dst_cache for input and output paths in seg6 lwtunnel (bsc#1263140).\n- CVE-2026-31669: mptcp: fix slab-use-after-free in __inet_lookup_established (bsc#1263141).\n- CVE-2026-31675: net/sched: sch_netem: fix out-of-bounds access in packet corruption (bsc#1263556).\n- CVE-2026-31678: openvswitch: defer tunnel netdev_put to RCU release (bsc#1263562).\n- CVE-2026-31679: openvswitch: validate MPLS set/set_masked payload length (bsc#1263592).\n- CVE-2026-31681: netfilter: xt_multiport: validate range encoding in checkentry (bsc#1263593).\n- CVE-2026-31682: bridge: br_nd_send: linearize skb before parsing ND options (bsc#1263595).\n- CVE-2026-31684: net: sched: act_csum: validate nested VLAN headers (bsc#1263596).\n- CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263668).\n- CVE-2026-31691: igb: remove napi_synchronize() in igb_down() (bsc#1263604).\n- CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263901).\n- CVE-2026-31700: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (bsc#1263882).\n- CVE-2026-31738: vxlan: validate ND option lengths in vxlan_na_create (bsc#1264059).\n- CVE-2026-31787: xen/privcmd: fix double free via VMA splitting (bsc#1262181).\n- CVE-2026-43009: bpf: Fix incorrect pruning due to atomic fetch precision tracking (bsc#1264014).\n- CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1263931).\n- CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1263933).\n- CVE-2026-43037: ip6_tunnel: clear skb2-\u003ecb in ip4ip6_err() (bsc#1263995).\n- CVE-2026-43038: ipv6: icmp: clear skb2-\u003ecb in ip6_err_gen_icmpv6_unreach() (bsc#1264097).\n- CVE-2026-43045: mshv: Refactor and rename memory region handling functions (bsc#1263942).\n- CVE-2026-43050: atm: lec: fix use-after-free in sock_def_readable() (bsc#1264082).\n- CVE-2026-43060: netfilter: nft_ct: drop pending enqueued packets on removal (bsc#1264183).\n- CVE-2026-43082: net: txgbe: leave space for null terminators on property_entry (bsc#1264233).\n- CVE-2026-43088: net: af_key: zero aligned sockaddr tail in PF_KEY exports (bsc#1264469).\n- CVE-2026-43153: xfs: remove xfs_attr_leaf_hasname (bsc#1264586).\n- CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264848).\n- CVE-2026-43265: KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block() (bsc#1264427).\n- CVE-2026-43329: netfilter: flowtable: strictly check for maximum number of actions (bsc#1265085).\n- CVE-2026-43365: xfs: fix undersized l_iclog_roundoff values (bsc#1265119).\n- CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265116).\n- CVE-2026-43441: net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1264674).\n- CVE-2026-43494: net/rds: reset op_nents when zerocopy page pin fails (bsc#1265626).\n- CVE-2026-43503: net: skbuff: propagate shared-frag marker through frag-transfer helpers (bsc#1265960).\n\nThe following non security issues were fixed:\n\n- accel/qaic: Add overflow check to remap_pfn_range during mmap (git-fixes).\n- ACPI: AGDI: fix missing newline in error message (git-fixes).\n- ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug (git-fixes).\n- ACPI: scan: Use acpi_dev_put() in object add error paths (git-fixes).\n- ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO (git-fixes).\n- ACPI: video: force native backlight on HP OMEN 16 (8A44) (stable-fixes).\n- ACPI: video: Move Lenovo Legion S7 15ACH6 quirk to the right section (git-fixes).\n- ALSA: 6fire: Fix input volume change detection (git-fixes).\n- ALSA: 6fire: fix use-after-free on disconnect (git-fixes).\n- ALSA: aoa: i2sbus: clear stale prepared state (git-fixes).\n- ALSA: aoa: i2sbus: fix OF node lifetime handling (git-fixes).\n- ALSA: aoa: Skip devices with no codecs in i2sbus_resume() (git-fixes).\n- ALSA: aoa: Use guard() for mutex locks (stable-fixes).\n- ALSA: asihpi: avoid write overflow check warning (stable-fixes).\n- ALSA: caiaq: Don't abort when no input device is available (git-fixes).\n- ALSA: caiaq: Fix control_put() result and cache rollback (git-fixes).\n- ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path (git-fixes).\n- ALSA: caiaq: fix usb_dev refcount leak on probe failure (git-fixes).\n- ALSA: caiaq: Handle probe errors properly (git-fixes).\n- ALSA: caiaq: take a reference on the USB device in create_card() (git-fixes).\n- ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() (git-fixes).\n- ALSA: core: Fix potential data race at fasync handling (git-fixes).\n- ALSA: core: Serialize deferred fasync state checks (git-fixes).\n- ALSA: core: Validate compress device numbers without dynamic minors (git-fixes).\n- ALSA: ctxfi: Add fallback to default RSR for S/PDIF (git-fixes).\n- ALSA: ctxfi: Fix missing SPDIFI1 index handling (stable-fixes).\n- ALSA: ctxfi: Limit PTP to a single page (git-fixes).\n- ALSA: firewire-tascam: Do not drop unread control events (git-fixes).\n- ALSA: fireworks: bound device-supplied status before string array lookup (git-fixes).\n- ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 (stable-fixes).\n- ALSA: hda/realtek - fixed speaker no sound update (git-fixes).\n- ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk (stable-fixes).\n- ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx (stable-fixes).\n- ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC (stable-fixes).\n- ALSA: hda/realtek: add quirk for Framework F111:000F (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 (stable-fixes).\n- ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') (git-fixes).\n- ALSA: hda: cs35l41: Put ACPI device on missing physical node (git-fixes).\n- ALSA: hda: cs35l56: Propagate ASP TX source control errors (git-fixes).\n- ALSA: hda: cs35l56: Put ACPI device after setting companion (git-fixes).\n- ALSA: hda: Fix NULL pointer dereference in snd_hda_ctl_add() (git-fixes).\n- ALSA: misc: Use guard() for spin locks (stable-fixes).\n- ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger (stable-fixes).\n- ALSA: pcmtest: fix reference leak on failed device registration (git-fixes).\n- ALSA: pcmtest: Fix resource leaks in module init error paths (git-fixes).\n- ALSA: pcmtest: Return -EFAULT on pattern read copy failure (git-fixes).\n- ALSA: sc6000: Keep the programmed board state in card-private data (git-fixes).\n- ALSA: scarlett2: Add missing error check when initialise Autogain Status (git-fixes).\n- ALSA: scarlett2: Add missing sentinel initializer field (git-fixes).\n- ALSA: seq: Notify client and port info changes (stable-fixes).\n- ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes (stable-fixes).\n- ALSA: usb-audio: apply quirk for MOONDROP JU Jiu (stable-fixes).\n- ALSA: usb-audio: Avoid false E-MU sample-rate notifications (git-fixes).\n- ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() (git-fixes).\n- ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans (git-fixes).\n- ALSA: usb-audio: Bound MIDI endpoint descriptor scans (git-fixes).\n- ALSA: usb-audio: Evaluate packsize caps at the right place (git-fixes).\n- ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch (git-fixes).\n- ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams (git-fixes).\n- ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex (stable-fixes).\n- ALSA: usb-audio: Fix UAC3 cluster descriptor size check (git-fixes).\n- ALSA: usb-audio: midi2: Restart output URBs on resume (git-fixes).\n- ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES (git-fixes).\n- ALSA: virtio: drop an extaneous kernel-doc comment (git-fixes).\n- amdgpu/jpeg: fix deepsleep register for jpeg 5_0_0 and 5_0_2 (stable-fixes).\n- ASoC: amd: acp: Add DMI quirk for Valve Steam Deck OLED (git-fixes).\n- ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF (stable-fixes).\n- ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table (stable-fixes).\n- ASoC: codecs: ab8500: Fix casting of private data (git-fixes).\n- ASoC: cs35l56: Destroy workqueue in probe error path (git-fixes).\n- ASoC: cs35l56: Don't use devres to unregister component (git-fixes).\n- ASoC: cs35l56: Fix hibernate write in runtime resume error path (git-fixes).\n- ASoC: fsl_easrc: Change the type for iec958 channel status controls (git-fixes).\n- ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() (git-fixes).\n- ASoC: fsl_easrc: fix comment typo (git-fixes).\n- ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() (git-fixes).\n- ASoC: fsl_micfil: Add access property for \"VAD Detected\" (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in micfil_quality_set() (git-fixes).\n- ASoC: fsl_xcvr: Fix event generation for cached controls (git-fixes).\n- ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() (git-fixes).\n- ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() (git-fixes).\n- ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error (git-fixes).\n- ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop (git-fixes).\n- ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens (git-fixes).\n- ASoC: qcom: q6apm: move component registration to unmanaged version (git-fixes).\n- ASoC: qcom: q6apm: remove child devices when apm is removed (git-fixes).\n- ASoC: qcom: qdsp6: topology: check widget type before accessing data (git-fixes).\n- ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list (stable-fixes).\n- ASoC: SOF: compress: return the configured codec from get_params (git-fixes).\n- ASoC: SOF: Don't allow pointer operations on unconfigured streams (git-fixes).\n- ASoC: SOF: Intel: hda: Place check before dereference (git-fixes).\n- ASoC: SOF: topology: reject invalid vendor array size in token parser (stable-fixes).\n- ASoC: sti: Return errors from regmap_field_alloc() (git-fixes).\n- ASoC: sti: use managed regmap_field allocations (git-fixes).\n- ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J (stable-fixes).\n- ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 (stable-fixes).\n- backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() (git-fixes).\n- batman-adv: bla: only purge non-released claims (git-fixes).\n- batman-adv: bla: prevent use-after-free when deleting claims (git-fixes).\n- batman-adv: bla: put backbone reference on failed claim hash insert (git-fixes).\n- batman-adv: fix integer overflow on buff_pos (git-fixes).\n- batman-adv: hold claim backbone gateways by reference (git-fixes).\n- batman-adv: reject new tp_meter sessions during teardown (git-fixes).\n- batman-adv: reject oversized global TT response buffers (git-fixes).\n- batman-adv: stop caching unowned originator pointers in BAT IV (git-fixes).\n- bitfield: Add FIELD_MODIFY() helper (jsc#PED-14238).\n- Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling (git-fixes).\n- Bluetooth: btmtk: validate WMT event SKB length before struct access (git-fixes).\n- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (bsc#1260996).\n- Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (git-fixes).\n- Bluetooth: hci_event: fix memset typo (git-fixes).\n- Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt (git-fixes).\n- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (git-fixes).\n- Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (git-fixes).\n- Bluetooth: HIDP: serialise l2cap_unregister_user via hidp_session_sem (git-fixes).\n- Bluetooth: ISO: Fix data-race on dst in iso_sock_connect() (git-fixes).\n- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (git-fixes).\n- Bluetooth: l2cap: fix MPS check in l2cap_ecred_reconf_req (git-fixes).\n- Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (git-fixes).\n- Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() (git-fixes).\n- Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU (git-fixes).\n- Bluetooth: RFCOMM: pull credit byte with skb_pull_data() (git-fixes).\n- Bluetooth: SCO: check for codecs-\u003enum_codecs == 1 before assigning to sco_pi(sk)-\u003ecodec (git-fixes).\n- Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready (git-fixes).\n- Bluetooth: SCO: hold sk properly in sco_conn_ready (git-fixes).\n- Bluetooth: virtio_bt: clamp rx length before skb_put (git-fixes).\n- Bluetooth: virtio_bt: validate rx pkt_type header length (git-fixes).\n- bpf: Add third round of bounds deduction (git-fixes).\n- bpf: Fix u32/s32 bounds when ranges cross min/max boundary (git-fixes).\n- bpf: Improve bounds when s64 crosses sign boundary (git-fixes).\n- bpf: Switch CONFIG_CFI_CLANG to CONFIG_CFI (git-fixes).\n- btrfs: qgroup: update all parent qgroups when doing quick inherit (bsc#1258933).\n- btrfs: reject root items with drop_progress and zero drop_level (git-fixes).\n- btrfs: replace BUG() with error handling in __btrfs_balance() (git-fixes).\n- bus: mhi: host: pci_generic: Switch to async power up to avoid boot delays (git-fixes).\n- bus: rifsc: fix RIF configuration check for peripherals (git-fixes).\n- can: mcp251x: add error handling for power enable in open and resume (stable-fixes).\n- can: raw: fix ro-\u003euniq use-after-free in raw_rcv() (git-fixes).\n- can: ucan: fix devres lifetime (git-fixes).\n- cdc-acm: new quirk for EPSON HMD (stable-fixes).\n- check-for-config-changes: Exclude CC_MS_EXTENSIONS.\n- check-for-config-changes: Exclude HAVE_CFI_ICALL_NORMALIZE_INTEGERS{,_RUSTC}.\n- comedi: dt2815: add hardware detection to prevent crash (stable-fixes).\n- cpufreq: intel_pstate: Drop Arrow Lake from \"scaling factor\" list (bsc#1249104).\n- crypto: af_alg - limit RX SG extraction by receive buffer budget (git-fixes).\n- crypto: algif_aead - Fix minimum RX size check for decryption (git-fixes).\n- crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup (git-fixes).\n- crypto: atmel-ecc - Release client on allocation failure (git-fixes).\n- crypto: atmel-sha204a - Fix error codes in OTP reads (git-fixes).\n- crypto: atmel-sha204a - Fix OTP sysfs read and error handling (git-fixes).\n- crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path (git-fixes).\n- crypto: atmel-sha204a - Fix uninitialized data access on OTP read error (git-fixes).\n- crypto: atmel-tdes - fix DMA sync direction (git-fixes).\n- crypto: ccp - copy IV using skcipher ivsize (git-fixes).\n- crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (git-fixes).\n- crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (git-fixes).\n- crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (git-fixes).\n- crypto: ccree - fix a memory leak in cc_mac_digest() (git-fixes).\n- crypto: drivers - Switch back to struct platform_driver::remove() (jsc#PED-14238).\n- crypto: drivers - Use str_enable_disable-like helpers (jsc#PED-14238).\n- crypto: hisilicon - Fix dma_unmap_single() direction (git-fixes).\n- crypto: iaa - Adjust workqueue allocation type (jsc#PED-14238).\n- crypto: iaa - fix per-node CPU counter reset in rebalance_wq_table() (git-fixes).\n- crypto: iaa - Move compression CRC into request object (jsc#PED-14238).\n- crypto: iaa - Optimize rebalance_wq_table() (jsc#PED-14238).\n- crypto: iaa - Remove potential infinite loop in check_completion() (jsc#PED-14238).\n- crypto: iaa - Remove unreachable pr_debug from iaa_crypto_cleanup_module (jsc#PED-14238).\n- crypto: iaa - Remove unused disable_async argument from iaa_decompress (jsc#PED-14238).\n- crypto: iaa - Replace sprintf with sysfs_emit in sysfs show functions (jsc#PED-14238).\n- crypto: iaa - Simplify init_iaa_device() (jsc#PED-14238).\n- crypto: jitterentropy - replace long-held spinlock with mutex (git-fixes).\n- crypto: nx - Fix packed layout in struct nx842_crypto_header (git-fixes).\n- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (git-fixes).\n- crypto: qat - #undef field_get() before local definition (jsc#PED-14238).\n- crypto: qat - add adf_rl_get_num_svc_aes() in rate limiting (jsc#PED-14238).\n- crypto: qat - add bank state save and restore for qat_420xx (jsc#PED-14238).\n- crypto: qat - add command queue telemetry counters for GEN6 (jsc#PED-14238).\n- crypto: qat - add compression slice count for rate limiting (jsc#PED-14238).\n- crypto: qat - add decompression service for rate limiting (jsc#PED-14238).\n- crypto: qat - add decompression service to telemetry (jsc#PED-14238).\n- crypto: qat - add firmware headers for GEN6 devices (jsc#PED-14238).\n- crypto: qat - add GEN6 firmware loader (jsc#PED-14238).\n- crypto: qat - add get_svc_slice_cnt() in device data structure (jsc#PED-14238).\n- crypto: qat - add live migration enablers for GEN6 devices (jsc#PED-14238).\n- crypto: qat - add macro to write 64-bit values to registers (jsc#PED-14238).\n- crypto: qat - add missing header inclusion (jsc#PED-14238).\n- crypto: qat - add qat_6xxx driver (jsc#PED-14238).\n- crypto: qat - add ring buffer idle telemetry counter for GEN6 (jsc#PED-14238).\n- crypto: qat - add support for decompression service to GEN6 devices (jsc#PED-14238).\n- crypto: qat - consolidate service enums (jsc#PED-14238).\n- crypto: qat - Constify struct pm_status_row (jsc#PED-14238).\n- crypto: qat - disable 4xxx AE cluster when lead engine is fused off (git-fixes).\n- crypto: qat - disable 420xx AE cluster when lead engine is fused off (git-fixes).\n- crypto: qat - do not export adf_cfg_services (jsc#PED-14238).\n- crypto: qat - enable power management debugfs for GEN6 devices (jsc#PED-14238).\n- crypto: qat - enable RAS support for GEN6 devices (jsc#PED-14238).\n- crypto: qat - enable rate limiting feature for GEN6 devices (jsc#PED-14238).\n- crypto: qat - enable reporting of error counters for GEN6 devices (jsc#PED-14238).\n- crypto: qat - enable telemetry for GEN6 devices (jsc#PED-14238).\n- crypto: qat - export adf_get_service_mask() (jsc#PED-14238).\n- crypto: qat - export adf_init_admin_pm() (jsc#PED-14238).\n- crypto: qat - expose configuration functions (jsc#PED-14238).\n- crypto: qat - fix compression instance leak (git-fixes).\n- crypto: qat - fix IRQ cleanup on 6xxx probe failure (git-fixes).\n- crypto: qat - fix object goals in Makefiles (jsc#PED-14238.\n- crypto: qat - fix type mismatch in RAS sysfs show functions (git-fixes).\n- crypto: qat - Fix typo \"accelaration\" (jsc#PED-14238).\n- crypto: qat - fix virtual channel configuration for GEN6 devices (jsc#PED-14238).\n- crypto: qat - include qat_common in top Makefile (jsc#PED-14238).\n- crypto: qat - introduce fuse array (jsc#PED-14238).\n- crypto: qat - make adf_dev_autoreset() static (jsc#PED-14238).\n- crypto: qat - optimize allocations for fw authentication (jsc#PED-14238).\n- crypto: qat - refactor compression template logic (jsc#PED-14238).\n- crypto: qat - refactor FW signing algorithm (jsc#PED-14238).\n- crypto: qat - refactor ring-related debug functions (jsc#PED-14238).\n- crypto: qat - refactor service parsing logic (jsc#PED-14238).\n- crypto: qat - relocate and rename bank state structure definition (jsc#PED-14238).\n- crypto: qat - relocate bank state helper functions (jsc#PED-14238).\n- crypto: qat - relocate power management debugfs helper APIs (jsc#PED-14238).\n- crypto: qat - relocate service related functions (jsc#PED-14238).\n- crypto: qat - remove BITS_IN_DWORD() (jsc#PED-14238).\n- crypto: qat - Remove dst_null support (jsc#PED-14238).\n- crypto: qat - remove duplicate masking for GEN6 devices (jsc#PED-14238).\n- crypto: qat - remove initialization in device class (jsc#PED-14238).\n- crypto: qat - remove redundant FW image size check (jsc#PED-14238).\n- crypto: qat - remove unused adf_devmgr_get_first (jsc#PED-14238).\n- crypto: qat - remove unused members in suof structure (jsc#PED-14238).\n- crypto: qat - rename and relocate timer logic (jsc#PED-14238).\n- crypto: qat - reorder objects in qat_common Makefile (jsc#PED-14238).\n- crypto: qat - replace CHECK_STAT macro with static inline function (jsc#PED-14238).\n- crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() (jsc#PED-14238).\n- crypto: qat - restore ASYM service support for GEN6 devices (jsc#PED-14238).\n- crypto: qat - Return pointer directly in adf_ctl_alloc_resources (jsc#PED-14238).\n- crypto: qat - set command ids as reserved (jsc#PED-14238).\n- crypto: qat - switch to standard pattern for PCI IDs (jsc#PED-14238).\n- crypto: qat - update firmware api (jsc#PED-14238).\n- crypto: qat - use pr_fmt() in adf_gen4_hw_data.c (jsc#PED-14238).\n- crypto: qat - use pr_fmt() in qat uclo.c (jsc#PED-14238).\n- crypto: qat - use simple_strtoull to improve qat_uclo_parse_num (jsc#PED-14238).\n- crypto: qat - use swab32 macro (git-fixes).\n- crypto: qat - validate service in rate limiting sysfs api (jsc#PED-14238).\n- crypto: qat/qat_6xxx - Fix NULL vs IS_ERR() check in adf_probe() (jsc#PED-14238).\n- crypto: sa2ul - Fix AEAD fallback algorithm names (git-fixes).\n- crypto: simd - reject compat registrations without __ prefixes (git-fixes).\n- crypto: talitos - fix SEC1 32k ahash request limitation (git-fixes).\n- crypto: tegra - Disable softirqs before finalizing request (git-fixes).\n- devres: fix missing node debug info in devm_krealloc() (git-fixes).\n- dmaengine: dw-axi-dmac: fix Alignment should match open parenthesis (git-fixes).\n- dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function (git-fixes).\n- dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() (git-fixes).\n- dpll: zl3073x: Add support to adjust phase (bsc#1255752).\n- dpll: zl3073x: Fix output pin phase adjustment sign (bsc#1255752).\n- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (bsc#1255752).\n- dpll: zl3073x: Specify phase adjustment granularity for pins (bsc#1255752).\n- drivers/base/memory: fix memory block reference leak in poison accounting (git-fixes).\n- drm/amd/display: Add NULL check for integrated_info in clk_mgr_construct (git-fixes).\n- drm/amd/display: Allow DCE link encoder without AUX registers (git-fixes).\n- drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths (git-fixes).\n- drm/amd/display: Change dither policy for 10 bpc output back to dithering (git-fixes).\n- drm/amd/display: Correct logic check error for fastboot (git-fixes).\n- drm/amd/display: Disable 10-bit truncation and dithering on DCE 6.x (git-fixes).\n- drm/amd/display: Disable fastboot on DCE 6 too (stable-fixes).\n- drm/amd/display: Read EDID from VBIOS embedded panel info (git-fixes).\n- drm/amd/pm/ci: Clear EnabledForActivity field for memory levels (git-fixes).\n- drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs (git-fixes).\n- drm/amd/pm/ci: Fill DW8 fields from SMC (git-fixes).\n- drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 (git-fixes).\n- drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled (git-fixes).\n- drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board (git-fixes).\n- drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock (git-fixes).\n- drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x (git-fixes).\n- drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) (git-fixes).\n- drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ (stable-fixes).\n- drm/amdgpu/gfx10: look at the right prop for gfx queue priority (git-fixes).\n- drm/amdgpu/gfx11: look at the right prop for gfx queue priority (git-fixes).\n- drm/amdgpu/gmc: Fix AMDGPU_GART_PLACEMENT_LOW to not overlap with VRAM (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.5 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.0 ring (git-fixes).\n- drm/amdgpu/pm: add missing revision check for CI (git-fixes).\n- drm/amdgpu/pm: align Hawaii mclk workaround with radeon (git-fixes).\n- drm/amdgpu/pm: drop SMU driver if version not matched messages (stable-fixes).\n- drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission (git-fixes).\n- drm/amdgpu/vce: Prevent partial address patches (stable-fixes).\n- drm/amdgpu/vcn3: Avoid overflow on msg bound check (git-fixes).\n- drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (stable-fixes).\n- drm/amdgpu/vcn4: Avoid overflow on msg bound check (git-fixes).\n- drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (stable-fixes).\n- drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (stable-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v4.0.5 enc ring (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v5.0.0 enc ring (git-fixes).\n- drm/amdgpu: Add bounds checking to ib_{get,set}_value (stable-fixes).\n- drm/amdgpu: Add default case in DVI mode validation (git-fixes).\n- drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG (git-fixes).\n- drm/amdgpu: fix zero-size GDS range init on RDNA4 (stable-fixes).\n- drm/amdgpu: gate VM CPU HDP flush on reset lock (stable-fixes).\n- drm/amdgpu: replace PASID IDR with XArray (git-fixes).\n- drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count (stable-fixes).\n- drm/amdgpu: zero-initialize GART table on allocation (stable-fixes).\n- drm/amdkfd: Add upper bound check for num_of_nodes (stable-fixes).\n- drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure (stable-fixes).\n- drm/amdkfd: Make all TLB-flushes heavy-weight (stable-fixes).\n- drm/amdkfd: validate SVM ioctl nattr against buffer size (stable-fixes).\n- drm/arcpgu: fix device node leak (git-fixes).\n- drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs (git-fixes).\n- drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check (git-fixes).\n- drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() (git-fixes).\n- drm/bridge: stm_lvds: Do not fail atomic_check on disabled connector (git-fixes).\n- drm/etnaviv: Fix armed job not being pushed to the DRM scheduler (git-fixes).\n- drm/exynos: remove bridge when component_add fails (git-fixes).\n- drm/fb-helper: Fix clipping when damage area spans a single scanline (git-fixes).\n- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (git-fixes).\n- drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup (git-fixes).\n- drm/gma500/oaktrail_lvds: fix hang on init failure (git-fixes).\n- drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init (git-fixes).\n- drm/i915/dp: Fix VSC dynamic range signaling for RGB formats (git-fixes).\n- drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (git-fixes).\n- drm/i915/wm: Verify the correct plane DDB entry (git-fixes).\n- drm/i915: skip __i915_request_skip() for already signaled requests (git-fixes).\n- drm/imagination: Switch reset_reason fields from enum to u32 (git-fixes).\n- drm/komeda: fix integer overflow in AFBC framebuffer size check (git-fixes).\n- drm/loongson: Use managed KMS polling (git-fixes).\n- drm/msm/a6xx: Fix dumping A650+ debugbus blocks (git-fixes).\n- drm/msm/a6xx: Fix HLSQ register dumping (git-fixes).\n- drm/msm/a6xx: Use barriers while updating HFI Q headers (git-fixes).\n- drm/msm/dpu: fix mismatch between power and frequency (git-fixes).\n- drm/msm/dsi: add the missing parameter description (git-fixes).\n- drm/msm/dsi: fix bits_per_pclk (git-fixes).\n- drm/msm/dsi: fix hdisplay calculation for CMD mode panel (git-fixes).\n- drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 (git-fixes).\n- drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata() (git-fixes).\n- drm/msm/shrinker: Fix can_block() logic (git-fixes).\n- drm/nouveau: fix nvkm_device leak on aperture removal failure (git-fixes).\n- drm/nouveau: fix u32 overflow in pushbuf reloc bounds check (git-fixes).\n- drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds (git-fixes).\n- drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds (git-fixes).\n- drm/panel: sharp-ls043t1le01: make use of prepare_prev_first (git-fixes).\n- drm/panel: simple: Correct G190EAN01 prepare timing (git-fixes).\n- drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() (git-fixes).\n- drm/panthor: Fix outdated function documentation (git-fixes).\n- drm/radeon: add missing revision check for CI (git-fixes).\n- drm/sun4i: backend: fix error pointer dereference (git-fixes).\n- drm/sun4i: Fix resource leaks (git-fixes).\n- drm/v3d: Handle error from drm_sched_entity_init() (git-fixes).\n- drm/vc4: Fix a memory leak in hang state error path (git-fixes).\n- drm/vc4: Fix memory leak of BO array in hang state (git-fixes).\n- drm/vc4: platform_get_irq_byname() returns an int (stable-fixes).\n- drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock (git-fixes).\n- drm/vc4: Release runtime PM reference after binding V3D (git-fixes).\n- drm/vram: remove DRM_VRAM_MM_FILE_OPERATIONS from docs (git-fixes).\n- drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked() (git-fixes).\n- drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked() (git-fixes).\n- drm/xe/debugfs: Correct printing of register whitelist ranges (git-fixes).\n- drm/xe/dma-buf: handle empty bo and UAF races (git-fixes).\n- drm/xe/gsc: Fix BO leak on error in query_compatibility_version() (git-fixes).\n- drm/xe/uapi: update used tracking kernel-doc (git-fixes).\n- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (git-fixes).\n- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (git-fixes).\n- dt-bindings: net: Fix Tegra234 MGBE PTP clock (git-fixes).\n- efi/capsule-loader: fix incorrect sizeof in phys array reallocation (git-fixes).\n- efi: pstore: Drop efivar lock when efi_pstore_open() returns with an error (git-fixes).\n- erofs: add GFP_NOIO in the bio completion if needed (git-fixes).\n- ext4: fix fsync(2) for nojournal mode (git-fixes).\n- ext4: make recently_deleted() properly work with lazy itable initialization (git-fixes).\n- ext4: reject mount if bigalloc with s_first_data_block != 0 (git-fixes).\n- extcon: Fixed sysfs duplicate filename issue (git-fixes).\n- extcon: ptn5150: handle pending IRQ events during system resume (git-fixes).\n- fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break (git-fixes).\n- fbdev: offb: fix PCI device reference leak on probe failure (git-fixes).\n- fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO (stable-fixes).\n- fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO (git-fixes).\n- firmware: arm_ffa: Use the correct buffer size during RXTX_MAP (git-fixes).\n- firmware: dmi: Correct an indexing error in dmi.h (git-fixes).\n- firmware: google: framebuffer: Do not mark framebuffer as busy (git-fixes).\n- firmware: google: framebuffer: Do not unregister platform device (git-fixes).\n- gpio: of: clear OF_POPULATED on hog nodes in remove path (git-fixes).\n- gpio: tegra: fix irq_release_resources calling enable instead of disable (git-fixes).\n- gtp: disable BH before calling udp_tunnel_xmit_skb() (git-fixes).\n- HID: alps: fix NULL pointer dereference in alps_raw_event() (git-fixes).\n- HID: amd_sfh: don't log error when device discovery fails with -EOPNOTSUPP (git-fixes).\n- HID: apple: ensure the keyboard backlight is off if suspending (git-fixes).\n- HID: asus: do not abort probe when not necessary (git-fixes).\n- HID: asus: make asus_resume adhere to linux kernel coding standards (git-fixes).\n- HID: core: clamp report_size in s32ton() to avoid undefined shift (stable-fixes).\n- HID: logitech-hidpp: Enable MX Master 4 over bluetooth (stable-fixes).\n- HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure (stable-fixes).\n- HID: multitouch: Check to ensure report responses match the request (stable-fixes).\n- HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 (stable-fixes).\n- HID: roccat: fix use-after-free in roccat_report_event (stable-fixes).\n- HID: usbhid: fix deadlock in hid_post_reset() (git-fixes).\n- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (stable-fixes).\n- hisi_acc_vfio_pci: add eq and aeq interruption restore (git-fixes).\n- hisi_acc_vfio_pci: bugfix cache write-back issue (git-fixes).\n- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (git-fixes).\n- hv_sock: fix ARM64 support (git-fixes).\n- hv_sock: update outdated comment for renamed vsock_stream_recvmsg() (git-fixes).\n- hwmon: (ads7871) Fix endianness bug in 16-bit register reads (git-fixes).\n- hwmon: (corsair-psu) Close HID device on probe errors (git-fixes).\n- hwmon: (lm63) Add locking to avoid TOCTOU (git-fixes).\n- hwmon: (ltc2992) Clamp threshold writes to hardware range (git-fixes).\n- hwmon: (ltc2992) Fix u32 overflow in power read path (git-fixes).\n- hwmon: (ltc4286) Add missing MODULE_IMPORT_NS(\"PMBUS\") (git-fixes).\n- hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt (git-fixes).\n- hwmon: (powerz) Fix use-after-free on USB disconnect (git-fixes).\n- hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data() (git-fixes).\n- i2c: s3c24xx: check the size of the SMBUS message before using it (stable-fixes).\n- i2c: smbus: reject oversized block transfers in the common path (git-fixes).\n- i2c: stm32f7: reinit_completion() per transfer not per msg (git-fixes).\n- i2c: stub: Reject I2C block transfers with invalid length (git-fixes).\n- i2c: tegra: Add HS mode support (bsc#1261550).\n- i2c: tegra: Add Tegra256 support (bsc#1261550).\n- i2c: tegra: Do not configure DMA if not supported (bsc#1261550).\n- i2c: tegra: Don't mark devices with pins as IRQ safe (stable-fixes).\n- i2c: tegra: Update Tegra256 timing parameters (bsc#1261550).\n- i2c: tegra: Use separate variables for fast and fastplus (bsc#1261550).\n- i3c: dw: Fix memory leak in dw_i3c_master_i3c_xfers() (git-fixes).\n- i3c: master: Fix error codes at send_ccc_cmd (git-fixes).\n- i3c: mipi-i3c-hci: fix IBI payload length calculation for final status (git-fixes).\n- ibmveth: Disable GSO for packets with small MSS (bsc#1265144).\n- iio: adc: ad7192: Revert \"properly check spi_get_device_match_data()\" (stable-fixes).\n- iio: adc: ad7768-1: fix one-shot mode data acquisition (git-fixes).\n- iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() (git-fixes).\n- iio: frequency: admv1013: add dev variable (stable-fixes).\n- iio: frequency: admv1013: fix NULL pointer dereference on str (git-fixes).\n- Input: bcm5974 - recover from failed mode switch (stable-fixes).\n- Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table (stable-fixes).\n- Input: uinput - fix circular locking dependency with ff-core (git-fixes).\n- Input: uinput - take event lock when submitting FF request \"event\" (stable-fixes).\n- Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode (stable-fixes).\n- Input: xpad - add support for Razer Wolverine V3 Pro (stable-fixes).\n- interconnect: debugfs: fix devm_kstrdup and kfree mismatch (git-fixes).\n- io_uring/timeout: check unused sqe fields (git-fixes).\n- iommu/amd: move wait_on_sem() out of spinlock (git-fixes bsc#1260593).\n- iommu/amd: serialize sequence allocation under concurrent TLB invalidations (git-fixes bsc#1260593).\n- iommu/vt-d: Remove LPIG from page group response descriptor (jsc#PED-16113).\n- ipmi: Add limits to event and receive message requests (git-fixes).\n- ipmi: Check event message buffer response for bad data (git-fixes).\n- ipmi: ssif_bmc: change log level to dbg in irq callback (git-fixes).\n- ipmi: ssif_bmc: fix message desynchronization after truncated response (git-fixes).\n- ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure (git-fixes).\n- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (git-fixes).\n- KVM: arm64: Allow cacheable stage 2 mapping using VMA flags (git-fixes).\n- KVM: arm64: Assume non-PFNMAP/MIXEDMAP VMAs can be mapped cacheable (git-fixes).\n- KVM: arm64: Block cacheable PFNMAP mapping (git-fixes).\n- KVM: arm64: Consolidate idreg callbacks (git-fixes).\n- KVM: arm64: Discard PC update state on vcpu reset (git-fixes).\n- KVM: arm64: Finalize ID registers only once per VM (git-fixes).\n- KVM: arm64: Fix MTE flag initialization for protected VMs (git-fixes).\n- KVM: arm64: Fix page leak in user_mem_abort() (git-fixes).\n- KVM: arm64: Fix Trace Buffer trap polarity for protected VMs (git-fixes).\n- KVM: arm64: Fix Trace Buffer trapping for protected VMs (git-fixes).\n- KVM: arm64: Fix vma_shift staleness on nested hwpoison path (git-fixes).\n- KVM: arm64: Hide S1POE from guests when not supported by the host (git-fixes).\n- KVM: arm64: Limit clearing of ID_{AA64PFR0,PFR1}_EL1.GIC to userspace irqchip (git-fixes).\n- KVM: arm64: Make all 32bit ID registers fully writable (git-fixes).\n- KVM: arm64: nv: Add trap config for DBGWCR\u003c15\u003e_EL1 (git-fixes).\n- KVM: arm64: nv: Return correct RES0 bits for FGT registers (git-fixes).\n- KVM: arm64: pkvm: Fallback to level-3 mapping on host stage-2 fault (git-fixes).\n- KVM: arm64: Read PMUVer as unsigned (git-fixes).\n- KVM: arm64: Rename the device variable to s2_force_noncacheable (git-fixes).\n- KVM: arm64: Return early from trace helpers when KVM isn't available (git-fixes).\n- KVM: arm64: Set ID_{AA64PFR0,PFR1}_EL1.GIC when GICv3 is configured (git-fixes).\n- KVM: arm64: vgic-v3: Release reserved slot outside of lpi_xa's lock (git-fixes).\n- KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes).\n- KVM: nSVM: Use vcpu-\u003earch.cr2 when updating vmcb12 on nested #VMEXIT (git-fixes).\n- KVM: nVMX: Add consistency check for TSC_MULTIPLIER=0 (git-fixes).\n- KVM: Reject wrapped offset in kvm_reset_dirty_gfn() (git-fixes).\n- KVM: SEV: Disallow LAUNCH_FINISH if vCPUs are actively being created (git-fixes).\n- KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (git-fixes).\n- KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish (git-fixes).\n- KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm-\u003elock (git-fixes).\n- KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU (git-fixes).\n- KVM: SVM: Disallow EFER.LMSLE when not supported by hardware (git-fixes).\n- KVM: SVM: Fix a missing kunmap_local() in sev_gmem_post_populate() (git-fixes).\n- KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC (git-fixes).\n- KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (git-fixes).\n- KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN (git-fixes).\n- KVM: SVM: Properly check RAX in the emulator for SVM instructions (git-fixes).\n- KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (git-fixes).\n- KVM: TDX: Explicitly set user-return MSRs that *may* be clobbered by the TDX-Module (git-fixes).\n- KVM: x86/mmu: Fix UBSAN warning when reading nx_huge_pages parameter (git-fixes).\n- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (git-fixes).\n- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (git-fixes).\n- KVM: x86: Advertise EferLmsleUnsupported to userspace (git-fixes).\n- KVM: x86: check for nEPT/nNPT in slow flush hypercalls (git-fixes).\n- KVM: X86: Fix array_index_nospec protection in __pv_send_ipi (git-fixes).\n- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (git-fixes).\n- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (git-fixes).\n- KVM: x86: Ignore cpuid faulting in SMM (git-fixes).\n- leds: lgm-sso: Remove duplicate assignments for priv-\u003emmap (git-fixes).\n- leds: qcom-lpg: Check for array overflow when selecting the high resolution (stable-fixes).\n- lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() (git-fixes).\n- md/raid1: fix the comparing region of interval tree (bsc#1261555).\n- md/raid1: serialize overlap io for writemostly disk (bsc#1261555).\n- media: amphion: Fix race between m2m job_abort and device_run (git-fixes).\n- media: as102: fix to not free memory after the device is registered in as102_usb_probe() (git-fixes).\n- media: chips-media: wave5: add missing spinlock protection for handle_dynamic_resolution_change() (git-fixes).\n- media: chips-media: wave5: add missing spinlock protection for send_eos_event() (git-fixes).\n- media: chips-media: wave5: fix a potential memory leak in wave5_vdi_init() (git-fixes).\n- media: dib8000: avoid division by 0 in dib8000_set_dds() (git-fixes).\n- media: em28xx: fix use-after-free in em28xx_v4l2_open() (git-fixes).\n- media: hackrf: fix to not free memory after the device is registered in hackrf_probe() (git-fixes).\n- media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() (git-fixes).\n- media: i2c: imx283: Enter full standby when stopping streaming (git-fixes).\n- media: i2c: imx283: Fix hang when going from large to small resolution (git-fixes).\n- media: i2c: imx412: Assert reset GPIO during probe (git-fixes).\n- media: i2c: ov08d10: fix image vertical start setting (git-fixes).\n- media: i2c: ov8856: free control handler on error in ov8856_init_controls() (git-fixes).\n- media: intel/ipu6: fix error pointer dereference (git-fixes).\n- media: mtk-jpeg: fix use-after-free in release path due to uncancelled work (git-fixes).\n- media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 (git-fixes).\n- media: omap3isp: drop the use count of v4l2 pipeline (git-fixes).\n- media: pci: zoran: fix potential memory leak in zoran_probe() (git-fixes).\n- media: rc: streamzap: Error handling in probe (git-fixes).\n- media: rc: xbox_remote: heed DMA restrictions (git-fixes).\n- media: saa7164: add ioremap return checks and cleanups (git-fixes).\n- media: staging: imx: configure src_mux in csi_start (git-fixes).\n- media: staging: imx: request mbus_config in csi_start (git-fixes).\n- media: uvcvideo: Enable VB2_DMABUF for metadata stream (git-fixes).\n- media: videobuf2: Set vma_flags in vb2_dma_sg_mmap (git-fixes).\n- media: vidtv: fix nfeeds state corruption on start_streaming failure (git-fixes).\n- media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections (git-fixes).\n- media: vidtv: fix pass-by-value structs causing MSAN warnings (git-fixes).\n- memory: tegra30-emc: Fix dll_change check (git-fixes).\n- memory: tegra124-emc: Fix dll_change check (git-fixes).\n- mfd: core: Preserve OF node when ACPI handle is present (git-fixes).\n- mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() (git-fixes).\n- mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused (git-fixes).\n- mkspec: Add signature to source list only when it exists.\n- mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration (git-fixes).\n- mmc: vub300: fix NULL-deref on disconnect (git-fixes).\n- modpost: Amend ppc64 save/restfpr symnames for -Os build (bsc#1215199).\n- mtd: docg3: fix use-after-free in docg3_release() (git-fixes).\n- mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions (git-fixes).\n- mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path (git-fixes).\n- mtd: physmap_of_gemini: Fix disabled pinctrl state check (git-fixes).\n- mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob (git-fixes).\n- mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations (git-fixes).\n- mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() (git-fixes).\n- mtd: spi-nor: sst: Fix write enable before AAI sequence (git-fixes).\n- mtd: spi-nor: swp: check SR_TB flag when getting tb_mask (git-fixes).\n- net-shapers: don't free reply skb after genlmsg_reply() (git-fixes).\n- net/mlx5: Fix HCA caps leak on notifier init failure (git-fixes).\n- net/rds: reset op_nents when zerocopy page pin fails (bsc#1265626).\n- net/sched: cls_fw: fix NULL dereference of \"old\" filters before change() (git-fixes).\n- net/sched: fix pedit partial COW leading to page cache corruption (bsc#1265421).\n- net: gro: don't merge zcopy skbs (git-fixes).\n- net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf (git-fixes).\n- net: mana: Add MAC address to vPort logs and clarify error messages (git-fixes).\n- net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq() (git-fixes).\n- net: mana: Don't overwrite port probe error with add_adev result (git-fixes).\n- net: mana: Fix crash from unvalidated SHM offset read from BAR0 during FLR (bsc#1265846).\n- net: mana: Fix EQ leak in mana_remove on NULL port (git-fixes).\n- net: mana: Fix RX skb truesize accounting (bsc#1248754).\n- net: mana: Guard mana_remove against double invocation (git-fixes).\n- net: mana: hardening: Validate adapter_mtu from MANA_QUERY_DEV_CONFIG (git-fixes).\n- net: mana: hardening: Validate doorbell ID from GDMA_REGISTER_DEVICE response (git-fixes).\n- net: mana: Init gf_stats_work before potential error paths in probe (git-fixes).\n- net: mana: Init link_change_work before potential error paths in probe (git-fixes).\n- net: mana: Move current_speed debugfs file to mana_init_port() (git-fixes).\n- net: mana: remove double CQ cleanup in mana_create_rxq error path (git-fixes).\n- net: mana: Set default number of queues to 16 (bsc#1261648).\n- net: mana: Skip WQ object destruction for uninitialized RXQ (git-fixes).\n- net: mana: Use at least SZ_4K in doorbell ID range check (git-fixes).\n- net: mana: Use pci_name() for debugfs directory naming (git-fixes).\n- net: phy: broadcom: Save PHY counters during suspend (git-fixes).\n- net: phy: DP83TC811: add reading of abilities (git-fixes).\n- net: phy: dp83869: fix setting CLK_O_SEL field (git-fixes).\n- net: phy: fix a return path in get_phy_c45_ids() (git-fixes).\n- net: phy: qcom: at803x: Use the correct bit to disable extended next page (git-fixes).\n- net: stmmac: Fix PTP ref clock for Tegra234 (git-fixes).\n- net: usb: asix: ax88772: re-add usbnet_link_change() in phylink callbacks (git-fixes).\n- net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() (git-fixes).\n- net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() (git-fixes).\n- net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit (git-fixes).\n- net: wan: fsl_ucc_hdlc: fix ucc_hdlc_remove (git-fixes).\n- net: wan: fsl_ucc_hdlc: fix uhdlc_memclean (git-fixes).\n- net: wan: fsl_ucc_hdlc: free tx_skbuff in uhdlc_memclean (git-fixes).\n- net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler (git-fixes).\n- NFC: digital: Bounds check NFC-A cascade depth in SDD response handler (git-fixes).\n- nfc: llcp: add missing return after LLCP_CLOSED checks (git-fixes).\n- nfc: pn533: allocate rx skb before consuming bytes (git-fixes).\n- nfc: s3fwrn5: allocate rx skb before consuming bytes (git-fixes).\n- NFC: trf7970a: Ignore antenna noise when checking for RF field (git-fixes).\n- nvme-apple: drop invalid put of admin queue reference count (git-fixes).\n- nvme-auth: Include SC_C in RVAL controller hash (bsc#1260428).\n- nvme-loop: do not cancel I/O and admin tagset during ctrl reset/shutdown (bsc#1262709).\n- nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 (git-fixes).\n- nvme: Allow reauth from sysfs (bsc#1259672).\n- nvme: Expose the tls_configured sysfs for secure concat connections (bsc#1259672).\n- nvme: expose TLS mode (bsc#1259672).\n- nvme: fix admin queue leak on controller reset (git-fixes).\n- nvme: fix PCIe subsystem reset controller state transition (bsc#1261738).\n- nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers (git-fixes).\n- ocfs2: fix possible deadlock between unlink and dio_end_io_write (bsc#1258718).\n- ocfs2: split transactions in dio completion to avoid credit exhaustion (bsc#1258718).\n- openvswitch: vport: fix self-deadlock on release of tunnel ports (git-fixes).\n- panic/printk: replace other_cpu_in_panic() with panic_on_other_cpu() (bsc#1261149).\n- panic/printk: replace this_cpu_in_panic() with panic_on_this_cpu() (bsc#1261149).\n- panic: introduce helper functions for panic state (bsc#1261149).\n- panic: use angle-bracket include for panic.h (bsc#1261149).\n- PCI/AER: Clear only error bits in PCIe Device Status (git-fixes).\n- PCI/AER: Stop ruling out unbound devices as error source (git-fixes).\n- PCI/ASPM: Fix pci_clear_and_set_config_dword() usage (git-fixes).\n- PCI/NPEM: Set LED_HW_PLUGGABLE for hotplug-capable ports (git-fixes).\n- PCI/TPH: Allow TPH enable for RCiEPs (git-fixes).\n- PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well (git-fixes).\n- PCI: dwc: rcar-gen4: Change EPC BAR alignment to 4K as per the documentation (git-fixes).\n- PCI: Enable AtomicOps only if Root Port supports them (git-fixes).\n- PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown (git-fixes).\n- PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup (git-fixes).\n- PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete (git-fixes).\n- PCI: hv: Set default NUMA node to 0 for devices without affinity info (bsc#1261648).\n- PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found (git-fixes).\n- PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion support (git-fixes).\n- PCI: tegra194: Allow system suspend when the Endpoint link is not up (git-fixes).\n- PCI: tegra194: Disable direct speed change for Endpoint mode (git-fixes).\n- PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down (git-fixes).\n- PCI: tegra194: Disable PERST# IRQ only in Endpoint mode (git-fixes).\n- PCI: tegra194: Fix CBB timeout caused by DBI access before core power-on (git-fixes).\n- PCI: tegra194: Fix polling delay for L2 state (git-fixes).\n- PCI: tegra194: Free up Endpoint resources during remove() (git-fixes).\n- PCI: tegra194: Increase LTSSM poll time on surprise link down (git-fixes).\n- PCI: tegra194: Set LTR message request before PCIe link up in Endpoint mode (git-fixes).\n- PCI: tegra194: Use devm_gpiod_get_optional() to parse \"nvidia,refclk-select\" (git-fixes).\n- PCI: tegra194: Use DWC IP core version (git-fixes).\n- pinctrl: abx500: Fix type of 'argument' variable (git-fixes).\n- pinctrl: Fix spelling problem (git-fixes).\n- pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) (stable-fixes).\n- pinctrl: pic32: change all cases of bare 'unsigned' to 'unsigned int' (git-fixes).\n- pinctrl: pic32: use consistent spacing around '+' (git-fixes).\n- pinctrl: pinctrl-pic32: Fix resource leak (git-fixes).\n- pinctrl: realtek: Fix function signature for config argument (git-fixes).\n- pinctrl: renesas: rzg2l: Fix save/restore of {IOLH,IEN,PUPD,SMT} registers (git-fixes).\n- platform/chrome: chromeos_tbmc: Drop wakeup source on remove (git-fixes).\n- platform/surface: surfacepro3_button: Drop wakeup source on remove (git-fixes).\n- platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug (stable-fixes).\n- platform/x86/intel-uncore-freq: Handle autonomous UFS status bit (git-fixes).\n- platform/x86: asus-wmi: adjust screenpad power/brightness handling (git-fixes).\n- platform/x86: asus-wmi: fix screenpad brightness range (git-fixes).\n- platform/x86: dell-wmi-sysman: bound enumeration string aggregation (git-fixes).\n- platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() (git-fixes).\n- platform/x86: hp-wmi: Ignore backlight and FnLock events (stable-fixes).\n- platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup (git-fixes).\n- power: supply: axp288_charger: Do not cancel work before initializing it (git-fixes).\n- power: supply: max17042: avoid overflow when determining health (git-fixes).\n- powerpc/crash: fix backup region offset update to elfcorehdr (bsc#1259535).\n- powerpc/crash: Update backup region offset in elfcorehdr on memory hotplug (bsc#1259535).\n- printk/nbcon/panic: Allow printk kthread to sleep when the system is in panic (bsc#1261149).\n- printk/nbcon: Block printk kthreads when any CPU is in an emergency context (bsc#1261149).\n- printk/nbcon: Release nbcon consoles ownership in atomic flush after each emitted record (bsc#1261149).\n- printk/nbcon: Restore IRQ in atomic flush after each emitted record (bsc#1261149).\n- printk/nbcon: use panic_on_this_cpu() helper (bsc#1261149).\n- printk: Allow printk_trigger_flush() to flush all types (bsc#1262750).\n- printk: Allow to use the printk kthread immediately even for 1st nbcon (jsc#PED-7912).\n- printk: Avoid irq_work for printk_deferred() on suspend (bsc#1262750).\n- printk: Avoid scheduling irq_work on suspend (bsc#1262750).\n- printk: console_flush_one_record() code cleanup (bsc#1261149).\n- printk: Introduce console_flush_one_record (bsc#1261149).\n- printk: Use console_flush_one_record for legacy printer kthread (bsc#1261149).\n- pwm: imx-tpm: Count the number of enabled channels in probe (git-fixes).\n- qat: don't mess with -\u003ed_name (jsc#PED-14238).\n- r8152: fix incorrect register write to USB_UPHY_XTAL (git-fixes).\n- RDMA/irdma: Fix double free related to rereg_user_mr (git-fixes).\n- RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() (git-fixes).\n- RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() (git-fixes).\n- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (git-fixes).\n- RDMA/mana: Validate rx_hash_key_len (git-fixes).\n- RDMA/mana_ib: cleanup the usage of mana_gd_send_request() (git-fixes).\n- RDMA/mana_ib: Disable RX steering on RSS QP destroy (git-fixes).\n- RDMA/mana_ib: Support memory windows (git-fixes).\n- regulator: act8945a: fix OF node reference imbalance (git-fixes).\n- regulator: bd9571mwv: fix OF node reference imbalance (git-fixes).\n- regulator: max77650: fix OF node reference imbalance (git-fixes).\n- regulator: mt6357: fix OF node reference imbalance (git-fixes).\n- regulator: rk808: fix OF node reference imbalance (git-fixes).\n- remoteproc: xlnx: Fix sram property parsing (git-fixes).\n- remoteproc: xlnx: Only access buffer information if IPI is buffered (git-fixes).\n- Revert \"ALSA: usb: Increase volume range that triggers a warning\" (git-fixes).\n- Revert \"serial: 8250: Revert \"drop lockdep annotation from serial8250_clear_IER()\"\" (bsc#1262480).\n- Revert \"serial: 8250: Switch to nbcon console\" (bsc#1262480).\n- rtc: abx80x: Disable alarm feature if no interrupt attached (git-fixes).\n- rtc: ntxec: fix OF node reference imbalance (git-fixes).\n- s390/dasd: Copy detected format information to secondary device (bsc#1259994).\n- s390/dasd: Fix gendisk parent after copy pair swap (bsc#1259994).\n- s390/dasd: Move quiesce state with pprc swap (bsc#1259994).\n- sched/fair: Change likelyhood of nohz.nr_cpus (bsc#1234634 bsc#1258961).\n- sched/fair: Move checking for nohz cpus after time check (bsc#1234634 bsc#1258961).\n- sched/fair: Remove nohz.nr_cpus and use weight of cpumask instead (bsc#1234634 bsc#1258961).\n- scsi: lpfc: Add clean up of aborted NVMe commands during PCI fcn reset (bsc#1262019).\n- scsi: lpfc: Add log messages to fabric login error labels (bsc#1262019).\n- scsi: lpfc: Add PCI ID support for LPe42100 series adapters (bsc#1262019).\n- scsi: lpfc: Add REG_VFI mailbox cmd error handling (bsc#1262019).\n- scsi: lpfc: Break out of IRQ affinity assignment when mask reaches nr_cpu_ids (bsc#1262019).\n- scsi: lpfc: Check ASIC_ID register to aid diagnostics during failed fw updates (bsc#1262019).\n- scsi: lpfc: Cleanup error exit paths in lpfc_fdmi_cmd() and associated messages (bsc#1262019).\n- scsi: lpfc: ELIMINATE kernel-doc warnings in lpfc.h (bsc#1262019).\n- scsi: lpfc: Fix incorrect txcmplq_cnt during cleanup in lpfc_sli_abort_ring() (bsc#1262019).\n- scsi: lpfc: Introduce 128G link speed selection and support (bsc#1262019).\n- scsi: lpfc: Log discarded and insufficient RQE buffer events (bsc#1262019).\n- scsi: lpfc: Log MCQE contents for mbox commands with no context (bsc#1262019).\n- scsi: lpfc: Properly set WC for DPP mapping (bsc#1262019).\n- scsi: lpfc: Reduce pointer chasing when accessing vmid_flag (bsc#1262019).\n- scsi: lpfc: Remove deprecated PBDE feature (bsc#1262019).\n- scsi: lpfc: Remove unnecessary ndlp kref get in lpfc_check_nlp_post_devloss (bsc#1262019).\n- scsi: lpfc: Restrict first burst to non-FCoE and SLI4 adapters only (bsc#1262019).\n- scsi: lpfc: Select mailbox rq_create cmd version based on SLI4 if_type (bsc#1262019).\n- scsi: lpfc: Update class of service bit field to 3 bits for WQE submissions (bsc#1262019).\n- scsi: lpfc: Update construction of SGL when XPSGL is enabled (bsc#1262019).\n- scsi: lpfc: Update copyright year string for 2026 (bsc#1262019).\n- scsi: lpfc: Update log message when ndlp kref get is unsuccessful (bsc#1262019).\n- scsi: lpfc: Update lpfc version to 14.4.0.14 (bsc#1262019).\n- scsi: lpfc: Update lpfc version to 15.0.0.0 (bsc#1262019).\n- scsi: lpfc: Update outdated comment for renamed lpfc_freenode() (bsc#1262019).\n- scsi: lpfc: Use min_t() instead of min() in lpfc_sli4_driver_resource_setup (bsc#1262019).\n- scsi: lpfc: Use the crc32c() function (bsc#1262019).\n- scsi: mpi3mr: Add NULL checks when resetting request and reply queues (git-fixes).\n- scsi: ses: Fix devices attaching to different hosts (git-fixes).\n- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (git-fixes).\n- scsi: target: iscsi: validate CHAP_R length before base64 decode (bsc#1265449).\n- scsi: ufs: ufs-pci: Add support for Intel Wildcat Lake (jsc#PED-13771).\n- selftests/bpf: Test cross-sign 64bits range refinement (git-fixes).\n- selftests/bpf: Test invariants on JSLT crossing sign (git-fixes).\n- selftests/bpf: test refining u32/s32 bounds when ranges cross min/max boundary (git-fixes).\n- selftests: net: build net/lib dependency in all target (bsc#1262245).\n- selinux: don't reserve xattr slot when we won't fill it (stable-fixes).\n- selinux: prune /sys/fs/selinux/disable (stable-fixes).\n- selinux: shrink critical section in sel_write_load() (stable-fixes).\n- serial: 8250: Add serial8250_handle_irq_locked() (bsc#1262480).\n- serial: 8250: Protect LCR write in shutdown (bsc#1262480).\n- serial: 8250_dw: Avoid unnecessary LCR writes (bsc#1262480).\n- serial: 8250_dw: Ensure BUSY is deasserted (bsc#1262480).\n- serial: 8250_dw: Rework dw8250_handle_irq() locking and IIR handling (bsc#1262480).\n- serial: 8250_dw: Rework IIR_NO_INT handling to stop interrupt storm (bsc#1262480).\n- Set CONFIG_INTEL_TSX_MODE to follow upstream AUTO default (bsc#1263044).\n- soc/tegra: cbb: Set ERD on resume for err interrupt (git-fixes).\n- soc: qcom: aoss: compare against normalized cooling state (git-fixes).\n- soc: qcom: llcc: fix v1 SB syndrome register offset (git-fixes).\n- soc: qcom: ocmem: make the core clock optional (git-fixes).\n- soc: qcom: ocmem: register reasons for probe deferrals (git-fixes).\n- soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available (git-fixes).\n- sound: ua101: fix division by zero at probe (git-fixes).\n- soundwire: bus: demote UNATTACHED state warnings to dev_dbg() (git-fixes).\n- soundwire: cadence: Clear message complete before signaling waiting thread (git-fixes).\n- soundwire: debugfs: initialize firmware_file to empty string (git-fixes).\n- spi: aspeed-smc: fix controller deregistration (git-fixes).\n- spi: at91-usart: fix controller deregistration (git-fixes).\n- spi: atmel: fix controller deregistration (git-fixes).\n- spi: bcm63xx: fix controller deregistration (git-fixes).\n- spi: bcmbca-hsspi: fix controller deregistration (git-fixes).\n- spi: cadence: fix controller deregistration (git-fixes).\n- spi: cadence: fix unclocked access on unbind (git-fixes).\n- spi: ch341: fix memory leaks on probe failures (git-fixes).\n- spi: coldfire-qspi: fix controller deregistration (git-fixes).\n- spi: dln2: fix controller deregistration (git-fixes).\n- spi: fix controller cleanup() documentation (git-fixes).\n- spi: fix misleading controller deregistration kernel-doc (git-fixes).\n- spi: fix misleading controller registration kernel-doc (git-fixes).\n- spi: fsl-espi: fix controller deregistration (git-fixes).\n- spi: fsl-qspi: Use reinit_completion() for repeated operations (git-fixes).\n- spi: fsl: fix controller deregistration (git-fixes).\n- spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo (git-fixes).\n- spi: img-spfi: fix controller deregistration (git-fixes).\n- spi: imx: fix runtime pm leak on probe deferral (git-fixes).\n- spi: imx: fix use-after-free on unbind (git-fixes).\n- spi: lantiq-ssc: fix controller deregistration (git-fixes).\n- spi: meson-spicc: fix controller deregistration (git-fixes).\n- spi: microchip-core-qspi: fix controller deregistration (git-fixes).\n- spi: mpc52xx: fix controller deregistration (git-fixes).\n- spi: mpc52xx: fix use-after-free on registration failure (git-fixes).\n- spi: mpc52xx: fix use-after-free on unbind (git-fixes).\n- spi: mtk-nor: fix controller deregistration (git-fixes).\n- spi: mtk-snfi: fix memory leak in probe (git-fixes).\n- spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback (git-fixes).\n- spi: mxic: fix controller deregistration (git-fixes).\n- spi: mxs: fix controller deregistration (git-fixes).\n- spi: npcm-pspi: fix controller deregistration (git-fixes).\n- spi: omap2-mcspi: fix controller deregistration (git-fixes).\n- spi: orion: fix clock imbalance on registration failure (git-fixes).\n- spi: orion: fix controller deregistration (git-fixes).\n- spi: orion: fix runtime pm leak on unbind (git-fixes).\n- spi: pic32-sqi: fix controller deregistration (git-fixes).\n- spi: pic32: fix controller deregistration (git-fixes).\n- spi: pl022: fix controller deregistration (git-fixes).\n- spi: qup: fix controller deregistration (git-fixes).\n- spi: rockchip: fix controller deregistration (git-fixes).\n- spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ (git-fixes).\n- spi: rspi: fix controller deregistration (git-fixes).\n- spi: s3c64xx: fix controller deregistration (git-fixes).\n- spi: s3c64xx: fix NULL-deref on driver unbind (git-fixes).\n- spi: sh-hspi: fix controller deregistration (git-fixes).\n- spi: sprd: fix controller deregistration (git-fixes).\n- spi: st-ssc4: fix controller deregistration (git-fixes).\n- spi: sun4i: fix controller deregistration (git-fixes).\n- spi: sun6i: fix controller deregistration (git-fixes).\n- spi: syncuacer: fix controller deregistration (git-fixes).\n- spi: ti-qspi: fix controller deregistration (git-fixes).\n- spi: topcliff-pch: fix controller deregistration (git-fixes).\n- spi: topcliff-pch: fix use-after-free on unbind (git-fixes).\n- spi: uniphier: fix controller deregistration (git-fixes).\n- spi: uniphier: Simplify clock handling with devm_clk_get_enabled() (stable-fixes).\n- spi: zynq-qspi: fix controller deregistration (git-fixes).\n- spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() (stable-fixes).\n- spi: zynqmp-gqspi: fix controller deregistration (git-fixes).\n- staging: media: atomisp: Disallow all private IOCTLs (git-fixes).\n- staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() (git-fixes).\n- staging: sm750fb: fix division by zero in ps_to_hz() (git-fixes).\n- staging: vme_user: fix root device leak on init failure (git-fixes).\n- tg3: replace placeholder MAC address with device property (git-fixes).\n- thermal/drivers/spear: Fix error condition for reading st,thermal-flags (git-fixes).\n- thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp (git-fixes).\n- thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata (git-fixes).\n- tools/power/turbostat: Fix microcode patch level output for AMD/Hygon (git-fixes).\n- tools: hv: Fix cross-compilation (git-fixes).\n- tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public() (git-fixes).\n- tpm: avoid -Wunused-but-set-variable (git-fixes).\n- tpm: Fix auth session leak in tpm2_get_random() error path (git-fixes).\n- tpm: tpm_tis: add error logging for data transfer (git-fixes).\n- tpm: tpm_tis: stop transmit if retries are exhausted (git-fixes).\n- tpm: Use kfree_sensitive() to free auth session in tpm_dev_release() (git-fixes).\n- tty: serial: ip22zilog: Fix section mispatch warning (git-fixes).\n- udp: Force compute_score to always inline (bsc#1241259).\n- unshare: fix unshare_fs() handling (git-fixes).\n- USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen (git-fixes).\n- usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (git-fixes).\n- usb: chipidea: otg: not wait vbus drop if use role_switch (git-fixes).\n- USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam (stable-fixes).\n- usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer (stable-fixes).\n- usb: gadget: f_hid: Add missing error code (git-fixes).\n- usb: gadget: f_hid: don't call cdev_init while cdev in use (git-fixes).\n- usb: gadget: f_hid: move list and spinlock inits from bind to alloc (stable-fixes).\n- usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() (git-fixes).\n- usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() (git-fixes).\n- usb: gadget: f_uac1_legacy: validate control request size (stable-fixes).\n- usb: gadget: renesas_usb3: validate endpoint index in standard request handlers (git-fixes).\n- usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo (git-fixes).\n- USB: omap_udc: DMA: Don't enable burst 4 mode (git-fixes).\n- usb: port: add delay after usb_hub_set_port_power() (git-fixes).\n- usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive (stable-fixes).\n- USB: serial: io_edgeport: add support for Blackbox IC135A (stable-fixes).\n- USB: serial: option: add MeiG Smart SRM825WN (stable-fixes).\n- USB: serial: option: add support for Rolling Wireless RW135R-GL (stable-fixes).\n- USB: serial: option: add Telit Cinterion FN990A MBIM composition (git-fixes).\n- USB: serial: option: add Telit Cinterion LE910Cx compositions (stable-fixes).\n- usb: storage: Expand range of matched versions for VL817 quirks entry (git-fixes).\n- usb: typec: tcpm: reset internal port states on soft reset AMS (git-fixes).\n- usb: ulpi: fix memory leak on ulpi_register() error paths (git-fixes).\n- usb: usblp: fix heap leak in IEEE 1284 device ID via short response (stable-fixes).\n- usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl (stable-fixes).\n- usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() (git-fixes).\n- usbip: validate number_of_packets in usbip_pack_ret_submit() (git-fixes).\n- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (git-fixes).\n- vfio/pds: Fix memory leak in pds_vfio_dirty_enable() (git-fixes).\n- vfio/pds: Fix missing detach_ioas op (git-fixes).\n- vfio/pds: replace bitmap_free with vfree (git-fixes).\n- vfio/type1: Fix error unwind in migration dirty bitmap allocation (git-fixes).\n- vfio: Fix unbalanced vfio_df_close call in no-iommu mode (git-fixes).\n- vfio: Prevent open_count decrement to negative (git-fixes).\n- virt: arm-cca-guest: fix error check for RSI_INCOMPLETE (git-fixes).\n- virt: sev-guest: Do not use host-controlled page order in cleanup path (git-fixes).\n- virt: tdx-guest: Fix handling of host controlled 'quote' buffer length (git-fixes).\n- virt: tdx-guest: Return error for GetQuote failures (git-fixes).\n- wifi: ath5k: do not access array OOB (git-fixes).\n- wifi: ath9k: Fix typo (git-fixes).\n- wifi: ath10k: fix station lookup failure during disconnect (git-fixes).\n- wifi: ath11k: fix memory leaks in beacon template setup (git-fixes).\n- wifi: ath12k: fix leak in some ath12k_wmi_xxx() functions (git-fixes).\n- wifi: ath12k: use lockdep_assert_in_rcu_read_lock() for RCU assertions (git-fixes).\n- wifi: b43: enforce bounds check on firmware key index in b43_rx() (git-fixes).\n- wifi: b43legacy: enforce bounds check on firmware key index in RX path (git-fixes).\n- wifi: brcmfmac: Fix error pointer dereference (git-fixes).\n- wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task (git-fixes).\n- wifi: brcmfmac: validate bsscfg indices in IF events (stable-fixes).\n- wifi: brcmsmac: Fix dma_free_coherent() size (git-fixes).\n- wifi: cw1200: Revert \"Fix locking in error paths\" (git-fixes).\n- wifi: libertas: notify firmware load wait on disconnect (git-fixes).\n- wifi: mac80211: check ieee80211_rx_data_set_link return in pubsta MLO path (git-fixes).\n- wifi: mac80211: check tdls flag in ieee80211_tdls_oper (stable-fixes).\n- wifi: mac80211: drop stray 'static' from fast-RX rx_result (git-fixes).\n- wifi: mac80211: handle VHT EXT NSS in ieee80211_determine_our_sta_mode() (git-fixes).\n- wifi: mac80211: remove station if connection prep fails (git-fixes).\n- wifi: mac80211: use safe list iteration in radar detect work (git-fixes).\n- wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req() (git-fixes).\n- wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor (stable-fixes).\n- wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling (git-fixes).\n- wifi: mt76: mt7615: fix use_cts_prot support (git-fixes).\n- wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() (git-fixes).\n- wifi: mt76: mt7915: fix use_cts_prot support (git-fixes).\n- wifi: mt76: mt7921: fix 6GHz regulatory update on connection (git-fixes).\n- wifi: mt76: mt7921: fix a potential clc buffer length underflow (git-fixes).\n- wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work (git-fixes).\n- wifi: mt76: mt7921: Place upper limit on station AID (git-fixes).\n- wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() (git-fixes).\n- wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr (git-fixes).\n- wifi: mt76: mt7925: fix incorrect length field in txpower command (git-fixes).\n- wifi: mt76: mt7925: Fix incorrect MLO mode in firmware control (git-fixes).\n- wifi: mt76: mt7925: fix incorrect TLV length in CLC command (git-fixes).\n- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_tx_check_aggr() (git-fixes).\n- wifi: mt76: mt7925: prevent NULL vif dereference in mt7925_mac_write_txwi (git-fixes).\n- wifi: mt76: mt7996: fix FCS error flag check in RX descriptor (git-fixes).\n- wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event (git-fixes).\n- wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work() (git-fixes).\n- wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() (git-fixes).\n- wifi: nl80211: fix NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST usage (git-fixes).\n- wifi: nl80211: require admin perm on SET_PMK / DEL_PMK (git-fixes).\n- wifi: rsi: fix kthread lifetime race between self-exit and external-stop (git-fixes).\n- wifi: rt2x00usb: fix devres lifetime (git-fixes).\n- wifi: rtl8xxxu: fix potential use of uninitialized value (git-fixes).\n- wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet (git-fixes).\n- wifi: rtw88: Add additional USB IDs for RTL8812BU (bsc#1263135).\n- wifi: rtw88: Add BUFFALO WI-U3-866DHP to the USB ID list (bsc#1263135).\n- wifi: rtw88: Add support for Mercusys MA30N and D-Link DWA-T185 rev. A1 (bsc#1263135).\n- wifi: rtw88: check for PCI upstream bridge existence (git-fixes).\n- wifi: rtw88: fix device leak on probe failure (git-fixes).\n- wifi: rtw88: rtw8822bu VID/PID for BUFFALO WI-U2-866DM (bsc#1263135).\n- wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() (git-fixes).\n- wifi: wl1251: validate packet IDs before indexing tx_frames (stable-fixes).\n- x86/acpi/boot: Correct acpi_is_processor_usable() check again (git-fixes).\n- x86/boot/sev: Avoid shared GHCB page for early memory acceptance (git-fixes).\n- x86/boot/sev: Support memory acceptance in the EFI stub under SVSM (git-fixes).\n- x86/boot: Fix page table access in 5-level to 4-level paging transition (git-fixes).\n- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (bsc#1263255).\n- x86/cpufeatures: Free up unused feature bits (bsc#1263255).\n- x86/fred: Fix early boot failures on SEV-ES/SNP guests (git-fixes).\n- x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (git-fixes).\n- x86/sev: Add missing RIP_REL_REF() invocations during sme_enable() (git-fixes).\n- x86/sev: Do not touch VMSA pages during SNP guest memory kdump (git-fixes).\n- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (git-fixes).\n- x86/sev: Fix operator precedence in GHCB_MSR_VMPL_REQ_LEVEL macro (git-fixes).\n- x86/sev: Improve handling of writes to intercepted TSC MSRs (git-fixes).\n- x86/sev: Make sure pages are not skipped during kdump (git-fixes).\n- x86/tsx: Get the tsx= command line parameter with early_param() (bsc#1250951 bsc#1263044).\n- x86/tsx: Make tsx_ctrl_state static (bsc#1250951 bsc#1263044).\n- x86/vmware: Parse MP tables for SEV-SNP enabled guests under VMware hypervisors (git-fixes).\n- X.509: Fix out-of-bounds access when parsing extensions (git-fixes).\n- Xarray: do not return sibling entries from xas_find_marked() (bsc#1263815).\n","status":"published","published":"2026-05-28T11:12:43Z","modified":"2026-07-09T18:24:07.906973973Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:21841-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).\n- CVE-2024-14027: xattr: switch to CLASS(fd) (bsc#1259420).\n- CVE-2025-40181: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (bsc#1253471).\n- CVE-2025-68265: nvme: fix admin request_queue lifetime (bsc#1255360).\n- CVE-2025-68310: s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (bsc#1255160).\n- CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).\n- CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).\n- CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).\n- CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).\n- CVE-2026-23276: net: add xmit recursion limit to tunnel xmit functions (bsc#1260012).\n- CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).\n- CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).\n- CVE-2026-23316: net: ipv4: fix ARM64 alignment fault in multipath hash seed (bsc#1260573).\n- CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).\n- CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).\n- CVE-2026-23346: arm64: io: Rename ioremap_prot() to __ioremap_prot() (bsc#1260529).\n- CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).\n- CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).\n- CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).\n- CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).\n- CVE-2026-23375: mm: thp: deny THP for files on anonymous inodes (bsc#1260576).\n- CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).\n- CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).\n- CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).\n- CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).\n- CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).\n- CVE-2026-23417: bpf: Fix constant blinding for PROBE_MEM32 stores (bsc#1261410).\n- CVE-2026-23436: net: add helpers for lookup and walking netdevs under netdev_lock() (bsc#1261617).\n- CVE-2026-23437: net: shaper: protect late read accesses to the hierarchy (bsc#1261635).\n- CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).\n- CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).\n- CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).\n- CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).\n- CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).\n- CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).\n- CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).\n- CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).\n- CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).\n- CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).\n- CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).\n- CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).\n- CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on wakeup race (bsc#1261694).\n- CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).\n- CVE-2026-31395: bnxt_en: fix OOB access in DBG_BUF_PRODUCER async event handler (bsc#1261786).\n- CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).\n- CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).\n- CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).\n- CVE-2026-31406: xfrm: Fix work re-schedule after cancel in xfrm_nat_keepalive_net_fini() (bsc#1261629).\n- CVE-2026-31407: netfilter: conntrack: add missing netlink policy validations (bsc#1261632).\n- CVE-2026-31411: net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (bsc#1261752).\n- CVE-2026-31415: ipv6: avoid overflows in ip6_datagram_send_ctl() (bsc#1262099).\n- CVE-2026-31416: netfilter: nfnetlink_log: account for netlink header size (bsc#1262100).\n- CVE-2026-31420: bridge: mrp: reject zero test interval to avoid OOM panic (bsc#1262055).\n- CVE-2026-31421: net/sched: cls_fw: fix NULL pointer dereference on shared blocks (bsc#1262061).\n- CVE-2026-31422: net/sched: cls_flow: fix NULL pointer dereference on shared blocks (bsc#1262054).\n- CVE-2026-31423: net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() (bsc#1262063).\n- CVE-2026-31424: netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (bsc#1262053).\n- CVE-2026-31425: rds: ib: reject FRMR registration before IB connection is established (bsc#1262074).\n- CVE-2026-31427: netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp (bsc#1262086).\n- CVE-2026-31428: netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (bsc#1262087).\n- CVE-2026-31435: netfs: Fix read abandonment during retry (bsc#1262601).\n- CVE-2026-31449: ext4: validate p_idx bounds in ext4_ext_correct_indexes (bsc#1262616).\n- CVE-2026-31453: xfs: avoid dereferencing log items after push callbacks (bsc#1262617).\n- CVE-2026-31456: mm/pagewalk: fix race between concurrent split and refault (bsc#1262627).\n- CVE-2026-31494: net: cadence: macb: Synchronize stats calculations (bsc#1262671).\n- CVE-2026-31496: netfilter: nf_conntrack_expect: skip expectations in other netns via proc (bsc#1262673).\n- CVE-2026-31503: udp: Fix wildcard bind conflict check when using hash2 (bsc#1263077).\n- CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263085).\n- CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263093).\n- CVE-2026-31507: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer (bsc#1263095).\n- CVE-2026-31515: af_key: validate families in pfkey_send_migrate() (bsc#1262752).\n- CVE-2026-31519: btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create (bsc#1263012).\n- CVE-2026-31525: bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN (bsc#1262725).\n- CVE-2026-31526: bpf: Fix exception exit lock checking for subprogs (bsc#1262662).\n- CVE-2026-31528: perf: Make sure to use pmu_ctx-\u003epmu for groups (bsc#1263001).\n- CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262758).\n- CVE-2026-31547: drm/xe: Fix missing runtime PM reference in ccs_mode_store (bsc#1263018).\n- CVE-2026-31550: pmdomain: bcm: bcm2835-power: Increase ASB control timeout (bsc#1263104).\n- CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263107).\n- CVE-2026-31565: RDMA/irdma: Fix deadlock during netdev reset with active connections (bsc#1263064).\n- CVE-2026-31579: wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit (bsc#1263074).\n- CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263176).\n- CVE-2026-31588: KVM: x86: Use scratch field in MMIO fragment to hold small write values (bsc#1263165).\n- CVE-2026-31644: net: lan966x: fix use-after-free and leak in lan966x_fdma_reload() (bsc#1263048).\n- CVE-2026-31649: net: stmmac: fix integer underflow in chain mode (bsc#1263582).\n- CVE-2026-31658: net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() (bsc#1263052).\n- CVE-2026-31662: tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (bsc#1263131).\n- CVE-2026-31666: btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref() (bsc#1263138).\n- CVE-2026-31668: seg6: separate dst_cache for input and output paths in seg6 lwtunnel (bsc#1263140).\n- CVE-2026-31669: mptcp: fix slab-use-after-free in __inet_lookup_established (bsc#1263141).\n- CVE-2026-31675: net/sched: sch_netem: fix out-of-bounds access in packet corruption (bsc#1263556).\n- CVE-2026-31678: openvswitch: defer tunnel netdev_put to RCU release (bsc#1263562).\n- CVE-2026-31679: openvswitch: validate MPLS set/set_masked payload length (bsc#1263592).\n- CVE-2026-31681: netfilter: xt_multiport: validate range encoding in checkentry (bsc#1263593).\n- CVE-2026-31682: bridge: br_nd_send: linearize skb before parsing ND options (bsc#1263595).\n- CVE-2026-31684: net: sched: act_csum: validate nested VLAN headers (bsc#1263596).\n- CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263668).\n- CVE-2026-31691: igb: remove napi_synchronize() in igb_down() (bsc#1263604).\n- CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263901).\n- CVE-2026-31700: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (bsc#1263882).\n- CVE-2026-31738: vxlan: validate ND option lengths in vxlan_na_create (bsc#1264059).\n- CVE-2026-31787: xen/privcmd: fix double free via VMA splitting (bsc#1262181).\n- CVE-2026-43009: bpf: Fix incorrect pruning due to atomic fetch precision tracking (bsc#1264014).\n- CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1263931).\n- CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1263933).\n- CVE-2026-43037: ip6_tunnel: clear skb2-\u003ecb in ip4ip6_err() (bsc#1263995).\n- CVE-2026-43038: ipv6: icmp: clear skb2-\u003ecb in ip6_err_gen_icmpv6_unreach() (bsc#1264097).\n- CVE-2026-43045: mshv: Refactor and rename memory region handling functions (bsc#1263942).\n- CVE-2026-43050: atm: lec: fix use-after-free in sock_def_readable() (bsc#1264082).\n- CVE-2026-43060: netfilter: nft_ct: drop pending enqueued packets on removal (bsc#1264183).\n- CVE-2026-43082: net: txgbe: leave space for null terminators on property_entry (bsc#1264233).\n- CVE-2026-43088: net: af_key: zero aligned sockaddr tail in PF_KEY exports (bsc#1264469).\n- CVE-2026-43153: xfs: remove xfs_attr_leaf_hasname (bsc#1264586).\n- CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264848).\n- CVE-2026-43265: KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block() (bsc#1264427).\n- CVE-2026-43329: netfilter: flowtable: strictly check for maximum number of actions (bsc#1265085).\n- CVE-2026-43365: xfs: fix undersized l_iclog_roundoff values (bsc#1265119).\n- CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265116).\n- CVE-2026-43441: net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1264674).\n- CVE-2026-43494: net/rds: reset op_nents when zerocopy page pin fails (bsc#1265626).\n- CVE-2026-43503: net: skbuff: propagate shared-frag marker through frag-transfer helpers (bsc#1265960).\n\nThe following non security issues were fixed:\n\n- accel/qaic: Add overflow check to remap_pfn_range during mmap (git-fixes).\n- ACPI: AGDI: fix missing newline in error message (git-fixes).\n- ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug (git-fixes).\n- ACPI: scan: Use acpi_dev_put() in object add error paths (git-fixes).\n- ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO (git-fixes).\n- ACPI: video: force native backlight on HP OMEN 16 (8A44) (stable-fixes).\n- ACPI: video: Move Lenovo Legion S7 15ACH6 quirk to the right section (git-fixes).\n- ALSA: 6fire: Fix input volume change detection (git-fixes).\n- ALSA: 6fire: fix use-after-free on disconnect (git-fixes).\n- ALSA: aoa: i2sbus: clear stale prepared state (git-fixes).\n- ALSA: aoa: i2sbus: fix OF node lifetime handling (git-fixes).\n- ALSA: aoa: Skip devices with no codecs in i2sbus_resume() (git-fixes).\n- ALSA: aoa: Use guard() for mutex locks (stable-fixes).\n- ALSA: asihpi: avoid write overflow check warning (stable-fixes).\n- ALSA: caiaq: Don't abort when no input device is available (git-fixes).\n- ALSA: caiaq: Fix control_put() result and cache rollback (git-fixes).\n- ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path (git-fixes).\n- ALSA: caiaq: fix usb_dev refcount leak on probe failure (git-fixes).\n- ALSA: caiaq: Handle probe errors properly (git-fixes).\n- ALSA: caiaq: take a reference on the USB device in create_card() (git-fixes).\n- ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() (git-fixes).\n- ALSA: core: Fix potential data race at fasync handling (git-fixes).\n- ALSA: core: Serialize deferred fasync state checks (git-fixes).\n- ALSA: core: Validate compress device numbers without dynamic minors (git-fixes).\n- ALSA: ctxfi: Add fallback to default RSR for S/PDIF (git-fixes).\n- ALSA: ctxfi: Fix missing SPDIFI1 index handling (stable-fixes).\n- ALSA: ctxfi: Limit PTP to a single page (git-fixes).\n- ALSA: firewire-tascam: Do not drop unread control events (git-fixes).\n- ALSA: fireworks: bound device-supplied status before string array lookup (git-fixes).\n- ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 (stable-fixes).\n- ALSA: hda/realtek - fixed speaker no sound update (git-fixes).\n- ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk (stable-fixes).\n- ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx (stable-fixes).\n- ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC (stable-fixes).\n- ALSA: hda/realtek: add quirk for Framework F111:000F (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 (stable-fixes).\n- ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') (git-fixes).\n- ALSA: hda: cs35l41: Put ACPI device on missing physical node (git-fixes).\n- ALSA: hda: cs35l56: Propagate ASP TX source control errors (git-fixes).\n- ALSA: hda: cs35l56: Put ACPI device after setting companion (git-fixes).\n- ALSA: hda: Fix NULL pointer dereference in snd_hda_ctl_add() (git-fixes).\n- ALSA: misc: Use guard() for spin locks (stable-fixes).\n- ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger (stable-fixes).\n- ALSA: pcmtest: fix reference leak on failed device registration (git-fixes).\n- ALSA: pcmtest: Fix resource leaks in module init error paths (git-fixes).\n- ALSA: pcmtest: Return -EFAULT on pattern read copy failure (git-fixes).\n- ALSA: sc6000: Keep the programmed board state in card-private data (git-fixes).\n- ALSA: scarlett2: Add missing error check when initialise Autogain Status (git-fixes).\n- ALSA: scarlett2: Add missing sentinel initializer field (git-fixes).\n- ALSA: seq: Notify client and port info changes (stable-fixes).\n- ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes (stable-fixes).\n- ALSA: usb-audio: apply quirk for MOONDROP JU Jiu (stable-fixes).\n- ALSA: usb-audio: Avoid false E-MU sample-rate notifications (git-fixes).\n- ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() (git-fixes).\n- ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans (git-fixes).\n- ALSA: usb-audio: Bound MIDI endpoint descriptor scans (git-fixes).\n- ALSA: usb-audio: Evaluate packsize caps at the right place (git-fixes).\n- ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch (git-fixes).\n- ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams (git-fixes).\n- ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex (stable-fixes).\n- ALSA: usb-audio: Fix UAC3 cluster descriptor size check (git-fixes).\n- ALSA: usb-audio: midi2: Restart output URBs on resume (git-fixes).\n- ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES (git-fixes).\n- ALSA: virtio: drop an extaneous kernel-doc comment (git-fixes).\n- amdgpu/jpeg: fix deepsleep register for jpeg 5_0_0 and 5_0_2 (stable-fixes).\n- ASoC: amd: acp: Add DMI quirk for Valve Steam Deck OLED (git-fixes).\n- ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF (stable-fixes).\n- ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table (stable-fixes).\n- ASoC: codecs: ab8500: Fix casting of private data (git-fixes).\n- ASoC: cs35l56: Destroy workqueue in probe error path (git-fixes).\n- ASoC: cs35l56: Don't use devres to unregister component (git-fixes).\n- ASoC: cs35l56: Fix hibernate write in runtime resume error path (git-fixes).\n- ASoC: fsl_easrc: Change the type for iec958 channel status controls (git-fixes).\n- ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() (git-fixes).\n- ASoC: fsl_easrc: fix comment typo (git-fixes).\n- ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() (git-fixes).\n- ASoC: fsl_micfil: Add access property for \"VAD Detected\" (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in micfil_quality_set() (git-fixes).\n- ASoC: fsl_xcvr: Fix event generation for cached controls (git-fixes).\n- ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() (git-fixes).\n- ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() (git-fixes).\n- ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error (git-fixes).\n- ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop (git-fixes).\n- ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens (git-fixes).\n- ASoC: qcom: q6apm: move component registration to unmanaged version (git-fixes).\n- ASoC: qcom: q6apm: remove child devices when apm is removed (git-fixes).\n- ASoC: qcom: qdsp6: topology: check widget type before accessing data (git-fixes).\n- ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list (stable-fixes).\n- ASoC: SOF: compress: return the configured codec from get_params (git-fixes).\n- ASoC: SOF: Don't allow pointer operations on unconfigured streams (git-fixes).\n- ASoC: SOF: Intel: hda: Place check before dereference (git-fixes).\n- ASoC: SOF: topology: reject invalid vendor array size in token parser (stable-fixes).\n- ASoC: sti: Return errors from regmap_field_alloc() (git-fixes).\n- ASoC: sti: use managed regmap_field allocations (git-fixes).\n- ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J (stable-fixes).\n- ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 (stable-fixes).\n- backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() (git-fixes).\n- batman-adv: bla: only purge non-released claims (git-fixes).\n- batman-adv: bla: prevent use-after-free when deleting claims (git-fixes).\n- batman-adv: bla: put backbone reference on failed claim hash insert (git-fixes).\n- batman-adv: fix integer overflow on buff_pos (git-fixes).\n- batman-adv: hold claim backbone gateways by reference (git-fixes).\n- batman-adv: reject new tp_meter sessions during teardown (git-fixes).\n- batman-adv: reject oversized global TT response buffers (git-fixes).\n- batman-adv: stop caching unowned originator pointers in BAT IV (git-fixes).\n- bitfield: Add FIELD_MODIFY() helper (jsc#PED-14238).\n- Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling (git-fixes).\n- Bluetooth: btmtk: validate WMT event SKB length before struct access (git-fixes).\n- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (bsc#1260996).\n- Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (git-fixes).\n- Bluetooth: hci_event: fix memset typo (git-fixes).\n- Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt (git-fixes).\n- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (git-fixes).\n- Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (git-fixes).\n- Bluetooth: HIDP: serialise l2cap_unregister_user via hidp_session_sem (git-fixes).\n- Bluetooth: ISO: Fix data-race on dst in iso_sock_connect() (git-fixes).\n- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (git-fixes).\n- Bluetooth: l2cap: fix MPS check in l2cap_ecred_reconf_req (git-fixes).\n- Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (git-fixes).\n- Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() (git-fixes).\n- Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU (git-fixes).\n- Bluetooth: RFCOMM: pull credit byte with skb_pull_data() (git-fixes).\n- Bluetooth: SCO: check for codecs-\u003enum_codecs == 1 before assigning to sco_pi(sk)-\u003ecodec (git-fixes).\n- Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready (git-fixes).\n- Bluetooth: SCO: hold sk properly in sco_conn_ready (git-fixes).\n- Bluetooth: virtio_bt: clamp rx length before skb_put (git-fixes).\n- Bluetooth: virtio_bt: validate rx pkt_type header length (git-fixes).\n- bpf: Add third round of bounds deduction (git-fixes).\n- bpf: Fix u32/s32 bounds when ranges cross min/max boundary (git-fixes).\n- bpf: Improve bounds when s64 crosses sign boundary (git-fixes).\n- bpf: Switch CONFIG_CFI_CLANG to CONFIG_CFI (git-fixes).\n- btrfs: qgroup: update all parent qgroups when doing quick inherit (bsc#1258933).\n- btrfs: reject root items with drop_progress and zero drop_level (git-fixes).\n- btrfs: replace BUG() with error handling in __btrfs_balance() (git-fixes).\n- bus: mhi: host: pci_generic: Switch to async power up to avoid boot delays (git-fixes).\n- bus: rifsc: fix RIF configuration check for peripherals (git-fixes).\n- can: mcp251x: add error handling for power enable in open and resume (stable-fixes).\n- can: raw: fix ro-\u003euniq use-after-free in raw_rcv() (git-fixes).\n- can: ucan: fix devres lifetime (git-fixes).\n- cdc-acm: new quirk for EPSON HMD (stable-fixes).\n- check-for-config-changes: Exclude CC_MS_EXTENSIONS.\n- check-for-config-changes: Exclude HAVE_CFI_ICALL_NORMALIZE_INTEGERS{,_RUSTC}.\n- comedi: dt2815: add hardware detection to prevent crash (stable-fixes).\n- cpufreq: intel_pstate: Drop Arrow Lake from \"scaling factor\" list (bsc#1249104).\n- crypto: af_alg - limit RX SG extraction by receive buffer budget (git-fixes).\n- crypto: algif_aead - Fix minimum RX size check for decryption (git-fixes).\n- crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup (git-fixes).\n- crypto: atmel-ecc - Release client on allocation failure (git-fixes).\n- crypto: atmel-sha204a - Fix error codes in OTP reads (git-fixes).\n- crypto: atmel-sha204a - Fix OTP sysfs read and error handling (git-fixes).\n- crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path (git-fixes).\n- crypto: atmel-sha204a - Fix uninitialized data access on OTP read error (git-fixes).\n- crypto: atmel-tdes - fix DMA sync direction (git-fixes).\n- crypto: ccp - copy IV using skcipher ivsize (git-fixes).\n- crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (git-fixes).\n- crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (git-fixes).\n- crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (git-fixes).\n- crypto: ccree - fix a memory leak in cc_mac_digest() (git-fixes).\n- crypto: drivers - Switch back to struct platform_driver::remove() (jsc#PED-14238).\n- crypto: drivers - Use str_enable_disable-like helpers (jsc#PED-14238).\n- crypto: hisilicon - Fix dma_unmap_single() direction (git-fixes).\n- crypto: iaa - Adjust workqueue allocation type (jsc#PED-14238).\n- crypto: iaa - fix per-node CPU counter reset in rebalance_wq_table() (git-fixes).\n- crypto: iaa - Move compression CRC into request object (jsc#PED-14238).\n- crypto: iaa - Optimize rebalance_wq_table() (jsc#PED-14238).\n- crypto: iaa - Remove potential infinite loop in check_completion() (jsc#PED-14238).\n- crypto: iaa - Remove unreachable pr_debug from iaa_crypto_cleanup_module (jsc#PED-14238).\n- crypto: iaa - Remove unused disable_async argument from iaa_decompress (jsc#PED-14238).\n- crypto: iaa - Replace sprintf with sysfs_emit in sysfs show functions (jsc#PED-14238).\n- crypto: iaa - Simplify init_iaa_device() (jsc#PED-14238).\n- crypto: jitterentropy - replace long-held spinlock with mutex (git-fixes).\n- crypto: nx - Fix packed layout in struct nx842_crypto_header (git-fixes).\n- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (git-fixes).\n- crypto: qat - #undef field_get() before local definition (jsc#PED-14238).\n- crypto: qat - add adf_rl_get_num_svc_aes() in rate limiting (jsc#PED-14238).\n- crypto: qat - add bank state save and restore for qat_420xx (jsc#PED-14238).\n- crypto: qat - add command queue telemetry counters for GEN6 (jsc#PED-14238).\n- crypto: qat - add compression slice count for rate limiting (jsc#PED-14238).\n- crypto: qat - add decompression service for rate limiting (jsc#PED-14238).\n- crypto: qat - add decompression service to telemetry (jsc#PED-14238).\n- crypto: qat - add firmware headers for GEN6 devices (jsc#PED-14238).\n- crypto: qat - add GEN6 firmware loader (jsc#PED-14238).\n- crypto: qat - add get_svc_slice_cnt() in device data structure (jsc#PED-14238).\n- crypto: qat - add live migration enablers for GEN6 devices (jsc#PED-14238).\n- crypto: qat - add macro to write 64-bit values to registers (jsc#PED-14238).\n- crypto: qat - add missing header inclusion (jsc#PED-14238).\n- crypto: qat - add qat_6xxx driver (jsc#PED-14238).\n- crypto: qat - add ring buffer idle telemetry counter for GEN6 (jsc#PED-14238).\n- crypto: qat - add support for decompression service to GEN6 devices (jsc#PED-14238).\n- crypto: qat - consolidate service enums (jsc#PED-14238).\n- crypto: qat - Constify struct pm_status_row (jsc#PED-14238).\n- crypto: qat - disable 4xxx AE cluster when lead engine is fused off (git-fixes).\n- crypto: qat - disable 420xx AE cluster when lead engine is fused off (git-fixes).\n- crypto: qat - do not export adf_cfg_services (jsc#PED-14238).\n- crypto: qat - enable power management debugfs for GEN6 devices (jsc#PED-14238).\n- crypto: qat - enable RAS support for GEN6 devices (jsc#PED-14238).\n- crypto: qat - enable rate limiting feature for GEN6 devices (jsc#PED-14238).\n- crypto: qat - enable reporting of error counters for GEN6 devices (jsc#PED-14238).\n- crypto: qat - enable telemetry for GEN6 devices (jsc#PED-14238).\n- crypto: qat - export adf_get_service_mask() (jsc#PED-14238).\n- crypto: qat - export adf_init_admin_pm() (jsc#PED-14238).\n- crypto: qat - expose configuration functions (jsc#PED-14238).\n- crypto: qat - fix compression instance leak (git-fixes).\n- crypto: qat - fix IRQ cleanup on 6xxx probe failure (git-fixes).\n- crypto: qat - fix object goals in Makefiles (jsc#PED-14238.\n- crypto: qat - fix type mismatch in RAS sysfs show functions (git-fixes).\n- crypto: qat - Fix typo \"accelaration\" (jsc#PED-14238).\n- crypto: qat - fix virtual channel configuration for GEN6 devices (jsc#PED-14238).\n- crypto: qat - include qat_common in top Makefile (jsc#PED-14238).\n- crypto: qat - introduce fuse array (jsc#PED-14238).\n- crypto: qat - make adf_dev_autoreset() static (jsc#PED-14238).\n- crypto: qat - optimize allocations for fw authentication (jsc#PED-14238).\n- crypto: qat - refactor compression template logic (jsc#PED-14238).\n- crypto: qat - refactor FW signing algorithm (jsc#PED-14238).\n- crypto: qat - refactor ring-related debug functions (jsc#PED-14238).\n- crypto: qat - refactor service parsing logic (jsc#PED-14238).\n- crypto: qat - relocate and rename bank state structure definition (jsc#PED-14238).\n- crypto: qat - relocate bank state helper functions (jsc#PED-14238).\n- crypto: qat - relocate power management debugfs helper APIs (jsc#PED-14238).\n- crypto: qat - relocate service related functions (jsc#PED-14238).\n- crypto: qat - remove BITS_IN_DWORD() (jsc#PED-14238).\n- crypto: qat - Remove dst_null support (jsc#PED-14238).\n- crypto: qat - remove duplicate masking for GEN6 devices (jsc#PED-14238).\n- crypto: qat - remove initialization in device class (jsc#PED-14238).\n- crypto: qat - remove redundant FW image size check (jsc#PED-14238).\n- crypto: qat - remove unused adf_devmgr_get_first (jsc#PED-14238).\n- crypto: qat - remove unused members in suof structure (jsc#PED-14238).\n- crypto: qat - rename and relocate timer logic (jsc#PED-14238).\n- crypto: qat - reorder objects in qat_common Makefile (jsc#PED-14238).\n- crypto: qat - replace CHECK_STAT macro with static inline function (jsc#PED-14238).\n- crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() (jsc#PED-14238).\n- crypto: qat - restore ASYM service support for GEN6 devices (jsc#PED-14238).\n- crypto: qat - Return pointer directly in adf_ctl_alloc_resources (jsc#PED-14238).\n- crypto: qat - set command ids as reserved (jsc#PED-14238).\n- crypto: qat - switch to standard pattern for PCI IDs (jsc#PED-14238).\n- crypto: qat - update firmware api (jsc#PED-14238).\n- crypto: qat - use pr_fmt() in adf_gen4_hw_data.c (jsc#PED-14238).\n- crypto: qat - use pr_fmt() in qat uclo.c (jsc#PED-14238).\n- crypto: qat - use simple_strtoull to improve qat_uclo_parse_num (jsc#PED-14238).\n- crypto: qat - use swab32 macro (git-fixes).\n- crypto: qat - validate service in rate limiting sysfs api (jsc#PED-14238).\n- crypto: qat/qat_6xxx - Fix NULL vs IS_ERR() check in adf_probe() (jsc#PED-14238).\n- crypto: sa2ul - Fix AEAD fallback algorithm names (git-fixes).\n- crypto: simd - reject compat registrations without __ prefixes (git-fixes).\n- crypto: talitos - fix SEC1 32k ahash request limitation (git-fixes).\n- crypto: tegra - Disable softirqs before finalizing request (git-fixes).\n- devres: fix missing node debug info in devm_krealloc() (git-fixes).\n- dmaengine: dw-axi-dmac: fix Alignment should match open parenthesis (git-fixes).\n- dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function (git-fixes).\n- dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() (git-fixes).\n- dpll: zl3073x: Add support to adjust phase (bsc#1255752).\n- dpll: zl3073x: Fix output pin phase adjustment sign (bsc#1255752).\n- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (bsc#1255752).\n- dpll: zl3073x: Specify phase adjustment granularity for pins (bsc#1255752).\n- drivers/base/memory: fix memory block reference leak in poison accounting (git-fixes).\n- drm/amd/display: Add NULL check for integrated_info in clk_mgr_construct (git-fixes).\n- drm/amd/display: Allow DCE link encoder without AUX registers (git-fixes).\n- drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths (git-fixes).\n- drm/amd/display: Change dither policy for 10 bpc output back to dithering (git-fixes).\n- drm/amd/display: Correct logic check error for fastboot (git-fixes).\n- drm/amd/display: Disable 10-bit truncation and dithering on DCE 6.x (git-fixes).\n- drm/amd/display: Disable fastboot on DCE 6 too (stable-fixes).\n- drm/amd/display: Read EDID from VBIOS embedded panel info (git-fixes).\n- drm/amd/pm/ci: Clear EnabledForActivity field for memory levels (git-fixes).\n- drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs (git-fixes).\n- drm/amd/pm/ci: Fill DW8 fields from SMC (git-fixes).\n- drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 (git-fixes).\n- drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled (git-fixes).\n- drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board (git-fixes).\n- drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock (git-fixes).\n- drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x (git-fixes).\n- drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) (git-fixes).\n- drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ (stable-fixes).\n- drm/amdgpu/gfx10: look at the right prop for gfx queue priority (git-fixes).\n- drm/amdgpu/gfx11: look at the right prop for gfx queue priority (git-fixes).\n- drm/amdgpu/gmc: Fix AMDGPU_GART_PLACEMENT_LOW to not overlap with VRAM (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.5 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.0 ring (git-fixes).\n- drm/amdgpu/pm: add missing revision check for CI (git-fixes).\n- drm/amdgpu/pm: align Hawaii mclk workaround with radeon (git-fixes).\n- drm/amdgpu/pm: drop SMU driver if version not matched messages (stable-fixes).\n- drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission (git-fixes).\n- drm/amdgpu/vce: Prevent partial address patches (stable-fixes).\n- drm/amdgpu/vcn3: Avoid overflow on msg bound check (git-fixes).\n- drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (stable-fixes).\n- drm/amdgpu/vcn4: Avoid overflow on msg bound check (git-fixes).\n- drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (stable-fixes).\n- drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (stable-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v4.0.5 enc ring (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v5.0.0 enc ring (git-fixes).\n- drm/amdgpu: Add bounds checking to ib_{get,set}_value (stable-fixes).\n- drm/amdgpu: Add default case in DVI mode validation (git-fixes).\n- drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG (git-fixes).\n- drm/amdgpu: fix zero-size GDS range init on RDNA4 (stable-fixes).\n- drm/amdgpu: gate VM CPU HDP flush on reset lock (stable-fixes).\n- drm/amdgpu: replace PASID IDR with XArray (git-fixes).\n- drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count (stable-fixes).\n- drm/amdgpu: zero-initialize GART table on allocation (stable-fixes).\n- drm/amdkfd: Add upper bound check for num_of_nodes (stable-fixes).\n- drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure (stable-fixes).\n- drm/amdkfd: Make all TLB-flushes heavy-weight (stable-fixes).\n- drm/amdkfd: validate SVM ioctl nattr against buffer size (stable-fixes).\n- drm/arcpgu: fix device node leak (git-fixes).\n- drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs (git-fixes).\n- drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check (git-fixes).\n- drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() (git-fixes).\n- drm/bridge: stm_lvds: Do not fail atomic_check on disabled connector (git-fixes).\n- drm/etnaviv: Fix armed job not being pushed to the DRM scheduler (git-fixes).\n- drm/exynos: remove bridge when component_add fails (git-fixes).\n- drm/fb-helper: Fix clipping when damage area spans a single scanline (git-fixes).\n- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (git-fixes).\n- drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup (git-fixes).\n- drm/gma500/oaktrail_lvds: fix hang on init failure (git-fixes).\n- drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init (git-fixes).\n- drm/i915/dp: Fix VSC dynamic range signaling for RGB formats (git-fixes).\n- drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (git-fixes).\n- drm/i915/wm: Verify the correct plane DDB entry (git-fixes).\n- drm/i915: skip __i915_request_skip() for already signaled requests (git-fixes).\n- drm/imagination: Switch reset_reason fields from enum to u32 (git-fixes).\n- drm/komeda: fix integer overflow in AFBC framebuffer size check (git-fixes).\n- drm/loongson: Use managed KMS polling (git-fixes).\n- drm/msm/a6xx: Fix dumping A650+ debugbus blocks (git-fixes).\n- drm/msm/a6xx: Fix HLSQ register dumping (git-fixes).\n- drm/msm/a6xx: Use barriers while updating HFI Q headers (git-fixes).\n- drm/msm/dpu: fix mismatch between power and frequency (git-fixes).\n- drm/msm/dsi: add the missing parameter description (git-fixes).\n- drm/msm/dsi: fix bits_per_pclk (git-fixes).\n- drm/msm/dsi: fix hdisplay calculation for CMD mode panel (git-fixes).\n- drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 (git-fixes).\n- drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata() (git-fixes).\n- drm/msm/shrinker: Fix can_block() logic (git-fixes).\n- drm/nouveau: fix nvkm_device leak on aperture removal failure (git-fixes).\n- drm/nouveau: fix u32 overflow in pushbuf reloc bounds check (git-fixes).\n- drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds (git-fixes).\n- drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds (git-fixes).\n- drm/panel: sharp-ls043t1le01: make use of prepare_prev_first (git-fixes).\n- drm/panel: simple: Correct G190EAN01 prepare timing (git-fixes).\n- drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() (git-fixes).\n- drm/panthor: Fix outdated function documentation (git-fixes).\n- drm/radeon: add missing revision check for CI (git-fixes).\n- drm/sun4i: backend: fix error pointer dereference (git-fixes).\n- drm/sun4i: Fix resource leaks (git-fixes).\n- drm/v3d: Handle error from drm_sched_entity_init() (git-fixes).\n- drm/vc4: Fix a memory leak in hang state error path (git-fixes).\n- drm/vc4: Fix memory leak of BO array in hang state (git-fixes).\n- drm/vc4: platform_get_irq_byname() returns an int (stable-fixes).\n- drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock (git-fixes).\n- drm/vc4: Release runtime PM reference after binding V3D (git-fixes).\n- drm/vram: remove DRM_VRAM_MM_FILE_OPERATIONS from docs (git-fixes).\n- drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked() (git-fixes).\n- drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked() (git-fixes).\n- drm/xe/debugfs: Correct printing of register whitelist ranges (git-fixes).\n- drm/xe/dma-buf: handle empty bo and UAF races (git-fixes).\n- drm/xe/gsc: Fix BO leak on error in query_compatibility_version() (git-fixes).\n- drm/xe/uapi: update used tracking kernel-doc (git-fixes).\n- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (git-fixes).\n- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (git-fixes).\n- dt-bindings: net: Fix Tegra234 MGBE PTP clock (git-fixes).\n- efi/capsule-loader: fix incorrect sizeof in phys array reallocation (git-fixes).\n- efi: pstore: Drop efivar lock when efi_pstore_open() returns with an error (git-fixes).\n- erofs: add GFP_NOIO in the bio completion if needed (git-fixes).\n- ext4: fix fsync(2) for nojournal mode (git-fixes).\n- ext4: make recently_deleted() properly work with lazy itable initialization (git-fixes).\n- ext4: reject mount if bigalloc with s_first_data_block != 0 (git-fixes).\n- extcon: Fixed sysfs duplicate filename issue (git-fixes).\n- extcon: ptn5150: handle pending IRQ events during system resume (git-fixes).\n- fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break (git-fixes).\n- fbdev: offb: fix PCI device reference leak on probe failure (git-fixes).\n- fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO (stable-fixes).\n- fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO (git-fixes).\n- firmware: arm_ffa: Use the correct buffer size during RXTX_MAP (git-fixes).\n- firmware: dmi: Correct an indexing error in dmi.h (git-fixes).\n- firmware: google: framebuffer: Do not mark framebuffer as busy (git-fixes).\n- firmware: google: framebuffer: Do not unregister platform device (git-fixes).\n- gpio: of: clear OF_POPULATED on hog nodes in remove path (git-fixes).\n- gpio: tegra: fix irq_release_resources calling enable instead of disable (git-fixes).\n- gtp: disable BH before calling udp_tunnel_xmit_skb() (git-fixes).\n- HID: alps: fix NULL pointer dereference in alps_raw_event() (git-fixes).\n- HID: amd_sfh: don't log error when device discovery fails with -EOPNOTSUPP (git-fixes).\n- HID: apple: ensure the keyboard backlight is off if suspending (git-fixes).\n- HID: asus: do not abort probe when not necessary (git-fixes).\n- HID: asus: make asus_resume adhere to linux kernel coding standards (git-fixes).\n- HID: core: clamp report_size in s32ton() to avoid undefined shift (stable-fixes).\n- HID: logitech-hidpp: Enable MX Master 4 over bluetooth (stable-fixes).\n- HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure (stable-fixes).\n- HID: multitouch: Check to ensure report responses match the request (stable-fixes).\n- HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 (stable-fixes).\n- HID: roccat: fix use-after-free in roccat_report_event (stable-fixes).\n- HID: usbhid: fix deadlock in hid_post_reset() (git-fixes).\n- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (stable-fixes).\n- hisi_acc_vfio_pci: add eq and aeq interruption restore (git-fixes).\n- hisi_acc_vfio_pci: bugfix cache write-back issue (git-fixes).\n- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (git-fixes).\n- hv_sock: fix ARM64 support (git-fixes).\n- hv_sock: update outdated comment for renamed vsock_stream_recvmsg() (git-fixes).\n- hwmon: (ads7871) Fix endianness bug in 16-bit register reads (git-fixes).\n- hwmon: (corsair-psu) Close HID device on probe errors (git-fixes).\n- hwmon: (lm63) Add locking to avoid TOCTOU (git-fixes).\n- hwmon: (ltc2992) Clamp threshold writes to hardware range (git-fixes).\n- hwmon: (ltc2992) Fix u32 overflow in power read path (git-fixes).\n- hwmon: (ltc4286) Add missing MODULE_IMPORT_NS(\"PMBUS\") (git-fixes).\n- hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt (git-fixes).\n- hwmon: (powerz) Fix use-after-free on USB disconnect (git-fixes).\n- hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data() (git-fixes).\n- i2c: s3c24xx: check the size of the SMBUS message before using it (stable-fixes).\n- i2c: smbus: reject oversized block transfers in the common path (git-fixes).\n- i2c: stm32f7: reinit_completion() per transfer not per msg (git-fixes).\n- i2c: stub: Reject I2C block transfers with invalid length (git-fixes).\n- i2c: tegra: Add HS mode support (bsc#1261550).\n- i2c: tegra: Add Tegra256 support (bsc#1261550).\n- i2c: tegra: Do not configure DMA if not supported (bsc#1261550).\n- i2c: tegra: Don't mark devices with pins as IRQ safe (stable-fixes).\n- i2c: tegra: Update Tegra256 timing parameters (bsc#1261550).\n- i2c: tegra: Use separate variables for fast and fastplus (bsc#1261550).\n- i3c: dw: Fix memory leak in dw_i3c_master_i3c_xfers() (git-fixes).\n- i3c: master: Fix error codes at send_ccc_cmd (git-fixes).\n- i3c: mipi-i3c-hci: fix IBI payload length calculation for final status (git-fixes).\n- ibmveth: Disable GSO for packets with small MSS (bsc#1265144).\n- iio: adc: ad7192: Revert \"properly check spi_get_device_match_data()\" (stable-fixes).\n- iio: adc: ad7768-1: fix one-shot mode data acquisition (git-fixes).\n- iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() (git-fixes).\n- iio: frequency: admv1013: add dev variable (stable-fixes).\n- iio: frequency: admv1013: fix NULL pointer dereference on str (git-fixes).\n- Input: bcm5974 - recover from failed mode switch (stable-fixes).\n- Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table (stable-fixes).\n- Input: uinput - fix circular locking dependency with ff-core (git-fixes).\n- Input: uinput - take event lock when submitting FF request \"event\" (stable-fixes).\n- Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode (stable-fixes).\n- Input: xpad - add support for Razer Wolverine V3 Pro (stable-fixes).\n- interconnect: debugfs: fix devm_kstrdup and kfree mismatch (git-fixes).\n- io_uring/timeout: check unused sqe fields (git-fixes).\n- iommu/amd: move wait_on_sem() out of spinlock (git-fixes bsc#1260593).\n- iommu/amd: serialize sequence allocation under concurrent TLB invalidations (git-fixes bsc#1260593).\n- iommu/vt-d: Remove LPIG from page group response descriptor (jsc#PED-16113).\n- ipmi: Add limits to event and receive message requests (git-fixes).\n- ipmi: Check event message buffer response for bad data (git-fixes).\n- ipmi: ssif_bmc: change log level to dbg in irq callback (git-fixes).\n- ipmi: ssif_bmc: fix message desynchronization after truncated response (git-fixes).\n- ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure (git-fixes).\n- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (git-fixes).\n- KVM: arm64: Allow cacheable stage 2 mapping using VMA flags (git-fixes).\n- KVM: arm64: Assume non-PFNMAP/MIXEDMAP VMAs can be mapped cacheable (git-fixes).\n- KVM: arm64: Block cacheable PFNMAP mapping (git-fixes).\n- KVM: arm64: Consolidate idreg callbacks (git-fixes).\n- KVM: arm64: Discard PC update state on vcpu reset (git-fixes).\n- KVM: arm64: Finalize ID registers only once per VM (git-fixes).\n- KVM: arm64: Fix MTE flag initialization for protected VMs (git-fixes).\n- KVM: arm64: Fix page leak in user_mem_abort() (git-fixes).\n- KVM: arm64: Fix Trace Buffer trap polarity for protected VMs (git-fixes).\n- KVM: arm64: Fix Trace Buffer trapping for protected VMs (git-fixes).\n- KVM: arm64: Fix vma_shift staleness on nested hwpoison path (git-fixes).\n- KVM: arm64: Hide S1POE from guests when not supported by the host (git-fixes).\n- KVM: arm64: Limit clearing of ID_{AA64PFR0,PFR1}_EL1.GIC to userspace irqchip (git-fixes).\n- KVM: arm64: Make all 32bit ID registers fully writable (git-fixes).\n- KVM: arm64: nv: Add trap config for DBGWCR\u003c15\u003e_EL1 (git-fixes).\n- KVM: arm64: nv: Return correct RES0 bits for FGT registers (git-fixes).\n- KVM: arm64: pkvm: Fallback to level-3 mapping on host stage-2 fault (git-fixes).\n- KVM: arm64: Read PMUVer as unsigned (git-fixes).\n- KVM: arm64: Rename the device variable to s2_force_noncacheable (git-fixes).\n- KVM: arm64: Return early from trace helpers when KVM isn't available (git-fixes).\n- KVM: arm64: Set ID_{AA64PFR0,PFR1}_EL1.GIC when GICv3 is configured (git-fixes).\n- KVM: arm64: vgic-v3: Release reserved slot outside of lpi_xa's lock (git-fixes).\n- KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes).\n- KVM: nSVM: Use vcpu-\u003earch.cr2 when updating vmcb12 on nested #VMEXIT (git-fixes).\n- KVM: nVMX: Add consistency check for TSC_MULTIPLIER=0 (git-fixes).\n- KVM: Reject wrapped offset in kvm_reset_dirty_gfn() (git-fixes).\n- KVM: SEV: Disallow LAUNCH_FINISH if vCPUs are actively being created (git-fixes).\n- KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (git-fixes).\n- KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish (git-fixes).\n- KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm-\u003elock (git-fixes).\n- KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU (git-fixes).\n- KVM: SVM: Disallow EFER.LMSLE when not supported by hardware (git-fixes).\n- KVM: SVM: Fix a missing kunmap_local() in sev_gmem_post_populate() (git-fixes).\n- KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC (git-fixes).\n- KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (git-fixes).\n- KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN (git-fixes).\n- KVM: SVM: Properly check RAX in the emulator for SVM instructions (git-fixes).\n- KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (git-fixes).\n- KVM: TDX: Explicitly set user-return MSRs that *may* be clobbered by the TDX-Module (git-fixes).\n- KVM: x86/mmu: Fix UBSAN warning when reading nx_huge_pages parameter (git-fixes).\n- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (git-fixes).\n- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (git-fixes).\n- KVM: x86: Advertise EferLmsleUnsupported to userspace (git-fixes).\n- KVM: x86: check for nEPT/nNPT in slow flush hypercalls (git-fixes).\n- KVM: X86: Fix array_index_nospec protection in __pv_send_ipi (git-fixes).\n- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (git-fixes).\n- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (git-fixes).\n- KVM: x86: Ignore cpuid faulting in SMM (git-fixes).\n- leds: lgm-sso: Remove duplicate assignments for priv-\u003emmap (git-fixes).\n- leds: qcom-lpg: Check for array overflow when selecting the high resolution (stable-fixes).\n- lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() (git-fixes).\n- md/raid1: fix the comparing region of interval tree (bsc#1261555).\n- md/raid1: serialize overlap io for writemostly disk (bsc#1261555).\n- media: amphion: Fix race between m2m job_abort and device_run (git-fixes).\n- media: as102: fix to not free memory after the device is registered in as102_usb_probe() (git-fixes).\n- media: chips-media: wave5: add missing spinlock protection for handle_dynamic_resolution_change() (git-fixes).\n- media: chips-media: wave5: add missing spinlock protection for send_eos_event() (git-fixes).\n- media: chips-media: wave5: fix a potential memory leak in wave5_vdi_init() (git-fixes).\n- media: dib8000: avoid division by 0 in dib8000_set_dds() (git-fixes).\n- media: em28xx: fix use-after-free in em28xx_v4l2_open() (git-fixes).\n- media: hackrf: fix to not free memory after the device is registered in hackrf_probe() (git-fixes).\n- media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() (git-fixes).\n- media: i2c: imx283: Enter full standby when stopping streaming (git-fixes).\n- media: i2c: imx283: Fix hang when going from large to small resolution (git-fixes).\n- media: i2c: imx412: Assert reset GPIO during probe (git-fixes).\n- media: i2c: ov08d10: fix image vertical start setting (git-fixes).\n- media: i2c: ov8856: free control handler on error in ov8856_init_controls() (git-fixes).\n- media: intel/ipu6: fix error pointer dereference (git-fixes).\n- media: mtk-jpeg: fix use-after-free in release path due to uncancelled work (git-fixes).\n- media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 (git-fixes).\n- media: omap3isp: drop the use count of v4l2 pipeline (git-fixes).\n- media: pci: zoran: fix potential memory leak in zoran_probe() (git-fixes).\n- media: rc: streamzap: Error handling in probe (git-fixes).\n- media: rc: xbox_remote: heed DMA restrictions (git-fixes).\n- media: saa7164: add ioremap return checks and cleanups (git-fixes).\n- media: staging: imx: configure src_mux in csi_start (git-fixes).\n- media: staging: imx: request mbus_config in csi_start (git-fixes).\n- media: uvcvideo: Enable VB2_DMABUF for metadata stream (git-fixes).\n- media: videobuf2: Set vma_flags in vb2_dma_sg_mmap (git-fixes).\n- media: vidtv: fix nfeeds state corruption on start_streaming failure (git-fixes).\n- media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections (git-fixes).\n- media: vidtv: fix pass-by-value structs causing MSAN warnings (git-fixes).\n- memory: tegra30-emc: Fix dll_change check (git-fixes).\n- memory: tegra124-emc: Fix dll_change check (git-fixes).\n- mfd: core: Preserve OF node when ACPI handle is present (git-fixes).\n- mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() (git-fixes).\n- mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused (git-fixes).\n- mkspec: Add signature to source list only when it exists.\n- mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration (git-fixes).\n- mmc: vub300: fix NULL-deref on disconnect (git-fixes).\n- modpost: Amend ppc64 save/restfpr symnames for -Os build (bsc#1215199).\n- mtd: docg3: fix use-after-free in docg3_release() (git-fixes).\n- mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions (git-fixes).\n- mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path (git-fixes).\n- mtd: physmap_of_gemini: Fix disabled pinctrl state check (git-fixes).\n- mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob (git-fixes).\n- mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations (git-fixes).\n- mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() (git-fixes).\n- mtd: spi-nor: sst: Fix write enable before AAI sequence (git-fixes).\n- mtd: spi-nor: swp: check SR_TB flag when getting tb_mask (git-fixes).\n- net-shapers: don't free reply skb after genlmsg_reply() (git-fixes).\n- net/mlx5: Fix HCA caps leak on notifier init failure (git-fixes).\n- net/rds: reset op_nents when zerocopy page pin fails (bsc#1265626).\n- net/sched: cls_fw: fix NULL dereference of \"old\" filters before change() (git-fixes).\n- net/sched: fix pedit partial COW leading to page cache corruption (bsc#1265421).\n- net: gro: don't merge zcopy skbs (git-fixes).\n- net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf (git-fixes).\n- net: mana: Add MAC address to vPort logs and clarify error messages (git-fixes).\n- net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq() (git-fixes).\n- net: mana: Don't overwrite port probe error with add_adev result (git-fixes).\n- net: mana: Fix crash from unvalidated SHM offset read from BAR0 during FLR (bsc#1265846).\n- net: mana: Fix EQ leak in mana_remove on NULL port (git-fixes).\n- net: mana: Fix RX skb truesize accounting (bsc#1248754).\n- net: mana: Guard mana_remove against double invocation (git-fixes).\n- net: mana: hardening: Validate adapter_mtu from MANA_QUERY_DEV_CONFIG (git-fixes).\n- net: mana: hardening: Validate doorbell ID from GDMA_REGISTER_DEVICE response (git-fixes).\n- net: mana: Init gf_stats_work before potential error paths in probe (git-fixes).\n- net: mana: Init link_change_work before potential error paths in probe (git-fixes).\n- net: mana: Move current_speed debugfs file to mana_init_port() (git-fixes).\n- net: mana: remove double CQ cleanup in mana_create_rxq error path (git-fixes).\n- net: mana: Set default number of queues to 16 (bsc#1261648).\n- net: mana: Skip WQ object destruction for uninitialized RXQ (git-fixes).\n- net: mana: Use at least SZ_4K in doorbell ID range check (git-fixes).\n- net: mana: Use pci_name() for debugfs directory naming (git-fixes).\n- net: phy: broadcom: Save PHY counters during suspend (git-fixes).\n- net: phy: DP83TC811: add reading of abilities (git-fixes).\n- net: phy: dp83869: fix setting CLK_O_SEL field (git-fixes).\n- net: phy: fix a return path in get_phy_c45_ids() (git-fixes).\n- net: phy: qcom: at803x: Use the correct bit to disable extended next page (git-fixes).\n- net: stmmac: Fix PTP ref clock for Tegra234 (git-fixes).\n- net: usb: asix: ax88772: re-add usbnet_link_change() in phylink callbacks (git-fixes).\n- net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() (git-fixes).\n- net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() (git-fixes).\n- net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit (git-fixes).\n- net: wan: fsl_ucc_hdlc: fix ucc_hdlc_remove (git-fixes).\n- net: wan: fsl_ucc_hdlc: fix uhdlc_memclean (git-fixes).\n- net: wan: fsl_ucc_hdlc: free tx_skbuff in uhdlc_memclean (git-fixes).\n- net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler (git-fixes).\n- NFC: digital: Bounds check NFC-A cascade depth in SDD response handler (git-fixes).\n- nfc: llcp: add missing return after LLCP_CLOSED checks (git-fixes).\n- nfc: pn533: allocate rx skb before consuming bytes (git-fixes).\n- nfc: s3fwrn5: allocate rx skb before consuming bytes (git-fixes).\n- NFC: trf7970a: Ignore antenna noise when checking for RF field (git-fixes).\n- nvme-apple: drop invalid put of admin queue reference count (git-fixes).\n- nvme-auth: Include SC_C in RVAL controller hash (bsc#1260428).\n- nvme-loop: do not cancel I/O and admin tagset during ctrl reset/shutdown (bsc#1262709).\n- nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 (git-fixes).\n- nvme: Allow reauth from sysfs (bsc#1259672).\n- nvme: Expose the tls_configured sysfs for secure concat connections (bsc#1259672).\n- nvme: expose TLS mode (bsc#1259672).\n- nvme: fix admin queue leak on controller reset (git-fixes).\n- nvme: fix PCIe subsystem reset controller state transition (bsc#1261738).\n- nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers (git-fixes).\n- ocfs2: fix possible deadlock between unlink and dio_end_io_write (bsc#1258718).\n- ocfs2: split transactions in dio completion to avoid credit exhaustion (bsc#1258718).\n- openvswitch: vport: fix self-deadlock on release of tunnel ports (git-fixes).\n- panic/printk: replace other_cpu_in_panic() with panic_on_other_cpu() (bsc#1261149).\n- panic/printk: replace this_cpu_in_panic() with panic_on_this_cpu() (bsc#1261149).\n- panic: introduce helper functions for panic state (bsc#1261149).\n- panic: use angle-bracket include for panic.h (bsc#1261149).\n- PCI/AER: Clear only error bits in PCIe Device Status (git-fixes).\n- PCI/AER: Stop ruling out unbound devices as error source (git-fixes).\n- PCI/ASPM: Fix pci_clear_and_set_config_dword() usage (git-fixes).\n- PCI/NPEM: Set LED_HW_PLUGGABLE for hotplug-capable ports (git-fixes).\n- PCI/TPH: Allow TPH enable for RCiEPs (git-fixes).\n- PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well (git-fixes).\n- PCI: dwc: rcar-gen4: Change EPC BAR alignment to 4K as per the documentation (git-fixes).\n- PCI: Enable AtomicOps only if Root Port supports them (git-fixes).\n- PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown (git-fixes).\n- PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup (git-fixes).\n- PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete (git-fixes).\n- PCI: hv: Set default NUMA node to 0 for devices without affinity info (bsc#1261648).\n- PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found (git-fixes).\n- PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion support (git-fixes).\n- PCI: tegra194: Allow system suspend when the Endpoint link is not up (git-fixes).\n- PCI: tegra194: Disable direct speed change for Endpoint mode (git-fixes).\n- PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down (git-fixes).\n- PCI: tegra194: Disable PERST# IRQ only in Endpoint mode (git-fixes).\n- PCI: tegra194: Fix CBB timeout caused by DBI access before core power-on (git-fixes).\n- PCI: tegra194: Fix polling delay for L2 state (git-fixes).\n- PCI: tegra194: Free up Endpoint resources during remove() (git-fixes).\n- PCI: tegra194: Increase LTSSM poll time on surprise link down (git-fixes).\n- PCI: tegra194: Set LTR message request before PCIe link up in Endpoint mode (git-fixes).\n- PCI: tegra194: Use devm_gpiod_get_optional() to parse \"nvidia,refclk-select\" (git-fixes).\n- PCI: tegra194: Use DWC IP core version (git-fixes).\n- pinctrl: abx500: Fix type of 'argument' variable (git-fixes).\n- pinctrl: Fix spelling problem (git-fixes).\n- pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) (stable-fixes).\n- pinctrl: pic32: change all cases of bare 'unsigned' to 'unsigned int' (git-fixes).\n- pinctrl: pic32: use consistent spacing around '+' (git-fixes).\n- pinctrl: pinctrl-pic32: Fix resource leak (git-fixes).\n- pinctrl: realtek: Fix function signature for config argument (git-fixes).\n- pinctrl: renesas: rzg2l: Fix save/restore of {IOLH,IEN,PUPD,SMT} registers (git-fixes).\n- platform/chrome: chromeos_tbmc: Drop wakeup source on remove (git-fixes).\n- platform/surface: surfacepro3_button: Drop wakeup source on remove (git-fixes).\n- platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug (stable-fixes).\n- platform/x86/intel-uncore-freq: Handle autonomous UFS status bit (git-fixes).\n- platform/x86: asus-wmi: adjust screenpad power/brightness handling (git-fixes).\n- platform/x86: asus-wmi: fix screenpad brightness range (git-fixes).\n- platform/x86: dell-wmi-sysman: bound enumeration string aggregation (git-fixes).\n- platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() (git-fixes).\n- platform/x86: hp-wmi: Ignore backlight and FnLock events (stable-fixes).\n- platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup (git-fixes).\n- power: supply: axp288_charger: Do not cancel work before initializing it (git-fixes).\n- power: supply: max17042: avoid overflow when determining health (git-fixes).\n- powerpc/crash: fix backup region offset update to elfcorehdr (bsc#1259535).\n- powerpc/crash: Update backup region offset in elfcorehdr on memory hotplug (bsc#1259535).\n- printk/nbcon/panic: Allow printk kthread to sleep when the system is in panic (bsc#1261149).\n- printk/nbcon: Block printk kthreads when any CPU is in an emergency context (bsc#1261149).\n- printk/nbcon: Release nbcon consoles ownership in atomic flush after each emitted record (bsc#1261149).\n- printk/nbcon: Restore IRQ in atomic flush after each emitted record (bsc#1261149).\n- printk/nbcon: use panic_on_this_cpu() helper (bsc#1261149).\n- printk: Allow printk_trigger_flush() to flush all types (bsc#1262750).\n- printk: Allow to use the printk kthread immediately even for 1st nbcon (jsc#PED-7912).\n- printk: Avoid irq_work for printk_deferred() on suspend (bsc#1262750).\n- printk: Avoid scheduling irq_work on suspend (bsc#1262750).\n- printk: console_flush_one_record() code cleanup (bsc#1261149).\n- printk: Introduce console_flush_one_record (bsc#1261149).\n- printk: Use console_flush_one_record for legacy printer kthread (bsc#1261149).\n- pwm: imx-tpm: Count the number of enabled channels in probe (git-fixes).\n- qat: don't mess with -\u003ed_name (jsc#PED-14238).\n- r8152: fix incorrect register write to USB_UPHY_XTAL (git-fixes).\n- RDMA/irdma: Fix double free related to rereg_user_mr (git-fixes).\n- RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() (git-fixes).\n- RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() (git-fixes).\n- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (git-fixes).\n- RDMA/mana: Validate rx_hash_key_len (git-fixes).\n- RDMA/mana_ib: cleanup the usage of mana_gd_send_request() (git-fixes).\n- RDMA/mana_ib: Disable RX steering on RSS QP destroy (git-fixes).\n- RDMA/mana_ib: Support memory windows (git-fixes).\n- regulator: act8945a: fix OF node reference imbalance (git-fixes).\n- regulator: bd9571mwv: fix OF node reference imbalance (git-fixes).\n- regulator: max77650: fix OF node reference imbalance (git-fixes).\n- regulator: mt6357: fix OF node reference imbalance (git-fixes).\n- regulator: rk808: fix OF node reference imbalance (git-fixes).\n- remoteproc: xlnx: Fix sram property parsing (git-fixes).\n- remoteproc: xlnx: Only access buffer information if IPI is buffered (git-fixes).\n- Revert \"ALSA: usb: Increase volume range that triggers a warning\" (git-fixes).\n- Revert \"serial: 8250: Revert \"drop lockdep annotation from serial8250_clear_IER()\"\" (bsc#1262480).\n- Revert \"serial: 8250: Switch to nbcon console\" (bsc#1262480).\n- rtc: abx80x: Disable alarm feature if no interrupt attached (git-fixes).\n- rtc: ntxec: fix OF node reference imbalance (git-fixes).\n- s390/dasd: Copy detected format information to secondary device (bsc#1259994).\n- s390/dasd: Fix gendisk parent after copy pair swap (bsc#1259994).\n- s390/dasd: Move quiesce state with pprc swap (bsc#1259994).\n- sched/fair: Change likelyhood of nohz.nr_cpus (bsc#1234634 bsc#1258961).\n- sched/fair: Move checking for nohz cpus after time check (bsc#1234634 bsc#1258961).\n- sched/fair: Remove nohz.nr_cpus and use weight of cpumask instead (bsc#1234634 bsc#1258961).\n- scsi: lpfc: Add clean up of aborted NVMe commands during PCI fcn reset (bsc#1262019).\n- scsi: lpfc: Add log messages to fabric login error labels (bsc#1262019).\n- scsi: lpfc: Add PCI ID support for LPe42100 series adapters (bsc#1262019).\n- scsi: lpfc: Add REG_VFI mailbox cmd error handling (bsc#1262019).\n- scsi: lpfc: Break out of IRQ affinity assignment when mask reaches nr_cpu_ids (bsc#1262019).\n- scsi: lpfc: Check ASIC_ID register to aid diagnostics during failed fw updates (bsc#1262019).\n- scsi: lpfc: Cleanup error exit paths in lpfc_fdmi_cmd() and associated messages (bsc#1262019).\n- scsi: lpfc: ELIMINATE kernel-doc warnings in lpfc.h (bsc#1262019).\n- scsi: lpfc: Fix incorrect txcmplq_cnt during cleanup in lpfc_sli_abort_ring() (bsc#1262019).\n- scsi: lpfc: Introduce 128G link speed selection and support (bsc#1262019).\n- scsi: lpfc: Log discarded and insufficient RQE buffer events (bsc#1262019).\n- scsi: lpfc: Log MCQE contents for mbox commands with no context (bsc#1262019).\n- scsi: lpfc: Properly set WC for DPP mapping (bsc#1262019).\n- scsi: lpfc: Reduce pointer chasing when accessing vmid_flag (bsc#1262019).\n- scsi: lpfc: Remove deprecated PBDE feature (bsc#1262019).\n- scsi: lpfc: Remove unnecessary ndlp kref get in lpfc_check_nlp_post_devloss (bsc#1262019).\n- scsi: lpfc: Restrict first burst to non-FCoE and SLI4 adapters only (bsc#1262019).\n- scsi: lpfc: Select mailbox rq_create cmd version based on SLI4 if_type (bsc#1262019).\n- scsi: lpfc: Update class of service bit field to 3 bits for WQE submissions (bsc#1262019).\n- scsi: lpfc: Update construction of SGL when XPSGL is enabled (bsc#1262019).\n- scsi: lpfc: Update copyright year string for 2026 (bsc#1262019).\n- scsi: lpfc: Update log message when ndlp kref get is unsuccessful (bsc#1262019).\n- scsi: lpfc: Update lpfc version to 14.4.0.14 (bsc#1262019).\n- scsi: lpfc: Update lpfc version to 15.0.0.0 (bsc#1262019).\n- scsi: lpfc: Update outdated comment for renamed lpfc_freenode() (bsc#1262019).\n- scsi: lpfc: Use min_t() instead of min() in lpfc_sli4_driver_resource_setup (bsc#1262019).\n- scsi: lpfc: Use the crc32c() function (bsc#1262019).\n- scsi: mpi3mr: Add NULL checks when resetting request and reply queues (git-fixes).\n- scsi: ses: Fix devices attaching to different hosts (git-fixes).\n- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (git-fixes).\n- scsi: target: iscsi: validate CHAP_R length before base64 decode (bsc#1265449).\n- scsi: ufs: ufs-pci: Add support for Intel Wildcat Lake (jsc#PED-13771).\n- selftests/bpf: Test cross-sign 64bits range refinement (git-fixes).\n- selftests/bpf: Test invariants on JSLT crossing sign (git-fixes).\n- selftests/bpf: test refining u32/s32 bounds when ranges cross min/max boundary (git-fixes).\n- selftests: net: build net/lib dependency in all target (bsc#1262245).\n- selinux: don't reserve xattr slot when we won't fill it (stable-fixes).\n- selinux: prune /sys/fs/selinux/disable (stable-fixes).\n- selinux: shrink critical section in sel_write_load() (stable-fixes).\n- serial: 8250: Add serial8250_handle_irq_locked() (bsc#1262480).\n- serial: 8250: Protect LCR write in shutdown (bsc#1262480).\n- serial: 8250_dw: Avoid unnecessary LCR writes (bsc#1262480).\n- serial: 8250_dw: Ensure BUSY is deasserted (bsc#1262480).\n- serial: 8250_dw: Rework dw8250_handle_irq() locking and IIR handling (bsc#1262480).\n- serial: 8250_dw: Rework IIR_NO_INT handling to stop interrupt storm (bsc#1262480).\n- Set CONFIG_INTEL_TSX_MODE to follow upstream AUTO default (bsc#1263044).\n- soc/tegra: cbb: Set ERD on resume for err interrupt (git-fixes).\n- soc: qcom: aoss: compare against normalized cooling state (git-fixes).\n- soc: qcom: llcc: fix v1 SB syndrome register offset (git-fixes).\n- soc: qcom: ocmem: make the core clock optional (git-fixes).\n- soc: qcom: ocmem: register reasons for probe deferrals (git-fixes).\n- soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available (git-fixes).\n- sound: ua101: fix division by zero at probe (git-fixes).\n- soundwire: bus: demote UNATTACHED state warnings to dev_dbg() (git-fixes).\n- soundwire: cadence: Clear message complete before signaling waiting thread (git-fixes).\n- soundwire: debugfs: initialize firmware_file to empty string (git-fixes).\n- spi: aspeed-smc: fix controller deregistration (git-fixes).\n- spi: at91-usart: fix controller deregistration (git-fixes).\n- spi: atmel: fix controller deregistration (git-fixes).\n- spi: bcm63xx: fix controller deregistration (git-fixes).\n- spi: bcmbca-hsspi: fix controller deregistration (git-fixes).\n- spi: cadence: fix controller deregistration (git-fixes).\n- spi: cadence: fix unclocked access on unbind (git-fixes).\n- spi: ch341: fix memory leaks on probe failures (git-fixes).\n- spi: coldfire-qspi: fix controller deregistration (git-fixes).\n- spi: dln2: fix controller deregistration (git-fixes).\n- spi: fix controller cleanup() documentation (git-fixes).\n- spi: fix misleading controller deregistration kernel-doc (git-fixes).\n- spi: fix misleading controller registration kernel-doc (git-fixes).\n- spi: fsl-espi: fix controller deregistration (git-fixes).\n- spi: fsl-qspi: Use reinit_completion() for repeated operations (git-fixes).\n- spi: fsl: fix controller deregistration (git-fixes).\n- spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo (git-fixes).\n- spi: img-spfi: fix controller deregistration (git-fixes).\n- spi: imx: fix runtime pm leak on probe deferral (git-fixes).\n- spi: imx: fix use-after-free on unbind (git-fixes).\n- spi: lantiq-ssc: fix controller deregistration (git-fixes).\n- spi: meson-spicc: fix controller deregistration (git-fixes).\n- spi: microchip-core-qspi: fix controller deregistration (git-fixes).\n- spi: mpc52xx: fix controller deregistration (git-fixes).\n- spi: mpc52xx: fix use-after-free on registration failure (git-fixes).\n- spi: mpc52xx: fix use-after-free on unbind (git-fixes).\n- spi: mtk-nor: fix controller deregistration (git-fixes).\n- spi: mtk-snfi: fix memory leak in probe (git-fixes).\n- spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback (git-fixes).\n- spi: mxic: fix controller deregistration (git-fixes).\n- spi: mxs: fix controller deregistration (git-fixes).\n- spi: npcm-pspi: fix controller deregistration (git-fixes).\n- spi: omap2-mcspi: fix controller deregistration (git-fixes).\n- spi: orion: fix clock imbalance on registration failure (git-fixes).\n- spi: orion: fix controller deregistration (git-fixes).\n- spi: orion: fix runtime pm leak on unbind (git-fixes).\n- spi: pic32-sqi: fix controller deregistration (git-fixes).\n- spi: pic32: fix controller deregistration (git-fixes).\n- spi: pl022: fix controller deregistration (git-fixes).\n- spi: qup: fix controller deregistration (git-fixes).\n- spi: rockchip: fix controller deregistration (git-fixes).\n- spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ (git-fixes).\n- spi: rspi: fix controller deregistration (git-fixes).\n- spi: s3c64xx: fix controller deregistration (git-fixes).\n- spi: s3c64xx: fix NULL-deref on driver unbind (git-fixes).\n- spi: sh-hspi: fix controller deregistration (git-fixes).\n- spi: sprd: fix controller deregistration (git-fixes).\n- spi: st-ssc4: fix controller deregistration (git-fixes).\n- spi: sun4i: fix controller deregistration (git-fixes).\n- spi: sun6i: fix controller deregistration (git-fixes).\n- spi: syncuacer: fix controller deregistration (git-fixes).\n- spi: ti-qspi: fix controller deregistration (git-fixes).\n- spi: topcliff-pch: fix controller deregistration (git-fixes).\n- spi: topcliff-pch: fix use-after-free on unbind (git-fixes).\n- spi: uniphier: fix controller deregistration (git-fixes).\n- spi: uniphier: Simplify clock handling with devm_clk_get_enabled() (stable-fixes).\n- spi: zynq-qspi: fix controller deregistration (git-fixes).\n- spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() (stable-fixes).\n- spi: zynqmp-gqspi: fix controller deregistration (git-fixes).\n- staging: media: atomisp: Disallow all private IOCTLs (git-fixes).\n- staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() (git-fixes).\n- staging: sm750fb: fix division by zero in ps_to_hz() (git-fixes).\n- staging: vme_user: fix root device leak on init failure (git-fixes).\n- tg3: replace placeholder MAC address with device property (git-fixes).\n- thermal/drivers/spear: Fix error condition for reading st,thermal-flags (git-fixes).\n- thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp (git-fixes).\n- thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata (git-fixes).\n- tools/power/turbostat: Fix microcode patch level output for AMD/Hygon (git-fixes).\n- tools: hv: Fix cross-compilation (git-fixes).\n- tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public() (git-fixes).\n- tpm: avoid -Wunused-but-set-variable (git-fixes).\n- tpm: Fix auth session leak in tpm2_get_random() error path (git-fixes).\n- tpm: tpm_tis: add error logging for data transfer (git-fixes).\n- tpm: tpm_tis: stop transmit if retries are exhausted (git-fixes).\n- tpm: Use kfree_sensitive() to free auth session in tpm_dev_release() (git-fixes).\n- tty: serial: ip22zilog: Fix section mispatch warning (git-fixes).\n- udp: Force compute_score to always inline (bsc#1241259).\n- unshare: fix unshare_fs() handling (git-fixes).\n- USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen (git-fixes).\n- usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (git-fixes).\n- usb: chipidea: otg: not wait vbus drop if use role_switch (git-fixes).\n- USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam (stable-fixes).\n- usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer (stable-fixes).\n- usb: gadget: f_hid: Add missing error code (git-fixes).\n- usb: gadget: f_hid: don't call cdev_init while cdev in use (git-fixes).\n- usb: gadget: f_hid: move list and spinlock inits from bind to alloc (stable-fixes).\n- usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() (git-fixes).\n- usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() (git-fixes).\n- usb: gadget: f_uac1_legacy: validate control request size (stable-fixes).\n- usb: gadget: renesas_usb3: validate endpoint index in standard request handlers (git-fixes).\n- usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo (git-fixes).\n- USB: omap_udc: DMA: Don't enable burst 4 mode (git-fixes).\n- usb: port: add delay after usb_hub_set_port_power() (git-fixes).\n- usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive (stable-fixes).\n- USB: serial: io_edgeport: add support for Blackbox IC135A (stable-fixes).\n- USB: serial: option: add MeiG Smart SRM825WN (stable-fixes).\n- USB: serial: option: add support for Rolling Wireless RW135R-GL (stable-fixes).\n- USB: serial: option: add Telit Cinterion FN990A MBIM composition (git-fixes).\n- USB: serial: option: add Telit Cinterion LE910Cx compositions (stable-fixes).\n- usb: storage: Expand range of matched versions for VL817 quirks entry (git-fixes).\n- usb: typec: tcpm: reset internal port states on soft reset AMS (git-fixes).\n- usb: ulpi: fix memory leak on ulpi_register() error paths (git-fixes).\n- usb: usblp: fix heap leak in IEEE 1284 device ID via short response (stable-fixes).\n- usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl (stable-fixes).\n- usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() (git-fixes).\n- usbip: validate number_of_packets in usbip_pack_ret_submit() (git-fixes).\n- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (git-fixes).\n- vfio/pds: Fix memory leak in pds_vfio_dirty_enable() (git-fixes).\n- vfio/pds: Fix missing detach_ioas op (git-fixes).\n- vfio/pds: replace bitmap_free with vfree (git-fixes).\n- vfio/type1: Fix error unwind in migration dirty bitmap allocation (git-fixes).\n- vfio: Fix unbalanced vfio_df_close call in no-iommu mode (git-fixes).\n- vfio: Prevent open_count decrement to negative (git-fixes).\n- virt: arm-cca-guest: fix error check for RSI_INCOMPLETE (git-fixes).\n- virt: sev-guest: Do not use host-controlled page order in cleanup path (git-fixes).\n- virt: tdx-guest: Fix handling of host controlled 'quote' buffer length (git-fixes).\n- virt: tdx-guest: Return error for GetQuote failures (git-fixes).\n- wifi: ath5k: do not access array OOB (git-fixes).\n- wifi: ath9k: Fix typo (git-fixes).\n- wifi: ath10k: fix station lookup failure during disconnect (git-fixes).\n- wifi: ath11k: fix memory leaks in beacon template setup (git-fixes).\n- wifi: ath12k: fix leak in some ath12k_wmi_xxx() functions (git-fixes).\n- wifi: ath12k: use lockdep_assert_in_rcu_read_lock() for RCU assertions (git-fixes).\n- wifi: b43: enforce bounds check on firmware key index in b43_rx() (git-fixes).\n- wifi: b43legacy: enforce bounds check on firmware key index in RX path (git-fixes).\n- wifi: brcmfmac: Fix error pointer dereference (git-fixes).\n- wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task (git-fixes).\n- wifi: brcmfmac: validate bsscfg indices in IF events (stable-fixes).\n- wifi: brcmsmac: Fix dma_free_coherent() size (git-fixes).\n- wifi: cw1200: Revert \"Fix locking in error paths\" (git-fixes).\n- wifi: libertas: notify firmware load wait on disconnect (git-fixes).\n- wifi: mac80211: check ieee80211_rx_data_set_link return in pubsta MLO path (git-fixes).\n- wifi: mac80211: check tdls flag in ieee80211_tdls_oper (stable-fixes).\n- wifi: mac80211: drop stray 'static' from fast-RX rx_result (git-fixes).\n- wifi: mac80211: handle VHT EXT NSS in ieee80211_determine_our_sta_mode() (git-fixes).\n- wifi: mac80211: remove station if connection prep fails (git-fixes).\n- wifi: mac80211: use safe list iteration in radar detect work (git-fixes).\n- wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req() (git-fixes).\n- wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor (stable-fixes).\n- wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling (git-fixes).\n- wifi: mt76: mt7615: fix use_cts_prot support (git-fixes).\n- wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() (git-fixes).\n- wifi: mt76: mt7915: fix use_cts_prot support (git-fixes).\n- wifi: mt76: mt7921: fix 6GHz regulatory update on connection (git-fixes).\n- wifi: mt76: mt7921: fix a potential clc buffer length underflow (git-fixes).\n- wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work (git-fixes).\n- wifi: mt76: mt7921: Place upper limit on station AID (git-fixes).\n- wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() (git-fixes).\n- wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr (git-fixes).\n- wifi: mt76: mt7925: fix incorrect length field in txpower command (git-fixes).\n- wifi: mt76: mt7925: Fix incorrect MLO mode in firmware control (git-fixes).\n- wifi: mt76: mt7925: fix incorrect TLV length in CLC command (git-fixes).\n- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_tx_check_aggr() (git-fixes).\n- wifi: mt76: mt7925: prevent NULL vif dereference in mt7925_mac_write_txwi (git-fixes).\n- wifi: mt76: mt7996: fix FCS error flag check in RX descriptor (git-fixes).\n- wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event (git-fixes).\n- wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work() (git-fixes).\n- wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() (git-fixes).\n- wifi: nl80211: fix NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST usage (git-fixes).\n- wifi: nl80211: require admin perm on SET_PMK / DEL_PMK (git-fixes).\n- wifi: rsi: fix kthread lifetime race between self-exit and external-stop (git-fixes).\n- wifi: rt2x00usb: fix devres lifetime (git-fixes).\n- wifi: rtl8xxxu: fix potential use of uninitialized value (git-fixes).\n- wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet (git-fixes).\n- wifi: rtw88: Add additional USB IDs for RTL8812BU (bsc#1263135).\n- wifi: rtw88: Add BUFFALO WI-U3-866DHP to the USB ID list (bsc#1263135).\n- wifi: rtw88: Add support for Mercusys MA30N and D-Link DWA-T185 rev. A1 (bsc#1263135).\n- wifi: rtw88: check for PCI upstream bridge existence (git-fixes).\n- wifi: rtw88: fix device leak on probe failure (git-fixes).\n- wifi: rtw88: rtw8822bu VID/PID for BUFFALO WI-U2-866DM (bsc#1263135).\n- wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() (git-fixes).\n- wifi: wl1251: validate packet IDs before indexing tx_frames (stable-fixes).\n- x86/acpi/boot: Correct acpi_is_processor_usable() check again (git-fixes).\n- x86/boot/sev: Avoid shared GHCB page for early memory acceptance (git-fixes).\n- x86/boot/sev: Support memory acceptance in the EFI stub under SVSM (git-fixes).\n- x86/boot: Fix page table access in 5-level to 4-level paging transition (git-fixes).\n- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (bsc#1263255).\n- x86/cpufeatures: Free up unused feature bits (bsc#1263255).\n- x86/fred: Fix early boot failures on SEV-ES/SNP guests (git-fixes).\n- x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (git-fixes).\n- x86/sev: Add missing RIP_REL_REF() invocations during sme_enable() (git-fixes).\n- x86/sev: Do not touch VMSA pages during SNP guest memory kdump (git-fixes).\n- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (git-fixes).\n- x86/sev: Fix operator precedence in GHCB_MSR_VMPL_REQ_LEVEL macro (git-fixes).\n- x86/sev: Improve handling of writes to intercepted TSC MSRs (git-fixes).\n- x86/sev: Make sure pages are not skipped during kdump (git-fixes).\n- x86/tsx: Get the tsx= command line parameter with early_param() (bsc#1250951 bsc#1263044).\n- x86/tsx: Make tsx_ctrl_state static (bsc#1250951 bsc#1263044).\n- x86/vmware: Parse MP tables for SEV-SNP enabled guests under VMware hypervisors (git-fixes).\n- X.509: Fix out-of-bounds access when parsing extensions (git-fixes).\n- Xarray: do not return sibling entries from xas_find_marked() (bsc#1263815).\n","status":"published","published":"2026-05-28T11:40:20Z","modified":"2026-05-31T18:24:29.197819689Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:21845-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).\n- CVE-2024-14027: xattr: switch to CLASS(fd) (bsc#1259420).\n- CVE-2025-40181: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (bsc#1253471).\n- CVE-2025-68265: nvme: fix admin request_queue lifetime (bsc#1255360).\n- CVE-2025-68310: s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (bsc#1255160).\n- CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).\n- CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).\n- CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).\n- CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).\n- CVE-2026-23276: net: add xmit recursion limit to tunnel xmit functions (bsc#1260012).\n- CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).\n- CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).\n- CVE-2026-23316: net: ipv4: fix ARM64 alignment fault in multipath hash seed (bsc#1260573).\n- CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).\n- CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).\n- CVE-2026-23346: arm64: io: Rename ioremap_prot() to __ioremap_prot() (bsc#1260529).\n- CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).\n- CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).\n- CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).\n- CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).\n- CVE-2026-23375: mm: thp: deny THP for files on anonymous inodes (bsc#1260576).\n- CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).\n- CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).\n- CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).\n- CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).\n- CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).\n- CVE-2026-23417: bpf: Fix constant blinding for PROBE_MEM32 stores (bsc#1261410).\n- CVE-2026-23436: net: add helpers for lookup and walking netdevs under netdev_lock() (bsc#1261617).\n- CVE-2026-23437: net: shaper: protect late read accesses to the hierarchy (bsc#1261635).\n- CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).\n- CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).\n- CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).\n- CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).\n- CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).\n- CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).\n- CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).\n- CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).\n- CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).\n- CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).\n- CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).\n- CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).\n- CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on wakeup race (bsc#1261694).\n- CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).\n- CVE-2026-31395: bnxt_en: fix OOB access in DBG_BUF_PRODUCER async event handler (bsc#1261786).\n- CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).\n- CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).\n- CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).\n- CVE-2026-31406: xfrm: Fix work re-schedule after cancel in xfrm_nat_keepalive_net_fini() (bsc#1261629).\n- CVE-2026-31407: netfilter: conntrack: add missing netlink policy validations (bsc#1261632).\n- CVE-2026-31411: net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (bsc#1261752).\n- CVE-2026-31415: ipv6: avoid overflows in ip6_datagram_send_ctl() (bsc#1262099).\n- CVE-2026-31416: netfilter: nfnetlink_log: account for netlink header size (bsc#1262100).\n- CVE-2026-31420: bridge: mrp: reject zero test interval to avoid OOM panic (bsc#1262055).\n- CVE-2026-31421: net/sched: cls_fw: fix NULL pointer dereference on shared blocks (bsc#1262061).\n- CVE-2026-31422: net/sched: cls_flow: fix NULL pointer dereference on shared blocks (bsc#1262054).\n- CVE-2026-31423: net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() (bsc#1262063).\n- CVE-2026-31424: netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (bsc#1262053).\n- CVE-2026-31425: rds: ib: reject FRMR registration before IB connection is established (bsc#1262074).\n- CVE-2026-31427: netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp (bsc#1262086).\n- CVE-2026-31428: netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (bsc#1262087).\n- CVE-2026-31435: netfs: Fix read abandonment during retry (bsc#1262601).\n- CVE-2026-31449: ext4: validate p_idx bounds in ext4_ext_correct_indexes (bsc#1262616).\n- CVE-2026-31453: xfs: avoid dereferencing log items after push callbacks (bsc#1262617).\n- CVE-2026-31456: mm/pagewalk: fix race between concurrent split and refault (bsc#1262627).\n- CVE-2026-31494: net: cadence: macb: Synchronize stats calculations (bsc#1262671).\n- CVE-2026-31496: netfilter: nf_conntrack_expect: skip expectations in other netns via proc (bsc#1262673).\n- CVE-2026-31503: udp: Fix wildcard bind conflict check when using hash2 (bsc#1263077).\n- CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263085).\n- CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263093).\n- CVE-2026-31507: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer (bsc#1263095).\n- CVE-2026-31515: af_key: validate families in pfkey_send_migrate() (bsc#1262752).\n- CVE-2026-31519: btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create (bsc#1263012).\n- CVE-2026-31525: bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN (bsc#1262725).\n- CVE-2026-31526: bpf: Fix exception exit lock checking for subprogs (bsc#1262662).\n- CVE-2026-31528: perf: Make sure to use pmu_ctx-\u003epmu for groups (bsc#1263001).\n- CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262758).\n- CVE-2026-31547: drm/xe: Fix missing runtime PM reference in ccs_mode_store (bsc#1263018).\n- CVE-2026-31550: pmdomain: bcm: bcm2835-power: Increase ASB control timeout (bsc#1263104).\n- CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263107).\n- CVE-2026-31565: RDMA/irdma: Fix deadlock during netdev reset with active connections (bsc#1263064).\n- CVE-2026-31579: wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit (bsc#1263074).\n- CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263176).\n- CVE-2026-31588: KVM: x86: Use scratch field in MMIO fragment to hold small write values (bsc#1263165).\n- CVE-2026-31644: net: lan966x: fix use-after-free and leak in lan966x_fdma_reload() (bsc#1263048).\n- CVE-2026-31649: net: stmmac: fix integer underflow in chain mode (bsc#1263582).\n- CVE-2026-31658: net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() (bsc#1263052).\n- CVE-2026-31662: tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (bsc#1263131).\n- CVE-2026-31666: btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref() (bsc#1263138).\n- CVE-2026-31668: seg6: separate dst_cache for input and output paths in seg6 lwtunnel (bsc#1263140).\n- CVE-2026-31669: mptcp: fix slab-use-after-free in __inet_lookup_established (bsc#1263141).\n- CVE-2026-31675: net/sched: sch_netem: fix out-of-bounds access in packet corruption (bsc#1263556).\n- CVE-2026-31678: openvswitch: defer tunnel netdev_put to RCU release (bsc#1263562).\n- CVE-2026-31679: openvswitch: validate MPLS set/set_masked payload length (bsc#1263592).\n- CVE-2026-31681: netfilter: xt_multiport: validate range encoding in checkentry (bsc#1263593).\n- CVE-2026-31682: bridge: br_nd_send: linearize skb before parsing ND options (bsc#1263595).\n- CVE-2026-31684: net: sched: act_csum: validate nested VLAN headers (bsc#1263596).\n- CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263668).\n- CVE-2026-31691: igb: remove napi_synchronize() in igb_down() (bsc#1263604).\n- CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263901).\n- CVE-2026-31700: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (bsc#1263882).\n- CVE-2026-31738: vxlan: validate ND option lengths in vxlan_na_create (bsc#1264059).\n- CVE-2026-31787: xen/privcmd: fix double free via VMA splitting (bsc#1262181).\n- CVE-2026-43009: bpf: Fix incorrect pruning due to atomic fetch precision tracking (bsc#1264014).\n- CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1263931).\n- CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1263933).\n- CVE-2026-43037: ip6_tunnel: clear skb2-\u003ecb in ip4ip6_err() (bsc#1263995).\n- CVE-2026-43038: ipv6: icmp: clear skb2-\u003ecb in ip6_err_gen_icmpv6_unreach() (bsc#1264097).\n- CVE-2026-43045: mshv: Refactor and rename memory region handling functions (bsc#1263942).\n- CVE-2026-43050: atm: lec: fix use-after-free in sock_def_readable() (bsc#1264082).\n- CVE-2026-43060: netfilter: nft_ct: drop pending enqueued packets on removal (bsc#1264183).\n- CVE-2026-43082: net: txgbe: leave space for null terminators on property_entry (bsc#1264233).\n- CVE-2026-43088: net: af_key: zero aligned sockaddr tail in PF_KEY exports (bsc#1264469).\n- CVE-2026-43153: xfs: remove xfs_attr_leaf_hasname (bsc#1264586).\n- CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264848).\n- CVE-2026-43265: KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block() (bsc#1264427).\n- CVE-2026-43329: netfilter: flowtable: strictly check for maximum number of actions (bsc#1265085).\n- CVE-2026-43365: xfs: fix undersized l_iclog_roundoff values (bsc#1265119).\n- CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265116).\n- CVE-2026-43441: net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1264674).\n- CVE-2026-43494: net/rds: reset op_nents when zerocopy page pin fails (bsc#1265626).\n- CVE-2026-43503: net: skbuff: propagate shared-frag marker through frag-transfer helpers (bsc#1265960).\n\nThe following non security issues were fixed:\n\n- accel/qaic: Add overflow check to remap_pfn_range during mmap (git-fixes).\n- ACPI: AGDI: fix missing newline in error message (git-fixes).\n- ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug (git-fixes).\n- ACPI: scan: Use acpi_dev_put() in object add error paths (git-fixes).\n- ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO (git-fixes).\n- ACPI: video: force native backlight on HP OMEN 16 (8A44) (stable-fixes).\n- ACPI: video: Move Lenovo Legion S7 15ACH6 quirk to the right section (git-fixes).\n- ALSA: 6fire: Fix input volume change detection (git-fixes).\n- ALSA: 6fire: fix use-after-free on disconnect (git-fixes).\n- ALSA: aoa: i2sbus: clear stale prepared state (git-fixes).\n- ALSA: aoa: i2sbus: fix OF node lifetime handling (git-fixes).\n- ALSA: aoa: Skip devices with no codecs in i2sbus_resume() (git-fixes).\n- ALSA: aoa: Use guard() for mutex locks (stable-fixes).\n- ALSA: asihpi: avoid write overflow check warning (stable-fixes).\n- ALSA: caiaq: Don't abort when no input device is available (git-fixes).\n- ALSA: caiaq: Fix control_put() result and cache rollback (git-fixes).\n- ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path (git-fixes).\n- ALSA: caiaq: fix usb_dev refcount leak on probe failure (git-fixes).\n- ALSA: caiaq: Handle probe errors properly (git-fixes).\n- ALSA: caiaq: take a reference on the USB device in create_card() (git-fixes).\n- ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() (git-fixes).\n- ALSA: core: Fix potential data race at fasync handling (git-fixes).\n- ALSA: core: Serialize deferred fasync state checks (git-fixes).\n- ALSA: core: Validate compress device numbers without dynamic minors (git-fixes).\n- ALSA: ctxfi: Add fallback to default RSR for S/PDIF (git-fixes).\n- ALSA: ctxfi: Fix missing SPDIFI1 index handling (stable-fixes).\n- ALSA: ctxfi: Limit PTP to a single page (git-fixes).\n- ALSA: firewire-tascam: Do not drop unread control events (git-fixes).\n- ALSA: fireworks: bound device-supplied status before string array lookup (git-fixes).\n- ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 (stable-fixes).\n- ALSA: hda/realtek - fixed speaker no sound update (git-fixes).\n- ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk (stable-fixes).\n- ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx (stable-fixes).\n- ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC (stable-fixes).\n- ALSA: hda/realtek: add quirk for Framework F111:000F (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 (stable-fixes).\n- ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') (git-fixes).\n- ALSA: hda: cs35l41: Put ACPI device on missing physical node (git-fixes).\n- ALSA: hda: cs35l56: Propagate ASP TX source control errors (git-fixes).\n- ALSA: hda: cs35l56: Put ACPI device after setting companion (git-fixes).\n- ALSA: hda: Fix NULL pointer dereference in snd_hda_ctl_add() (git-fixes).\n- ALSA: misc: Use guard() for spin locks (stable-fixes).\n- ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger (stable-fixes).\n- ALSA: pcmtest: fix reference leak on failed device registration (git-fixes).\n- ALSA: pcmtest: Fix resource leaks in module init error paths (git-fixes).\n- ALSA: pcmtest: Return -EFAULT on pattern read copy failure (git-fixes).\n- ALSA: sc6000: Keep the programmed board state in card-private data (git-fixes).\n- ALSA: scarlett2: Add missing error check when initialise Autogain Status (git-fixes).\n- ALSA: scarlett2: Add missing sentinel initializer field (git-fixes).\n- ALSA: seq: Notify client and port info changes (stable-fixes).\n- ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes (stable-fixes).\n- ALSA: usb-audio: apply quirk for MOONDROP JU Jiu (stable-fixes).\n- ALSA: usb-audio: Avoid false E-MU sample-rate notifications (git-fixes).\n- ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() (git-fixes).\n- ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans (git-fixes).\n- ALSA: usb-audio: Bound MIDI endpoint descriptor scans (git-fixes).\n- ALSA: usb-audio: Evaluate packsize caps at the right place (git-fixes).\n- ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch (git-fixes).\n- ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams (git-fixes).\n- ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex (stable-fixes).\n- ALSA: usb-audio: Fix UAC3 cluster descriptor size check (git-fixes).\n- ALSA: usb-audio: midi2: Restart output URBs on resume (git-fixes).\n- ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES (git-fixes).\n- ALSA: virtio: drop an extaneous kernel-doc comment (git-fixes).\n- amdgpu/jpeg: fix deepsleep register for jpeg 5_0_0 and 5_0_2 (stable-fixes).\n- ASoC: amd: acp: Add DMI quirk for Valve Steam Deck OLED (git-fixes).\n- ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF (stable-fixes).\n- ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table (stable-fixes).\n- ASoC: codecs: ab8500: Fix casting of private data (git-fixes).\n- ASoC: cs35l56: Destroy workqueue in probe error path (git-fixes).\n- ASoC: cs35l56: Don't use devres to unregister component (git-fixes).\n- ASoC: cs35l56: Fix hibernate write in runtime resume error path (git-fixes).\n- ASoC: fsl_easrc: Change the type for iec958 channel status controls (git-fixes).\n- ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() (git-fixes).\n- ASoC: fsl_easrc: fix comment typo (git-fixes).\n- ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() (git-fixes).\n- ASoC: fsl_micfil: Add access property for \"VAD Detected\" (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in micfil_quality_set() (git-fixes).\n- ASoC: fsl_xcvr: Fix event generation for cached controls (git-fixes).\n- ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() (git-fixes).\n- ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() (git-fixes).\n- ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error (git-fixes).\n- ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop (git-fixes).\n- ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens (git-fixes).\n- ASoC: qcom: q6apm: move component registration to unmanaged version (git-fixes).\n- ASoC: qcom: q6apm: remove child devices when apm is removed (git-fixes).\n- ASoC: qcom: qdsp6: topology: check widget type before accessing data (git-fixes).\n- ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list (stable-fixes).\n- ASoC: SOF: compress: return the configured codec from get_params (git-fixes).\n- ASoC: SOF: Don't allow pointer operations on unconfigured streams (git-fixes).\n- ASoC: SOF: Intel: hda: Place check before dereference (git-fixes).\n- ASoC: SOF: topology: reject invalid vendor array size in token parser (stable-fixes).\n- ASoC: sti: Return errors from regmap_field_alloc() (git-fixes).\n- ASoC: sti: use managed regmap_field allocations (git-fixes).\n- ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J (stable-fixes).\n- ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 (stable-fixes).\n- backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() (git-fixes).\n- batman-adv: bla: only purge non-released claims (git-fixes).\n- batman-adv: bla: prevent use-after-free when deleting claims (git-fixes).\n- batman-adv: bla: put backbone reference on failed claim hash insert (git-fixes).\n- batman-adv: fix integer overflow on buff_pos (git-fixes).\n- batman-adv: hold claim backbone gateways by reference (git-fixes).\n- batman-adv: reject new tp_meter sessions during teardown (git-fixes).\n- batman-adv: reject oversized global TT response buffers (git-fixes).\n- batman-adv: stop caching unowned originator pointers in BAT IV (git-fixes).\n- bitfield: Add FIELD_MODIFY() helper (jsc#PED-14238).\n- Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling (git-fixes).\n- Bluetooth: btmtk: validate WMT event SKB length before struct access (git-fixes).\n- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (bsc#1260996).\n- Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (git-fixes).\n- Bluetooth: hci_event: fix memset typo (git-fixes).\n- Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt (git-fixes).\n- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (git-fixes).\n- Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (git-fixes).\n- Bluetooth: HIDP: serialise l2cap_unregister_user via hidp_session_sem (git-fixes).\n- Bluetooth: ISO: Fix data-race on dst in iso_sock_connect() (git-fixes).\n- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (git-fixes).\n- Bluetooth: l2cap: fix MPS check in l2cap_ecred_reconf_req (git-fixes).\n- Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (git-fixes).\n- Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() (git-fixes).\n- Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU (git-fixes).\n- Bluetooth: RFCOMM: pull credit byte with skb_pull_data() (git-fixes).\n- Bluetooth: SCO: check for codecs-\u003enum_codecs == 1 before assigning to sco_pi(sk)-\u003ecodec (git-fixes).\n- Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready (git-fixes).\n- Bluetooth: SCO: hold sk properly in sco_conn_ready (git-fixes).\n- Bluetooth: virtio_bt: clamp rx length before skb_put (git-fixes).\n- Bluetooth: virtio_bt: validate rx pkt_type header length (git-fixes).\n- bpf: Add third round of bounds deduction (git-fixes).\n- bpf: Fix u32/s32 bounds when ranges cross min/max boundary (git-fixes).\n- bpf: Improve bounds when s64 crosses sign boundary (git-fixes).\n- bpf: Switch CONFIG_CFI_CLANG to CONFIG_CFI (git-fixes).\n- btrfs: qgroup: update all parent qgroups when doing quick inherit (bsc#1258933).\n- btrfs: reject root items with drop_progress and zero drop_level (git-fixes).\n- btrfs: replace BUG() with error handling in __btrfs_balance() (git-fixes).\n- bus: mhi: host: pci_generic: Switch to async power up to avoid boot delays (git-fixes).\n- bus: rifsc: fix RIF configuration check for peripherals (git-fixes).\n- can: mcp251x: add error handling for power enable in open and resume (stable-fixes).\n- can: raw: fix ro-\u003euniq use-after-free in raw_rcv() (git-fixes).\n- can: ucan: fix devres lifetime (git-fixes).\n- cdc-acm: new quirk for EPSON HMD (stable-fixes).\n- check-for-config-changes: Exclude CC_MS_EXTENSIONS.\n- check-for-config-changes: Exclude HAVE_CFI_ICALL_NORMALIZE_INTEGERS{,_RUSTC}.\n- comedi: dt2815: add hardware detection to prevent crash (stable-fixes).\n- cpufreq: intel_pstate: Drop Arrow Lake from \"scaling factor\" list (bsc#1249104).\n- crypto: af_alg - limit RX SG extraction by receive buffer budget (git-fixes).\n- crypto: algif_aead - Fix minimum RX size check for decryption (git-fixes).\n- crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup (git-fixes).\n- crypto: atmel-ecc - Release client on allocation failure (git-fixes).\n- crypto: atmel-sha204a - Fix error codes in OTP reads (git-fixes).\n- crypto: atmel-sha204a - Fix OTP sysfs read and error handling (git-fixes).\n- crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path (git-fixes).\n- crypto: atmel-sha204a - Fix uninitialized data access on OTP read error (git-fixes).\n- crypto: atmel-tdes - fix DMA sync direction (git-fixes).\n- crypto: ccp - copy IV using skcipher ivsize (git-fixes).\n- crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (git-fixes).\n- crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (git-fixes).\n- crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (git-fixes).\n- crypto: ccree - fix a memory leak in cc_mac_digest() (git-fixes).\n- crypto: drivers - Switch back to struct platform_driver::remove() (jsc#PED-14238).\n- crypto: drivers - Use str_enable_disable-like helpers (jsc#PED-14238).\n- crypto: hisilicon - Fix dma_unmap_single() direction (git-fixes).\n- crypto: iaa - Adjust workqueue allocation type (jsc#PED-14238).\n- crypto: iaa - fix per-node CPU counter reset in rebalance_wq_table() (git-fixes).\n- crypto: iaa - Move compression CRC into request object (jsc#PED-14238).\n- crypto: iaa - Optimize rebalance_wq_table() (jsc#PED-14238).\n- crypto: iaa - Remove potential infinite loop in check_completion() (jsc#PED-14238).\n- crypto: iaa - Remove unreachable pr_debug from iaa_crypto_cleanup_module (jsc#PED-14238).\n- crypto: iaa - Remove unused disable_async argument from iaa_decompress (jsc#PED-14238).\n- crypto: iaa - Replace sprintf with sysfs_emit in sysfs show functions (jsc#PED-14238).\n- crypto: iaa - Simplify init_iaa_device() (jsc#PED-14238).\n- crypto: jitterentropy - replace long-held spinlock with mutex (git-fixes).\n- crypto: nx - Fix packed layout in struct nx842_crypto_header (git-fixes).\n- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (git-fixes).\n- crypto: qat - #undef field_get() before local definition (jsc#PED-14238).\n- crypto: qat - add adf_rl_get_num_svc_aes() in rate limiting (jsc#PED-14238).\n- crypto: qat - add bank state save and restore for qat_420xx (jsc#PED-14238).\n- crypto: qat - add command queue telemetry counters for GEN6 (jsc#PED-14238).\n- crypto: qat - add compression slice count for rate limiting (jsc#PED-14238).\n- crypto: qat - add decompression service for rate limiting (jsc#PED-14238).\n- crypto: qat - add decompression service to telemetry (jsc#PED-14238).\n- crypto: qat - add firmware headers for GEN6 devices (jsc#PED-14238).\n- crypto: qat - add GEN6 firmware loader (jsc#PED-14238).\n- crypto: qat - add get_svc_slice_cnt() in device data structure (jsc#PED-14238).\n- crypto: qat - add live migration enablers for GEN6 devices (jsc#PED-14238).\n- crypto: qat - add macro to write 64-bit values to registers (jsc#PED-14238).\n- crypto: qat - add missing header inclusion (jsc#PED-14238).\n- crypto: qat - add qat_6xxx driver (jsc#PED-14238).\n- crypto: qat - add ring buffer idle telemetry counter for GEN6 (jsc#PED-14238).\n- crypto: qat - add support for decompression service to GEN6 devices (jsc#PED-14238).\n- crypto: qat - consolidate service enums (jsc#PED-14238).\n- crypto: qat - Constify struct pm_status_row (jsc#PED-14238).\n- crypto: qat - disable 4xxx AE cluster when lead engine is fused off (git-fixes).\n- crypto: qat - disable 420xx AE cluster when lead engine is fused off (git-fixes).\n- crypto: qat - do not export adf_cfg_services (jsc#PED-14238).\n- crypto: qat - enable power management debugfs for GEN6 devices (jsc#PED-14238).\n- crypto: qat - enable RAS support for GEN6 devices (jsc#PED-14238).\n- crypto: qat - enable rate limiting feature for GEN6 devices (jsc#PED-14238).\n- crypto: qat - enable reporting of error counters for GEN6 devices (jsc#PED-14238).\n- crypto: qat - enable telemetry for GEN6 devices (jsc#PED-14238).\n- crypto: qat - export adf_get_service_mask() (jsc#PED-14238).\n- crypto: qat - export adf_init_admin_pm() (jsc#PED-14238).\n- crypto: qat - expose configuration functions (jsc#PED-14238).\n- crypto: qat - fix compression instance leak (git-fixes).\n- crypto: qat - fix IRQ cleanup on 6xxx probe failure (git-fixes).\n- crypto: qat - fix object goals in Makefiles (jsc#PED-14238.\n- crypto: qat - fix type mismatch in RAS sysfs show functions (git-fixes).\n- crypto: qat - Fix typo \"accelaration\" (jsc#PED-14238).\n- crypto: qat - fix virtual channel configuration for GEN6 devices (jsc#PED-14238).\n- crypto: qat - include qat_common in top Makefile (jsc#PED-14238).\n- crypto: qat - introduce fuse array (jsc#PED-14238).\n- crypto: qat - make adf_dev_autoreset() static (jsc#PED-14238).\n- crypto: qat - optimize allocations for fw authentication (jsc#PED-14238).\n- crypto: qat - refactor compression template logic (jsc#PED-14238).\n- crypto: qat - refactor FW signing algorithm (jsc#PED-14238).\n- crypto: qat - refactor ring-related debug functions (jsc#PED-14238).\n- crypto: qat - refactor service parsing logic (jsc#PED-14238).\n- crypto: qat - relocate and rename bank state structure definition (jsc#PED-14238).\n- crypto: qat - relocate bank state helper functions (jsc#PED-14238).\n- crypto: qat - relocate power management debugfs helper APIs (jsc#PED-14238).\n- crypto: qat - relocate service related functions (jsc#PED-14238).\n- crypto: qat - remove BITS_IN_DWORD() (jsc#PED-14238).\n- crypto: qat - Remove dst_null support (jsc#PED-14238).\n- crypto: qat - remove duplicate masking for GEN6 devices (jsc#PED-14238).\n- crypto: qat - remove initialization in device class (jsc#PED-14238).\n- crypto: qat - remove redundant FW image size check (jsc#PED-14238).\n- crypto: qat - remove unused adf_devmgr_get_first (jsc#PED-14238).\n- crypto: qat - remove unused members in suof structure (jsc#PED-14238).\n- crypto: qat - rename and relocate timer logic (jsc#PED-14238).\n- crypto: qat - reorder objects in qat_common Makefile (jsc#PED-14238).\n- crypto: qat - replace CHECK_STAT macro with static inline function (jsc#PED-14238).\n- crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() (jsc#PED-14238).\n- crypto: qat - restore ASYM service support for GEN6 devices (jsc#PED-14238).\n- crypto: qat - Return pointer directly in adf_ctl_alloc_resources (jsc#PED-14238).\n- crypto: qat - set command ids as reserved (jsc#PED-14238).\n- crypto: qat - switch to standard pattern for PCI IDs (jsc#PED-14238).\n- crypto: qat - update firmware api (jsc#PED-14238).\n- crypto: qat - use pr_fmt() in adf_gen4_hw_data.c (jsc#PED-14238).\n- crypto: qat - use pr_fmt() in qat uclo.c (jsc#PED-14238).\n- crypto: qat - use simple_strtoull to improve qat_uclo_parse_num (jsc#PED-14238).\n- crypto: qat - use swab32 macro (git-fixes).\n- crypto: qat - validate service in rate limiting sysfs api (jsc#PED-14238).\n- crypto: qat/qat_6xxx - Fix NULL vs IS_ERR() check in adf_probe() (jsc#PED-14238).\n- crypto: sa2ul - Fix AEAD fallback algorithm names (git-fixes).\n- crypto: simd - reject compat registrations without __ prefixes (git-fixes).\n- crypto: talitos - fix SEC1 32k ahash request limitation (git-fixes).\n- crypto: tegra - Disable softirqs before finalizing request (git-fixes).\n- devres: fix missing node debug info in devm_krealloc() (git-fixes).\n- dmaengine: dw-axi-dmac: fix Alignment should match open parenthesis (git-fixes).\n- dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function (git-fixes).\n- dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() (git-fixes).\n- dpll: zl3073x: Add support to adjust phase (bsc#1255752).\n- dpll: zl3073x: Fix output pin phase adjustment sign (bsc#1255752).\n- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (bsc#1255752).\n- dpll: zl3073x: Specify phase adjustment granularity for pins (bsc#1255752).\n- drivers/base/memory: fix memory block reference leak in poison accounting (git-fixes).\n- drm/amd/display: Add NULL check for integrated_info in clk_mgr_construct (git-fixes).\n- drm/amd/display: Allow DCE link encoder without AUX registers (git-fixes).\n- drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths (git-fixes).\n- drm/amd/display: Change dither policy for 10 bpc output back to dithering (git-fixes).\n- drm/amd/display: Correct logic check error for fastboot (git-fixes).\n- drm/amd/display: Disable 10-bit truncation and dithering on DCE 6.x (git-fixes).\n- drm/amd/display: Disable fastboot on DCE 6 too (stable-fixes).\n- drm/amd/display: Read EDID from VBIOS embedded panel info (git-fixes).\n- drm/amd/pm/ci: Clear EnabledForActivity field for memory levels (git-fixes).\n- drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs (git-fixes).\n- drm/amd/pm/ci: Fill DW8 fields from SMC (git-fixes).\n- drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 (git-fixes).\n- drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled (git-fixes).\n- drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board (git-fixes).\n- drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock (git-fixes).\n- drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x (git-fixes).\n- drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) (git-fixes).\n- drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ (stable-fixes).\n- drm/amdgpu/gfx10: look at the right prop for gfx queue priority (git-fixes).\n- drm/amdgpu/gfx11: look at the right prop for gfx queue priority (git-fixes).\n- drm/amdgpu/gmc: Fix AMDGPU_GART_PLACEMENT_LOW to not overlap with VRAM (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.5 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.0 ring (git-fixes).\n- drm/amdgpu/pm: add missing revision check for CI (git-fixes).\n- drm/amdgpu/pm: align Hawaii mclk workaround with radeon (git-fixes).\n- drm/amdgpu/pm: drop SMU driver if version not matched messages (stable-fixes).\n- drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission (git-fixes).\n- drm/amdgpu/vce: Prevent partial address patches (stable-fixes).\n- drm/amdgpu/vcn3: Avoid overflow on msg bound check (git-fixes).\n- drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (stable-fixes).\n- drm/amdgpu/vcn4: Avoid overflow on msg bound check (git-fixes).\n- drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (stable-fixes).\n- drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (stable-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v4.0.5 enc ring (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v5.0.0 enc ring (git-fixes).\n- drm/amdgpu: Add bounds checking to ib_{get,set}_value (stable-fixes).\n- drm/amdgpu: Add default case in DVI mode validation (git-fixes).\n- drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG (git-fixes).\n- drm/amdgpu: fix zero-size GDS range init on RDNA4 (stable-fixes).\n- drm/amdgpu: gate VM CPU HDP flush on reset lock (stable-fixes).\n- drm/amdgpu: replace PASID IDR with XArray (git-fixes).\n- drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count (stable-fixes).\n- drm/amdgpu: zero-initialize GART table on allocation (stable-fixes).\n- drm/amdkfd: Add upper bound check for num_of_nodes (stable-fixes).\n- drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure (stable-fixes).\n- drm/amdkfd: Make all TLB-flushes heavy-weight (stable-fixes).\n- drm/amdkfd: validate SVM ioctl nattr against buffer size (stable-fixes).\n- drm/arcpgu: fix device node leak (git-fixes).\n- drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs (git-fixes).\n- drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check (git-fixes).\n- drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() (git-fixes).\n- drm/bridge: stm_lvds: Do not fail atomic_check on disabled connector (git-fixes).\n- drm/etnaviv: Fix armed job not being pushed to the DRM scheduler (git-fixes).\n- drm/exynos: remove bridge when component_add fails (git-fixes).\n- drm/fb-helper: Fix clipping when damage area spans a single scanline (git-fixes).\n- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (git-fixes).\n- drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup (git-fixes).\n- drm/gma500/oaktrail_lvds: fix hang on init failure (git-fixes).\n- drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init (git-fixes).\n- drm/i915/dp: Fix VSC dynamic range signaling for RGB formats (git-fixes).\n- drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (git-fixes).\n- drm/i915/wm: Verify the correct plane DDB entry (git-fixes).\n- drm/i915: skip __i915_request_skip() for already signaled requests (git-fixes).\n- drm/imagination: Switch reset_reason fields from enum to u32 (git-fixes).\n- drm/komeda: fix integer overflow in AFBC framebuffer size check (git-fixes).\n- drm/loongson: Use managed KMS polling (git-fixes).\n- drm/msm/a6xx: Fix dumping A650+ debugbus blocks (git-fixes).\n- drm/msm/a6xx: Fix HLSQ register dumping (git-fixes).\n- drm/msm/a6xx: Use barriers while updating HFI Q headers (git-fixes).\n- drm/msm/dpu: fix mismatch between power and frequency (git-fixes).\n- drm/msm/dsi: add the missing parameter description (git-fixes).\n- drm/msm/dsi: fix bits_per_pclk (git-fixes).\n- drm/msm/dsi: fix hdisplay calculation for CMD mode panel (git-fixes).\n- drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 (git-fixes).\n- drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata() (git-fixes).\n- drm/msm/shrinker: Fix can_block() logic (git-fixes).\n- drm/nouveau: fix nvkm_device leak on aperture removal failure (git-fixes).\n- drm/nouveau: fix u32 overflow in pushbuf reloc bounds check (git-fixes).\n- drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds (git-fixes).\n- drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds (git-fixes).\n- drm/panel: sharp-ls043t1le01: make use of prepare_prev_first (git-fixes).\n- drm/panel: simple: Correct G190EAN01 prepare timing (git-fixes).\n- drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() (git-fixes).\n- drm/panthor: Fix outdated function documentation (git-fixes).\n- drm/radeon: add missing revision check for CI (git-fixes).\n- drm/sun4i: backend: fix error pointer dereference (git-fixes).\n- drm/sun4i: Fix resource leaks (git-fixes).\n- drm/v3d: Handle error from drm_sched_entity_init() (git-fixes).\n- drm/vc4: Fix a memory leak in hang state error path (git-fixes).\n- drm/vc4: Fix memory leak of BO array in hang state (git-fixes).\n- drm/vc4: platform_get_irq_byname() returns an int (stable-fixes).\n- drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock (git-fixes).\n- drm/vc4: Release runtime PM reference after binding V3D (git-fixes).\n- drm/vram: remove DRM_VRAM_MM_FILE_OPERATIONS from docs (git-fixes).\n- drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked() (git-fixes).\n- drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked() (git-fixes).\n- drm/xe/debugfs: Correct printing of register whitelist ranges (git-fixes).\n- drm/xe/dma-buf: handle empty bo and UAF races (git-fixes).\n- drm/xe/gsc: Fix BO leak on error in query_compatibility_version() (git-fixes).\n- drm/xe/uapi: update used tracking kernel-doc (git-fixes).\n- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (git-fixes).\n- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (git-fixes).\n- dt-bindings: net: Fix Tegra234 MGBE PTP clock (git-fixes).\n- efi/capsule-loader: fix incorrect sizeof in phys array reallocation (git-fixes).\n- efi: pstore: Drop efivar lock when efi_pstore_open() returns with an error (git-fixes).\n- erofs: add GFP_NOIO in the bio completion if needed (git-fixes).\n- ext4: fix fsync(2) for nojournal mode (git-fixes).\n- ext4: make recently_deleted() properly work with lazy itable initialization (git-fixes).\n- ext4: reject mount if bigalloc with s_first_data_block != 0 (git-fixes).\n- extcon: Fixed sysfs duplicate filename issue (git-fixes).\n- extcon: ptn5150: handle pending IRQ events during system resume (git-fixes).\n- fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break (git-fixes).\n- fbdev: offb: fix PCI device reference leak on probe failure (git-fixes).\n- fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO (stable-fixes).\n- fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO (git-fixes).\n- firmware: arm_ffa: Use the correct buffer size during RXTX_MAP (git-fixes).\n- firmware: dmi: Correct an indexing error in dmi.h (git-fixes).\n- firmware: google: framebuffer: Do not mark framebuffer as busy (git-fixes).\n- firmware: google: framebuffer: Do not unregister platform device (git-fixes).\n- gpio: of: clear OF_POPULATED on hog nodes in remove path (git-fixes).\n- gpio: tegra: fix irq_release_resources calling enable instead of disable (git-fixes).\n- gtp: disable BH before calling udp_tunnel_xmit_skb() (git-fixes).\n- HID: alps: fix NULL pointer dereference in alps_raw_event() (git-fixes).\n- HID: amd_sfh: don't log error when device discovery fails with -EOPNOTSUPP (git-fixes).\n- HID: apple: ensure the keyboard backlight is off if suspending (git-fixes).\n- HID: asus: do not abort probe when not necessary (git-fixes).\n- HID: asus: make asus_resume adhere to linux kernel coding standards (git-fixes).\n- HID: core: clamp report_size in s32ton() to avoid undefined shift (stable-fixes).\n- HID: logitech-hidpp: Enable MX Master 4 over bluetooth (stable-fixes).\n- HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure (stable-fixes).\n- HID: multitouch: Check to ensure report responses match the request (stable-fixes).\n- HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 (stable-fixes).\n- HID: roccat: fix use-after-free in roccat_report_event (stable-fixes).\n- HID: usbhid: fix deadlock in hid_post_reset() (git-fixes).\n- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (stable-fixes).\n- hisi_acc_vfio_pci: add eq and aeq interruption restore (git-fixes).\n- hisi_acc_vfio_pci: bugfix cache write-back issue (git-fixes).\n- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (git-fixes).\n- hv_sock: fix ARM64 support (git-fixes).\n- hv_sock: update outdated comment for renamed vsock_stream_recvmsg() (git-fixes).\n- hwmon: (ads7871) Fix endianness bug in 16-bit register reads (git-fixes).\n- hwmon: (corsair-psu) Close HID device on probe errors (git-fixes).\n- hwmon: (lm63) Add locking to avoid TOCTOU (git-fixes).\n- hwmon: (ltc2992) Clamp threshold writes to hardware range (git-fixes).\n- hwmon: (ltc2992) Fix u32 overflow in power read path (git-fixes).\n- hwmon: (ltc4286) Add missing MODULE_IMPORT_NS(\"PMBUS\") (git-fixes).\n- hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt (git-fixes).\n- hwmon: (powerz) Fix use-after-free on USB disconnect (git-fixes).\n- hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data() (git-fixes).\n- i2c: s3c24xx: check the size of the SMBUS message before using it (stable-fixes).\n- i2c: smbus: reject oversized block transfers in the common path (git-fixes).\n- i2c: stm32f7: reinit_completion() per transfer not per msg (git-fixes).\n- i2c: stub: Reject I2C block transfers with invalid length (git-fixes).\n- i2c: tegra: Add HS mode support (bsc#1261550).\n- i2c: tegra: Add Tegra256 support (bsc#1261550).\n- i2c: tegra: Do not configure DMA if not supported (bsc#1261550).\n- i2c: tegra: Don't mark devices with pins as IRQ safe (stable-fixes).\n- i2c: tegra: Update Tegra256 timing parameters (bsc#1261550).\n- i2c: tegra: Use separate variables for fast and fastplus (bsc#1261550).\n- i3c: dw: Fix memory leak in dw_i3c_master_i3c_xfers() (git-fixes).\n- i3c: master: Fix error codes at send_ccc_cmd (git-fixes).\n- i3c: mipi-i3c-hci: fix IBI payload length calculation for final status (git-fixes).\n- ibmveth: Disable GSO for packets with small MSS (bsc#1265144).\n- iio: adc: ad7192: Revert \"properly check spi_get_device_match_data()\" (stable-fixes).\n- iio: adc: ad7768-1: fix one-shot mode data acquisition (git-fixes).\n- iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() (git-fixes).\n- iio: frequency: admv1013: add dev variable (stable-fixes).\n- iio: frequency: admv1013: fix NULL pointer dereference on str (git-fixes).\n- Input: bcm5974 - recover from failed mode switch (stable-fixes).\n- Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table (stable-fixes).\n- Input: uinput - fix circular locking dependency with ff-core (git-fixes).\n- Input: uinput - take event lock when submitting FF request \"event\" (stable-fixes).\n- Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode (stable-fixes).\n- Input: xpad - add support for Razer Wolverine V3 Pro (stable-fixes).\n- interconnect: debugfs: fix devm_kstrdup and kfree mismatch (git-fixes).\n- io_uring/timeout: check unused sqe fields (git-fixes).\n- iommu/amd: move wait_on_sem() out of spinlock (git-fixes bsc#1260593).\n- iommu/amd: serialize sequence allocation under concurrent TLB invalidations (git-fixes bsc#1260593).\n- iommu/vt-d: Remove LPIG from page group response descriptor (jsc#PED-16113).\n- ipmi: Add limits to event and receive message requests (git-fixes).\n- ipmi: Check event message buffer response for bad data (git-fixes).\n- ipmi: ssif_bmc: change log level to dbg in irq callback (git-fixes).\n- ipmi: ssif_bmc: fix message desynchronization after truncated response (git-fixes).\n- ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure (git-fixes).\n- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (git-fixes).\n- KVM: arm64: Allow cacheable stage 2 mapping using VMA flags (git-fixes).\n- KVM: arm64: Assume non-PFNMAP/MIXEDMAP VMAs can be mapped cacheable (git-fixes).\n- KVM: arm64: Block cacheable PFNMAP mapping (git-fixes).\n- KVM: arm64: Consolidate idreg callbacks (git-fixes).\n- KVM: arm64: Discard PC update state on vcpu reset (git-fixes).\n- KVM: arm64: Finalize ID registers only once per VM (git-fixes).\n- KVM: arm64: Fix MTE flag initialization for protected VMs (git-fixes).\n- KVM: arm64: Fix page leak in user_mem_abort() (git-fixes).\n- KVM: arm64: Fix Trace Buffer trap polarity for protected VMs (git-fixes).\n- KVM: arm64: Fix Trace Buffer trapping for protected VMs (git-fixes).\n- KVM: arm64: Fix vma_shift staleness on nested hwpoison path (git-fixes).\n- KVM: arm64: Hide S1POE from guests when not supported by the host (git-fixes).\n- KVM: arm64: Limit clearing of ID_{AA64PFR0,PFR1}_EL1.GIC to userspace irqchip (git-fixes).\n- KVM: arm64: Make all 32bit ID registers fully writable (git-fixes).\n- KVM: arm64: nv: Add trap config for DBGWCR\u003c15\u003e_EL1 (git-fixes).\n- KVM: arm64: nv: Return correct RES0 bits for FGT registers (git-fixes).\n- KVM: arm64: pkvm: Fallback to level-3 mapping on host stage-2 fault (git-fixes).\n- KVM: arm64: Read PMUVer as unsigned (git-fixes).\n- KVM: arm64: Rename the device variable to s2_force_noncacheable (git-fixes).\n- KVM: arm64: Return early from trace helpers when KVM isn't available (git-fixes).\n- KVM: arm64: Set ID_{AA64PFR0,PFR1}_EL1.GIC when GICv3 is configured (git-fixes).\n- KVM: arm64: vgic-v3: Release reserved slot outside of lpi_xa's lock (git-fixes).\n- KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes).\n- KVM: nSVM: Use vcpu-\u003earch.cr2 when updating vmcb12 on nested #VMEXIT (git-fixes).\n- KVM: nVMX: Add consistency check for TSC_MULTIPLIER=0 (git-fixes).\n- KVM: Reject wrapped offset in kvm_reset_dirty_gfn() (git-fixes).\n- KVM: SEV: Disallow LAUNCH_FINISH if vCPUs are actively being created (git-fixes).\n- KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (git-fixes).\n- KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish (git-fixes).\n- KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm-\u003elock (git-fixes).\n- KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU (git-fixes).\n- KVM: SVM: Disallow EFER.LMSLE when not supported by hardware (git-fixes).\n- KVM: SVM: Fix a missing kunmap_local() in sev_gmem_post_populate() (git-fixes).\n- KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC (git-fixes).\n- KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (git-fixes).\n- KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN (git-fixes).\n- KVM: SVM: Properly check RAX in the emulator for SVM instructions (git-fixes).\n- KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (git-fixes).\n- KVM: TDX: Explicitly set user-return MSRs that *may* be clobbered by the TDX-Module (git-fixes).\n- KVM: x86/mmu: Fix UBSAN warning when reading nx_huge_pages parameter (git-fixes).\n- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (git-fixes).\n- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (git-fixes).\n- KVM: x86: Advertise EferLmsleUnsupported to userspace (git-fixes).\n- KVM: x86: check for nEPT/nNPT in slow flush hypercalls (git-fixes).\n- KVM: X86: Fix array_index_nospec protection in __pv_send_ipi (git-fixes).\n- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (git-fixes).\n- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (git-fixes).\n- KVM: x86: Ignore cpuid faulting in SMM (git-fixes).\n- leds: lgm-sso: Remove duplicate assignments for priv-\u003emmap (git-fixes).\n- leds: qcom-lpg: Check for array overflow when selecting the high resolution (stable-fixes).\n- lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() (git-fixes).\n- md/raid1: fix the comparing region of interval tree (bsc#1261555).\n- md/raid1: serialize overlap io for writemostly disk (bsc#1261555).\n- media: amphion: Fix race between m2m job_abort and device_run (git-fixes).\n- media: as102: fix to not free memory after the device is registered in as102_usb_probe() (git-fixes).\n- media: chips-media: wave5: add missing spinlock protection for handle_dynamic_resolution_change() (git-fixes).\n- media: chips-media: wave5: add missing spinlock protection for send_eos_event() (git-fixes).\n- media: chips-media: wave5: fix a potential memory leak in wave5_vdi_init() (git-fixes).\n- media: dib8000: avoid division by 0 in dib8000_set_dds() (git-fixes).\n- media: em28xx: fix use-after-free in em28xx_v4l2_open() (git-fixes).\n- media: hackrf: fix to not free memory after the device is registered in hackrf_probe() (git-fixes).\n- media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() (git-fixes).\n- media: i2c: imx283: Enter full standby when stopping streaming (git-fixes).\n- media: i2c: imx283: Fix hang when going from large to small resolution (git-fixes).\n- media: i2c: imx412: Assert reset GPIO during probe (git-fixes).\n- media: i2c: ov08d10: fix image vertical start setting (git-fixes).\n- media: i2c: ov8856: free control handler on error in ov8856_init_controls() (git-fixes).\n- media: intel/ipu6: fix error pointer dereference (git-fixes).\n- media: mtk-jpeg: fix use-after-free in release path due to uncancelled work (git-fixes).\n- media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 (git-fixes).\n- media: omap3isp: drop the use count of v4l2 pipeline (git-fixes).\n- media: pci: zoran: fix potential memory leak in zoran_probe() (git-fixes).\n- media: rc: streamzap: Error handling in probe (git-fixes).\n- media: rc: xbox_remote: heed DMA restrictions (git-fixes).\n- media: saa7164: add ioremap return checks and cleanups (git-fixes).\n- media: staging: imx: configure src_mux in csi_start (git-fixes).\n- media: staging: imx: request mbus_config in csi_start (git-fixes).\n- media: uvcvideo: Enable VB2_DMABUF for metadata stream (git-fixes).\n- media: videobuf2: Set vma_flags in vb2_dma_sg_mmap (git-fixes).\n- media: vidtv: fix nfeeds state corruption on start_streaming failure (git-fixes).\n- media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections (git-fixes).\n- media: vidtv: fix pass-by-value structs causing MSAN warnings (git-fixes).\n- memory: tegra30-emc: Fix dll_change check (git-fixes).\n- memory: tegra124-emc: Fix dll_change check (git-fixes).\n- mfd: core: Preserve OF node when ACPI handle is present (git-fixes).\n- mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() (git-fixes).\n- mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused (git-fixes).\n- mkspec: Add signature to source list only when it exists.\n- mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration (git-fixes).\n- mmc: vub300: fix NULL-deref on disconnect (git-fixes).\n- modpost: Amend ppc64 save/restfpr symnames for -Os build (bsc#1215199).\n- mtd: docg3: fix use-after-free in docg3_release() (git-fixes).\n- mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions (git-fixes).\n- mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path (git-fixes).\n- mtd: physmap_of_gemini: Fix disabled pinctrl state check (git-fixes).\n- mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob (git-fixes).\n- mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations (git-fixes).\n- mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() (git-fixes).\n- mtd: spi-nor: sst: Fix write enable before AAI sequence (git-fixes).\n- mtd: spi-nor: swp: check SR_TB flag when getting tb_mask (git-fixes).\n- net-shapers: don't free reply skb after genlmsg_reply() (git-fixes).\n- net/mlx5: Fix HCA caps leak on notifier init failure (git-fixes).\n- net/rds: reset op_nents when zerocopy page pin fails (bsc#1265626).\n- net/sched: cls_fw: fix NULL dereference of \"old\" filters before change() (git-fixes).\n- net/sched: fix pedit partial COW leading to page cache corruption (bsc#1265421).\n- net: gro: don't merge zcopy skbs (git-fixes).\n- net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf (git-fixes).\n- net: mana: Add MAC address to vPort logs and clarify error messages (git-fixes).\n- net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq() (git-fixes).\n- net: mana: Don't overwrite port probe error with add_adev result (git-fixes).\n- net: mana: Fix crash from unvalidated SHM offset read from BAR0 during FLR (bsc#1265846).\n- net: mana: Fix EQ leak in mana_remove on NULL port (git-fixes).\n- net: mana: Fix RX skb truesize accounting (bsc#1248754).\n- net: mana: Guard mana_remove against double invocation (git-fixes).\n- net: mana: hardening: Validate adapter_mtu from MANA_QUERY_DEV_CONFIG (git-fixes).\n- net: mana: hardening: Validate doorbell ID from GDMA_REGISTER_DEVICE response (git-fixes).\n- net: mana: Init gf_stats_work before potential error paths in probe (git-fixes).\n- net: mana: Init link_change_work before potential error paths in probe (git-fixes).\n- net: mana: Move current_speed debugfs file to mana_init_port() (git-fixes).\n- net: mana: remove double CQ cleanup in mana_create_rxq error path (git-fixes).\n- net: mana: Set default number of queues to 16 (bsc#1261648).\n- net: mana: Skip WQ object destruction for uninitialized RXQ (git-fixes).\n- net: mana: Use at least SZ_4K in doorbell ID range check (git-fixes).\n- net: mana: Use pci_name() for debugfs directory naming (git-fixes).\n- net: phy: broadcom: Save PHY counters during suspend (git-fixes).\n- net: phy: DP83TC811: add reading of abilities (git-fixes).\n- net: phy: dp83869: fix setting CLK_O_SEL field (git-fixes).\n- net: phy: fix a return path in get_phy_c45_ids() (git-fixes).\n- net: phy: qcom: at803x: Use the correct bit to disable extended next page (git-fixes).\n- net: stmmac: Fix PTP ref clock for Tegra234 (git-fixes).\n- net: usb: asix: ax88772: re-add usbnet_link_change() in phylink callbacks (git-fixes).\n- net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() (git-fixes).\n- net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() (git-fixes).\n- net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit (git-fixes).\n- net: wan: fsl_ucc_hdlc: fix ucc_hdlc_remove (git-fixes).\n- net: wan: fsl_ucc_hdlc: fix uhdlc_memclean (git-fixes).\n- net: wan: fsl_ucc_hdlc: free tx_skbuff in uhdlc_memclean (git-fixes).\n- net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler (git-fixes).\n- NFC: digital: Bounds check NFC-A cascade depth in SDD response handler (git-fixes).\n- nfc: llcp: add missing return after LLCP_CLOSED checks (git-fixes).\n- nfc: pn533: allocate rx skb before consuming bytes (git-fixes).\n- nfc: s3fwrn5: allocate rx skb before consuming bytes (git-fixes).\n- NFC: trf7970a: Ignore antenna noise when checking for RF field (git-fixes).\n- nvme-apple: drop invalid put of admin queue reference count (git-fixes).\n- nvme-auth: Include SC_C in RVAL controller hash (bsc#1260428).\n- nvme-loop: do not cancel I/O and admin tagset during ctrl reset/shutdown (bsc#1262709).\n- nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 (git-fixes).\n- nvme: Allow reauth from sysfs (bsc#1259672).\n- nvme: Expose the tls_configured sysfs for secure concat connections (bsc#1259672).\n- nvme: expose TLS mode (bsc#1259672).\n- nvme: fix admin queue leak on controller reset (git-fixes).\n- nvme: fix PCIe subsystem reset controller state transition (bsc#1261738).\n- nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers (git-fixes).\n- ocfs2: fix possible deadlock between unlink and dio_end_io_write (bsc#1258718).\n- ocfs2: split transactions in dio completion to avoid credit exhaustion (bsc#1258718).\n- openvswitch: vport: fix self-deadlock on release of tunnel ports (git-fixes).\n- panic/printk: replace other_cpu_in_panic() with panic_on_other_cpu() (bsc#1261149).\n- panic/printk: replace this_cpu_in_panic() with panic_on_this_cpu() (bsc#1261149).\n- panic: introduce helper functions for panic state (bsc#1261149).\n- panic: use angle-bracket include for panic.h (bsc#1261149).\n- PCI/AER: Clear only error bits in PCIe Device Status (git-fixes).\n- PCI/AER: Stop ruling out unbound devices as error source (git-fixes).\n- PCI/ASPM: Fix pci_clear_and_set_config_dword() usage (git-fixes).\n- PCI/NPEM: Set LED_HW_PLUGGABLE for hotplug-capable ports (git-fixes).\n- PCI/TPH: Allow TPH enable for RCiEPs (git-fixes).\n- PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well (git-fixes).\n- PCI: dwc: rcar-gen4: Change EPC BAR alignment to 4K as per the documentation (git-fixes).\n- PCI: Enable AtomicOps only if Root Port supports them (git-fixes).\n- PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown (git-fixes).\n- PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup (git-fixes).\n- PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete (git-fixes).\n- PCI: hv: Set default NUMA node to 0 for devices without affinity info (bsc#1261648).\n- PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found (git-fixes).\n- PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion support (git-fixes).\n- PCI: tegra194: Allow system suspend when the Endpoint link is not up (git-fixes).\n- PCI: tegra194: Disable direct speed change for Endpoint mode (git-fixes).\n- PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down (git-fixes).\n- PCI: tegra194: Disable PERST# IRQ only in Endpoint mode (git-fixes).\n- PCI: tegra194: Fix CBB timeout caused by DBI access before core power-on (git-fixes).\n- PCI: tegra194: Fix polling delay for L2 state (git-fixes).\n- PCI: tegra194: Free up Endpoint resources during remove() (git-fixes).\n- PCI: tegra194: Increase LTSSM poll time on surprise link down (git-fixes).\n- PCI: tegra194: Set LTR message request before PCIe link up in Endpoint mode (git-fixes).\n- PCI: tegra194: Use devm_gpiod_get_optional() to parse \"nvidia,refclk-select\" (git-fixes).\n- PCI: tegra194: Use DWC IP core version (git-fixes).\n- pinctrl: abx500: Fix type of 'argument' variable (git-fixes).\n- pinctrl: Fix spelling problem (git-fixes).\n- pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) (stable-fixes).\n- pinctrl: pic32: change all cases of bare 'unsigned' to 'unsigned int' (git-fixes).\n- pinctrl: pic32: use consistent spacing around '+' (git-fixes).\n- pinctrl: pinctrl-pic32: Fix resource leak (git-fixes).\n- pinctrl: realtek: Fix function signature for config argument (git-fixes).\n- pinctrl: renesas: rzg2l: Fix save/restore of {IOLH,IEN,PUPD,SMT} registers (git-fixes).\n- platform/chrome: chromeos_tbmc: Drop wakeup source on remove (git-fixes).\n- platform/surface: surfacepro3_button: Drop wakeup source on remove (git-fixes).\n- platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug (stable-fixes).\n- platform/x86/intel-uncore-freq: Handle autonomous UFS status bit (git-fixes).\n- platform/x86: asus-wmi: adjust screenpad power/brightness handling (git-fixes).\n- platform/x86: asus-wmi: fix screenpad brightness range (git-fixes).\n- platform/x86: dell-wmi-sysman: bound enumeration string aggregation (git-fixes).\n- platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() (git-fixes).\n- platform/x86: hp-wmi: Ignore backlight and FnLock events (stable-fixes).\n- platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup (git-fixes).\n- power: supply: axp288_charger: Do not cancel work before initializing it (git-fixes).\n- power: supply: max17042: avoid overflow when determining health (git-fixes).\n- powerpc/crash: fix backup region offset update to elfcorehdr (bsc#1259535).\n- powerpc/crash: Update backup region offset in elfcorehdr on memory hotplug (bsc#1259535).\n- printk/nbcon/panic: Allow printk kthread to sleep when the system is in panic (bsc#1261149).\n- printk/nbcon: Block printk kthreads when any CPU is in an emergency context (bsc#1261149).\n- printk/nbcon: Release nbcon consoles ownership in atomic flush after each emitted record (bsc#1261149).\n- printk/nbcon: Restore IRQ in atomic flush after each emitted record (bsc#1261149).\n- printk/nbcon: use panic_on_this_cpu() helper (bsc#1261149).\n- printk: Allow printk_trigger_flush() to flush all types (bsc#1262750).\n- printk: Allow to use the printk kthread immediately even for 1st nbcon (jsc#PED-7912).\n- printk: Avoid irq_work for printk_deferred() on suspend (bsc#1262750).\n- printk: Avoid scheduling irq_work on suspend (bsc#1262750).\n- printk: console_flush_one_record() code cleanup (bsc#1261149).\n- printk: Introduce console_flush_one_record (bsc#1261149).\n- printk: Use console_flush_one_record for legacy printer kthread (bsc#1261149).\n- pwm: imx-tpm: Count the number of enabled channels in probe (git-fixes).\n- qat: don't mess with -\u003ed_name (jsc#PED-14238).\n- r8152: fix incorrect register write to USB_UPHY_XTAL (git-fixes).\n- RDMA/irdma: Fix double free related to rereg_user_mr (git-fixes).\n- RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() (git-fixes).\n- RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() (git-fixes).\n- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (git-fixes).\n- RDMA/mana: Validate rx_hash_key_len (git-fixes).\n- RDMA/mana_ib: cleanup the usage of mana_gd_send_request() (git-fixes).\n- RDMA/mana_ib: Disable RX steering on RSS QP destroy (git-fixes).\n- RDMA/mana_ib: Support memory windows (git-fixes).\n- regulator: act8945a: fix OF node reference imbalance (git-fixes).\n- regulator: bd9571mwv: fix OF node reference imbalance (git-fixes).\n- regulator: max77650: fix OF node reference imbalance (git-fixes).\n- regulator: mt6357: fix OF node reference imbalance (git-fixes).\n- regulator: rk808: fix OF node reference imbalance (git-fixes).\n- remoteproc: xlnx: Fix sram property parsing (git-fixes).\n- remoteproc: xlnx: Only access buffer information if IPI is buffered (git-fixes).\n- Revert \"ALSA: usb: Increase volume range that triggers a warning\" (git-fixes).\n- Revert \"serial: 8250: Revert \"drop lockdep annotation from serial8250_clear_IER()\"\" (bsc#1262480).\n- Revert \"serial: 8250: Switch to nbcon console\" (bsc#1262480).\n- rtc: abx80x: Disable alarm feature if no interrupt attached (git-fixes).\n- rtc: ntxec: fix OF node reference imbalance (git-fixes).\n- s390/dasd: Copy detected format information to secondary device (bsc#1259994).\n- s390/dasd: Fix gendisk parent after copy pair swap (bsc#1259994).\n- s390/dasd: Move quiesce state with pprc swap (bsc#1259994).\n- sched/fair: Change likelyhood of nohz.nr_cpus (bsc#1234634 bsc#1258961).\n- sched/fair: Move checking for nohz cpus after time check (bsc#1234634 bsc#1258961).\n- sched/fair: Remove nohz.nr_cpus and use weight of cpumask instead (bsc#1234634 bsc#1258961).\n- scsi: lpfc: Add clean up of aborted NVMe commands during PCI fcn reset (bsc#1262019).\n- scsi: lpfc: Add log messages to fabric login error labels (bsc#1262019).\n- scsi: lpfc: Add PCI ID support for LPe42100 series adapters (bsc#1262019).\n- scsi: lpfc: Add REG_VFI mailbox cmd error handling (bsc#1262019).\n- scsi: lpfc: Break out of IRQ affinity assignment when mask reaches nr_cpu_ids (bsc#1262019).\n- scsi: lpfc: Check ASIC_ID register to aid diagnostics during failed fw updates (bsc#1262019).\n- scsi: lpfc: Cleanup error exit paths in lpfc_fdmi_cmd() and associated messages (bsc#1262019).\n- scsi: lpfc: ELIMINATE kernel-doc warnings in lpfc.h (bsc#1262019).\n- scsi: lpfc: Fix incorrect txcmplq_cnt during cleanup in lpfc_sli_abort_ring() (bsc#1262019).\n- scsi: lpfc: Introduce 128G link speed selection and support (bsc#1262019).\n- scsi: lpfc: Log discarded and insufficient RQE buffer events (bsc#1262019).\n- scsi: lpfc: Log MCQE contents for mbox commands with no context (bsc#1262019).\n- scsi: lpfc: Properly set WC for DPP mapping (bsc#1262019).\n- scsi: lpfc: Reduce pointer chasing when accessing vmid_flag (bsc#1262019).\n- scsi: lpfc: Remove deprecated PBDE feature (bsc#1262019).\n- scsi: lpfc: Remove unnecessary ndlp kref get in lpfc_check_nlp_post_devloss (bsc#1262019).\n- scsi: lpfc: Restrict first burst to non-FCoE and SLI4 adapters only (bsc#1262019).\n- scsi: lpfc: Select mailbox rq_create cmd version based on SLI4 if_type (bsc#1262019).\n- scsi: lpfc: Update class of service bit field to 3 bits for WQE submissions (bsc#1262019).\n- scsi: lpfc: Update construction of SGL when XPSGL is enabled (bsc#1262019).\n- scsi: lpfc: Update copyright year string for 2026 (bsc#1262019).\n- scsi: lpfc: Update log message when ndlp kref get is unsuccessful (bsc#1262019).\n- scsi: lpfc: Update lpfc version to 14.4.0.14 (bsc#1262019).\n- scsi: lpfc: Update lpfc version to 15.0.0.0 (bsc#1262019).\n- scsi: lpfc: Update outdated comment for renamed lpfc_freenode() (bsc#1262019).\n- scsi: lpfc: Use min_t() instead of min() in lpfc_sli4_driver_resource_setup (bsc#1262019).\n- scsi: lpfc: Use the crc32c() function (bsc#1262019).\n- scsi: mpi3mr: Add NULL checks when resetting request and reply queues (git-fixes).\n- scsi: ses: Fix devices attaching to different hosts (git-fixes).\n- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (git-fixes).\n- scsi: target: iscsi: validate CHAP_R length before base64 decode (bsc#1265449).\n- scsi: ufs: ufs-pci: Add support for Intel Wildcat Lake (jsc#PED-13771).\n- selftests/bpf: Test cross-sign 64bits range refinement (git-fixes).\n- selftests/bpf: Test invariants on JSLT crossing sign (git-fixes).\n- selftests/bpf: test refining u32/s32 bounds when ranges cross min/max boundary (git-fixes).\n- selftests: net: build net/lib dependency in all target (bsc#1262245).\n- selinux: don't reserve xattr slot when we won't fill it (stable-fixes).\n- selinux: prune /sys/fs/selinux/disable (stable-fixes).\n- selinux: shrink critical section in sel_write_load() (stable-fixes).\n- serial: 8250: Add serial8250_handle_irq_locked() (bsc#1262480).\n- serial: 8250: Protect LCR write in shutdown (bsc#1262480).\n- serial: 8250_dw: Avoid unnecessary LCR writes (bsc#1262480).\n- serial: 8250_dw: Ensure BUSY is deasserted (bsc#1262480).\n- serial: 8250_dw: Rework dw8250_handle_irq() locking and IIR handling (bsc#1262480).\n- serial: 8250_dw: Rework IIR_NO_INT handling to stop interrupt storm (bsc#1262480).\n- Set CONFIG_INTEL_TSX_MODE to follow upstream AUTO default (bsc#1263044).\n- soc/tegra: cbb: Set ERD on resume for err interrupt (git-fixes).\n- soc: qcom: aoss: compare against normalized cooling state (git-fixes).\n- soc: qcom: llcc: fix v1 SB syndrome register offset (git-fixes).\n- soc: qcom: ocmem: make the core clock optional (git-fixes).\n- soc: qcom: ocmem: register reasons for probe deferrals (git-fixes).\n- soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available (git-fixes).\n- sound: ua101: fix division by zero at probe (git-fixes).\n- soundwire: bus: demote UNATTACHED state warnings to dev_dbg() (git-fixes).\n- soundwire: cadence: Clear message complete before signaling waiting thread (git-fixes).\n- soundwire: debugfs: initialize firmware_file to empty string (git-fixes).\n- spi: aspeed-smc: fix controller deregistration (git-fixes).\n- spi: at91-usart: fix controller deregistration (git-fixes).\n- spi: atmel: fix controller deregistration (git-fixes).\n- spi: bcm63xx: fix controller deregistration (git-fixes).\n- spi: bcmbca-hsspi: fix controller deregistration (git-fixes).\n- spi: cadence: fix controller deregistration (git-fixes).\n- spi: cadence: fix unclocked access on unbind (git-fixes).\n- spi: ch341: fix memory leaks on probe failures (git-fixes).\n- spi: coldfire-qspi: fix controller deregistration (git-fixes).\n- spi: dln2: fix controller deregistration (git-fixes).\n- spi: fix controller cleanup() documentation (git-fixes).\n- spi: fix misleading controller deregistration kernel-doc (git-fixes).\n- spi: fix misleading controller registration kernel-doc (git-fixes).\n- spi: fsl-espi: fix controller deregistration (git-fixes).\n- spi: fsl-qspi: Use reinit_completion() for repeated operations (git-fixes).\n- spi: fsl: fix controller deregistration (git-fixes).\n- spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo (git-fixes).\n- spi: img-spfi: fix controller deregistration (git-fixes).\n- spi: imx: fix runtime pm leak on probe deferral (git-fixes).\n- spi: imx: fix use-after-free on unbind (git-fixes).\n- spi: lantiq-ssc: fix controller deregistration (git-fixes).\n- spi: meson-spicc: fix controller deregistration (git-fixes).\n- spi: microchip-core-qspi: fix controller deregistration (git-fixes).\n- spi: mpc52xx: fix controller deregistration (git-fixes).\n- spi: mpc52xx: fix use-after-free on registration failure (git-fixes).\n- spi: mpc52xx: fix use-after-free on unbind (git-fixes).\n- spi: mtk-nor: fix controller deregistration (git-fixes).\n- spi: mtk-snfi: fix memory leak in probe (git-fixes).\n- spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback (git-fixes).\n- spi: mxic: fix controller deregistration (git-fixes).\n- spi: mxs: fix controller deregistration (git-fixes).\n- spi: npcm-pspi: fix controller deregistration (git-fixes).\n- spi: omap2-mcspi: fix controller deregistration (git-fixes).\n- spi: orion: fix clock imbalance on registration failure (git-fixes).\n- spi: orion: fix controller deregistration (git-fixes).\n- spi: orion: fix runtime pm leak on unbind (git-fixes).\n- spi: pic32-sqi: fix controller deregistration (git-fixes).\n- spi: pic32: fix controller deregistration (git-fixes).\n- spi: pl022: fix controller deregistration (git-fixes).\n- spi: qup: fix controller deregistration (git-fixes).\n- spi: rockchip: fix controller deregistration (git-fixes).\n- spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ (git-fixes).\n- spi: rspi: fix controller deregistration (git-fixes).\n- spi: s3c64xx: fix controller deregistration (git-fixes).\n- spi: s3c64xx: fix NULL-deref on driver unbind (git-fixes).\n- spi: sh-hspi: fix controller deregistration (git-fixes).\n- spi: sprd: fix controller deregistration (git-fixes).\n- spi: st-ssc4: fix controller deregistration (git-fixes).\n- spi: sun4i: fix controller deregistration (git-fixes).\n- spi: sun6i: fix controller deregistration (git-fixes).\n- spi: syncuacer: fix controller deregistration (git-fixes).\n- spi: ti-qspi: fix controller deregistration (git-fixes).\n- spi: topcliff-pch: fix controller deregistration (git-fixes).\n- spi: topcliff-pch: fix use-after-free on unbind (git-fixes).\n- spi: uniphier: fix controller deregistration (git-fixes).\n- spi: uniphier: Simplify clock handling with devm_clk_get_enabled() (stable-fixes).\n- spi: zynq-qspi: fix controller deregistration (git-fixes).\n- spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() (stable-fixes).\n- spi: zynqmp-gqspi: fix controller deregistration (git-fixes).\n- staging: media: atomisp: Disallow all private IOCTLs (git-fixes).\n- staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() (git-fixes).\n- staging: sm750fb: fix division by zero in ps_to_hz() (git-fixes).\n- staging: vme_user: fix root device leak on init failure (git-fixes).\n- tg3: replace placeholder MAC address with device property (git-fixes).\n- thermal/drivers/spear: Fix error condition for reading st,thermal-flags (git-fixes).\n- thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp (git-fixes).\n- thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata (git-fixes).\n- tools/power/turbostat: Fix microcode patch level output for AMD/Hygon (git-fixes).\n- tools: hv: Fix cross-compilation (git-fixes).\n- tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public() (git-fixes).\n- tpm: avoid -Wunused-but-set-variable (git-fixes).\n- tpm: Fix auth session leak in tpm2_get_random() error path (git-fixes).\n- tpm: tpm_tis: add error logging for data transfer (git-fixes).\n- tpm: tpm_tis: stop transmit if retries are exhausted (git-fixes).\n- tpm: Use kfree_sensitive() to free auth session in tpm_dev_release() (git-fixes).\n- tty: serial: ip22zilog: Fix section mispatch warning (git-fixes).\n- udp: Force compute_score to always inline (bsc#1241259).\n- unshare: fix unshare_fs() handling (git-fixes).\n- USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen (git-fixes).\n- usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (git-fixes).\n- usb: chipidea: otg: not wait vbus drop if use role_switch (git-fixes).\n- USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam (stable-fixes).\n- usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer (stable-fixes).\n- usb: gadget: f_hid: Add missing error code (git-fixes).\n- usb: gadget: f_hid: don't call cdev_init while cdev in use (git-fixes).\n- usb: gadget: f_hid: move list and spinlock inits from bind to alloc (stable-fixes).\n- usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() (git-fixes).\n- usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() (git-fixes).\n- usb: gadget: f_uac1_legacy: validate control request size (stable-fixes).\n- usb: gadget: renesas_usb3: validate endpoint index in standard request handlers (git-fixes).\n- usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo (git-fixes).\n- USB: omap_udc: DMA: Don't enable burst 4 mode (git-fixes).\n- usb: port: add delay after usb_hub_set_port_power() (git-fixes).\n- usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive (stable-fixes).\n- USB: serial: io_edgeport: add support for Blackbox IC135A (stable-fixes).\n- USB: serial: option: add MeiG Smart SRM825WN (stable-fixes).\n- USB: serial: option: add support for Rolling Wireless RW135R-GL (stable-fixes).\n- USB: serial: option: add Telit Cinterion FN990A MBIM composition (git-fixes).\n- USB: serial: option: add Telit Cinterion LE910Cx compositions (stable-fixes).\n- usb: storage: Expand range of matched versions for VL817 quirks entry (git-fixes).\n- usb: typec: tcpm: reset internal port states on soft reset AMS (git-fixes).\n- usb: ulpi: fix memory leak on ulpi_register() error paths (git-fixes).\n- usb: usblp: fix heap leak in IEEE 1284 device ID via short response (stable-fixes).\n- usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl (stable-fixes).\n- usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() (git-fixes).\n- usbip: validate number_of_packets in usbip_pack_ret_submit() (git-fixes).\n- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (git-fixes).\n- vfio/pds: Fix memory leak in pds_vfio_dirty_enable() (git-fixes).\n- vfio/pds: Fix missing detach_ioas op (git-fixes).\n- vfio/pds: replace bitmap_free with vfree (git-fixes).\n- vfio/type1: Fix error unwind in migration dirty bitmap allocation (git-fixes).\n- vfio: Fix unbalanced vfio_df_close call in no-iommu mode (git-fixes).\n- vfio: Prevent open_count decrement to negative (git-fixes).\n- virt: arm-cca-guest: fix error check for RSI_INCOMPLETE (git-fixes).\n- virt: sev-guest: Do not use host-controlled page order in cleanup path (git-fixes).\n- virt: tdx-guest: Fix handling of host controlled 'quote' buffer length (git-fixes).\n- virt: tdx-guest: Return error for GetQuote failures (git-fixes).\n- wifi: ath5k: do not access array OOB (git-fixes).\n- wifi: ath9k: Fix typo (git-fixes).\n- wifi: ath10k: fix station lookup failure during disconnect (git-fixes).\n- wifi: ath11k: fix memory leaks in beacon template setup (git-fixes).\n- wifi: ath12k: fix leak in some ath12k_wmi_xxx() functions (git-fixes).\n- wifi: ath12k: use lockdep_assert_in_rcu_read_lock() for RCU assertions (git-fixes).\n- wifi: b43: enforce bounds check on firmware key index in b43_rx() (git-fixes).\n- wifi: b43legacy: enforce bounds check on firmware key index in RX path (git-fixes).\n- wifi: brcmfmac: Fix error pointer dereference (git-fixes).\n- wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task (git-fixes).\n- wifi: brcmfmac: validate bsscfg indices in IF events (stable-fixes).\n- wifi: brcmsmac: Fix dma_free_coherent() size (git-fixes).\n- wifi: cw1200: Revert \"Fix locking in error paths\" (git-fixes).\n- wifi: libertas: notify firmware load wait on disconnect (git-fixes).\n- wifi: mac80211: check ieee80211_rx_data_set_link return in pubsta MLO path (git-fixes).\n- wifi: mac80211: check tdls flag in ieee80211_tdls_oper (stable-fixes).\n- wifi: mac80211: drop stray 'static' from fast-RX rx_result (git-fixes).\n- wifi: mac80211: handle VHT EXT NSS in ieee80211_determine_our_sta_mode() (git-fixes).\n- wifi: mac80211: remove station if connection prep fails (git-fixes).\n- wifi: mac80211: use safe list iteration in radar detect work (git-fixes).\n- wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req() (git-fixes).\n- wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor (stable-fixes).\n- wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling (git-fixes).\n- wifi: mt76: mt7615: fix use_cts_prot support (git-fixes).\n- wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() (git-fixes).\n- wifi: mt76: mt7915: fix use_cts_prot support (git-fixes).\n- wifi: mt76: mt7921: fix 6GHz regulatory update on connection (git-fixes).\n- wifi: mt76: mt7921: fix a potential clc buffer length underflow (git-fixes).\n- wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work (git-fixes).\n- wifi: mt76: mt7921: Place upper limit on station AID (git-fixes).\n- wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() (git-fixes).\n- wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr (git-fixes).\n- wifi: mt76: mt7925: fix incorrect length field in txpower command (git-fixes).\n- wifi: mt76: mt7925: Fix incorrect MLO mode in firmware control (git-fixes).\n- wifi: mt76: mt7925: fix incorrect TLV length in CLC command (git-fixes).\n- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_tx_check_aggr() (git-fixes).\n- wifi: mt76: mt7925: prevent NULL vif dereference in mt7925_mac_write_txwi (git-fixes).\n- wifi: mt76: mt7996: fix FCS error flag check in RX descriptor (git-fixes).\n- wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event (git-fixes).\n- wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work() (git-fixes).\n- wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() (git-fixes).\n- wifi: nl80211: fix NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST usage (git-fixes).\n- wifi: nl80211: require admin perm on SET_PMK / DEL_PMK (git-fixes).\n- wifi: rsi: fix kthread lifetime race between self-exit and external-stop (git-fixes).\n- wifi: rt2x00usb: fix devres lifetime (git-fixes).\n- wifi: rtl8xxxu: fix potential use of uninitialized value (git-fixes).\n- wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet (git-fixes).\n- wifi: rtw88: Add additional USB IDs for RTL8812BU (bsc#1263135).\n- wifi: rtw88: Add BUFFALO WI-U3-866DHP to the USB ID list (bsc#1263135).\n- wifi: rtw88: Add support for Mercusys MA30N and D-Link DWA-T185 rev. A1 (bsc#1263135).\n- wifi: rtw88: check for PCI upstream bridge existence (git-fixes).\n- wifi: rtw88: fix device leak on probe failure (git-fixes).\n- wifi: rtw88: rtw8822bu VID/PID for BUFFALO WI-U2-866DM (bsc#1263135).\n- wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() (git-fixes).\n- wifi: wl1251: validate packet IDs before indexing tx_frames (stable-fixes).\n- x86/acpi/boot: Correct acpi_is_processor_usable() check again (git-fixes).\n- x86/boot/sev: Avoid shared GHCB page for early memory acceptance (git-fixes).\n- x86/boot/sev: Support memory acceptance in the EFI stub under SVSM (git-fixes).\n- x86/boot: Fix page table access in 5-level to 4-level paging transition (git-fixes).\n- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (bsc#1263255).\n- x86/cpufeatures: Free up unused feature bits (bsc#1263255).\n- x86/fred: Fix early boot failures on SEV-ES/SNP guests (git-fixes).\n- x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (git-fixes).\n- x86/sev: Add missing RIP_REL_REF() invocations during sme_enable() (git-fixes).\n- x86/sev: Do not touch VMSA pages during SNP guest memory kdump (git-fixes).\n- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (git-fixes).\n- x86/sev: Fix operator precedence in GHCB_MSR_VMPL_REQ_LEVEL macro (git-fixes).\n- x86/sev: Improve handling of writes to intercepted TSC MSRs (git-fixes).\n- x86/sev: Make sure pages are not skipped during kdump (git-fixes).\n- x86/tsx: Get the tsx= command line parameter with early_param() (bsc#1250951 bsc#1263044).\n- x86/tsx: Make tsx_ctrl_state static (bsc#1250951 bsc#1263044).\n- x86/vmware: Parse MP tables for SEV-SNP enabled guests under VMware hypervisors (git-fixes).\n- X.509: Fix out-of-bounds access when parsing extensions (git-fixes).\n- Xarray: do not return sibling entries from xas_find_marked() (bsc#1263815).\n","status":"published","published":"2026-05-28T11:49:10Z","modified":"2026-06-02T18:24:25.768544597Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:21860-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).\n- CVE-2024-14027: xattr: switch to CLASS(fd) (bsc#1259420).\n- CVE-2025-40181: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (bsc#1253471).\n- CVE-2025-68265: nvme: fix admin request_queue lifetime (bsc#1255360).\n- CVE-2025-68310: s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (bsc#1255160).\n- CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).\n- CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).\n- CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).\n- CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).\n- CVE-2026-23276: net: add xmit recursion limit to tunnel xmit functions (bsc#1260012).\n- CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).\n- CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).\n- CVE-2026-23316: net: ipv4: fix ARM64 alignment fault in multipath hash seed (bsc#1260573).\n- CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).\n- CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).\n- CVE-2026-23346: arm64: io: Rename ioremap_prot() to __ioremap_prot() (bsc#1260529).\n- CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).\n- CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).\n- CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).\n- CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).\n- CVE-2026-23375: mm: thp: deny THP for files on anonymous inodes (bsc#1260576).\n- CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).\n- CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).\n- CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).\n- CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).\n- CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).\n- CVE-2026-23417: bpf: Fix constant blinding for PROBE_MEM32 stores (bsc#1261410).\n- CVE-2026-23436: net: add helpers for lookup and walking netdevs under netdev_lock() (bsc#1261617).\n- CVE-2026-23437: net: shaper: protect late read accesses to the hierarchy (bsc#1261635).\n- CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).\n- CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).\n- CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).\n- CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).\n- CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).\n- CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).\n- CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).\n- CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).\n- CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).\n- CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).\n- CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).\n- CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).\n- CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on wakeup race (bsc#1261694).\n- CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).\n- CVE-2026-31395: bnxt_en: fix OOB access in DBG_BUF_PRODUCER async event handler (bsc#1261786).\n- CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).\n- CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).\n- CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).\n- CVE-2026-31406: xfrm: Fix work re-schedule after cancel in xfrm_nat_keepalive_net_fini() (bsc#1261629).\n- CVE-2026-31407: netfilter: conntrack: add missing netlink policy validations (bsc#1261632).\n- CVE-2026-31411: net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (bsc#1261752).\n- CVE-2026-31415: ipv6: avoid overflows in ip6_datagram_send_ctl() (bsc#1262099).\n- CVE-2026-31416: netfilter: nfnetlink_log: account for netlink header size (bsc#1262100).\n- CVE-2026-31420: bridge: mrp: reject zero test interval to avoid OOM panic (bsc#1262055).\n- CVE-2026-31421: net/sched: cls_fw: fix NULL pointer dereference on shared blocks (bsc#1262061).\n- CVE-2026-31422: net/sched: cls_flow: fix NULL pointer dereference on shared blocks (bsc#1262054).\n- CVE-2026-31423: net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() (bsc#1262063).\n- CVE-2026-31424: netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (bsc#1262053).\n- CVE-2026-31425: rds: ib: reject FRMR registration before IB connection is established (bsc#1262074).\n- CVE-2026-31427: netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp (bsc#1262086).\n- CVE-2026-31428: netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (bsc#1262087).\n- CVE-2026-31435: netfs: Fix read abandonment during retry (bsc#1262601).\n- CVE-2026-31449: ext4: validate p_idx bounds in ext4_ext_correct_indexes (bsc#1262616).\n- CVE-2026-31453: xfs: avoid dereferencing log items after push callbacks (bsc#1262617).\n- CVE-2026-31456: mm/pagewalk: fix race between concurrent split and refault (bsc#1262627).\n- CVE-2026-31494: net: cadence: macb: Synchronize stats calculations (bsc#1262671).\n- CVE-2026-31496: netfilter: nf_conntrack_expect: skip expectations in other netns via proc (bsc#1262673).\n- CVE-2026-31503: udp: Fix wildcard bind conflict check when using hash2 (bsc#1263077).\n- CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263085).\n- CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263093).\n- CVE-2026-31507: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer (bsc#1263095).\n- CVE-2026-31515: af_key: validate families in pfkey_send_migrate() (bsc#1262752).\n- CVE-2026-31519: btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create (bsc#1263012).\n- CVE-2026-31525: bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN (bsc#1262725).\n- CVE-2026-31526: bpf: Fix exception exit lock checking for subprogs (bsc#1262662).\n- CVE-2026-31528: perf: Make sure to use pmu_ctx-\u003epmu for groups (bsc#1263001).\n- CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262758).\n- CVE-2026-31547: drm/xe: Fix missing runtime PM reference in ccs_mode_store (bsc#1263018).\n- CVE-2026-31550: pmdomain: bcm: bcm2835-power: Increase ASB control timeout (bsc#1263104).\n- CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263107).\n- CVE-2026-31565: RDMA/irdma: Fix deadlock during netdev reset with active connections (bsc#1263064).\n- CVE-2026-31579: wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit (bsc#1263074).\n- CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263176).\n- CVE-2026-31588: KVM: x86: Use scratch field in MMIO fragment to hold small write values (bsc#1263165).\n- CVE-2026-31644: net: lan966x: fix use-after-free and leak in lan966x_fdma_reload() (bsc#1263048).\n- CVE-2026-31649: net: stmmac: fix integer underflow in chain mode (bsc#1263582).\n- CVE-2026-31658: net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() (bsc#1263052).\n- CVE-2026-31662: tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (bsc#1263131).\n- CVE-2026-31666: btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref() (bsc#1263138).\n- CVE-2026-31668: seg6: separate dst_cache for input and output paths in seg6 lwtunnel (bsc#1263140).\n- CVE-2026-31669: mptcp: fix slab-use-after-free in __inet_lookup_established (bsc#1263141).\n- CVE-2026-31675: net/sched: sch_netem: fix out-of-bounds access in packet corruption (bsc#1263556).\n- CVE-2026-31678: openvswitch: defer tunnel netdev_put to RCU release (bsc#1263562).\n- CVE-2026-31679: openvswitch: validate MPLS set/set_masked payload length (bsc#1263592).\n- CVE-2026-31681: netfilter: xt_multiport: validate range encoding in checkentry (bsc#1263593).\n- CVE-2026-31682: bridge: br_nd_send: linearize skb before parsing ND options (bsc#1263595).\n- CVE-2026-31684: net: sched: act_csum: validate nested VLAN headers (bsc#1263596).\n- CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263668).\n- CVE-2026-31691: igb: remove napi_synchronize() in igb_down() (bsc#1263604).\n- CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263901).\n- CVE-2026-31700: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (bsc#1263882).\n- CVE-2026-31738: vxlan: validate ND option lengths in vxlan_na_create (bsc#1264059).\n- CVE-2026-31787: xen/privcmd: fix double free via VMA splitting (bsc#1262181).\n- CVE-2026-43009: bpf: Fix incorrect pruning due to atomic fetch precision tracking (bsc#1264014).\n- CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1263931).\n- CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1263933).\n- CVE-2026-43037: ip6_tunnel: clear skb2-\u003ecb in ip4ip6_err() (bsc#1263995).\n- CVE-2026-43038: ipv6: icmp: clear skb2-\u003ecb in ip6_err_gen_icmpv6_unreach() (bsc#1264097).\n- CVE-2026-43045: mshv: Refactor and rename memory region handling functions (bsc#1263942).\n- CVE-2026-43050: atm: lec: fix use-after-free in sock_def_readable() (bsc#1264082).\n- CVE-2026-43060: netfilter: nft_ct: drop pending enqueued packets on removal (bsc#1264183).\n- CVE-2026-43082: net: txgbe: leave space for null terminators on property_entry (bsc#1264233).\n- CVE-2026-43088: net: af_key: zero aligned sockaddr tail in PF_KEY exports (bsc#1264469).\n- CVE-2026-43153: xfs: remove xfs_attr_leaf_hasname (bsc#1264586).\n- CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264848).\n- CVE-2026-43265: KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block() (bsc#1264427).\n- CVE-2026-43329: netfilter: flowtable: strictly check for maximum number of actions (bsc#1265085).\n- CVE-2026-43365: xfs: fix undersized l_iclog_roundoff values (bsc#1265119).\n- CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265116).\n- CVE-2026-43441: net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1264674).\n- CVE-2026-43494: net/rds: reset op_nents when zerocopy page pin fails (bsc#1265626).\n- CVE-2026-43503: net: skbuff: propagate shared-frag marker through frag-transfer helpers (bsc#1265960).\n\nThe following non security issues were fixed:\n\n- accel/qaic: Add overflow check to remap_pfn_range during mmap (git-fixes).\n- ACPI: AGDI: fix missing newline in error message (git-fixes).\n- ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug (git-fixes).\n- ACPI: scan: Use acpi_dev_put() in object add error paths (git-fixes).\n- ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO (git-fixes).\n- ACPI: video: force native backlight on HP OMEN 16 (8A44) (stable-fixes).\n- ACPI: video: Move Lenovo Legion S7 15ACH6 quirk to the right section (git-fixes).\n- ALSA: 6fire: Fix input volume change detection (git-fixes).\n- ALSA: 6fire: fix use-after-free on disconnect (git-fixes).\n- ALSA: aoa: i2sbus: clear stale prepared state (git-fixes).\n- ALSA: aoa: i2sbus: fix OF node lifetime handling (git-fixes).\n- ALSA: aoa: Skip devices with no codecs in i2sbus_resume() (git-fixes).\n- ALSA: aoa: Use guard() for mutex locks (stable-fixes).\n- ALSA: asihpi: avoid write overflow check warning (stable-fixes).\n- ALSA: caiaq: Don't abort when no input device is available (git-fixes).\n- ALSA: caiaq: Fix control_put() result and cache rollback (git-fixes).\n- ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path (git-fixes).\n- ALSA: caiaq: fix usb_dev refcount leak on probe failure (git-fixes).\n- ALSA: caiaq: Handle probe errors properly (git-fixes).\n- ALSA: caiaq: take a reference on the USB device in create_card() (git-fixes).\n- ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() (git-fixes).\n- ALSA: core: Fix potential data race at fasync handling (git-fixes).\n- ALSA: core: Serialize deferred fasync state checks (git-fixes).\n- ALSA: core: Validate compress device numbers without dynamic minors (git-fixes).\n- ALSA: ctxfi: Add fallback to default RSR for S/PDIF (git-fixes).\n- ALSA: ctxfi: Fix missing SPDIFI1 index handling (stable-fixes).\n- ALSA: ctxfi: Limit PTP to a single page (git-fixes).\n- ALSA: firewire-tascam: Do not drop unread control events (git-fixes).\n- ALSA: fireworks: bound device-supplied status before string array lookup (git-fixes).\n- ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 (stable-fixes).\n- ALSA: hda/realtek - fixed speaker no sound update (git-fixes).\n- ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk (stable-fixes).\n- ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx (stable-fixes).\n- ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC (stable-fixes).\n- ALSA: hda/realtek: add quirk for Framework F111:000F (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 (stable-fixes).\n- ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') (git-fixes).\n- ALSA: hda: cs35l41: Put ACPI device on missing physical node (git-fixes).\n- ALSA: hda: cs35l56: Propagate ASP TX source control errors (git-fixes).\n- ALSA: hda: cs35l56: Put ACPI device after setting companion (git-fixes).\n- ALSA: hda: Fix NULL pointer dereference in snd_hda_ctl_add() (git-fixes).\n- ALSA: misc: Use guard() for spin locks (stable-fixes).\n- ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger (stable-fixes).\n- ALSA: pcmtest: fix reference leak on failed device registration (git-fixes).\n- ALSA: pcmtest: Fix resource leaks in module init error paths (git-fixes).\n- ALSA: pcmtest: Return -EFAULT on pattern read copy failure (git-fixes).\n- ALSA: sc6000: Keep the programmed board state in card-private data (git-fixes).\n- ALSA: scarlett2: Add missing error check when initialise Autogain Status (git-fixes).\n- ALSA: scarlett2: Add missing sentinel initializer field (git-fixes).\n- ALSA: seq: Notify client and port info changes (stable-fixes).\n- ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes (stable-fixes).\n- ALSA: usb-audio: apply quirk for MOONDROP JU Jiu (stable-fixes).\n- ALSA: usb-audio: Avoid false E-MU sample-rate notifications (git-fixes).\n- ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() (git-fixes).\n- ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans (git-fixes).\n- ALSA: usb-audio: Bound MIDI endpoint descriptor scans (git-fixes).\n- ALSA: usb-audio: Evaluate packsize caps at the right place (git-fixes).\n- ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch (git-fixes).\n- ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams (git-fixes).\n- ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex (stable-fixes).\n- ALSA: usb-audio: Fix UAC3 cluster descriptor size check (git-fixes).\n- ALSA: usb-audio: midi2: Restart output URBs on resume (git-fixes).\n- ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES (git-fixes).\n- ALSA: virtio: drop an extaneous kernel-doc comment (git-fixes).\n- amdgpu/jpeg: fix deepsleep register for jpeg 5_0_0 and 5_0_2 (stable-fixes).\n- ASoC: amd: acp: Add DMI quirk for Valve Steam Deck OLED (git-fixes).\n- ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF (stable-fixes).\n- ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table (stable-fixes).\n- ASoC: codecs: ab8500: Fix casting of private data (git-fixes).\n- ASoC: cs35l56: Destroy workqueue in probe error path (git-fixes).\n- ASoC: cs35l56: Don't use devres to unregister component (git-fixes).\n- ASoC: cs35l56: Fix hibernate write in runtime resume error path (git-fixes).\n- ASoC: fsl_easrc: Change the type for iec958 channel status controls (git-fixes).\n- ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() (git-fixes).\n- ASoC: fsl_easrc: fix comment typo (git-fixes).\n- ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() (git-fixes).\n- ASoC: fsl_micfil: Add access property for \"VAD Detected\" (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in micfil_quality_set() (git-fixes).\n- ASoC: fsl_xcvr: Fix event generation for cached controls (git-fixes).\n- ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() (git-fixes).\n- ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() (git-fixes).\n- ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error (git-fixes).\n- ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop (git-fixes).\n- ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens (git-fixes).\n- ASoC: qcom: q6apm: move component registration to unmanaged version (git-fixes).\n- ASoC: qcom: q6apm: remove child devices when apm is removed (git-fixes).\n- ASoC: qcom: qdsp6: topology: check widget type before accessing data (git-fixes).\n- ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list (stable-fixes).\n- ASoC: SOF: compress: return the configured codec from get_params (git-fixes).\n- ASoC: SOF: Don't allow pointer operations on unconfigured streams (git-fixes).\n- ASoC: SOF: Intel: hda: Place check before dereference (git-fixes).\n- ASoC: SOF: topology: reject invalid vendor array size in token parser (stable-fixes).\n- ASoC: sti: Return errors from regmap_field_alloc() (git-fixes).\n- ASoC: sti: use managed regmap_field allocations (git-fixes).\n- ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J (stable-fixes).\n- ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 (stable-fixes).\n- backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() (git-fixes).\n- batman-adv: bla: only purge non-released claims (git-fixes).\n- batman-adv: bla: prevent use-after-free when deleting claims (git-fixes).\n- batman-adv: bla: put backbone reference on failed claim hash insert (git-fixes).\n- batman-adv: fix integer overflow on buff_pos (git-fixes).\n- batman-adv: hold claim backbone gateways by reference (git-fixes).\n- batman-adv: reject new tp_meter sessions during teardown (git-fixes).\n- batman-adv: reject oversized global TT response buffers (git-fixes).\n- batman-adv: stop caching unowned originator pointers in BAT IV (git-fixes).\n- bitfield: Add FIELD_MODIFY() helper (jsc#PED-14238).\n- Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling (git-fixes).\n- Bluetooth: btmtk: validate WMT event SKB length before struct access (git-fixes).\n- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (bsc#1260996).\n- Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (git-fixes).\n- Bluetooth: hci_event: fix memset typo (git-fixes).\n- Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt (git-fixes).\n- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (git-fixes).\n- Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (git-fixes).\n- Bluetooth: HIDP: serialise l2cap_unregister_user via hidp_session_sem (git-fixes).\n- Bluetooth: ISO: Fix data-race on dst in iso_sock_connect() (git-fixes).\n- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (git-fixes).\n- Bluetooth: l2cap: fix MPS check in l2cap_ecred_reconf_req (git-fixes).\n- Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (git-fixes).\n- Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() (git-fixes).\n- Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU (git-fixes).\n- Bluetooth: RFCOMM: pull credit byte with skb_pull_data() (git-fixes).\n- Bluetooth: SCO: check for codecs-\u003enum_codecs == 1 before assigning to sco_pi(sk)-\u003ecodec (git-fixes).\n- Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready (git-fixes).\n- Bluetooth: SCO: hold sk properly in sco_conn_ready (git-fixes).\n- Bluetooth: virtio_bt: clamp rx length before skb_put (git-fixes).\n- Bluetooth: virtio_bt: validate rx pkt_type header length (git-fixes).\n- bpf: Add third round of bounds deduction (git-fixes).\n- bpf: Fix u32/s32 bounds when ranges cross min/max boundary (git-fixes).\n- bpf: Improve bounds when s64 crosses sign boundary (git-fixes).\n- bpf: Switch CONFIG_CFI_CLANG to CONFIG_CFI (git-fixes).\n- btrfs: qgroup: update all parent qgroups when doing quick inherit (bsc#1258933).\n- btrfs: reject root items with drop_progress and zero drop_level (git-fixes).\n- btrfs: replace BUG() with error handling in __btrfs_balance() (git-fixes).\n- bus: mhi: host: pci_generic: Switch to async power up to avoid boot delays (git-fixes).\n- bus: rifsc: fix RIF configuration check for peripherals (git-fixes).\n- can: mcp251x: add error handling for power enable in open and resume (stable-fixes).\n- can: raw: fix ro-\u003euniq use-after-free in raw_rcv() (git-fixes).\n- can: ucan: fix devres lifetime (git-fixes).\n- cdc-acm: new quirk for EPSON HMD (stable-fixes).\n- check-for-config-changes: Exclude CC_MS_EXTENSIONS.\n- check-for-config-changes: Exclude HAVE_CFI_ICALL_NORMALIZE_INTEGERS{,_RUSTC}.\n- comedi: dt2815: add hardware detection to prevent crash (stable-fixes).\n- cpufreq: intel_pstate: Drop Arrow Lake from \"scaling factor\" list (bsc#1249104).\n- crypto: af_alg - limit RX SG extraction by receive buffer budget (git-fixes).\n- crypto: algif_aead - Fix minimum RX size check for decryption (git-fixes).\n- crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup (git-fixes).\n- crypto: atmel-ecc - Release client on allocation failure (git-fixes).\n- crypto: atmel-sha204a - Fix error codes in OTP reads (git-fixes).\n- crypto: atmel-sha204a - Fix OTP sysfs read and error handling (git-fixes).\n- crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path (git-fixes).\n- crypto: atmel-sha204a - Fix uninitialized data access on OTP read error (git-fixes).\n- crypto: atmel-tdes - fix DMA sync direction (git-fixes).\n- crypto: ccp - copy IV using skcipher ivsize (git-fixes).\n- crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (git-fixes).\n- crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (git-fixes).\n- crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (git-fixes).\n- crypto: ccree - fix a memory leak in cc_mac_digest() (git-fixes).\n- crypto: drivers - Switch back to struct platform_driver::remove() (jsc#PED-14238).\n- crypto: drivers - Use str_enable_disable-like helpers (jsc#PED-14238).\n- crypto: hisilicon - Fix dma_unmap_single() direction (git-fixes).\n- crypto: iaa - Adjust workqueue allocation type (jsc#PED-14238).\n- crypto: iaa - fix per-node CPU counter reset in rebalance_wq_table() (git-fixes).\n- crypto: iaa - Move compression CRC into request object (jsc#PED-14238).\n- crypto: iaa - Optimize rebalance_wq_table() (jsc#PED-14238).\n- crypto: iaa - Remove potential infinite loop in check_completion() (jsc#PED-14238).\n- crypto: iaa - Remove unreachable pr_debug from iaa_crypto_cleanup_module (jsc#PED-14238).\n- crypto: iaa - Remove unused disable_async argument from iaa_decompress (jsc#PED-14238).\n- crypto: iaa - Replace sprintf with sysfs_emit in sysfs show functions (jsc#PED-14238).\n- crypto: iaa - Simplify init_iaa_device() (jsc#PED-14238).\n- crypto: jitterentropy - replace long-held spinlock with mutex (git-fixes).\n- crypto: nx - Fix packed layout in struct nx842_crypto_header (git-fixes).\n- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (git-fixes).\n- crypto: qat - #undef field_get() before local definition (jsc#PED-14238).\n- crypto: qat - add adf_rl_get_num_svc_aes() in rate limiting (jsc#PED-14238).\n- crypto: qat - add bank state save and restore for qat_420xx (jsc#PED-14238).\n- crypto: qat - add command queue telemetry counters for GEN6 (jsc#PED-14238).\n- crypto: qat - add compression slice count for rate limiting (jsc#PED-14238).\n- crypto: qat - add decompression service for rate limiting (jsc#PED-14238).\n- crypto: qat - add decompression service to telemetry (jsc#PED-14238).\n- crypto: qat - add firmware headers for GEN6 devices (jsc#PED-14238).\n- crypto: qat - add GEN6 firmware loader (jsc#PED-14238).\n- crypto: qat - add get_svc_slice_cnt() in device data structure (jsc#PED-14238).\n- crypto: qat - add live migration enablers for GEN6 devices (jsc#PED-14238).\n- crypto: qat - add macro to write 64-bit values to registers (jsc#PED-14238).\n- crypto: qat - add missing header inclusion (jsc#PED-14238).\n- crypto: qat - add qat_6xxx driver (jsc#PED-14238).\n- crypto: qat - add ring buffer idle telemetry counter for GEN6 (jsc#PED-14238).\n- crypto: qat - add support for decompression service to GEN6 devices (jsc#PED-14238).\n- crypto: qat - consolidate service enums (jsc#PED-14238).\n- crypto: qat - Constify struct pm_status_row (jsc#PED-14238).\n- crypto: qat - disable 4xxx AE cluster when lead engine is fused off (git-fixes).\n- crypto: qat - disable 420xx AE cluster when lead engine is fused off (git-fixes).\n- crypto: qat - do not export adf_cfg_services (jsc#PED-14238).\n- crypto: qat - enable power management debugfs for GEN6 devices (jsc#PED-14238).\n- crypto: qat - enable RAS support for GEN6 devices (jsc#PED-14238).\n- crypto: qat - enable rate limiting feature for GEN6 devices (jsc#PED-14238).\n- crypto: qat - enable reporting of error counters for GEN6 devices (jsc#PED-14238).\n- crypto: qat - enable telemetry for GEN6 devices (jsc#PED-14238).\n- crypto: qat - export adf_get_service_mask() (jsc#PED-14238).\n- crypto: qat - export adf_init_admin_pm() (jsc#PED-14238).\n- crypto: qat - expose configuration functions (jsc#PED-14238).\n- crypto: qat - fix compression instance leak (git-fixes).\n- crypto: qat - fix IRQ cleanup on 6xxx probe failure (git-fixes).\n- crypto: qat - fix object goals in Makefiles (jsc#PED-14238.\n- crypto: qat - fix type mismatch in RAS sysfs show functions (git-fixes).\n- crypto: qat - Fix typo \"accelaration\" (jsc#PED-14238).\n- crypto: qat - fix virtual channel configuration for GEN6 devices (jsc#PED-14238).\n- crypto: qat - include qat_common in top Makefile (jsc#PED-14238).\n- crypto: qat - introduce fuse array (jsc#PED-14238).\n- crypto: qat - make adf_dev_autoreset() static (jsc#PED-14238).\n- crypto: qat - optimize allocations for fw authentication (jsc#PED-14238).\n- crypto: qat - refactor compression template logic (jsc#PED-14238).\n- crypto: qat - refactor FW signing algorithm (jsc#PED-14238).\n- crypto: qat - refactor ring-related debug functions (jsc#PED-14238).\n- crypto: qat - refactor service parsing logic (jsc#PED-14238).\n- crypto: qat - relocate and rename bank state structure definition (jsc#PED-14238).\n- crypto: qat - relocate bank state helper functions (jsc#PED-14238).\n- crypto: qat - relocate power management debugfs helper APIs (jsc#PED-14238).\n- crypto: qat - relocate service related functions (jsc#PED-14238).\n- crypto: qat - remove BITS_IN_DWORD() (jsc#PED-14238).\n- crypto: qat - Remove dst_null support (jsc#PED-14238).\n- crypto: qat - remove duplicate masking for GEN6 devices (jsc#PED-14238).\n- crypto: qat - remove initialization in device class (jsc#PED-14238).\n- crypto: qat - remove redundant FW image size check (jsc#PED-14238).\n- crypto: qat - remove unused adf_devmgr_get_first (jsc#PED-14238).\n- crypto: qat - remove unused members in suof structure (jsc#PED-14238).\n- crypto: qat - rename and relocate timer logic (jsc#PED-14238).\n- crypto: qat - reorder objects in qat_common Makefile (jsc#PED-14238).\n- crypto: qat - replace CHECK_STAT macro with static inline function (jsc#PED-14238).\n- crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() (jsc#PED-14238).\n- crypto: qat - restore ASYM service support for GEN6 devices (jsc#PED-14238).\n- crypto: qat - Return pointer directly in adf_ctl_alloc_resources (jsc#PED-14238).\n- crypto: qat - set command ids as reserved (jsc#PED-14238).\n- crypto: qat - switch to standard pattern for PCI IDs (jsc#PED-14238).\n- crypto: qat - update firmware api (jsc#PED-14238).\n- crypto: qat - use pr_fmt() in adf_gen4_hw_data.c (jsc#PED-14238).\n- crypto: qat - use pr_fmt() in qat uclo.c (jsc#PED-14238).\n- crypto: qat - use simple_strtoull to improve qat_uclo_parse_num (jsc#PED-14238).\n- crypto: qat - use swab32 macro (git-fixes).\n- crypto: qat - validate service in rate limiting sysfs api (jsc#PED-14238).\n- crypto: qat/qat_6xxx - Fix NULL vs IS_ERR() check in adf_probe() (jsc#PED-14238).\n- crypto: sa2ul - Fix AEAD fallback algorithm names (git-fixes).\n- crypto: simd - reject compat registrations without __ prefixes (git-fixes).\n- crypto: talitos - fix SEC1 32k ahash request limitation (git-fixes).\n- crypto: tegra - Disable softirqs before finalizing request (git-fixes).\n- devres: fix missing node debug info in devm_krealloc() (git-fixes).\n- dmaengine: dw-axi-dmac: fix Alignment should match open parenthesis (git-fixes).\n- dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function (git-fixes).\n- dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() (git-fixes).\n- dpll: zl3073x: Add support to adjust phase (bsc#1255752).\n- dpll: zl3073x: Fix output pin phase adjustment sign (bsc#1255752).\n- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (bsc#1255752).\n- dpll: zl3073x: Specify phase adjustment granularity for pins (bsc#1255752).\n- drivers/base/memory: fix memory block reference leak in poison accounting (git-fixes).\n- drm/amd/display: Add NULL check for integrated_info in clk_mgr_construct (git-fixes).\n- drm/amd/display: Allow DCE link encoder without AUX registers (git-fixes).\n- drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths (git-fixes).\n- drm/amd/display: Change dither policy for 10 bpc output back to dithering (git-fixes).\n- drm/amd/display: Correct logic check error for fastboot (git-fixes).\n- drm/amd/display: Disable 10-bit truncation and dithering on DCE 6.x (git-fixes).\n- drm/amd/display: Disable fastboot on DCE 6 too (stable-fixes).\n- drm/amd/display: Read EDID from VBIOS embedded panel info (git-fixes).\n- drm/amd/pm/ci: Clear EnabledForActivity field for memory levels (git-fixes).\n- drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs (git-fixes).\n- drm/amd/pm/ci: Fill DW8 fields from SMC (git-fixes).\n- drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 (git-fixes).\n- drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled (git-fixes).\n- drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board (git-fixes).\n- drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock (git-fixes).\n- drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x (git-fixes).\n- drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) (git-fixes).\n- drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ (stable-fixes).\n- drm/amdgpu/gfx10: look at the right prop for gfx queue priority (git-fixes).\n- drm/amdgpu/gfx11: look at the right prop for gfx queue priority (git-fixes).\n- drm/amdgpu/gmc: Fix AMDGPU_GART_PLACEMENT_LOW to not overlap with VRAM (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.5 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.0 ring (git-fixes).\n- drm/amdgpu/pm: add missing revision check for CI (git-fixes).\n- drm/amdgpu/pm: align Hawaii mclk workaround with radeon (git-fixes).\n- drm/amdgpu/pm: drop SMU driver if version not matched messages (stable-fixes).\n- drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission (git-fixes).\n- drm/amdgpu/vce: Prevent partial address patches (stable-fixes).\n- drm/amdgpu/vcn3: Avoid overflow on msg bound check (git-fixes).\n- drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (stable-fixes).\n- drm/amdgpu/vcn4: Avoid overflow on msg bound check (git-fixes).\n- drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (stable-fixes).\n- drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (stable-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v4.0.5 enc ring (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v5.0.0 enc ring (git-fixes).\n- drm/amdgpu: Add bounds checking to ib_{get,set}_value (stable-fixes).\n- drm/amdgpu: Add default case in DVI mode validation (git-fixes).\n- drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG (git-fixes).\n- drm/amdgpu: fix zero-size GDS range init on RDNA4 (stable-fixes).\n- drm/amdgpu: gate VM CPU HDP flush on reset lock (stable-fixes).\n- drm/amdgpu: replace PASID IDR with XArray (git-fixes).\n- drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count (stable-fixes).\n- drm/amdgpu: zero-initialize GART table on allocation (stable-fixes).\n- drm/amdkfd: Add upper bound check for num_of_nodes (stable-fixes).\n- drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure (stable-fixes).\n- drm/amdkfd: Make all TLB-flushes heavy-weight (stable-fixes).\n- drm/amdkfd: validate SVM ioctl nattr against buffer size (stable-fixes).\n- drm/arcpgu: fix device node leak (git-fixes).\n- drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs (git-fixes).\n- drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check (git-fixes).\n- drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() (git-fixes).\n- drm/bridge: stm_lvds: Do not fail atomic_check on disabled connector (git-fixes).\n- drm/etnaviv: Fix armed job not being pushed to the DRM scheduler (git-fixes).\n- drm/exynos: remove bridge when component_add fails (git-fixes).\n- drm/fb-helper: Fix clipping when damage area spans a single scanline (git-fixes).\n- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (git-fixes).\n- drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup (git-fixes).\n- drm/gma500/oaktrail_lvds: fix hang on init failure (git-fixes).\n- drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init (git-fixes).\n- drm/i915/dp: Fix VSC dynamic range signaling for RGB formats (git-fixes).\n- drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (git-fixes).\n- drm/i915/wm: Verify the correct plane DDB entry (git-fixes).\n- drm/i915: skip __i915_request_skip() for already signaled requests (git-fixes).\n- drm/imagination: Switch reset_reason fields from enum to u32 (git-fixes).\n- drm/komeda: fix integer overflow in AFBC framebuffer size check (git-fixes).\n- drm/loongson: Use managed KMS polling (git-fixes).\n- drm/msm/a6xx: Fix dumping A650+ debugbus blocks (git-fixes).\n- drm/msm/a6xx: Fix HLSQ register dumping (git-fixes).\n- drm/msm/a6xx: Use barriers while updating HFI Q headers (git-fixes).\n- drm/msm/dpu: fix mismatch between power and frequency (git-fixes).\n- drm/msm/dsi: add the missing parameter description (git-fixes).\n- drm/msm/dsi: fix bits_per_pclk (git-fixes).\n- drm/msm/dsi: fix hdisplay calculation for CMD mode panel (git-fixes).\n- drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 (git-fixes).\n- drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata() (git-fixes).\n- drm/msm/shrinker: Fix can_block() logic (git-fixes).\n- drm/nouveau: fix nvkm_device leak on aperture removal failure (git-fixes).\n- drm/nouveau: fix u32 overflow in pushbuf reloc bounds check (git-fixes).\n- drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds (git-fixes).\n- drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds (git-fixes).\n- drm/panel: sharp-ls043t1le01: make use of prepare_prev_first (git-fixes).\n- drm/panel: simple: Correct G190EAN01 prepare timing (git-fixes).\n- drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() (git-fixes).\n- drm/panthor: Fix outdated function documentation (git-fixes).\n- drm/radeon: add missing revision check for CI (git-fixes).\n- drm/sun4i: backend: fix error pointer dereference (git-fixes).\n- drm/sun4i: Fix resource leaks (git-fixes).\n- drm/v3d: Handle error from drm_sched_entity_init() (git-fixes).\n- drm/vc4: Fix a memory leak in hang state error path (git-fixes).\n- drm/vc4: Fix memory leak of BO array in hang state (git-fixes).\n- drm/vc4: platform_get_irq_byname() returns an int (stable-fixes).\n- drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock (git-fixes).\n- drm/vc4: Release runtime PM reference after binding V3D (git-fixes).\n- drm/vram: remove DRM_VRAM_MM_FILE_OPERATIONS from docs (git-fixes).\n- drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked() (git-fixes).\n- drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked() (git-fixes).\n- drm/xe/debugfs: Correct printing of register whitelist ranges (git-fixes).\n- drm/xe/dma-buf: handle empty bo and UAF races (git-fixes).\n- drm/xe/gsc: Fix BO leak on error in query_compatibility_version() (git-fixes).\n- drm/xe/uapi: update used tracking kernel-doc (git-fixes).\n- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (git-fixes).\n- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (git-fixes).\n- dt-bindings: net: Fix Tegra234 MGBE PTP clock (git-fixes).\n- efi/capsule-loader: fix incorrect sizeof in phys array reallocation (git-fixes).\n- efi: pstore: Drop efivar lock when efi_pstore_open() returns with an error (git-fixes).\n- erofs: add GFP_NOIO in the bio completion if needed (git-fixes).\n- ext4: fix fsync(2) for nojournal mode (git-fixes).\n- ext4: make recently_deleted() properly work with lazy itable initialization (git-fixes).\n- ext4: reject mount if bigalloc with s_first_data_block != 0 (git-fixes).\n- extcon: Fixed sysfs duplicate filename issue (git-fixes).\n- extcon: ptn5150: handle pending IRQ events during system resume (git-fixes).\n- fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break (git-fixes).\n- fbdev: offb: fix PCI device reference leak on probe failure (git-fixes).\n- fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO (stable-fixes).\n- fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO (git-fixes).\n- firmware: arm_ffa: Use the correct buffer size during RXTX_MAP (git-fixes).\n- firmware: dmi: Correct an indexing error in dmi.h (git-fixes).\n- firmware: google: framebuffer: Do not mark framebuffer as busy (git-fixes).\n- firmware: google: framebuffer: Do not unregister platform device (git-fixes).\n- gpio: of: clear OF_POPULATED on hog nodes in remove path (git-fixes).\n- gpio: tegra: fix irq_release_resources calling enable instead of disable (git-fixes).\n- gtp: disable BH before calling udp_tunnel_xmit_skb() (git-fixes).\n- HID: alps: fix NULL pointer dereference in alps_raw_event() (git-fixes).\n- HID: amd_sfh: don't log error when device discovery fails with -EOPNOTSUPP (git-fixes).\n- HID: apple: ensure the keyboard backlight is off if suspending (git-fixes).\n- HID: asus: do not abort probe when not necessary (git-fixes).\n- HID: asus: make asus_resume adhere to linux kernel coding standards (git-fixes).\n- HID: core: clamp report_size in s32ton() to avoid undefined shift (stable-fixes).\n- HID: logitech-hidpp: Enable MX Master 4 over bluetooth (stable-fixes).\n- HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure (stable-fixes).\n- HID: multitouch: Check to ensure report responses match the request (stable-fixes).\n- HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 (stable-fixes).\n- HID: roccat: fix use-after-free in roccat_report_event (stable-fixes).\n- HID: usbhid: fix deadlock in hid_post_reset() (git-fixes).\n- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (stable-fixes).\n- hisi_acc_vfio_pci: add eq and aeq interruption restore (git-fixes).\n- hisi_acc_vfio_pci: bugfix cache write-back issue (git-fixes).\n- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (git-fixes).\n- hv_sock: fix ARM64 support (git-fixes).\n- hv_sock: update outdated comment for renamed vsock_stream_recvmsg() (git-fixes).\n- hwmon: (ads7871) Fix endianness bug in 16-bit register reads (git-fixes).\n- hwmon: (corsair-psu) Close HID device on probe errors (git-fixes).\n- hwmon: (lm63) Add locking to avoid TOCTOU (git-fixes).\n- hwmon: (ltc2992) Clamp threshold writes to hardware range (git-fixes).\n- hwmon: (ltc2992) Fix u32 overflow in power read path (git-fixes).\n- hwmon: (ltc4286) Add missing MODULE_IMPORT_NS(\"PMBUS\") (git-fixes).\n- hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt (git-fixes).\n- hwmon: (powerz) Fix use-after-free on USB disconnect (git-fixes).\n- hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data() (git-fixes).\n- i2c: s3c24xx: check the size of the SMBUS message before using it (stable-fixes).\n- i2c: smbus: reject oversized block transfers in the common path (git-fixes).\n- i2c: stm32f7: reinit_completion() per transfer not per msg (git-fixes).\n- i2c: stub: Reject I2C block transfers with invalid length (git-fixes).\n- i2c: tegra: Add HS mode support (bsc#1261550).\n- i2c: tegra: Add Tegra256 support (bsc#1261550).\n- i2c: tegra: Do not configure DMA if not supported (bsc#1261550).\n- i2c: tegra: Don't mark devices with pins as IRQ safe (stable-fixes).\n- i2c: tegra: Update Tegra256 timing parameters (bsc#1261550).\n- i2c: tegra: Use separate variables for fast and fastplus (bsc#1261550).\n- i3c: dw: Fix memory leak in dw_i3c_master_i3c_xfers() (git-fixes).\n- i3c: master: Fix error codes at send_ccc_cmd (git-fixes).\n- i3c: mipi-i3c-hci: fix IBI payload length calculation for final status (git-fixes).\n- ibmveth: Disable GSO for packets with small MSS (bsc#1265144).\n- iio: adc: ad7192: Revert \"properly check spi_get_device_match_data()\" (stable-fixes).\n- iio: adc: ad7768-1: fix one-shot mode data acquisition (git-fixes).\n- iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() (git-fixes).\n- iio: frequency: admv1013: add dev variable (stable-fixes).\n- iio: frequency: admv1013: fix NULL pointer dereference on str (git-fixes).\n- Input: bcm5974 - recover from failed mode switch (stable-fixes).\n- Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table (stable-fixes).\n- Input: uinput - fix circular locking dependency with ff-core (git-fixes).\n- Input: uinput - take event lock when submitting FF request \"event\" (stable-fixes).\n- Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode (stable-fixes).\n- Input: xpad - add support for Razer Wolverine V3 Pro (stable-fixes).\n- interconnect: debugfs: fix devm_kstrdup and kfree mismatch (git-fixes).\n- io_uring/timeout: check unused sqe fields (git-fixes).\n- iommu/amd: move wait_on_sem() out of spinlock (git-fixes bsc#1260593).\n- iommu/amd: serialize sequence allocation under concurrent TLB invalidations (git-fixes bsc#1260593).\n- iommu/vt-d: Remove LPIG from page group response descriptor (jsc#PED-16113).\n- ipmi: Add limits to event and receive message requests (git-fixes).\n- ipmi: Check event message buffer response for bad data (git-fixes).\n- ipmi: ssif_bmc: change log level to dbg in irq callback (git-fixes).\n- ipmi: ssif_bmc: fix message desynchronization after truncated response (git-fixes).\n- ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure (git-fixes).\n- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (git-fixes).\n- KVM: arm64: Allow cacheable stage 2 mapping using VMA flags (git-fixes).\n- KVM: arm64: Assume non-PFNMAP/MIXEDMAP VMAs can be mapped cacheable (git-fixes).\n- KVM: arm64: Block cacheable PFNMAP mapping (git-fixes).\n- KVM: arm64: Consolidate idreg callbacks (git-fixes).\n- KVM: arm64: Discard PC update state on vcpu reset (git-fixes).\n- KVM: arm64: Finalize ID registers only once per VM (git-fixes).\n- KVM: arm64: Fix MTE flag initialization for protected VMs (git-fixes).\n- KVM: arm64: Fix page leak in user_mem_abort() (git-fixes).\n- KVM: arm64: Fix Trace Buffer trap polarity for protected VMs (git-fixes).\n- KVM: arm64: Fix Trace Buffer trapping for protected VMs (git-fixes).\n- KVM: arm64: Fix vma_shift staleness on nested hwpoison path (git-fixes).\n- KVM: arm64: Hide S1POE from guests when not supported by the host (git-fixes).\n- KVM: arm64: Limit clearing of ID_{AA64PFR0,PFR1}_EL1.GIC to userspace irqchip (git-fixes).\n- KVM: arm64: Make all 32bit ID registers fully writable (git-fixes).\n- KVM: arm64: nv: Add trap config for DBGWCR\u003c15\u003e_EL1 (git-fixes).\n- KVM: arm64: nv: Return correct RES0 bits for FGT registers (git-fixes).\n- KVM: arm64: pkvm: Fallback to level-3 mapping on host stage-2 fault (git-fixes).\n- KVM: arm64: Read PMUVer as unsigned (git-fixes).\n- KVM: arm64: Rename the device variable to s2_force_noncacheable (git-fixes).\n- KVM: arm64: Return early from trace helpers when KVM isn't available (git-fixes).\n- KVM: arm64: Set ID_{AA64PFR0,PFR1}_EL1.GIC when GICv3 is configured (git-fixes).\n- KVM: arm64: vgic-v3: Release reserved slot outside of lpi_xa's lock (git-fixes).\n- KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes).\n- KVM: nSVM: Use vcpu-\u003earch.cr2 when updating vmcb12 on nested #VMEXIT (git-fixes).\n- KVM: nVMX: Add consistency check for TSC_MULTIPLIER=0 (git-fixes).\n- KVM: Reject wrapped offset in kvm_reset_dirty_gfn() (git-fixes).\n- KVM: SEV: Disallow LAUNCH_FINISH if vCPUs are actively being created (git-fixes).\n- KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (git-fixes).\n- KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish (git-fixes).\n- KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm-\u003elock (git-fixes).\n- KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU (git-fixes).\n- KVM: SVM: Disallow EFER.LMSLE when not supported by hardware (git-fixes).\n- KVM: SVM: Fix a missing kunmap_local() in sev_gmem_post_populate() (git-fixes).\n- KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC (git-fixes).\n- KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (git-fixes).\n- KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN (git-fixes).\n- KVM: SVM: Properly check RAX in the emulator for SVM instructions (git-fixes).\n- KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (git-fixes).\n- KVM: TDX: Explicitly set user-return MSRs that *may* be clobbered by the TDX-Module (git-fixes).\n- KVM: x86/mmu: Fix UBSAN warning when reading nx_huge_pages parameter (git-fixes).\n- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (git-fixes).\n- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (git-fixes).\n- KVM: x86: Advertise EferLmsleUnsupported to userspace (git-fixes).\n- KVM: x86: check for nEPT/nNPT in slow flush hypercalls (git-fixes).\n- KVM: X86: Fix array_index_nospec protection in __pv_send_ipi (git-fixes).\n- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (git-fixes).\n- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (git-fixes).\n- KVM: x86: Ignore cpuid faulting in SMM (git-fixes).\n- leds: lgm-sso: Remove duplicate assignments for priv-\u003emmap (git-fixes).\n- leds: qcom-lpg: Check for array overflow when selecting the high resolution (stable-fixes).\n- lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() (git-fixes).\n- md/raid1: fix the comparing region of interval tree (bsc#1261555).\n- md/raid1: serialize overlap io for writemostly disk (bsc#1261555).\n- media: amphion: Fix race between m2m job_abort and device_run (git-fixes).\n- media: as102: fix to not free memory after the device is registered in as102_usb_probe() (git-fixes).\n- media: chips-media: wave5: add missing spinlock protection for handle_dynamic_resolution_change() (git-fixes).\n- media: chips-media: wave5: add missing spinlock protection for send_eos_event() (git-fixes).\n- media: chips-media: wave5: fix a potential memory leak in wave5_vdi_init() (git-fixes).\n- media: dib8000: avoid division by 0 in dib8000_set_dds() (git-fixes).\n- media: em28xx: fix use-after-free in em28xx_v4l2_open() (git-fixes).\n- media: hackrf: fix to not free memory after the device is registered in hackrf_probe() (git-fixes).\n- media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() (git-fixes).\n- media: i2c: imx283: Enter full standby when stopping streaming (git-fixes).\n- media: i2c: imx283: Fix hang when going from large to small resolution (git-fixes).\n- media: i2c: imx412: Assert reset GPIO during probe (git-fixes).\n- media: i2c: ov08d10: fix image vertical start setting (git-fixes).\n- media: i2c: ov8856: free control handler on error in ov8856_init_controls() (git-fixes).\n- media: intel/ipu6: fix error pointer dereference (git-fixes).\n- media: mtk-jpeg: fix use-after-free in release path due to uncancelled work (git-fixes).\n- media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 (git-fixes).\n- media: omap3isp: drop the use count of v4l2 pipeline (git-fixes).\n- media: pci: zoran: fix potential memory leak in zoran_probe() (git-fixes).\n- media: rc: streamzap: Error handling in probe (git-fixes).\n- media: rc: xbox_remote: heed DMA restrictions (git-fixes).\n- media: saa7164: add ioremap return checks and cleanups (git-fixes).\n- media: staging: imx: configure src_mux in csi_start (git-fixes).\n- media: staging: imx: request mbus_config in csi_start (git-fixes).\n- media: uvcvideo: Enable VB2_DMABUF for metadata stream (git-fixes).\n- media: videobuf2: Set vma_flags in vb2_dma_sg_mmap (git-fixes).\n- media: vidtv: fix nfeeds state corruption on start_streaming failure (git-fixes).\n- media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections (git-fixes).\n- media: vidtv: fix pass-by-value structs causing MSAN warnings (git-fixes).\n- memory: tegra30-emc: Fix dll_change check (git-fixes).\n- memory: tegra124-emc: Fix dll_change check (git-fixes).\n- mfd: core: Preserve OF node when ACPI handle is present (git-fixes).\n- mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() (git-fixes).\n- mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused (git-fixes).\n- mkspec: Add signature to source list only when it exists.\n- mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration (git-fixes).\n- mmc: vub300: fix NULL-deref on disconnect (git-fixes).\n- modpost: Amend ppc64 save/restfpr symnames for -Os build (bsc#1215199).\n- mtd: docg3: fix use-after-free in docg3_release() (git-fixes).\n- mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions (git-fixes).\n- mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path (git-fixes).\n- mtd: physmap_of_gemini: Fix disabled pinctrl state check (git-fixes).\n- mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob (git-fixes).\n- mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations (git-fixes).\n- mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() (git-fixes).\n- mtd: spi-nor: sst: Fix write enable before AAI sequence (git-fixes).\n- mtd: spi-nor: swp: check SR_TB flag when getting tb_mask (git-fixes).\n- net-shapers: don't free reply skb after genlmsg_reply() (git-fixes).\n- net/mlx5: Fix HCA caps leak on notifier init failure (git-fixes).\n- net/rds: reset op_nents when zerocopy page pin fails (bsc#1265626).\n- net/sched: cls_fw: fix NULL dereference of \"old\" filters before change() (git-fixes).\n- net/sched: fix pedit partial COW leading to page cache corruption (bsc#1265421).\n- net: gro: don't merge zcopy skbs (git-fixes).\n- net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf (git-fixes).\n- net: mana: Add MAC address to vPort logs and clarify error messages (git-fixes).\n- net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq() (git-fixes).\n- net: mana: Don't overwrite port probe error with add_adev result (git-fixes).\n- net: mana: Fix crash from unvalidated SHM offset read from BAR0 during FLR (bsc#1265846).\n- net: mana: Fix EQ leak in mana_remove on NULL port (git-fixes).\n- net: mana: Fix RX skb truesize accounting (bsc#1248754).\n- net: mana: Guard mana_remove against double invocation (git-fixes).\n- net: mana: hardening: Validate adapter_mtu from MANA_QUERY_DEV_CONFIG (git-fixes).\n- net: mana: hardening: Validate doorbell ID from GDMA_REGISTER_DEVICE response (git-fixes).\n- net: mana: Init gf_stats_work before potential error paths in probe (git-fixes).\n- net: mana: Init link_change_work before potential error paths in probe (git-fixes).\n- net: mana: Move current_speed debugfs file to mana_init_port() (git-fixes).\n- net: mana: remove double CQ cleanup in mana_create_rxq error path (git-fixes).\n- net: mana: Set default number of queues to 16 (bsc#1261648).\n- net: mana: Skip WQ object destruction for uninitialized RXQ (git-fixes).\n- net: mana: Use at least SZ_4K in doorbell ID range check (git-fixes).\n- net: mana: Use pci_name() for debugfs directory naming (git-fixes).\n- net: phy: broadcom: Save PHY counters during suspend (git-fixes).\n- net: phy: DP83TC811: add reading of abilities (git-fixes).\n- net: phy: dp83869: fix setting CLK_O_SEL field (git-fixes).\n- net: phy: fix a return path in get_phy_c45_ids() (git-fixes).\n- net: phy: qcom: at803x: Use the correct bit to disable extended next page (git-fixes).\n- net: stmmac: Fix PTP ref clock for Tegra234 (git-fixes).\n- net: usb: asix: ax88772: re-add usbnet_link_change() in phylink callbacks (git-fixes).\n- net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() (git-fixes).\n- net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() (git-fixes).\n- net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit (git-fixes).\n- net: wan: fsl_ucc_hdlc: fix ucc_hdlc_remove (git-fixes).\n- net: wan: fsl_ucc_hdlc: fix uhdlc_memclean (git-fixes).\n- net: wan: fsl_ucc_hdlc: free tx_skbuff in uhdlc_memclean (git-fixes).\n- net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler (git-fixes).\n- NFC: digital: Bounds check NFC-A cascade depth in SDD response handler (git-fixes).\n- nfc: llcp: add missing return after LLCP_CLOSED checks (git-fixes).\n- nfc: pn533: allocate rx skb before consuming bytes (git-fixes).\n- nfc: s3fwrn5: allocate rx skb before consuming bytes (git-fixes).\n- NFC: trf7970a: Ignore antenna noise when checking for RF field (git-fixes).\n- nvme-apple: drop invalid put of admin queue reference count (git-fixes).\n- nvme-auth: Include SC_C in RVAL controller hash (bsc#1260428).\n- nvme-loop: do not cancel I/O and admin tagset during ctrl reset/shutdown (bsc#1262709).\n- nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 (git-fixes).\n- nvme: Allow reauth from sysfs (bsc#1259672).\n- nvme: Expose the tls_configured sysfs for secure concat connections (bsc#1259672).\n- nvme: expose TLS mode (bsc#1259672).\n- nvme: fix admin queue leak on controller reset (git-fixes).\n- nvme: fix PCIe subsystem reset controller state transition (bsc#1261738).\n- nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers (git-fixes).\n- ocfs2: fix possible deadlock between unlink and dio_end_io_write (bsc#1258718).\n- ocfs2: split transactions in dio completion to avoid credit exhaustion (bsc#1258718).\n- openvswitch: vport: fix self-deadlock on release of tunnel ports (git-fixes).\n- panic/printk: replace other_cpu_in_panic() with panic_on_other_cpu() (bsc#1261149).\n- panic/printk: replace this_cpu_in_panic() with panic_on_this_cpu() (bsc#1261149).\n- panic: introduce helper functions for panic state (bsc#1261149).\n- panic: use angle-bracket include for panic.h (bsc#1261149).\n- PCI/AER: Clear only error bits in PCIe Device Status (git-fixes).\n- PCI/AER: Stop ruling out unbound devices as error source (git-fixes).\n- PCI/ASPM: Fix pci_clear_and_set_config_dword() usage (git-fixes).\n- PCI/NPEM: Set LED_HW_PLUGGABLE for hotplug-capable ports (git-fixes).\n- PCI/TPH: Allow TPH enable for RCiEPs (git-fixes).\n- PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well (git-fixes).\n- PCI: dwc: rcar-gen4: Change EPC BAR alignment to 4K as per the documentation (git-fixes).\n- PCI: Enable AtomicOps only if Root Port supports them (git-fixes).\n- PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown (git-fixes).\n- PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup (git-fixes).\n- PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete (git-fixes).\n- PCI: hv: Set default NUMA node to 0 for devices without affinity info (bsc#1261648).\n- PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found (git-fixes).\n- PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion support (git-fixes).\n- PCI: tegra194: Allow system suspend when the Endpoint link is not up (git-fixes).\n- PCI: tegra194: Disable direct speed change for Endpoint mode (git-fixes).\n- PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down (git-fixes).\n- PCI: tegra194: Disable PERST# IRQ only in Endpoint mode (git-fixes).\n- PCI: tegra194: Fix CBB timeout caused by DBI access before core power-on (git-fixes).\n- PCI: tegra194: Fix polling delay for L2 state (git-fixes).\n- PCI: tegra194: Free up Endpoint resources during remove() (git-fixes).\n- PCI: tegra194: Increase LTSSM poll time on surprise link down (git-fixes).\n- PCI: tegra194: Set LTR message request before PCIe link up in Endpoint mode (git-fixes).\n- PCI: tegra194: Use devm_gpiod_get_optional() to parse \"nvidia,refclk-select\" (git-fixes).\n- PCI: tegra194: Use DWC IP core version (git-fixes).\n- pinctrl: abx500: Fix type of 'argument' variable (git-fixes).\n- pinctrl: Fix spelling problem (git-fixes).\n- pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) (stable-fixes).\n- pinctrl: pic32: change all cases of bare 'unsigned' to 'unsigned int' (git-fixes).\n- pinctrl: pic32: use consistent spacing around '+' (git-fixes).\n- pinctrl: pinctrl-pic32: Fix resource leak (git-fixes).\n- pinctrl: realtek: Fix function signature for config argument (git-fixes).\n- pinctrl: renesas: rzg2l: Fix save/restore of {IOLH,IEN,PUPD,SMT} registers (git-fixes).\n- platform/chrome: chromeos_tbmc: Drop wakeup source on remove (git-fixes).\n- platform/surface: surfacepro3_button: Drop wakeup source on remove (git-fixes).\n- platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug (stable-fixes).\n- platform/x86/intel-uncore-freq: Handle autonomous UFS status bit (git-fixes).\n- platform/x86: asus-wmi: adjust screenpad power/brightness handling (git-fixes).\n- platform/x86: asus-wmi: fix screenpad brightness range (git-fixes).\n- platform/x86: dell-wmi-sysman: bound enumeration string aggregation (git-fixes).\n- platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() (git-fixes).\n- platform/x86: hp-wmi: Ignore backlight and FnLock events (stable-fixes).\n- platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup (git-fixes).\n- power: supply: axp288_charger: Do not cancel work before initializing it (git-fixes).\n- power: supply: max17042: avoid overflow when determining health (git-fixes).\n- powerpc/crash: fix backup region offset update to elfcorehdr (bsc#1259535).\n- powerpc/crash: Update backup region offset in elfcorehdr on memory hotplug (bsc#1259535).\n- printk/nbcon/panic: Allow printk kthread to sleep when the system is in panic (bsc#1261149).\n- printk/nbcon: Block printk kthreads when any CPU is in an emergency context (bsc#1261149).\n- printk/nbcon: Release nbcon consoles ownership in atomic flush after each emitted record (bsc#1261149).\n- printk/nbcon: Restore IRQ in atomic flush after each emitted record (bsc#1261149).\n- printk/nbcon: use panic_on_this_cpu() helper (bsc#1261149).\n- printk: Allow printk_trigger_flush() to flush all types (bsc#1262750).\n- printk: Allow to use the printk kthread immediately even for 1st nbcon (jsc#PED-7912).\n- printk: Avoid irq_work for printk_deferred() on suspend (bsc#1262750).\n- printk: Avoid scheduling irq_work on suspend (bsc#1262750).\n- printk: console_flush_one_record() code cleanup (bsc#1261149).\n- printk: Introduce console_flush_one_record (bsc#1261149).\n- printk: Use console_flush_one_record for legacy printer kthread (bsc#1261149).\n- pwm: imx-tpm: Count the number of enabled channels in probe (git-fixes).\n- qat: don't mess with -\u003ed_name (jsc#PED-14238).\n- r8152: fix incorrect register write to USB_UPHY_XTAL (git-fixes).\n- RDMA/irdma: Fix double free related to rereg_user_mr (git-fixes).\n- RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() (git-fixes).\n- RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() (git-fixes).\n- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (git-fixes).\n- RDMA/mana: Validate rx_hash_key_len (git-fixes).\n- RDMA/mana_ib: cleanup the usage of mana_gd_send_request() (git-fixes).\n- RDMA/mana_ib: Disable RX steering on RSS QP destroy (git-fixes).\n- RDMA/mana_ib: Support memory windows (git-fixes).\n- regulator: act8945a: fix OF node reference imbalance (git-fixes).\n- regulator: bd9571mwv: fix OF node reference imbalance (git-fixes).\n- regulator: max77650: fix OF node reference imbalance (git-fixes).\n- regulator: mt6357: fix OF node reference imbalance (git-fixes).\n- regulator: rk808: fix OF node reference imbalance (git-fixes).\n- remoteproc: xlnx: Fix sram property parsing (git-fixes).\n- remoteproc: xlnx: Only access buffer information if IPI is buffered (git-fixes).\n- Revert \"ALSA: usb: Increase volume range that triggers a warning\" (git-fixes).\n- Revert \"serial: 8250: Revert \"drop lockdep annotation from serial8250_clear_IER()\"\" (bsc#1262480).\n- Revert \"serial: 8250: Switch to nbcon console\" (bsc#1262480).\n- rtc: abx80x: Disable alarm feature if no interrupt attached (git-fixes).\n- rtc: ntxec: fix OF node reference imbalance (git-fixes).\n- s390/dasd: Copy detected format information to secondary device (bsc#1259994).\n- s390/dasd: Fix gendisk parent after copy pair swap (bsc#1259994).\n- s390/dasd: Move quiesce state with pprc swap (bsc#1259994).\n- sched/fair: Change likelyhood of nohz.nr_cpus (bsc#1234634 bsc#1258961).\n- sched/fair: Move checking for nohz cpus after time check (bsc#1234634 bsc#1258961).\n- sched/fair: Remove nohz.nr_cpus and use weight of cpumask instead (bsc#1234634 bsc#1258961).\n- scsi: lpfc: Add clean up of aborted NVMe commands during PCI fcn reset (bsc#1262019).\n- scsi: lpfc: Add log messages to fabric login error labels (bsc#1262019).\n- scsi: lpfc: Add PCI ID support for LPe42100 series adapters (bsc#1262019).\n- scsi: lpfc: Add REG_VFI mailbox cmd error handling (bsc#1262019).\n- scsi: lpfc: Break out of IRQ affinity assignment when mask reaches nr_cpu_ids (bsc#1262019).\n- scsi: lpfc: Check ASIC_ID register to aid diagnostics during failed fw updates (bsc#1262019).\n- scsi: lpfc: Cleanup error exit paths in lpfc_fdmi_cmd() and associated messages (bsc#1262019).\n- scsi: lpfc: ELIMINATE kernel-doc warnings in lpfc.h (bsc#1262019).\n- scsi: lpfc: Fix incorrect txcmplq_cnt during cleanup in lpfc_sli_abort_ring() (bsc#1262019).\n- scsi: lpfc: Introduce 128G link speed selection and support (bsc#1262019).\n- scsi: lpfc: Log discarded and insufficient RQE buffer events (bsc#1262019).\n- scsi: lpfc: Log MCQE contents for mbox commands with no context (bsc#1262019).\n- scsi: lpfc: Properly set WC for DPP mapping (bsc#1262019).\n- scsi: lpfc: Reduce pointer chasing when accessing vmid_flag (bsc#1262019).\n- scsi: lpfc: Remove deprecated PBDE feature (bsc#1262019).\n- scsi: lpfc: Remove unnecessary ndlp kref get in lpfc_check_nlp_post_devloss (bsc#1262019).\n- scsi: lpfc: Restrict first burst to non-FCoE and SLI4 adapters only (bsc#1262019).\n- scsi: lpfc: Select mailbox rq_create cmd version based on SLI4 if_type (bsc#1262019).\n- scsi: lpfc: Update class of service bit field to 3 bits for WQE submissions (bsc#1262019).\n- scsi: lpfc: Update construction of SGL when XPSGL is enabled (bsc#1262019).\n- scsi: lpfc: Update copyright year string for 2026 (bsc#1262019).\n- scsi: lpfc: Update log message when ndlp kref get is unsuccessful (bsc#1262019).\n- scsi: lpfc: Update lpfc version to 14.4.0.14 (bsc#1262019).\n- scsi: lpfc: Update lpfc version to 15.0.0.0 (bsc#1262019).\n- scsi: lpfc: Update outdated comment for renamed lpfc_freenode() (bsc#1262019).\n- scsi: lpfc: Use min_t() instead of min() in lpfc_sli4_driver_resource_setup (bsc#1262019).\n- scsi: lpfc: Use the crc32c() function (bsc#1262019).\n- scsi: mpi3mr: Add NULL checks when resetting request and reply queues (git-fixes).\n- scsi: ses: Fix devices attaching to different hosts (git-fixes).\n- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (git-fixes).\n- scsi: target: iscsi: validate CHAP_R length before base64 decode (bsc#1265449).\n- scsi: ufs: ufs-pci: Add support for Intel Wildcat Lake (jsc#PED-13771).\n- selftests/bpf: Test cross-sign 64bits range refinement (git-fixes).\n- selftests/bpf: Test invariants on JSLT crossing sign (git-fixes).\n- selftests/bpf: test refining u32/s32 bounds when ranges cross min/max boundary (git-fixes).\n- selftests: net: build net/lib dependency in all target (bsc#1262245).\n- selinux: don't reserve xattr slot when we won't fill it (stable-fixes).\n- selinux: prune /sys/fs/selinux/disable (stable-fixes).\n- selinux: shrink critical section in sel_write_load() (stable-fixes).\n- serial: 8250: Add serial8250_handle_irq_locked() (bsc#1262480).\n- serial: 8250: Protect LCR write in shutdown (bsc#1262480).\n- serial: 8250_dw: Avoid unnecessary LCR writes (bsc#1262480).\n- serial: 8250_dw: Ensure BUSY is deasserted (bsc#1262480).\n- serial: 8250_dw: Rework dw8250_handle_irq() locking and IIR handling (bsc#1262480).\n- serial: 8250_dw: Rework IIR_NO_INT handling to stop interrupt storm (bsc#1262480).\n- Set CONFIG_INTEL_TSX_MODE to follow upstream AUTO default (bsc#1263044).\n- soc/tegra: cbb: Set ERD on resume for err interrupt (git-fixes).\n- soc: qcom: aoss: compare against normalized cooling state (git-fixes).\n- soc: qcom: llcc: fix v1 SB syndrome register offset (git-fixes).\n- soc: qcom: ocmem: make the core clock optional (git-fixes).\n- soc: qcom: ocmem: register reasons for probe deferrals (git-fixes).\n- soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available (git-fixes).\n- sound: ua101: fix division by zero at probe (git-fixes).\n- soundwire: bus: demote UNATTACHED state warnings to dev_dbg() (git-fixes).\n- soundwire: cadence: Clear message complete before signaling waiting thread (git-fixes).\n- soundwire: debugfs: initialize firmware_file to empty string (git-fixes).\n- spi: aspeed-smc: fix controller deregistration (git-fixes).\n- spi: at91-usart: fix controller deregistration (git-fixes).\n- spi: atmel: fix controller deregistration (git-fixes).\n- spi: bcm63xx: fix controller deregistration (git-fixes).\n- spi: bcmbca-hsspi: fix controller deregistration (git-fixes).\n- spi: cadence: fix controller deregistration (git-fixes).\n- spi: cadence: fix unclocked access on unbind (git-fixes).\n- spi: ch341: fix memory leaks on probe failures (git-fixes).\n- spi: coldfire-qspi: fix controller deregistration (git-fixes).\n- spi: dln2: fix controller deregistration (git-fixes).\n- spi: fix controller cleanup() documentation (git-fixes).\n- spi: fix misleading controller deregistration kernel-doc (git-fixes).\n- spi: fix misleading controller registration kernel-doc (git-fixes).\n- spi: fsl-espi: fix controller deregistration (git-fixes).\n- spi: fsl-qspi: Use reinit_completion() for repeated operations (git-fixes).\n- spi: fsl: fix controller deregistration (git-fixes).\n- spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo (git-fixes).\n- spi: img-spfi: fix controller deregistration (git-fixes).\n- spi: imx: fix runtime pm leak on probe deferral (git-fixes).\n- spi: imx: fix use-after-free on unbind (git-fixes).\n- spi: lantiq-ssc: fix controller deregistration (git-fixes).\n- spi: meson-spicc: fix controller deregistration (git-fixes).\n- spi: microchip-core-qspi: fix controller deregistration (git-fixes).\n- spi: mpc52xx: fix controller deregistration (git-fixes).\n- spi: mpc52xx: fix use-after-free on registration failure (git-fixes).\n- spi: mpc52xx: fix use-after-free on unbind (git-fixes).\n- spi: mtk-nor: fix controller deregistration (git-fixes).\n- spi: mtk-snfi: fix memory leak in probe (git-fixes).\n- spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback (git-fixes).\n- spi: mxic: fix controller deregistration (git-fixes).\n- spi: mxs: fix controller deregistration (git-fixes).\n- spi: npcm-pspi: fix controller deregistration (git-fixes).\n- spi: omap2-mcspi: fix controller deregistration (git-fixes).\n- spi: orion: fix clock imbalance on registration failure (git-fixes).\n- spi: orion: fix controller deregistration (git-fixes).\n- spi: orion: fix runtime pm leak on unbind (git-fixes).\n- spi: pic32-sqi: fix controller deregistration (git-fixes).\n- spi: pic32: fix controller deregistration (git-fixes).\n- spi: pl022: fix controller deregistration (git-fixes).\n- spi: qup: fix controller deregistration (git-fixes).\n- spi: rockchip: fix controller deregistration (git-fixes).\n- spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ (git-fixes).\n- spi: rspi: fix controller deregistration (git-fixes).\n- spi: s3c64xx: fix controller deregistration (git-fixes).\n- spi: s3c64xx: fix NULL-deref on driver unbind (git-fixes).\n- spi: sh-hspi: fix controller deregistration (git-fixes).\n- spi: sprd: fix controller deregistration (git-fixes).\n- spi: st-ssc4: fix controller deregistration (git-fixes).\n- spi: sun4i: fix controller deregistration (git-fixes).\n- spi: sun6i: fix controller deregistration (git-fixes).\n- spi: syncuacer: fix controller deregistration (git-fixes).\n- spi: ti-qspi: fix controller deregistration (git-fixes).\n- spi: topcliff-pch: fix controller deregistration (git-fixes).\n- spi: topcliff-pch: fix use-after-free on unbind (git-fixes).\n- spi: uniphier: fix controller deregistration (git-fixes).\n- spi: uniphier: Simplify clock handling with devm_clk_get_enabled() (stable-fixes).\n- spi: zynq-qspi: fix controller deregistration (git-fixes).\n- spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() (stable-fixes).\n- spi: zynqmp-gqspi: fix controller deregistration (git-fixes).\n- staging: media: atomisp: Disallow all private IOCTLs (git-fixes).\n- staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() (git-fixes).\n- staging: sm750fb: fix division by zero in ps_to_hz() (git-fixes).\n- staging: vme_user: fix root device leak on init failure (git-fixes).\n- tg3: replace placeholder MAC address with device property (git-fixes).\n- thermal/drivers/spear: Fix error condition for reading st,thermal-flags (git-fixes).\n- thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp (git-fixes).\n- thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata (git-fixes).\n- tools/power/turbostat: Fix microcode patch level output for AMD/Hygon (git-fixes).\n- tools: hv: Fix cross-compilation (git-fixes).\n- tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public() (git-fixes).\n- tpm: avoid -Wunused-but-set-variable (git-fixes).\n- tpm: Fix auth session leak in tpm2_get_random() error path (git-fixes).\n- tpm: tpm_tis: add error logging for data transfer (git-fixes).\n- tpm: tpm_tis: stop transmit if retries are exhausted (git-fixes).\n- tpm: Use kfree_sensitive() to free auth session in tpm_dev_release() (git-fixes).\n- tty: serial: ip22zilog: Fix section mispatch warning (git-fixes).\n- udp: Force compute_score to always inline (bsc#1241259).\n- unshare: fix unshare_fs() handling (git-fixes).\n- USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen (git-fixes).\n- usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (git-fixes).\n- usb: chipidea: otg: not wait vbus drop if use role_switch (git-fixes).\n- USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam (stable-fixes).\n- usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer (stable-fixes).\n- usb: gadget: f_hid: Add missing error code (git-fixes).\n- usb: gadget: f_hid: don't call cdev_init while cdev in use (git-fixes).\n- usb: gadget: f_hid: move list and spinlock inits from bind to alloc (stable-fixes).\n- usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() (git-fixes).\n- usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() (git-fixes).\n- usb: gadget: f_uac1_legacy: validate control request size (stable-fixes).\n- usb: gadget: renesas_usb3: validate endpoint index in standard request handlers (git-fixes).\n- usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo (git-fixes).\n- USB: omap_udc: DMA: Don't enable burst 4 mode (git-fixes).\n- usb: port: add delay after usb_hub_set_port_power() (git-fixes).\n- usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive (stable-fixes).\n- USB: serial: io_edgeport: add support for Blackbox IC135A (stable-fixes).\n- USB: serial: option: add MeiG Smart SRM825WN (stable-fixes).\n- USB: serial: option: add support for Rolling Wireless RW135R-GL (stable-fixes).\n- USB: serial: option: add Telit Cinterion FN990A MBIM composition (git-fixes).\n- USB: serial: option: add Telit Cinterion LE910Cx compositions (stable-fixes).\n- usb: storage: Expand range of matched versions for VL817 quirks entry (git-fixes).\n- usb: typec: tcpm: reset internal port states on soft reset AMS (git-fixes).\n- usb: ulpi: fix memory leak on ulpi_register() error paths (git-fixes).\n- usb: usblp: fix heap leak in IEEE 1284 device ID via short response (stable-fixes).\n- usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl (stable-fixes).\n- usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() (git-fixes).\n- usbip: validate number_of_packets in usbip_pack_ret_submit() (git-fixes).\n- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (git-fixes).\n- vfio/pds: Fix memory leak in pds_vfio_dirty_enable() (git-fixes).\n- vfio/pds: Fix missing detach_ioas op (git-fixes).\n- vfio/pds: replace bitmap_free with vfree (git-fixes).\n- vfio/type1: Fix error unwind in migration dirty bitmap allocation (git-fixes).\n- vfio: Fix unbalanced vfio_df_close call in no-iommu mode (git-fixes).\n- vfio: Prevent open_count decrement to negative (git-fixes).\n- virt: arm-cca-guest: fix error check for RSI_INCOMPLETE (git-fixes).\n- virt: sev-guest: Do not use host-controlled page order in cleanup path (git-fixes).\n- virt: tdx-guest: Fix handling of host controlled 'quote' buffer length (git-fixes).\n- virt: tdx-guest: Return error for GetQuote failures (git-fixes).\n- wifi: ath5k: do not access array OOB (git-fixes).\n- wifi: ath9k: Fix typo (git-fixes).\n- wifi: ath10k: fix station lookup failure during disconnect (git-fixes).\n- wifi: ath11k: fix memory leaks in beacon template setup (git-fixes).\n- wifi: ath12k: fix leak in some ath12k_wmi_xxx() functions (git-fixes).\n- wifi: ath12k: use lockdep_assert_in_rcu_read_lock() for RCU assertions (git-fixes).\n- wifi: b43: enforce bounds check on firmware key index in b43_rx() (git-fixes).\n- wifi: b43legacy: enforce bounds check on firmware key index in RX path (git-fixes).\n- wifi: brcmfmac: Fix error pointer dereference (git-fixes).\n- wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task (git-fixes).\n- wifi: brcmfmac: validate bsscfg indices in IF events (stable-fixes).\n- wifi: brcmsmac: Fix dma_free_coherent() size (git-fixes).\n- wifi: cw1200: Revert \"Fix locking in error paths\" (git-fixes).\n- wifi: libertas: notify firmware load wait on disconnect (git-fixes).\n- wifi: mac80211: check ieee80211_rx_data_set_link return in pubsta MLO path (git-fixes).\n- wifi: mac80211: check tdls flag in ieee80211_tdls_oper (stable-fixes).\n- wifi: mac80211: drop stray 'static' from fast-RX rx_result (git-fixes).\n- wifi: mac80211: handle VHT EXT NSS in ieee80211_determine_our_sta_mode() (git-fixes).\n- wifi: mac80211: remove station if connection prep fails (git-fixes).\n- wifi: mac80211: use safe list iteration in radar detect work (git-fixes).\n- wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req() (git-fixes).\n- wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor (stable-fixes).\n- wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling (git-fixes).\n- wifi: mt76: mt7615: fix use_cts_prot support (git-fixes).\n- wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() (git-fixes).\n- wifi: mt76: mt7915: fix use_cts_prot support (git-fixes).\n- wifi: mt76: mt7921: fix 6GHz regulatory update on connection (git-fixes).\n- wifi: mt76: mt7921: fix a potential clc buffer length underflow (git-fixes).\n- wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work (git-fixes).\n- wifi: mt76: mt7921: Place upper limit on station AID (git-fixes).\n- wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() (git-fixes).\n- wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr (git-fixes).\n- wifi: mt76: mt7925: fix incorrect length field in txpower command (git-fixes).\n- wifi: mt76: mt7925: Fix incorrect MLO mode in firmware control (git-fixes).\n- wifi: mt76: mt7925: fix incorrect TLV length in CLC command (git-fixes).\n- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_tx_check_aggr() (git-fixes).\n- wifi: mt76: mt7925: prevent NULL vif dereference in mt7925_mac_write_txwi (git-fixes).\n- wifi: mt76: mt7996: fix FCS error flag check in RX descriptor (git-fixes).\n- wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event (git-fixes).\n- wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work() (git-fixes).\n- wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() (git-fixes).\n- wifi: nl80211: fix NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST usage (git-fixes).\n- wifi: nl80211: require admin perm on SET_PMK / DEL_PMK (git-fixes).\n- wifi: rsi: fix kthread lifetime race between self-exit and external-stop (git-fixes).\n- wifi: rt2x00usb: fix devres lifetime (git-fixes).\n- wifi: rtl8xxxu: fix potential use of uninitialized value (git-fixes).\n- wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet (git-fixes).\n- wifi: rtw88: Add additional USB IDs for RTL8812BU (bsc#1263135).\n- wifi: rtw88: Add BUFFALO WI-U3-866DHP to the USB ID list (bsc#1263135).\n- wifi: rtw88: Add support for Mercusys MA30N and D-Link DWA-T185 rev. A1 (bsc#1263135).\n- wifi: rtw88: check for PCI upstream bridge existence (git-fixes).\n- wifi: rtw88: fix device leak on probe failure (git-fixes).\n- wifi: rtw88: rtw8822bu VID/PID for BUFFALO WI-U2-866DM (bsc#1263135).\n- wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() (git-fixes).\n- wifi: wl1251: validate packet IDs before indexing tx_frames (stable-fixes).\n- x86/acpi/boot: Correct acpi_is_processor_usable() check again (git-fixes).\n- x86/boot/sev: Avoid shared GHCB page for early memory acceptance (git-fixes).\n- x86/boot/sev: Support memory acceptance in the EFI stub under SVSM (git-fixes).\n- x86/boot: Fix page table access in 5-level to 4-level paging transition (git-fixes).\n- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (bsc#1263255).\n- x86/cpufeatures: Free up unused feature bits (bsc#1263255).\n- x86/fred: Fix early boot failures on SEV-ES/SNP guests (git-fixes).\n- x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (git-fixes).\n- x86/sev: Add missing RIP_REL_REF() invocations during sme_enable() (git-fixes).\n- x86/sev: Do not touch VMSA pages during SNP guest memory kdump (git-fixes).\n- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (git-fixes).\n- x86/sev: Fix operator precedence in GHCB_MSR_VMPL_REQ_LEVEL macro (git-fixes).\n- x86/sev: Improve handling of writes to intercepted TSC MSRs (git-fixes).\n- x86/sev: Make sure pages are not skipped during kdump (git-fixes).\n- x86/tsx: Get the tsx= command line parameter with early_param() (bsc#1250951 bsc#1263044).\n- x86/tsx: Make tsx_ctrl_state static (bsc#1250951 bsc#1263044).\n- x86/vmware: Parse MP tables for SEV-SNP enabled guests under VMware hypervisors (git-fixes).\n- X.509: Fix out-of-bounds access when parsing extensions (git-fixes).\n- Xarray: do not return sibling entries from xas_find_marked() (bsc#1263815).\n","status":"published","published":"2026-05-28T11:40:20Z","modified":"2026-06-02T18:24:31.043353389Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"USN-8094-1","title":"linux, linux-aws, linux-aws-6.17, linux-gcp, linux-hwe-6.17, linux-oracle, linux-oracle-6.17 vulnerabilities","description":"\nQualys discovered that several vulnerabilities existed in the AppArmor\nLinux kernel Security Module (LSM). An unprivileged local attacker could\nuse these issues to load, replace, and remove arbitrary AppArmor profiles\ncausing denial of service, exposure of sensitive information (kernel\nmemory), local privilege escalation, or possibly escape a container.\n(LP: #2143853)\n\nIt was discovered that some AMD Zen 5 processors supporting RDSEED\ninstruction did not properly handle entropy, potentially resulting in the\nconsumption of insufficiently random values. A local attacker could\npossibly use this issue to influence the values returned by the RDSEED\ninstruction causing loss of confidentiality and integrity. (CVE-2025-62626)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ATM drivers;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Data acquisition framework and drivers;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - Intel Stratix 10 firmware drivers;\n  - GPIO subsystem;\n  - GPU drivers;\n  - Microsoft Hyper-V drivers;\n  - CoreSight HW tracing drivers;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Tablet) drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - Macintosh device drivers;\n  - Multiple devices driver;\n  - MOST (Media Oriented Systems Transport) drivers;\n  - MTD block device drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - Texas Instruments network drivers;\n  - Ethernet team driver;\n  - MediaTek network drivers;\n  - NVME drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - Voltage and Current Regulator drivers;\n  - Real Time Clock drivers;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - Texas Instruments SoC drivers;\n  - SPI subsystem;\n  - Media Oriented Systems Transport (MOST) driver;\n  - Realtek RTL8723BS SDIO drivers;\n  - TCM subsystem;\n  - UFS subsystem;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - Renesas USBHS Controller drivers;\n  - USB Mass Storage drivers;\n  - USB Type-C Connector System Software Interface driver;\n  - Backlight driver;\n  - Framebuffer layer;\n  - AFS file system;\n  - BFS file system;\n  - BTRFS file system;\n  - EROFS file system;\n  - Ext4 file system;\n  - FAT file system;\n  - GFS2 file system;\n  - Journaling layer for block devices (JBD2);\n  - File systems infrastructure;\n  - Network file system (NFS) client;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - SMB network file system;\n  - XFS file system;\n  - BPF subsystem;\n  - MediaTek SoC drivers;\n  - Bluetooth subsystem;\n  - io_uring subsystem;\n  - Locking primitives;\n  - Scheduler infrastructure;\n  - Timer subsystem;\n  - Tracing infrastructure;\n  - Kexec HandOver (KHO);\n  - Memory management;\n  - Ceph Core library;\n  - Networking core;\n  - Devlink API;\n  - IPv4 networking;\n  - IPv6 networking;\n  - Multipath TCP;\n  - Open vSwitch;\n  - Network traffic control;\n  - VMware vSockets driver;\n  - eXpress Data Path;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Simplified Mandatory Access Control Kernel framework;\n  - FireWire sound drivers;\n  - HD-audio driver;\n  - Turtle Beach Wavefront ALSA driver;\n  - SoundWire (SDCA) ASoC drivers;\n(CVE-2025-40246, CVE-2025-40247, CVE-2025-40248, CVE-2025-40249,\nCVE-2025-40250, CVE-2025-40251, CVE-2025-40252, CVE-2025-40253,\nCVE-2025-40254, CVE-2025-40255, CVE-2025-40257, CVE-2025-40258,\nCVE-2025-40259, CVE-2025-40260, CVE-2025-40261, CVE-2025-40262,\nCVE-2025-40263, CVE-2025-40264, CVE-2025-40265, CVE-2025-40266,\nCVE-2025-40290, CVE-2025-40345, CVE-2025-68212, CVE-2025-68213,\nCVE-2025-68214, CVE-2025-68215, CVE-2025-68217, CVE-2025-68218,\nCVE-2025-68219, CVE-2025-68220, CVE-2025-68221, CVE-2025-68222,\nCVE-2025-68223, CVE-2025-68225, CVE-2025-68227, CVE-2025-68228,\nCVE-2025-68229, CVE-2025-68230, CVE-2025-68231, CVE-2025-68232,\nCVE-2025-68233, CVE-2025-68234, CVE-2025-68235, CVE-2025-68236,\nCVE-2025-68237, CVE-2025-68238, CVE-2025-68254, CVE-2025-68255,\nCVE-2025-68256, CVE-2025-68257, CVE-2025-68258, CVE-2025-68259,\nCVE-2025-68261, CVE-2025-68262, CVE-2025-68263, CVE-2025-68264,\nCVE-2025-68265, CVE-2025-68266, CVE-2025-68281, CVE-2025-68282,\nCVE-2025-68283, CVE-2025-68284, CVE-2025-68285, CVE-2025-68286,\nCVE-2025-68287, CVE-2025-68288, CVE-2025-68289, CVE-2025-68290,\nCVE-2025-68292, CVE-2025-68293, CVE-2025-68294, CVE-2025-68295,\nCVE-2025-68296, CVE-2025-68297, CVE-2025-68298, CVE-2025-68299,\nCVE-2025-68300, CVE-2025-68301, CVE-2025-68302, CVE-2025-68303,\nCVE-2025-68304, CVE-2025-68305, CVE-2025-68306, CVE-2025-68307,\nCVE-2025-68308, CVE-2025-68323, CVE-2025-68324, CVE-2025-68325,\nCVE-2025-68326, CVE-2025-68327, CVE-2025-68328, CVE-2025-68329,\nCVE-2025-68330, CVE-2025-68331, CVE-2025-68332, CVE-2025-68333,\nCVE-2025-68334, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337,\nCVE-2025-68338, CVE-2025-68339, CVE-2025-68340, CVE-2025-68341,\nCVE-2025-68342, CVE-2025-68343, CVE-2025-68344, CVE-2025-68345,\nCVE-2025-68346, CVE-2025-68347, CVE-2025-68348, CVE-2025-68349,\nCVE-2025-68352, CVE-2025-68354, CVE-2025-68356, CVE-2025-68358,\nCVE-2025-68359, CVE-2025-68360, CVE-2025-68361, CVE-2025-68362,\nCVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367,\nCVE-2025-68369, CVE-2025-68370, CVE-2025-68371, CVE-2025-68372,\nCVE-2025-68373, CVE-2025-68374, CVE-2025-68375, CVE-2025-68376,\nCVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724,\nCVE-2025-68726, CVE-2025-68727, CVE-2025-68728, CVE-2025-68729,\nCVE-2025-68730, CVE-2025-68732, CVE-2025-68733, CVE-2025-68735,\nCVE-2025-68738, CVE-2025-68739, CVE-2025-68740, CVE-2025-68741,\nCVE-2025-68742, CVE-2025-68743, CVE-2025-68744, CVE-2025-68746,\nCVE-2025-68747, CVE-2025-68748, CVE-2025-68749, CVE-2025-68751,\nCVE-2025-68752, CVE-2025-68753, CVE-2025-68754, CVE-2025-68755,\nCVE-2025-68756, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759,\nCVE-2025-68760, CVE-2025-68762, CVE-2025-68763, CVE-2025-68764,\nCVE-2025-68765, CVE-2025-68766, CVE-2025-71128)\n","status":"published","published":"2026-03-16T13:42:27Z","modified":"2026-11-04T20:01:52.690428076Z","updated_at":"2026-11-04T20:16:32.566315Z"},{"id":"USN-8094-2","title":"linux-gcp-6.17, linux-realtime vulnerabilities","description":"Qualys discovered that several vulnerabilities existed in the AppArmor\nLinux kernel Security Module (LSM). An unprivileged local attacker could\nuse these issues to load, replace, and remove arbitrary AppArmor profiles\ncausing denial of service, exposure of sensitive information (kernel\nmemory), local privilege escalation, or possibly escape a container.\n(LP: #2143853)\n\nIt was discovered that some AMD Zen 5 processors supporting RDSEED\ninstruction did not properly handle entropy, potentially resulting in the\nconsumption of insufficiently random values. A local attacker could\npossibly use this issue to influence the values returned by the RDSEED\ninstruction causing loss of confidentiality and integrity. (CVE-2025-62626)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ATM drivers;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Data acquisition framework and drivers;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - Intel Stratix 10 firmware drivers;\n  - GPIO subsystem;\n  - GPU drivers;\n  - Microsoft Hyper-V drivers;\n  - CoreSight HW tracing drivers;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Tablet) drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - Macintosh device drivers;\n  - Multiple devices driver;\n  - MOST (Media Oriented Systems Transport) drivers;\n  - MTD block device drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - Texas Instruments network drivers;\n  - Ethernet team driver;\n  - MediaTek network drivers;\n  - NVME drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - Voltage and Current Regulator drivers;\n  - Real Time Clock drivers;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - Texas Instruments SoC drivers;\n  - SPI subsystem;\n  - Media Oriented Systems Transport (MOST) driver;\n  - Realtek RTL8723BS SDIO drivers;\n  - TCM subsystem;\n  - UFS subsystem;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - Renesas USBHS Controller drivers;\n  - USB Mass Storage drivers;\n  - USB Type-C Connector System Software Interface driver;\n  - Backlight driver;\n  - Framebuffer layer;\n  - AFS file system;\n  - BFS file system;\n  - BTRFS file system;\n  - EROFS file system;\n  - Ext4 file system;\n  - FAT file system;\n  - GFS2 file system;\n  - Journaling layer for block devices (JBD2);\n  - File systems infrastructure;\n  - Network file system (NFS) client;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - SMB network file system;\n  - XFS file system;\n  - BPF subsystem;\n  - MediaTek SoC drivers;\n  - Bluetooth subsystem;\n  - io_uring subsystem;\n  - Locking primitives;\n  - Scheduler infrastructure;\n  - Timer subsystem;\n  - Tracing infrastructure;\n  - Kexec HandOver (KHO);\n  - Memory management;\n  - Ceph Core library;\n  - Networking core;\n  - Devlink API;\n  - IPv4 networking;\n  - IPv6 networking;\n  - Multipath TCP;\n  - Open vSwitch;\n  - Network traffic control;\n  - VMware vSockets driver;\n  - eXpress Data Path;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Simplified Mandatory Access Control Kernel framework;\n  - FireWire sound drivers;\n  - HD-audio driver;\n  - Turtle Beach Wavefront ALSA driver;\n  - SoundWire (SDCA) ASoC drivers;\n(CVE-2025-40246, CVE-2025-40247, CVE-2025-40248, CVE-2025-40249,\nCVE-2025-40250, CVE-2025-40251, CVE-2025-40252, CVE-2025-40253,\nCVE-2025-40254, CVE-2025-40255, CVE-2025-40257, CVE-2025-40258,\nCVE-2025-40259, CVE-2025-40260, CVE-2025-40261, CVE-2025-40262,\nCVE-2025-40263, CVE-2025-40264, CVE-2025-40265, CVE-2025-40266,\nCVE-2025-40290, CVE-2025-40345, CVE-2025-68212, CVE-2025-68213,\nCVE-2025-68214, CVE-2025-68215, CVE-2025-68217, CVE-2025-68218,\nCVE-2025-68219, CVE-2025-68220, CVE-2025-68221, CVE-2025-68222,\nCVE-2025-68223, CVE-2025-68225, CVE-2025-68227, CVE-2025-68228,\nCVE-2025-68229, CVE-2025-68230, CVE-2025-68231, CVE-2025-68232,\nCVE-2025-68233, CVE-2025-68234, CVE-2025-68235, CVE-2025-68236,\nCVE-2025-68237, CVE-2025-68238, CVE-2025-68254, CVE-2025-68255,\nCVE-2025-68256, CVE-2025-68257, CVE-2025-68258, CVE-2025-68259,\nCVE-2025-68261, CVE-2025-68262, CVE-2025-68263, CVE-2025-68264,\nCVE-2025-68265, CVE-2025-68266, CVE-2025-68281, CVE-2025-68282,\nCVE-2025-68283, CVE-2025-68284, CVE-2025-68285, CVE-2025-68286,\nCVE-2025-68287, CVE-2025-68288, CVE-2025-68289, CVE-2025-68290,\nCVE-2025-68292, CVE-2025-68293, CVE-2025-68294, CVE-2025-68295,\nCVE-2025-68296, CVE-2025-68297, CVE-2025-68298, CVE-2025-68299,\nCVE-2025-68300, CVE-2025-68301, CVE-2025-68302, CVE-2025-68303,\nCVE-2025-68304, CVE-2025-68305, CVE-2025-68306, CVE-2025-68307,\nCVE-2025-68308, CVE-2025-68323, CVE-2025-68324, CVE-2025-68325,\nCVE-2025-68326, CVE-2025-68327, CVE-2025-68328, CVE-2025-68329,\nCVE-2025-68330, CVE-2025-68331, CVE-2025-68332, CVE-2025-68333,\nCVE-2025-68334, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337,\nCVE-2025-68338, CVE-2025-68339, CVE-2025-68340, CVE-2025-68341,\nCVE-2025-68342, CVE-2025-68343, CVE-2025-68344, CVE-2025-68345,\nCVE-2025-68346, CVE-2025-68347, CVE-2025-68348, CVE-2025-68349,\nCVE-2025-68352, CVE-2025-68354, CVE-2025-68356, CVE-2025-68358,\nCVE-2025-68359, CVE-2025-68360, CVE-2025-68361, CVE-2025-68362,\nCVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367,\nCVE-2025-68369, CVE-2025-68370, CVE-2025-68371, CVE-2025-68372,\nCVE-2025-68373, CVE-2025-68374, CVE-2025-68375, CVE-2025-68376,\nCVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724,\nCVE-2025-68726, CVE-2025-68727, CVE-2025-68728, CVE-2025-68729,\nCVE-2025-68730, CVE-2025-68732, CVE-2025-68733, CVE-2025-68735,\nCVE-2025-68738, CVE-2025-68739, CVE-2025-68740, CVE-2025-68741,\nCVE-2025-68742, CVE-2025-68743, CVE-2025-68744, CVE-2025-68746,\nCVE-2025-68747, CVE-2025-68748, CVE-2025-68749, CVE-2025-68751,\nCVE-2025-68752, CVE-2025-68753, CVE-2025-68754, CVE-2025-68755,\nCVE-2025-68756, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759,\nCVE-2025-68760, CVE-2025-68762, CVE-2025-68763, CVE-2025-68764,\nCVE-2025-68765, CVE-2025-68766, CVE-2025-71128)\n","status":"published","published":"2026-03-17T18:33:02Z","modified":"2026-11-04T20:01:46.381938777Z","updated_at":"2026-11-04T20:16:32.566315Z"},{"id":"USN-8094-3","title":"linux-realtime-6.17 vulnerabilities","description":"Qualys discovered that several vulnerabilities existed in the AppArmor\nLinux kernel Security Module (LSM). An unprivileged local attacker could\nuse these issues to load, replace, and remove arbitrary AppArmor profiles\ncausing denial of service, exposure of sensitive information (kernel\nmemory), local privilege escalation, or possibly escape a container.\n(LP: #2143853)\n\nIt was discovered that some AMD Zen 5 processors supporting RDSEED\ninstruction did not properly handle entropy, potentially resulting in the\nconsumption of insufficiently random values. A local attacker could\npossibly use this issue to influence the values returned by the RDSEED\ninstruction causing loss of confidentiality and integrity. (CVE-2025-62626)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ATM drivers;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Data acquisition framework and drivers;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - Intel Stratix 10 firmware drivers;\n  - GPIO subsystem;\n  - GPU drivers;\n  - Microsoft Hyper-V drivers;\n  - CoreSight HW tracing drivers;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Tablet) drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - Macintosh device drivers;\n  - Multiple devices driver;\n  - MOST (Media Oriented Systems Transport) drivers;\n  - MTD block device drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - Texas Instruments network drivers;\n  - Ethernet team driver;\n  - MediaTek network drivers;\n  - NVME drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - Voltage and Current Regulator drivers;\n  - Real Time Clock drivers;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - Texas Instruments SoC drivers;\n  - SPI subsystem;\n  - Media Oriented Systems Transport (MOST) driver;\n  - Realtek RTL8723BS SDIO drivers;\n  - TCM subsystem;\n  - UFS subsystem;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - Renesas USBHS Controller drivers;\n  - USB Mass Storage drivers;\n  - USB Type-C Connector System Software Interface driver;\n  - Backlight driver;\n  - Framebuffer layer;\n  - AFS file system;\n  - BFS file system;\n  - BTRFS file system;\n  - EROFS file system;\n  - Ext4 file system;\n  - FAT file system;\n  - GFS2 file system;\n  - Journaling layer for block devices (JBD2);\n  - File systems infrastructure;\n  - Network file system (NFS) client;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - SMB network file system;\n  - XFS file system;\n  - BPF subsystem;\n  - MediaTek SoC drivers;\n  - Bluetooth subsystem;\n  - io_uring subsystem;\n  - Locking primitives;\n  - Scheduler infrastructure;\n  - Timer subsystem;\n  - Tracing infrastructure;\n  - Kexec HandOver (KHO);\n  - Memory management;\n  - Ceph Core library;\n  - Networking core;\n  - Devlink API;\n  - IPv4 networking;\n  - IPv6 networking;\n  - Multipath TCP;\n  - Open vSwitch;\n  - Network traffic control;\n  - VMware vSockets driver;\n  - eXpress Data Path;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Simplified Mandatory Access Control Kernel framework;\n  - FireWire sound drivers;\n  - HD-audio driver;\n  - Turtle Beach Wavefront ALSA driver;\n  - SoundWire (SDCA) ASoC drivers;\n(CVE-2025-40246, CVE-2025-40247, CVE-2025-40248, CVE-2025-40249,\nCVE-2025-40250, CVE-2025-40251, CVE-2025-40252, CVE-2025-40253,\nCVE-2025-40254, CVE-2025-40255, CVE-2025-40257, CVE-2025-40258,\nCVE-2025-40259, CVE-2025-40260, CVE-2025-40261, CVE-2025-40262,\nCVE-2025-40263, CVE-2025-40264, CVE-2025-40265, CVE-2025-40266,\nCVE-2025-40290, CVE-2025-40345, CVE-2025-68212, CVE-2025-68213,\nCVE-2025-68214, CVE-2025-68215, CVE-2025-68217, CVE-2025-68218,\nCVE-2025-68219, CVE-2025-68220, CVE-2025-68221, CVE-2025-68222,\nCVE-2025-68223, CVE-2025-68225, CVE-2025-68227, CVE-2025-68228,\nCVE-2025-68229, CVE-2025-68230, CVE-2025-68231, CVE-2025-68232,\nCVE-2025-68233, CVE-2025-68234, CVE-2025-68235, CVE-2025-68236,\nCVE-2025-68237, CVE-2025-68238, CVE-2025-68254, CVE-2025-68255,\nCVE-2025-68256, CVE-2025-68257, CVE-2025-68258, CVE-2025-68259,\nCVE-2025-68261, CVE-2025-68262, CVE-2025-68263, CVE-2025-68264,\nCVE-2025-68265, CVE-2025-68266, CVE-2025-68281, CVE-2025-68282,\nCVE-2025-68283, CVE-2025-68284, CVE-2025-68285, CVE-2025-68286,\nCVE-2025-68287, CVE-2025-68288, CVE-2025-68289, CVE-2025-68290,\nCVE-2025-68292, CVE-2025-68293, CVE-2025-68294, CVE-2025-68295,\nCVE-2025-68296, CVE-2025-68297, CVE-2025-68298, CVE-2025-68299,\nCVE-2025-68300, CVE-2025-68301, CVE-2025-68302, CVE-2025-68303,\nCVE-2025-68304, CVE-2025-68305, CVE-2025-68306, CVE-2025-68307,\nCVE-2025-68308, CVE-2025-68323, CVE-2025-68324, CVE-2025-68325,\nCVE-2025-68326, CVE-2025-68327, CVE-2025-68328, CVE-2025-68329,\nCVE-2025-68330, CVE-2025-68331, CVE-2025-68332, CVE-2025-68333,\nCVE-2025-68334, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337,\nCVE-2025-68338, CVE-2025-68339, CVE-2025-68340, CVE-2025-68341,\nCVE-2025-68342, CVE-2025-68343, CVE-2025-68344, CVE-2025-68345,\nCVE-2025-68346, CVE-2025-68347, CVE-2025-68348, CVE-2025-68349,\nCVE-2025-68352, CVE-2025-68354, CVE-2025-68356, CVE-2025-68358,\nCVE-2025-68359, CVE-2025-68360, CVE-2025-68361, CVE-2025-68362,\nCVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367,\nCVE-2025-68369, CVE-2025-68370, CVE-2025-68371, CVE-2025-68372,\nCVE-2025-68373, CVE-2025-68374, CVE-2025-68375, CVE-2025-68376,\nCVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724,\nCVE-2025-68726, CVE-2025-68727, CVE-2025-68728, CVE-2025-68729,\nCVE-2025-68730, CVE-2025-68732, CVE-2025-68733, CVE-2025-68735,\nCVE-2025-68738, CVE-2025-68739, CVE-2025-68740, CVE-2025-68741,\nCVE-2025-68742, CVE-2025-68743, CVE-2025-68744, CVE-2025-68746,\nCVE-2025-68747, CVE-2025-68748, CVE-2025-68749, CVE-2025-68751,\nCVE-2025-68752, CVE-2025-68753, CVE-2025-68754, CVE-2025-68755,\nCVE-2025-68756, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759,\nCVE-2025-68760, CVE-2025-68762, CVE-2025-68763, CVE-2025-68764,\nCVE-2025-68765, CVE-2025-68766, CVE-2025-71128)\n","status":"published","published":"2026-03-23T22:14:44Z","modified":"2026-11-04T20:01:32.693368267Z","updated_at":"2026-11-04T20:16:32.566315Z"},{"id":"USN-8094-4","title":"linux-azure, linux-azure-6.17 vulnerabilities","description":"Qualys discovered that several vulnerabilities existed in the AppArmor\nLinux kernel Security Module (LSM). An unprivileged local attacker could\nuse these issues to load, replace, and remove arbitrary AppArmor profiles\ncausing denial of service, exposure of sensitive information (kernel\nmemory), local privilege escalation, or possibly escape a container.\n(LP: #2143853)\n\nIt was discovered that some AMD Zen 5 processors supporting RDSEED\ninstruction did not properly handle entropy, potentially resulting in the\nconsumption of insufficiently random values. A local attacker could\npossibly use this issue to influence the values returned by the RDSEED\ninstruction causing loss of confidentiality and integrity. (CVE-2025-62626)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ATM drivers;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Data acquisition framework and drivers;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - Intel Stratix 10 firmware drivers;\n  - GPIO subsystem;\n  - GPU drivers;\n  - Microsoft Hyper-V drivers;\n  - CoreSight HW tracing drivers;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Tablet) drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - Macintosh device drivers;\n  - Multiple devices driver;\n  - MOST (Media Oriented Systems Transport) drivers;\n  - MTD block device drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - Texas Instruments network drivers;\n  - Ethernet team driver;\n  - MediaTek network drivers;\n  - NVME drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - Voltage and Current Regulator drivers;\n  - Real Time Clock drivers;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - Texas Instruments SoC drivers;\n  - SPI subsystem;\n  - Media Oriented Systems Transport (MOST) driver;\n  - Realtek RTL8723BS SDIO drivers;\n  - TCM subsystem;\n  - UFS subsystem;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - Renesas USBHS Controller drivers;\n  - USB Mass Storage drivers;\n  - USB Type-C Connector System Software Interface driver;\n  - Backlight driver;\n  - Framebuffer layer;\n  - AFS file system;\n  - BFS file system;\n  - BTRFS file system;\n  - EROFS file system;\n  - Ext4 file system;\n  - FAT file system;\n  - GFS2 file system;\n  - Journaling layer for block devices (JBD2);\n  - File systems infrastructure;\n  - Network file system (NFS) client;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - SMB network file system;\n  - XFS file system;\n  - BPF subsystem;\n  - MediaTek SoC drivers;\n  - Bluetooth subsystem;\n  - io_uring subsystem;\n  - Locking primitives;\n  - Scheduler infrastructure;\n  - Timer subsystem;\n  - Tracing infrastructure;\n  - Kexec HandOver (KHO);\n  - Memory management;\n  - Ceph Core library;\n  - Networking core;\n  - Devlink API;\n  - IPv4 networking;\n  - IPv6 networking;\n  - Multipath TCP;\n  - Open vSwitch;\n  - Network traffic control;\n  - VMware vSockets driver;\n  - eXpress Data Path;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Simplified Mandatory Access Control Kernel framework;\n  - FireWire sound drivers;\n  - HD-audio driver;\n  - Turtle Beach Wavefront ALSA driver;\n  - SoundWire (SDCA) ASoC drivers;\n(CVE-2025-40246, CVE-2025-40247, CVE-2025-40248, CVE-2025-40249,\nCVE-2025-40250, CVE-2025-40251, CVE-2025-40252, CVE-2025-40253,\nCVE-2025-40254, CVE-2025-40255, CVE-2025-40257, CVE-2025-40258,\nCVE-2025-40259, CVE-2025-40260, CVE-2025-40261, CVE-2025-40262,\nCVE-2025-40263, CVE-2025-40264, CVE-2025-40265, CVE-2025-40266,\nCVE-2025-40290, CVE-2025-40345, CVE-2025-68212, CVE-2025-68213,\nCVE-2025-68214, CVE-2025-68215, CVE-2025-68217, CVE-2025-68218,\nCVE-2025-68219, CVE-2025-68220, CVE-2025-68221, CVE-2025-68222,\nCVE-2025-68223, CVE-2025-68225, CVE-2025-68227, CVE-2025-68228,\nCVE-2025-68229, CVE-2025-68230, CVE-2025-68231, CVE-2025-68232,\nCVE-2025-68233, CVE-2025-68234, CVE-2025-68235, CVE-2025-68236,\nCVE-2025-68237, CVE-2025-68238, CVE-2025-68254, CVE-2025-68255,\nCVE-2025-68256, CVE-2025-68257, CVE-2025-68258, CVE-2025-68259,\nCVE-2025-68261, CVE-2025-68262, CVE-2025-68263, CVE-2025-68264,\nCVE-2025-68265, CVE-2025-68266, CVE-2025-68281, CVE-2025-68282,\nCVE-2025-68283, CVE-2025-68284, CVE-2025-68285, CVE-2025-68286,\nCVE-2025-68287, CVE-2025-68288, CVE-2025-68289, CVE-2025-68290,\nCVE-2025-68292, CVE-2025-68293, CVE-2025-68294, CVE-2025-68295,\nCVE-2025-68296, CVE-2025-68297, CVE-2025-68298, CVE-2025-68299,\nCVE-2025-68300, CVE-2025-68301, CVE-2025-68302, CVE-2025-68303,\nCVE-2025-68304, CVE-2025-68305, CVE-2025-68306, CVE-2025-68307,\nCVE-2025-68308, CVE-2025-68323, CVE-2025-68324, CVE-2025-68325,\nCVE-2025-68326, CVE-2025-68327, CVE-2025-68328, CVE-2025-68329,\nCVE-2025-68330, CVE-2025-68331, CVE-2025-68332, CVE-2025-68333,\nCVE-2025-68334, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337,\nCVE-2025-68338, CVE-2025-68339, CVE-2025-68340, CVE-2025-68341,\nCVE-2025-68342, CVE-2025-68343, CVE-2025-68344, CVE-2025-68345,\nCVE-2025-68346, CVE-2025-68347, CVE-2025-68348, CVE-2025-68349,\nCVE-2025-68352, CVE-2025-68354, CVE-2025-68356, CVE-2025-68358,\nCVE-2025-68359, CVE-2025-68360, CVE-2025-68361, CVE-2025-68362,\nCVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367,\nCVE-2025-68369, CVE-2025-68370, CVE-2025-68371, CVE-2025-68372,\nCVE-2025-68373, CVE-2025-68374, CVE-2025-68375, CVE-2025-68376,\nCVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724,\nCVE-2025-68726, CVE-2025-68727, CVE-2025-68728, CVE-2025-68729,\nCVE-2025-68730, CVE-2025-68732, CVE-2025-68733, CVE-2025-68735,\nCVE-2025-68738, CVE-2025-68739, CVE-2025-68740, CVE-2025-68741,\nCVE-2025-68742, CVE-2025-68743, CVE-2025-68744, CVE-2025-68746,\nCVE-2025-68747, CVE-2025-68748, CVE-2025-68749, CVE-2025-68751,\nCVE-2025-68752, CVE-2025-68753, CVE-2025-68754, CVE-2025-68755,\nCVE-2025-68756, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759,\nCVE-2025-68760, CVE-2025-68762, CVE-2025-68763, CVE-2025-68764,\nCVE-2025-68765, CVE-2025-68766, CVE-2025-71128)\n","status":"published","published":"2026-03-25T19:04:26Z","modified":"2026-11-04T20:00:58.138263943Z","updated_at":"2026-11-04T20:16:32.566315Z"},{"id":"USN-8094-5","title":"linux-raspi vulnerabilities","description":"Qualys discovered that several vulnerabilities existed in the AppArmor\nLinux kernel Security Module (LSM). An unprivileged local attacker could\nuse these issues to load, replace, and remove arbitrary AppArmor profiles\ncausing denial of service, exposure of sensitive information (kernel\nmemory), local privilege escalation, or possibly escape a container.\n(LP: #2143853)\n\nIt was discovered that some AMD Zen 5 processors supporting RDSEED\ninstruction did not properly handle entropy, potentially resulting in the\nconsumption of insufficiently random values. A local attacker could\npossibly use this issue to influence the values returned by the RDSEED\ninstruction causing loss of confidentiality and integrity. (CVE-2025-62626)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ATM drivers;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Data acquisition framework and drivers;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - Intel Stratix 10 firmware drivers;\n  - GPIO subsystem;\n  - GPU drivers;\n  - Microsoft Hyper-V drivers;\n  - CoreSight HW tracing drivers;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Tablet) drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - Macintosh device drivers;\n  - Multiple devices driver;\n  - MOST (Media Oriented Systems Transport) drivers;\n  - MTD block device drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - Texas Instruments network drivers;\n  - Ethernet team driver;\n  - MediaTek network drivers;\n  - NVME drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - Voltage and Current Regulator drivers;\n  - Real Time Clock drivers;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - Texas Instruments SoC drivers;\n  - SPI subsystem;\n  - Media Oriented Systems Transport (MOST) driver;\n  - Realtek RTL8723BS SDIO drivers;\n  - TCM subsystem;\n  - UFS subsystem;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - Renesas USBHS Controller drivers;\n  - USB Mass Storage drivers;\n  - USB Type-C Connector System Software Interface driver;\n  - Backlight driver;\n  - Framebuffer layer;\n  - AFS file system;\n  - BFS file system;\n  - BTRFS file system;\n  - EROFS file system;\n  - Ext4 file system;\n  - FAT file system;\n  - GFS2 file system;\n  - Journaling layer for block devices (JBD2);\n  - File systems infrastructure;\n  - Network file system (NFS) client;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - SMB network file system;\n  - XFS file system;\n  - BPF subsystem;\n  - MediaTek SoC drivers;\n  - Bluetooth subsystem;\n  - io_uring subsystem;\n  - Locking primitives;\n  - Scheduler infrastructure;\n  - Timer subsystem;\n  - Tracing infrastructure;\n  - Kexec HandOver (KHO);\n  - Memory management;\n  - Ceph Core library;\n  - Networking core;\n  - Devlink API;\n  - IPv4 networking;\n  - IPv6 networking;\n  - Multipath TCP;\n  - Open vSwitch;\n  - Network traffic control;\n  - VMware vSockets driver;\n  - eXpress Data Path;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Simplified Mandatory Access Control Kernel framework;\n  - FireWire sound drivers;\n  - HD-audio driver;\n  - Turtle Beach Wavefront ALSA driver;\n  - SoundWire (SDCA) ASoC drivers;\n(CVE-2025-40246, CVE-2025-40247, CVE-2025-40248, CVE-2025-40249,\nCVE-2025-40250, CVE-2025-40251, CVE-2025-40252, CVE-2025-40253,\nCVE-2025-40254, CVE-2025-40255, CVE-2025-40257, CVE-2025-40258,\nCVE-2025-40259, CVE-2025-40260, CVE-2025-40261, CVE-2025-40262,\nCVE-2025-40263, CVE-2025-40264, CVE-2025-40265, CVE-2025-40266,\nCVE-2025-40290, CVE-2025-40345, CVE-2025-68212, CVE-2025-68213,\nCVE-2025-68214, CVE-2025-68215, CVE-2025-68217, CVE-2025-68218,\nCVE-2025-68219, CVE-2025-68220, CVE-2025-68221, CVE-2025-68222,\nCVE-2025-68223, CVE-2025-68225, CVE-2025-68227, CVE-2025-68228,\nCVE-2025-68229, CVE-2025-68230, CVE-2025-68231, CVE-2025-68232,\nCVE-2025-68233, CVE-2025-68234, CVE-2025-68235, CVE-2025-68236,\nCVE-2025-68237, CVE-2025-68238, CVE-2025-68254, CVE-2025-68255,\nCVE-2025-68256, CVE-2025-68257, CVE-2025-68258, CVE-2025-68259,\nCVE-2025-68261, CVE-2025-68262, CVE-2025-68263, CVE-2025-68264,\nCVE-2025-68265, CVE-2025-68266, CVE-2025-68281, CVE-2025-68282,\nCVE-2025-68283, CVE-2025-68284, CVE-2025-68285, CVE-2025-68286,\nCVE-2025-68287, CVE-2025-68288, CVE-2025-68289, CVE-2025-68290,\nCVE-2025-68292, CVE-2025-68293, CVE-2025-68294, CVE-2025-68295,\nCVE-2025-68296, CVE-2025-68297, CVE-2025-68298, CVE-2025-68299,\nCVE-2025-68300, CVE-2025-68301, CVE-2025-68302, CVE-2025-68303,\nCVE-2025-68304, CVE-2025-68305, CVE-2025-68306, CVE-2025-68307,\nCVE-2025-68308, CVE-2025-68323, CVE-2025-68324, CVE-2025-68325,\nCVE-2025-68326, CVE-2025-68327, CVE-2025-68328, CVE-2025-68329,\nCVE-2025-68330, CVE-2025-68331, CVE-2025-68332, CVE-2025-68333,\nCVE-2025-68334, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337,\nCVE-2025-68338, CVE-2025-68339, CVE-2025-68340, CVE-2025-68341,\nCVE-2025-68342, CVE-2025-68343, CVE-2025-68344, CVE-2025-68345,\nCVE-2025-68346, CVE-2025-68347, CVE-2025-68348, CVE-2025-68349,\nCVE-2025-68352, CVE-2025-68354, CVE-2025-68356, CVE-2025-68358,\nCVE-2025-68359, CVE-2025-68360, CVE-2025-68361, CVE-2025-68362,\nCVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367,\nCVE-2025-68369, CVE-2025-68370, CVE-2025-68371, CVE-2025-68372,\nCVE-2025-68373, CVE-2025-68374, CVE-2025-68375, CVE-2025-68376,\nCVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724,\nCVE-2025-68726, CVE-2025-68727, CVE-2025-68728, CVE-2025-68729,\nCVE-2025-68730, CVE-2025-68732, CVE-2025-68733, CVE-2025-68735,\nCVE-2025-68738, CVE-2025-68739, CVE-2025-68740, CVE-2025-68741,\nCVE-2025-68742, CVE-2025-68743, CVE-2025-68744, CVE-2025-68746,\nCVE-2025-68747, CVE-2025-68748, CVE-2025-68749, CVE-2025-68751,\nCVE-2025-68752, CVE-2025-68753, CVE-2025-68754, CVE-2025-68755,\nCVE-2025-68756, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759,\nCVE-2025-68760, CVE-2025-68762, CVE-2025-68763, CVE-2025-68764,\nCVE-2025-68765, CVE-2025-68766, CVE-2025-71128)\n","status":"published","published":"2026-04-01T15:00:17Z","modified":"2026-11-04T20:00:51.261504797Z","updated_at":"2026-11-04T20:16:32.566315Z"},{"id":"USN-8152-1","title":"linux-oem-6.17 vulnerabilities","description":"It was discovered that some AMD Zen 5 processors supporting RDSEED\ninstruction did not properly handle entropy, potentially resulting in the\nconsumption of insufficiently random values. A local attacker could\npossibly use this issue to influence the values returned by the RDSEED\ninstruction causing loss of confidentiality and integrity. (CVE-2025-62626)\n\nQualys discovered that several vulnerabilities existed in the AppArmor\nLinux kernel Security Module (LSM). An unprivileged local attacker could\nuse these issues to load, replace, and remove arbitrary AppArmor profiles\ncausing denial of service, exposure of sensitive information (kernel\nmemory), local privilege escalation, or possibly escape a container.\n(LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403,\nCVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407,\nCVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - S390 architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ATM drivers;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Data acquisition framework and drivers;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - Intel Stratix 10 firmware drivers;\n  - GPIO subsystem;\n  - GPU drivers;\n  - Microsoft Hyper-V drivers;\n  - CoreSight HW tracing drivers;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Tablet) drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - Macintosh device drivers;\n  - Multiple devices driver;\n  - MOST (Media Oriented Systems Transport) drivers;\n  - MTD block device drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - Texas Instruments network drivers;\n  - Ethernet team driver;\n  - MediaTek network drivers;\n  - NVME drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - Voltage and Current Regulator drivers;\n  - Real Time Clock drivers;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - Texas Instruments SoC drivers;\n  - SPI subsystem;\n  - Media Oriented Systems Transport (MOST) driver;\n  - Realtek RTL8723BS SDIO drivers;\n  - TCM subsystem;\n  - UFS subsystem;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - Renesas USBHS Controller drivers;\n  - USB Mass Storage drivers;\n  - USB Type-C Connector System Software Interface driver;\n  - Backlight driver;\n  - Framebuffer layer;\n  - AFS file system;\n  - BFS file system;\n  - BTRFS file system;\n  - EROFS file system;\n  - Ext4 file system;\n  - FAT file system;\n  - GFS2 file system;\n  - Journaling layer for block devices (JBD2);\n  - File systems infrastructure;\n  - Network file system (NFS) client;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - SMB network file system;\n  - XFS file system;\n  - BPF subsystem;\n  - MediaTek SoC drivers;\n  - Bluetooth subsystem;\n  - io_uring subsystem;\n  - Locking primitives;\n  - Scheduler infrastructure;\n  - Timer subsystem;\n  - Tracing infrastructure;\n  - Kexec HandOver (KHO);\n  - Memory management;\n  - Ceph Core library;\n  - Networking core;\n  - Devlink API;\n  - IPv4 networking;\n  - IPv6 networking;\n  - Multipath TCP;\n  - Netfilter;\n  - Open vSwitch;\n  - Network traffic control;\n  - VMware vSockets driver;\n  - eXpress Data Path;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Simplified Mandatory Access Control Kernel framework;\n  - FireWire sound drivers;\n  - HD-audio driver;\n  - Turtle Beach Wavefront ALSA driver;\n  - SoundWire (SDCA) ASoC drivers;\n(CVE-2025-40246, CVE-2025-40247, CVE-2025-40248, CVE-2025-40249,\nCVE-2025-40250, CVE-2025-40251, CVE-2025-40252, CVE-2025-40253,\nCVE-2025-40254, CVE-2025-40255, CVE-2025-40257, CVE-2025-40258,\nCVE-2025-40259, CVE-2025-40260, CVE-2025-40261, CVE-2025-40262,\nCVE-2025-40263, CVE-2025-40264, CVE-2025-40265, CVE-2025-40266,\nCVE-2025-40290, CVE-2025-40345, CVE-2025-68212, CVE-2025-68213,\nCVE-2025-68214, CVE-2025-68215, CVE-2025-68217, CVE-2025-68218,\nCVE-2025-68219, CVE-2025-68220, CVE-2025-68221, CVE-2025-68222,\nCVE-2025-68223, CVE-2025-68225, CVE-2025-68227, CVE-2025-68228,\nCVE-2025-68229, CVE-2025-68230, CVE-2025-68231, CVE-2025-68232,\nCVE-2025-68233, CVE-2025-68234, CVE-2025-68235, CVE-2025-68236,\nCVE-2025-68237, CVE-2025-68238, CVE-2025-68254, CVE-2025-68255,\nCVE-2025-68256, CVE-2025-68257, CVE-2025-68258, CVE-2025-68259,\nCVE-2025-68261, CVE-2025-68262, CVE-2025-68263, CVE-2025-68264,\nCVE-2025-68265, CVE-2025-68266, CVE-2025-68281, CVE-2025-68282,\nCVE-2025-68283, CVE-2025-68284, CVE-2025-68285, CVE-2025-68286,\nCVE-2025-68287, CVE-2025-68288, CVE-2025-68289, CVE-2025-68290,\nCVE-2025-68292, CVE-2025-68293, CVE-2025-68294, CVE-2025-68295,\nCVE-2025-68296, CVE-2025-68297, CVE-2025-68298, CVE-2025-68299,\nCVE-2025-68300, CVE-2025-68301, CVE-2025-68302, CVE-2025-68303,\nCVE-2025-68304, CVE-2025-68305, CVE-2025-68306, CVE-2025-68307,\nCVE-2025-68308, CVE-2025-68323, CVE-2025-68324, CVE-2025-68325,\nCVE-2025-68326, CVE-2025-68327, CVE-2025-68328, CVE-2025-68329,\nCVE-2025-68330, CVE-2025-68331, CVE-2025-68332, CVE-2025-68333,\nCVE-2025-68334, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337,\nCVE-2025-68338, CVE-2025-68339, CVE-2025-68340, CVE-2025-68341,\nCVE-2025-68342, CVE-2025-68343, CVE-2025-68344, CVE-2025-68345,\nCVE-2025-68346, CVE-2025-68347, CVE-2025-68348, CVE-2025-68349,\nCVE-2025-68352, CVE-2025-68354, CVE-2025-68356, CVE-2025-68358,\nCVE-2025-68359, CVE-2025-68360, CVE-2025-68361, CVE-2025-68362,\nCVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367,\nCVE-2025-68369, CVE-2025-68370, CVE-2025-68371, CVE-2025-68372,\nCVE-2025-68373, CVE-2025-68374, CVE-2025-68375, CVE-2025-68376,\nCVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724,\nCVE-2025-68726, CVE-2025-68727, CVE-2025-68728, CVE-2025-68729,\nCVE-2025-68730, CVE-2025-68732, CVE-2025-68733, CVE-2025-68735,\nCVE-2025-68738, CVE-2025-68739, CVE-2025-68740, CVE-2025-68741,\nCVE-2025-68742, CVE-2025-68743, CVE-2025-68744, CVE-2025-68746,\nCVE-2025-68747, CVE-2025-68748, CVE-2025-68749, CVE-2025-68751,\nCVE-2025-68752, CVE-2025-68753, CVE-2025-68754, CVE-2025-68755,\nCVE-2025-68756, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759,\nCVE-2025-68760, CVE-2025-68762, CVE-2025-68763, CVE-2025-68764,\nCVE-2025-68765, CVE-2025-68766, CVE-2025-71128, CVE-2026-23060,\nCVE-2026-23074, CVE-2026-23111)\n","status":"published","published":"2026-04-06T21:59:02Z","modified":"2026-11-04T20:01:38.913033023Z","updated_at":"2026-11-04T20:16:32.566315Z"},{"id":"USN-8179-1","title":"linux, linux-aws, linux-aws-6.8, linux-gcp, linux-gke, linux-gkeop, linux-ibm, linux-lowlatency, linux-lowlatency-hwe-6.8 vulnerabilities","description":"Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo\nRizzo discovered that some AMD Zen processors did not properly verify the\nsignature of CPU microcode. This flaw is known as EntrySign. A privileged\nattacker could possibly use this issue to cause load malicious CPU\nmicrocode causing loss of integrity and confidentiality.\n(CVE-2024-36347)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - MIPS architecture;\n  - PowerPC architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - ACPI drivers;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - Hardware crypto device drivers;\n  - GPU drivers;\n  - Hardware monitoring drivers;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - Macintosh device drivers;\n  - Multiple devices driver;\n  - Media drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - Ethernet team driver;\n  - MediaTek network drivers;\n  - NVME drivers;\n  - PA-RISC drivers;\n  - Chrome hardware platform drivers;\n  - x86 platform drivers;\n  - Voltage and Current Regulator drivers;\n  - SCSI subsystem;\n  - SPI subsystem;\n  - Media Oriented Systems Transport (MOST) driver;\n  - Realtek RTL8723BS SDIO drivers;\n  - TCM subsystem;\n  - USB Host Controller drivers;\n  - USB Type-C Connector System Software Interface driver;\n  - Backlight driver;\n  - Watchdog drivers;\n  - BFS file system;\n  - BTRFS file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - HFS+ file system;\n  - File systems infrastructure;\n  - Journaling layer for block devices (JBD2);\n  - Network file system (NFS) client;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - SMB network file system;\n  - BPF subsystem;\n  - Ethernet bridge;\n  - io_uring subsystem;\n  - Locking primitives;\n  - Scheduler infrastructure;\n  - Shadow Call Stack mechanism;\n  - Tracing infrastructure;\n  - Memory management;\n  - CAIF protocol;\n  - Ceph Core library;\n  - Networking core;\n  - Ethtool driver;\n  - Handshake API;\n  - HSR network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NET/ROM layer;\n  - NFC subsystem;\n  - Open vSwitch;\n  - Rose network layer;\n  - Network traffic control;\n  - Network sockets;\n  - Sun RPC protocol;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Key management;\n  - Simplified Mandatory Access Control Kernel framework;\n  - FireWire sound drivers;\n  - HD-audio driver;\n  - Turtle Beach Wavefront ALSA driver;\n  - STMicroelectronics SoC drivers;\n  - USB sound devices;\n  - KVM subsystem;\n(CVE-2024-57795, CVE-2025-22022, CVE-2025-22111, CVE-2025-38022,\nCVE-2025-38234, CVE-2025-40164, CVE-2025-40325, CVE-2025-68206,\nCVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257,\nCVE-2025-68258, CVE-2025-68259, CVE-2025-68261, CVE-2025-68263,\nCVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291,\nCVE-2025-68325, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336,\nCVE-2025-68337, CVE-2025-68344, CVE-2025-68345, CVE-2025-68346,\nCVE-2025-68347, CVE-2025-68349, CVE-2025-68354, CVE-2025-68362,\nCVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367,\nCVE-2025-68369, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374,\nCVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724,\nCVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733,\nCVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68744,\nCVE-2025-68746, CVE-2025-68753, CVE-2025-68755, CVE-2025-68756,\nCVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68763,\nCVE-2025-68764, CVE-2025-68765, CVE-2025-68766, CVE-2025-68767,\nCVE-2025-68769, CVE-2025-68770, CVE-2025-68771, CVE-2025-68772,\nCVE-2025-68773, CVE-2025-68774, CVE-2025-68775, CVE-2025-68776,\nCVE-2025-68777, CVE-2025-68778, CVE-2025-68780, CVE-2025-68782,\nCVE-2025-68783, CVE-2025-68785, CVE-2025-68786, CVE-2025-68787,\nCVE-2025-68788, CVE-2025-68794, CVE-2025-68795, CVE-2025-68796,\nCVE-2025-68797, CVE-2025-68798, CVE-2025-68799, CVE-2025-68800,\nCVE-2025-68801, CVE-2025-68804, CVE-2025-68806, CVE-2025-68808,\nCVE-2025-68809, CVE-2025-68810, CVE-2025-68811, CVE-2025-68813,\nCVE-2025-68814, CVE-2025-68815, CVE-2025-68816, CVE-2025-68817,\nCVE-2025-68818, CVE-2025-68819, CVE-2025-68820, CVE-2025-68821,\nCVE-2025-71064, CVE-2025-71065, CVE-2025-71066, CVE-2025-71067,\nCVE-2025-71068, CVE-2025-71069, CVE-2025-71071, CVE-2025-71072,\nCVE-2025-71075, CVE-2025-71077, CVE-2025-71078, CVE-2025-71079,\nCVE-2025-71081, CVE-2025-71082, CVE-2025-71083, CVE-2025-71084,\nCVE-2025-71085, CVE-2025-71086, CVE-2025-71087, CVE-2025-71088,\nCVE-2025-71089, CVE-2025-71091, CVE-2025-71093, CVE-2025-71094,\nCVE-2025-71095, CVE-2025-71096, CVE-2025-71097, CVE-2025-71098,\nCVE-2025-71101, CVE-2025-71102, CVE-2025-71104, CVE-2025-71105,\nCVE-2025-71107, CVE-2025-71108, CVE-2025-71109, CVE-2025-71111,\nCVE-2025-71112, CVE-2025-71113, CVE-2025-71114, CVE-2025-71116,\nCVE-2025-71118, CVE-2025-71119, CVE-2025-71120, CVE-2025-71121,\nCVE-2025-71122, CVE-2025-71123, CVE-2025-71125, CVE-2025-71126,\nCVE-2025-71127, CVE-2025-71130, CVE-2025-71131, CVE-2025-71132,\nCVE-2025-71133, CVE-2025-71135, CVE-2025-71136, CVE-2025-71137,\nCVE-2025-71138, CVE-2025-71140, CVE-2025-71141, CVE-2025-71143,\nCVE-2025-71144, CVE-2025-71147, CVE-2025-71148, CVE-2025-71149,\nCVE-2025-71150, CVE-2025-71151, CVE-2025-71153, CVE-2025-71154,\nCVE-2026-23209)\n","status":"published","published":"2026-04-16T14:13:07Z","modified":"2026-11-04T20:03:13.295663568Z","updated_at":"2026-11-04T21:44:35.728664Z"},{"id":"USN-8179-2","title":"linux-aws-fips, linux-fips, linux-gcp-fips vulnerabilities","description":"Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo\nRizzo discovered that some AMD Zen processors did not properly verify the\nsignature of CPU microcode. This flaw is known as EntrySign. A privileged\nattacker could possibly use this issue to cause load malicious CPU\nmicrocode causing loss of integrity and confidentiality.\n(CVE-2024-36347)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - MIPS architecture;\n  - PowerPC architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - ACPI drivers;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - Hardware crypto device drivers;\n  - GPU drivers;\n  - Hardware monitoring drivers;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - Macintosh device drivers;\n  - Multiple devices driver;\n  - Media drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - Ethernet team driver;\n  - MediaTek network drivers;\n  - NVME drivers;\n  - PA-RISC drivers;\n  - Chrome hardware platform drivers;\n  - x86 platform drivers;\n  - Voltage and Current Regulator drivers;\n  - SCSI subsystem;\n  - SPI subsystem;\n  - Media Oriented Systems Transport (MOST) driver;\n  - Realtek RTL8723BS SDIO drivers;\n  - TCM subsystem;\n  - USB Host Controller drivers;\n  - USB Type-C Connector System Software Interface driver;\n  - Backlight driver;\n  - Watchdog drivers;\n  - BFS file system;\n  - BTRFS file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - HFS+ file system;\n  - File systems infrastructure;\n  - Journaling layer for block devices (JBD2);\n  - Network file system (NFS) client;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - SMB network file system;\n  - BPF subsystem;\n  - Ethernet bridge;\n  - io_uring subsystem;\n  - Locking primitives;\n  - Scheduler infrastructure;\n  - Shadow Call Stack mechanism;\n  - Tracing infrastructure;\n  - Memory management;\n  - CAIF protocol;\n  - Ceph Core library;\n  - Networking core;\n  - Ethtool driver;\n  - Handshake API;\n  - HSR network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NET/ROM layer;\n  - NFC subsystem;\n  - Open vSwitch;\n  - Rose network layer;\n  - Network traffic control;\n  - Network sockets;\n  - Sun RPC protocol;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Key management;\n  - Simplified Mandatory Access Control Kernel framework;\n  - FireWire sound drivers;\n  - HD-audio driver;\n  - Turtle Beach Wavefront ALSA driver;\n  - STMicroelectronics SoC drivers;\n  - USB sound devices;\n  - KVM subsystem;\n(CVE-2024-57795, CVE-2025-22022, CVE-2025-22111, CVE-2025-38022,\nCVE-2025-38234, CVE-2025-40164, CVE-2025-40325, CVE-2025-68206,\nCVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257,\nCVE-2025-68258, CVE-2025-68259, CVE-2025-68261, CVE-2025-68263,\nCVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291,\nCVE-2025-68325, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336,\nCVE-2025-68337, CVE-2025-68344, CVE-2025-68345, CVE-2025-68346,\nCVE-2025-68347, CVE-2025-68349, CVE-2025-68354, CVE-2025-68362,\nCVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367,\nCVE-2025-68369, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374,\nCVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724,\nCVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733,\nCVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68744,\nCVE-2025-68746, CVE-2025-68753, CVE-2025-68755, CVE-2025-68756,\nCVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68763,\nCVE-2025-68764, CVE-2025-68765, CVE-2025-68766, CVE-2025-68767,\nCVE-2025-68769, CVE-2025-68770, CVE-2025-68771, CVE-2025-68772,\nCVE-2025-68773, CVE-2025-68774, CVE-2025-68775, CVE-2025-68776,\nCVE-2025-68777, CVE-2025-68778, CVE-2025-68780, CVE-2025-68782,\nCVE-2025-68783, CVE-2025-68785, CVE-2025-68786, CVE-2025-68787,\nCVE-2025-68788, CVE-2025-68794, CVE-2025-68795, CVE-2025-68796,\nCVE-2025-68797, CVE-2025-68798, CVE-2025-68799, CVE-2025-68800,\nCVE-2025-68801, CVE-2025-68804, CVE-2025-68806, CVE-2025-68808,\nCVE-2025-68809, CVE-2025-68810, CVE-2025-68811, CVE-2025-68813,\nCVE-2025-68814, CVE-2025-68815, CVE-2025-68816, CVE-2025-68817,\nCVE-2025-68818, CVE-2025-68819, CVE-2025-68820, CVE-2025-68821,\nCVE-2025-71064, CVE-2025-71065, CVE-2025-71066, CVE-2025-71067,\nCVE-2025-71068, CVE-2025-71069, CVE-2025-71071, CVE-2025-71072,\nCVE-2025-71075, CVE-2025-71077, CVE-2025-71078, CVE-2025-71079,\nCVE-2025-71081, CVE-2025-71082, CVE-2025-71083, CVE-2025-71084,\nCVE-2025-71085, CVE-2025-71086, CVE-2025-71087, CVE-2025-71088,\nCVE-2025-71089, CVE-2025-71091, CVE-2025-71093, CVE-2025-71094,\nCVE-2025-71095, CVE-2025-71096, CVE-2025-71097, CVE-2025-71098,\nCVE-2025-71101, CVE-2025-71102, CVE-2025-71104, CVE-2025-71105,\nCVE-2025-71107, CVE-2025-71108, CVE-2025-71109, CVE-2025-71111,\nCVE-2025-71112, CVE-2025-71113, CVE-2025-71114, CVE-2025-71116,\nCVE-2025-71118, CVE-2025-71119, CVE-2025-71120, CVE-2025-71121,\nCVE-2025-71122, CVE-2025-71123, CVE-2025-71125, CVE-2025-71126,\nCVE-2025-71127, CVE-2025-71130, CVE-2025-71131, CVE-2025-71132,\nCVE-2025-71133, CVE-2025-71135, CVE-2025-71136, CVE-2025-71137,\nCVE-2025-71138, CVE-2025-71140, CVE-2025-71141, CVE-2025-71143,\nCVE-2025-71144, CVE-2025-71147, CVE-2025-71148, CVE-2025-71149,\nCVE-2025-71150, CVE-2025-71151, CVE-2025-71153, CVE-2025-71154,\nCVE-2026-23209)\n","status":"published","published":"2026-04-17T09:36:13Z","modified":"2026-11-04T20:01:03.58249938Z","updated_at":"2026-11-04T20:16:32.566315Z"},{"id":"USN-8179-3","title":"linux-hwe-6.8, linux-ibm-6.8, linux-raspi vulnerabilities","description":"Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo\nRizzo discovered that some AMD Zen processors did not properly verify the\nsignature of CPU microcode. This flaw is known as EntrySign. A privileged\nattacker could possibly use this issue to cause load malicious CPU\nmicrocode causing loss of integrity and confidentiality.\n(CVE-2024-36347)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - MIPS architecture;\n  - PowerPC architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - ACPI drivers;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - Hardware crypto device drivers;\n  - GPU drivers;\n  - Hardware monitoring drivers;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - Macintosh device drivers;\n  - Multiple devices driver;\n  - Media drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - Ethernet team driver;\n  - MediaTek network drivers;\n  - NVME drivers;\n  - PA-RISC drivers;\n  - Chrome hardware platform drivers;\n  - x86 platform drivers;\n  - Voltage and Current Regulator drivers;\n  - SCSI subsystem;\n  - SPI subsystem;\n  - Media Oriented Systems Transport (MOST) driver;\n  - Realtek RTL8723BS SDIO drivers;\n  - TCM subsystem;\n  - USB Host Controller drivers;\n  - USB Type-C Connector System Software Interface driver;\n  - Backlight driver;\n  - Watchdog drivers;\n  - BFS file system;\n  - BTRFS file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - HFS+ file system;\n  - File systems infrastructure;\n  - Journaling layer for block devices (JBD2);\n  - Network file system (NFS) client;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - SMB network file system;\n  - BPF subsystem;\n  - Ethernet bridge;\n  - io_uring subsystem;\n  - Locking primitives;\n  - Scheduler infrastructure;\n  - Shadow Call Stack mechanism;\n  - Tracing infrastructure;\n  - Memory management;\n  - CAIF protocol;\n  - Ceph Core library;\n  - Networking core;\n  - Ethtool driver;\n  - Handshake API;\n  - HSR network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NET/ROM layer;\n  - NFC subsystem;\n  - Open vSwitch;\n  - Rose network layer;\n  - Network traffic control;\n  - Network sockets;\n  - Sun RPC protocol;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Key management;\n  - Simplified Mandatory Access Control Kernel framework;\n  - FireWire sound drivers;\n  - HD-audio driver;\n  - Turtle Beach Wavefront ALSA driver;\n  - STMicroelectronics SoC drivers;\n  - USB sound devices;\n  - KVM subsystem;\n(CVE-2024-57795, CVE-2025-22022, CVE-2025-22111, CVE-2025-38022,\nCVE-2025-38234, CVE-2025-40164, CVE-2025-40325, CVE-2025-68206,\nCVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257,\nCVE-2025-68258, CVE-2025-68259, CVE-2025-68261, CVE-2025-68263,\nCVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291,\nCVE-2025-68325, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336,\nCVE-2025-68337, CVE-2025-68344, CVE-2025-68345, CVE-2025-68346,\nCVE-2025-68347, CVE-2025-68349, CVE-2025-68354, CVE-2025-68362,\nCVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367,\nCVE-2025-68369, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374,\nCVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724,\nCVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733,\nCVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68744,\nCVE-2025-68746, CVE-2025-68753, CVE-2025-68755, CVE-2025-68756,\nCVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68763,\nCVE-2025-68764, CVE-2025-68765, CVE-2025-68766, CVE-2025-68767,\nCVE-2025-68769, CVE-2025-68770, CVE-2025-68771, CVE-2025-68772,\nCVE-2025-68773, CVE-2025-68774, CVE-2025-68775, CVE-2025-68776,\nCVE-2025-68777, CVE-2025-68778, CVE-2025-68780, CVE-2025-68782,\nCVE-2025-68783, CVE-2025-68785, CVE-2025-68786, CVE-2025-68787,\nCVE-2025-68788, CVE-2025-68794, CVE-2025-68795, CVE-2025-68796,\nCVE-2025-68797, CVE-2025-68798, CVE-2025-68799, CVE-2025-68800,\nCVE-2025-68801, CVE-2025-68804, CVE-2025-68806, CVE-2025-68808,\nCVE-2025-68809, CVE-2025-68810, CVE-2025-68811, CVE-2025-68813,\nCVE-2025-68814, CVE-2025-68815, CVE-2025-68816, CVE-2025-68817,\nCVE-2025-68818, CVE-2025-68819, CVE-2025-68820, CVE-2025-68821,\nCVE-2025-71064, CVE-2025-71065, CVE-2025-71066, CVE-2025-71067,\nCVE-2025-71068, CVE-2025-71069, CVE-2025-71071, CVE-2025-71072,\nCVE-2025-71075, CVE-2025-71077, CVE-2025-71078, CVE-2025-71079,\nCVE-2025-71081, CVE-2025-71082, CVE-2025-71083, CVE-2025-71084,\nCVE-2025-71085, CVE-2025-71086, CVE-2025-71087, CVE-2025-71088,\nCVE-2025-71089, CVE-2025-71091, CVE-2025-71093, CVE-2025-71094,\nCVE-2025-71095, CVE-2025-71096, CVE-2025-71097, CVE-2025-71098,\nCVE-2025-71101, CVE-2025-71102, CVE-2025-71104, CVE-2025-71105,\nCVE-2025-71107, CVE-2025-71108, CVE-2025-71109, CVE-2025-71111,\nCVE-2025-71112, CVE-2025-71113, CVE-2025-71114, CVE-2025-71116,\nCVE-2025-71118, CVE-2025-71119, CVE-2025-71120, CVE-2025-71121,\nCVE-2025-71122, CVE-2025-71123, CVE-2025-71125, CVE-2025-71126,\nCVE-2025-71127, CVE-2025-71130, CVE-2025-71131, CVE-2025-71132,\nCVE-2025-71133, CVE-2025-71135, CVE-2025-71136, CVE-2025-71137,\nCVE-2025-71138, CVE-2025-71140, CVE-2025-71141, CVE-2025-71143,\nCVE-2025-71144, CVE-2025-71147, CVE-2025-71148, CVE-2025-71149,\nCVE-2025-71150, CVE-2025-71151, CVE-2025-71153, CVE-2025-71154,\nCVE-2026-23209)\n","status":"published","published":"2026-04-23T09:41:51Z","modified":"2026-11-04T20:02:00.522763798Z","updated_at":"2026-11-04T20:16:32.566315Z"},{"id":"USN-8179-4","title":"linux-gcp-6.8 vulnerabilities","description":"Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo\nRizzo discovered that some AMD Zen processors did not properly verify the\nsignature of CPU microcode. This flaw is known as EntrySign. A privileged\nattacker could possibly use this issue to cause load malicious CPU\nmicrocode causing loss of integrity and confidentiality.\n(CVE-2024-36347)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - MIPS architecture;\n  - PowerPC architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - ACPI drivers;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - Hardware crypto device drivers;\n  - GPU drivers;\n  - Hardware monitoring drivers;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - Macintosh device drivers;\n  - Multiple devices driver;\n  - Media drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - Ethernet team driver;\n  - MediaTek network drivers;\n  - NVME drivers;\n  - PA-RISC drivers;\n  - Chrome hardware platform drivers;\n  - x86 platform drivers;\n  - Voltage and Current Regulator drivers;\n  - SCSI subsystem;\n  - SPI subsystem;\n  - Media Oriented Systems Transport (MOST) driver;\n  - Realtek RTL8723BS SDIO drivers;\n  - TCM subsystem;\n  - USB Host Controller drivers;\n  - USB Type-C Connector System Software Interface driver;\n  - Backlight driver;\n  - Watchdog drivers;\n  - BFS file system;\n  - BTRFS file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - HFS+ file system;\n  - File systems infrastructure;\n  - Journaling layer for block devices (JBD2);\n  - Network file system (NFS) client;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - SMB network file system;\n  - BPF subsystem;\n  - Ethernet bridge;\n  - io_uring subsystem;\n  - Locking primitives;\n  - Scheduler infrastructure;\n  - Shadow Call Stack mechanism;\n  - Tracing infrastructure;\n  - Memory management;\n  - CAIF protocol;\n  - Ceph Core library;\n  - Networking core;\n  - Ethtool driver;\n  - Handshake API;\n  - HSR network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NET/ROM layer;\n  - NFC subsystem;\n  - Open vSwitch;\n  - Rose network layer;\n  - Network traffic control;\n  - Network sockets;\n  - Sun RPC protocol;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Key management;\n  - Simplified Mandatory Access Control Kernel framework;\n  - FireWire sound drivers;\n  - HD-audio driver;\n  - Turtle Beach Wavefront ALSA driver;\n  - STMicroelectronics SoC drivers;\n  - USB sound devices;\n  - KVM subsystem;\n(CVE-2024-57795, CVE-2025-22022, CVE-2025-22111, CVE-2025-38022,\nCVE-2025-38234, CVE-2025-40164, CVE-2025-40325, CVE-2025-68206,\nCVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257,\nCVE-2025-68258, CVE-2025-68259, CVE-2025-68261, CVE-2025-68263,\nCVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291,\nCVE-2025-68325, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336,\nCVE-2025-68337, CVE-2025-68344, CVE-2025-68345, CVE-2025-68346,\nCVE-2025-68347, CVE-2025-68349, CVE-2025-68354, CVE-2025-68362,\nCVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367,\nCVE-2025-68369, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374,\nCVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724,\nCVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733,\nCVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68744,\nCVE-2025-68746, CVE-2025-68753, CVE-2025-68755, CVE-2025-68756,\nCVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68763,\nCVE-2025-68764, CVE-2025-68765, CVE-2025-68766, CVE-2025-68767,\nCVE-2025-68769, CVE-2025-68770, CVE-2025-68771, CVE-2025-68772,\nCVE-2025-68773, CVE-2025-68774, CVE-2025-68775, CVE-2025-68776,\nCVE-2025-68777, CVE-2025-68778, CVE-2025-68780, CVE-2025-68782,\nCVE-2025-68783, CVE-2025-68785, CVE-2025-68786, CVE-2025-68787,\nCVE-2025-68788, CVE-2025-68794, CVE-2025-68795, CVE-2025-68796,\nCVE-2025-68797, CVE-2025-68798, CVE-2025-68799, CVE-2025-68800,\nCVE-2025-68801, CVE-2025-68804, CVE-2025-68806, CVE-2025-68808,\nCVE-2025-68809, CVE-2025-68810, CVE-2025-68811, CVE-2025-68813,\nCVE-2025-68814, CVE-2025-68815, CVE-2025-68816, CVE-2025-68817,\nCVE-2025-68818, CVE-2025-68819, CVE-2025-68820, CVE-2025-68821,\nCVE-2025-71064, CVE-2025-71065, CVE-2025-71066, CVE-2025-71067,\nCVE-2025-71068, CVE-2025-71069, CVE-2025-71071, CVE-2025-71072,\nCVE-2025-71075, CVE-2025-71077, CVE-2025-71078, CVE-2025-71079,\nCVE-2025-71081, CVE-2025-71082, CVE-2025-71083, CVE-2025-71084,\nCVE-2025-71085, CVE-2025-71086, CVE-2025-71087, CVE-2025-71088,\nCVE-2025-71089, CVE-2025-71091, CVE-2025-71093, CVE-2025-71094,\nCVE-2025-71095, CVE-2025-71096, CVE-2025-71097, CVE-2025-71098,\nCVE-2025-71101, CVE-2025-71102, CVE-2025-71104, CVE-2025-71105,\nCVE-2025-71107, CVE-2025-71108, CVE-2025-71109, CVE-2025-71111,\nCVE-2025-71112, CVE-2025-71113, CVE-2025-71114, CVE-2025-71116,\nCVE-2025-71118, CVE-2025-71119, CVE-2025-71120, CVE-2025-71121,\nCVE-2025-71122, CVE-2025-71123, CVE-2025-71125, CVE-2025-71126,\nCVE-2025-71127, CVE-2025-71130, CVE-2025-71131, CVE-2025-71132,\nCVE-2025-71133, CVE-2025-71135, CVE-2025-71136, CVE-2025-71137,\nCVE-2025-71138, CVE-2025-71140, CVE-2025-71141, CVE-2025-71143,\nCVE-2025-71144, CVE-2025-71147, CVE-2025-71148, CVE-2025-71150,\nCVE-2025-71151, CVE-2025-71153, CVE-2025-71154, CVE-2026-23209)\n","status":"published","published":"2026-05-07T07:34:08Z","modified":"2026-11-04T20:01:41.542186472Z","updated_at":"2026-11-04T20:16:32.566315Z"},{"id":"USN-8184-1","title":"linux-realtime, linux-realtime-6.8 vulnerabilities","description":"Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo\nRizzo discovered that some AMD Zen processors did not properly verify the\nsignature of CPU microcode. This flaw is known as EntrySign. A privileged\nattacker could possibly use this issue to cause load malicious CPU\nmicrocode causing loss of integrity and confidentiality.\n(CVE-2024-36347)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - MIPS architecture;\n  - PowerPC architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - ACPI drivers;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - Hardware crypto device drivers;\n  - GPU drivers;\n  - Hardware monitoring drivers;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - Macintosh device drivers;\n  - Multiple devices driver;\n  - Media drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - Ethernet team driver;\n  - MediaTek network drivers;\n  - NVME drivers;\n  - PA-RISC drivers;\n  - Chrome hardware platform drivers;\n  - x86 platform drivers;\n  - Voltage and Current Regulator drivers;\n  - SCSI subsystem;\n  - SPI subsystem;\n  - Media Oriented Systems Transport (MOST) driver;\n  - Realtek RTL8723BS SDIO drivers;\n  - TCM subsystem;\n  - USB Host Controller drivers;\n  - USB Type-C Connector System Software Interface driver;\n  - Backlight driver;\n  - Watchdog drivers;\n  - BFS file system;\n  - BTRFS file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - HFS+ file system;\n  - File systems infrastructure;\n  - Journaling layer for block devices (JBD2);\n  - Network file system (NFS) client;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - SMB network file system;\n  - BPF subsystem;\n  - Ethernet bridge;\n  - io_uring subsystem;\n  - Locking primitives;\n  - Scheduler infrastructure;\n  - Shadow Call Stack mechanism;\n  - Tracing infrastructure;\n  - Memory management;\n  - CAIF protocol;\n  - Ceph Core library;\n  - Networking core;\n  - Ethtool driver;\n  - Handshake API;\n  - HSR network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NET/ROM layer;\n  - NFC subsystem;\n  - Open vSwitch;\n  - Rose network layer;\n  - Network traffic control;\n  - Network sockets;\n  - Sun RPC protocol;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Key management;\n  - Simplified Mandatory Access Control Kernel framework;\n  - FireWire sound drivers;\n  - HD-audio driver;\n  - Turtle Beach Wavefront ALSA driver;\n  - STMicroelectronics SoC drivers;\n  - USB sound devices;\n  - KVM subsystem;\n(CVE-2024-57795, CVE-2025-22022, CVE-2025-22111, CVE-2025-38022,\nCVE-2025-38234, CVE-2025-40164, CVE-2025-40325, CVE-2025-68206,\nCVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257,\nCVE-2025-68258, CVE-2025-68259, CVE-2025-68261, CVE-2025-68263,\nCVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291,\nCVE-2025-68325, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336,\nCVE-2025-68337, CVE-2025-68344, CVE-2025-68345, CVE-2025-68346,\nCVE-2025-68347, CVE-2025-68349, CVE-2025-68354, CVE-2025-68362,\nCVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367,\nCVE-2025-68369, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374,\nCVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724,\nCVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733,\nCVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68744,\nCVE-2025-68746, CVE-2025-68753, CVE-2025-68755, CVE-2025-68756,\nCVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68763,\nCVE-2025-68764, CVE-2025-68765, CVE-2025-68766, CVE-2025-68767,\nCVE-2025-68769, CVE-2025-68770, CVE-2025-68771, CVE-2025-68772,\nCVE-2025-68773, CVE-2025-68774, CVE-2025-68775, CVE-2025-68776,\nCVE-2025-68777, CVE-2025-68778, CVE-2025-68780, CVE-2025-68782,\nCVE-2025-68783, CVE-2025-68785, CVE-2025-68786, CVE-2025-68787,\nCVE-2025-68788, CVE-2025-68794, CVE-2025-68795, CVE-2025-68796,\nCVE-2025-68797, CVE-2025-68798, CVE-2025-68799, CVE-2025-68800,\nCVE-2025-68801, CVE-2025-68804, CVE-2025-68806, CVE-2025-68808,\nCVE-2025-68809, CVE-2025-68810, CVE-2025-68811, CVE-2025-68813,\nCVE-2025-68814, CVE-2025-68815, CVE-2025-68816, CVE-2025-68817,\nCVE-2025-68818, CVE-2025-68819, CVE-2025-68820, CVE-2025-68821,\nCVE-2025-71064, CVE-2025-71065, CVE-2025-71066, CVE-2025-71067,\nCVE-2025-71068, CVE-2025-71069, CVE-2025-71071, CVE-2025-71072,\nCVE-2025-71075, CVE-2025-71077, CVE-2025-71078, CVE-2025-71079,\nCVE-2025-71080, CVE-2025-71081, CVE-2025-71082, CVE-2025-71083,\nCVE-2025-71084, CVE-2025-71085, CVE-2025-71086, CVE-2025-71087,\nCVE-2025-71088, CVE-2025-71089, CVE-2025-71091, CVE-2025-71093,\nCVE-2025-71094, CVE-2025-71095, CVE-2025-71096, CVE-2025-71097,\nCVE-2025-71098, CVE-2025-71101, CVE-2025-71102, CVE-2025-71104,\nCVE-2025-71105, CVE-2025-71107, CVE-2025-71108, CVE-2025-71109,\nCVE-2025-71111, CVE-2025-71112, CVE-2025-71113, CVE-2025-71114,\nCVE-2025-71116, CVE-2025-71118, CVE-2025-71119, CVE-2025-71120,\nCVE-2025-71121, CVE-2025-71122, CVE-2025-71123, CVE-2025-71125,\nCVE-2025-71126, CVE-2025-71127, CVE-2025-71130, CVE-2025-71131,\nCVE-2025-71132, CVE-2025-71133, CVE-2025-71135, CVE-2025-71136,\nCVE-2025-71137, CVE-2025-71138, CVE-2025-71140, CVE-2025-71141,\nCVE-2025-71143, CVE-2025-71144, CVE-2025-71147, CVE-2025-71148,\nCVE-2025-71149, CVE-2025-71150, CVE-2025-71151, CVE-2025-71153,\nCVE-2025-71154, CVE-2026-23209)\n","status":"published","published":"2026-04-17T09:26:36Z","modified":"2026-11-04T20:02:31.825928772Z","updated_at":"2026-11-04T20:16:32.566315Z"},{"id":"USN-8185-1","title":"linux-nvidia, linux-nvidia-6.8 vulnerabilities","description":"Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo\nRizzo discovered that some AMD Zen processors did not properly verify the\nsignature of CPU microcode. This flaw is known as EntrySign. A privileged\nattacker could possibly use this issue to cause load malicious CPU\nmicrocode causing loss of integrity and confidentiality.\n(CVE-2024-36347)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - MIPS architecture;\n  - PowerPC architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - ACPI drivers;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - Hardware crypto device drivers;\n  - GPU drivers;\n  - Hardware monitoring drivers;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - Macintosh device drivers;\n  - Multiple devices driver;\n  - Media drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - Ethernet team driver;\n  - MediaTek network drivers;\n  - NVME drivers;\n  - PA-RISC drivers;\n  - Chrome hardware platform drivers;\n  - x86 platform drivers;\n  - Voltage and Current Regulator drivers;\n  - SCSI subsystem;\n  - SPI subsystem;\n  - Media Oriented Systems Transport (MOST) driver;\n  - Realtek RTL8723BS SDIO drivers;\n  - TCM subsystem;\n  - USB Host Controller drivers;\n  - USB Type-C Connector System Software Interface driver;\n  - Backlight driver;\n  - Watchdog drivers;\n  - BFS file system;\n  - BTRFS file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - HFS+ file system;\n  - File systems infrastructure;\n  - Journaling layer for block devices (JBD2);\n  - Network file system (NFS) client;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - SMB network file system;\n  - BPF subsystem;\n  - Ethernet bridge;\n  - io_uring subsystem;\n  - Locking primitives;\n  - Scheduler infrastructure;\n  - Shadow Call Stack mechanism;\n  - Tracing infrastructure;\n  - Memory management;\n  - CAIF protocol;\n  - Ceph Core library;\n  - Networking core;\n  - Ethtool driver;\n  - Handshake API;\n  - HSR network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NET/ROM layer;\n  - NFC subsystem;\n  - Open vSwitch;\n  - Rose network layer;\n  - Network traffic control;\n  - Network sockets;\n  - Sun RPC protocol;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Key management;\n  - Simplified Mandatory Access Control Kernel framework;\n  - FireWire sound drivers;\n  - HD-audio driver;\n  - Turtle Beach Wavefront ALSA driver;\n  - STMicroelectronics SoC drivers;\n  - USB sound devices;\n  - KVM subsystem;\n(CVE-2024-57795, CVE-2025-22022, CVE-2025-22111, CVE-2025-38022,\nCVE-2025-38234, CVE-2025-40164, CVE-2025-40325, CVE-2025-68206,\nCVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257,\nCVE-2025-68258, CVE-2025-68259, CVE-2025-68261, CVE-2025-68263,\nCVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291,\nCVE-2025-68325, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336,\nCVE-2025-68337, CVE-2025-68344, CVE-2025-68345, CVE-2025-68346,\nCVE-2025-68347, CVE-2025-68349, CVE-2025-68354, CVE-2025-68362,\nCVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367,\nCVE-2025-68369, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374,\nCVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724,\nCVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733,\nCVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68744,\nCVE-2025-68753, CVE-2025-68755, CVE-2025-68756, CVE-2025-68757,\nCVE-2025-68758, CVE-2025-68759, CVE-2025-68763, CVE-2025-68764,\nCVE-2025-68765, CVE-2025-68766, CVE-2025-68767, CVE-2025-68769,\nCVE-2025-68770, CVE-2025-68771, CVE-2025-68772, CVE-2025-68773,\nCVE-2025-68774, CVE-2025-68775, CVE-2025-68776, CVE-2025-68777,\nCVE-2025-68778, CVE-2025-68780, CVE-2025-68782, CVE-2025-68783,\nCVE-2025-68785, CVE-2025-68786, CVE-2025-68787, CVE-2025-68788,\nCVE-2025-68794, CVE-2025-68795, CVE-2025-68796, CVE-2025-68797,\nCVE-2025-68798, CVE-2025-68799, CVE-2025-68800, CVE-2025-68801,\nCVE-2025-68804, CVE-2025-68806, CVE-2025-68808, CVE-2025-68809,\nCVE-2025-68810, CVE-2025-68811, CVE-2025-68813, CVE-2025-68814,\nCVE-2025-68815, CVE-2025-68816, CVE-2025-68817, CVE-2025-68818,\nCVE-2025-68819, CVE-2025-68820, CVE-2025-68821, CVE-2025-71064,\nCVE-2025-71065, CVE-2025-71066, CVE-2025-71067, CVE-2025-71068,\nCVE-2025-71069, CVE-2025-71071, CVE-2025-71072, CVE-2025-71075,\nCVE-2025-71077, CVE-2025-71078, CVE-2025-71079, CVE-2025-71081,\nCVE-2025-71082, CVE-2025-71083, CVE-2025-71084, CVE-2025-71085,\nCVE-2025-71086, CVE-2025-71087, CVE-2025-71088, CVE-2025-71089,\nCVE-2025-71091, CVE-2025-71093, CVE-2025-71094, CVE-2025-71095,\nCVE-2025-71096, CVE-2025-71097, CVE-2025-71098, CVE-2025-71101,\nCVE-2025-71102, CVE-2025-71104, CVE-2025-71105, CVE-2025-71107,\nCVE-2025-71108, CVE-2025-71109, CVE-2025-71111, CVE-2025-71112,\nCVE-2025-71113, CVE-2025-71114, CVE-2025-71116, CVE-2025-71118,\nCVE-2025-71119, CVE-2025-71120, CVE-2025-71121, CVE-2025-71122,\nCVE-2025-71123, CVE-2025-71125, CVE-2025-71126, CVE-2025-71127,\nCVE-2025-71130, CVE-2025-71131, CVE-2025-71132, CVE-2025-71133,\nCVE-2025-71135, CVE-2025-71136, CVE-2025-71137, CVE-2025-71138,\nCVE-2025-71140, CVE-2025-71141, CVE-2025-71143, CVE-2025-71144,\nCVE-2025-71147, CVE-2025-71148, CVE-2025-71149, CVE-2025-71150,\nCVE-2025-71151, CVE-2025-71153, CVE-2025-71154, CVE-2026-23209)\n","status":"published","published":"2026-04-17T09:55:06Z","modified":"2026-11-04T20:02:30.754056894Z","updated_at":"2026-11-04T20:16:32.566315Z"},{"id":"USN-8185-2","title":"linux-nvidia-lowlatency vulnerabilities","description":"Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo\nRizzo discovered that some AMD Zen processors did not properly verify the\nsignature of CPU microcode. This flaw is known as EntrySign. A privileged\nattacker could possibly use this issue to cause load malicious CPU\nmicrocode causing loss of integrity and confidentiality.\n(CVE-2024-36347)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - MIPS architecture;\n  - PowerPC architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - ACPI drivers;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - Hardware crypto device drivers;\n  - GPU drivers;\n  - Hardware monitoring drivers;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - Macintosh device drivers;\n  - Multiple devices driver;\n  - Media drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - Ethernet team driver;\n  - MediaTek network drivers;\n  - NVME drivers;\n  - PA-RISC drivers;\n  - Chrome hardware platform drivers;\n  - x86 platform drivers;\n  - Voltage and Current Regulator drivers;\n  - SCSI subsystem;\n  - SPI subsystem;\n  - Media Oriented Systems Transport (MOST) driver;\n  - Realtek RTL8723BS SDIO drivers;\n  - TCM subsystem;\n  - USB Host Controller drivers;\n  - USB Type-C Connector System Software Interface driver;\n  - Backlight driver;\n  - Watchdog drivers;\n  - BFS file system;\n  - BTRFS file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - HFS+ file system;\n  - File systems infrastructure;\n  - Journaling layer for block devices (JBD2);\n  - Network file system (NFS) client;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - SMB network file system;\n  - BPF subsystem;\n  - Ethernet bridge;\n  - io_uring subsystem;\n  - Locking primitives;\n  - Scheduler infrastructure;\n  - Shadow Call Stack mechanism;\n  - Tracing infrastructure;\n  - Memory management;\n  - CAIF protocol;\n  - Ceph Core library;\n  - Networking core;\n  - Ethtool driver;\n  - Handshake API;\n  - HSR network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NET/ROM layer;\n  - NFC subsystem;\n  - Open vSwitch;\n  - Rose network layer;\n  - Network traffic control;\n  - Network sockets;\n  - Sun RPC protocol;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Key management;\n  - Simplified Mandatory Access Control Kernel framework;\n  - FireWire sound drivers;\n  - HD-audio driver;\n  - Turtle Beach Wavefront ALSA driver;\n  - STMicroelectronics SoC drivers;\n  - USB sound devices;\n  - KVM subsystem;\n(CVE-2024-57795, CVE-2025-22022, CVE-2025-22111, CVE-2025-38022,\nCVE-2025-38234, CVE-2025-40164, CVE-2025-40325, CVE-2025-68206,\nCVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257,\nCVE-2025-68258, CVE-2025-68259, CVE-2025-68261, CVE-2025-68263,\nCVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291,\nCVE-2025-68325, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336,\nCVE-2025-68337, CVE-2025-68344, CVE-2025-68345, CVE-2025-68346,\nCVE-2025-68347, CVE-2025-68349, CVE-2025-68354, CVE-2025-68362,\nCVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367,\nCVE-2025-68369, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374,\nCVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724,\nCVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733,\nCVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68744,\nCVE-2025-68753, CVE-2025-68755, CVE-2025-68756, CVE-2025-68757,\nCVE-2025-68758, CVE-2025-68759, CVE-2025-68763, CVE-2025-68764,\nCVE-2025-68765, CVE-2025-68766, CVE-2025-68767, CVE-2025-68769,\nCVE-2025-68770, CVE-2025-68771, CVE-2025-68772, CVE-2025-68773,\nCVE-2025-68774, CVE-2025-68775, CVE-2025-68776, CVE-2025-68777,\nCVE-2025-68778, CVE-2025-68780, CVE-2025-68782, CVE-2025-68783,\nCVE-2025-68785, CVE-2025-68786, CVE-2025-68787, CVE-2025-68788,\nCVE-2025-68794, CVE-2025-68795, CVE-2025-68796, CVE-2025-68797,\nCVE-2025-68798, CVE-2025-68799, CVE-2025-68800, CVE-2025-68801,\nCVE-2025-68804, CVE-2025-68806, CVE-2025-68808, CVE-2025-68809,\nCVE-2025-68810, CVE-2025-68811, CVE-2025-68813, CVE-2025-68814,\nCVE-2025-68815, CVE-2025-68816, CVE-2025-68817, CVE-2025-68818,\nCVE-2025-68819, CVE-2025-68820, CVE-2025-68821, CVE-2025-71064,\nCVE-2025-71065, CVE-2025-71066, CVE-2025-71067, CVE-2025-71068,\nCVE-2025-71069, CVE-2025-71071, CVE-2025-71072, CVE-2025-71075,\nCVE-2025-71077, CVE-2025-71078, CVE-2025-71079, CVE-2025-71081,\nCVE-2025-71082, CVE-2025-71083, CVE-2025-71084, CVE-2025-71085,\nCVE-2025-71086, CVE-2025-71087, CVE-2025-71088, CVE-2025-71089,\nCVE-2025-71091, CVE-2025-71093, CVE-2025-71094, CVE-2025-71095,\nCVE-2025-71096, CVE-2025-71097, CVE-2025-71098, CVE-2025-71101,\nCVE-2025-71102, CVE-2025-71104, CVE-2025-71105, CVE-2025-71107,\nCVE-2025-71108, CVE-2025-71109, CVE-2025-71111, CVE-2025-71112,\nCVE-2025-71113, CVE-2025-71114, CVE-2025-71116, CVE-2025-71118,\nCVE-2025-71119, CVE-2025-71120, CVE-2025-71121, CVE-2025-71122,\nCVE-2025-71123, CVE-2025-71125, CVE-2025-71126, CVE-2025-71127,\nCVE-2025-71130, CVE-2025-71131, CVE-2025-71132, CVE-2025-71133,\nCVE-2025-71135, CVE-2025-71136, CVE-2025-71137, CVE-2025-71138,\nCVE-2025-71140, CVE-2025-71141, CVE-2025-71143, CVE-2025-71144,\nCVE-2025-71147, CVE-2025-71148, CVE-2025-71149, CVE-2025-71150,\nCVE-2025-71151, CVE-2025-71153, CVE-2025-71154, CVE-2026-23209)\n","status":"published","published":"2026-04-28T16:30:16Z","modified":"2026-11-04T20:02:27.129164299Z","updated_at":"2026-11-04T20:16:32.566315Z"},{"id":"USN-8203-1","title":"linux-oracle, linux-oracle-6.8 vulnerabilities","description":"Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo\nRizzo discovered that some AMD Zen processors did not properly verify the\nsignature of CPU microcode. This flaw is known as EntrySign. A privileged\nattacker could possibly use this issue to cause load malicious CPU\nmicrocode causing loss of integrity and confidentiality.\n(CVE-2024-36347)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - MIPS architecture;\n  - PowerPC architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - ACPI drivers;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - Hardware crypto device drivers;\n  - GPU drivers;\n  - Hardware monitoring drivers;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - Macintosh device drivers;\n  - Multiple devices driver;\n  - Media drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - Ethernet team driver;\n  - MediaTek network drivers;\n  - NVME drivers;\n  - PA-RISC drivers;\n  - Chrome hardware platform drivers;\n  - x86 platform drivers;\n  - Voltage and Current Regulator drivers;\n  - SCSI subsystem;\n  - SPI subsystem;\n  - Media Oriented Systems Transport (MOST) driver;\n  - Realtek RTL8723BS SDIO drivers;\n  - TCM subsystem;\n  - USB Host Controller drivers;\n  - USB Type-C Connector System Software Interface driver;\n  - Backlight driver;\n  - Watchdog drivers;\n  - BFS file system;\n  - BTRFS file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - HFS+ file system;\n  - File systems infrastructure;\n  - Journaling layer for block devices (JBD2);\n  - Network file system (NFS) client;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - SMB network file system;\n  - BPF subsystem;\n  - Ethernet bridge;\n  - io_uring subsystem;\n  - Locking primitives;\n  - Scheduler infrastructure;\n  - Shadow Call Stack mechanism;\n  - Tracing infrastructure;\n  - Memory management;\n  - CAIF protocol;\n  - Ceph Core library;\n  - Networking core;\n  - Ethtool driver;\n  - Handshake API;\n  - HSR network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NET/ROM layer;\n  - NFC subsystem;\n  - Open vSwitch;\n  - Rose network layer;\n  - Network traffic control;\n  - Network sockets;\n  - Sun RPC protocol;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Key management;\n  - Simplified Mandatory Access Control Kernel framework;\n  - FireWire sound drivers;\n  - HD-audio driver;\n  - Turtle Beach Wavefront ALSA driver;\n  - STMicroelectronics SoC drivers;\n  - USB sound devices;\n  - KVM subsystem;\n(CVE-2024-57795, CVE-2025-22022, CVE-2025-22111, CVE-2025-38022,\nCVE-2025-38234, CVE-2025-40164, CVE-2025-40325, CVE-2025-68206,\nCVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257,\nCVE-2025-68258, CVE-2025-68259, CVE-2025-68261, CVE-2025-68263,\nCVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291,\nCVE-2025-68325, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336,\nCVE-2025-68337, CVE-2025-68344, CVE-2025-68345, CVE-2025-68346,\nCVE-2025-68347, CVE-2025-68349, CVE-2025-68354, CVE-2025-68362,\nCVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367,\nCVE-2025-68369, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374,\nCVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724,\nCVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733,\nCVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68744,\nCVE-2025-68746, CVE-2025-68753, CVE-2025-68755, CVE-2025-68756,\nCVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68763,\nCVE-2025-68764, CVE-2025-68765, CVE-2025-68766, CVE-2025-68767,\nCVE-2025-68769, CVE-2025-68770, CVE-2025-68771, CVE-2025-68772,\nCVE-2025-68773, CVE-2025-68774, CVE-2025-68775, CVE-2025-68776,\nCVE-2025-68777, CVE-2025-68778, CVE-2025-68780, CVE-2025-68782,\nCVE-2025-68783, CVE-2025-68785, CVE-2025-68786, CVE-2025-68787,\nCVE-2025-68788, CVE-2025-68794, CVE-2025-68795, CVE-2025-68796,\nCVE-2025-68797, CVE-2025-68798, CVE-2025-68799, CVE-2025-68800,\nCVE-2025-68801, CVE-2025-68804, CVE-2025-68806, CVE-2025-68808,\nCVE-2025-68809, CVE-2025-68810, CVE-2025-68811, CVE-2025-68813,\nCVE-2025-68814, CVE-2025-68815, CVE-2025-68816, CVE-2025-68817,\nCVE-2025-68818, CVE-2025-68819, CVE-2025-68820, CVE-2025-68821,\nCVE-2025-71064, CVE-2025-71065, CVE-2025-71066, CVE-2025-71067,\nCVE-2025-71068, CVE-2025-71069, CVE-2025-71071, CVE-2025-71072,\nCVE-2025-71075, CVE-2025-71077, CVE-2025-71078, CVE-2025-71079,\nCVE-2025-71081, CVE-2025-71082, CVE-2025-71083, CVE-2025-71084,\nCVE-2025-71085, CVE-2025-71086, CVE-2025-71087, CVE-2025-71088,\nCVE-2025-71089, CVE-2025-71091, CVE-2025-71093, CVE-2025-71094,\nCVE-2025-71095, CVE-2025-71096, CVE-2025-71097, CVE-2025-71098,\nCVE-2025-71101, CVE-2025-71102, CVE-2025-71104, CVE-2025-71105,\nCVE-2025-71107, CVE-2025-71108, CVE-2025-71109, CVE-2025-71111,\nCVE-2025-71112, CVE-2025-71113, CVE-2025-71114, CVE-2025-71116,\nCVE-2025-71118, CVE-2025-71119, CVE-2025-71120, CVE-2025-71121,\nCVE-2025-71122, CVE-2025-71123, CVE-2025-71125, CVE-2025-71126,\nCVE-2025-71127, CVE-2025-71130, CVE-2025-71131, CVE-2025-71132,\nCVE-2025-71133, CVE-2025-71135, CVE-2025-71136, CVE-2025-71137,\nCVE-2025-71138, CVE-2025-71140, CVE-2025-71141, CVE-2025-71143,\nCVE-2025-71144, CVE-2025-71147, CVE-2025-71148, CVE-2025-71149,\nCVE-2025-71150, CVE-2025-71151, CVE-2025-71153, CVE-2025-71154,\nCVE-2026-23060, CVE-2026-23074, CVE-2026-23111, CVE-2026-23209)\n","status":"published","published":"2026-04-23T09:52:44Z","modified":"2026-11-04T20:02:33.906318206Z","updated_at":"2026-11-04T20:16:32.566315Z"},{"id":"USN-8204-1","title":"linux-raspi-realtime vulnerabilities","description":"Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo\nRizzo discovered that some AMD Zen processors did not properly verify the\nsignature of CPU microcode. This flaw is known as EntrySign. A privileged\nattacker could possibly use this issue to cause load malicious CPU\nmicrocode causing loss of integrity and confidentiality.\n(CVE-2024-36347)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - MIPS architecture;\n  - PowerPC architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - ACPI drivers;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - Hardware crypto device drivers;\n  - GPU drivers;\n  - Hardware monitoring drivers;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - Macintosh device drivers;\n  - Multiple devices driver;\n  - Media drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - Ethernet team driver;\n  - MediaTek network drivers;\n  - NVME drivers;\n  - PA-RISC drivers;\n  - Chrome hardware platform drivers;\n  - x86 platform drivers;\n  - Voltage and Current Regulator drivers;\n  - SCSI subsystem;\n  - SPI subsystem;\n  - Media Oriented Systems Transport (MOST) driver;\n  - Realtek RTL8723BS SDIO drivers;\n  - TCM subsystem;\n  - USB Host Controller drivers;\n  - USB Type-C Connector System Software Interface driver;\n  - Backlight driver;\n  - Watchdog drivers;\n  - BFS file system;\n  - BTRFS file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - HFS+ file system;\n  - File systems infrastructure;\n  - Journaling layer for block devices (JBD2);\n  - Network file system (NFS) client;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - SMB network file system;\n  - BPF subsystem;\n  - Ethernet bridge;\n  - io_uring subsystem;\n  - Locking primitives;\n  - Scheduler infrastructure;\n  - Shadow Call Stack mechanism;\n  - Tracing infrastructure;\n  - Memory management;\n  - CAIF protocol;\n  - Ceph Core library;\n  - Networking core;\n  - Ethtool driver;\n  - Handshake API;\n  - HSR network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NET/ROM layer;\n  - NFC subsystem;\n  - Open vSwitch;\n  - Rose network layer;\n  - Network traffic control;\n  - Network sockets;\n  - Sun RPC protocol;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Key management;\n  - Simplified Mandatory Access Control Kernel framework;\n  - FireWire sound drivers;\n  - HD-audio driver;\n  - Turtle Beach Wavefront ALSA driver;\n  - STMicroelectronics SoC drivers;\n  - USB sound devices;\n  - KVM subsystem;\n(CVE-2024-57795, CVE-2025-22022, CVE-2025-22111, CVE-2025-38022,\nCVE-2025-38234, CVE-2025-40164, CVE-2025-40325, CVE-2025-68206,\nCVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257,\nCVE-2025-68258, CVE-2025-68259, CVE-2025-68261, CVE-2025-68263,\nCVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291,\nCVE-2025-68325, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336,\nCVE-2025-68337, CVE-2025-68344, CVE-2025-68345, CVE-2025-68346,\nCVE-2025-68347, CVE-2025-68349, CVE-2025-68354, CVE-2025-68362,\nCVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367,\nCVE-2025-68369, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374,\nCVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724,\nCVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733,\nCVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68744,\nCVE-2025-68746, CVE-2025-68753, CVE-2025-68755, CVE-2025-68756,\nCVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68763,\nCVE-2025-68764, CVE-2025-68765, CVE-2025-68766, CVE-2025-68767,\nCVE-2025-68769, CVE-2025-68770, CVE-2025-68771, CVE-2025-68772,\nCVE-2025-68773, CVE-2025-68774, CVE-2025-68775, CVE-2025-68776,\nCVE-2025-68777, CVE-2025-68778, CVE-2025-68780, CVE-2025-68782,\nCVE-2025-68783, CVE-2025-68785, CVE-2025-68786, CVE-2025-68787,\nCVE-2025-68788, CVE-2025-68794, CVE-2025-68795, CVE-2025-68796,\nCVE-2025-68797, CVE-2025-68798, CVE-2025-68799, CVE-2025-68800,\nCVE-2025-68801, CVE-2025-68804, CVE-2025-68806, CVE-2025-68808,\nCVE-2025-68809, CVE-2025-68810, CVE-2025-68811, CVE-2025-68813,\nCVE-2025-68814, CVE-2025-68815, CVE-2025-68816, CVE-2025-68817,\nCVE-2025-68818, CVE-2025-68819, CVE-2025-68820, CVE-2025-68821,\nCVE-2025-71064, CVE-2025-71065, CVE-2025-71066, CVE-2025-71067,\nCVE-2025-71068, CVE-2025-71069, CVE-2025-71071, CVE-2025-71072,\nCVE-2025-71075, CVE-2025-71077, CVE-2025-71078, CVE-2025-71079,\nCVE-2025-71080, CVE-2025-71081, CVE-2025-71082, CVE-2025-71083,\nCVE-2025-71084, CVE-2025-71085, CVE-2025-71086, CVE-2025-71087,\nCVE-2025-71088, CVE-2025-71089, CVE-2025-71091, CVE-2025-71093,\nCVE-2025-71094, CVE-2025-71095, CVE-2025-71096, CVE-2025-71097,\nCVE-2025-71098, CVE-2025-71101, CVE-2025-71102, CVE-2025-71104,\nCVE-2025-71105, CVE-2025-71107, CVE-2025-71108, CVE-2025-71109,\nCVE-2025-71111, CVE-2025-71112, CVE-2025-71113, CVE-2025-71114,\nCVE-2025-71116, CVE-2025-71118, CVE-2025-71119, CVE-2025-71120,\nCVE-2025-71121, CVE-2025-71122, CVE-2025-71123, CVE-2025-71125,\nCVE-2025-71126, CVE-2025-71127, CVE-2025-71130, CVE-2025-71131,\nCVE-2025-71132, CVE-2025-71133, CVE-2025-71135, CVE-2025-71136,\nCVE-2025-71137, CVE-2025-71138, CVE-2025-71140, CVE-2025-71141,\nCVE-2025-71143, CVE-2025-71144, CVE-2025-71147, CVE-2025-71148,\nCVE-2025-71149, CVE-2025-71150, CVE-2025-71151, CVE-2025-71153,\nCVE-2025-71154, CVE-2026-23209)\n","status":"published","published":"2026-04-23T10:00:50Z","modified":"2026-11-04T20:02:31.149520524Z","updated_at":"2026-11-04T20:16:32.566315Z"},{"id":"USN-8258-1","title":"linux-azure vulnerabilities","description":"Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo\nRizzo discovered that some AMD Zen processors did not properly verify the\nsignature of CPU microcode. This flaw is known as EntrySign. A privileged\nattacker could possibly use this issue to cause load malicious CPU\nmicrocode causing loss of integrity and confidentiality. (CVE-2024-36347)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - MIPS architecture;\n  - PowerPC architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - ACPI drivers;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - Hardware crypto device drivers;\n  - GPU drivers;\n  - Hardware monitoring drivers;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - Macintosh device drivers;\n  - Multiple devices driver;\n  - Media drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - Ethernet team driver;\n  - MediaTek network drivers;\n  - NVME drivers;\n  - PA-RISC drivers;\n  - Chrome hardware platform drivers;\n  - x86 platform drivers;\n  - Voltage and Current Regulator drivers;\n  - SCSI subsystem;\n  - SPI subsystem;\n  - Media Oriented Systems Transport (MOST) driver;\n  - Realtek RTL8723BS SDIO drivers;\n  - TCM subsystem;\n  - USB Host Controller drivers;\n  - USB Type-C Connector System Software Interface driver;\n  - Backlight driver;\n  - Watchdog drivers;\n  - BFS file system;\n  - BTRFS file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - HFS+ file system;\n  - File systems infrastructure;\n  - Journaling layer for block devices (JBD2);\n  - Network file system (NFS) client;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - SMB network file system;\n  - BPF subsystem;\n  - Ethernet bridge;\n  - io_uring subsystem;\n  - Locking primitives;\n  - Scheduler infrastructure;\n  - Shadow Call Stack mechanism;\n  - Tracing infrastructure;\n  - Memory management;\n  - CAIF protocol;\n  - Ceph Core library;\n  - Networking core;\n  - Ethtool driver;\n  - Handshake API;\n  - HSR network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NET/ROM layer;\n  - NFC subsystem;\n  - Open vSwitch;\n  - Rose network layer;\n  - Network traffic control;\n  - Network sockets;\n  - Sun RPC protocol;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Key management;\n  - Simplified Mandatory Access Control Kernel framework;\n  - FireWire sound drivers;\n  - HD-audio driver;\n  - Turtle Beach Wavefront ALSA driver;\n  - STMicroelectronics SoC drivers;\n  - USB sound devices;\n  - KVM subsystem;\n(CVE-2024-57795, CVE-2025-22022, CVE-2025-22111, CVE-2025-38022,\nCVE-2025-38234, CVE-2025-40164, CVE-2025-40325, CVE-2025-68206,\nCVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257,\nCVE-2025-68258, CVE-2025-68259, CVE-2025-68261, CVE-2025-68263,\nCVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291,\nCVE-2025-68325, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336,\nCVE-2025-68337, CVE-2025-68344, CVE-2025-68345, CVE-2025-68346,\nCVE-2025-68347, CVE-2025-68349, CVE-2025-68354, CVE-2025-68362,\nCVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367,\nCVE-2025-68369, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374,\nCVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724,\nCVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733,\nCVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68744,\nCVE-2025-68746, CVE-2025-68753, CVE-2025-68755, CVE-2025-68756,\nCVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68763,\nCVE-2025-68764, CVE-2025-68765, CVE-2025-68766, CVE-2025-68767,\nCVE-2025-68769, CVE-2025-68770, CVE-2025-68771, CVE-2025-68772,\nCVE-2025-68773, CVE-2025-68774, CVE-2025-68775, CVE-2025-68776,\nCVE-2025-68777, CVE-2025-68778, CVE-2025-68780, CVE-2025-68782,\nCVE-2025-68783, CVE-2025-68785, CVE-2025-68786, CVE-2025-68787,\nCVE-2025-68788, CVE-2025-68794, CVE-2025-68795, CVE-2025-68796,\nCVE-2025-68797, CVE-2025-68798, CVE-2025-68799, CVE-2025-68800,\nCVE-2025-68801, CVE-2025-68804, CVE-2025-68806, CVE-2025-68808,\nCVE-2025-68809, CVE-2025-68810, CVE-2025-68811, CVE-2025-68813,\nCVE-2025-68814, CVE-2025-68815, CVE-2025-68816, CVE-2025-68817,\nCVE-2025-68818, CVE-2025-68819, CVE-2025-68820, CVE-2025-68821,\nCVE-2025-71064, CVE-2025-71065, CVE-2025-71066, CVE-2025-71067,\nCVE-2025-71068, CVE-2025-71069, CVE-2025-71071, CVE-2025-71072,\nCVE-2025-71075, CVE-2025-71077, CVE-2025-71078, CVE-2025-71079,\nCVE-2025-71081, CVE-2025-71082, CVE-2025-71083, CVE-2025-71084,\nCVE-2025-71085, CVE-2025-71086, CVE-2025-71087, CVE-2025-71088,\nCVE-2025-71089, CVE-2025-71091, CVE-2025-71093, CVE-2025-71094,\nCVE-2025-71095, CVE-2025-71096, CVE-2025-71097, CVE-2025-71098,\nCVE-2025-71101, CVE-2025-71102, CVE-2025-71104, CVE-2025-71105,\nCVE-2025-71107, CVE-2025-71108, CVE-2025-71109, CVE-2025-71111,\nCVE-2025-71112, CVE-2025-71113, CVE-2025-71114, CVE-2025-71116,\nCVE-2025-71118, CVE-2025-71119, CVE-2025-71120, CVE-2025-71121,\nCVE-2025-71122, CVE-2025-71123, CVE-2025-71125, CVE-2025-71126,\nCVE-2025-71127, CVE-2025-71130, CVE-2025-71131, CVE-2025-71132,\nCVE-2025-71133, CVE-2025-71135, CVE-2025-71136, CVE-2025-71137,\nCVE-2025-71138, CVE-2025-71140, CVE-2025-71141, CVE-2025-71143,\nCVE-2025-71144, CVE-2025-71147, CVE-2025-71148, CVE-2025-71150,\nCVE-2025-71151, CVE-2025-71153, CVE-2025-71154, CVE-2026-23112,\nCVE-2026-23209, CVE-2026-23231)\n","status":"published","published":"2026-05-07T15:27:52Z","modified":"2026-11-04T20:01:44.192195069Z","updated_at":"2026-11-04T20:16:32.566315Z"},{"id":"USN-8261-1","title":"linux-xilinx vulnerabilities","description":"Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo\nRizzo discovered that some AMD Zen processors did not properly verify the\nsignature of CPU microcode. This flaw is known as EntrySign. A privileged\nattacker could possibly use this issue to cause load malicious CPU\nmicrocode causing loss of integrity and confidentiality. (CVE-2024-36347)\n\nQualys discovered that several vulnerabilities existed in the AppArmor\nLinux kernel Security Module (LSM). An unprivileged local attacker could\nuse these issues to load, replace, and remove arbitrary AppArmor profiles\ncausing denial of service, exposure of sensitive information (kernel\nmemory), local privilege escalation, or possibly escape a container.\n(LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403,\nCVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407,\nCVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - MIPS architecture;\n  - Nios II architecture;\n  - PA-RISC architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - Sun Sparc architecture;\n  - User-Mode Linux (UML);\n  - x86 architecture;\n  - Xtensa architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - ATM drivers;\n  - Drivers core;\n  - Block device driver;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Character device driver;\n  - Hardware random number generator core;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - DMA engine subsystem;\n  - ARM SCMI message protocol;\n  - EFI core;\n  - Intel Stratix 10 firmware drivers;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - CoreSight HW tracing drivers;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - Input Device (Tablet) drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - ISDN/mISDN subsystem;\n  - Macintosh device drivers;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - Fastrpc Driver;\n  - MOST (Media Oriented Systems Transport) drivers;\n  - MTD block device drivers;\n  - Ethernet bonding driver;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - Texas Instruments network drivers;\n  - Ethernet team driver;\n  - MediaTek network drivers;\n  - NVME drivers;\n  - PA-RISC drivers;\n  - PCI subsystem;\n  - PCCARD (PCMCIA/CardBus) bus subsystem;\n  - Performance monitor drivers;\n  - Pin controllers subsystem;\n  - Chrome hardware platform drivers;\n  - x86 platform drivers;\n  - ARM PM domains;\n  - PPS (Pulse Per Second) driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - Voltage and Current Regulator drivers;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - Texas Instruments SoC drivers;\n  - SPI subsystem;\n  - Media Oriented Systems Transport (MOST) driver;\n  - Realtek RTL8723BS SDIO drivers;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - TTY drivers;\n  - Userspace I/O drivers;\n  - Cadence USB3 driver;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Renesas USBHS Controller drivers;\n  - USB Mass Storage drivers;\n  - USB Type-C Connector System Software Interface driver;\n  - Virtio Host (VHOST) subsystem;\n  - Backlight driver;\n  - Framebuffer layer;\n  - Watchdog drivers;\n  - Xen hypervisor drivers;\n  - AFS file system;\n  - BFS file system;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - File systems infrastructure;\n  - EFI Variable file system;\n  - exFAT file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - GFS2 file system;\n  - HFS file system;\n  - HFS+ file system;\n  - HugeTLB file system;\n  - Journaling layer for block devices (JBD2);\n  - JFS file system;\n  - KERNFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - OrangeFS file system;\n  - Proc file system;\n  - Diskquota system;\n  - SMB network file system;\n  - SquashFS file system;\n  - UDF file system;\n  - XFS file system;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - BPF subsystem;\n  - Ethernet bridge;\n  - Mellanox drivers;\n  - NFS page cache wrapper;\n  - Memory management;\n  - Memory Management;\n  - Media input infrastructure;\n  - Bluetooth subsystem;\n  - IP tunnels definitions;\n  - Network traffic control;\n  - Rose network layer;\n  - Network sockets;\n  - io_uring subsystem;\n  - Control group (cgroup);\n  - Kernel crash support code;\n  - Kernel futex primitives;\n  - Locking primitives;\n  - PID allocator;\n  - Scheduler infrastructure;\n  - Shadow Call Stack mechanism;\n  - Syscalls implementation;\n  - Timer subsystem;\n  - Tracing infrastructure;\n  - 9P file system network protocol;\n  - Amateur Radio drivers;\n  - B.A.T.M.A.N. meshing protocol;\n  - CAIF protocol;\n  - Ceph Core library;\n  - Networking core;\n  - Devlink API;\n  - Ethtool driver;\n  - Handshake API;\n  - HSR network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NET/ROM layer;\n  - NFC subsystem;\n  - Open vSwitch;\n  - RF switch subsystem;\n  - SCTP protocol;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Key management;\n  - Simplified Mandatory Access Control Kernel framework;\n  - FireWire sound drivers;\n  - HD-audio driver;\n  - Turtle Beach Wavefront ALSA driver;\n  - Intel ASoC drivers;\n  - QCOM ASoC drivers;\n  - STMicroelectronics SoC drivers;\n  - USB sound devices;\n  - KVM subsystem;\n(CVE-2024-57795, CVE-2025-21833, CVE-2025-22022, CVE-2025-22103,\nCVE-2025-22105, CVE-2025-22106, CVE-2025-22107, CVE-2025-22111,\nCVE-2025-22113, CVE-2025-22121, CVE-2025-22124, CVE-2025-22125,\nCVE-2025-23129, CVE-2025-23130, CVE-2025-23133, CVE-2025-23143,\nCVE-2025-37860, CVE-2025-38022, CVE-2025-38105, CVE-2025-38234,\nCVE-2025-38502, CVE-2025-38556, CVE-2025-38627, CVE-2025-38643,\nCVE-2025-38709, CVE-2025-39678, CVE-2025-39697, CVE-2025-39805,\nCVE-2025-39806, CVE-2025-39807, CVE-2025-39808, CVE-2025-39810,\nCVE-2025-39811, CVE-2025-39812, CVE-2025-39813, CVE-2025-39815,\nCVE-2025-39817, CVE-2025-39819, CVE-2025-39823, CVE-2025-39824,\nCVE-2025-39825, CVE-2025-39826, CVE-2025-39827, CVE-2025-39828,\nCVE-2025-39829, CVE-2025-39832, CVE-2025-39835, CVE-2025-39836,\nCVE-2025-39838, CVE-2025-39839, CVE-2025-39841, CVE-2025-39842,\nCVE-2025-39843, CVE-2025-39844, CVE-2025-39845, CVE-2025-39846,\nCVE-2025-39847, CVE-2025-39848, CVE-2025-39849, CVE-2025-39850,\nCVE-2025-39851, CVE-2025-39852, CVE-2025-39853, CVE-2025-39854,\nCVE-2025-39857, CVE-2025-39860, CVE-2025-39861, CVE-2025-39863,\nCVE-2025-39864, CVE-2025-39865, CVE-2025-39866, CVE-2025-39869,\nCVE-2025-39870, CVE-2025-39871, CVE-2025-39873, CVE-2025-39876,\nCVE-2025-39877, CVE-2025-39880, CVE-2025-39881, CVE-2025-39883,\nCVE-2025-39885, CVE-2025-39886, CVE-2025-39891, CVE-2025-39894,\nCVE-2025-39895, CVE-2025-39899, CVE-2025-39901, CVE-2025-39902,\nCVE-2025-39907, CVE-2025-39909, CVE-2025-39911, CVE-2025-39913,\nCVE-2025-39914, CVE-2025-39916, CVE-2025-39920, CVE-2025-39923,\nCVE-2025-39927, CVE-2025-39929, CVE-2025-39931, CVE-2025-39932,\nCVE-2025-39934, CVE-2025-39937, CVE-2025-39938, CVE-2025-39940,\nCVE-2025-39942, CVE-2025-39943, CVE-2025-39944, CVE-2025-39945,\nCVE-2025-39947, CVE-2025-39948, CVE-2025-39949, CVE-2025-39950,\nCVE-2025-39951, CVE-2025-39952, CVE-2025-39953, CVE-2025-39955,\nCVE-2025-39957, CVE-2025-39961, CVE-2025-39965, CVE-2025-39967,\nCVE-2025-39968, CVE-2025-39969, CVE-2025-39970, CVE-2025-39971,\nCVE-2025-39972, CVE-2025-39973, CVE-2025-39977, CVE-2025-39978,\nCVE-2025-39980, CVE-2025-39981, CVE-2025-39982, CVE-2025-39985,\nCVE-2025-39986, CVE-2025-39987, CVE-2025-39988, CVE-2025-39991,\nCVE-2025-39992, CVE-2025-39994, CVE-2025-39995, CVE-2025-39996,\nCVE-2025-39998, CVE-2025-40000, CVE-2025-40001, CVE-2025-40006,\nCVE-2025-40008, CVE-2025-40009, CVE-2025-40010, CVE-2025-40011,\nCVE-2025-40013, CVE-2025-40016, CVE-2025-40020, CVE-2025-40021,\nCVE-2025-40024, CVE-2025-40026, CVE-2025-40027, CVE-2025-40029,\nCVE-2025-40030, CVE-2025-40031, CVE-2025-40032, CVE-2025-40033,\nCVE-2025-40035, CVE-2025-40036, CVE-2025-40037, CVE-2025-40038,\nCVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40047,\nCVE-2025-40048, CVE-2025-40049, CVE-2025-40051, CVE-2025-40052,\nCVE-2025-40053, CVE-2025-40055, CVE-2025-40056, CVE-2025-40057,\nCVE-2025-40058, CVE-2025-40059, CVE-2025-40060, CVE-2025-40061,\nCVE-2025-40062, CVE-2025-40067, CVE-2025-40068, CVE-2025-40070,\nCVE-2025-40071, CVE-2025-40077, CVE-2025-40078, CVE-2025-40079,\nCVE-2025-40080, CVE-2025-40081, CVE-2025-40083, CVE-2025-40084,\nCVE-2025-40085, CVE-2025-40087, CVE-2025-40088, CVE-2025-40092,\nCVE-2025-40093, CVE-2025-40094, CVE-2025-40095, CVE-2025-40096,\nCVE-2025-40099, CVE-2025-40100, CVE-2025-40101, CVE-2025-40103,\nCVE-2025-40104, CVE-2025-40105, CVE-2025-40106, CVE-2025-40107,\nCVE-2025-40109, CVE-2025-40110, CVE-2025-40111, CVE-2025-40112,\nCVE-2025-40115, CVE-2025-40116, CVE-2025-40118, CVE-2025-40120,\nCVE-2025-40121, CVE-2025-40123, CVE-2025-40124, CVE-2025-40125,\nCVE-2025-40126, CVE-2025-40127, CVE-2025-40129, CVE-2025-40134,\nCVE-2025-40137, CVE-2025-40140, CVE-2025-40141, CVE-2025-40153,\nCVE-2025-40154, CVE-2025-40155, CVE-2025-40156, CVE-2025-40159,\nCVE-2025-40160, CVE-2025-40164, CVE-2025-40165, CVE-2025-40166,\nCVE-2025-40167, CVE-2025-40169, CVE-2025-40171, CVE-2025-40172,\nCVE-2025-40173, CVE-2025-40176, CVE-2025-40178, CVE-2025-40179,\nCVE-2025-40180, CVE-2025-40183, CVE-2025-40187, CVE-2025-40188,\nCVE-2025-40192, CVE-2025-40193, CVE-2025-40194, CVE-2025-40196,\nCVE-2025-40198, CVE-2025-40200, CVE-2025-40201, CVE-2025-40202,\nCVE-2025-40204, CVE-2025-40205, CVE-2025-40206, CVE-2025-40207,\nCVE-2025-40211, CVE-2025-40218, CVE-2025-40219, CVE-2025-40220,\nCVE-2025-40221, CVE-2025-40223, CVE-2025-40226, CVE-2025-40231,\nCVE-2025-40233, CVE-2025-40235, CVE-2025-40237, CVE-2025-40238,\nCVE-2025-40240, CVE-2025-40242, CVE-2025-40243, CVE-2025-40244,\nCVE-2025-40245, CVE-2025-40248, CVE-2025-40250, CVE-2025-40251,\nCVE-2025-40252, CVE-2025-40253, CVE-2025-40254, CVE-2025-40257,\nCVE-2025-40258, CVE-2025-40259, CVE-2025-40261, CVE-2025-40262,\nCVE-2025-40263, CVE-2025-40264, CVE-2025-40266, CVE-2025-40268,\nCVE-2025-40269, CVE-2025-40271, CVE-2025-40272, CVE-2025-40273,\nCVE-2025-40275, CVE-2025-40277, CVE-2025-40278, CVE-2025-40279,\nCVE-2025-40280, CVE-2025-40281, CVE-2025-40282, CVE-2025-40283,\nCVE-2025-40284, CVE-2025-40285, CVE-2025-40286, CVE-2025-40287,\nCVE-2025-40288, CVE-2025-40289, CVE-2025-40292, CVE-2025-40293,\nCVE-2025-40294, CVE-2025-40301, CVE-2025-40303, CVE-2025-40304,\nCVE-2025-40305, CVE-2025-40306, CVE-2025-40307, CVE-2025-40308,\nCVE-2025-40309, CVE-2025-40310, CVE-2025-40311, CVE-2025-40312,\nCVE-2025-40313, CVE-2025-40314, CVE-2025-40315, CVE-2025-40317,\nCVE-2025-40318, CVE-2025-40319, CVE-2025-40320, CVE-2025-40321,\nCVE-2025-40322, CVE-2025-40323, CVE-2025-40324, CVE-2025-40325,\nCVE-2025-40328, CVE-2025-40329, CVE-2025-40331, CVE-2025-40333,\nCVE-2025-40337, CVE-2025-40339, CVE-2025-40341, CVE-2025-40342,\nCVE-2025-40343, CVE-2025-40345, CVE-2025-40346, CVE-2025-40347,\nCVE-2025-40349, CVE-2025-40350, CVE-2025-40351, CVE-2025-40353,\nCVE-2025-40358, CVE-2025-40360, CVE-2025-40363, CVE-2025-68168,\nCVE-2025-68171, CVE-2025-68172, CVE-2025-68173, CVE-2025-68176,\nCVE-2025-68177, CVE-2025-68178, CVE-2025-68179, CVE-2025-68180,\nCVE-2025-68183, CVE-2025-68184, CVE-2025-68185, CVE-2025-68190,\nCVE-2025-68191, CVE-2025-68192, CVE-2025-68194, CVE-2025-68198,\nCVE-2025-68200, CVE-2025-68201, CVE-2025-68204, CVE-2025-68206,\nCVE-2025-68208, CVE-2025-68213, CVE-2025-68214, CVE-2025-68217,\nCVE-2025-68218, CVE-2025-68219, CVE-2025-68220, CVE-2025-68222,\nCVE-2025-68223, CVE-2025-68227, CVE-2025-68229, CVE-2025-68231,\nCVE-2025-68233, CVE-2025-68235, CVE-2025-68237, CVE-2025-68238,\nCVE-2025-68241, CVE-2025-68244, CVE-2025-68245, CVE-2025-68246,\nCVE-2025-68249, CVE-2025-68254, CVE-2025-68255, CVE-2025-68256,\nCVE-2025-68257, CVE-2025-68258, CVE-2025-68259, CVE-2025-68261,\nCVE-2025-68263, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266,\nCVE-2025-68282, CVE-2025-68283, CVE-2025-68284, CVE-2025-68285,\nCVE-2025-68286, CVE-2025-68287, CVE-2025-68288, CVE-2025-68289,\nCVE-2025-68290, CVE-2025-68295, CVE-2025-68297, CVE-2025-68301,\nCVE-2025-68302, CVE-2025-68303, CVE-2025-68305, CVE-2025-68307,\nCVE-2025-68308, CVE-2025-68310, CVE-2025-68311, CVE-2025-68312,\nCVE-2025-68313, CVE-2025-68315, CVE-2025-68320, CVE-2025-68321,\nCVE-2025-68322, CVE-2025-68325, CVE-2025-68327, CVE-2025-68328,\nCVE-2025-68330, CVE-2025-68331, CVE-2025-68332, CVE-2025-68335,\nCVE-2025-68336, CVE-2025-68337, CVE-2025-68339, CVE-2025-68340,\nCVE-2025-68342, CVE-2025-68343, CVE-2025-68344, CVE-2025-68345,\nCVE-2025-68346, CVE-2025-68347, CVE-2025-68349, CVE-2025-68354,\nCVE-2025-68362, CVE-2025-68363, CVE-2025-68364, CVE-2025-68366,\nCVE-2025-68367, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374,\nCVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724,\nCVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733,\nCVE-2025-68734, CVE-2025-68740, CVE-2025-68741, CVE-2025-68742,\nCVE-2025-68744, CVE-2025-68746, CVE-2025-68753, CVE-2025-68755,\nCVE-2025-68756, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759,\nCVE-2025-68763, CVE-2025-68764, CVE-2025-68765, CVE-2025-68766,\nCVE-2025-68767, CVE-2025-68769, CVE-2025-68770, CVE-2025-68771,\nCVE-2025-68772, CVE-2025-68773, CVE-2025-68774, CVE-2025-68775,\nCVE-2025-68776, CVE-2025-68777, CVE-2025-68778, CVE-2025-68780,\nCVE-2025-68782, CVE-2025-68783, CVE-2025-68785, CVE-2025-68786,\nCVE-2025-68787, CVE-2025-68788, CVE-2025-68794, CVE-2025-68795,\nCVE-2025-68796, CVE-2025-68797, CVE-2025-68798, CVE-2025-68799,\nCVE-2025-68800, CVE-2025-68801, CVE-2025-68804, CVE-2025-68806,\nCVE-2025-68808, CVE-2025-68809, CVE-2025-68810, CVE-2025-68811,\nCVE-2025-68813, CVE-2025-68814, CVE-2025-68815, CVE-2025-68816,\nCVE-2025-68817, CVE-2025-68818, CVE-2025-68819, CVE-2025-68820,\nCVE-2025-71064, CVE-2025-71065, CVE-2025-71066, CVE-2025-71067,\nCVE-2025-71068, CVE-2025-71069, CVE-2025-71071, CVE-2025-71072,\nCVE-2025-71075, CVE-2025-71077, CVE-2025-71078, CVE-2025-71079,\nCVE-2025-71081, CVE-2025-71082, CVE-2025-71083, CVE-2025-71084,\nCVE-2025-71085, CVE-2025-71086, CVE-2025-71087, CVE-2025-71088,\nCVE-2025-71089, CVE-2025-71091, CVE-2025-71093, CVE-2025-71094,\nCVE-2025-71095, CVE-2025-71096, CVE-2025-71097, CVE-2025-71098,\nCVE-2025-71101, CVE-2025-71102, CVE-2025-71104, CVE-2025-71105,\nCVE-2025-71107, CVE-2025-71108, CVE-2025-71109, CVE-2025-71111,\nCVE-2025-71112, CVE-2025-71113, CVE-2025-71114, CVE-2025-71116,\nCVE-2025-71118, CVE-2025-71119, CVE-2025-71120, CVE-2025-71121,\nCVE-2025-71122, CVE-2025-71125, CVE-2025-71126, CVE-2025-71127,\nCVE-2025-71130, CVE-2025-71131, CVE-2025-71132, CVE-2025-71133,\nCVE-2025-71135, CVE-2025-71136, CVE-2025-71137, CVE-2025-71138,\nCVE-2025-71140, CVE-2025-71141, CVE-2025-71143, CVE-2025-71147,\nCVE-2025-71148, CVE-2025-71150, CVE-2025-71151, CVE-2025-71153,\nCVE-2025-71154, CVE-2026-23060, CVE-2026-23074, CVE-2026-23111,\nCVE-2026-23112, CVE-2026-23209, CVE-2026-23231, CVE-2026-23273)\n","status":"published","published":"2026-05-07T15:54:20Z","modified":"2026-09-07T14:05:25.637433365Z","updated_at":"2026-11-02T16:58:22.951676Z"},{"id":"USN-8265-1","title":"linux-nvidia-tegra vulnerabilities","description":"Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo\nRizzo discovered that some AMD Zen processors did not properly verify the\nsignature of CPU microcode. This flaw is known as EntrySign. A privileged\nattacker could possibly use this issue to cause load malicious CPU\nmicrocode causing loss of integrity and confidentiality. (CVE-2024-36347)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - MIPS architecture;\n  - PowerPC architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - ACPI drivers;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - Hardware crypto device drivers;\n  - GPU drivers;\n  - Hardware monitoring drivers;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - Macintosh device drivers;\n  - Multiple devices driver;\n  - Media drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - Ethernet team driver;\n  - MediaTek network drivers;\n  - NVME drivers;\n  - PA-RISC drivers;\n  - Chrome hardware platform drivers;\n  - x86 platform drivers;\n  - Voltage and Current Regulator drivers;\n  - SCSI subsystem;\n  - SPI subsystem;\n  - Media Oriented Systems Transport (MOST) driver;\n  - Realtek RTL8723BS SDIO drivers;\n  - TCM subsystem;\n  - USB Host Controller drivers;\n  - USB Type-C Connector System Software Interface driver;\n  - Backlight driver;\n  - Watchdog drivers;\n  - BFS file system;\n  - BTRFS file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - HFS+ file system;\n  - File systems infrastructure;\n  - Journaling layer for block devices (JBD2);\n  - Network file system (NFS) client;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - SMB network file system;\n  - BPF subsystem;\n  - Ethernet bridge;\n  - io_uring subsystem;\n  - Locking primitives;\n  - Scheduler infrastructure;\n  - Shadow Call Stack mechanism;\n  - Tracing infrastructure;\n  - Memory management;\n  - CAIF protocol;\n  - Ceph Core library;\n  - Networking core;\n  - Ethtool driver;\n  - Handshake API;\n  - HSR network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NET/ROM layer;\n  - NFC subsystem;\n  - Open vSwitch;\n  - Rose network layer;\n  - Network traffic control;\n  - Network sockets;\n  - Sun RPC protocol;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Key management;\n  - Simplified Mandatory Access Control Kernel framework;\n  - FireWire sound drivers;\n  - HD-audio driver;\n  - Turtle Beach Wavefront ALSA driver;\n  - STMicroelectronics SoC drivers;\n  - USB sound devices;\n  - KVM subsystem;\n(CVE-2024-57795, CVE-2025-22022, CVE-2025-22111, CVE-2025-38022,\nCVE-2025-38234, CVE-2025-40164, CVE-2025-40325, CVE-2025-68206,\nCVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257,\nCVE-2025-68258, CVE-2025-68259, CVE-2025-68261, CVE-2025-68263,\nCVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291,\nCVE-2025-68325, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336,\nCVE-2025-68337, CVE-2025-68344, CVE-2025-68345, CVE-2025-68346,\nCVE-2025-68347, CVE-2025-68349, CVE-2025-68354, CVE-2025-68362,\nCVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367,\nCVE-2025-68369, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374,\nCVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724,\nCVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733,\nCVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68744,\nCVE-2025-68753, CVE-2025-68755, CVE-2025-68756, CVE-2025-68757,\nCVE-2025-68758, CVE-2025-68759, CVE-2025-68763, CVE-2025-68764,\nCVE-2025-68765, CVE-2025-68766, CVE-2025-68767, CVE-2025-68769,\nCVE-2025-68770, CVE-2025-68771, CVE-2025-68772, CVE-2025-68773,\nCVE-2025-68774, CVE-2025-68775, CVE-2025-68776, CVE-2025-68777,\nCVE-2025-68778, CVE-2025-68780, CVE-2025-68782, CVE-2025-68783,\nCVE-2025-68785, CVE-2025-68786, CVE-2025-68787, CVE-2025-68788,\nCVE-2025-68794, CVE-2025-68795, CVE-2025-68796, CVE-2025-68797,\nCVE-2025-68798, CVE-2025-68799, CVE-2025-68800, CVE-2025-68801,\nCVE-2025-68804, CVE-2025-68806, CVE-2025-68808, CVE-2025-68809,\nCVE-2025-68810, CVE-2025-68811, CVE-2025-68813, CVE-2025-68814,\nCVE-2025-68815, CVE-2025-68816, CVE-2025-68817, CVE-2025-68818,\nCVE-2025-68819, CVE-2025-68820, CVE-2025-68821, CVE-2025-71064,\nCVE-2025-71065, CVE-2025-71066, CVE-2025-71067, CVE-2025-71068,\nCVE-2025-71069, CVE-2025-71071, CVE-2025-71072, CVE-2025-71075,\nCVE-2025-71077, CVE-2025-71078, CVE-2025-71079, CVE-2025-71080,\nCVE-2025-71081, CVE-2025-71082, CVE-2025-71083, CVE-2025-71084,\nCVE-2025-71085, CVE-2025-71086, CVE-2025-71087, CVE-2025-71088,\nCVE-2025-71089, CVE-2025-71091, CVE-2025-71093, CVE-2025-71094,\nCVE-2025-71095, CVE-2025-71096, CVE-2025-71097, CVE-2025-71098,\nCVE-2025-71101, CVE-2025-71102, CVE-2025-71104, CVE-2025-71105,\nCVE-2025-71107, CVE-2025-71108, CVE-2025-71109, CVE-2025-71111,\nCVE-2025-71112, CVE-2025-71113, CVE-2025-71114, CVE-2025-71116,\nCVE-2025-71118, CVE-2025-71119, CVE-2025-71120, CVE-2025-71121,\nCVE-2025-71122, CVE-2025-71123, CVE-2025-71125, CVE-2025-71126,\nCVE-2025-71127, CVE-2025-71130, CVE-2025-71131, CVE-2025-71132,\nCVE-2025-71133, CVE-2025-71135, CVE-2025-71136, CVE-2025-71137,\nCVE-2025-71138, CVE-2025-71140, CVE-2025-71141, CVE-2025-71143,\nCVE-2025-71144, CVE-2025-71147, CVE-2025-71148, CVE-2025-71150,\nCVE-2025-71151, CVE-2025-71153, CVE-2025-71154, CVE-2026-23209)\n","status":"published","published":"2026-05-11T12:47:33Z","modified":"2026-11-04T20:01:45.20291432Z","updated_at":"2026-11-04T20:16:32.566315Z"},{"id":"USN-8440-1","title":"linux-azure-6.8 vulnerabilities","description":"Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo\nRizzo discovered that some AMD Zen processors did not properly verify the\nsignature of CPU microcode. This flaw is known as EntrySign. A privileged\nattacker could possibly use this issue to cause load malicious CPU\nmicrocode causing loss of integrity and confidentiality. (CVE-2024-36347)\n\nIt was discovered that the Linux kernel algif_aead module did not properly\nhandle in-place cryptographic operations. This flaw is known as Copy Fail.\nA local attacker could use this to escalate privileges, or possibly escape\na container. (CVE-2026-31431)\n\nIt was discovered that the Linux kernel did not properly handle shared page\nfragments during socket buffer operations, collectively known as Dirty\nFrag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the\nRxRPC networking subsystem when processing paged fragments. A local\nattacker could use this to escalate privileges, or possibly escape a\ncontainer. (CVE-2026-43284, CVE-2026-43500, CVE-2026-45998, CVE-2026-46000)\n\nIt was discovered that a logic flaw existed in the XFRM ESP-in-TCP\nsubsystem in the Linux kernel when handling socket buffer fragments. This\nflaw is known as Fragnesia. A local attacker could use this to escalate\nprivileges, or possibly escape a container. (CVE-2026-43503,\nCVE-2026-46300)\n\nQualys discovered that a race condition existed in the ptrace subsystem of\nthe Linux kernel when privileged processes are exiting. An unprivileged\nlocal attacker could use this issue to expose sensitive information.\n(CVE-2026-46333)\n\nTristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0\ncontain a memory leak when handling AppArmor notifications. A local\nattacker could use this to cause resource exhaustion. (CVE-2026-47326)\n\nTristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0\ncontain a NULL pointer dereference when handling AppArmor notifications. A\nlocal attacker could use this to cause a kernel oops. (CVE-2026-47327)\n\nTristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0\ncontained an invalid free when handling AppArmor notifications. A local\nattacker could use this to corrupt kernel memory. (CVE-2026-47328)\n\nTristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0\ncontained insufficient validation of AppArmor notification responses. A\nlocal attacker could use this to allow crafted responses to be processed.\n(CVE-2026-47329)\n\nTristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 used\nan uninitialized variable when handling AppArmor notifications. A local\nattacker could use this to cause incorrect caching of data.\n(CVE-2026-47330)\n\nTristan Madani discovered that Ubuntu Linux kernel 6.8 contained a use-\nafter-free (UAF) bug. A local attacker could use this to cause memory\ncorruption and, theoretically, arbitrary code execution. (CVE-2026-47331)\n\nTristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0\ncontained an out-of-bounds (OOB) read when handling AppArmor notifications.\nA local attacker could use this to cause information disclosure of kernel\nmemory. (CVE-2026-47332)\n\nTristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0\ncontained a out-of-bounds (OOB) read when handling AppArmor notifications.\nA local attacker could use this to cause kernel memory corruption and,\ntheoretically, influence processing of AppArmor policies. (CVE-2026-47333)\n\nTristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0\ncontained incorrect holding of locks when handling AppArmor notifications.\nA local attacker could use this to cause a kernel panic or deadlock.\n(CVE-2026-47334)\n\nTristan Madani discovered that Ubuntu Linux kernel 6.8 contained a NULL\npointer dereference when handling AppArmor notifications. A local attacker\ncould use this to cause a kernel panic. (CVE-2026-47335)\n\nTristan Madani discovered that Ubuntu Linux kernel 6.8 used an\nuninitialized variable when handling AppArmor AF_INET/AF_INET6 socket\nmediation. A local attacker could use this to influence processing of fine-\ngrained network socket mediation. (CVE-2026-47336)\n\nTristan Madani and Trevor Lawrence have each independently discovered that\nUbuntu Linux kernel 6.8, 6.17 and 7.0 contained a NULL pointer dereference\nwhen handling AppArmor network socket mediation. A local attacker could use\nthis to cause a kernel oops. (CVE-2026-47337)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - MIPS architecture;\n  - PowerPC architecture;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Drivers core;\n  - Network block device driver;\n  - Null block device driver;\n  - Ublk userspace block driver;\n  - Bluetooth drivers;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - Counter interface drivers;\n  - Hardware crypto device drivers;\n  - DMA engine subsystem;\n  - DPLL subsystem;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - Intel Trace Hub HW tracing drivers;\n  - IIO ADC drivers;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - On-Chip Interconnect management framework;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - Modular ISDN driver;\n  - LED subsystem;\n  - Macintosh device drivers;\n  - Multiple devices driver;\n  - Media drivers;\n  - UACCE accelerator framework;\n  - MMC subsystem;\n  - Ethernet bonding driver;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - Ethernet team driver;\n  - MediaTek network drivers;\n  - NVME drivers;\n  - PA-RISC drivers;\n  - PHY drivers;\n  - Chrome hardware platform drivers;\n  - x86 platform drivers;\n  - i.MX PM domains;\n  - Voltage and Current Regulator drivers;\n  - SCSI subsystem;\n  - SLIMbus drivers;\n  - SPI subsystem;\n  - Media Oriented Systems Transport (MOST) driver;\n  - Realtek RTL8723BS SDIO drivers;\n  - TCM subsystem;\n  - USB Host Controller drivers;\n  - USB Type-C Connector System Software Interface driver;\n  - Backlight driver;\n  - W1 Dallas's 1-wire bus driver;\n  - Watchdog drivers;\n  - Xen hypervisor drivers;\n  - BFS file system;\n  - BTRFS file system;\n  - EFI Variable file system;\n  - exFAT file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - HFS+ file system;\n  - File systems infrastructure;\n  - Journaling layer for block devices (JBD2);\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - SMB network file system;\n  - BPF subsystem;\n  - Ethernet bridge;\n  - Scheduler infrastructure;\n  - Netfilter;\n  - NFC subsystem;\n  - Tracing infrastructure;\n  - io_uring subsystem;\n  - Perf events;\n  - Locking primitives;\n  - Shadow Call Stack mechanism;\n  - Floating proportions library;\n  - Memory management;\n  - Bluetooth subsystem;\n  - CAIF protocol;\n  - CAN network layer;\n  - Ceph Core library;\n  - Networking core;\n  - Ethtool driver;\n  - Handshake API;\n  - HSR network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - L2TP protocol;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - NET/ROM layer;\n  - Open vSwitch;\n  - Packet sockets;\n  - RDS protocol;\n  - Rose network layer;\n  - RxRPC session sockets;\n  - Network traffic control;\n  - SCTP protocol;\n  - Network sockets;\n  - Sun RPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Key management;\n  - Simplified Mandatory Access Control Kernel framework;\n  - ALSA AC97 driver;\n  - Generic PCM loopback sound driver;\n  - FireWire sound drivers;\n  - HD-audio driver;\n  - Turtle Beach Wavefront ALSA driver;\n  - Creative Sound Blaster X-Fi driver;\n  - AMD SoC Alsa drivers;\n  - Texas InstrumentS Audio (ASoC/HDA) drivers;\n  - STMicroelectronics SoC drivers;\n  - USB sound devices;\n  - KVM subsystem;\n(CVE-2024-50004, CVE-2024-57795, CVE-2024-58096, CVE-2024-58097,\nCVE-2025-22022, CVE-2025-22111, CVE-2025-37926, CVE-2025-38022,\nCVE-2025-38201, CVE-2025-38234, CVE-2025-38591, CVE-2025-40039,\nCVE-2025-40082, CVE-2025-40149, CVE-2025-40164, CVE-2025-40325,\nCVE-2025-68206, CVE-2025-68254, CVE-2025-68255, CVE-2025-68256,\nCVE-2025-68257, CVE-2025-68258, CVE-2025-68259, CVE-2025-68261,\nCVE-2025-68263, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266,\nCVE-2025-68291, CVE-2025-68325, CVE-2025-68332, CVE-2025-68335,\nCVE-2025-68336, CVE-2025-68337, CVE-2025-68344, CVE-2025-68345,\nCVE-2025-68346, CVE-2025-68347, CVE-2025-68349, CVE-2025-68351,\nCVE-2025-68354, CVE-2025-68358, CVE-2025-68362, CVE-2025-68363,\nCVE-2025-68364, CVE-2025-68365, CVE-2025-68366, CVE-2025-68367,\nCVE-2025-68369, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374,\nCVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724,\nCVE-2025-68725, CVE-2025-68727, CVE-2025-68728, CVE-2025-68732,\nCVE-2025-68733, CVE-2025-68740, CVE-2025-68741, CVE-2025-68742,\nCVE-2025-68744, CVE-2025-68746, CVE-2025-68749, CVE-2025-68753,\nCVE-2025-68755, CVE-2025-68756, CVE-2025-68757, CVE-2025-68758,\nCVE-2025-68759, CVE-2025-68763, CVE-2025-68764, CVE-2025-68765,\nCVE-2025-68766, CVE-2025-68767, CVE-2025-68769, CVE-2025-68770,\nCVE-2025-68771, CVE-2025-68772, CVE-2025-68773, CVE-2025-68774,\nCVE-2025-68775, CVE-2025-68776, CVE-2025-68777, CVE-2025-68778,\nCVE-2025-68780, CVE-2025-68782, CVE-2025-68783, CVE-2025-68785,\nCVE-2025-68786, CVE-2025-68787, CVE-2025-68788, CVE-2025-68794,\nCVE-2025-68795, CVE-2025-68796, CVE-2025-68797, CVE-2025-68798,\nCVE-2025-68799, CVE-2025-68800, CVE-2025-68801, CVE-2025-68803,\nCVE-2025-68804, CVE-2025-68806, CVE-2025-68808, CVE-2025-68809,\nCVE-2025-68810, CVE-2025-68811, CVE-2025-68813, CVE-2025-68814,\nCVE-2025-68815, CVE-2025-68816, CVE-2025-68817, CVE-2025-68818,\nCVE-2025-68819, CVE-2025-68820, CVE-2025-68821, CVE-2025-68823,\nCVE-2025-71064, CVE-2025-71065, CVE-2025-71066, CVE-2025-71067,\nCVE-2025-71068, CVE-2025-71069, CVE-2025-71071, CVE-2025-71072,\nCVE-2025-71075, CVE-2025-71077, CVE-2025-71078, CVE-2025-71079,\nCVE-2025-71081, CVE-2025-71082, CVE-2025-71083, CVE-2025-71084,\nCVE-2025-71085, CVE-2025-71086, CVE-2025-71087, CVE-2025-71088,\nCVE-2025-71089, CVE-2025-71091, CVE-2025-71093, CVE-2025-71094,\nCVE-2025-71095, CVE-2025-71096, CVE-2025-71097, CVE-2025-71098,\nCVE-2025-71101, CVE-2025-71102, CVE-2025-71104, CVE-2025-71105,\nCVE-2025-71107, CVE-2025-71108, CVE-2025-71109, CVE-2025-71111,\nCVE-2025-71112, CVE-2025-71113, CVE-2025-71114, CVE-2025-71116,\nCVE-2025-71118, CVE-2025-71119, CVE-2025-71120, CVE-2025-71121,\nCVE-2025-71122, CVE-2025-71123, CVE-2025-71125, CVE-2025-71126,\nCVE-2025-71127, CVE-2025-71130, CVE-2025-71131, CVE-2025-71132,\nCVE-2025-71133, CVE-2025-71135, CVE-2025-71136, CVE-2025-71137,\nCVE-2025-71138, CVE-2025-71140, CVE-2025-71141, CVE-2025-71143,\nCVE-2025-71144, CVE-2025-71147, CVE-2025-71148, CVE-2025-71150,\nCVE-2025-71151, CVE-2025-71153, CVE-2025-71154, CVE-2025-71160,\nCVE-2025-71162, CVE-2025-71163, CVE-2025-71180, CVE-2025-71182,\nCVE-2025-71183, CVE-2025-71184, CVE-2025-71185, CVE-2025-71186,\nCVE-2025-71188, CVE-2025-71189, CVE-2025-71190, CVE-2025-71191,\nCVE-2025-71192, CVE-2025-71193, CVE-2025-71194, CVE-2025-71195,\nCVE-2025-71196, CVE-2025-71197, CVE-2025-71198, CVE-2025-71199,\nCVE-2025-71200, CVE-2025-71220, CVE-2025-71222, CVE-2025-71224,\nCVE-2025-71225, CVE-2025-71268, CVE-2026-22976, CVE-2026-22977,\nCVE-2026-22978, CVE-2026-22979, CVE-2026-22980, CVE-2026-22982,\nCVE-2026-22984, CVE-2026-22990, CVE-2026-22991, CVE-2026-22992,\nCVE-2026-22994, CVE-2026-22996, CVE-2026-22997, CVE-2026-22998,\nCVE-2026-22999, CVE-2026-23000, CVE-2026-23001, CVE-2026-23003,\nCVE-2026-23005, CVE-2026-23006, CVE-2026-23010, CVE-2026-23011,\nCVE-2026-23019, CVE-2026-23020, CVE-2026-23021, CVE-2026-23025,\nCVE-2026-23026, CVE-2026-23030, CVE-2026-23031, CVE-2026-23032,\nCVE-2026-23033, CVE-2026-23035, CVE-2026-23037, CVE-2026-23038,\nCVE-2026-23047, CVE-2026-23049, CVE-2026-23050, CVE-2026-23053,\nCVE-2026-23054, CVE-2026-23056, CVE-2026-23057, CVE-2026-23058,\nCVE-2026-23059, CVE-2026-23061, CVE-2026-23062, CVE-2026-23063,\nCVE-2026-23064, CVE-2026-23065, CVE-2026-23068, CVE-2026-23069,\nCVE-2026-23071, CVE-2026-23073, CVE-2026-23075, CVE-2026-23076,\nCVE-2026-23078, CVE-2026-23080, CVE-2026-23083, CVE-2026-23084,\nCVE-2026-23085, CVE-2026-23086, CVE-2026-23087, CVE-2026-23088,\nCVE-2026-23089, CVE-2026-23090, CVE-2026-23091, CVE-2026-23093,\nCVE-2026-23094, CVE-2026-23095, CVE-2026-23096, CVE-2026-23097,\nCVE-2026-23098, CVE-2026-23099, CVE-2026-23101, CVE-2026-23102,\nCVE-2026-23103, CVE-2026-23105, CVE-2026-23107, CVE-2026-23108,\nCVE-2026-23110, CVE-2026-23112, CVE-2026-23113, CVE-2026-23116,\nCVE-2026-23119, CVE-2026-23120, CVE-2026-23121, CVE-2026-23123,\nCVE-2026-23124, CVE-2026-23125, CVE-2026-23126, CVE-2026-23128,\nCVE-2026-23129, CVE-2026-23131, CVE-2026-23133, CVE-2026-23135,\nCVE-2026-23136, CVE-2026-23139, CVE-2026-23140, CVE-2026-23141,\nCVE-2026-23142, CVE-2026-23144, CVE-2026-23145, CVE-2026-23146,\nCVE-2026-23148, CVE-2026-23150, CVE-2026-23151, CVE-2026-23156,\nCVE-2026-23159, CVE-2026-23160, CVE-2026-23163, CVE-2026-23164,\nCVE-2026-23166, CVE-2026-23167, CVE-2026-23168, CVE-2026-23170,\nCVE-2026-23172, CVE-2026-23173, CVE-2026-23176, CVE-2026-23178,\nCVE-2026-23179, CVE-2026-23180, CVE-2026-23182, CVE-2026-23187,\nCVE-2026-23190, CVE-2026-23191, CVE-2026-23193, CVE-2026-23198,\nCVE-2026-23204, CVE-2026-23205, CVE-2026-23206, CVE-2026-23209,\nCVE-2026-23212, CVE-2026-23213, CVE-2026-23214, CVE-2026-23215,\nCVE-2026-23216, CVE-2026-23231, CVE-2026-23254, CVE-2026-23256,\nCVE-2026-23257, CVE-2026-23258, CVE-2026-23260, CVE-2026-23261,\nCVE-2026-23262, CVE-2026-23264, CVE-2026-23274, CVE-2026-23351,\nCVE-2026-23394, CVE-2026-31419, CVE-2026-31504, CVE-2026-31533,\nCVE-2026-31676, CVE-2026-43033, CVE-2026-43077, CVE-2026-43078,\nCVE-2026-43362, CVE-2026-43494, CVE-2026-46028, CVE-2026-46323)\n","status":"published","published":"2026-06-16T22:30:05Z","modified":"2026-11-07T01:45:16.546246471Z","updated_at":"2026-11-07T01:57:06.567161Z"}]}}