{"id":"CVE-2025-68310","aliases":["BELL-CVE-2025-68310","DEBIAN-CVE-2025-68310","DLA-4436-1","EUVD-2025-203759","GHSA-f5pp-8jv2-77ph","MGASA-2026-0017","MGASA-2026-0018","OESA-2026-1303","OESA-2026-1304","OESA-2026-1305","ROOT-OS-DEBIAN-12-CVE-2025-68310","ROOT-OS-UBUNTU-2204-CVE-2025-68310","ROOT-OS-UBUNTU-2404-CVE-2025-68310","SUSE-SU-2026:21834-1","SUSE-SU-2026:21841-1","SUSE-SU-2026:21845-1","SUSE-SU-2026:21860-1","SUSE-SU-2026:2217-1","SUSE-SU-2026:2238-1","UBUNTU-CVE-2025-68310","USN-8029-1","USN-8029-2","USN-8029-3","USN-8030-1","USN-8048-1","USN-8095-1","USN-8095-2","USN-8095-3","USN-8095-4","USN-8095-5","USN-8100-1","USN-8125-1","USN-8126-1","USN-8165-1","USN-8261-1","openSUSE-SU-2026:20826-1"],"status":"published","title":"s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump\n\nDo not block PCI config accesses through pci_cfg_access_lock() when\nexecuting the s390 variant of PCI error recovery: Acquire just\ndevice_lock() instead of pci_dev_lock() as powerpc's EEH and\ngenerig PCI AER processing do.\n\nDuring error recovery testing a pair of tasks was reported to be hung:\n\nmlx5_core 0000:00:00.1: mlx5_health_try_recover:338:(pid 5553): health recovery flow aborted, PCI reads still not working\nINFO: task kmcheck:72 blocked for more than 122 seconds.\n      Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1\n\"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\ntask:kmcheck         state:D stack:0     pid:72    tgid:72    ppid:2      flags:0x00000000\nCall Trace:\n [\u003c000000065256f030\u003e] __schedule+0x2a0/0x590\n [\u003c000000065256f356\u003e] schedule+0x36/0xe0\n [\u003c000000065256f572\u003e] schedule_preempt_disabled+0x22/0x30\n [\u003c0000000652570a94\u003e] __mutex_lock.constprop.0+0x484/0x8a8\n [\u003c000003ff800673a4\u003e] mlx5_unload_one+0x34/0x58 [mlx5_core]\n [\u003c000003ff8006745c\u003e] mlx5_pci_err_detected+0x94/0x140 [mlx5_core]\n [\u003c0000000652556c5a\u003e] zpci_event_attempt_error_recovery+0xf2/0x398\n [\u003c0000000651b9184a\u003e] __zpci_event_error+0x23a/0x2c0\nINFO: task kworker/u1664:6:1514 blocked for more than 122 seconds.\n      Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1\n\"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\ntask:kworker/u1664:6 state:D stack:0     pid:1514  tgid:1514  ppid:2      flags:0x00000000\nWorkqueue: mlx5_health0000:00:00.0 mlx5_fw_fatal_reporter_err_work [mlx5_core]\nCall Trace:\n [\u003c000000065256f030\u003e] __schedule+0x2a0/0x590\n [\u003c000000065256f356\u003e] schedule+0x36/0xe0\n [\u003c0000000652172e28\u003e] pci_wait_cfg+0x80/0xe8\n [\u003c0000000652172f94\u003e] pci_cfg_access_lock+0x74/0x88\n [\u003c000003ff800916b6\u003e] mlx5_vsc_gw_lock+0x36/0x178 [mlx5_core]\n [\u003c000003ff80098824\u003e] mlx5_crdump_collect+0x34/0x1c8 [mlx5_core]\n [\u003c000003ff80074b62\u003e] mlx5_fw_fatal_reporter_dump+0x6a/0xe8 [mlx5_core]\n [\u003c0000000652512242\u003e] devlink_health_do_dump.part.0+0x82/0x168\n [\u003c0000000652513212\u003e] devlink_health_report+0x19a/0x230\n [\u003c000003ff80075a12\u003e] mlx5_fw_fatal_reporter_err_work+0xba/0x1b0 [mlx5_core]\n\nNo kernel log of the exact same error with an upstream kernel is\navailable - but the very same deadlock situation can be constructed there,\ntoo:\n\n- task: kmcheck\n  mlx5_unload_one() tries to acquire devlink lock while the PCI error\n  recovery code has set pdev-\u003eblock_cfg_access by way of\n  pci_cfg_access_lock()\n- task: kworker\n  mlx5_crdump_collect() tries to set block_cfg_access through\n  pci_cfg_access_lock() while devlink_health_report() had acquired\n  the devlink lock.\n\nA similar deadlock situation can be reproduced by requesting a\ncrdump with\n  \u003e devlink health dump show pci/\u003cBDF\u003e reporter fw_fatal\n\nwhile PCI error recovery is executed on the same \u003cBDF\u003e physical function\nby mlx5_core's pci_error_handlers. On s390 this can be injected with\n  \u003e zpcictl --reset-fw \u003cBDF\u003e\n\nTests with this patch failed to reproduce that second deadlock situation,\nthe devlink command is rejected with \"kernel answers: Permission denied\" -\nand we get a kernel log message of:\n\nmlx5_core 1ed0:00:00.1: mlx5_crdump_collect:50:(pid 254382): crdump: failed to lock vsc gw err -5\n\nbecause the config read of VSC_SEMAPHORE is rejected by the underlying\nhardware.\n\nTwo prior attempts to address this issue have been discussed and\nultimately rejected [see link], with the primary argument that s390's\nimplementation of PCI error recovery is imposing restrictions that\nneither powerpc's EEH nor PCI AER handling need. Tests show that PCI\nerror recovery on s390 is running to completion even without blocking\naccess to PCI config space.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","from":"osv"},"epss":{"day":"2026-11-10","score":0.00191,"percentile":0.08843,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2025-12-16T15:39:41Z","modified":"2026-11-10T02:50:20Z","fixes":[{"ecosystem":"Alpaquita:23","package":"linux-lts","fixed_in":["6.1.159-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"linux-lts","fixed_in":["6.12.58-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"linux-lts","fixed_in":["6.18.35-r1"],"sources":["osv"]},{"ecosystem":"Linux","package":"Kernel","fixed_in":["6.1.159","6.6.117","6.12.58","6.17.8"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"linux","fixed_in":["6.1.159-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["6.12.63-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["6.17.8-1"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"linux","fixed_in":["6.1.190-1.aikido.167"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-linux","fixed_in":["6.1.190-1.aikido.167"],"sources":["osv"]},{"ecosystem":"Root:Ubuntu:22.04","package":"linux","fixed_in":["5.15.0-203.213.aikido.119"],"sources":["osv"]},{"ecosystem":"Root:Ubuntu:22.04","package":"rootio-linux","fixed_in":["5.15.0-203.213.aikido.119"],"sources":["osv"]},{"ecosystem":"Root:Ubuntu:24.04","package":"linux","fixed_in":["6.8.0-149.149.aikido.91"],"sources":["osv"]},{"ecosystem":"Root:Ubuntu:24.04","package":"rootio-linux","fixed_in":["6.8.0-149.149.aikido.91"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.8","fixed_in":["6.8.0-1050.53~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.8","fixed_in":["6.8.0-1051.57~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-6.8","fixed_in":["6.8.0-1058.65~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.8","fixed_in":["6.8.0-1052.55~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.8","fixed_in":["6.8.0-106.106~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-ibm-6.8","fixed_in":["6.8.0-1049.49~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.8","fixed_in":["6.8.0-106.106.1~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.8","fixed_in":["6.8.0-1049.52~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.8","fixed_in":["6.8.0-1047.48~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-6.8","fixed_in":["6.8.0-106.106~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:Realtime:22.04:LTS","package":"linux-realtime-6.8","fixed_in":["6.8.1-1045.46~22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux","fixed_in":["6.8.0-106.106"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws","fixed_in":["6.8.0-1050.53"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws-6.17","fixed_in":["6.17.0-1007.7~24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure","fixed_in":["6.8.0-1051.57"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-fde","fixed_in":["6.8.0-1058.65"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp","fixed_in":["6.8.0-1052.55"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.17","fixed_in":["6.17.0-1008.8~24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-gke","fixed_in":["6.8.0-1048.53"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-gkeop","fixed_in":["6.8.0-1035.38"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-ibm","fixed_in":["6.8.0-1049.49"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency","fixed_in":["6.8.0-106.106.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia","fixed_in":["6.8.0-1049.52"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-6.17","fixed_in":["6.17.0-1008.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-lowlatency","fixed_in":["6.8.0-1049.52.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-tegra","fixed_in":["6.8.0-1020.20"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.17","fixed_in":["6.17.0-1011.11"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle","fixed_in":["6.8.0-1047.48"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle-6.17","fixed_in":["6.17.0-1007.7~24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi","fixed_in":["6.8.0-1050.54"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"linux-xilinx","fixed_in":["6.8.0-1028.29"],"sources":["osv"]},{"ecosystem":"Ubuntu:Nvidia-BlueField:24.04:LTS","package":"linux-bluefield","fixed_in":["6.8.0-1017.21"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-raspi-realtime","fixed_in":["6.8.0-2040.41"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime","fixed_in":["6.8.1-1045.46"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime-6.17","fixed_in":["6.17.0-1006.7~24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-aws-fips","fixed_in":["6.8.0-1050.53+fips1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-azure-fips","fixed_in":["6.8.0-1052.58+fips1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-fips","fixed_in":["6.8.0-106.106+fips1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-gcp-fips","fixed_in":["6.8.0-1052.55+fips1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"linux","fixed_in":["6.17.0-14.14"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"linux-aws","fixed_in":["6.17.0-1007.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"linux-azure","fixed_in":["6.17.0-1008.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"linux-gcp","fixed_in":["6.17.0-1007.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"linux-oracle","fixed_in":["6.17.0-1007.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"linux-raspi","fixed_in":["6.17.0-1008.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"linux-realtime","fixed_in":["6.17.0-1006.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"linux-riscv","fixed_in":["6.17.0-14.14.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:23","package":"linux-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.158-r0"},{"fixed":"6.1.159-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"linux-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.12.57-r0"},{"fixed":"6.12.58-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"linux-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.12.92-r1"},{"fixed":"6.18.35-r1"}]}]},{"source":"osv","ecosystem":"Linux","package":"Kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.159"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.117"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.58"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.17.8"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.159-1"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.112-1","6.1.115-1","6.1.119-1","6.1.123-1","6.1.124-1","6.1.128-1","6.1.129-1","6.1.133-1","6.1.135-1","6.1.137-1","6.1.139-1","6.1.140-1","6.1.147-1","6.1.148-1","6.1.153-1","6.1.158-1","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.63-1"}]}],"versions":["6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.57-1","6.12.57-1~bpo12+1","6.12.63-1~bpo12+1"]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.8-1"}]}],"versions":["6.12.100-1","6.12.101-1","6.12.105-1","6.12.107-1","6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.57-1","6.12.57-1~bpo12+1","6.12.63-1","6.12.63-1~bpo12+1","6.12.69-1","6.12.69-1~bpo12+1","6.12.73-1","6.12.73-1~bpo12+1","6.12.74-1","6.12.74-2","6.12.74-2~bpo12+1","6.12.85-1","6.12.85-1~bpo12+1","6.12.86-1","6.12.86-1~bpo12+1","6.12.88-1","6.12.88-1~bpo12+1","6.12.90-1","6.12.90-1~bpo12+1","6.12.90-2","6.12.90-2~bpo12+1","6.12.94-1","6.12.94-1~bpo12+1","6.12.95-1","6.12.95-1~bpo12+1","6.12.96-1","6.13.10-1~exp1","6.13.11-1~exp1","6.13.2-1~exp1","6.13.3-1~exp1","6.13.4-1~exp1","6.13.5-1~exp1","6.13.6-1~exp1","6.13.7-1~exp1","6.13.8-1~exp1","6.13.9-1~exp1","6.13~rc6-1~exp1","6.13~rc7-1~exp1","6.14.3-1~exp1","6.14.5-1~exp1","6.14.6-1~exp1","6.15-1~exp1","6.15.1-1~exp1","6.15.2-1~exp1","6.15.3-1~exp1","6.15.4-1~exp1","6.15.5-1~exp1","6.15.6-1~exp1","6.15~rc7-1~exp1","6.16-1~exp1","6.16.1-1~exp1","6.16.10-1","6.16.11-1","6.16.12-1","6.16.12-1~bpo13+1","6.16.12-2","6.16.3-1","6.16.3-1~bpo13+1","6.16.5-1","6.16.6-1","6.16.7-1","6.16.8-1","6.16.9-1","6.16~rc7-1~exp1","6.17.2-1~exp1","6.17.5-1~exp1","6.17.6-1","6.17.7-1","6.17.7-2","6.17.8-1~bpo13+1"]},{"source":"osv","ecosystem":"Debian:11","package":"linux-6.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.159-1~deb11u1"}]}],"versions":["6.1.106-3~deb11u1","6.1.106-3~deb11u2","6.1.106-3~deb11u3","6.1.112-1~deb11u1","6.1.119-1~deb11u1","6.1.128-1~deb11u1","6.1.129-1~deb11u1","6.1.137-1~deb11u1","6.1.140-1~deb11u1","6.1.147-1~deb11u1","6.1.148-1~deb11u1","6.1.153-1~deb11u1","6.1.158-1~deb11u1"],"bundled":114},{"source":"osv","ecosystem":"Mageia:9","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.120-1.mga9"}]}],"bundled":236},{"source":"osv","ecosystem":"Mageia:9","package":"kmod-virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.14-14.mga9"}]}],"bundled":236},{"source":"osv","ecosystem":"Mageia:9","package":"kmod-xtables-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.24-88.mga9"}]}],"bundled":236},{"source":"osv","ecosystem":"Mageia:9","package":"kernel-linus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.120-1.mga9"}]}],"bundled":236},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.0-138.0.0.119.oe2403"}]}],"bundled":99},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.0-138.0.0.132.oe2403sp1"}]}],"bundled":99},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.0-138.0.0.132.oe2403sp2"}]}],"bundled":94},{"source":"osv","ecosystem":"Root:Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.190-1.aikido.167"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.190-1.aikido.167"}]}]},{"source":"osv","ecosystem":"Root:Ubuntu:22.04","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-203.213.aikido.119"}]}]},{"source":"osv","ecosystem":"Root:Ubuntu:22.04","package":"rootio-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-203.213.aikido.119"}]}]},{"source":"osv","ecosystem":"Root:Ubuntu:24.04","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-149.149.aikido.91"}]}]},{"source":"osv","ecosystem":"Root:Ubuntu:24.04","package":"rootio-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-149.149.aikido.91"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro Extras 6.2","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.33.1"}]}],"bundled":206},{"source":"osv","ecosystem":"SUSE:Linux Micro Extras 6.2","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.33.1"}]}],"bundled":206},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.55.1"}]}],"bundled":204},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.55.1"}]}],"bundled":204},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.55.1.150700.17.33.1"}]}],"bundled":204},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.55.1"}]}],"bundled":204},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.55.1"}]}],"bundled":204},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.55.1"}]}],"bundled":204},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.55.1"}]}],"bundled":204},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.55.1"}]}],"bundled":204},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.55.1"}]}],"bundled":204},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.55.1"}]}],"bundled":204},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.55.1"}]}],"bundled":204},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"kernel-livepatch-SLE15-SP7_Update_15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150700.15.3.1"}]}],"bundled":204},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.55.1"}]}],"bundled":204},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.55.1"}]}],"bundled":204},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.55.1"}]}],"bundled":204},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.0-28.30~16.04.1","4.8.0-30.32~16.04.1","4.8.0-32.34~16.04.1","4.8.0-34.36~16.04.1","4.10.0-14.16~16.04.1","4.10.0-19.21~16.04.1","4.10.0-20.22~16.04.1","4.10.0-21.23~16.04.1","4.10.0-22.24~16.04.1","4.10.0-24.28~16.04.1","4.10.0-26.30~16.04.1","4.11.0-13.19~16.04.1","4.11.0-14.20~16.04.1","4.13.0-16.19~16.04.3","4.13.0-17.20~16.04.1","4.13.0-19.22~16.04.1","4.13.0-21.24~16.04.1","4.13.0-25.29~16.04.2","4.15.0-13.14~16.04.1","4.15.0-15.16~16.04.1","4.15.0-20.21~16.04.1","4.15.0-22.24~16.04.1","4.15.0-23.25~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1021.24~18.04.1","5.0.0-1022.25~18.04.1","5.0.0-1023.26~18.04.1","5.0.0-1024.27~18.04.1","5.0.0-1025.28","5.0.0-1027.30"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1019.21~18.04.1","5.3.0-1023.25~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.2","5.3.0-1033.35","5.3.0-1034.36","5.3.0-1035.37"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.2","4.15.0-1003.3","4.15.0-1004.4","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1012.12","4.15.0-1013.13","4.15.0-1014.14","4.15.0-1018.18","4.15.0-1019.19","4.15.0-1021.21","4.15.0-1022.23","4.15.0-1023.24","4.15.0-1025.26","4.15.0-1028.29","4.15.0-1030.31","4.15.0-1031.32","4.15.0-1032.33","4.15.0-1035.36","4.15.0-1036.38","4.15.0-1037.39","4.18.0-1011.11~18.04.1","4.18.0-1013.13~18.04.1","4.18.0-1014.14~18.04.1","4.18.0-1018.18~18.04.1","4.18.0-1019.19~18.04.1","4.18.0-1020.20~18.04.1","4.18.0-1023.24~18.04.1","4.18.0-1024.25~18.04.1","4.18.0-1025.27~18.04.1","5.0.0-1014.14~18.04.1","5.0.0-1016.17~18.04.1","5.0.0-1018.19~18.04.1","5.0.0-1020.21~18.04.1","5.0.0-1022.23~18.04.1","5.0.0-1023.24~18.04.1","5.0.0-1025.27~18.04.1","5.0.0-1027.29~18.04.1","5.0.0-1028.30~18.04.1","5.0.0-1029.31~18.04.1","5.0.0-1031.33","5.0.0-1032.34","5.0.0-1035.37","5.0.0-1036.38"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8~18.04.1","5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1019.20~18.04.1","5.3.0-1020.21~18.04.1","5.3.0-1022.23~18.04.1","5.3.0-1028.29~18.04.1","5.3.0-1031.32~18.04.1","5.3.0-1032.33~18.04.1","5.3.0-1034.35~18.04.1","5.3.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-1006.6~18.04.1","4.18.0-1007.7~18.04.1","4.18.0-1008.8~18.04.1","5.0.0-1012.12~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1001.1","4.15.0-1003.3","4.15.0-1005.5","4.15.0-1006.6","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1010.10","4.15.0-1014.14","4.15.0-1015.15","4.15.0-1017.18","4.15.0-1018.19","4.15.0-1019.20","4.15.0-1021.22","4.15.0-1023.24","4.15.0-1024.25","4.15.0-1025.26","4.15.0-1026.27","4.15.0-1027.28","4.15.0-1028.29","4.15.0-1029.31","4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1042.45","4.15.0-1044.70","5.0.0-1020.20~18.04.1","5.0.0-1021.21~18.04.1","5.0.0-1025.26~18.04.1","5.0.0-1026.27~18.04.1","5.0.0-1028.29~18.04.1","5.0.0-1029.30~18.04.1","5.0.0-1031.32","5.0.0-1033.34","5.0.0-1034.35"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1020.22~18.04.1","5.3.0-1026.28~18.04.1","5.3.0-1029.31~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-4.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1041.43","4.15.0-1042.44","4.15.0-1044.46","4.15.0-1045.48","4.15.0-1046.49","4.15.0-1048.51","4.15.0-1049.52","4.15.0-1050.53","4.15.0-1052.55","4.15.0-1055.58","4.15.0-1057.60","4.15.0-1058.61","4.15.0-1059.62","4.15.0-1063.66","4.15.0-1064.67","4.15.0-1066.69","4.15.0-1067.70","4.15.0-1069.72","4.15.0-1070.73","4.15.0-1072.76","4.15.0-1073.78","4.15.0-1074.79","4.15.0-1076.81","4.15.0-1077.82","4.15.0-1078.83","4.15.0-1079.84"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1025.25~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.31~18.04.1","5.4.0-1030.32~18.04.1","5.4.0-1032.34~18.04.1","5.4.0-1033.35~18.04.1","5.4.0-1035.37~18.04.1","5.4.0-1036.38~18.04.1","5.4.0-1037.39~18.04.1","5.4.0-1039.41~18.04.1","5.4.0-1040.42~18.04.1","5.4.0-1042.44~18.04.1","5.4.0-1043.45~18.04.1","5.4.0-1044.46~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1","5.4.0-1052.55~18.04.1","5.4.0-1053.56~18.04.1","5.4.0-1054.57~18.04.1","5.4.0-1055.58~18.04.1","5.4.0-1056.59~18.04.1","5.4.0-1057.60~18.04.1","5.4.0-1059.62~18.04.1","5.4.0-1061.64~18.04.1","5.4.0-1062.65~18.04.1","5.4.0-1063.66~18.04.1","5.4.0-1065.68~18.04.1","5.4.0-1066.69~18.04.1","5.4.0-1067.70~18.04.1","5.4.0-1068.71~18.04.1","5.4.0-1071.76~18.04.3","5.4.0-1072.77~18.04.1","5.4.0-1074.79~18.04.1","5.4.0-1076.82~18.04.1","5.4.0-1078.84~18.04.1","5.4.0-1080.86~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gkeop-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1001.1","5.4.0-1003.3","5.4.0-1004.5","5.4.0-1005.6","5.4.0-1007.8~18.04.1","5.4.0-1008.9~18.04.1","5.4.0-1009.10~18.04.1","5.4.0-1010.11~18.04.1","5.4.0-1011.12~18.04.2","5.4.0-1012.13~18.04.1","5.4.0-1013.14~18.04.1","5.4.0-1014.15~18.04.1","5.4.0-1015.16~18.04.1","5.4.0-1016.17~18.04.1","5.4.0-1018.19~18.04.1","5.4.0-1021.22~18.04.1","5.4.0-1022.23~18.04.1","5.4.0-1023.24~18.04.1","5.4.0-1024.25~18.04.1","5.4.0-1025.26~18.04.1","5.4.0-1026.27~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.30~18.04.2","5.4.0-1031.32~18.04.1","5.4.0-1032.33~18.04.1","5.4.0-1033.34~18.04.1","5.4.0-1034.35~18.04.1","5.4.0-1036.37~18.04.1","5.4.0-1037.38~18.04.1","5.4.0-1038.39~18.04.1","5.4.0-1039.40~18.04.1","5.4.0-1040.41~18.04.1","5.4.0-1043.44~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1048.51~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-13.14~18.04.1","4.18.0-14.15~18.04.1","4.18.0-15.16~18.04.1","4.18.0-16.17~18.04.1","4.18.0-17.18~18.04.1","4.18.0-18.19~18.04.1","4.18.0-20.21~18.04.1","4.18.0-21.22~18.04.1","4.18.0-22.23~18.04.1","4.18.0-24.25~18.04.1","4.18.0-25.26~18.04.1","5.0.0-23.24~18.04.1","5.0.0-25.26~18.04.1","5.0.0-27.28~18.04.1","5.0.0-29.31~18.04.1","5.0.0-31.33~18.04.1","5.0.0-32.34~18.04.2","5.0.0-35.38~18.04.1","5.0.0-36.39~18.04.1","5.0.0-37.40~18.04.1","5.3.0-26.28~18.04.1","5.3.0-28.30~18.04.1","5.3.0-40.32~18.04.1","5.3.0-42.34~18.04.1","5.3.0-45.37~18.04.1","5.3.0-46.38~18.04.1","5.3.0-51.44~18.04.2","5.3.0-53.47~18.04.1","5.3.0-59.53~18.04.1","5.3.0-61.55~18.04.1","5.3.0-62.56~18.04.1","5.3.0-64.58~18.04.1","5.3.0-65.59","5.3.0-66.60","5.3.0-67.61","5.3.0-68.63","5.3.0-69.65","5.3.0-70.66","5.3.0-72.68","5.3.0-73.69","5.3.0-74.70","5.3.0-75.71","5.3.0-76.72"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-15.16~18.04.1","5.0.0-16.17~18.04.1","5.0.0-17.18~18.04.1","5.0.0-19.20~18.04.1","5.0.0-20.21~18.04.1","5.3.0-19.20~18.04.2","5.3.0-22.24~18.04.1","5.3.0-23.25~18.04.1","5.3.0-23.25~18.04.2","5.3.0-24.26~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.3","4.15.0-1004.5","4.15.0-1006.9","4.15.0-1008.11","4.15.0-1009.12","4.15.0-1012.15","4.15.0-1013.16","4.15.0-1015.18","4.15.0-1017.20","4.15.0-1018.21","4.15.0-1021.24","4.15.0-1024.29","4.15.0-1026.31","4.15.0-1028.33","4.15.0-1030.35","4.15.0-1033.38","4.15.0-1034.39","4.15.0-1035.40","4.15.0-1036.41","4.15.0-1038.43","4.15.0-1039.44","4.15.0-1043.48","4.15.0-1045.50","4.15.0-1050.57","4.15.0-1056.65","4.15.0-1057.66","4.15.0-1059.68","4.15.0-1063.72","4.15.0-1064.73","4.15.0-1065.75","4.15.0-1066.76","4.15.0-1067.77","4.15.0-1069.79","4.15.0-1073.83","4.15.0-1076.86","4.15.0-1079.89","4.15.0-1080.90","4.15.0-1081.91","4.15.0-1087.97","4.15.0-1090.100","4.15.0-1091.101","4.15.0-1093.103","4.15.0-1094.104","4.15.0-1096.106","4.15.0-1097.107","4.15.0-1099.109","4.15.0-1100.110","4.15.0-1101.112","4.15.0-1102.113","4.15.0-1103.114"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1007.12~18.04.1","5.0.0-1008.13~18.04.1","5.0.0-1009.14~18.04.1","5.0.0-1010.15~18.04.1","5.0.0-1011.16","5.0.0-1013.18","5.0.0-1014.19"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1011.12~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.18~18.04.1","5.3.0-1018.20~18.04.1","5.3.0-1024.26~18.04.1","5.3.0-1027.29~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.9~20.04.2","5.11.0-1014.15~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.2","5.11.0-1021.22~20.04.2","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.2","5.13.0-1011.12~20.04.1","5.13.0-1012.13~20.04.1","5.13.0-1014.15~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1019.21~20.04.1","5.13.0-1021.23~20.04.2","5.13.0-1022.24~20.04.1","5.13.0-1023.25~20.04.1","5.13.0-1025.27~20.04.1","5.13.0-1028.31~20.04.1","5.13.0-1029.32~20.04.1","5.13.0-1031.35~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-aws-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1014.18~20.04.1","5.15.0-1015.19~20.04.1","5.15.0-1017.21~20.04.1","5.15.0-1019.23~20.04.1","5.15.0-1020.24~20.04.1","5.15.0-1021.25~20.04.1","5.15.0-1022.26~20.04.1","5.15.0-1023.27~20.04.1","5.15.0-1026.30~20.04.2","5.15.0-1027.31~20.04.1","5.15.0-1028.32~20.04.1","5.15.0-1030.34~20.04.1","5.15.0-1031.35~20.04.1","5.15.0-1033.37~20.04.1","5.15.0-1034.38~20.04.1","5.15.0-1035.39~20.04.1","5.15.0-1036.40~20.04.1","5.15.0-1037.41~20.04.1","5.15.0-1038.43~20.04.1","5.15.0-1039.44~20.04.1","5.15.0-1040.45~20.04.1","5.15.0-1041.46~20.04.1","5.15.0-1043.48~20.04.1","5.15.0-1044.49~20.04.1","5.15.0-1045.50~20.04.1","5.15.0-1047.52~20.04.1","5.15.0-1048.53~20.04.1","5.15.0-1049.54~20.04.1","5.15.0-1050.55~20.04.1","5.15.0-1051.56~20.04.1","5.15.0-1052.57~20.04.1","5.15.0-1053.58~20.04.1","5.15.0-1055.60~20.04.1","5.15.0-1056.61~20.04.1","5.15.0-1057.63~20.04.1","5.15.0-1058.64~20.04.1","5.15.0-1061.67~20.04.1","5.15.0-1062.68~20.04.1","5.15.0-1063.69~20.04.1","5.15.0-1064.70~20.04.1","5.15.0-1065.71~20.04.1","5.15.0-1066.72~20.04.1","5.15.0-1067.73~20.04.1","5.15.0-1068.74~20.04.1","5.15.0-1069.75~20.04.1","5.15.0-1070.76~20.04.1","5.15.0-1071.77~20.04.1","5.15.0-1072.78~20.04.1","5.15.0-1073.79~20.04.1","5.15.0-1075.82~20.04.1","5.15.0-1077.84~20.04.1","5.15.0-1080.87~20.04.1","5.15.0-1081.88~20.04.1","5.15.0-1082.89~20.04.1","5.15.0-1083.90~20.04.1","5.15.0-1084.91~20.04.1","5.15.0-1086.93~20.04.1","5.15.0-1087.94~20.04.1","5.15.0-1088.95~20.04.1","5.15.0-1089.96~20.04.1","5.15.0-1090.97~20.04.1","5.15.0-1091.98~20.04.1","5.15.0-1092.99~20.04.1","5.15.0-1093.100~20.04.1","5.15.0-1095.102~20.04.1","5.15.0-1096.103~20.04.1","5.15.0-1097.104~20.04.1","5.15.0-1098.105~20.04.1","5.15.0-1099.106~20.04.1","5.15.0-1100.107~20.04.2","5.15.0-1101.108~20.04.1","5.15.0-1103.110~20.04.1","5.15.0-1104.111~20.04.1","5.15.0-1105.112~20.04.1","5.15.0-1106.113~20.04.1","5.15.0-1108.115~20.04.1","5.15.0-1109.116~20.04.1","5.15.0-1111.118~20.04.1","5.15.0-1112.119~20.04.1","5.15.0-1114.121~20.04.1","5.15.0-1115.122~20.04.1","5.15.0-1116.123~20.04.1","5.15.0-1117.124~20.04.1","5.15.0-1119.126~20.04.1","5.15.0-1120.127~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1041.43~20.04.1","5.8.0-1042.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1007.7~20.04.2","5.11.0-1012.13~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10~20.04.2","5.13.0-1012.14~20.04.1","5.13.0-1013.15~20.04.1","5.13.0-1014.16~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1021.24~20.04.1","5.13.0-1022.26~20.04.1","5.13.0-1023.27~20.04.1","5.13.0-1025.29~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1029.34~20.04.1","5.13.0-1031.37~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-azure-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1007.8~20.04.1","5.15.0-1008.9~20.04.1","5.15.0-1013.16~20.04.1","5.15.0-1014.17~20.04.1","5.15.0-1017.20~20.04.1","5.15.0-1019.24~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1021.26~20.04.1","5.15.0-1022.27~20.04.1","5.15.0-1023.29~20.04.1","5.15.0-1029.36~20.04.1","5.15.0-1030.37~20.04.1","5.15.0-1031.38~20.04.1","5.15.0-1033.40~20.04.1","5.15.0-1034.41~20.04.1","5.15.0-1035.42~20.04.1","5.15.0-1036.43~20.04.1","5.15.0-1037.44~20.04.1","5.15.0-1038.45~20.04.1","5.15.0-1039.46~20.04.1","5.15.0-1040.47~20.04.1","5.15.0-1041.48~20.04.1","5.15.0-1042.49~20.04.1","5.15.0-1043.50~20.04.1","5.15.0-1045.52~20.04.1","5.15.0-1046.53~20.04.1","5.15.0-1047.54~20.04.1","5.15.0-1049.56~20.04.1","5.15.0-1050.57~20.04.1","5.15.0-1051.59~20.04.1","5.15.0-1052.60~20.04.1","5.15.0-1053.61~20.04.1","5.15.0-1054.62~20.04.1","5.15.0-1056.64~20.04.1","5.15.0-1057.65~20.04.1","5.15.0-1058.66~20.04.2","5.15.0-1059.67~20.04.1","5.15.0-1060.69~20.04.1","5.15.0-1061.70~20.04.1","5.15.0-1063.72~20.04.1","5.15.0-1064.73~20.04.1","5.15.0-1065.74~20.04.1","5.15.0-1067.76~20.04.1","5.15.0-1068.77~20.04.1","5.15.0-1070.79~20.04.1","5.15.0-1071.80~20.04.1","5.15.0-1072.81~20.04.1","5.15.0-1073.82~20.04.1","5.15.0-1074.83~20.04.1","5.15.0-1075.84~20.04.1","5.15.0-1078.87~20.04.1","5.15.0-1079.88~20.04.1","5.15.0-1081.90~20.04.1","5.15.0-1082.91~20.04.1","5.15.0-1086.95~20.04.1","5.15.0-1087.96~20.04.1","5.15.0-1088.97~20.04.1","5.15.0-1089.98~20.04.1","5.15.0-1091.100~20.04.1","5.15.0-1094.103~20.04.1","5.15.0-1095.104~20.04.1","5.15.0-1096.105~20.04.1","5.15.0-1097.106~20.04.1","5.15.0-1098.107~20.04.1","5.15.0-1102.111~20.04.1","5.15.0-1103.112~20.04.1","5.15.0-1110.119~20.04.1","5.15.0-1111.120~20.04.1","5.15.0-1114.123~20.04.1","5.15.0-1116.125~20.04.1","5.15.0-1117.126~20.04.1","5.15.0-1119.128~20.04.1","5.15.0-1121.130~20.04.1","5.15.0-1122.131~20.04.1","5.15.0-1123.132~20.04.1","5.15.0-1125.134~20.04.1","5.15.0-1126.135~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1033.35~20.04.1","5.8.0-1036.38~20.04.1","5.8.0-1039.42~20.04.1","5.8.0-1040.43~20.04.1","5.8.0-1041.44~20.04.1","5.8.0-1042.45~20.04.1","5.8.0-1043.46~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1063.66+cvm2.2","5.4.0-1063.66+cvm3.2","5.4.0-1064.67+cvm1.1","5.4.0-1065.68+cvm2.1","5.4.0-1067.70+cvm1.1","5.4.0-1068.71+cvm1.1","5.4.0-1069.72+cvm1.1","5.4.0-1070.73+cvm1.1","5.4.0-1072.75+cvm1.1","5.4.0-1073.76+cvm1.1","5.4.0-1074.77+cvm1.1","5.4.0-1076.79+cvm1.1","5.4.0-1078.81+cvm1.1","5.4.0-1080.83+cvm1.1","5.4.0-1083.87+cvm1.1","5.4.0-1085.90+cvm1.1","5.4.0-1085.90+cvm2.1","5.4.0-1086.91+cvm1.1","5.4.0-1089.94+cvm1.2","5.4.0-1090.95+cvm1.1","5.4.0-1091.96+cvm1.1","5.4.0-1092.97+cvm1.1","5.4.0-1095.101+cvm1.1","5.4.0-1098.104+cvm1.1","5.4.0-1100.106+cvm1.1","5.4.0-1103.109+cvm1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-azure-fde-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1019.24~20.04.1.1","5.15.0-1020.25~20.04.1.1","5.15.0-1021.26~20.04.1.1","5.15.0-1029.36~20.04.1.1","5.15.0-1030.37~20.04.1.1","5.15.0-1031.38~20.04.1.1","5.15.0-1033.40~20.04.1.1","5.15.0-1034.41~20.04.1.2","5.15.0-1035.42~20.04.1.1","5.15.0-1036.43~20.04.1.1","5.15.0-1037.44~20.04.1.1","5.15.0-1038.45~20.04.1.1","5.15.0-1039.46~20.04.1.1","5.15.0-1040.47~20.04.1.1","5.15.0-1041.48~20.04.1.1","5.15.0-1042.49~20.04.1.1","5.15.0-1043.50~20.04.1.1","5.15.0-1046.53~20.04.1.1","5.15.0-1047.54~20.04.1.1","5.15.0-1049.56~20.04.1.1","5.15.0-1050.57~20.04.1.1","5.15.0-1051.59~20.04.1.1","5.15.0-1052.60~20.04.1.1","5.15.0-1053.61~20.04.1.1","5.15.0-1054.62~20.04.1.1","5.15.0-1056.64~20.04.1.1","5.15.0-1057.65~20.04.1.1","5.15.0-1058.66~20.04.2.1","5.15.0-1059.67~20.04.1.1","5.15.0-1060.69~20.04.1.1","5.15.0-1061.70~20.04.1.1","5.15.0-1063.72~20.04.1.1","5.15.0-1064.73~20.04.1.1","5.15.0-1065.74~20.04.1.1","5.15.0-1067.76~20.04.1.1","5.15.0-1068.77~20.04.1.1","5.15.0-1070.79~20.04.1.1","5.15.0-1071.80~20.04.1.1","5.15.0-1072.81~20.04.1.1","5.15.0-1073.82~20.04.1.1","5.15.0-1074.83~20.04.1.1","5.15.0-1076.85~20.04.1.1","5.15.0-1078.87~20.04.1.1","5.15.0-1081.90~20.04.1.1","5.15.0-1082.91~20.04.1.1","5.15.0-1086.95~20.04.1.1","5.15.0-1087.96~20.04.1.1","5.15.0-1088.97~20.04.1.1","5.15.0-1089.98~20.04.1.1","5.15.0-1091.100~20.04.1.1","5.15.0-1094.103~20.04.1.1","5.15.0-1096.105~20.04.1.1","5.15.0-1097.106~20.04.1.1","5.15.0-1098.107~20.04.1.1","5.15.0-1102.111~20.04.1.1","5.15.0-1103.112~20.04.1.1","5.15.0-1111.120~20.04.1.1","5.15.0-1114.123~20.04.1","5.15.0-1116.125~20.04.1","5.15.0-1117.126~20.04.2","5.15.0-1118.127~20.04.1","5.15.0-1119.128~20.04.1","5.15.0-1120.129~20.04.1","5.15.0-1121.130~20.04.1","5.15.0-1122.131~20.04.1","5.15.0-1124.133~20.04.1","5.15.0-1125.134~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.10~20.04.1","5.11.0-1014.16~20.04.1","5.11.0-1017.19~20.04.1","5.11.0-1018.20~20.04.2","5.11.0-1020.22~20.04.1","5.11.0-1021.23~20.04.1","5.11.0-1022.24~20.04.1","5.11.0-1023.25~20.04.1","5.11.0-1024.26~20.04.1","5.11.0-1026.29~20.04.1","5.11.0-1028.32~20.04.1","5.11.0-1029.33~20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.3","5.13.0-1012.15~20.04.1","5.13.0-1013.16~20.04.1","5.13.0-1015.18~20.04.1","5.13.0-1019.23~20.04.1","5.13.0-1021.25~20.04.1","5.13.0-1023.28~20.04.1","5.13.0-1024.29~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1030.36~20.04.1","5.13.0-1031.37~20.04.1","5.13.0-1033.40~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-gcp-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1006.9~20.04.1","5.15.0-1012.17~20.04.1","5.15.0-1013.18~20.04.1","5.15.0-1016.21~20.04.1","5.15.0-1017.23~20.04.2","5.15.0-1018.24~20.04.1","5.15.0-1021.28~20.04.1","5.15.0-1022.29~20.04.1","5.15.0-1025.32~20.04.2","5.15.0-1026.33~20.04.1","5.15.0-1027.34~20.04.1","5.15.0-1029.36~20.04.1","5.15.0-1030.37~20.04.1","5.15.0-1031.38~20.04.1","5.15.0-1032.40~20.04.1","5.15.0-1033.41~20.04.1","5.15.0-1034.42~20.04.1","5.15.0-1035.43~20.04.1","5.15.0-1036.44~20.04.1","5.15.0-1037.45~20.04.1","5.15.0-1038.46~20.04.1","5.15.0-1039.47~20.04.1","5.15.0-1040.48~20.04.1","5.15.0-1041.49~20.04.1","5.15.0-1042.50~20.04.1","5.15.0-1044.52~20.04.1","5.15.0-1045.53~20.04.2","5.15.0-1046.54~20.04.1","5.15.0-1047.55~20.04.1","5.15.0-1048.56~20.04.1","5.15.0-1049.57~20.04.1","5.15.0-1051.59~20.04.1","5.15.0-1052.60~20.04.1","5.15.0-1053.61~20.04.1","5.15.0-1054.62~20.04.1","5.15.0-1055.63~20.04.1","5.15.0-1058.66~20.04.1","5.15.0-1059.67~20.04.1","5.15.0-1060.68~20.04.1","5.15.0-1062.70~20.04.1","5.15.0-1065.73~20.04.1","5.15.0-1066.74~20.04.1","5.15.0-1067.75~20.04.1","5.15.0-1068.76~20.04.1","5.15.0-1069.77~20.04.1","5.15.0-1070.78~20.04.1","5.15.0-1071.79~20.04.1","5.15.0-1072.80~20.04.1","5.15.0-1073.81~20.04.1","5.15.0-1074.83~20.04.1","5.15.0-1075.84~20.04.1","5.15.0-1077.86~20.04.1","5.15.0-1078.87~20.04.1","5.15.0-1081.90~20.04.1","5.15.0-1083.92~20.04.1","5.15.0-1085.94~20.04.1","5.15.0-1086.95~20.04.1","5.15.0-1087.96~20.04.2","5.15.0-1088.97~20.04.1","5.15.0-1090.99~20.04.1","5.15.0-1091.100~20.04.1","5.15.0-1092.101~20.04.1","5.15.0-1093.102~20.04.1","5.15.0-1095.104~20.04.1","5.15.0-1096.105~20.04.1","5.15.0-1097.106~20.04.1","5.15.0-1098.107~20.04.1","5.15.0-1099.108~20.04.1","5.15.0-1100.109~20.04.1","5.15.0-1101.110~20.04.1","5.15.0-1103.112~20.04.1","5.15.0-1104.113~20.04.1","5.15.0-1106.115~20.04.1","5.15.0-1108.117~20.04.1","5.15.0-1109.118~20.04.1","5.15.0-1111.121~20.04.1","5.15.0-1112.122~20.04.1","5.15.0-1114.124~20.04.1","5.15.0-1118.128~20.04.1","5.15.0-1120.130~20.04.1","5.15.0-1121.131~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1032.34~20.04.1","5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1039.41"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1033.35","5.4.0-1035.37","5.4.0-1036.38","5.4.0-1037.39","5.4.0-1039.41","5.4.0-1041.43","5.4.0-1042.44","5.4.0-1043.45","5.4.0-1044.46","5.4.0-1046.48","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1055.58","5.4.0-1056.59","5.4.0-1057.60","5.4.0-1059.62","5.4.0-1061.64","5.4.0-1062.65","5.4.0-1063.66","5.4.0-1065.68","5.4.0-1066.69","5.4.0-1067.70","5.4.0-1068.71","5.4.0-1071.76","5.4.0-1072.77","5.4.0-1074.79","5.4.0-1076.82","5.4.0-1078.84","5.4.0-1080.86","5.4.0-1081.87","5.4.0-1083.89","5.4.0-1084.90","5.4.0-1086.93","5.4.0-1087.94","5.4.0-1090.97","5.4.0-1091.98","5.4.0-1094.101","5.4.0-1095.102","5.4.0-1096.103","5.4.0-1097.104","5.4.0-1098.105","5.4.0-1099.106","5.4.0-1100.107","5.4.0-1101.108","5.4.0-1102.109","5.4.0-1103.110","5.4.0-1104.111","5.4.0-1105.112"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1011.14~20.04.1","5.15.0-1014.17~20.04.1","5.15.0-1015.18~20.04.1","5.15.0-1016.19~20.04.1","5.15.0-1019.23~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1023.28~20.04.2","5.15.0-1027.32~20.04.1","5.15.0-1028.33~20.04.1","5.15.0-1029.34~20.04.1","5.15.0-1031.36~20.04.1","5.15.0-1032.37~20.04.1","5.15.0-1033.38~20.04.1","5.15.0-1034.39~20.04.1","5.15.0-1036.41~20.04.1","5.15.0-1037.42~20.04.1","5.15.0-1038.43~20.04.1","5.15.0-1039.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1008.9","5.4.0-1009.10","5.4.0-1010.11","5.4.0-1011.12","5.4.0-1012.13","5.4.0-1013.14","5.4.0-1014.15","5.4.0-1015.16","5.4.0-1016.17","5.4.0-1018.19","5.4.0-1021.22","5.4.0-1022.23","5.4.0-1023.24","5.4.0-1024.25","5.4.0-1025.26","5.4.0-1026.27","5.4.0-1027.28","5.4.0-1029.30","5.4.0-1031.32","5.4.0-1032.33","5.4.0-1033.34","5.4.0-1034.35","5.4.0-1036.37","5.4.0-1037.38","5.4.0-1038.39","5.4.0-1039.40","5.4.0-1040.41","5.4.0-1043.44","5.4.0-1046.48","5.4.0-1048.51","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1056.60","5.4.0-1057.61","5.4.0-1060.64","5.4.0-1061.65","5.4.0-1062.66","5.4.0-1064.68","5.4.0-1065.69","5.4.0-1066.70","5.4.0-1067.71","5.4.0-1068.72","5.4.0-1069.73","5.4.0-1070.74","5.4.0-1071.75","5.4.0-1072.76","5.4.0-1073.77","5.4.0-1074.78","5.4.0-1075.79","5.4.0-1076.80","5.4.0-1077.81","5.4.0-1078.82","5.4.0-1079.83","5.4.0-1080.84","5.4.0-1081.85","5.4.0-1083.87","5.4.0-1084.88","5.4.0-1085.89","5.4.0-1086.90","5.4.0-1087.91","5.4.0-1088.92","5.4.0-1089.93","5.4.0-1090.94","5.4.0-1091.95","5.4.0-1092.96","5.4.0-1093.97","5.4.0-1094.98","5.4.0-1095.99","5.4.0-1096.100","5.4.0-1097.101","5.4.0-1098.102","5.4.0-1099.103","5.4.0-1100.104","5.4.0-1101.105","5.4.0-1102.106"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gkeop-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1003.5~20.04.2","5.15.0-1005.7~20.04.1","5.15.0-1007.10~20.04.1","5.15.0-1008.12~20.04.1","5.15.0-1011.15~20.04.2","5.15.0-1012.16~20.04.1","5.15.0-1013.17~20.04.1","5.15.0-1015.19~20.04.1","5.15.0-1016.21~20.04.1","5.15.0-1017.22~20.04.1","5.15.0-1018.23~20.04.1","5.15.0-1019.24~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1021.26~20.04.1","5.15.0-1022.27~20.04.1","5.15.0-1023.28~20.04.1","5.15.0-1024.29~20.04.1","5.15.0-1025.30~20.04.1","5.15.0-1026.31~20.04.1","5.15.0-1027.32~20.04.1","5.15.0-1028.33~20.04.1","5.15.0-1030.35~20.04.1","5.15.0-1031.37~20.04.1","5.15.0-1032.38~20.04.1","5.15.0-1033.39~20.04.1","5.15.0-1034.40~20.04.1","5.15.0-1035.41~20.04.1","5.15.0-1036.42~20.04.1","5.15.0-1037.43~20.04.1","5.15.0-1038.44~20.04.1","5.15.0-1039.45~20.04.1","5.15.0-1040.46~20.04.1","5.15.0-1043.50~20.04.1","5.15.0-1044.51~20.04.1","5.15.0-1045.52~20.04.1","5.15.0-1046.53~20.04.1","5.15.0-1047.54~20.04.1","5.15.0-1048.55~20.04.1","5.15.0-1049.56~20.04.1","5.15.0-1050.57~20.04.1","5.15.0-1051.58~20.04.1","5.15.0-1052.59~20.04.1","5.15.0-1053.60~20.04.1","5.15.0-1054.61~20.04.1","5.15.0-1055.62~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-22.23~20.04.1","5.11.0-25.27~20.04.1","5.11.0-27.29~20.04.1","5.11.0-34.36~20.04.1","5.11.0-36.40~20.04.1","5.11.0-37.41~20.04.2","5.11.0-38.42~20.04.1","5.11.0-40.44~20.04.2","5.11.0-41.45~20.04.1","5.11.0-43.47~20.04.2","5.11.0-44.48~20.04.2","5.11.0-46.51~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-21.21~20.04.1","5.13.0-22.22~20.04.1","5.13.0-23.23~20.04.2","5.13.0-25.26~20.04.1","5.13.0-27.29~20.04.1","5.13.0-28.31~20.04.1","5.13.0-30.33~20.04.1","5.13.0-35.40~20.04.1","5.13.0-37.42~20.04.1","5.13.0-39.44~20.04.1","5.13.0-40.45~20.04.1","5.13.0-41.46~20.04.1","5.13.0-44.49~20.04.1","5.13.0-48.54~20.04.1","5.13.0-51.58~20.04.1","5.13.0-52.59~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-hwe-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-33.34~20.04.1","5.15.0-41.44~20.04.1","5.15.0-43.46~20.04.1","5.15.0-46.49~20.04.1","5.15.0-48.54~20.04.1","5.15.0-50.56~20.04.1","5.15.0-52.58~20.04.1","5.15.0-53.59~20.04.1","5.15.0-56.62~20.04.1","5.15.0-57.63~20.04.1","5.15.0-58.64~20.04.1","5.15.0-60.66~20.04.1","5.15.0-67.74~20.04.1","5.15.0-69.76~20.04.1","5.15.0-70.77~20.04.1","5.15.0-71.78~20.04.1","5.15.0-72.79~20.04.1","5.15.0-73.80~20.04.1","5.15.0-75.82~20.04.1","5.15.0-76.83~20.04.1","5.15.0-78.85~20.04.1","5.15.0-79.86~20.04.2","5.15.0-82.91~20.04.1","5.15.0-83.92~20.04.1","5.15.0-84.93~20.04.1","5.15.0-86.96~20.04.1","5.15.0-87.97~20.04.1","5.15.0-88.98~20.04.1","5.15.0-89.99~20.04.1","5.15.0-91.101~20.04.1","5.15.0-92.102~20.04.1","5.15.0-94.104~20.04.1","5.15.0-97.107~20.04.1","5.15.0-100.110~20.04.1","5.15.0-101.111~20.04.1","5.15.0-102.112~20.04.1","5.15.0-105.115~20.04.1","5.15.0-106.116~20.04.1","5.15.0-107.117~20.04.1","5.15.0-113.123~20.04.1","5.15.0-116.126~20.04.1","5.15.0-117.127~20.04.1","5.15.0-118.128~20.04.1","5.15.0-119.129~20.04.1","5.15.0-121.131~20.04.1","5.15.0-122.132~20.04.1","5.15.0-124.134~20.04.1","5.15.0-125.135~20.04.1","5.15.0-126.136~20.04.1","5.15.0-127.137~20.04.1","5.15.0-130.140~20.04.1","5.15.0-131.141~20.04.1","5.15.0-134.145~20.04.1","5.15.0-136.147~20.04.1","5.15.0-138.148~20.04.1","5.15.0-139.149~20.04.1","5.15.0-142.152~20.04.1","5.15.0-143.153~20.04.1","5.15.0-144.157~20.04.1","5.15.0-145.158~20.04.1","5.15.0-151.161~20.04.1","5.15.0-152.162~20.04.1","5.15.0-153.163~20.04.1","5.15.0-156.166~20.04.1","5.15.0-157.167~20.04.1","5.15.0-160.170~20.04.1","5.15.0-161.171~20.04.1","5.15.0-163.173~20.04.1","5.15.0-164.174~20.04.1","5.15.0-168.178~20.04.1","5.15.0-170.180~20.04.3","5.15.0-171.181~20.04.1","5.15.0-173.183~20.04.1","5.15.0-176.186~20.04.1","5.15.0-177.187~20.04.1","5.15.0-179.189~20.04.1","5.15.0-181.191~20.04.1","5.15.0-185.195~20.04.1","5.15.0-186.196~20.04.1","5.15.0-190.200~20.04.1","5.15.0-191.201~20.04.1","5.15.0-194.204~20.04.1","5.15.0-198.208~20.04.1","5.15.0-202.212~20.04.1","5.15.0-203.213~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-23.24~20.04.1","5.8.0-25.26~20.04.1","5.8.0-28.30~20.04.1","5.8.0-29.31~20.04.1","5.8.0-31.33~20.04.1","5.8.0-33.36~20.04.1","5.8.0-34.37~20.04.2","5.8.0-36.40~20.04.1","5.8.0-38.43~20.04.1","5.8.0-40.45~20.04.1","5.8.0-41.46~20.04.1","5.8.0-43.49~20.04.1","5.8.0-44.50~20.04.1","5.8.0-45.51~20.04.1","5.8.0-48.54~20.04.1","5.8.0-49.55~20.04.1","5.8.0-50.56~20.04.1","5.8.0-53.60~20.04.1","5.8.0-55.62~20.04.1","5.8.0-59.66~20.04.1","5.8.0-63.71~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-ibm-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1033.36~20.04.1","5.15.0-1034.37~20.04.1","5.15.0-1035.38~20.04.1","5.15.0-1036.39~20.04.1","5.15.0-1037.40~20.04.1","5.15.0-1038.41~20.04.1","5.15.0-1040.43~20.04.1","5.15.0-1041.44~20.04.1","5.15.0-1042.45~20.04.1","5.15.0-1043.46~20.04.1","5.15.0-1044.47~20.04.1","5.15.0-1045.48~20.04.1","5.15.0-1046.49~20.04.1","5.15.0-1047.50~20.04.1","5.15.0-1048.51~20.04.1","5.15.0-1049.52~20.04.1","5.15.0-1050.53~20.04.1","5.15.0-1053.56~20.04.1","5.15.0-1054.57~20.04.1","5.15.0-1055.58~20.04.1","5.15.0-1057.60~20.04.1","5.15.0-1058.61~20.04.1","5.15.0-1059.62~20.04.1","5.15.0-1060.63~20.04.1","5.15.0-1061.64~20.04.1","5.15.0-1062.65~20.04.1","5.15.0-1063.66~20.04.1","5.15.0-1064.67~20.04.1","5.15.0-1065.68~20.04.1","5.15.0-1066.69~20.04.1","5.15.0-1067.70~20.04.1","5.15.0-1068.71~20.04.1","5.15.0-1069.72~20.04.1","5.15.0-1074.77~20.04.1","5.15.0-1075.78~20.04.1","5.15.0-1076.79~20.04.1","5.15.0-1078.81~20.04.1","5.15.0-1079.82~20.04.1","5.15.0-1080.83~20.04.1","5.15.0-1081.84~20.04.1","5.15.0-1083.86~20.04.1","5.15.0-1085.88~20.04.1","5.15.0-1086.89~20.04.1","5.15.0-1087.90~20.04.1","5.15.0-1089.92~20.04.1","5.15.0-1090.93~20.04.1","5.15.0-1091.94~20.04.1","5.15.0-1092.95~20.04.1","5.15.0-1093.96~20.04.1","5.15.0-1094.97~20.04.1","5.15.0-1095.98~20.04.1","5.15.0-1097.100~20.04.1","5.15.0-1098.101~20.04.1","5.15.0-1099.102~20.04.1","5.15.0-1100.103~20.04.1","5.15.0-1102.105~20.04.1","5.15.0-1103.106~20.04.1","5.15.0-1105.109~20.04.1","5.15.0-1106.110~20.04.1","5.15.0-1107.111~20.04.1","5.15.0-1108.112~20.04.1","5.15.0-1109.113~20.04.1","5.15.0-1110.114~20.04.1","5.15.0-1111.115~20.04.1","5.15.0-1113.117~20.04.1","5.15.0-1114.118~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-intel-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1007.7","5.13.0-1008.8","5.13.0-1009.9","5.13.0-1010.10","5.13.0-1011.11","5.13.0-1014.15","5.13.0-1017.19"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-intel-iotg-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1003.5~20.04.1","5.15.0-1008.11~20.04.1","5.15.0-1010.14~20.04.1","5.15.0-1015.20~20.04.2","5.15.0-1016.21~20.04.1","5.15.0-1017.22~20.04.1","5.15.0-1018.23~20.04.1","5.15.0-1021.26~20.04.1","5.15.0-1023.28~20.04.1","5.15.0-1025.30~20.04.1","5.15.0-1026.31~20.04.1","5.15.0-1027.32~20.04.1","5.15.0-1030.35~20.04.1","5.15.0-1031.36~20.04.1","5.15.0-1033.38~20.04.1","5.15.0-1034.39~20.04.1","5.15.0-1036.41~20.04.1","5.15.0-1037.42~20.04.1","5.15.0-1038.43~20.04.1","5.15.0-1040.46~20.04.1","5.15.0-1043.49~20.04.1","5.15.0-1045.51~20.04.1","5.15.0-1046.52~20.04.1","5.15.0-1048.54~20.04.1","5.15.0-1049.55~20.04.1","5.15.0-1050.56~20.04.1","5.15.0-1051.57~20.04.1","5.15.0-1052.58~20.04.1","5.15.0-1055.61~20.04.1","5.15.0-1058.64~20.04.1","5.15.0-1059.65~20.04.1","5.15.0-1060.66~20.04.1","5.15.0-1061.67~20.04.1","5.15.0-1062.68~20.04.1","5.15.0-1063.69~20.04.1","5.15.0-1064.70~20.04.1","5.15.0-1065.71~20.04.1","5.15.0-1066.72~20.04.1","5.15.0-1067.73~20.04.1","5.15.0-1071.77~20.04.1","5.15.0-1072.78~20.04.1","5.15.0-1073.79~20.04.2","5.15.0-1074.80~20.04.1","5.15.0-1077.83~20.04.1","5.15.0-1078.84~20.04.1","5.15.0-1079.85~20.04.1","5.15.0-1083.89~20.04.1","5.15.0-1084.90~20.04.1","5.15.0-1085.91~20.04.1","5.15.0-1086.92~20.04.1","5.15.0-1087.93~20.04.1","5.15.0-1088.94~20.04.1","5.15.0-1090.96~20.04.1","5.15.0-1091.97~20.04.1","5.15.0-1092.98~20.04.1","5.15.0-1093.99~20.04.1","5.15.0-1094.100~20.04.1","5.15.0-1095.101~20.04.1","5.15.0-1096.102~20.04.1","5.15.0-1098.104~20.04.1","5.15.0-1099.105~20.04.1","5.15.0-1100.106~20.04.1","5.15.0-1101.107~20.04.1","5.15.0-1103.109~20.04.1","5.15.0-1104.110~20.04.1","5.15.0-1106.112~20.04.1","5.15.0-1107.113~20.04.1","5.15.0-1108.114~20.04.1","5.15.0-1109.115~20.04.1","5.15.0-1110.116~20.04.1","5.15.0-1111.117~20.04.1","5.15.0-1112.118~20.04.1","5.15.0-1114.120~20.04.1","5.15.0-1115.121~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-lowlatency-hwe-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-33.34~20.04.1","5.15.0-42.45~20.04.1","5.15.0-43.46~20.04.1","5.15.0-46.49~20.04.1","5.15.0-48.54~20.04.1","5.15.0-50.56~20.04.1","5.15.0-52.58~20.04.1","5.15.0-53.59~20.04.1","5.15.0-56.62~20.04.1","5.15.0-58.64~20.04.1","5.15.0-60.66~20.04.1","5.15.0-67.74~20.04.1","5.15.0-69.76~20.04.1","5.15.0-70.77~20.04.1","5.15.0-71.78~20.04.1","5.15.0-72.79~20.04.1","5.15.0-73.80~20.04.1","5.15.0-75.82~20.04.1","5.15.0-76.83~20.04.1","5.15.0-78.85~20.04.1","5.15.0-79.88~20.04.1","5.15.0-82.91~20.04.1","5.15.0-83.92~20.04.1","5.15.0-84.93~20.04.1","5.15.0-86.95~20.04.1","5.15.0-87.96~20.04.1","5.15.0-88.98~20.04.1","5.15.0-89.99~20.04.1","5.15.0-91.101~20.04.1","5.15.0-92.102~20.04.1","5.15.0-94.104~20.04.1","5.15.0-97.107~20.04.1","5.15.0-100.110~20.04.1","5.15.0-101.111~20.04.1","5.15.0-102.112~20.04.1","5.15.0-105.115~20.04.1","5.15.0-106.116~20.04.1","5.15.0-107.117~20.04.1","5.15.0-110.120~20.04.1","5.15.0-113.123~20.04.1","5.15.0-116.126~20.04.1","5.15.0-117.127~20.04.1","5.15.0-118.128~20.04.1","5.15.0-119.129~20.04.1","5.15.0-121.131~20.04.1","5.15.0-122.132~20.04.1","5.15.0-124.134~20.04.1","5.15.0-125.135~20.04.1","5.15.0-126.136~20.04.1","5.15.0-127.137~20.04.1","5.15.0-128.138~20.04.1","5.15.0-129.139~20.04.1","5.15.0-131.141~20.04.1","5.15.0-133.143~20.04.1","5.15.0-134.145~20.04.1","5.15.0-135.146~20.04.1","5.15.0-136.147~20.04.1","5.15.0-138.148~20.04.1","5.15.0-139.149~20.04.1","5.15.0-140.150~20.04.1","5.15.0-142.152~20.04.1","5.15.0-143.153~20.04.1","5.15.0-144.157~20.04.1","5.15.0-145.158~20.04.1","5.15.0-152.162~20.04.1","5.15.0-153.163~20.04.1","5.15.0-156.166~20.04.1","5.15.0-157.167~20.04.1","5.15.0-160.170~20.04.1","5.15.0-161.171~20.04.1","5.15.0-163.173~20.04.1","5.15.0-164.174~20.04.1","5.15.0-168.178~20.04.1","5.15.0-170.180~20.04.1","5.15.0-171.181~20.04.1","5.15.0-173.183~20.04.1","5.15.0-174.184~20.04.1","5.15.0-175.185~20.04.1","5.15.0-177.187~20.04.1","5.15.0-178.188~20.04.1","5.15.0-179.189~20.04.1","5.15.0-181.191~20.04.1","5.15.0-183.193~20.04.1","5.15.0-184.194~20.04.1","5.15.0-190.200~20.04.1","5.15.0-191.201~20.04.1","5.15.0-194.204~20.04.1","5.15.0-195.205~20.04.1","5.15.0-197.207~20.04.1","5.15.0-198.208~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-nvidia-tegra-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1009.9~20.04.1","5.15.0-1010.10~20.04.1","5.15.0-1012.12~20.04.1","5.15.0-1014.14~20.04.1","5.15.0-1015.15~20.04.1","5.15.0-1016.16~20.04.1","5.15.0-1017.17~20.04.1","5.15.0-1018.18~20.04.1","5.15.0-1019.19~20.04.1","5.15.0-1020.20~20.04.1","5.15.0-1022.22~20.04.1","5.15.0-1025.25~20.04.1","5.15.0-1027.27~20.04.1","5.15.0-1030.30~20.04.1","5.15.0-1032.32~20.04.1","5.15.0-1039.39~20.04.1","5.15.0-1040.40~20.04.1","5.15.0-1041.41~20.04.1","5.15.0-1042.42~20.04.1","5.15.0-1043.43~20.04.1","5.15.0-1044.44~20.04.1","5.15.0-1045.45~20.04.1","5.15.0-1046.46~20.04.1","5.15.0-1047.47~20.04.1","5.15.0-1048.48~20.04.1","5.15.0-1049.49~20.04.1","5.15.0-1050.50~20.04.1","5.15.0-1051.51~20.04.1","5.15.0-1052.52~20.04.2","5.15.0-1053.53~20.04.1","5.15.0-1055.55~20.04.1","5.15.0-1057.57~20.04.1","5.15.0-1058.58~20.04.1","5.15.0-1060.60~20.04.1","5.15.0-1061.61~20.04.1","5.15.0-1063.63~20.04.1","5.15.0-1064.66~20.04.1","5.15.0-1065.67~20.04.1","5.15.0-1066.68~20.04.1","5.15.0-1067.69~20.04.1","5.15.0-1068.70~20.04.1","5.15.0-1070.72~20.04.1","5.15.0-1071.73~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.10.0-1008.9","5.10.0-1011.12","5.10.0-1013.14","5.10.0-1014.15","5.10.0-1016.17","5.10.0-1017.18","5.10.0-1019.20","5.10.0-1021.22","5.10.0-1022.23","5.10.0-1023.24","5.10.0-1025.26","5.10.0-1026.27","5.10.0-1029.30","5.10.0-1032.33","5.10.0-1033.34","5.10.0-1034.35","5.10.0-1038.40","5.10.0-1044.46","5.10.0-1045.47","5.10.0-1049.51","5.10.0-1050.52","5.10.0-1051.53","5.10.0-1052.54","5.10.0-1053.55","5.10.0-1055.58","5.10.0-1057.61"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10","5.13.0-1010.11","5.13.0-1012.16","5.13.0-1014.18","5.13.0-1017.21","5.13.0-1019.23","5.13.0-1020.24","5.13.0-1021.25","5.13.0-1022.26","5.13.0-1026.32","5.13.0-1028.35","5.13.0-1029.36"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.14.0-1004.4","5.14.0-1005.5","5.14.0-1007.7","5.14.0-1008.8","5.14.0-1010.10","5.14.0-1011.11","5.14.0-1013.13","5.14.0-1018.19","5.14.0-1020.22","5.14.0-1022.24","5.14.0-1024.26","5.14.0-1027.30","5.14.0-1029.32","5.14.0-1031.34","5.14.0-1032.35","5.14.0-1033.36","5.14.0-1034.37","5.14.0-1036.40","5.14.0-1038.42","5.14.0-1042.47","5.14.0-1044.49","5.14.0-1045.51","5.14.0-1046.53","5.14.0-1047.54","5.14.0-1048.55","5.14.0-1049.56","5.14.0-1050.57","5.14.0-1051.58","5.14.0-1052.59","5.14.0-1054.61","5.14.0-1055.62","5.14.0-1056.63","5.14.0-1057.64","5.14.0-1058.66","5.14.0-1059.67"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.6.0-1007.7","5.6.0-1008.8","5.6.0-1010.10","5.6.0-1011.11","5.6.0-1013.13","5.6.0-1017.17","5.6.0-1018.18","5.6.0-1020.20","5.6.0-1021.21","5.6.0-1023.23","5.6.0-1026.26","5.6.0-1027.27","5.6.0-1028.28","5.6.0-1031.32","5.6.0-1032.33","5.6.0-1033.35","5.6.0-1034.36","5.6.0-1035.37","5.6.0-1036.39","5.6.0-1039.43","5.6.0-1042.46","5.6.0-1047.51","5.6.0-1048.52","5.6.0-1050.54","5.6.0-1052.56","5.6.0-1053.57","5.6.0-1054.58","5.6.0-1055.59","5.6.0-1056.60"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1008.8~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1011.13~20.04.2","5.13.0-1015.19~20.04.1","5.13.0-1016.20~20.04.1","5.13.0-1018.22~20.04.1","5.13.0-1021.26~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1030.35~20.04.1","5.13.0-1033.39~20.04.1","5.13.0-1034.40~20.04.1","5.13.0-1036.43~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-oracle-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1007.9~20.04.1","5.15.0-1013.17~20.04.1","5.15.0-1016.20~20.04.1","5.15.0-1017.22~20.04.1","5.15.0-1018.23~20.04.1","5.15.0-1019.24~20.04.1","5.15.0-1021.27~20.04.1","5.15.0-1022.28~20.04.1","5.15.0-1025.31~20.04.2","5.15.0-1027.33~20.04.1","5.15.0-1029.35~20.04.1","5.15.0-1030.36~20.04.1","5.15.0-1032.38~20.04.1","5.15.0-1033.39~20.04.1","5.15.0-1034.40~20.04.1","5.15.0-1035.41~20.04.1","5.15.0-1036.42~20.04.1","5.15.0-1037.43~20.04.1","5.15.0-1038.44~20.04.1","5.15.0-1039.45~20.04.1","5.15.0-1040.46~20.04.1","5.15.0-1041.47~20.04.1","5.15.0-1042.48~20.04.1","5.15.0-1044.50~20.04.1","5.15.0-1045.51~20.04.1","5.15.0-1046.52~20.04.1","5.15.0-1047.53~20.04.1","5.15.0-1048.54~20.04.1","5.15.0-1049.55~20.04.1","5.15.0-1050.56~20.04.1","5.15.0-1051.57~20.04.1","5.15.0-1052.58~20.04.1","5.15.0-1053.59~20.04.1","5.15.0-1054.60~20.04.1","5.15.0-1055.61~20.04.1","5.15.0-1058.64~20.04.1","5.15.0-1059.65~20.04.1","5.15.0-1061.67~20.04.1","5.15.0-1062.68~20.04.1","5.15.0-1063.69~20.04.1","5.15.0-1065.71~20.04.1","5.15.0-1066.72~20.04.1","5.15.0-1067.73~20.04.1","5.15.0-1068.74~20.04.1","5.15.0-1069.75~20.04.1","5.15.0-1070.76~20.04.1","5.15.0-1071.77~20.04.1","5.15.0-1072.78~20.04.1","5.15.0-1073.79~20.04.1","5.15.0-1074.80~20.04.1","5.15.0-1075.81~20.04.1","5.15.0-1076.82~20.04.1","5.15.0-1077.83~20.04.1","5.15.0-1078.84~20.04.1","5.15.0-1079.85~20.04.1","5.15.0-1080.86~20.04.1","5.15.0-1081.87~20.04.1","5.15.0-1083.89~20.04.1","5.15.0-1084.90~20.04.1","5.15.0-1085.91~20.04.3","5.15.0-1086.92~20.04.1","5.15.0-1088.94~20.04.1","5.15.0-1090.96~20.04.1","5.15.0-1091.97~20.04.1","5.15.0-1092.98~20.04.1","5.15.0-1093.99~20.04.1","5.15.0-1094.100~20.04.1","5.15.0-1095.101~20.04.1","5.15.0-1096.102~20.04.1","5.15.0-1097.103~20.04.1","5.15.0-1098.104~20.04.1","5.15.0-1100.106~20.04.1","5.15.0-1101.107~20.04.1","5.15.0-1102.108~20.04.1","5.15.0-1104.110~20.04.1","5.15.0-1106.112~20.04.1","5.15.0-1108.114~20.04.1","5.15.0-1109.115~20.04.1","5.15.0-1110.116~20.04.1","5.15.0-1111.117~20.04.1","5.15.0-1114.120~20.04.1","5.15.0-1116.122~20.04.1","5.15.0-1117.123~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1031.32~20.04.2","5.8.0-1033.34~20.04.1","5.8.0-1034.35~20.04.2","5.8.0-1037.38~20.04.1","5.8.0-1038.39~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8","5.3.0-1014.16","5.3.0-1015.17","5.3.0-1017.19","5.4.0-1004.4","5.4.0-1006.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-24.28","5.4.0-26.30","5.4.0-27.31","5.4.0-28.32","5.4.0-30.34","5.4.0-31.35","5.4.0-33.37","5.4.0-34.38","5.4.0-36.41","5.4.0-37.42","5.4.0-39.44","5.4.0-40.45"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1018.19~20.04.2","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1024.25~20.04.1","5.11.0-1026.28~20.04.1","5.11.0-1028.31~20.04.1","5.11.0-1029.32~20.04.1","5.11.0-1030.34","5.11.0-1031.35"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-riscv-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1015.17~20.04.1","5.15.0-1017.19~20.04.1","5.15.0-1018.21~20.04.1","5.15.0-1019.22~20.04.1","5.15.0-1022.26~20.04.1","5.15.0-1023.27~20.04.1","5.15.0-1026.30~20.04.2","5.15.0-1027.31~20.04.1","5.15.0-1028.32~20.04.1","5.15.0-1029.33~20.04.1","5.15.0-1030.34~20.04.1","5.15.0-1031.35~20.04.1","5.15.0-1032.36~20.04.1","5.15.0-1033.37~20.04.1","5.15.0-1034.38~20.04.1","5.15.0-1035.39~20.04.1","5.15.0-1036.40~20.04.2","5.15.0-1037.41~20.04.2","5.15.0-1038.42~20.04.2","5.15.0-1039.43~20.04.2","5.15.0-1040.44~20.04.3","5.15.0-1041.45~20.04.1","5.15.0-1043.47~20.04.1","5.15.0-1044.48~20.04.1","5.15.0-1045.49~20.04.1","5.15.0-1046.50~20.04.1","5.15.0-1047.51~20.04.1","5.15.0-1048.52~20.04.1","5.15.0-1049.53~20.04.2","5.15.0-1050.54~20.04.1","5.15.0-1051.55~20.04.1","5.15.0-1052.56~20.04.1","5.15.0-1053.57~20.04.1","5.15.0-1056.60~20.04.1","5.15.0-1057.61~20.04.1","5.15.0-1058.62~20.04.1","5.15.0-1059.63~20.04.1","5.15.0-1060.64~20.04.1","5.15.0-1061.65~20.04.1","5.15.0-1062.66~20.04.1","5.15.0-1063.67~20.04.1","5.15.0-1064.68~20.04.1","5.15.0-1065.69~20.04.1","5.15.0-1066.70~20.04.1","5.15.0-1067.71~20.04.1","5.15.0-1068.72~20.04.1","5.15.0-1069.73~20.04.1","5.15.0-1070.74~20.04.1","5.15.0-1071.75~20.04.1","5.15.0-1072.76~20.04.1","5.15.0-1073.77~20.04.1","5.15.0-1074.78~20.04.1","5.15.0-1075.79~20.04.1","5.15.0-1076.80~20.04.1","5.15.0-1077.81~20.04.1","5.15.0-1078.82~20.04.1","5.15.0-1079.83~20.04.1","5.15.0-1081.85~20.04.1","5.15.0-1082.86~20.04.1","5.15.0-1083.87~20.04.1","5.15.0-1084.88~20.04.1","5.15.0-1085.89~20.04.1","5.15.0-1086.90~20.04.1","5.15.0-1087.91~20.04.1","5.15.0-1088.92~20.04.1","5.15.0-1090.94~20.04.1","5.15.0-1091.95~20.04.1","5.15.0-1092.96~20.04.1","5.15.0-1093.97~20.04.2","5.15.0-1094.98~20.04.1","5.15.0-1095.99~20.04.1","5.15.0-1096.100~20.04.1","5.15.0-1097.101~20.04.1","5.15.0-1098.102~20.04.1","5.15.0-1099.103~20.04.1","5.15.0-1100.104~20.04.1","5.15.0-1102.106~20.04.1","5.15.0-1103.107~20.04.1","5.15.0-1105.109~20.04.1","5.15.0-1106.110~20.04.1","5.15.0-1107.111~20.04.1","5.15.0-1108.112~20.04.1","5.15.0-1109.113~20.04.1","5.15.0-1110.114~20.04.1","5.15.0-1111.115~20.04.1","5.15.0-1113.117~20.04.2","5.15.0-1114.118~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-14.16~20.04.1","5.8.0-14.16~20.04.3","5.8.0-16.18~20.04.1","5.8.0-17.19~20.04.1","5.8.0-18.20~20.04.1","5.8.0-20.22~20.04.1","5.8.0-22.24~20.04.1","5.8.0-25.27~20.04.1","5.8.0-26.28~20.04.1","5.8.0-29.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-19.19","5.15.0-17.17","5.15.0-18.18","5.15.0-22.22","5.15.0-23.23","5.15.0-25.25","5.15.0-27.28","5.15.0-30.31","5.15.0-33.34","5.15.0-35.36","5.15.0-37.39","5.15.0-39.42","5.15.0-40.43","5.15.0-41.44","5.15.0-43.46","5.15.0-46.49","5.15.0-47.51","5.15.0-48.54","5.15.0-50.56","5.15.0-52.58","5.15.0-53.59","5.15.0-56.62","5.15.0-57.63","5.15.0-58.64","5.15.0-60.66","5.15.0-67.74","5.15.0-69.76","5.15.0-70.77","5.15.0-71.78","5.15.0-72.79","5.15.0-73.80","5.15.0-75.82","5.15.0-76.83","5.15.0-78.85","5.15.0-79.86","5.15.0-82.91","5.15.0-83.92","5.15.0-84.93","5.15.0-86.96","5.15.0-87.97","5.15.0-88.98","5.15.0-89.99","5.15.0-91.101","5.15.0-92.102","5.15.0-94.104","5.15.0-97.107","5.15.0-100.110","5.15.0-101.111","5.15.0-102.112","5.15.0-105.115","5.15.0-106.116","5.15.0-107.117","5.15.0-112.122","5.15.0-113.123","5.15.0-116.126","5.15.0-117.127","5.15.0-118.128","5.15.0-119.129","5.15.0-121.131","5.15.0-122.132","5.15.0-124.134","5.15.0-125.135","5.15.0-126.136","5.15.0-127.137","5.15.0-128.138","5.15.0-130.140","5.15.0-131.141","5.15.0-133.144","5.15.0-134.145","5.15.0-135.146","5.15.0-136.147","5.15.0-138.148","5.15.0-139.149","5.15.0-140.150","5.15.0-141.151","5.15.0-142.152","5.15.0-143.153","5.15.0-144.157","5.15.0-151.161","5.15.0-152.162","5.15.0-153.163","5.15.0-156.166","5.15.0-157.167","5.15.0-160.170","5.15.0-161.171","5.15.0-163.173","5.15.0-164.174","5.15.0-168.178","5.15.0-170.180","5.15.0-171.181","5.15.0-173.183","5.15.0-174.184","5.15.0-176.186","5.15.0-177.187","5.15.0-179.189","5.15.0-181.191","5.15.0-185.195","5.15.0-186.196","5.15.0-187.197","5.15.0-190.200","5.15.0-191.201","5.15.0-194.204","5.15.0-198.208","5.15.0-202.212","5.15.0-203.213"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-allwinner-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1007.7~22.04.1","5.19.0-1009.9~22.04.1","5.19.0-1010.10~22.04.1","5.19.0-1011.11~22.04.1","5.19.0-1012.12~22.04.1","5.19.0-1013.13~22.04.1","5.19.0-1014.14~22.04.1","5.19.0-1015.15~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1005.6","5.15.0-1002.4","5.15.0-1003.5","5.15.0-1004.6","5.15.0-1005.7","5.15.0-1008.10","5.15.0-1009.11","5.15.0-1011.14","5.15.0-1013.17","5.15.0-1014.18","5.15.0-1015.19","5.15.0-1017.21","5.15.0-1019.23","5.15.0-1020.24","5.15.0-1021.25","5.15.0-1022.26","5.15.0-1023.27","5.15.0-1026.30","5.15.0-1027.31","5.15.0-1028.32","5.15.0-1030.34","5.15.0-1031.35","5.15.0-1033.37","5.15.0-1034.38","5.15.0-1035.39","5.15.0-1036.40","5.15.0-1037.41","5.15.0-1038.43","5.15.0-1039.44","5.15.0-1040.45","5.15.0-1042.47","5.15.0-1043.48","5.15.0-1044.49","5.15.0-1045.50","5.15.0-1047.52","5.15.0-1048.53","5.15.0-1049.54","5.15.0-1050.55","5.15.0-1051.56","5.15.0-1052.57","5.15.0-1053.58","5.15.0-1055.60","5.15.0-1056.61","5.15.0-1057.63","5.15.0-1060.66","5.15.0-1061.67","5.15.0-1062.68","5.15.0-1063.69","5.15.0-1064.70","5.15.0-1065.71","5.15.0-1066.72","5.15.0-1067.73","5.15.0-1068.74","5.15.0-1069.75","5.15.0-1070.76","5.15.0-1071.77","5.15.0-1072.78","5.15.0-1073.79","5.15.0-1076.83","5.15.0-1078.85","5.15.0-1079.86","5.15.0-1080.87","5.15.0-1081.88","5.15.0-1082.89","5.15.0-1083.90","5.15.0-1084.91","5.15.0-1085.92","5.15.0-1086.93","5.15.0-1087.94","5.15.0-1088.95","5.15.0-1089.96","5.15.0-1090.97","5.15.0-1091.98","5.15.0-1092.99","5.15.0-1093.100","5.15.0-1095.102","5.15.0-1096.103","5.15.0-1097.104","5.15.0-1098.105","5.15.0-1099.106","5.15.0-1100.107","5.15.0-1101.108","5.15.0-1103.110","5.15.0-1104.111","5.15.0-1105.112","5.15.0-1106.113","5.15.0-1108.115","5.15.0-1109.116","5.15.0-1111.118","5.15.0-1112.119","5.15.0-1113.120","5.15.0-1114.121","5.15.0-1115.122","5.15.0-1116.123","5.15.0-1117.124","5.15.0-1119.126","5.15.0-1120.127"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1019.20~22.04.1","5.19.0-1020.21~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1026.27~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1029.30~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1008.8~22.04.1","6.5.0-1010.10~22.04.1","6.5.0-1011.11~22.04.1","6.5.0-1012.12~22.04.1","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.2","6.5.0-1018.18~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1021.21~22.04.1","6.5.0-1022.22~22.04.1","6.5.0-1023.23~22.04.1","6.5.0-1024.24~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1050.53~22.04.1"}]}],"versions":["6.8.0-1009.9~22.04.2","6.8.0-1010.10~22.04.2","6.8.0-1011.12~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.15~22.04.1","6.8.0-1015.16~22.04.1","6.8.0-1016.17~22.04.2","6.8.0-1017.18~22.04.1","6.8.0-1018.19~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1023.25~22.04.1","6.8.0-1024.26~22.04.1","6.8.0-1027.29~22.04.1","6.8.0-1028.30~22.04.1","6.8.0-1029.31~22.04.1","6.8.0-1030.32~22.04.1","6.8.0-1031.33~22.04.1","6.8.0-1032.34~22.04.1","6.8.0-1033.35~22.04.1","6.8.0-1035.37~22.04.1","6.8.0-1036.38~22.04.1","6.8.0-1039.41~22.04.1","6.8.0-1040.42~22.04.1","6.8.0-1041.43~22.04.1","6.8.0-1042.44~22.04.1","6.8.0-1043.45~22.04.1","6.8.0-1044.46~22.04.1","6.8.0-1045.47~22.04.1","6.8.0-1046.49~22.04.1","6.8.0-1047.50~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1006.7","5.15.0-1001.2","5.15.0-1002.3","5.15.0-1003.4","5.15.0-1005.6","5.15.0-1007.8","5.15.0-1008.9","5.15.0-1010.12","5.15.0-1012.15","5.15.0-1013.16","5.15.0-1014.17","5.15.0-1017.20","5.15.0-1019.24","5.15.0-1020.25","5.15.0-1021.26","5.15.0-1022.27","5.15.0-1023.29","5.15.0-1024.30","5.15.0-1029.36","5.15.0-1030.37","5.15.0-1031.38","5.15.0-1033.40","5.15.0-1034.41","5.15.0-1035.42","5.15.0-1036.43","5.15.0-1037.44","5.15.0-1038.45","5.15.0-1039.46","5.15.0-1040.47","5.15.0-1041.48","5.15.0-1042.49","5.15.0-1044.51","5.15.0-1045.52","5.15.0-1046.53","5.15.0-1047.54","5.15.0-1049.56","5.15.0-1050.57","5.15.0-1051.59","5.15.0-1052.60","5.15.0-1053.61","5.15.0-1054.62","5.15.0-1056.64","5.15.0-1057.65","5.15.0-1058.66","5.15.0-1059.67","5.15.0-1060.69","5.15.0-1061.70","5.15.0-1063.72","5.15.0-1064.73","5.15.0-1066.75","5.15.0-1067.76","5.15.0-1068.77","5.15.0-1070.79","5.15.0-1071.80","5.15.0-1072.81","5.15.0-1073.82","5.15.0-1074.83","5.15.0-1075.84","5.15.0-1078.87","5.15.0-1079.88","5.15.0-1081.90","5.15.0-1082.91","5.15.0-1084.93","5.15.0-1086.95","5.15.0-1087.96","5.15.0-1088.97","5.15.0-1089.98","5.15.0-1090.99","5.15.0-1091.100","5.15.0-1092.101","5.15.0-1094.103","5.15.0-1095.104","5.15.0-1096.105","5.15.0-1097.106","5.15.0-1098.107","5.15.0-1099.108","5.15.0-1101.110","5.15.0-1102.111","5.15.0-1103.112","5.15.0-1109.118","5.15.0-1110.119","5.15.0-1111.120","5.15.0-1114.123","5.15.0-1116.125","5.15.0-1117.126","5.15.0-1118.127","5.15.0-1119.128","5.15.0-1121.130","5.15.0-1122.131","5.15.0-1123.132","5.15.0-1125.134","5.15.0-1126.135"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.21~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1025.28~22.04.1","5.19.0-1026.29~22.04.1","5.19.0-1027.30~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1","6.2.0-1019.19~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.7~22.04.1","6.5.0-1009.9~22.04.1","6.5.0-1010.10~22.04.1","6.5.0-1011.11~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.1","6.5.0-1018.19~22.04.2","6.5.0-1019.20~22.04.1","6.5.0-1021.22~22.04.1","6.5.0-1022.23~22.04.1","6.5.0-1023.24~22.04.1","6.5.0-1024.25~22.04.1","6.5.0-1025.26~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1051.57~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1009.9~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1012.14~22.04.1","6.8.0-1013.15~22.04.1","6.8.0-1014.16~22.04.1","6.8.0-1015.17~22.04.2","6.8.0-1017.20~22.04.1","6.8.0-1018.21~22.04.1","6.8.0-1020.23~22.04.1","6.8.0-1021.25~22.04.1","6.8.0-1025.30~22.04.1","6.8.0-1026.31~22.04.1","6.8.0-1027.32~22.04.1","6.8.0-1028.33~22.04.1","6.8.0-1029.34~22.04.1","6.8.0-1030.35~22.04.1","6.8.0-1031.36~22.04.1","6.8.0-1034.39~22.04.1","6.8.0-1036.42~22.04.1","6.8.0-1040.46~22.04.1","6.8.0-1041.47~22.04.1","6.8.0-1044.50~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1019.24.1","5.15.0-1024.30.1","5.15.0-1029.36.1","5.15.0-1030.37.1","5.15.0-1031.38.1","5.15.0-1033.40.1","5.15.0-1034.41.1","5.15.0-1035.42.1","5.15.0-1036.43.1","5.15.0-1037.44.1","5.15.0-1038.45.1","5.15.0-1039.46.1","5.15.0-1041.48.1","5.15.0-1042.49.1","5.15.0-1044.51.1","5.15.0-1045.52.1","5.15.0-1046.53.1","5.15.0-1047.54.1","5.15.0-1049.56.1","5.15.0-1050.57.1","5.15.0-1051.59.1","5.15.0-1052.60.1","5.15.0-1053.61.1","5.15.0-1054.62.1","5.15.0-1056.64.1","5.15.0-1057.65.1","5.15.0-1058.66.1","5.15.0-1059.67.1","5.15.0-1060.69.1","5.15.0-1061.70.1","5.15.0-1063.72.1","5.15.0-1064.73.1","5.15.0-1065.74.1","5.15.0-1067.76.1","5.15.0-1068.77.1","5.15.0-1070.79.1","5.15.0-1071.80.1","5.15.0-1072.81.1","5.15.0-1073.82.1","5.15.0-1076.85.1","5.15.0-1078.87.1","5.15.0-1081.90.1","5.15.0-1082.91.1","5.15.0-1084.93.1","5.15.0-1086.95.1","5.15.0-1087.96.1","5.15.0-1088.97.1","5.15.0-1089.98.1","5.15.0-1090.99.1","5.15.0-1091.100.1","5.15.0-1092.101.1","5.15.0-1094.103.1","5.15.0-1095.104.1","5.15.0-1096.105.1","5.15.0-1097.106.1","5.15.0-1098.107.1","5.15.0-1102.111.1","5.15.0-1109.118.1","5.15.0-1110.119.1","5.15.0-1111.120.1","5.15.0-1114.123","5.15.0-1116.125","5.15.0-1117.126","5.15.0-1118.127","5.15.0-1119.128","5.15.0-1120.129","5.15.0-1121.130","5.15.0-1122.131","5.15.0-1124.133","5.15.0-1125.134"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1025.28~22.04.1.1","5.19.0-1026.29~22.04.1.1","5.19.0-1027.30~22.04.2.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1.1","6.2.0-1009.9~22.04.3.1","6.2.0-1011.11~22.04.1.1","6.2.0-1012.12~22.04.1.1","6.2.0-1014.14~22.04.1.1","6.2.0-1015.15~22.04.1.1","6.2.0-1016.16~22.04.1.1","6.2.0-1017.17~22.04.1.1","6.2.0-1018.18~22.04.1.1","6.2.0-1019.19~22.04.1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1058.65~22.04.1"}]}],"versions":["6.8.0-1041.48~22.04.1","6.8.0-1042.49~22.04.1","6.8.0-1044.51~22.04.1","6.8.0-1046.53~22.04.1","6.8.0-1053.60~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1005.6","5.15.0-1001.3","5.15.0-1002.5","5.15.0-1003.6","5.15.0-1004.7","5.15.0-1005.8","5.15.0-1006.9","5.15.0-1008.12","5.15.0-1010.15","5.15.0-1013.18","5.15.0-1016.21","5.15.0-1017.23","5.15.0-1018.24","5.15.0-1019.25","5.15.0-1021.28","5.15.0-1022.29","5.15.0-1025.32","5.15.0-1026.33","5.15.0-1027.34","5.15.0-1029.36","5.15.0-1030.37","5.15.0-1031.38","5.15.0-1032.40","5.15.0-1034.42","5.15.0-1035.43","5.15.0-1036.44","5.15.0-1037.45","5.15.0-1038.46","5.15.0-1039.47","5.15.0-1040.48","5.15.0-1041.49","5.15.0-1042.50","5.15.0-1044.52","5.15.0-1045.53","5.15.0-1046.54","5.15.0-1047.55","5.15.0-1048.56","5.15.0-1049.57","5.15.0-1051.59","5.15.0-1052.60","5.15.0-1053.61","5.15.0-1054.62","5.15.0-1055.63","5.15.0-1058.66","5.15.0-1059.67","5.15.0-1060.68","5.15.0-1062.70","5.15.0-1063.71","5.15.0-1064.72","5.15.0-1065.73","5.15.0-1066.74","5.15.0-1067.75","5.15.0-1068.76","5.15.0-1069.77","5.15.0-1070.78","5.15.0-1071.79","5.15.0-1072.80","5.15.0-1073.81","5.15.0-1074.83","5.15.0-1075.84","5.15.0-1077.86","5.15.0-1078.87","5.15.0-1079.88","5.15.0-1080.89","5.15.0-1081.90","5.15.0-1082.91","5.15.0-1083.92","5.15.0-1084.93","5.15.0-1085.94","5.15.0-1086.95","5.15.0-1087.96","5.15.0-1088.97","5.15.0-1090.99","5.15.0-1091.100","5.15.0-1092.101","5.15.0-1093.102","5.15.0-1095.104","5.15.0-1096.105","5.15.0-1097.106","5.15.0-1098.107","5.15.0-1099.108","5.15.0-1100.109","5.15.0-1101.110","5.15.0-1103.112","5.15.0-1104.113","5.15.0-1105.114","5.15.0-1106.115","5.15.0-1108.117","5.15.0-1109.118","5.15.0-1111.121","5.15.0-1112.122","5.15.0-1114.124","5.15.0-1115.125","5.15.0-1117.127","5.15.0-1118.128","5.15.0-1120.130","5.15.0-1121.131"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.22~22.04.2","5.19.0-1021.23~22.04.1","5.19.0-1022.24~22.04.1","5.19.0-1024.26~22.04.1","5.19.0-1025.27~22.04.1","5.19.0-1026.28~22.04.1","5.19.0-1027.29~22.04.1","5.19.0-1030.32~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1011.11~22.04.3","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1016.18~22.04.1","6.2.0-1017.19~22.04.1","6.2.0-1018.20~22.04.1","6.2.0-1019.21~22.04.1","6.2.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1010.10~22.04.3","6.5.0-1011.11~22.04.1","6.5.0-1013.13~22.04.1","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.1","6.5.0-1018.18~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1022.24~22.04.1","6.5.0-1023.25~22.04.1","6.5.0-1024.26~22.04.1","6.5.0-1025.27~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1052.55~22.04.1"}]}],"versions":["6.8.0-1010.11~22.04.1","6.8.0-1011.12~22.04.1","6.8.0-1012.13~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.16~22.04.1","6.8.0-1015.17~22.04.1","6.8.0-1016.18~22.04.1","6.8.0-1017.19~22.04.1","6.8.0-1018.20~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1024.26~22.04.1","6.8.0-1025.27~22.04.1","6.8.0-1026.28~22.04.1","6.8.0-1027.29~22.04.1","6.8.0-1028.30~22.04.1","6.8.0-1029.31~22.04.1","6.8.0-1030.32~22.04.1","6.8.0-1031.33~22.04.1","6.8.0-1032.34~22.04.1","6.8.0-1033.35~22.04.1","6.8.0-1034.36~22.04.2","6.8.0-1036.38~22.04.1","6.8.0-1037.39~22.04.1","6.8.0-1040.42~22.04.1","6.8.0-1041.43~22.04.1","6.8.0-1042.45~22.04.1","6.8.0-1043.46~22.04.1","6.8.0-1044.47~22.04.1","6.8.0-1045.48~22.04.1","6.8.0-1046.49~22.04.1","6.8.0-1047.50~22.04.2","6.8.0-1048.51~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1002.2","5.15.0-1003.3","5.15.0-1004.5","5.15.0-1005.6","5.15.0-1006.7","5.15.0-1008.10","5.15.0-1010.13","5.15.0-1011.14","5.15.0-1014.17","5.15.0-1015.18","5.15.0-1016.19","5.15.0-1017.20","5.15.0-1019.23","5.15.0-1020.25","5.15.0-1023.28","5.15.0-1024.29","5.15.0-1027.32","5.15.0-1028.33","5.15.0-1030.35","5.15.0-1031.36","5.15.0-1032.37","5.15.0-1033.38","5.15.0-1034.39","5.15.0-1035.40","5.15.0-1036.41","5.15.0-1037.42","5.15.0-1038.43","5.15.0-1039.44","5.15.0-1040.45","5.15.0-1041.46","5.15.0-1042.47","5.15.0-1044.49","5.15.0-1045.50","5.15.0-1046.51","5.15.0-1047.52","5.15.0-1048.53","5.15.0-1049.54","5.15.0-1050.55","5.15.0-1051.56","5.15.0-1052.57","5.15.0-1053.58","5.15.0-1054.59","5.15.0-1057.62","5.15.0-1058.63","5.15.0-1059.64","5.15.0-1060.66","5.15.0-1061.67","5.15.0-1062.68","5.15.0-1063.69","5.15.0-1064.70","5.15.0-1065.71","5.15.0-1066.72","5.15.0-1067.73","5.15.0-1068.74","5.15.0-1069.75","5.15.0-1070.76","5.15.0-1071.77","5.15.0-1072.78","5.15.0-1073.79","5.15.0-1075.81","5.15.0-1076.82","5.15.0-1077.83","5.15.0-1078.84","5.15.0-1079.85","5.15.0-1080.86","5.15.0-1081.87","5.15.0-1082.88","5.15.0-1083.89","5.15.0-1084.90","5.15.0-1085.91","5.15.0-1086.92","5.15.0-1087.93","5.15.0-1088.94","5.15.0-1089.95","5.15.0-1090.96","5.15.0-1091.97","5.15.0-1092.98","5.15.0-1093.99","5.15.0-1094.100","5.15.0-1095.101","5.15.0-1096.102","5.15.0-1097.103","5.15.0-1099.105","5.15.0-1100.106","5.15.0-1101.107","5.15.0-1102.108","5.15.0-1104.110","5.15.0-1105.111","5.15.0-1107.113","5.15.0-1108.114","5.15.0-1110.116","5.15.0-1111.117","5.15.0-1112.118","5.15.0-1113.119","5.15.0-1115.121","5.15.0-1116.122"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1001.2","5.15.0-1002.4","5.15.0-1003.5","5.15.0-1004.6","5.15.0-1005.7","5.15.0-1007.10","5.15.0-1008.12","5.15.0-1011.15","5.15.0-1012.16","5.15.0-1013.17","5.15.0-1015.19","5.15.0-1016.21","5.15.0-1017.22","5.15.0-1018.23","5.15.0-1019.24","5.15.0-1020.25","5.15.0-1021.26","5.15.0-1022.27","5.15.0-1023.28","5.15.0-1024.29","5.15.0-1025.30","5.15.0-1026.31","5.15.0-1027.32","5.15.0-1028.33","5.15.0-1030.35","5.15.0-1031.37","5.15.0-1032.38","5.15.0-1033.39","5.15.0-1034.40","5.15.0-1035.41","5.15.0-1036.42","5.15.0-1037.43","5.15.0-1038.44","5.15.0-1039.45","5.15.0-1040.46","5.15.0-1043.50","5.15.0-1044.51","5.15.0-1045.52","5.15.0-1046.53","5.15.0-1047.54","5.15.0-1048.55","5.15.0-1049.56","5.15.0-1050.57","5.15.0-1051.58","5.15.0-1052.59","5.15.0-1053.60","5.15.0-1054.61","5.15.0-1055.62","5.15.0-1056.63","5.15.0-1057.64","5.15.0-1058.66","5.15.0-1059.67","5.15.0-1060.68","5.15.0-1061.69","5.15.0-1062.70","5.15.0-1063.71","5.15.0-1064.72","5.15.0-1065.73","5.15.0-1066.74","5.15.0-1067.75","5.15.0-1068.76","5.15.0-1069.77","5.15.0-1070.78","5.15.0-1071.79","5.15.0-1073.81","5.15.0-1074.82","5.15.0-1075.83","5.15.0-1076.84","5.15.0-1078.86","5.15.0-1079.87","5.15.0-1080.88","5.15.0-1081.89","5.15.0-1082.90","5.15.0-1083.91","5.15.0-1084.92","5.15.0-1086.94","5.15.0-1087.95","5.15.0-1088.96","5.15.0-1089.97","5.15.0-1091.99","5.15.0-1092.100","5.15.0-1094.102","5.15.0-1095.103","5.15.0-1096.104","5.15.0-1097.105","5.15.0-1098.106","5.15.0-1099.107","5.15.0-1100.108","5.15.0-1102.110","5.15.0-1103.111"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-28.29~22.04.1","5.19.0-32.33~22.04.1","5.19.0-35.36~22.04.1","5.19.0-38.39~22.04.1","5.19.0-40.41~22.04.1","5.19.0-41.42~22.04.1","5.19.0-42.43~22.04.1","5.19.0-43.44~22.04.1","5.19.0-45.46~22.04.1","5.19.0-46.47~22.04.1","5.19.0-50.50"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-25.25~22.04.2","6.2.0-26.26~22.04.1","6.2.0-31.31~22.04.1","6.2.0-32.32~22.04.1","6.2.0-33.33~22.04.1","6.2.0-34.34~22.04.1","6.2.0-35.35~22.04.1","6.2.0-36.37~22.04.1","6.2.0-37.38~22.04.1","6.2.0-39.40~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-14.14~22.04.1","6.5.0-15.15~22.04.1","6.5.0-17.17~22.04.1","6.5.0-18.18~22.04.1","6.5.0-21.21~22.04.1","6.5.0-25.25~22.04.1","6.5.0-26.26~22.04.1","6.5.0-27.28~22.04.1","6.5.0-28.29~22.04.1","6.5.0-35.35~22.04.1","6.5.0-41.41~22.04.2","6.5.0-44.44~22.04.1","6.5.0-45.45~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-106.106~22.04.1"}]}],"versions":["6.8.0-38.38~22.04.1","6.8.0-39.39~22.04.1","6.8.0-40.40~22.04.3","6.8.0-45.45~22.04.1","6.8.0-47.47~22.04.1","6.8.0-48.48~22.04.1","6.8.0-49.49~22.04.1","6.8.0-50.51~22.04.1","6.8.0-51.52~22.04.1","6.8.0-52.53~22.04.1","6.8.0-57.59~22.04.1","6.8.0-58.60~22.04.1","6.8.0-59.61~22.04.1","6.8.0-60.63~22.04.1","6.8.0-64.67~22.04.1","6.8.0-65.68~22.04.1","6.8.0-78.78~22.04.1","6.8.0-79.79~22.04.1","6.8.0-83.83~22.04.1","6.8.0-84.84~22.04.1","6.8.0-85.85~22.04.1","6.8.0-86.87~22.04.1","6.8.0-87.88~22.04.1","6.8.0-88.89~22.04.2","6.8.0-90.91~22.04.1","6.8.0-94.96~22.04.1","6.8.0-100.100~22.04.1","6.8.0-101.101~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1002.2","5.15.0-1003.3","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1007.8","5.15.0-1009.11","5.15.0-1010.12","5.15.0-1012.14","5.15.0-1013.15","5.15.0-1015.17","5.15.0-1017.20","5.15.0-1018.21","5.15.0-1021.24","5.15.0-1022.25","5.15.0-1023.26","5.15.0-1025.28","5.15.0-1026.29","5.15.0-1027.30","5.15.0-1028.31","5.15.0-1029.32","5.15.0-1030.33","5.15.0-1031.34","5.15.0-1032.35","5.15.0-1033.36","5.15.0-1034.37","5.15.0-1035.38","5.15.0-1036.39","5.15.0-1037.40","5.15.0-1038.41","5.15.0-1040.43","5.15.0-1041.44","5.15.0-1042.45","5.15.0-1043.46","5.15.0-1044.47","5.15.0-1045.48","5.15.0-1046.49","5.15.0-1047.50","5.15.0-1048.51","5.15.0-1049.52","5.15.0-1050.53","5.15.0-1053.56","5.15.0-1054.57","5.15.0-1055.58","5.15.0-1056.59","5.15.0-1057.60","5.15.0-1058.61","5.15.0-1059.62","5.15.0-1060.63","5.15.0-1061.64","5.15.0-1062.65","5.15.0-1063.66","5.15.0-1064.67","5.15.0-1065.68","5.15.0-1066.69","5.15.0-1067.70","5.15.0-1068.71","5.15.0-1069.72","5.15.0-1070.73","5.15.0-1071.74","5.15.0-1072.75","5.15.0-1073.76","5.15.0-1074.77","5.15.0-1075.78","5.15.0-1076.79","5.15.0-1077.80","5.15.0-1078.81","5.15.0-1079.82","5.15.0-1080.83","5.15.0-1081.84","5.15.0-1084.87","5.15.0-1085.88","5.15.0-1086.89","5.15.0-1087.90","5.15.0-1089.92","5.15.0-1090.93","5.15.0-1091.94","5.15.0-1092.95","5.15.0-1093.96","5.15.0-1094.97","5.15.0-1095.98","5.15.0-1097.100","5.15.0-1098.101","5.15.0-1099.102","5.15.0-1100.103","5.15.0-1102.105","5.15.0-1103.106","5.15.0-1105.109","5.15.0-1106.110","5.15.0-1107.111","5.15.0-1108.112","5.15.0-1109.113","5.15.0-1110.114","5.15.0-1111.115","5.15.0-1113.117","5.15.0-1114.118"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-ibm-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1049.49~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.13~22.04.1","6.8.0-1014.14~22.04.1","6.8.0-1015.15~22.04.1","6.8.0-1016.16~22.04.1","6.8.0-1017.17~22.04.1","6.8.0-1018.18~22.04.1","6.8.0-1019.19~22.04.1","6.8.0-1023.23~22.04.1","6.8.0-1024.24~22.04.1","6.8.0-1025.25~22.04.1","6.8.0-1026.26~22.04.1","6.8.0-1027.27~22.04.1","6.8.0-1028.28~22.04.1","6.8.0-1029.29~22.04.1","6.8.0-1030.30~22.04.1","6.8.0-1033.33~22.04.1","6.8.0-1036.36~22.04.1","6.8.0-1037.37~22.04.1","6.8.0-1038.38~22.04.1","6.8.0-1039.39~22.04.1","6.8.0-1040.40~22.04.1","6.8.0-1041.41~22.04.1","6.8.0-1042.42~22.04.1","6.8.0-1043.43~22.04.1","6.8.0-1044.44~22.04.1","6.8.0-1045.45~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-intel-iot-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1073.75"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-intel-iotg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1004.6","5.15.0-1008.11","5.15.0-1010.14","5.15.0-1013.17","5.15.0-1015.20","5.15.0-1016.21","5.15.0-1017.22","5.15.0-1018.23","5.15.0-1021.26","5.15.0-1023.28","5.15.0-1025.30","5.15.0-1026.31","5.15.0-1027.32","5.15.0-1028.33","5.15.0-1030.35","5.15.0-1031.36","5.15.0-1033.38","5.15.0-1034.39","5.15.0-1035.40","5.15.0-1036.41","5.15.0-1037.42","5.15.0-1038.43","5.15.0-1039.45","5.15.0-1040.46","5.15.0-1043.49","5.15.0-1045.51","5.15.0-1046.52","5.15.0-1047.53","5.15.0-1048.54","5.15.0-1049.55","5.15.0-1050.56","5.15.0-1051.57","5.15.0-1052.58","5.15.0-1055.61","5.15.0-1057.63","5.15.0-1058.64","5.15.0-1059.65","5.15.0-1060.66","5.15.0-1061.67","5.15.0-1062.68","5.15.0-1063.69","5.15.0-1064.70","5.15.0-1065.71","5.15.0-1066.72","5.15.0-1067.73","5.15.0-1071.77","5.15.0-1072.78","5.15.0-1073.79","5.15.0-1074.80","5.15.0-1075.81","5.15.0-1076.82","5.15.0-1077.83","5.15.0-1078.84","5.15.0-1079.85","5.15.0-1080.86","5.15.0-1081.87","5.15.0-1082.88","5.15.0-1083.89","5.15.0-1084.90","5.15.0-1085.91","5.15.0-1086.92","5.15.0-1087.93","5.15.0-1088.94","5.15.0-1090.96","5.15.0-1091.97","5.15.0-1092.98","5.15.0-1093.99","5.15.0-1094.100","5.15.0-1095.101","5.15.0-1096.102","5.15.0-1098.104","5.15.0-1099.105","5.15.0-1100.106","5.15.0-1101.107","5.15.0-1103.109","5.15.0-1104.110","5.15.0-1106.112","5.15.0-1107.113","5.15.0-1108.114","5.15.0-1109.115","5.15.0-1110.116","5.15.0-1111.117","5.15.0-1112.118","5.15.0-1114.120","5.15.0-1115.121"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1004.4","5.13.0-1006.6+22.04.1","5.13.0-1007.7+22.04.1","5.13.0-1010.11+22.04.1","5.15.0-1002.2","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1007.7","5.15.0-1008.8","5.15.0-1010.11","5.15.0-1012.14","5.15.0-1013.16","5.15.0-1016.19","5.15.0-1017.21","5.15.0-1018.22","5.15.0-1019.23","5.15.0-1020.24","5.15.0-1021.26","5.15.0-1024.29","5.15.0-1025.30","5.15.0-1026.31","5.15.0-1028.33","5.15.0-1029.34","5.15.0-1030.35","5.15.0-1031.36","5.15.0-1032.37","5.15.0-1033.38","5.15.0-1034.39","5.15.0-1035.40","5.15.0-1037.42","5.15.0-1038.43","5.15.0-1039.44","5.15.0-1040.45","5.15.0-1041.46","5.15.0-1042.47","5.15.0-1044.49","5.15.0-1045.50","5.15.0-1046.51","5.15.0-1047.52","5.15.0-1048.53","5.15.0-1049.54","5.15.0-1050.55","5.15.0-1051.56","5.15.0-1052.57","5.15.0-1053.58","5.15.0-1054.59","5.15.0-1057.62","5.15.0-1058.63","5.15.0-1059.64","5.15.0-1060.65","5.15.0-1061.66","5.15.0-1062.67","5.15.0-1063.68","5.15.0-1064.69","5.15.0-1065.70","5.15.0-1066.71","5.15.0-1067.72","5.15.0-1068.73","5.15.0-1069.74","5.15.0-1070.75","5.15.0-1071.76","5.15.0-1072.77","5.15.0-1073.78","5.15.0-1076.81","5.15.0-1077.82","5.15.0-1078.83","5.15.0-1079.84","5.15.0-1080.85","5.15.0-1081.86","5.15.0-1082.87","5.15.0-1083.88","5.15.0-1084.89","5.15.0-1085.90","5.15.0-1086.91","5.15.0-1087.92","5.15.0-1088.93","5.15.0-1089.94","5.15.0-1090.95","5.15.0-1091.96","5.15.0-1092.97","5.15.0-1093.98","5.15.0-1095.100","5.15.0-1096.101","5.15.0-1097.102","5.15.0-1098.103","5.15.0-1100.105","5.15.0-1101.106","5.15.0-1103.108","5.15.0-1104.109","5.15.0-1105.110","5.15.0-1106.111","5.15.0-1107.112","5.15.0-1108.113","5.15.0-1109.114","5.15.0-1111.116","5.15.0-1112.117"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-22.22","5.15.0-23.23","5.15.0-24.24","5.15.0-27.28","5.15.0-30.31","5.15.0-33.34","5.15.0-35.36","5.15.0-37.39","5.15.0-39.42","5.15.0-40.43","5.15.0-41.44","5.15.0-43.46","5.15.0-46.49","5.15.0-47.53","5.15.0-48.54","5.15.0-50.56","5.15.0-52.58","5.15.0-53.59","5.15.0-56.62","5.15.0-57.63","5.15.0-58.64","5.15.0-60.66","5.15.0-67.74","5.15.0-69.76","5.15.0-70.77","5.15.0-71.78","5.15.0-72.79","5.15.0-73.80","5.15.0-75.82","5.15.0-76.83","5.15.0-78.85","5.15.0-79.88","5.15.0-82.91","5.15.0-83.92","5.15.0-84.93","5.15.0-86.95","5.15.0-87.96","5.15.0-88.98","5.15.0-89.99","5.15.0-91.101","5.15.0-92.102","5.15.0-94.104","5.15.0-97.107","5.15.0-100.110","5.15.0-101.111","5.15.0-102.112","5.15.0-105.115","5.15.0-106.116","5.15.0-107.117","5.15.0-110.120","5.15.0-113.123","5.15.0-116.126","5.15.0-117.127","5.15.0-118.128","5.15.0-119.129","5.15.0-121.131","5.15.0-122.132","5.15.0-124.134","5.15.0-125.135","5.15.0-126.136","5.15.0-127.137","5.15.0-128.138","5.15.0-129.139","5.15.0-131.141","5.15.0-133.143","5.15.0-134.145","5.15.0-135.146","5.15.0-136.147","5.15.0-138.148","5.15.0-139.149","5.15.0-140.150","5.15.0-141.151","5.15.0-142.152","5.15.0-143.153","5.15.0-144.157","5.15.0-145.158","5.15.0-152.162","5.15.0-153.163","5.15.0-156.166","5.15.0-157.167","5.15.0-160.170","5.15.0-161.171","5.15.0-163.173","5.15.0-164.174","5.15.0-168.178","5.15.0-170.180","5.15.0-171.181","5.15.0-173.183","5.15.0-174.184","5.15.0-175.185","5.15.0-177.187","5.15.0-178.188","5.15.0-179.189","5.15.0-181.191","5.15.0-183.193","5.15.0-184.194","5.15.0-190.200","5.15.0-191.201","5.15.0-194.204","5.15.0-195.205","5.15.0-197.207","5.15.0-198.208"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1030.30"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-14.14.1~22.04.1","6.5.0-15.15.1.1~22.04.1","6.5.0-17.17.1.1.1~22.04.1","6.5.0-21.21.1~22.04.1","6.5.0-25.25.1~22.04.1","6.5.0-26.26.1~22.04.1","6.5.0-27.28.1~22.04.1","6.5.0-28.29.1~22.04.1","6.5.0-35.35.1~22.04.1","6.5.0-41.41.1~22.04.1","6.5.0-42.42.1~22.04.1","6.5.0-44.44.1~22.04.1","6.5.0-45.45.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-106.106.1~22.04.1"}]}],"versions":["6.8.0-38.38.1~22.04.2","6.8.0-40.40.1~22.04.1","6.8.0-44.44.1~22.04.1","6.8.0-45.45.1~22.04.1","6.8.0-47.47.1~22.04.1","6.8.0-48.48.3~22.04.1","6.8.0-49.49.1~22.04.1","6.8.0-50.51.1~22.04.1","6.8.0-51.52.1~22.04.1","6.8.0-52.53.1~22.04.1","6.8.0-54.56.1~22.04.1","6.8.0-55.57.1~22.04.1","6.8.0-56.58.1~22.04.1","6.8.0-57.59.1~22.04.1","6.8.0-58.60.1~22.04.1","6.8.0-59.61.1~22.04.1","6.8.0-60.63.1~22.04.1","6.8.0-62.65.1~22.04.1","6.8.0-63.66.1~22.04.1","6.8.0-64.67.1~22.04.1","6.8.0-65.68.1~22.04.1","6.8.0-78.78.1~22.04.1","6.8.0-79.79.1~22.04.1","6.8.0-83.83.1~22.04.1","6.8.0-84.84.1~22.04.1","6.8.0-85.85.1~22.04.1","6.8.0-86.87.1~22.04.1","6.8.0-87.88.1~22.04.1","6.8.0-88.89.1~22.04.1","6.8.0-90.91.1~22.04.1","6.8.0-94.96.1~22.04.1","6.8.0-100.100.1~22.04.1","6.8.0-101.101.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1005.5","5.15.0-1007.7","5.15.0-1010.10","5.15.0-1015.15","5.15.0-1017.17","5.15.0-1018.18","5.15.0-1023.23","5.15.0-1025.25","5.15.0-1026.26","5.15.0-1027.27","5.15.0-1028.28","5.15.0-1029.29","5.15.0-1030.30","5.15.0-1031.31","5.15.0-1032.32","5.15.0-1033.33","5.15.0-1037.37","5.15.0-1039.39","5.15.0-1040.40","5.15.0-1041.41","5.15.0-1042.42","5.15.0-1043.43","5.15.0-1044.44","5.15.0-1045.45","5.15.0-1046.46","5.15.0-1047.47","5.15.0-1048.48","5.15.0-1053.54","5.15.0-1054.55","5.15.0-1055.56","5.15.0-1058.59","5.15.0-1059.60","5.15.0-1060.61","5.15.0-1061.62","5.15.0-1062.63","5.15.0-1063.64","5.15.0-1064.65","5.15.0-1065.66","5.15.0-1066.67","5.15.0-1067.68","5.15.0-1068.69","5.15.0-1069.70","5.15.0-1070.71","5.15.0-1071.72","5.15.0-1072.73","5.15.0-1073.74","5.15.0-1074.75","5.15.0-1075.76","5.15.0-1076.77","5.15.0-1077.78","5.15.0-1078.79","5.15.0-1079.80","5.15.0-1080.81","5.15.0-1081.82","5.15.0-1082.83","5.15.0-1083.84","5.15.0-1085.86","5.15.0-1086.87","5.15.0-1087.88","5.15.0-1088.89","5.15.0-1090.91","5.15.0-1091.92","5.15.0-1092.93","5.15.0-1093.94","5.15.0-1094.95","5.15.0-1095.96","5.15.0-1096.97","5.15.0-1098.99","5.15.0-1099.100","5.15.0-1100.101","5.15.0-1101.102","5.15.0-1103.104","5.15.0-1104.105","5.15.0-1106.107","5.15.0-1107.108","5.15.0-1108.109","5.15.0-1109.110","5.15.0-1110.111","5.15.0-1111.112","5.15.0-1112.113","5.15.0-1114.115","5.15.0-1115.116"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1003.3~22.04.1","6.2.0-1009.9","6.2.0-1010.10","6.2.0-1011.11","6.2.0-1012.12","6.2.0-1013.13","6.2.0-1015.15"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1004.4","6.5.0-1007.7","6.5.0-1013.13","6.5.0-1014.14","6.5.0-1015.15","6.5.0-1018.18","6.5.0-1019.19","6.5.0-1021.22","6.5.0-1022.23","6.5.0-1023.24","6.5.0-1024.25"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1049.52~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1009.9~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.15~22.04.1","6.8.0-1015.16~22.04.1","6.8.0-1017.19~22.04.1","6.8.0-1018.20~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1022.25~22.04.2","6.8.0-1023.26~22.04.1","6.8.0-1024.27~22.04.1","6.8.0-1025.28~22.04.1","6.8.0-1026.29~22.04.1","6.8.0-1027.30~22.04.1","6.8.0-1028.31~22.04.1","6.8.0-1029.32~22.04.1","6.8.0-1030.33~22.04.1","6.8.0-1031.34~22.04.1","6.8.0-1032.35~22.04.1","6.8.0-1035.38~22.04.1","6.8.0-1036.39~22.04.1","6.8.0-1038.41~22.04.1","6.8.0-1039.42~22.04.1","6.8.0-1040.43~22.04.1","6.8.0-1041.44~22.04.2","6.8.0-1042.45~22.04.1","6.8.0-1043.46~22.04.1","6.8.0-1044.47~22.04.1","6.8.0-1045.48~22.04.1","6.8.0-1046.49~22.04.1","6.8.0-1047.50~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-tegra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1009.9","5.15.0-1010.10","5.15.0-1012.12","5.15.0-1013.13","5.15.0-1014.14","5.15.0-1015.15","5.15.0-1016.16","5.15.0-1017.17","5.15.0-1018.18","5.15.0-1019.19","5.15.0-1020.20","5.15.0-1021.21","5.15.0-1022.22","5.15.0-1025.25","5.15.0-1026.26","5.15.0-1027.27","5.15.0-1028.28","5.15.0-1030.30","5.15.0-1032.32","5.15.0-1033.33","5.15.0-1034.34","5.15.0-1035.35","5.15.0-1036.36","5.15.0-1037.37","5.15.0-1038.38","5.15.0-1039.39","5.15.0-1040.40","5.15.0-1041.41","5.15.0-1042.42","5.15.0-1043.43","5.15.0-1044.44","5.15.0-1045.45","5.15.0-1046.46","5.15.0-1047.47","5.15.0-1048.48","5.15.0-1049.49","5.15.0-1050.50","5.15.0-1051.51","5.15.0-1052.52","5.15.0-1053.53","5.15.0-1055.55","5.15.0-1056.56","5.15.0-1057.57","5.15.0-1058.58","5.15.0-1060.60","5.15.0-1061.61","5.15.0-1063.63","5.15.0-1064.66","5.15.0-1065.67","5.15.0-1066.68","5.15.0-1067.69","5.15.0-1068.70","5.15.0-1070.72","5.15.0-1071.73"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-tegra-igx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1001.1","5.15.0-1002.2","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1006.6","5.15.0-1007.7","5.15.0-1008.8","5.15.0-1009.9","5.15.0-1012.12","5.15.0-1013.13","5.15.0-1015.15","5.15.0-1016.16","5.15.0-1018.18","5.15.0-1019.19","5.15.0-1020.20","5.15.0-1021.21","5.15.0-1022.22","5.15.0-1023.23","5.15.0-1024.24","5.15.0-1026.26","5.15.0-1027.27","5.15.0-1028.28","5.15.0-1029.29","5.15.0-1030.30","5.15.0-1031.31","5.15.0-1032.32","5.15.0-1033.33","5.15.0-1034.34","5.15.0-1035.35","5.15.0-1036.36","5.15.0-1037.37","5.15.0-1038.38","5.15.0-1039.39","5.15.0-1040.40","5.15.0-1041.41","5.15.0-1042.42","5.15.0-1044.44","5.15.0-1045.45","5.15.0-1046.46","5.15.0-1047.47","5.15.0-1049.49","5.15.0-1050.50","5.15.0-1052.52","5.15.0-1053.53","5.15.0-1054.54","5.15.0-1055.55","5.15.0-1056.56","5.15.0-1057.57","5.15.0-1059.59"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-5.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.17.0-1003.3","5.17.0-1004.4","5.17.0-1006.6","5.17.0-1011.12","5.17.0-1012.13","5.17.0-1013.14","5.17.0-1014.15","5.17.0-1015.16","5.17.0-1016.17","5.17.0-1017.18","5.17.0-1018.19","5.17.0-1019.20","5.17.0-1020.21","5.17.0-1021.22","5.17.0-1024.25","5.17.0-1025.26","5.17.0-1026.27","5.17.0-1027.28","5.17.0-1028.29","5.17.0-1029.30","5.17.0-1030.31","5.17.0-1031.32","5.17.0-1032.33","5.17.0-1033.34","5.17.0-1034.35","5.17.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.0-1006.6","6.0.0-1007.7","6.0.0-1008.8","6.0.0-1009.9","6.0.0-1010.10","6.0.0-1011.11","6.0.0-1012.12","6.0.0-1013.13","6.0.0-1014.14","6.0.0-1015.15","6.0.0-1016.16","6.0.0-1017.17","6.0.0-1018.18","6.0.0-1019.19","6.0.0-1020.20","6.0.0-1021.21"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.0-1004.4","6.1.0-1006.6","6.1.0-1007.7","6.1.0-1008.8","6.1.0-1009.9","6.1.0-1010.10","6.1.0-1012.12","6.1.0-1013.13","6.1.0-1014.14","6.1.0-1015.15","6.1.0-1016.16","6.1.0-1017.17","6.1.0-1019.19","6.1.0-1020.20","6.1.0-1021.21","6.1.0-1022.22","6.1.0-1023.23","6.1.0-1024.24","6.1.0-1025.25","6.1.0-1026.26","6.1.0-1027.27","6.1.0-1028.28","6.1.0-1029.29","6.1.0-1033.33","6.1.0-1034.34","6.1.0-1035.35","6.1.0-1036.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1003.3","6.5.0-1004.4","6.5.0-1006.6","6.5.0-1007.7","6.5.0-1008.8","6.5.0-1009.10","6.5.0-1011.12","6.5.0-1013.14","6.5.0-1014.15","6.5.0-1015.16","6.5.0-1016.17","6.5.0-1018.19","6.5.0-1019.20","6.5.0-1020.21","6.5.0-1022.23","6.5.0-1023.24","6.5.0-1024.25","6.5.0-1025.26","6.5.0-1027.28"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.10","5.15.0-1001.3","5.15.0-1002.4","5.15.0-1003.5","5.15.0-1006.8","5.15.0-1007.9","5.15.0-1009.12","5.15.0-1011.15","5.15.0-1013.17","5.15.0-1016.20","5.15.0-1017.22","5.15.0-1018.23","5.15.0-1019.24","5.15.0-1021.27","5.15.0-1022.28","5.15.0-1025.31","5.15.0-1026.32","5.15.0-1027.33","5.15.0-1029.35","5.15.0-1030.36","5.15.0-1032.38","5.15.0-1033.39","5.15.0-1034.40","5.15.0-1035.41","5.15.0-1036.42","5.15.0-1037.43","5.15.0-1038.44","5.15.0-1039.45","5.15.0-1040.46","5.15.0-1041.47","5.15.0-1042.48","5.15.0-1044.50","5.15.0-1045.51","5.15.0-1046.52","5.15.0-1047.53","5.15.0-1048.54","5.15.0-1049.55","5.15.0-1050.56","5.15.0-1051.57","5.15.0-1052.58","5.15.0-1053.59","5.15.0-1054.60","5.15.0-1055.61","5.15.0-1058.64","5.15.0-1059.65","5.15.0-1060.66","5.15.0-1061.67","5.15.0-1062.68","5.15.0-1063.69","5.15.0-1064.70","5.15.0-1065.71","5.15.0-1066.72","5.15.0-1067.73","5.15.0-1068.74","5.15.0-1069.75","5.15.0-1070.76","5.15.0-1071.77","5.15.0-1072.78","5.15.0-1073.79","5.15.0-1074.80","5.15.0-1075.81","5.15.0-1076.82","5.15.0-1077.83","5.15.0-1078.84","5.15.0-1079.85","5.15.0-1080.86","5.15.0-1081.87","5.15.0-1082.88","5.15.0-1083.89","5.15.0-1084.90","5.15.0-1085.91","5.15.0-1086.92","5.15.0-1088.94","5.15.0-1089.95","5.15.0-1090.96","5.15.0-1091.97","5.15.0-1092.98","5.15.0-1093.99","5.15.0-1094.100","5.15.0-1095.101","5.15.0-1096.102","5.15.0-1097.103","5.15.0-1098.104","5.15.0-1100.106","5.15.0-1101.107","5.15.0-1102.108","5.15.0-1103.109","5.15.0-1105.111","5.15.0-1106.112","5.15.0-1108.114","5.15.0-1109.115","5.15.0-1110.116","5.15.0-1111.117","5.15.0-1112.118","5.15.0-1113.119","5.15.0-1114.120","5.15.0-1116.122","5.15.0-1117.123"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1013.13~22.04.4","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1018.18~22.04.1","6.5.0-1019.19~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1021.21~22.04.1","6.5.0-1023.23~22.04.1","6.5.0-1024.24~22.04.1","6.5.0-1025.25~22.04.1","6.5.0-1026.26~22.04.1","6.5.0-1027.27~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1047.48~22.04.1"}]}],"versions":["6.8.0-1006.6~22.04.3","6.8.0-1008.8~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.13~22.04.1","6.8.0-1014.14~22.04.1","6.8.0-1015.15~22.04.1","6.8.0-1016.17~22.04.1","6.8.0-1017.18~22.04.1","6.8.0-1018.19~22.04.1","6.8.0-1019.20~22.04.1","6.8.0-1020.21~22.04.1","6.8.0-1021.22~22.04.1","6.8.0-1022.23~22.04.1","6.8.0-1023.24~22.04.1","6.8.0-1024.25~22.04.1","6.8.0-1025.26~22.04.1","6.8.0-1026.27~22.04.1","6.8.0-1027.28~22.04.1","6.8.0-1028.29~22.04.1","6.8.0-1029.30~22.04.1","6.8.0-1030.31~22.04.1","6.8.0-1032.33~22.04.1","6.8.0-1033.34~22.04.1","6.8.0-1035.36~22.04.1","6.8.0-1037.38~22.04.1","6.8.0-1038.39~22.04.1","6.8.0-1039.40~22.04.1","6.8.0-1040.41~22.04.1","6.8.0-1041.42~22.04.1","6.8.0-1042.43~22.04.1","6.8.0-1043.44~22.04.1","6.8.0-1044.45~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-raspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9","5.15.0-1002.2","5.15.0-1003.3","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1006.6","5.15.0-1008.8","5.15.0-1011.13","5.15.0-1012.14","5.15.0-1013.15","5.15.0-1014.16","5.15.0-1015.17","5.15.0-1016.18","5.15.0-1017.19","5.15.0-1018.20","5.15.0-1021.23","5.15.0-1022.24","5.15.0-1023.25","5.15.0-1024.26","5.15.0-1025.27","5.15.0-1026.28","5.15.0-1027.29","5.15.0-1028.30","5.15.0-1029.31","5.15.0-1030.32","5.15.0-1032.35","5.15.0-1033.36","5.15.0-1034.37","5.15.0-1035.38","5.15.0-1036.39","5.15.0-1037.40","5.15.0-1038.41","5.15.0-1040.43","5.15.0-1041.44","5.15.0-1042.45","5.15.0-1043.46","5.15.0-1044.47","5.15.0-1045.48","5.15.0-1046.49","5.15.0-1047.50","5.15.0-1048.51","5.15.0-1049.52","5.15.0-1050.53","5.15.0-1053.56","5.15.0-1054.57","5.15.0-1055.58","5.15.0-1058.61","5.15.0-1059.62","5.15.0-1060.63","5.15.0-1061.64","5.15.0-1062.65","5.15.0-1063.66","5.15.0-1064.67","5.15.0-1065.68","5.15.0-1066.69","5.15.0-1067.70","5.15.0-1070.73","5.15.0-1071.74","5.15.0-1072.75","5.15.0-1073.76","5.15.0-1074.77","5.15.0-1075.78","5.15.0-1076.79","5.15.0-1077.80","5.15.0-1078.81","5.15.0-1079.82","5.15.0-1080.83","5.15.0-1083.86","5.15.0-1084.87","5.15.0-1085.88","5.15.0-1086.89","5.15.0-1087.90","5.15.0-1089.92","5.15.0-1090.93","5.15.0-1091.94","5.15.0-1092.95","5.15.0-1093.96","5.15.0-1097.100","5.15.0-1098.101","5.15.0-1099.102","5.15.0-1100.103","5.15.0-1102.105","5.15.0-1103.106","5.15.0-1105.108","5.15.0-1106.109","5.15.0-1108.111","5.15.0-1110.113"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1032.35"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1004.4","5.13.0-1006.6+22.04.1","5.13.0-1007.7+22.04.1","5.13.0-1010.11+22.04.1","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1006.6","5.15.0-1007.7","5.15.0-1008.8","5.15.0-1011.12","5.15.0-1012.13","5.15.0-1014.16","5.15.0-1015.17","5.15.0-1016.18","5.15.0-1017.19","5.15.0-1018.21","5.15.0-1019.22","5.15.0-1020.23","5.15.0-1022.26","5.15.0-1023.27","5.15.0-1026.30","5.15.0-1027.31","5.15.0-1028.32"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1012.13~22.04.1","5.19.0-1015.16~22.04.1","5.19.0-1016.17~22.04.1","5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1","5.19.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-17.17.1.1~22.04.1","6.5.0-21.21.1~22.04.1","6.5.0-25.25.1~22.04.1","6.5.0-26.26.1~22.04.1","6.5.0-27.28.1~22.04.1","6.5.0-28.29.1~22.04.1","6.5.0-35.35.1~22.04.1","6.5.0-40.40.1~22.04.1","6.5.0-42.42.1~22.04.1","6.5.0-45.45.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-106.106~22.04.1"}]}],"versions":["6.8.0-38.38.1~22.04.1","6.8.0-39.39.1~22.04.1","6.8.0-40.40.1~22.04.1","6.8.0-41.41.1~22.04.1","6.8.0-44.44.1~22.04.1","6.8.0-47.47.1~22.04.1","6.8.0-48.48.1~22.04.2","6.8.0-49.49.1~22.04.1","6.8.0-50.51.1~22.04.1","6.8.0-51.52.1~22.04.1","6.8.0-52.53.1~22.04.1","6.8.0-53.55.1~22.04.1","6.8.0-55.57.1~22.04.1","6.8.0-56.58.1~22.04.1","6.8.0-57.59.1~22.04.1","6.8.0-58.60.1~22.04.1","6.8.0-59.61.1~22.04.1","6.8.0-62.65~22.04.1","6.8.0-63.66~22.04.1","6.8.0-64.67~22.04.1","6.8.0-71.71~22.04.1","6.8.0-78.78~22.04.1","6.8.0-79.79~22.04.1","6.8.0-83.83~22.04.1","6.8.0-84.84~22.04.1","6.8.0-86.87~22.04.1","6.8.0-87.88~22.04.1","6.8.0-88.89~22.04.1","6.8.0-90.91~22.04.1","6.8.0-94.96~22.04.1","6.8.0-100.100~22.04.1","6.8.0-101.101~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1014.16~22.04.1","5.19.0-1015.17~22.04.1","5.19.0-1016.18~22.04.1","5.19.0-1017.19~22.04.1","5.19.0-1018.20~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1006.7~22.04.1","6.2.0-1007.8~22.04.1","6.2.0-1009.10~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.8~22.04.1","6.5.0-1008.9~22.04.1","6.5.0-1009.10~22.04.1","6.5.0-1010.11~22.04.1","6.5.0-1011.12~22.04.1","6.5.0-1012.13~22.04.1","6.5.0-1014.15~22.04.1","6.5.0-1015.16~22.04.1","6.5.0-1016.17~22.04.1","6.5.0-1017.18~22.04.1","6.5.0-1018.19~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-xilinx-zynqmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1022.26","5.15.0-1023.27","5.15.0-1025.29","5.15.0-1027.31","5.15.0-1030.34","5.15.0-1031.35","5.15.0-1035.39","5.15.0-1036.40","5.15.0-1037.41","5.15.0-1038.42","5.15.0-1039.43","5.15.0-1041.45","5.15.0-1044.48","5.15.0-1046.50","5.15.0-1050.54","5.15.0-1051.55","5.15.0-1052.56","5.15.0-1053.57","5.15.0-1054.58","5.15.0-1055.59","5.15.0-1056.60","5.15.0-1057.61","5.15.0-1059.63","5.15.0-1060.64","5.15.0-1061.65","5.15.0-1062.66","5.15.0-1063.67","5.15.0-1064.68","5.15.0-1065.69","5.15.0-1067.71","5.15.0-1068.72","5.15.0-1069.73","5.15.0-1070.74","5.15.0-1074.78","5.15.0-1075.79","5.15.0-1076.80","5.15.0-1077.81","5.15.0-1078.82","5.15.0-1079.83","5.15.0-1080.84"]},{"source":"osv","ecosystem":"Ubuntu:Nvidia-BlueField:22.04:LTS","package":"linux-bluefield","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1011.13","5.15.0-1014.16","5.15.0-1015.17","5.15.0-1017.19","5.15.0-1019.21","5.15.0-1021.23","5.15.0-1022.24","5.15.0-1023.25","5.15.0-1024.26","5.15.0-1027.29","5.15.0-1028.30","5.15.0-1031.33","5.15.0-1032.34","5.15.0-1033.35","5.15.0-1035.37","5.15.0-1036.38","5.15.0-1037.39","5.15.0-1038.40","5.15.0-1040.42","5.15.0-1042.44","5.15.0-1043.45","5.15.0-1044.46","5.15.0-1045.47","5.15.0-1047.49","5.15.0-1048.50","5.15.0-1050.52","5.15.0-1051.53","5.15.0-1052.54","5.15.0-1053.55","5.15.0-1054.56","5.15.0-1056.58","5.15.0-1057.59","5.15.0-1058.60","5.15.0-1059.61","5.15.0-1060.62","5.15.0-1061.63","5.15.0-1062.64","5.15.0-1063.65","5.15.0-1064.66","5.15.0-1065.67","5.15.0-1066.68","5.15.0-1067.69","5.15.0-1069.71","5.15.0-1070.72","5.15.0-1072.74","5.15.0-1074.76","5.15.0-1075.77","5.15.0-1076.78","5.15.0-1077.79","5.15.0-1079.81","5.15.0-1080.82","5.15.0-1081.83","5.15.0-1082.84","5.15.0-1083.85","5.15.0-1084.86","5.15.0-1085.87","5.15.0-1086.88","5.15.0-1087.89","5.15.0-1089.91","5.15.0-1090.92","5.15.0-1092.94","5.15.0-1093.95","5.15.0-1095.97","5.15.0-1096.98","5.15.0-1097.99","5.15.0-1098.100","5.15.0-1099.101","5.15.0-1100.102","5.15.0-1101.103","5.15.0-1103.105","5.15.0-1104.106"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:22.04:LTS","package":"linux-intel-iot-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1021.26","5.15.0-1022.27","5.15.0-1023.28","5.15.0-1024.29","5.15.0-1028.33","5.15.0-1033.35","5.15.0-1034.36","5.15.0-1035.37","5.15.0-1036.38","5.15.0-1037.39","5.15.0-1038.40","5.15.0-1039.41","5.15.0-1040.42","5.15.0-1041.43","5.15.0-1042.44","5.15.0-1043.45","5.15.0-1044.46","5.15.0-1046.48","5.15.0-1047.49","5.15.0-1048.50","5.15.0-1049.51","5.15.0-1050.52","5.15.0-1053.55","5.15.0-1054.56","5.15.0-1055.57","5.15.0-1056.58","5.15.0-1057.59","5.15.0-1058.60","5.15.0-1059.61","5.15.0-1060.62","5.15.0-1061.63","5.15.0-1063.65","5.15.0-1064.66","5.15.0-1066.68","5.15.0-1071.73","5.15.0-1072.74","5.15.0-1073.75","5.15.0-1074.76","5.15.0-1075.77","5.15.0-1076.78","5.15.0-1077.79","5.15.0-1078.80","5.15.0-1079.81","5.15.0-1080.82","5.15.0-1081.83","5.15.0-1082.84","5.15.0-1083.85","5.15.0-1084.86","5.15.0-1085.87","5.15.0-1086.88","5.15.0-1087.89","5.15.0-1088.90","5.15.0-1089.91","5.15.0-1090.92","5.15.0-1091.93","5.15.0-1092.94","5.15.0-1093.95","5.15.0-1094.96","5.15.0-1096.98","5.15.0-1097.99","5.15.0-1098.100","5.15.0-1099.101","5.15.0-1100.102","5.15.0-1101.103","5.15.0-1103.105","5.15.0-1104.106","5.15.0-1105.107","5.15.0-1106.108","5.15.0-1107.109","5.15.0-1108.110","5.15.0-1109.111","5.15.0-1111.115","5.15.0-1112.116"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:22.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1006.6","5.15.0-1007.7","5.15.0-1009.9","5.15.0-1011.11","5.15.0-1014.14","5.15.0-1015.15","5.15.0-1016.16","5.15.0-1019.19","5.15.0-1020.20","5.15.0-1021.21","5.15.0-1022.22","5.15.0-1024.25","5.15.0-1025.28","5.15.0-1028.31","5.15.0-1029.32","5.15.0-1030.33","5.15.0-1032.35","5.15.0-1033.36","5.15.0-1034.37","5.15.0-1036.39","5.15.0-1037.40","5.15.0-1038.41","5.15.0-1039.42","5.15.0-1040.45","5.15.0-1041.46","5.15.0-1042.47","5.15.0-1043.48","5.15.0-1044.49","5.15.0-1045.50","5.15.0-1046.52","5.15.0-1048.54","5.15.0-1049.55","5.15.0-1050.56","5.15.0-1051.57","5.15.0-1052.58","5.15.0-1053.59","5.15.0-1054.60","5.15.0-1055.62","5.15.0-1056.63","5.15.0-1057.64","5.15.0-1058.66","5.15.0-1061.69","5.15.0-1062.70","5.15.0-1063.71","5.15.0-1064.72","5.15.0-1065.73","5.15.0-1066.74","5.15.0-1067.75","5.15.0-1068.76","5.15.0-1069.77","5.15.0-1070.78","5.15.0-1071.79","5.15.0-1072.80","5.15.0-1073.81","5.15.0-1074.82","5.15.0-1075.83","5.15.0-1076.84","5.15.0-1077.85","5.15.0-1078.86","5.15.0-1079.87","5.15.0-1080.88","5.15.0-1081.89","5.15.0-1082.91","5.15.0-1083.92","5.15.0-1084.93","5.15.0-1085.94","5.15.0-1086.95","5.15.0-1087.96","5.15.0-1088.97","5.15.0-1089.98","5.15.0-1090.99","5.15.0-1091.100","5.15.0-1092.101","5.15.0-1093.102","5.15.0-1094.103","5.15.0-1095.104","5.15.0-1096.105","5.15.0-1097.106","5.15.0-1098.107","5.15.0-1099.108","5.15.0-1100.109","5.15.0-1102.111","5.15.0-1103.112","5.15.0-1104.113","5.15.0-1105.114","5.15.0-1107.116","5.15.0-1108.117","5.15.0-1110.119","5.15.0-1111.120","5.15.0-1112.121","5.15.0-1113.122","5.15.0-1114.123","5.15.0-1115.124","5.15.0-1116.125","5.15.0-1118.127","5.15.0-1119.128"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:22.04:LTS","package":"linux-realtime-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.1-1045.46~22.04.1"}]}],"versions":["6.8.1-1004.4~22.04.1","6.8.1-1005.5~22.04.2","6.8.1-1006.6~22.04.1","6.8.1-1007.7~22.04.1","6.8.1-1008.8~22.04.1","6.8.1-1009.9~22.04.1","6.8.1-1010.10~22.04.1","6.8.1-1011.11~22.04.1","6.8.1-1012.12~22.04.1","6.8.1-1013.14~22.04.1","6.8.1-1014.15~22.04.1","6.8.1-1015.16~22.04.1","6.8.1-1016.17~22.04.1","6.8.1-1017.18~22.04.1","6.8.1-1018.19~22.04.1","6.8.1-1019.20~22.04.1","6.8.1-1020.21~22.04.1","6.8.1-1021.22~22.04.1","6.8.1-1022.23~22.04.1","6.8.1-1023.24~22.04.1","6.8.1-1024.25~22.04.1","6.8.1-1025.26~22.04.1","6.8.1-1026.27~22.04.1","6.8.1-1030.31~22.04.1","6.8.1-1031.32~22.04.1","6.8.1-1034.35~22.04.1","6.8.1-1035.36~22.04.1","6.8.1-1036.37~22.04.1","6.8.1-1037.38~22.04.1","6.8.1-1038.39~22.04.1","6.8.1-1039.40~22.04.1","6.8.1-1040.41~22.04.1","6.8.1-1041.42~22.04.1","6.8.1-1042.43~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-preview:22.04:LTS","package":"linux-aws-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1042.47+fips1","5.15.0-1051.56+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-preview:22.04:LTS","package":"linux-azure-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1053.61+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-preview:22.04:LTS","package":"linux-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-73.80+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-preview:22.04:LTS","package":"linux-gcp-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1048.56+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"linux-aws-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1051.56+fips1","5.15.0-1052.57+fips1","5.15.0-1053.58+fips1","5.15.0-1055.60+fips1","5.15.0-1056.61+fips1","5.15.0-1057.63+fips1","5.15.0-1060.66+fips1","5.15.0-1061.67+fips1","5.15.0-1062.68+fips1","5.15.0-1063.69+fips1","5.15.0-1064.70+fips1","5.15.0-1065.71+fips1","5.15.0-1066.72+fips1","5.15.0-1067.73+fips1","5.15.0-1068.74+fips1","5.15.0-1069.75+fips1","5.15.0-1070.76+fips1","5.15.0-1071.77+fips1","5.15.0-1072.78+fips1","5.15.0-1073.79+fips1","5.15.0-1076.83+fips1","5.15.0-1077.84+fips1","5.15.0-1078.85+fips1","5.15.0-1079.86+fips1","5.15.0-1080.87+fips1","5.15.0-1081.88+fips1","5.15.0-1082.89+fips1","5.15.0-1083.90+fips1","5.15.0-1084.91+fips1","5.15.0-1085.92+fips1","5.15.0-1086.93+fips1","5.15.0-1087.94+fips1","5.15.0-1088.95+fips1","5.15.0-1089.96+fips1","5.15.0-1090.97+fips1","5.15.0-1091.98+fips1","5.15.0-1092.99+fips1","5.15.0-1093.100+fips1","5.15.0-1095.102+fips1","5.15.0-1096.103+fips1","5.15.0-1097.104+fips1","5.15.0-1098.105+fips1","5.15.0-1099.106+fips1","5.15.0-1100.107+fips1","5.15.0-1101.108+fips1","5.15.0-1103.110+fips1","5.15.0-1104.111+fips1","5.15.0-1105.112+fips1","5.15.0-1106.113+fips1","5.15.0-1108.115+fips1","5.15.0-1109.116+fips1","5.15.0-1111.118+fips1","5.15.0-1112.119+fips1","5.15.0-1113.120+fips1","5.15.0-1114.121+fips1","5.15.0-1115.122+fips1","5.15.0-1116.123+fips1","5.15.0-1117.124+fips1","5.15.0-1119.126+fips1","5.15.0-1120.127+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"linux-azure-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1053.61+fips1","5.15.0-1058.66+fips1","5.15.0-1059.67+fips1","5.15.0-1060.69+fips1","5.15.0-1061.70+fips1","5.15.0-1063.72+fips1","5.15.0-1064.73+fips1","5.15.0-1065.74+fips1","5.15.0-1067.76+fips1","5.15.0-1068.77+fips1","5.15.0-1070.79+fips1","5.15.0-1071.80+fips1","5.15.0-1072.81+fips1","5.15.0-1073.82+fips1","5.15.0-1074.83+fips1","5.15.0-1075.84+fips1","5.15.0-1078.87+fips1","5.15.0-1079.88+fips1","5.15.0-1080.89+fips1","5.15.0-1082.91+fips1","5.15.0-1083.92+fips1","5.15.0-1085.94+fips1","5.15.0-1087.96+fips1","5.15.0-1088.97+fips1","5.15.0-1089.98+fips1","5.15.0-1090.99+fips1","5.15.0-1091.100+fips1","5.15.0-1094.103+fips1","5.15.0-1095.104+fips1","5.15.0-1096.105+fips1","5.15.0-1097.106+fips1","5.15.0-1098.107+fips1","5.15.0-1101.110+fips1","5.15.0-1102.111+fips1","5.15.0-1103.112+fips1","5.15.0-1109.118+fips1","5.15.0-1110.119+fips1","5.15.0-1111.120+fips1","5.15.0-1114.123+fips1","5.15.0-1116.125+fips1","5.15.0-1117.126+fips1","5.15.0-1118.127+fips1","5.15.0-1119.128+fips1","5.15.0-1121.130+fips1","5.15.0-1122.131+fips1","5.15.0-1123.132+fips1","5.15.0-1125.134+fips1","5.15.0-1126.135+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"linux-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-73.80+fips1","5.15.0-92.102+fips1","5.15.0-94.104+fips1","5.15.0-97.107+fips1","5.15.0-100.110+fips1","5.15.0-101.111+fips1","5.15.0-102.112+fips1","5.15.0-105.115+fips1","5.15.0-106.116+fips1","5.15.0-107.117+fips1","5.15.0-111.121+fips1","5.15.0-113.123+fips1","5.15.0-115.125+fips1","5.15.0-117.127+fips1","5.15.0-118.128+fips1","5.15.0-119.129+fips1","5.15.0-121.131+fips1","5.15.0-122.132+fips1","5.15.0-124.134+fips1","5.15.0-125.135+fips1","5.15.0-127.137+fips1","5.15.0-128.138+fips1","5.15.0-130.140+fips1","5.15.0-131.141+fips1","5.15.0-133.144+fips1","5.15.0-134.145+fips1","5.15.0-135.146+fips1","5.15.0-136.147+fips1","5.15.0-138.148+fips1","5.15.0-139.149+fips1","5.15.0-140.150+fips1","5.15.0-141.151+fips1","5.15.0-142.152+fips1","5.15.0-143.153+fips1","5.15.0-144.157+fips1","5.15.0-145.158+fips1","5.15.0-152.162+fips1","5.15.0-153.163+fips1","5.15.0-156.166+fips1","5.15.0-157.167+fips1","5.15.0-160.170+fips1","5.15.0-161.171+fips1","5.15.0-163.173+fips1","5.15.0-164.174+fips1","5.15.0-168.178+fips1","5.15.0-170.180+fips1","5.15.0-171.181+fips1","5.15.0-173.183+fips1","5.15.0-174.184+fips1","5.15.0-176.186+fips1","5.15.0-177.187+fips1","5.15.0-179.189+fips1","5.15.0-181.191+fips1","5.15.0-185.195+fips1","5.15.0-186.196+fips1","5.15.0-190.200+fips1","5.15.0-191.201+fips1","5.15.0-194.204+fips1","5.15.0-198.208+fips1","5.15.0-202.212+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"linux-gcp-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1048.56+fips1","5.15.0-1055.63+fips2","5.15.0-1058.66+fips1","5.15.0-1059.67+fips1","5.15.0-1060.68+fips1","5.15.0-1062.70+fips1","5.15.0-1063.71+fips1","5.15.0-1064.72+fips1","5.15.0-1065.73+fips1","5.15.0-1066.74+fips1","5.15.0-1067.75+fips1","5.15.0-1068.76+fips1","5.15.0-1069.77+fips1","5.15.0-1070.78+fips1","5.15.0-1071.79+fips1","5.15.0-1072.80+fips1","5.15.0-1073.81+fips1","5.15.0-1074.83+fips1","5.15.0-1075.84+fips1","5.15.0-1077.86+fips1","5.15.0-1078.87+fips1","5.15.0-1079.88+fips1","5.15.0-1080.89+fips1","5.15.0-1081.90+fips1","5.15.0-1082.91+fips1","5.15.0-1083.92+fips1","5.15.0-1084.93+fips1","5.15.0-1085.94+fips1","5.15.0-1086.95+fips1","5.15.0-1087.96+fips1","5.15.0-1088.97+fips1","5.15.0-1090.99+fips1","5.15.0-1091.100+fips1","5.15.0-1092.101+fips1","5.15.0-1093.102+fips1","5.15.0-1095.104+fips1","5.15.0-1096.105+fips1","5.15.0-1097.106+fips1","5.15.0-1098.107+fips1","5.15.0-1099.108+fips1","5.15.0-1100.109+fips1","5.15.0-1101.110+fips1","5.15.0-1103.112+fips1","5.15.0-1104.113+fips1","5.15.0-1105.114+fips1","5.15.0-1106.115+fips1","5.15.0-1108.117+fips1","5.15.0-1109.118+fips1","5.15.0-1111.121+fips1","5.15.0-1112.122+fips1","5.15.0-1114.124+fips1","5.15.0-1115.125+fips1","5.15.0-1116.126+fips1","5.15.0-1118.128+fips1","5.15.0-1120.130+fips1","5.15.0-1121.131+fips1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-106.106"}]}],"versions":["6.5.0-9.9","6.6.0-14.14","6.8.0-11.11","6.8.0-20.20","6.8.0-22.22","6.8.0-28.28","6.8.0-31.31","6.8.0-35.35","6.8.0-36.36","6.8.0-38.38","6.8.0-39.39","6.8.0-40.40","6.8.0-41.41","6.8.0-44.44","6.8.0-45.45","6.8.0-47.47","6.8.0-48.48","6.8.0-49.49","6.8.0-50.51","6.8.0-51.52","6.8.0-52.53","6.8.0-53.55","6.8.0-54.56","6.8.0-55.57","6.8.0-56.58","6.8.0-57.59","6.8.0-58.60","6.8.0-59.61","6.8.0-60.63","6.8.0-62.65","6.8.0-63.66","6.8.0-64.67","6.8.0-71.71","6.8.0-78.78","6.8.0-79.79","6.8.0-83.83","6.8.0-84.84","6.8.0-85.85","6.8.0-86.87","6.8.0-87.88","6.8.0-88.89","6.8.0-90.91","6.8.0-94.96","6.8.0-100.100","6.8.0-101.101"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1050.53"}]}],"versions":["6.5.0-1008.8","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1006.6","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1016.17","6.8.0-1017.18","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1023.25","6.8.0-1024.26","6.8.0-1025.27","6.8.0-1026.28","6.8.0-1027.29","6.8.0-1028.30","6.8.0-1029.31","6.8.0-1030.32","6.8.0-1031.33","6.8.0-1032.34","6.8.0-1033.35","6.8.0-1035.37","6.8.0-1036.38","6.8.0-1038.40","6.8.0-1039.41","6.8.0-1040.42","6.8.0-1041.43","6.8.0-1042.44","6.8.0-1043.45","6.8.0-1044.46","6.8.0-1045.47","6.8.0-1046.49","6.8.0-1047.50"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1009.9~24.04.1","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1016.16~24.04.1","6.14.0-1017.17~24.04.1","6.14.0-1018.18~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1007.7~24.04.1"}]}],"versions":["6.17.0-1005.5~24.04.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1051.57"}]}],"versions":["6.5.0-1007.7","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1012.14","6.8.0-1013.15","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.20","6.8.0-1018.21","6.8.0-1020.23","6.8.0-1021.25","6.8.0-1025.30","6.8.0-1026.31","6.8.0-1027.32","6.8.0-1028.33","6.8.0-1029.34","6.8.0-1030.35","6.8.0-1031.36","6.8.0-1034.39","6.8.0-1038.44","6.8.0-1040.46","6.8.0-1041.47","6.8.0-1042.48","6.8.0-1044.50","6.8.0-1046.52"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1008.8~24.04.1","6.11.0-1012.12~24.04.1","6.11.0-1013.13~24.04.1","6.11.0-1014.14~24.04.1","6.11.0-1015.15~24.04.1","6.11.0-1017.17~24.04.1","6.11.0-1018.18~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1010.10~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1058.65"}]}],"versions":["6.8.0-1041.48","6.8.0-1044.51","6.8.0-1046.53","6.8.0-1053.60"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-fde-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-nvidia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1013.14","6.8.0-1014.15","6.8.0-1016.17","6.8.0-1018.19","6.8.0-1019.20","6.8.0-1022.23","6.8.0-1025.27","6.8.0-1027.30","6.8.0-1029.32","6.8.0-1039.42"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-nvidia-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1003.3","6.14.0-1006.6","6.14.0-1007.7"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1052.55"}]}],"versions":["6.5.0-1007.7","6.6.0-1001.1","6.8.0-1002.2","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.9","6.8.0-1009.10","6.8.0-1010.11","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1024.26","6.8.0-1025.27","6.8.0-1026.28","6.8.0-1027.29","6.8.0-1028.30","6.8.0-1029.31","6.8.0-1030.32","6.8.0-1031.33","6.8.0-1032.34","6.8.0-1033.35","6.8.0-1034.36","6.8.0-1036.38","6.8.0-1037.39","6.8.0-1039.41","6.8.0-1040.42","6.8.0-1041.43","6.8.0-1042.45","6.8.0-1043.46","6.8.0-1044.47","6.8.0-1045.48","6.8.0-1046.49","6.8.0-1047.50","6.8.0-1048.51"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1006.6~24.04.2","6.11.0-1011.11~24.04.1","6.11.0-1013.13~24.04.1","6.11.0-1014.14~24.04.1","6.11.0-1015.15~24.04.1","6.11.0-1016.16~24.04.1","6.11.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1014.15~24.04.1","6.14.0-1015.16~24.04.1","6.14.0-1016.17~24.04.1","6.14.0-1017.18~24.04.1","6.14.0-1018.19~24.04.1","6.14.0-1019.20~24.04.1","6.14.0-1020.21~24.04.1","6.14.0-1021.22~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1008.8~24.04.1"}]}],"versions":["6.17.0-1004.4~24.04.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1048.53"}]}],"versions":["6.8.0-1003.5","6.8.0-1004.7","6.8.0-1005.8","6.8.0-1006.9","6.8.0-1007.10","6.8.0-1008.11","6.8.0-1009.12","6.8.0-1010.13","6.8.0-1011.14","6.8.0-1012.15","6.8.0-1013.17","6.8.0-1014.18","6.8.0-1015.19","6.8.0-1016.20","6.8.0-1017.21","6.8.0-1019.23","6.8.0-1020.24","6.8.0-1021.25","6.8.0-1022.26","6.8.0-1023.27","6.8.0-1024.28","6.8.0-1025.29","6.8.0-1026.30","6.8.0-1027.31","6.8.0-1028.32","6.8.0-1029.33","6.8.0-1032.36","6.8.0-1033.37","6.8.0-1035.39","6.8.0-1036.40","6.8.0-1037.41","6.8.0-1038.43","6.8.0-1039.44","6.8.0-1040.45","6.8.0-1041.46","6.8.0-1042.47","6.8.0-1043.48","6.8.0-1044.49"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1035.38"}]}],"versions":["6.8.0-1001.3","6.8.0-1002.4","6.8.0-1003.5","6.8.0-1004.6","6.8.0-1006.8","6.8.0-1007.9","6.8.0-1008.10","6.8.0-1009.11","6.8.0-1010.12","6.8.0-1011.13","6.8.0-1012.14","6.8.0-1013.15","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1022.24","6.8.0-1023.25","6.8.0-1024.26","6.8.0-1025.28","6.8.0-1026.29","6.8.0-1027.30","6.8.0-1028.31","6.8.0-1029.32","6.8.0-1030.33","6.8.0-1031.34"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-hwe-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-17.17~24.04.2","6.11.0-19.19~24.04.1","6.11.0-21.21~24.04.1","6.11.0-24.24~24.04.1","6.11.0-25.25~24.04.1","6.11.0-26.26~24.04.1","6.11.0-28.28~24.04.1","6.11.0-29.29~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-hwe-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-24.24~24.04.3","6.14.0-27.27~24.04.1","6.14.0-28.28~24.04.1","6.14.0-29.29~24.04.1","6.14.0-32.32~24.04.1","6.14.0-33.33~24.04.1","6.14.0-34.34~24.04.1","6.14.0-35.35~24.04.1","6.14.0-36.36~24.04.1","6.14.0-37.37~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1049.49"}]}],"versions":["6.5.0-1009.9","6.8.0-1001.1","6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1015.15","6.8.0-1016.16","6.8.0-1017.17","6.8.0-1018.18","6.8.0-1019.19","6.8.0-1022.22","6.8.0-1023.23","6.8.0-1024.24","6.8.0-1025.25","6.8.0-1026.26","6.8.0-1027.27","6.8.0-1028.28","6.8.0-1029.29","6.8.0-1030.30","6.8.0-1033.33","6.8.0-1036.36","6.8.0-1037.37","6.8.0-1038.38","6.8.0-1039.39","6.8.0-1040.40","6.8.0-1041.41","6.8.0-1042.42","6.8.0-1043.43","6.8.0-1044.44","6.8.0-1045.45"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-106.106.1"}]}],"versions":["6.5.0-9.9.1","6.6.0-14.14.1","6.8.0-7.7.1","6.8.0-25.25.3","6.8.0-28.28.1","6.8.0-31.31.1","6.8.0-35.35.1","6.8.0-36.36.1","6.8.0-38.38.1","6.8.0-39.39.1","6.8.0-40.40.1","6.8.0-41.41.1","6.8.0-44.44.1","6.8.0-45.45.1","6.8.0-47.47.1","6.8.0-48.48.3","6.8.0-49.49.1","6.8.0-50.51.1","6.8.0-51.52.1","6.8.0-52.53.1","6.8.0-53.55.2","6.8.0-54.56.1","6.8.0-55.57.1","6.8.0-56.58.1","6.8.0-57.59.1","6.8.0-58.60.1","6.8.0-59.61.1","6.8.0-60.63.1","6.8.0-62.65.1","6.8.0-63.66.1","6.8.0-64.67.1","6.8.0-65.68.1","6.8.0-78.78.1","6.8.0-79.79.1","6.8.0-83.83.1","6.8.0-84.84.1","6.8.0-85.85.1","6.8.0-86.87.1","6.8.0-87.88.1","6.8.0-88.89.1","6.8.0-90.91.1","6.8.0-94.96.1","6.8.0-100.100.1","6.8.0-101.101.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency-hwe-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1009.10~24.04.1","6.11.0-1011.12~24.04.1","6.11.0-1012.13~24.04.1","6.11.0-1013.14~24.04.1","6.11.0-1014.15~24.04.1","6.11.0-1015.16~24.04.2","6.11.0-1016.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1049.52"}]}],"versions":["6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1022.25","6.8.0-1023.26","6.8.0-1024.27","6.8.0-1025.28","6.8.0-1026.29","6.8.0-1027.30","6.8.0-1028.31","6.8.0-1029.32","6.8.0-1030.33","6.8.0-1031.34","6.8.0-1032.35","6.8.0-1035.38","6.8.0-1036.39","6.8.0-1038.41","6.8.0-1039.42","6.8.0-1040.43","6.8.0-1041.44","6.8.0-1042.45","6.8.0-1043.46","6.8.0-1044.47","6.8.0-1045.48","6.8.0-1046.49","6.8.0-1047.50"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1002.2","6.11.0-1003.3","6.11.0-1007.7","6.11.0-1010.10","6.11.0-1011.11","6.11.0-1012.12","6.11.0-1013.13","6.11.0-1016.16"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1008.8"}]}],"versions":["6.17.0-1004.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1049.52.1"}]}],"versions":["6.8.0-1009.9.1","6.8.0-1011.11.1","6.8.0-1012.12.1","6.8.0-1013.14.1","6.8.0-1014.15.1","6.8.0-1015.16.1","6.8.0-1017.19.1","6.8.0-1018.20.1","6.8.0-1019.21.1","6.8.0-1020.22.1","6.8.0-1021.23.1","6.8.0-1022.25.2","6.8.0-1023.26.1","6.8.0-1024.27.1","6.8.0-1025.28.1","6.8.0-1026.29.1","6.8.0-1027.30.1","6.8.0-1028.31.1","6.8.0-1029.32.1","6.8.0-1030.33.1","6.8.0-1031.34.1","6.8.0-1032.35.1","6.8.0-1035.38.1","6.8.0-1036.39.1","6.8.0-1038.41.1","6.8.0-1039.42.1","6.8.0-1040.43.1","6.8.0-1041.44.1","6.8.0-1042.45.1","6.8.0-1043.46.1","6.8.0-1044.47.1","6.8.0-1045.48.1","6.8.0-1046.49.1","6.8.0-1047.50.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-tegra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1020.20"}]}],"versions":["6.8.0-1003.3","6.8.0-1004.4","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1016.16","6.8.0-1019.19"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1007.7","6.11.0-1008.8","6.11.0-1009.9","6.11.0-1010.10","6.11.0-1011.11","6.11.0-1012.12","6.11.0-1013.13","6.11.0-1015.15","6.11.0-1016.16","6.11.0-1017.17","6.11.0-1018.18","6.11.0-1020.20","6.11.0-1021.21","6.11.0-1022.22","6.11.0-1023.23","6.11.0-1024.24","6.11.0-1025.25","6.11.0-1027.27"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1004.4","6.14.0-1005.5","6.14.0-1006.6","6.14.0-1007.7","6.14.0-1008.8","6.14.0-1010.10","6.14.0-1011.11","6.14.0-1012.12","6.14.0-1013.13","6.14.0-1014.14","6.14.0-1015.15","6.14.0-1016.16","6.14.0-1017.17","6.14.0-1018.18","6.14.0-1019.19","6.14.0-1020.20"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1011.11"}]}],"versions":["6.17.0-1005.5","6.17.0-1006.6","6.17.0-1007.7","6.17.0-1008.8","6.17.0-1009.9","6.17.0-1010.10"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1016.16","6.8.0-1017.17","6.8.0-1018.18","6.8.0-1019.19","6.8.0-1020.20","6.8.0-1024.24","6.8.0-1025.25","6.8.0-1026.26","6.8.0-1027.27","6.8.0-1028.28","6.8.0-1029.29","6.8.0-1030.30","6.8.0-1031.31","6.8.0-1032.32"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1047.48"}]}],"versions":["6.5.0-1010.10","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1008.8","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1015.16","6.8.0-1016.17","6.8.0-1017.18","6.8.0-1018.19","6.8.0-1019.20","6.8.0-1020.21","6.8.0-1021.22","6.8.0-1022.23","6.8.0-1023.24","6.8.0-1024.25","6.8.0-1025.26","6.8.0-1026.27","6.8.0-1027.28","6.8.0-1028.29","6.8.0-1029.30","6.8.0-1030.31","6.8.0-1032.33","6.8.0-1033.34","6.8.0-1035.36","6.8.0-1037.38","6.8.0-1038.39","6.8.0-1039.40","6.8.0-1040.41","6.8.0-1041.42","6.8.0-1042.43","6.8.0-1043.44","6.8.0-1044.45"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1009.9~24.04.1","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1016.16~24.04.1","6.14.0-1017.17~24.04.1","6.14.0-1018.18~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1007.7~24.04.1"}]}],"versions":["6.17.0-1004.4~24.04.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1050.54"}]}],"versions":["6.5.0-1005.7","6.7.0-1001.1","6.8.0-1001.1","6.8.0-1002.2","6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.10","6.8.0-1010.11","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.23","6.8.0-1020.24","6.8.0-1024.28","6.8.0-1028.32","6.8.0-1029.33","6.8.0-1030.34","6.8.0-1031.35","6.8.0-1032.36","6.8.0-1035.39","6.8.0-1036.40","6.8.0-1038.42","6.8.0-1039.43","6.8.0-1040.44","6.8.0-1041.45","6.8.0-1042.46","6.8.0-1043.47","6.8.0-1044.48","6.8.0-1045.49","6.8.0-1047.51","6.8.0-1048.52"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-2019.20"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.1-1015.16"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-9.9.1","6.8.0-20.20.1","6.8.0-28.28.1","6.8.0-31.31.1","6.8.0-35.35.1","6.8.0-36.36.1","6.8.0-38.38.1","6.8.0-39.39.1","6.8.0-40.40.1","6.8.0-41.41.1","6.8.0-44.44.1","6.8.0-47.47.1","6.8.0-48.48.1","6.8.0-49.49.1","6.8.0-50.51.1","6.8.0-51.52.1","6.8.0-52.53.1","6.8.0-53.55.1","6.8.0-55.57.1","6.8.0-56.58.1","6.8.0-57.59.1","6.8.0-58.60.1","6.8.0-59.61.1","6.8.0-60.63.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-22.22.1~24.04.1","6.14.0-23.23.1~24.04.1","6.14.0-24.24.1~24.04.1","6.14.0-27.27.1~24.04.1","6.14.0-28.28.1~24.04.1","6.14.0-29.29.1~24.04.1","6.14.0-32.32.1~24.04.1","6.14.0-33.33.1~24.04.1","6.14.0-34.34.1~24.04.1","6.14.0-35.35.1~24.04.1","6.14.0-36.36.1~24.04.1","6.14.0-37.37.1~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-xilinx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1028.29"}]}],"versions":["6.8.0-1008.9","6.8.0-1009.10","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1017.18","6.8.0-1018.19","6.8.0-1019.20","6.8.0-1020.21","6.8.0-1021.22","6.8.0-1022.23","6.8.0-1023.24","6.8.0-1024.25"]},{"source":"osv","ecosystem":"Ubuntu:Nvidia-BlueField:24.04:LTS","package":"linux-bluefield","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1017.21"}]}],"versions":["6.8.0-1011.15","6.8.0-1012.16","6.8.0-1013.17","6.8.0-1014.18","6.8.0-1016.20"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-raspi-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-2040.41"}]}],"versions":["6.7.0-2001.1","6.8.0-2001.1","6.8.0-2002.2","6.8.0-2004.4","6.8.0-2005.5","6.8.0-2006.6","6.8.0-2007.7","6.8.0-2008.8","6.8.0-2009.9","6.8.0-2010.10","6.8.0-2011.11","6.8.0-2012.12","6.8.0-2013.14","6.8.0-2014.15","6.8.0-2015.16","6.8.0-2016.17","6.8.0-2017.18","6.8.0-2018.19","6.8.0-2019.20","6.8.0-2022.23","6.8.0-2023.24","6.8.0-2024.25","6.8.0-2025.26","6.8.0-2026.27","6.8.0-2028.29","6.8.0-2029.30","6.8.0-2030.31","6.8.0-2031.32","6.8.0-2032.33","6.8.0-2033.34","6.8.0-2034.35","6.8.0-2035.36","6.8.0-2036.37","6.8.0-2037.38","6.8.0-2038.39"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.1-1045.46"}]}],"versions":["6.8.0-1008.19","6.8.1-1001.1","6.8.1-1002.2","6.8.1-1003.3","6.8.1-1004.4","6.8.1-1005.5","6.8.1-1006.6","6.8.1-1007.7","6.8.1-1008.8","6.8.1-1009.9","6.8.1-1010.10","6.8.1-1011.11","6.8.1-1012.12","6.8.1-1013.14","6.8.1-1014.15","6.8.1-1015.16","6.8.1-1016.17","6.8.1-1017.18","6.8.1-1018.19","6.8.1-1019.20","6.8.1-1020.21","6.8.1-1021.22","6.8.1-1022.23","6.8.1-1023.24","6.8.1-1024.25","6.8.1-1025.26","6.8.1-1026.27","6.8.1-1030.31","6.8.1-1031.32","6.8.1-1033.34","6.8.1-1034.35","6.8.1-1035.36","6.8.1-1036.37","6.8.1-1037.38","6.8.1-1038.39","6.8.1-1039.40","6.8.1-1040.41","6.8.1-1041.42","6.8.1-1042.43"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1003.3~24.04.3","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1016.16~24.04.1","6.14.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1006.7~24.04.1"}]}],"versions":["6.17.0-1004.5~24.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-aws-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1050.53+fips1"}]}],"versions":["6.8.0-1035.37+fips1","6.8.0-1036.38+fips1","6.8.0-1038.40+fips1","6.8.0-1039.41+fips1","6.8.0-1040.42+fips1","6.8.0-1041.43+fips1","6.8.0-1042.44+fips1","6.8.0-1043.45+fips1","6.8.0-1044.46+fips1","6.8.0-1045.47+fips1","6.8.0-1046.49+fips1","6.8.0-1047.50+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-azure-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1052.58+fips1"}]}],"versions":["6.8.0-1034.39+fips1","6.8.0-1040.46+fips1","6.8.0-1044.50+fips1","6.8.0-1046.52+fips1","6.8.0-1047.53+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-106.106+fips1"}]}],"versions":["6.8.0-38.38+fips4","6.8.0-78.78+fips1","6.8.0-79.79+fips1","6.8.0-83.83+fips1","6.8.0-84.84+fips1","6.8.0-85.85+fips1","6.8.0-86.87+fips1","6.8.0-87.88+fips1","6.8.0-88.89+fips1","6.8.0-90.91+fips1","6.8.0-94.96+fips1","6.8.0-100.100+fips1","6.8.0-101.101+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-gcp-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1052.55+fips1"}]}],"versions":["6.8.0-1036.38+fips1","6.8.0-1037.39+fips1","6.8.0-1039.41+fips1","6.8.0-1040.42+fips1","6.8.0-1041.43+fips1","6.8.0-1042.45+fips1","6.8.0-1043.46+fips1","6.8.0-1044.47+fips1","6.8.0-1045.48+fips1","6.8.0-1046.49+fips1","6.8.0-1047.50+fips1","6.8.0-1048.51+fips1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-14.14"}]}],"versions":["6.14.0-15.15","6.15.0-3.3","6.15.0-4.4","6.16.0-13.13","6.16.0-16.16","6.17.0-3.3","6.17.0-4.4","6.17.0-5.5","6.17.0-6.6","6.17.0-7.7","6.17.0-8.8","6.17.0-12.12"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1007.7"}]}],"versions":["6.14.0-1005.5","6.14.0-1007.7+25.10.2","6.16.0-1001.1","6.17.0-1001.1","6.17.0-1002.2","6.17.0-1003.3","6.17.0-1004.4","6.17.0-1005.5","6.17.0-1006.6"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1008.8"}]}],"versions":["6.14.0-1004.4","6.14.0-1007.7+25.10.1","6.16.0-1001.1","6.17.0-1002.2","6.17.0-1003.3","6.17.0-1004.4","6.17.0-1006.6","6.17.0-1007.7"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1003.3","6.17.0-1004.4","6.17.0-1005.5","6.17.0-1007.7","6.17.0-1008.8","6.17.0-1010.10","6.17.0-1012.12","6.17.0-1014.14","6.17.0-1015.15","6.17.0-1017.17"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1007.7"}]}],"versions":["6.14.0-1006.6","6.14.0-1009.9+25.10.1","6.16.0-1001.1","6.17.0-1001.1","6.17.0-1002.2","6.17.0-1003.3","6.17.0-1004.4","6.17.0-1005.5","6.17.0-1006.6"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1007.7"}]}],"versions":["6.14.0-1005.5","6.14.0-1007.7+25.10.1","6.16.0-1001.1","6.17.0-1001.1","6.17.0-1002.2","6.17.0-1003.3","6.17.0-1005.5","6.17.0-1006.6"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-raspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1008.8"}]}],"versions":["6.14.0-1005.5","6.17.0-1003.3","6.17.0-1004.4","6.17.0-1005.5","6.17.0-1006.6","6.17.0-1007.7"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1006.7"}]}],"versions":["6.14.0-1002.2","6.17.0-1001.2","6.17.0-1002.3","6.17.0-1003.4","6.17.0-1004.5","6.17.0-1005.6"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-14.14.1"}]}],"versions":["6.14.0-13.13.2","6.17.0-4.4.1","6.17.0-5.5.1","6.17.0-6.6.1","6.17.0-7.7.1","6.17.0-8.8.1","6.17.0-12.12.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-14.14"}]}],"versions":["6.14.0-15.15","6.15.0-3.3","6.15.0-4.4","6.16.0-13.13","6.16.0-16.16","6.17.0-3.3","6.17.0-4.4","6.17.0-5.5","6.17.0-6.6","6.17.0-7.7","6.17.0-8.8","6.17.0-12.12"],"bundled":367},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-raspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1008.8"}]}],"versions":["6.14.0-1005.5","6.17.0-1003.3","6.17.0-1004.4","6.17.0-1005.5","6.17.0-1006.6","6.17.0-1007.7"],"bundled":367},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1006.7"}]}],"versions":["6.14.0-1002.2","6.17.0-1001.2","6.17.0-1002.3","6.17.0-1003.4","6.17.0-1004.5","6.17.0-1005.6"],"bundled":367},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1007.7"}]}],"versions":["6.14.0-1005.5","6.14.0-1007.7+25.10.2","6.16.0-1001.1","6.17.0-1001.1","6.17.0-1002.2","6.17.0-1003.3","6.17.0-1004.4","6.17.0-1005.5","6.17.0-1006.6"],"bundled":367},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1007.7"}]}],"versions":["6.14.0-1005.5","6.14.0-1007.7+25.10.1","6.16.0-1001.1","6.17.0-1001.1","6.17.0-1002.2","6.17.0-1003.3","6.17.0-1005.5","6.17.0-1006.6"],"bundled":367},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1008.8"}]}],"versions":["6.14.0-1004.4","6.14.0-1007.7+25.10.1","6.16.0-1001.1","6.17.0-1002.2","6.17.0-1003.3","6.17.0-1004.4","6.17.0-1006.6","6.17.0-1007.7"],"bundled":367},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1007.7"}]}],"versions":["6.14.0-1006.6","6.14.0-1009.9+25.10.1","6.16.0-1001.1","6.17.0-1001.1","6.17.0-1002.2","6.17.0-1003.3","6.17.0-1004.4","6.17.0-1005.5","6.17.0-1006.6"],"bundled":366},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-1011.11"}]}],"versions":["6.17.0-1005.5","6.17.0-1006.6","6.17.0-1007.7","6.17.0-1008.8","6.17.0-1009.9","6.17.0-1010.10"],"bundled":366},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1052.55~22.04.1"}]}],"versions":["6.8.0-1010.11~22.04.1","6.8.0-1011.12~22.04.1","6.8.0-1012.13~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.16~22.04.1","6.8.0-1015.17~22.04.1","6.8.0-1016.18~22.04.1","6.8.0-1017.19~22.04.1","6.8.0-1018.20~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1024.26~22.04.1","6.8.0-1025.27~22.04.1","6.8.0-1026.28~22.04.1","6.8.0-1027.29~22.04.1","6.8.0-1028.30~22.04.1","6.8.0-1029.31~22.04.1","6.8.0-1030.32~22.04.1","6.8.0-1031.33~22.04.1","6.8.0-1032.34~22.04.1","6.8.0-1033.35~22.04.1","6.8.0-1034.36~22.04.2","6.8.0-1036.38~22.04.1","6.8.0-1037.39~22.04.1","6.8.0-1040.42~22.04.1","6.8.0-1041.43~22.04.1","6.8.0-1042.45~22.04.1","6.8.0-1043.46~22.04.1","6.8.0-1044.47~22.04.1","6.8.0-1045.48~22.04.1","6.8.0-1046.49~22.04.1","6.8.0-1047.50~22.04.2","6.8.0-1048.51~22.04.1"],"bundled":423},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-106.106~22.04.1"}]}],"versions":["6.8.0-38.38~22.04.1","6.8.0-39.39~22.04.1","6.8.0-40.40~22.04.3","6.8.0-45.45~22.04.1","6.8.0-47.47~22.04.1","6.8.0-48.48~22.04.1","6.8.0-49.49~22.04.1","6.8.0-50.51~22.04.1","6.8.0-51.52~22.04.1","6.8.0-52.53~22.04.1","6.8.0-57.59~22.04.1","6.8.0-58.60~22.04.1","6.8.0-59.61~22.04.1","6.8.0-60.63~22.04.1","6.8.0-64.67~22.04.1","6.8.0-65.68~22.04.1","6.8.0-78.78~22.04.1","6.8.0-79.79~22.04.1","6.8.0-83.83~22.04.1","6.8.0-84.84~22.04.1","6.8.0-85.85~22.04.1","6.8.0-86.87~22.04.1","6.8.0-87.88~22.04.1","6.8.0-88.89~22.04.2","6.8.0-90.91~22.04.1","6.8.0-94.96~22.04.1","6.8.0-100.100~22.04.1","6.8.0-101.101~22.04.1"],"bundled":423},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-ibm-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1049.49~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.13~22.04.1","6.8.0-1014.14~22.04.1","6.8.0-1015.15~22.04.1","6.8.0-1016.16~22.04.1","6.8.0-1017.17~22.04.1","6.8.0-1018.18~22.04.1","6.8.0-1019.19~22.04.1","6.8.0-1023.23~22.04.1","6.8.0-1024.24~22.04.1","6.8.0-1025.25~22.04.1","6.8.0-1026.26~22.04.1","6.8.0-1027.27~22.04.1","6.8.0-1028.28~22.04.1","6.8.0-1029.29~22.04.1","6.8.0-1030.30~22.04.1","6.8.0-1033.33~22.04.1","6.8.0-1036.36~22.04.1","6.8.0-1037.37~22.04.1","6.8.0-1038.38~22.04.1","6.8.0-1039.39~22.04.1","6.8.0-1040.40~22.04.1","6.8.0-1041.41~22.04.1","6.8.0-1042.42~22.04.1","6.8.0-1043.43~22.04.1","6.8.0-1044.44~22.04.1","6.8.0-1045.45~22.04.1"],"bundled":423},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-106.106.1~22.04.1"}]}],"versions":["6.8.0-38.38.1~22.04.2","6.8.0-40.40.1~22.04.1","6.8.0-44.44.1~22.04.1","6.8.0-45.45.1~22.04.1","6.8.0-47.47.1~22.04.1","6.8.0-48.48.3~22.04.1","6.8.0-49.49.1~22.04.1","6.8.0-50.51.1~22.04.1","6.8.0-51.52.1~22.04.1","6.8.0-52.53.1~22.04.1","6.8.0-54.56.1~22.04.1","6.8.0-55.57.1~22.04.1","6.8.0-56.58.1~22.04.1","6.8.0-57.59.1~22.04.1","6.8.0-58.60.1~22.04.1","6.8.0-59.61.1~22.04.1","6.8.0-60.63.1~22.04.1","6.8.0-62.65.1~22.04.1","6.8.0-63.66.1~22.04.1","6.8.0-64.67.1~22.04.1","6.8.0-65.68.1~22.04.1","6.8.0-78.78.1~22.04.1","6.8.0-79.79.1~22.04.1","6.8.0-83.83.1~22.04.1","6.8.0-84.84.1~22.04.1","6.8.0-85.85.1~22.04.1","6.8.0-86.87.1~22.04.1","6.8.0-87.88.1~22.04.1","6.8.0-88.89.1~22.04.1","6.8.0-90.91.1~22.04.1","6.8.0-94.96.1~22.04.1","6.8.0-100.100.1~22.04.1","6.8.0-101.101.1~22.04.1"],"bundled":423},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1047.48~22.04.1"}]}],"versions":["6.8.0-1006.6~22.04.3","6.8.0-1008.8~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.13~22.04.1","6.8.0-1014.14~22.04.1","6.8.0-1015.15~22.04.1","6.8.0-1016.17~22.04.1","6.8.0-1017.18~22.04.1","6.8.0-1018.19~22.04.1","6.8.0-1019.20~22.04.1","6.8.0-1020.21~22.04.1","6.8.0-1021.22~22.04.1","6.8.0-1022.23~22.04.1","6.8.0-1023.24~22.04.1","6.8.0-1024.25~22.04.1","6.8.0-1025.26~22.04.1","6.8.0-1026.27~22.04.1","6.8.0-1027.28~22.04.1","6.8.0-1028.29~22.04.1","6.8.0-1029.30~22.04.1","6.8.0-1030.31~22.04.1","6.8.0-1032.33~22.04.1","6.8.0-1033.34~22.04.1","6.8.0-1035.36~22.04.1","6.8.0-1037.38~22.04.1","6.8.0-1038.39~22.04.1","6.8.0-1039.40~22.04.1","6.8.0-1040.41~22.04.1","6.8.0-1041.42~22.04.1","6.8.0-1042.43~22.04.1","6.8.0-1043.44~22.04.1","6.8.0-1044.45~22.04.1"],"bundled":423},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-106.106"}]}],"versions":["6.5.0-9.9","6.6.0-14.14","6.8.0-11.11","6.8.0-20.20","6.8.0-22.22","6.8.0-28.28","6.8.0-31.31","6.8.0-35.35","6.8.0-36.36","6.8.0-38.38","6.8.0-39.39","6.8.0-40.40","6.8.0-41.41","6.8.0-44.44","6.8.0-45.45","6.8.0-47.47","6.8.0-48.48","6.8.0-49.49","6.8.0-50.51","6.8.0-51.52","6.8.0-52.53","6.8.0-53.55","6.8.0-54.56","6.8.0-55.57","6.8.0-56.58","6.8.0-57.59","6.8.0-58.60","6.8.0-59.61","6.8.0-60.63","6.8.0-62.65","6.8.0-63.66","6.8.0-64.67","6.8.0-71.71","6.8.0-78.78","6.8.0-79.79","6.8.0-83.83","6.8.0-84.84","6.8.0-85.85","6.8.0-86.87","6.8.0-87.88","6.8.0-88.89","6.8.0-90.91","6.8.0-94.96","6.8.0-100.100","6.8.0-101.101"],"bundled":423},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1050.53"}]}],"versions":["6.5.0-1008.8","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1006.6","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1016.17","6.8.0-1017.18","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1023.25","6.8.0-1024.26","6.8.0-1025.27","6.8.0-1026.28","6.8.0-1027.29","6.8.0-1028.30","6.8.0-1029.31","6.8.0-1030.32","6.8.0-1031.33","6.8.0-1032.34","6.8.0-1033.35","6.8.0-1035.37","6.8.0-1036.38","6.8.0-1038.40","6.8.0-1039.41","6.8.0-1040.42","6.8.0-1041.43","6.8.0-1042.44","6.8.0-1043.45","6.8.0-1044.46","6.8.0-1045.47","6.8.0-1046.49","6.8.0-1047.50"],"bundled":423},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1052.55"}]}],"versions":["6.5.0-1007.7","6.6.0-1001.1","6.8.0-1002.2","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.9","6.8.0-1009.10","6.8.0-1010.11","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1024.26","6.8.0-1025.27","6.8.0-1026.28","6.8.0-1027.29","6.8.0-1028.30","6.8.0-1029.31","6.8.0-1030.32","6.8.0-1031.33","6.8.0-1032.34","6.8.0-1033.35","6.8.0-1034.36","6.8.0-1036.38","6.8.0-1037.39","6.8.0-1039.41","6.8.0-1040.42","6.8.0-1041.43","6.8.0-1042.45","6.8.0-1043.46","6.8.0-1044.47","6.8.0-1045.48","6.8.0-1046.49","6.8.0-1047.50","6.8.0-1048.51"],"bundled":423},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1048.53"}]}],"versions":["6.8.0-1003.5","6.8.0-1004.7","6.8.0-1005.8","6.8.0-1006.9","6.8.0-1007.10","6.8.0-1008.11","6.8.0-1009.12","6.8.0-1010.13","6.8.0-1011.14","6.8.0-1012.15","6.8.0-1013.17","6.8.0-1014.18","6.8.0-1015.19","6.8.0-1016.20","6.8.0-1017.21","6.8.0-1019.23","6.8.0-1020.24","6.8.0-1021.25","6.8.0-1022.26","6.8.0-1023.27","6.8.0-1024.28","6.8.0-1025.29","6.8.0-1026.30","6.8.0-1027.31","6.8.0-1028.32","6.8.0-1029.33","6.8.0-1032.36","6.8.0-1033.37","6.8.0-1035.39","6.8.0-1036.40","6.8.0-1037.41","6.8.0-1038.43","6.8.0-1039.44","6.8.0-1040.45","6.8.0-1041.46","6.8.0-1042.47","6.8.0-1043.48","6.8.0-1044.49"],"bundled":423},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1035.38"}]}],"versions":["6.8.0-1001.3","6.8.0-1002.4","6.8.0-1003.5","6.8.0-1004.6","6.8.0-1006.8","6.8.0-1007.9","6.8.0-1008.10","6.8.0-1009.11","6.8.0-1010.12","6.8.0-1011.13","6.8.0-1012.14","6.8.0-1013.15","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1022.24","6.8.0-1023.25","6.8.0-1024.26","6.8.0-1025.28","6.8.0-1026.29","6.8.0-1027.30","6.8.0-1028.31","6.8.0-1029.32","6.8.0-1030.33","6.8.0-1031.34"],"bundled":423},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1049.49"}]}],"versions":["6.5.0-1009.9","6.8.0-1001.1","6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1015.15","6.8.0-1016.16","6.8.0-1017.17","6.8.0-1018.18","6.8.0-1019.19","6.8.0-1022.22","6.8.0-1023.23","6.8.0-1024.24","6.8.0-1025.25","6.8.0-1026.26","6.8.0-1027.27","6.8.0-1028.28","6.8.0-1029.29","6.8.0-1030.30","6.8.0-1033.33","6.8.0-1036.36","6.8.0-1037.37","6.8.0-1038.38","6.8.0-1039.39","6.8.0-1040.40","6.8.0-1041.41","6.8.0-1042.42","6.8.0-1043.43","6.8.0-1044.44","6.8.0-1045.45"],"bundled":423},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-106.106.1"}]}],"versions":["6.5.0-9.9.1","6.6.0-14.14.1","6.8.0-7.7.1","6.8.0-25.25.3","6.8.0-28.28.1","6.8.0-31.31.1","6.8.0-35.35.1","6.8.0-36.36.1","6.8.0-38.38.1","6.8.0-39.39.1","6.8.0-40.40.1","6.8.0-41.41.1","6.8.0-44.44.1","6.8.0-45.45.1","6.8.0-47.47.1","6.8.0-48.48.3","6.8.0-49.49.1","6.8.0-50.51.1","6.8.0-51.52.1","6.8.0-52.53.1","6.8.0-53.55.2","6.8.0-54.56.1","6.8.0-55.57.1","6.8.0-56.58.1","6.8.0-57.59.1","6.8.0-58.60.1","6.8.0-59.61.1","6.8.0-60.63.1","6.8.0-62.65.1","6.8.0-63.66.1","6.8.0-64.67.1","6.8.0-65.68.1","6.8.0-78.78.1","6.8.0-79.79.1","6.8.0-83.83.1","6.8.0-84.84.1","6.8.0-85.85.1","6.8.0-86.87.1","6.8.0-87.88.1","6.8.0-88.89.1","6.8.0-90.91.1","6.8.0-94.96.1","6.8.0-100.100.1","6.8.0-101.101.1"],"bundled":423},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1047.48"}]}],"versions":["6.5.0-1010.10","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1008.8","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1015.16","6.8.0-1016.17","6.8.0-1017.18","6.8.0-1018.19","6.8.0-1019.20","6.8.0-1020.21","6.8.0-1021.22","6.8.0-1022.23","6.8.0-1023.24","6.8.0-1024.25","6.8.0-1025.26","6.8.0-1026.27","6.8.0-1027.28","6.8.0-1028.29","6.8.0-1029.30","6.8.0-1030.31","6.8.0-1032.33","6.8.0-1033.34","6.8.0-1035.36","6.8.0-1037.38","6.8.0-1038.39","6.8.0-1039.40","6.8.0-1040.41","6.8.0-1041.42","6.8.0-1042.43","6.8.0-1043.44","6.8.0-1044.45"],"bundled":423},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-aws-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1050.53+fips1"}]}],"versions":["6.8.0-1035.37+fips1","6.8.0-1036.38+fips1","6.8.0-1038.40+fips1","6.8.0-1039.41+fips1","6.8.0-1040.42+fips1","6.8.0-1041.43+fips1","6.8.0-1042.44+fips1","6.8.0-1043.45+fips1","6.8.0-1044.46+fips1","6.8.0-1045.47+fips1","6.8.0-1046.49+fips1","6.8.0-1047.50+fips1"],"bundled":423},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-106.106+fips1"}]}],"versions":["6.8.0-38.38+fips4","6.8.0-78.78+fips1","6.8.0-79.79+fips1","6.8.0-83.83+fips1","6.8.0-84.84+fips1","6.8.0-85.85+fips1","6.8.0-86.87+fips1","6.8.0-87.88+fips1","6.8.0-88.89+fips1","6.8.0-90.91+fips1","6.8.0-94.96+fips1","6.8.0-100.100+fips1","6.8.0-101.101+fips1"],"bundled":423},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-gcp-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1052.55+fips1"}]}],"versions":["6.8.0-1036.38+fips1","6.8.0-1037.39+fips1","6.8.0-1039.41+fips1","6.8.0-1040.42+fips1","6.8.0-1041.43+fips1","6.8.0-1042.45+fips1","6.8.0-1043.46+fips1","6.8.0-1044.47+fips1","6.8.0-1045.48+fips1","6.8.0-1046.49+fips1","6.8.0-1047.50+fips1","6.8.0-1048.51+fips1"],"bundled":423},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:22.04:LTS","package":"linux-realtime-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.1-1045.46~22.04.1"}]}],"versions":["6.8.1-1004.4~22.04.1","6.8.1-1005.5~22.04.2","6.8.1-1006.6~22.04.1","6.8.1-1007.7~22.04.1","6.8.1-1008.8~22.04.1","6.8.1-1009.9~22.04.1","6.8.1-1010.10~22.04.1","6.8.1-1011.11~22.04.1","6.8.1-1012.12~22.04.1","6.8.1-1013.14~22.04.1","6.8.1-1014.15~22.04.1","6.8.1-1015.16~22.04.1","6.8.1-1016.17~22.04.1","6.8.1-1017.18~22.04.1","6.8.1-1018.19~22.04.1","6.8.1-1019.20~22.04.1","6.8.1-1020.21~22.04.1","6.8.1-1021.22~22.04.1","6.8.1-1022.23~22.04.1","6.8.1-1023.24~22.04.1","6.8.1-1024.25~22.04.1","6.8.1-1025.26~22.04.1","6.8.1-1026.27~22.04.1","6.8.1-1030.31~22.04.1","6.8.1-1031.32~22.04.1","6.8.1-1034.35~22.04.1","6.8.1-1035.36~22.04.1","6.8.1-1036.37~22.04.1","6.8.1-1037.38~22.04.1","6.8.1-1038.39~22.04.1","6.8.1-1039.40~22.04.1","6.8.1-1040.41~22.04.1","6.8.1-1041.42~22.04.1","6.8.1-1042.43~22.04.1"],"bundled":423},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.1-1045.46"}]}],"versions":["6.8.0-1008.19","6.8.1-1001.1","6.8.1-1002.2","6.8.1-1003.3","6.8.1-1004.4","6.8.1-1005.5","6.8.1-1006.6","6.8.1-1007.7","6.8.1-1008.8","6.8.1-1009.9","6.8.1-1010.10","6.8.1-1011.11","6.8.1-1012.12","6.8.1-1013.14","6.8.1-1014.15","6.8.1-1015.16","6.8.1-1016.17","6.8.1-1017.18","6.8.1-1018.19","6.8.1-1019.20","6.8.1-1020.21","6.8.1-1021.22","6.8.1-1022.23","6.8.1-1023.24","6.8.1-1024.25","6.8.1-1025.26","6.8.1-1026.27","6.8.1-1030.31","6.8.1-1031.32","6.8.1-1033.34","6.8.1-1034.35","6.8.1-1035.36","6.8.1-1036.37","6.8.1-1037.38","6.8.1-1038.39","6.8.1-1039.40","6.8.1-1040.41","6.8.1-1041.42","6.8.1-1042.43"],"bundled":423},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1050.53~22.04.1"}]}],"versions":["6.8.0-1009.9~22.04.2","6.8.0-1010.10~22.04.2","6.8.0-1011.12~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.15~22.04.1","6.8.0-1015.16~22.04.1","6.8.0-1016.17~22.04.2","6.8.0-1017.18~22.04.1","6.8.0-1018.19~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1023.25~22.04.1","6.8.0-1024.26~22.04.1","6.8.0-1027.29~22.04.1","6.8.0-1028.30~22.04.1","6.8.0-1029.31~22.04.1","6.8.0-1030.32~22.04.1","6.8.0-1031.33~22.04.1","6.8.0-1032.34~22.04.1","6.8.0-1033.35~22.04.1","6.8.0-1035.37~22.04.1","6.8.0-1036.38~22.04.1","6.8.0-1039.41~22.04.1","6.8.0-1040.42~22.04.1","6.8.0-1041.43~22.04.1","6.8.0-1042.44~22.04.1","6.8.0-1043.45~22.04.1","6.8.0-1044.46~22.04.1","6.8.0-1045.47~22.04.1","6.8.0-1046.49~22.04.1","6.8.0-1047.50~22.04.1"],"bundled":423},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1050.54"}]}],"versions":["6.5.0-1005.7","6.7.0-1001.1","6.8.0-1001.1","6.8.0-1002.2","6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.10","6.8.0-1010.11","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.23","6.8.0-1020.24","6.8.0-1024.28","6.8.0-1028.32","6.8.0-1029.33","6.8.0-1030.34","6.8.0-1031.35","6.8.0-1032.36","6.8.0-1035.39","6.8.0-1036.40","6.8.0-1038.42","6.8.0-1039.43","6.8.0-1040.44","6.8.0-1041.45","6.8.0-1042.46","6.8.0-1043.47","6.8.0-1044.48","6.8.0-1045.49","6.8.0-1047.51","6.8.0-1048.52"],"bundled":423},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-raspi-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-2040.41"}]}],"versions":["6.7.0-2001.1","6.8.0-2001.1","6.8.0-2002.2","6.8.0-2004.4","6.8.0-2005.5","6.8.0-2006.6","6.8.0-2007.7","6.8.0-2008.8","6.8.0-2009.9","6.8.0-2010.10","6.8.0-2011.11","6.8.0-2012.12","6.8.0-2013.14","6.8.0-2014.15","6.8.0-2015.16","6.8.0-2016.17","6.8.0-2017.18","6.8.0-2018.19","6.8.0-2019.20","6.8.0-2022.23","6.8.0-2023.24","6.8.0-2024.25","6.8.0-2025.26","6.8.0-2026.27","6.8.0-2028.29","6.8.0-2029.30","6.8.0-2030.31","6.8.0-2031.32","6.8.0-2032.33","6.8.0-2033.34","6.8.0-2034.35","6.8.0-2035.36","6.8.0-2036.37","6.8.0-2037.38","6.8.0-2038.39"],"bundled":423},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1049.52~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1009.9~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.15~22.04.1","6.8.0-1015.16~22.04.1","6.8.0-1017.19~22.04.1","6.8.0-1018.20~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1022.25~22.04.2","6.8.0-1023.26~22.04.1","6.8.0-1024.27~22.04.1","6.8.0-1025.28~22.04.1","6.8.0-1026.29~22.04.1","6.8.0-1027.30~22.04.1","6.8.0-1028.31~22.04.1","6.8.0-1029.32~22.04.1","6.8.0-1030.33~22.04.1","6.8.0-1031.34~22.04.1","6.8.0-1032.35~22.04.1","6.8.0-1035.38~22.04.1","6.8.0-1036.39~22.04.1","6.8.0-1038.41~22.04.1","6.8.0-1039.42~22.04.1","6.8.0-1040.43~22.04.1","6.8.0-1041.44~22.04.2","6.8.0-1042.45~22.04.1","6.8.0-1043.46~22.04.1","6.8.0-1044.47~22.04.1","6.8.0-1045.48~22.04.1","6.8.0-1046.49~22.04.1","6.8.0-1047.50~22.04.1"],"bundled":425},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1049.52"}]}],"versions":["6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1022.25","6.8.0-1023.26","6.8.0-1024.27","6.8.0-1025.28","6.8.0-1026.29","6.8.0-1027.30","6.8.0-1028.31","6.8.0-1029.32","6.8.0-1030.33","6.8.0-1031.34","6.8.0-1032.35","6.8.0-1035.38","6.8.0-1036.39","6.8.0-1038.41","6.8.0-1039.42","6.8.0-1040.43","6.8.0-1041.44","6.8.0-1042.45","6.8.0-1043.46","6.8.0-1044.47","6.8.0-1045.48","6.8.0-1046.49","6.8.0-1047.50"],"bundled":425},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1049.52.1"}]}],"versions":["6.8.0-1009.9.1","6.8.0-1011.11.1","6.8.0-1012.12.1","6.8.0-1013.14.1","6.8.0-1014.15.1","6.8.0-1015.16.1","6.8.0-1017.19.1","6.8.0-1018.20.1","6.8.0-1019.21.1","6.8.0-1020.22.1","6.8.0-1021.23.1","6.8.0-1022.25.2","6.8.0-1023.26.1","6.8.0-1024.27.1","6.8.0-1025.28.1","6.8.0-1026.29.1","6.8.0-1027.30.1","6.8.0-1028.31.1","6.8.0-1029.32.1","6.8.0-1030.33.1","6.8.0-1031.34.1","6.8.0-1032.35.1","6.8.0-1035.38.1","6.8.0-1036.39.1","6.8.0-1038.41.1","6.8.0-1039.42.1","6.8.0-1040.43.1","6.8.0-1041.44.1","6.8.0-1042.45.1","6.8.0-1043.46.1","6.8.0-1044.47.1","6.8.0-1045.48.1","6.8.0-1046.49.1","6.8.0-1047.50.1"],"bundled":425},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1051.57"}]}],"versions":["6.5.0-1007.7","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1012.14","6.8.0-1013.15","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.20","6.8.0-1018.21","6.8.0-1020.23","6.8.0-1021.25","6.8.0-1025.30","6.8.0-1026.31","6.8.0-1027.32","6.8.0-1028.33","6.8.0-1029.34","6.8.0-1030.35","6.8.0-1031.36","6.8.0-1034.39","6.8.0-1038.44","6.8.0-1040.46","6.8.0-1041.47","6.8.0-1042.48","6.8.0-1044.50","6.8.0-1046.52"],"bundled":426},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1051.57~22.04.1"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1009.9~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1012.14~22.04.1","6.8.0-1013.15~22.04.1","6.8.0-1014.16~22.04.1","6.8.0-1015.17~22.04.2","6.8.0-1017.20~22.04.1","6.8.0-1018.21~22.04.1","6.8.0-1020.23~22.04.1","6.8.0-1021.25~22.04.1","6.8.0-1025.30~22.04.1","6.8.0-1026.31~22.04.1","6.8.0-1027.32~22.04.1","6.8.0-1028.33~22.04.1","6.8.0-1029.34~22.04.1","6.8.0-1030.35~22.04.1","6.8.0-1031.36~22.04.1","6.8.0-1034.39~22.04.1","6.8.0-1036.42~22.04.1","6.8.0-1040.46~22.04.1","6.8.0-1041.47~22.04.1","6.8.0-1044.50~22.04.1"],"bundled":1179},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-azure-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1052.58+fips1"}]}],"versions":["6.8.0-1034.39+fips1","6.8.0-1040.46+fips1","6.8.0-1044.50+fips1","6.8.0-1046.52+fips1","6.8.0-1047.53+fips1"],"bundled":438},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-xilinx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-1029.30"}]}],"versions":["6.8.0-1008.9","6.8.0-1009.10","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1017.18","6.8.0-1018.19","6.8.0-1019.20","6.8.0-1020.21","6.8.0-1021.22","6.8.0-1022.23","6.8.0-1023.24","6.8.0-1024.25","6.8.0-1028.29"],"bundled":609}],"products":[{"vendor":"linux","product":"linux"}],"references":[{"url":"https://git.kernel.org/stable/c/d0df2503bc3c2be385ca2fd96585daad1870c7c5","tags":["web","report"]},{"url":"https://git.kernel.org/stable/c/b63c061be622b17b495cbf78a6d5f2d4c3147f8e","tags":["web","report"]},{"url":"https://git.kernel.org/stable/c/3591d56ea9bfd3e7fbbe70f749bdeed689d415f9","tags":["web","report"]},{"url":"https://git.kernel.org/stable/c/54f938d9f5693af8ed586a08db4af5d9da1f0f2d","tags":["web","report"]},{"url":"https://git.kernel.org/stable/c/0fd20f65df6aa430454a0deed8f43efa91c54835","tags":["web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68310","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-f5pp-8jv2-77ph"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-68310","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68310.json","tags":["advisory"]},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-68310","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0017.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35021","tags":["report"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.117","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.118","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.119","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.120","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2026-0018.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35022","tags":["report"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1303","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57994","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58012","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37800","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38110","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38111","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38149","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38162","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38208","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38232","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38244","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38303","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38342","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38393","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38455","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38489","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38676","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38688","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38697","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38712","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38713","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38714","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38728","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39720","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39721","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39730","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39737","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39749","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39798","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39823","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39828","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39838","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39839","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39927","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39929","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39951","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40083","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40087","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40099","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40103","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40105","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40111","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40250","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40252","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40259","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40261","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40264","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40268","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40273","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40284","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40304","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40311","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40314","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40319","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40320","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40322","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40324","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40328","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40345","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40350","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40360","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40363","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68178","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68184","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68185","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68191","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68218","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68219","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68229","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68239","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68241","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68245","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68251","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68288","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68295","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68296","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68305","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68312","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68366","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68367","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68371","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68372","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68374","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68379","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68764","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68788","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68791","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68798","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68800","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68801","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68805","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68821","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71087","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71093","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71108","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71113","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71119","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71125","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71151","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1304","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1305","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38457","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39994","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40058","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621834-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1215199","tags":["report"]},{"url":"https://bugzilla.suse.com/1234634","tags":["report"]},{"url":"https://bugzilla.suse.com/1241259","tags":["report"]},{"url":"https://bugzilla.suse.com/1243603","tags":["report"]},{"url":"https://bugzilla.suse.com/1248754","tags":["report"]},{"url":"https://bugzilla.suse.com/1249104","tags":["report"]},{"url":"https://bugzilla.suse.com/1250951","tags":["report"]},{"url":"https://bugzilla.suse.com/1253471","tags":["report"]},{"url":"https://bugzilla.suse.com/1254518","tags":["report"]},{"url":"https://bugzilla.suse.com/1255160","tags":["report"]},{"url":"https://bugzilla.suse.com/1255360","tags":["report"]},{"url":"https://bugzilla.suse.com/1255459","tags":["report"]},{"url":"https://bugzilla.suse.com/1255752","tags":["report"]},{"url":"https://bugzilla.suse.com/1256288","tags":["report"]},{"url":"https://bugzilla.suse.com/1256865","tags":["report"]},{"url":"https://bugzilla.suse.com/1256867","tags":["report"]},{"url":"https://bugzilla.suse.com/1258518","tags":["report"]},{"url":"https://bugzilla.suse.com/1258718","tags":["report"]},{"url":"https://bugzilla.suse.com/1258826","tags":["report"]},{"url":"https://bugzilla.suse.com/1258849","tags":["report"]},{"url":"https://bugzilla.suse.com/1258850","tags":["report"]},{"url":"https://bugzilla.suse.com/1258854","tags":["report"]},{"url":"https://bugzilla.suse.com/1258855","tags":["report"]},{"url":"https://bugzilla.suse.com/1258856","tags":["report"]},{"url":"https://bugzilla.suse.com/1258857","tags":["report"]},{"url":"https://bugzilla.suse.com/1258933","tags":["report"]},{"url":"https://bugzilla.suse.com/1258961","tags":["report"]},{"url":"https://bugzilla.suse.com/1259186","tags":["report"]},{"url":"https://bugzilla.suse.com/1259199","tags":["report"]},{"url":"https://bugzilla.suse.com/1259222","tags":["report"]},{"url":"https://bugzilla.suse.com/1259420","tags":["report"]},{"url":"https://bugzilla.suse.com/1259461","tags":["report"]},{"url":"https://bugzilla.suse.com/1259535","tags":["report"]},{"url":"https://bugzilla.suse.com/1259672","tags":["report"]},{"url":"https://bugzilla.suse.com/1259799","tags":["report"]},{"url":"https://bugzilla.suse.com/1259806","tags":["report"]},{"url":"https://bugzilla.suse.com/1259857","tags":["report"]},{"url":"https://bugzilla.suse.com/1259865","tags":["report"]},{"url":"https://bugzilla.suse.com/1259868","tags":["report"]},{"url":"https://bugzilla.suse.com/1259869","tags":["report"]},{"url":"https://bugzilla.suse.com/1259871","tags":["report"]},{"url":"https://bugzilla.suse.com/1259873","tags":["report"]},{"url":"https://bugzilla.suse.com/1259878","tags":["report"]},{"url":"https://bugzilla.suse.com/1259889","tags":["report"]},{"url":"https://bugzilla.suse.com/1259994","tags":["report"]},{"url":"https://bugzilla.suse.com/1260010","tags":["report"]},{"url":"https://bugzilla.suse.com/1260012","tags":["report"]},{"url":"https://bugzilla.suse.com/1260018","tags":["report"]},{"url":"https://bugzilla.suse.com/1260428","tags":["report"]},{"url":"https://bugzilla.suse.com/1260468","tags":["report"]},{"url":"https://bugzilla.suse.com/1260483","tags":["report"]},{"url":"https://bugzilla.suse.com/1260484","tags":["report"]},{"url":"https://bugzilla.suse.com/1260485","tags":["report"]},{"url":"https://bugzilla.suse.com/1260489","tags":["report"]},{"url":"https://bugzilla.suse.com/1260504","tags":["report"]},{"url":"https://bugzilla.suse.com/1260505","tags":["report"]},{"url":"https://bugzilla.suse.com/1260507","tags":["report"]},{"url":"https://bugzilla.suse.com/1260514","tags":["report"]},{"url":"https://bugzilla.suse.com/1260523","tags":["report"]},{"url":"https://bugzilla.suse.com/1260526","tags":["report"]},{"url":"https://bugzilla.suse.com/1260528","tags":["report"]},{"url":"https://bugzilla.suse.com/1260529","tags":["report"]},{"url":"https://bugzilla.suse.com/1260530","tags":["report"]},{"url":"https://bugzilla.suse.com/1260531","tags":["report"]},{"url":"https://bugzilla.suse.com/1260532","tags":["report"]},{"url":"https://bugzilla.suse.com/1260533","tags":["report"]},{"url":"https://bugzilla.suse.com/1260536","tags":["report"]},{"url":"https://bugzilla.suse.com/1260537","tags":["report"]},{"url":"https://bugzilla.suse.com/1260538","tags":["report"]},{"url":"https://bugzilla.suse.com/1260541","tags":["report"]},{"url":"https://bugzilla.suse.com/1260546","tags":["report"]},{"url":"https://bugzilla.suse.com/1260549","tags":["report"]},{"url":"https://bugzilla.suse.com/1260551","tags":["report"]},{"url":"https://bugzilla.suse.com/1260552","tags":["report"]},{"url":"https://bugzilla.suse.com/1260555","tags":["report"]},{"url":"https://bugzilla.suse.com/1260561","tags":["report"]},{"url":"https://bugzilla.suse.com/1260562","tags":["report"]},{"url":"https://bugzilla.suse.com/1260566","tags":["report"]},{"url":"https://bugzilla.suse.com/1260571","tags":["report"]},{"url":"https://bugzilla.suse.com/1260572","tags":["report"]},{"url":"https://bugzilla.suse.com/1260573","tags":["report"]},{"url":"https://bugzilla.suse.com/1260576","tags":["report"]},{"url":"https://bugzilla.suse.com/1260580","tags":["report"]},{"url":"https://bugzilla.suse.com/1260581","tags":["report"]},{"url":"https://bugzilla.suse.com/1260593","tags":["report"]},{"url":"https://bugzilla.suse.com/1260613","tags":["report"]},{"url":"https://bugzilla.suse.com/1260728","tags":["report"]},{"url":"https://bugzilla.suse.com/1260729","tags":["report"]},{"url":"https://bugzilla.suse.com/1260731","tags":["report"]},{"url":"https://bugzilla.suse.com/1260798","tags":["report"]},{"url":"https://bugzilla.suse.com/1260800","tags":["report"]},{"url":"https://bugzilla.suse.com/1260801","tags":["report"]},{"url":"https://bugzilla.suse.com/1260807","tags":["report"]},{"url":"https://bugzilla.suse.com/1260811","tags":["report"]},{"url":"https://bugzilla.suse.com/1260996","tags":["report"]},{"url":"https://bugzilla.suse.com/1261020","tags":["report"]},{"url":"https://bugzilla.suse.com/1261149","tags":["report"]},{"url":"https://bugzilla.suse.com/1261287","tags":["report"]},{"url":"https://bugzilla.suse.com/1261288","tags":["report"]},{"url":"https://bugzilla.suse.com/1261295","tags":["report"]},{"url":"https://bugzilla.suse.com/1261348","tags":["report"]},{"url":"https://bugzilla.suse.com/1261410","tags":["report"]},{"url":"https://bugzilla.suse.com/1261503","tags":["report"]},{"url":"https://bugzilla.suse.com/1261504","tags":["report"]},{"url":"https://bugzilla.suse.com/1261505","tags":["report"]},{"url":"https://bugzilla.suse.com/1261550","tags":["report"]},{"url":"https://bugzilla.suse.com/1261555","tags":["report"]},{"url":"https://bugzilla.suse.com/1261581","tags":["report"]},{"url":"https://bugzilla.suse.com/1261582","tags":["report"]},{"url":"https://bugzilla.suse.com/1261584","tags":["report"]},{"url":"https://bugzilla.suse.com/1261585","tags":["report"]},{"url":"https://bugzilla.suse.com/1261592","tags":["report"]},{"url":"https://bugzilla.suse.com/1261601","tags":["report"]},{"url":"https://bugzilla.suse.com/1261602","tags":["report"]},{"url":"https://bugzilla.suse.com/1261617","tags":["report"]},{"url":"https://bugzilla.suse.com/1261618","tags":["report"]},{"url":"https://bugzilla.suse.com/1261629","tags":["report"]},{"url":"https://bugzilla.suse.com/1261632","tags":["report"]},{"url":"https://bugzilla.suse.com/1261635","tags":["report"]},{"url":"https://bugzilla.suse.com/1261636","tags":["report"]},{"url":"https://bugzilla.suse.com/1261637","tags":["report"]},{"url":"https://bugzilla.suse.com/1261638","tags":["report"]},{"url":"https://bugzilla.suse.com/1261641","tags":["report"]},{"url":"https://bugzilla.suse.com/1261644","tags":["report"]},{"url":"https://bugzilla.suse.com/1261645","tags":["report"]},{"url":"https://bugzilla.suse.com/1261648","tags":["report"]},{"url":"https://bugzilla.suse.com/1261679","tags":["report"]},{"url":"https://bugzilla.suse.com/1261685","tags":["report"]},{"url":"https://bugzilla.suse.com/1261686","tags":["report"]},{"url":"https://bugzilla.suse.com/1261687","tags":["report"]},{"url":"https://bugzilla.suse.com/1261692","tags":["report"]},{"url":"https://bugzilla.suse.com/1261694","tags":["report"]},{"url":"https://bugzilla.suse.com/1261700","tags":["report"]},{"url":"https://bugzilla.suse.com/1261702","tags":["report"]},{"url":"https://bugzilla.suse.com/1261703","tags":["report"]},{"url":"https://bugzilla.suse.com/1261707","tags":["report"]},{"url":"https://bugzilla.suse.com/1261710","tags":["report"]},{"url":"https://bugzilla.suse.com/1261713","tags":["report"]},{"url":"https://bugzilla.suse.com/1261714","tags":["report"]},{"url":"https://bugzilla.suse.com/1261719","tags":["report"]},{"url":"https://bugzilla.suse.com/1261738","tags":["report"]},{"url":"https://bugzilla.suse.com/1261750","tags":["report"]},{"url":"https://bugzilla.suse.com/1261751","tags":["report"]},{"url":"https://bugzilla.suse.com/1261752","tags":["report"]},{"url":"https://bugzilla.suse.com/1261768","tags":["report"]},{"url":"https://bugzilla.suse.com/1261778","tags":["report"]},{"url":"https://bugzilla.suse.com/1261779","tags":["report"]},{"url":"https://bugzilla.suse.com/1261780","tags":["report"]},{"url":"https://bugzilla.suse.com/1261781","tags":["report"]},{"url":"https://bugzilla.suse.com/1261786","tags":["report"]},{"url":"https://bugzilla.suse.com/1261788","tags":["report"]},{"url":"https://bugzilla.suse.com/1261789","tags":["report"]},{"url":"https://bugzilla.suse.com/1261796","tags":["report"]},{"url":"https://bugzilla.suse.com/1261797","tags":["report"]},{"url":"https://bugzilla.suse.com/1261896","tags":["report"]},{"url":"https://bugzilla.suse.com/1262019","tags":["report"]},{"url":"https://bugzilla.suse.com/1262053","tags":["report"]},{"url":"https://bugzilla.suse.com/1262054","tags":["report"]},{"url":"https://bugzilla.suse.com/1262055","tags":["report"]},{"url":"https://bugzilla.suse.com/1262061","tags":["report"]},{"url":"https://bugzilla.suse.com/1262063","tags":["report"]},{"url":"https://bugzilla.suse.com/1262074","tags":["report"]},{"url":"https://bugzilla.suse.com/1262078","tags":["report"]},{"url":"https://bugzilla.suse.com/1262086","tags":["report"]},{"url":"https://bugzilla.suse.com/1262087","tags":["report"]},{"url":"https://bugzilla.suse.com/1262099","tags":["report"]},{"url":"https://bugzilla.suse.com/1262100","tags":["report"]},{"url":"https://bugzilla.suse.com/1262101","tags":["report"]},{"url":"https://bugzilla.suse.com/1262179","tags":["report"]},{"url":"https://bugzilla.suse.com/1262181","tags":["report"]},{"url":"https://bugzilla.suse.com/1262245","tags":["report"]},{"url":"https://bugzilla.suse.com/1262250","tags":["report"]},{"url":"https://bugzilla.suse.com/1262480","tags":["report"]},{"url":"https://bugzilla.suse.com/1262601","tags":["report"]},{"url":"https://bugzilla.suse.com/1262616","tags":["report"]},{"url":"https://bugzilla.suse.com/1262617","tags":["report"]},{"url":"https://bugzilla.suse.com/1262627","tags":["report"]},{"url":"https://bugzilla.suse.com/1262662","tags":["report"]},{"url":"https://bugzilla.suse.com/1262665","tags":["report"]},{"url":"https://bugzilla.suse.com/1262671","tags":["report"]},{"url":"https://bugzilla.suse.com/1262673","tags":["report"]},{"url":"https://bugzilla.suse.com/1262709","tags":["report"]},{"url":"https://bugzilla.suse.com/1262725","tags":["report"]},{"url":"https://bugzilla.suse.com/1262731","tags":["report"]},{"url":"https://bugzilla.suse.com/1262750","tags":["report"]},{"url":"https://bugzilla.suse.com/1262752","tags":["report"]},{"url":"https://bugzilla.suse.com/1262758","tags":["report"]},{"url":"https://bugzilla.suse.com/1263001","tags":["report"]},{"url":"https://bugzilla.suse.com/1263012","tags":["report"]},{"url":"https://bugzilla.suse.com/1263018","tags":["report"]},{"url":"https://bugzilla.suse.com/1263044","tags":["report"]},{"url":"https://bugzilla.suse.com/1263048","tags":["report"]},{"url":"https://bugzilla.suse.com/1263052","tags":["report"]},{"url":"https://bugzilla.suse.com/1263064","tags":["report"]},{"url":"https://bugzilla.suse.com/1263074","tags":["report"]},{"url":"https://bugzilla.suse.com/1263077","tags":["report"]},{"url":"https://bugzilla.suse.com/1263085","tags":["report"]},{"url":"https://bugzilla.suse.com/1263093","tags":["report"]},{"url":"https://bugzilla.suse.com/1263095","tags":["report"]},{"url":"https://bugzilla.suse.com/1263104","tags":["report"]},{"url":"https://bugzilla.suse.com/1263107","tags":["report"]},{"url":"https://bugzilla.suse.com/1263131","tags":["report"]},{"url":"https://bugzilla.suse.com/1263135","tags":["report"]},{"url":"https://bugzilla.suse.com/1263138","tags":["report"]},{"url":"https://bugzilla.suse.com/1263140","tags":["report"]},{"url":"https://bugzilla.suse.com/1263141","tags":["report"]},{"url":"https://bugzilla.suse.com/1263165","tags":["report"]},{"url":"https://bugzilla.suse.com/1263176","tags":["report"]},{"url":"https://bugzilla.suse.com/1263255","tags":["report"]},{"url":"https://bugzilla.suse.com/1263556","tags":["report"]},{"url":"https://bugzilla.suse.com/1263562","tags":["report"]},{"url":"https://bugzilla.suse.com/1263582","tags":["report"]},{"url":"https://bugzilla.suse.com/1263592","tags":["report"]},{"url":"https://bugzilla.suse.com/1263593","tags":["report"]},{"url":"https://bugzilla.suse.com/1263595","tags":["report"]},{"url":"https://bugzilla.suse.com/1263596","tags":["report"]},{"url":"https://bugzilla.suse.com/1263604","tags":["report"]},{"url":"https://bugzilla.suse.com/1263668","tags":["report"]},{"url":"https://bugzilla.suse.com/1263815","tags":["report"]},{"url":"https://bugzilla.suse.com/1263882","tags":["report"]},{"url":"https://bugzilla.suse.com/1263901","tags":["report"]},{"url":"https://bugzilla.suse.com/1263931","tags":["report"]},{"url":"https://bugzilla.suse.com/1263933","tags":["report"]},{"url":"https://bugzilla.suse.com/1263942","tags":["report"]},{"url":"https://bugzilla.suse.com/1263995","tags":["report"]},{"url":"https://bugzilla.suse.com/1264014","tags":["report"]},{"url":"https://bugzilla.suse.com/1264059","tags":["report"]},{"url":"https://bugzilla.suse.com/1264082","tags":["report"]},{"url":"https://bugzilla.suse.com/1264097","tags":["report"]},{"url":"https://bugzilla.suse.com/1264183","tags":["report"]},{"url":"https://bugzilla.suse.com/1264233","tags":["report"]},{"url":"https://bugzilla.suse.com/1264427","tags":["report"]},{"url":"https://bugzilla.suse.com/1264469","tags":["report"]},{"url":"https://bugzilla.suse.com/1264586","tags":["report"]},{"url":"https://bugzilla.suse.com/1264674","tags":["report"]},{"url":"https://bugzilla.suse.com/1264837","tags":["report"]},{"url":"https://bugzilla.suse.com/1264848","tags":["report"]},{"url":"https://bugzilla.suse.com/1265085","tags":["report"]},{"url":"https://bugzilla.suse.com/1265116","tags":["report"]},{"url":"https://bugzilla.suse.com/1265119","tags":["report"]},{"url":"https://bugzilla.suse.com/1265144","tags":["report"]},{"url":"https://bugzilla.suse.com/1265308","tags":["report"]},{"url":"https://bugzilla.suse.com/1265421","tags":["report"]},{"url":"https://bugzilla.suse.com/1265449","tags":["report"]},{"url":"https://bugzilla.suse.com/1265456","tags":["report"]},{"url":"https://bugzilla.suse.com/1265626","tags":["report"]},{"url":"https://bugzilla.suse.com/1265846","tags":["report"]},{"url":"https://bugzilla.suse.com/1265960","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-2058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-14027","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68310","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71269","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71302","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23260","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23261","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23266","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23269","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23273","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23279","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23290","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23298","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23307","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23317","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23321","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23324","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23334","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23347","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23363","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23365","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23367","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23368","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23369","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23370","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23372","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23373","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23378","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23395","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23396","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23397","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23411","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23417","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23420","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23437","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23440","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23442","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23443","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23450","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23455","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23457","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23458","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23461","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23462","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23463","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23464","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23472","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23474","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31389","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31394","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31395","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31400","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31411","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31415","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31417","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31420","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31422","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31423","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31424","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31428","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31453","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31503","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31504","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31515","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31519","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31528","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31533","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31554","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31565","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31579","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31588","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31644","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31649","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31658","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31666","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31668","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31675","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31682","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31684","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31685","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31691","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31694","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31700","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31738","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31787","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43009","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43025","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43027","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43060","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43082","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43365","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43366","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43503","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46333","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621841-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621845-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621860-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262217-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1225897","tags":["report"]},{"url":"https://bugzilla.suse.com/1237452","tags":["report"]},{"url":"https://bugzilla.suse.com/1241166","tags":["report"]},{"url":"https://bugzilla.suse.com/1253122","tags":["report"]},{"url":"https://bugzilla.suse.com/1253754","tags":["report"]},{"url":"https://bugzilla.suse.com/1256863","tags":["report"]},{"url":"https://bugzilla.suse.com/1257183","tags":["report"]},{"url":"https://bugzilla.suse.com/1257631","tags":["report"]},{"url":"https://bugzilla.suse.com/1259484","tags":["report"]},{"url":"https://bugzilla.suse.com/1259485","tags":["report"]},{"url":"https://bugzilla.suse.com/1259870","tags":["report"]},{"url":"https://bugzilla.suse.com/1259995","tags":["report"]},{"url":"https://bugzilla.suse.com/1260497","tags":["report"]},{"url":"https://bugzilla.suse.com/1260501","tags":["report"]},{"url":"https://bugzilla.suse.com/1260522","tags":["report"]},{"url":"https://bugzilla.suse.com/1260527","tags":["report"]},{"url":"https://bugzilla.suse.com/1260544","tags":["report"]},{"url":"https://bugzilla.suse.com/1260550","tags":["report"]},{"url":"https://bugzilla.suse.com/1260553","tags":["report"]},{"url":"https://bugzilla.suse.com/1260989","tags":["report"]},{"url":"https://bugzilla.suse.com/1261412","tags":["report"]},{"url":"https://bugzilla.suse.com/1261507","tags":["report"]},{"url":"https://bugzilla.suse.com/1261628","tags":["report"]},{"url":"https://bugzilla.suse.com/1261669","tags":["report"]},{"url":"https://bugzilla.suse.com/1262020","tags":["report"]},{"url":"https://bugzilla.suse.com/1262526","tags":["report"]},{"url":"https://bugzilla.suse.com/1262599","tags":["report"]},{"url":"https://bugzilla.suse.com/1262602","tags":["report"]},{"url":"https://bugzilla.suse.com/1262734","tags":["report"]},{"url":"https://bugzilla.suse.com/1262746","tags":["report"]},{"url":"https://bugzilla.suse.com/1263065","tags":["report"]},{"url":"https://bugzilla.suse.com/1263149","tags":["report"]},{"url":"https://bugzilla.suse.com/1263170","tags":["report"]},{"url":"https://bugzilla.suse.com/1263600","tags":["report"]},{"url":"https://bugzilla.suse.com/1263723","tags":["report"]},{"url":"https://bugzilla.suse.com/1263797","tags":["report"]},{"url":"https://bugzilla.suse.com/1263877","tags":["report"]},{"url":"https://bugzilla.suse.com/1264087","tags":["report"]},{"url":"https://bugzilla.suse.com/1264449","tags":["report"]},{"url":"https://bugzilla.suse.com/1264482","tags":["report"]},{"url":"https://bugzilla.suse.com/1264634","tags":["report"]},{"url":"https://bugzilla.suse.com/1264651","tags":["report"]},{"url":"https://bugzilla.suse.com/1264661","tags":["report"]},{"url":"https://bugzilla.suse.com/1264801","tags":["report"]},{"url":"https://bugzilla.suse.com/1265090","tags":["report"]},{"url":"https://bugzilla.suse.com/1265126","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-20585","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23240","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23335","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23343","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23419","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31488","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31570","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31607","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31656","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43110","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43120","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43334","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43419","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43437","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262238-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1264013","tags":["report"]},{"url":"https://bugzilla.suse.com/1265209","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46331","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-68310","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-68310","tags":["report"]},{"url":"https://git.kernel.org/linus/0fd20f65df6aa430454a0deed8f43efa91c54835","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8029-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8030-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8029-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8048-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8029-3","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8095-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8100-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8095-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8095-3","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8095-4","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8125-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8126-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8095-5","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8165-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8261-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-40001","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40002","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40003","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40004","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40029","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40030","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40031","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40032","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40033","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40034","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40035","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40036","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40037","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40038","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40039","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40040","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40042","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40043","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40044","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40045","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40046","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40047","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40048","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40049","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40050","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40051","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40052","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40053","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40054","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40055","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40056","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40057","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40058","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40059","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40060","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40061","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40062","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40063","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40064","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40065","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40066","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40067","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40068","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40069","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40070","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40071","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40072","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40073","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40074","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40075","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40076","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40077","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40078","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40079","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40080","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40081","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40082","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40084","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40085","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40086","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40087","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40088","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40089","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40091","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40092","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40093","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40094","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40095","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40096","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40097","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40098","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40099","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40100","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40101","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40102","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40103","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40104","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40105","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40106","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40110","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40111","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40112","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40113","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40115","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40116","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40117","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40118","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40119","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40120","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40121","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40122","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40123","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40124","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40125","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40126","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40127","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40129","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40130","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40131","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40132","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40133","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40134","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40135","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40136","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40137","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40138","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40139","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40140","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40141","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40142","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40143","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40145","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40146","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40147","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40148","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40149","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40150","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40152","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40153","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40154","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40155","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40156","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40158","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40159","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40160","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40161","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40162","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40163","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40164","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40165","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40166","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40167","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40168","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40169","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40170","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40171","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40172","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40173","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40174","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40175","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40176","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40177","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40178","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40179","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40180","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40181","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40182","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40183","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40184","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40185","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40186","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40187","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40188","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40189","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40191","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40192","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40193","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40194","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40195","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40196","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40198","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40199","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40200","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40201","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40203","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40204","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40205","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40206","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40207","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40208","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40209","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40210","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40211","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40212","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40213","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40217","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40218","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40219","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40220","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40221","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40222","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40223","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40224","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40225","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40226","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40227","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40228","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40229","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40230","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40231","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40233","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40234","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40235","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40236","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40237","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40238","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40239","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40240","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40241","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40242","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40243","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40244","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40245","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40256","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40267","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40268","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40269","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40270","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40271","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40272","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40273","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40274","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40275","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40276","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40277","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40278","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40279","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40280","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40281","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40282","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40283","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40284","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40285","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40286","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40287","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40288","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40289","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40291","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40292","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40293","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40294","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40295","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40296","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40297","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40298","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40299","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40301","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40302","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40303","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40304","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40305","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40306","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40307","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40308","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40309","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40310","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40311","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40312","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40313","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40314","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40315","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40316","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40317","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40318","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40319","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40320","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40321","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40322","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40323","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40324","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40326","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40327","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40328","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40329","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40330","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40331","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40332","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40333","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40334","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40335","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40336","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40337","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40338","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40339","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40340","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40341","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40342","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40343","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40344","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40346","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40347","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40349","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40350","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40351","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40352","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40353","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40354","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40355","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40356","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40357","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40358","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40359","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40360","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40362","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40363","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68167","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68168","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68169","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68170","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68171","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68172","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68173","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68174","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68175","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68176","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68177","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68178","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68179","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68180","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68181","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68182","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68183","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68184","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68185","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68186","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68187","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68188","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68189","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68190","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68191","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68192","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68193","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68194","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68196","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68197","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68198","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68199","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68200","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68201","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68202","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68204","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68205","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68206","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68207","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68208","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68209","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68210","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68211","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68239","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68240","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68241","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68242","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68243","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68244","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68245","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68246","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68247","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68248","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68249","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68250","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68251","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68253","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68309","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68311","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68312","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68313","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68314","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68315","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68316","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68317","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68318","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68319","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68320","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68321","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68322","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68734","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40041","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40151","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21833","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22103","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22105","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22106","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22107","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22113","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22121","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22124","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22125","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23129","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23130","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23133","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23143","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37860","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38105","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38502","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38556","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38627","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38643","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38709","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39678","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39697","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39805","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39806","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39807","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39808","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39810","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39811","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39812","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39813","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39815","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39817","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39819","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39823","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39824","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39825","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39826","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39827","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39828","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39829","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39832","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39835","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39836","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39838","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39839","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39841","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39842","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39843","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39844","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39845","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39846","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39847","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39848","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39849","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39850","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39851","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39852","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39853","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39854","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39857","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39860","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39861","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39863","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39864","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39865","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39866","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39869","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39870","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39871","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39873","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39876","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39877","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39880","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39881","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39883","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39885","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39886","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39891","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39894","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39895","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39897","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39899","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39901","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39902","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39907","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39909","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39911","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39913","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39914","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39916","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39920","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39923","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39927","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39929","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39931","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39932","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39934","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39937","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39938","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39940","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39942","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39943","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39944","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39945","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39947","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39948","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39949","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39950","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39951","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39952","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39953","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39955","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39957","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39961","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39965","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39967","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39968","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39969","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39970","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39971","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39972","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39973","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39977","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39978","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39980","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39981","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39982","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39985","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39986","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39987","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39988","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39991","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39992","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39994","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39995","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39996","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39998","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40000","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40006","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40008","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40009","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40010","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40011","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40013","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40016","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40020","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40021","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40024","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40026","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40027","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40083","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40107","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40109","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40248","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40250","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40251","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40252","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40253","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40254","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40257","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40258","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40259","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40261","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40262","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40263","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40264","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40266","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40345","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68213","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68214","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68217","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68218","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68219","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68220","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68222","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68223","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68227","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68229","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68231","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68233","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68235","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68237","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68238","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68282","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68283","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68284","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68285","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68286","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68287","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68288","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68289","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68290","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68295","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68297","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68301","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68302","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68303","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68305","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68307","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68308","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68327","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68328","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68330","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68331","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68339","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68340","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68342","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68343","tags":["report"]},{"url":"https://launchpad.net/bugs/2143853","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23202","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23207","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22037","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37899","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40202","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-36331","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-36350","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-36357","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21884","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21931","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22026","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22101","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22102","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22115","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22120","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22126","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22128","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23140","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23141","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23142","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23144","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23145","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23146","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23147","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23148","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23149","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23150","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23151","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23155","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23156","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23157","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23158","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23159","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23160","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23161","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23163","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37738","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37739","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37740","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37741","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37742","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37744","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37745","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37748","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37749","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37754","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37755","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37757","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37758","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37759","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37761","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37763","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37764","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37765","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37766","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37767","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37768","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37769","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37770","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37771","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37772","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37773","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37775","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37777","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37778","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37780","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37781","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37784","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37786","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37787","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37788","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37789","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37790","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37792","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37793","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37794","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37796","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37799","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37800","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37801","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37803","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37805","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37808","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37809","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37810","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37811","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37812","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37813","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37815","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37816","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37817","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37819","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37820","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37822","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37823","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37824","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37826","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37827","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37828","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37829","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37830","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37831","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37836","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37839","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37840","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37841","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37842","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37844","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37846","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37849","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37850","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37851","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37852","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37853","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37854","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37856","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37857","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37858","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37859","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37861","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37862","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37863","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37864","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37865","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37867","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37869","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37871","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37872","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37873","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37874","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37875","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37878","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37879","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37881","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37883","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37884","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37885","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37886","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37887","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37891","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37892","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37897","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37900","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37901","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37903","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37905","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37909","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37911","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37912","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37913","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37914","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37915","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37916","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37917","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37918","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37920","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37921","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37922","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37923","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37924","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37925","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37927","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37928","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37930","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37931","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37933","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37935","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37936","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37938","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37940","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37943","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37944","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37945","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37947","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37948","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37949","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37951","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37952","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37956","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37957","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37959","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37960","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37961","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37962","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37963","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37967","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37968","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37969","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37970","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37972","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37973","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37975","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37977","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37978","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37979","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37980","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37982","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37983","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37984","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37985","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37986","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37987","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37988","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37989","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37990","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37991","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37992","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37994","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37995","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-37998","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38003","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38004","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38005","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38006","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38007","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38008","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38009","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38010","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38011","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38013","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38014","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38015","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38018","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38019","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38020","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38023","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38024","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38027","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38031","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38034","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38035","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38037","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38039","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38040","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38043","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38044","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38045","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38048","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38051","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38052","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38053","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38055","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38057","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38058","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38059","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38060","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38061","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38062","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38063","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38065","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38066","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38067","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38068","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38071","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38072","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38074","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38075","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38077","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38078","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38079","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38080","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38081","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38084","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38085","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38086","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38087","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38088","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38089","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38090","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38094","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38095","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38097","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38098","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38099","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38100","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38101","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38102","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38103","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38104","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38107","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38108","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38109","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38110","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38111","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38112","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38113","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38115","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38117","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38119","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38120","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38122","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38123","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38124","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38125","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38126","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38127","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38129","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38131","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38135","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38136","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38138","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38142","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38143","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38145","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38146","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38147","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38148","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38149","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38153","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38154","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38155","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38156","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38157","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38158","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38159","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38160","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38161","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38162","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38163","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38164","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38165","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38166","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38167","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38169","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38170","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38173","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38174","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38180","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38181","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38182","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38183","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38184","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38185","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38190","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38191","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38192","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38193","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38194","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38197","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38198","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38200","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38202","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38208","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38210","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38211","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38212","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38214","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38215","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38217","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38218","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38219","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38220","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38222","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38225","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38226","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38229","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38230","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38231","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38232","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38236","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38239","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38245","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38246","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38248","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38249","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38250","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38251","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38253","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38255","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38257","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38258","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38259","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38260","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38262","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38263","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38264","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38265","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38269","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38274","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38275","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38277","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38278","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38279","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38280","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38282","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38283","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38285","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38286","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38289","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38290","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38292","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38293","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38295","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38298","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38299","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38300","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38303","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38304","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38305","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38307","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38310","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38312","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38313","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38319","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38320","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38321","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38322","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38323","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38324","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38326","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38328","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38331","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38332","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38333","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38334","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38335","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38336","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38337","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38338","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38342","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38343","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38344","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38345","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38346","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38347","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38348","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38349","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38351","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38354","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38361","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38362","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38363","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38364","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38365","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38368","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38369","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38371","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38373","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38374","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38375","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38376","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38377","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38382","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38384","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38385","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38386","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38387","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38388","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38389","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38390","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38391","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38392","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38393","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38395","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38396","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38399","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38400","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38401","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38402","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38403","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38405","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38406","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38407","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38408","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38409","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38410","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38412","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38414","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38415","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38416","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38418","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38419","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38420","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38422","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38424","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38425","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38427","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38428","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38429","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38430","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38436","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38437","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38439","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38441","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38443","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38444","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38445","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38448","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38449","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38455","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38456","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38457","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38458","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38459","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38460","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38461","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38462","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38463","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38464","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38465","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38466","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38467","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38468","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38469","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38470","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38471","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38472","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38473","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38474","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38476","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38478","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38480","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38481","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38482","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38483","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38485","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38487","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38488","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38489","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38490","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38491","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38493","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38494","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38495","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38496","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38497","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38499","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38501","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38503","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38506","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38507","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38510","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38511","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38512","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38513","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38514","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38515","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38516","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38520","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38521","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38524","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38526","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38527","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38528","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38529","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38530","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38531","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38532","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38533","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38535","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38537","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38538","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38539","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38540","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38542","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38543","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38544","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38546","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38548","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38549","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38550","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38551","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38552","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38553","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38555","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38560","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38561","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38562","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38566","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38568","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38569","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38571","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38572","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38574","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38576","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38577","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38578","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38579","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38581","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38582","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38583","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38584","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38585","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38587","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38588","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38590","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38593","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38595","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38601","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38602","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38604","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38608","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38609","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38610","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38612","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38614","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38615","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38619","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38622","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38623","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38624","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38625","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38626","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38630","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38632","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38634","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38635","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38639","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38640","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38644","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38645","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38646","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38648","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38650","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38652","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38653","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38659","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38660","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38663","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38664","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38665","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38668","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38670","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38671","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38675","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38676","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38677","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38679","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38680","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38681","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38684","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38685","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38686","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38687","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38688","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38691","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38692","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38693","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38694","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38695","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38696","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38697","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38698","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38699","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38700","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38701","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38702","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38703","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38704","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38705","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38706","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38707","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38708","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38710","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38711","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38712","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38713","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38714","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38715","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38716","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38718","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38721","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38722","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38724","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38725","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38728","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38729","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38730","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38732","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38734","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38735","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39673","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39675","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39676","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39679","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39681","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39683","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39684","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39685","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39686","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39687","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39689","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39691","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39692","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39693","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39694","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39698","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39701","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39702","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39703","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39705","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39706","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39707","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39709","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39710","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39711","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39712","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39713","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39714","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39715","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39716","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39718","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39719","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39720","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39721","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39724","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39726","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39730","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39731","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39732","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39734","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39736","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39737","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39738","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39739","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39742","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39743","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39744","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39746","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39747","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39748","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39749","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39750","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39752","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39753","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39756","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39757","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39758","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39759","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39760","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39761","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39763","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39766","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39770","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39772","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39773","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39776","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39779","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39781","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39782","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39783","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39787","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39788","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39790","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39794","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39795","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39797","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39798","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39800","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39801","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39889","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39890","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39946","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-39989","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40019","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40215","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68750","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23060","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23074","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23111","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23268","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23269","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23403","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23404","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23405","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23406","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23407","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23408","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23409","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23410","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23411","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-36347","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57795","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22022","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-22111","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38022","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-38234","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-40325","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68254","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68255","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68256","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68257","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68258","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68259","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68261","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68263","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68264","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68265","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68266","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68325","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68332","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68335","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68336","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68337","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68344","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68345","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68346","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68347","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68349","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68354","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68362","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68363","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68364","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68366","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68367","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68371","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68372","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68374","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68378","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68379","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68380","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68724","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68727","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68728","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68732","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68733","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68740","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68741","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68742","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68744","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68746","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68753","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68755","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68756","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68757","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68758","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68759","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68763","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68764","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68765","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68766","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68767","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68769","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68770","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68771","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68772","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68773","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68774","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68775","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68776","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68777","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68778","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68780","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68782","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68783","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68785","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68786","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68787","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68788","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68794","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68795","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68796","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68797","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68798","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68799","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68800","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68801","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68804","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68806","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68808","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68809","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68810","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68811","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68813","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68814","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68815","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68816","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68817","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68818","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68819","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68820","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71064","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71065","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71066","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71067","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71068","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71069","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71071","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71072","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71075","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71077","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71078","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71079","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71081","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71082","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71083","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71084","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71085","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71086","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71087","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71088","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71089","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71091","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71093","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71094","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71095","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71096","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71097","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71098","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71101","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71102","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71104","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71105","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71107","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71108","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71109","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71111","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71112","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71113","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71114","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71116","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71118","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71119","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71120","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71121","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71122","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71125","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71126","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71127","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71130","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71131","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71132","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71133","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71135","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71136","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71137","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71138","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71140","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71141","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71143","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71147","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71148","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71149","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71150","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71151","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71153","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71154","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23112","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23209","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23231","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-23273","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-68310","title":"s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump\n\nDo not block PCI config accesses through pci_cfg_access_lock() when\nexecuting the s390 variant of PCI error recovery: Acquire just\ndevice_lock() instead of pci_dev_lock() as powerpc's EEH and\ngenerig PCI AER processing do.\n\nDuring error recovery testing a pair of tasks was reported to be hung:\n\nmlx5_core 0000:00:00.1: mlx5_health_try_recover:338:(pid 5553): health recovery flow aborted, PCI reads still not working\nINFO: task kmcheck:72 blocked for more than 122 seconds.\n      Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1\n\"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\ntask:kmcheck         state:D stack:0     pid:72    tgid:72    ppid:2      flags:0x00000000\nCall Trace:\n [\u003c000000065256f030\u003e] __schedule+0x2a0/0x590\n [\u003c000000065256f356\u003e] schedule+0x36/0xe0\n [\u003c000000065256f572\u003e] schedule_preempt_disabled+0x22/0x30\n [\u003c0000000652570a94\u003e] __mutex_lock.constprop.0+0x484/0x8a8\n [\u003c000003ff800673a4\u003e] mlx5_unload_one+0x34/0x58 [mlx5_core]\n [\u003c000003ff8006745c\u003e] mlx5_pci_err_detected+0x94/0x140 [mlx5_core]\n [\u003c0000000652556c5a\u003e] zpci_event_attempt_error_recovery+0xf2/0x398\n [\u003c0000000651b9184a\u003e] __zpci_event_error+0x23a/0x2c0\nINFO: task kworker/u1664:6:1514 blocked for more than 122 seconds.\n      Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1\n\"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\ntask:kworker/u1664:6 state:D stack:0     pid:1514  tgid:1514  ppid:2      flags:0x00000000\nWorkqueue: mlx5_health0000:00:00.0 mlx5_fw_fatal_reporter_err_work [mlx5_core]\nCall Trace:\n [\u003c000000065256f030\u003e] __schedule+0x2a0/0x590\n [\u003c000000065256f356\u003e] schedule+0x36/0xe0\n [\u003c0000000652172e28\u003e] pci_wait_cfg+0x80/0xe8\n [\u003c0000000652172f94\u003e] pci_cfg_access_lock+0x74/0x88\n [\u003c000003ff800916b6\u003e] mlx5_vsc_gw_lock+0x36/0x178 [mlx5_core]\n [\u003c000003ff80098824\u003e] mlx5_crdump_collect+0x34/0x1c8 [mlx5_core]\n [\u003c000003ff80074b62\u003e] mlx5_fw_fatal_reporter_dump+0x6a/0xe8 [mlx5_core]\n [\u003c0000000652512242\u003e] devlink_health_do_dump.part.0+0x82/0x168\n [\u003c0000000652513212\u003e] devlink_health_report+0x19a/0x230\n [\u003c000003ff80075a12\u003e] mlx5_fw_fatal_reporter_err_work+0xba/0x1b0 [mlx5_core]\n\nNo kernel log of the exact same error with an upstream kernel is\navailable - but the very same deadlock situation can be constructed there,\ntoo:\n\n- task: kmcheck\n  mlx5_unload_one() tries to acquire devlink lock while the PCI error\n  recovery code has set pdev-\u003eblock_cfg_access by way of\n  pci_cfg_access_lock()\n- task: kworker\n  mlx5_crdump_collect() tries to set block_cfg_access through\n  pci_cfg_access_lock() while devlink_health_report() had acquired\n  the devlink lock.\n\nA similar deadlock situation can be reproduced by requesting a\ncrdump with\n  \u003e devlink health dump show pci/\u003cBDF\u003e reporter fw_fatal\n\nwhile PCI error recovery is executed on the same \u003cBDF\u003e physical function\nby mlx5_core's pci_error_handlers. On s390 this can be injected with\n  \u003e zpcictl --reset-fw \u003cBDF\u003e\n\nTests with this patch failed to reproduce that second deadlock situation,\nthe devlink command is rejected with \"kernel answers: Permission denied\" -\nand we get a kernel log message of:\n\nmlx5_core 1ed0:00:00.1: mlx5_crdump_collect:50:(pid 254382): crdump: failed to lock vsc gw err -5\n\nbecause the config read of VSC_SEMAPHORE is rejected by the underlying\nhardware.\n\nTwo prior attempts to address this issue have been discussed and\nultimately rejected [see link], with the primary argument that s390's\nimplementation of PCI error recovery is imposing restrictions that\nneither powerpc's EEH nor PCI AER handling need. Tests show that PCI\nerror recovery on s390 is running to completion even without blocking\naccess to PCI config space.","status":"published","published":"2025-12-16T15:39:41.652Z","modified":"2026-05-11T21:50:41.874Z","updated_at":"2026-11-02T14:32:36.079745Z"}],"euvd":[{"id":"EUVD-2025-203759","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump\n\nDo not block PCI config accesses through pci_cfg_access_lock() when\nexecuting the s390 variant of PCI error recovery: Acquire just\ndevice_lock() instead of pci_dev_lock() as powerpc's EEH and\ngenerig PCI AER processing do.\n\nDuring error recovery testing a pair of tasks was reported to be hung:\n\nmlx5_core 0000:00:00.1: mlx5_health_try_recover:338:(pid 5553): health recovery flow aborted, PCI reads still not working\nINFO: task kmcheck:72 blocked for more than 122 seconds.\n      Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1\n\"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\ntask:kmcheck         state:D stack:0     pid:72    tgid:72    ppid:2      flags:0x00000000\nCall Trace:\n [\u003c000000065256f030\u003e] __schedule+0x2a0/0x590\n [\u003c000000065256f356\u003e] schedule+0x36/0xe0\n [\u003c000000065256f572\u003e] schedule_preempt_disabled+0x22/0x30\n [\u003c0000000652570a94\u003e] __mutex_lock.constprop.0+0x484/0x8a8\n [\u003c000003ff800673a4\u003e] mlx5_unload_one+0x34/0x58 [mlx5_core]\n [\u003c000003ff8006745c\u003e] mlx5_pci_err_detected+0x94/0x140 [mlx5_core]\n [\u003c0000000652556c5a\u003e] zpci_event_attempt_error_recovery+0xf2/0x398\n [\u003c0000000651b9184a\u003e] __zpci_event_error+0x23a/0x2c0\nINFO: task kworker/u1664:6:1514 blocked for more than 122 seconds.\n      Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1\n\"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\ntask:kworker/u1664:6 state:D stack:0     pid:1514  tgid:1514  ppid:2      flags:0x00000000\nWorkqueue: mlx5_health0000:00:00.0 mlx5_fw_fatal_reporter_err_work [mlx5_core]\nCall Trace:\n [\u003c000000065256f030\u003e] __schedule+0x2a0/0x590\n [\u003c000000065256f356\u003e] schedule+0x36/0xe0\n [\u003c0000000652172e28\u003e] pci_wait_cfg+0x80/0xe8\n [\u003c0000000652172f94\u003e] pci_cfg_access_lock+0x74/0x88\n [\u003c000003ff800916b6\u003e] mlx5_vsc_gw_lock+0x36/0x178 [mlx5_core]\n [\u003c000003ff80098824\u003e] mlx5_crdump_collect+0x34/0x1c8 [mlx5_core]\n [\u003c000003ff80074b62\u003e] mlx5_fw_fatal_reporter_dump+0x6a/0xe8 [mlx5_core]\n [\u003c0000000652512242\u003e] devlink_health_do_dump.part.0+0x82/0x168\n [\u003c0000000652513212\u003e] devlink_health_report+0x19a/0x230\n [\u003c000003ff80075a12\u003e] mlx5_fw_fatal_reporter_err_work+0xba/0x1b0 [mlx5_core]\n\nNo kernel log of the exact same error with an upstream kernel is\navailable - but the very same deadlock situation can be constructed there,\ntoo:\n\n- task: kmcheck\n  mlx5_unload_one() tries to acquire devlink lock while the PCI error\n  recovery code has set pdev-\u003eblock_cfg_access by way of\n  pci_cfg_access_lock()\n- task: kworker\n  mlx5_crdump_collect() tries to set block_cfg_access through\n  pci_cfg_access_lock() while devlink_health_report() had acquired\n  the devlink lock.\n\nA similar deadlock situation can be reproduced by requesting a\ncrdump with\n  \u003e devlink health dump show pci/\u003cBDF\u003e reporter fw_fatal\n\nwhile PCI error recovery is executed on the same \u003cBDF\u003e physical function\nby mlx5_core's pci_error_handlers. On s390 this can be injected with\n  \u003e zpcictl --reset-fw \u003cBDF\u003e\n\nTests with this patch failed to reproduce that second deadlock situation,\nthe devlink command is rejected with \"kernel answers: Permission denied\" -\nand we get a kernel log message of:\n\nmlx5_core 1ed0:00:00.1: mlx5_crdump_collect:50:(pid 254382): crdump: failed to lock vsc gw err -5\n\nbecause the config read of VSC_SEMAPHORE is rejected by the underlying\nhardware.\n\nTwo prior attempts to address this issue have been discussed and\nultimately rejected [see link], with the primary argument that s390's\nimplementation of PCI error recovery is imposing restrictions that\nneither powerpc's EEH nor PCI AER handling need. Tests show that PCI\nerror recovery on s390 is running to completion even without blocking\naccess to PCI config space.","status":"published","published":"2025-12-16T15:39:41Z","modified":"2026-05-11T21:50:41Z","updated_at":"2026-11-02T19:04:46.590754Z"}],"ghsa":[{"id":"GHSA-f5pp-8jv2-77ph","title":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/pci: Avoid deadlock...","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump\n\nDo not block PCI config accesses through pci_cfg_access_lock() when\nexecuting the s390 variant of PCI error recovery: Acquire just\ndevice_lock() instead of pci_dev_lock() as powerpc's EEH and\ngenerig PCI AER processing do.\n\nDuring error recovery testing a pair of tasks was reported to be hung:\n\nmlx5_core 0000:00:00.1: mlx5_health_try_recover:338:(pid 5553): health recovery flow aborted, PCI reads still not working\nINFO: task kmcheck:72 blocked for more than 122 seconds.\n      Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1\n\"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\ntask:kmcheck         state:D stack:0     pid:72    tgid:72    ppid:2      flags:0x00000000\nCall Trace:\n [\u003c000000065256f030\u003e] __schedule+0x2a0/0x590\n [\u003c000000065256f356\u003e] schedule+0x36/0xe0\n [\u003c000000065256f572\u003e] schedule_preempt_disabled+0x22/0x30\n [\u003c0000000652570a94\u003e] __mutex_lock.constprop.0+0x484/0x8a8\n [\u003c000003ff800673a4\u003e] mlx5_unload_one+0x34/0x58 [mlx5_core]\n [\u003c000003ff8006745c\u003e] mlx5_pci_err_detected+0x94/0x140 [mlx5_core]\n [\u003c0000000652556c5a\u003e] zpci_event_attempt_error_recovery+0xf2/0x398\n [\u003c0000000651b9184a\u003e] __zpci_event_error+0x23a/0x2c0\nINFO: task kworker/u1664:6:1514 blocked for more than 122 seconds.\n      Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1\n\"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\ntask:kworker/u1664:6 state:D stack:0     pid:1514  tgid:1514  ppid:2      flags:0x00000000\nWorkqueue: mlx5_health0000:00:00.0 mlx5_fw_fatal_reporter_err_work [mlx5_core]\nCall Trace:\n [\u003c000000065256f030\u003e] __schedule+0x2a0/0x590\n [\u003c000000065256f356\u003e] schedule+0x36/0xe0\n [\u003c0000000652172e28\u003e] pci_wait_cfg+0x80/0xe8\n [\u003c0000000652172f94\u003e] pci_cfg_access_lock+0x74/0x88\n [\u003c000003ff800916b6\u003e] mlx5_vsc_gw_lock+0x36/0x178 [mlx5_core]\n [\u003c000003ff80098824\u003e] mlx5_crdump_collect+0x34/0x1c8 [mlx5_core]\n [\u003c000003ff80074b62\u003e] mlx5_fw_fatal_reporter_dump+0x6a/0xe8 [mlx5_core]\n [\u003c0000000652512242\u003e] devlink_health_do_dump.part.0+0x82/0x168\n [\u003c0000000652513212\u003e] devlink_health_report+0x19a/0x230\n [\u003c000003ff80075a12\u003e] mlx5_fw_fatal_reporter_err_work+0xba/0x1b0 [mlx5_core]\n\nNo kernel log of the exact same error with an upstream kernel is\navailable - but the very same deadlock situation can be constructed there,\ntoo:\n\n- task: kmcheck\n  mlx5_unload_one() tries to acquire devlink lock while the PCI error\n  recovery code has set pdev-\u003eblock_cfg_access by way of\n  pci_cfg_access_lock()\n- task: kworker\n  mlx5_crdump_collect() tries to set block_cfg_access through\n  pci_cfg_access_lock() while devlink_health_report() had acquired\n  the devlink lock.\n\nA similar deadlock situation can be reproduced by requesting a\ncrdump with\n  \u003e devlink health dump show pci/\u003cBDF\u003e reporter fw_fatal\n\nwhile PCI error recovery is executed on the same \u003cBDF\u003e physical function\nby mlx5_core's pci_error_handlers. On s390 this can be injected with\n  \u003e zpcictl --reset-fw \u003cBDF\u003e\n\nTests with this patch failed to reproduce that second deadlock situation,\nthe devlink command is rejected with \"kernel answers: Permission denied\" -\nand we get a kernel log message of:\n\nmlx5_core 1ed0:00:00.1: mlx5_crdump_collect:50:(pid 254382): crdump: failed to lock vsc gw err -5\n\nbecause the config read of VSC_SEMAPHORE is rejected by the underlying\nhardware.\n\nTwo prior attempts to address this issue have been discussed and\nultimately rejected [see link], with the primary argument that s390's\nimplementation of PCI error recovery is imposing restrictions that\nneither powerpc's EEH nor PCI AER handling need. Tests show that PCI\nerror recovery on s390 is running to completion even without blocking\naccess to PCI config space.","status":"published","published":"2025-12-16T18:31:34Z","modified":"2025-12-16T18:31:43Z","updated_at":"2026-11-02T15:05:13.507882Z"}],"nvd":[{"id":"CVE-2025-68310","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump\n\nDo not block PCI config accesses through pci_cfg_access_lock() when\nexecuting the s390 variant of PCI error recovery: Acquire just\ndevice_lock() instead of pci_dev_lock() as powerpc's EEH and\ngenerig PCI AER processing do.\n\nDuring error recovery testing a pair of tasks was reported to be hung:\n\nmlx5_core 0000:00:00.1: mlx5_health_try_recover:338:(pid 5553): health recovery flow aborted, PCI reads still not working\nINFO: task kmcheck:72 blocked for more than 122 seconds.\n      Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1\n\"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\ntask:kmcheck         state:D stack:0     pid:72    tgid:72    ppid:2      flags:0x00000000\nCall Trace:\n [\u003c000000065256f030\u003e] __schedule+0x2a0/0x590\n [\u003c000000065256f356\u003e] schedule+0x36/0xe0\n [\u003c000000065256f572\u003e] schedule_preempt_disabled+0x22/0x30\n [\u003c0000000652570a94\u003e] __mutex_lock.constprop.0+0x484/0x8a8\n [\u003c000003ff800673a4\u003e] mlx5_unload_one+0x34/0x58 [mlx5_core]\n [\u003c000003ff8006745c\u003e] mlx5_pci_err_detected+0x94/0x140 [mlx5_core]\n [\u003c0000000652556c5a\u003e] zpci_event_attempt_error_recovery+0xf2/0x398\n [\u003c0000000651b9184a\u003e] __zpci_event_error+0x23a/0x2c0\nINFO: task kworker/u1664:6:1514 blocked for more than 122 seconds.\n      Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1\n\"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\ntask:kworker/u1664:6 state:D stack:0     pid:1514  tgid:1514  ppid:2      flags:0x00000000\nWorkqueue: mlx5_health0000:00:00.0 mlx5_fw_fatal_reporter_err_work [mlx5_core]\nCall Trace:\n [\u003c000000065256f030\u003e] __schedule+0x2a0/0x590\n [\u003c000000065256f356\u003e] schedule+0x36/0xe0\n [\u003c0000000652172e28\u003e] pci_wait_cfg+0x80/0xe8\n [\u003c0000000652172f94\u003e] pci_cfg_access_lock+0x74/0x88\n [\u003c000003ff800916b6\u003e] mlx5_vsc_gw_lock+0x36/0x178 [mlx5_core]\n [\u003c000003ff80098824\u003e] mlx5_crdump_collect+0x34/0x1c8 [mlx5_core]\n [\u003c000003ff80074b62\u003e] mlx5_fw_fatal_reporter_dump+0x6a/0xe8 [mlx5_core]\n [\u003c0000000652512242\u003e] devlink_health_do_dump.part.0+0x82/0x168\n [\u003c0000000652513212\u003e] devlink_health_report+0x19a/0x230\n [\u003c000003ff80075a12\u003e] mlx5_fw_fatal_reporter_err_work+0xba/0x1b0 [mlx5_core]\n\nNo kernel log of the exact same error with an upstream kernel is\navailable - but the very same deadlock situation can be constructed there,\ntoo:\n\n- task: kmcheck\n  mlx5_unload_one() tries to acquire devlink lock while the PCI error\n  recovery code has set pdev-\u003eblock_cfg_access by way of\n  pci_cfg_access_lock()\n- task: kworker\n  mlx5_crdump_collect() tries to set block_cfg_access through\n  pci_cfg_access_lock() while devlink_health_report() had acquired\n  the devlink lock.\n\nA similar deadlock situation can be reproduced by requesting a\ncrdump with\n  \u003e devlink health dump show pci/\u003cBDF\u003e reporter fw_fatal\n\nwhile PCI error recovery is executed on the same \u003cBDF\u003e physical function\nby mlx5_core's pci_error_handlers. On s390 this can be injected with\n  \u003e zpcictl --reset-fw \u003cBDF\u003e\n\nTests with this patch failed to reproduce that second deadlock situation,\nthe devlink command is rejected with \"kernel answers: Permission denied\" -\nand we get a kernel log message of:\n\nmlx5_core 1ed0:00:00.1: mlx5_crdump_collect:50:(pid 254382): crdump: failed to lock vsc gw err -5\n\nbecause the config read of VSC_SEMAPHORE is rejected by the underlying\nhardware.\n\nTwo prior attempts to address this issue have been discussed and\nultimately rejected [see link], with the primary argument that s390's\nimplementation of PCI error recovery is imposing restrictions that\nneither powerpc's EEH nor PCI AER handling need. Tests show that PCI\nerror recovery on s390 is running to completion even without blocking\naccess to PCI config space.","status":"published","published":"2025-12-16T16:16:10.547Z","modified":"2026-06-17T09:58:54.797Z","updated_at":"2026-11-02T14:11:51.309584Z"}],"osv":[{"id":"OESA-2026-1303","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nptr_ring: do not block hard interrupts in ptr_ring_resize_multiple()\n\nJakub added a lockdep_assert_no_hardirq() check in __page_pool_put_page()\nto increase test coverage.\n\nsyzbot found a splat caused by hard irq blocking in\nptr_ring_resize_multiple() [1]\n\nAs current users of ptr_ring_resize_multiple() do not require\nhard irqs being masked, replace it to only block BH.\n\nRename helpers to better reflect they are safe against BH only.\n\n- ptr_ring_resize_multiple() to ptr_ring_resize_multiple_bh()\n- skb_array_resize_multiple() to skb_array_resize_multiple_bh()\n\n[1]\n\nWARNING: CPU: 1 PID: 9150 at net/core/page_pool.c:709 __page_pool_put_page net/core/page_pool.c:709 [inline]\nWARNING: CPU: 1 PID: 9150 at net/core/page_pool.c:709 page_pool_put_unrefed_netmem+0x157/0xa40 net/core/page_pool.c:780\nModules linked in:\nCPU: 1 UID: 0 PID: 9150 Comm: syz.1.1052 Not tainted 6.11.0-rc3-syzkaller-00202-gf8669d7b5f5d #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024\nRIP: 0010:__page_pool_put_page net/core/page_pool.c:709 [inline]\nRIP: 0010:page_pool_put_unrefed_netmem+0x157/0xa40 net/core/page_pool.c:780\nCode: 74 0e e8 7c aa fb f7 eb 43 e8 75 aa fb f7 eb 3c 65 8b 1d 38 a8 6a 76 31 ff 89 de e8 a3 ae fb f7 85 db 74 0b e8 5a aa fb f7 90 \u0026lt;0f\u0026gt; 0b 90 eb 1d 65 8b 1d 15 a8 6a 76 31 ff 89 de e8 84 ae fb f7 85\nRSP: 0018:ffffc9000bda6b58 EFLAGS: 00010083\nRAX: ffffffff8997e523 RBX: 0000000000000000 RCX: 0000000000040000\nRDX: ffffc9000fbd0000 RSI: 0000000000001842 RDI: 0000000000001843\nRBP: 0000000000000000 R08: ffffffff8997df2c R09: 1ffffd40003a000d\nR10: dffffc0000000000 R11: fffff940003a000e R12: ffffea0001d00040\nR13: ffff88802e8a4000 R14: dffffc0000000000 R15: 00000000ffffffff\nFS:  00007fb7aaf716c0(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fa15a0d4b72 CR3: 00000000561b0000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u0026lt;TASK\u0026gt;\n tun_ptr_free drivers/net/tun.c:617 [inline]\n __ptr_ring_swap_queue include/linux/ptr_ring.h:571 [inline]\n ptr_ring_resize_multiple_noprof include/linux/ptr_ring.h:643 [inline]\n tun_queue_resize drivers/net/tun.c:3694 [inline]\n tun_device_event+0xaaf/0x1080 drivers/net/tun.c:3714\n notifier_call_chain+0x19f/0x3e0 kernel/notifier.c:93\n call_netdevice_notifiers_extack net/core/dev.c:2032 [inline]\n call_netdevice_notifiers net/core/dev.c:2046 [inline]\n dev_change_tx_queue_len+0x158/0x2a0 net/core/dev.c:9024\n do_setlink+0xff6/0x41f0 net/core/rtnetlink.c:2923\n rtnl_setlink+0x40d/0x5a0 net/core/rtnetlink.c:3201\n rtnetlink_rcv_msg+0x73f/0xcf0 net/core/rtnetlink.c:6647\n netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2550(CVE-2024-57994)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params\n\nEach cpu DAI should associate with a widget. However, the topology might\nnot create the right number of DAI widgets for aggregated amps. And it\nwill cause NULL pointer deference.\nCheck that the DAI widget associated with the CPU DAI is valid to prevent\nNULL pointer deference due to missing DAI widgets in topologies with\naggregated amps.(CVE-2024-58012)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndriver core: fix potential NULL pointer dereference in dev_uevent()\n\nIf userspace reads \u0026quot;uevent\u0026quot; device attribute at the same time as another\nthreads unbinds the device from its driver, change to dev-\u0026gt;driver from a\nvalid pointer to NULL may result in crash. Fix this by using READ_ONCE()\nwhen fetching the pointer, and take bus\u0026apos; drivers klist lock to make sure\ndriver instance will not disappear while we access it.\n\nUse WRITE_ONCE() when setting the driver pointer to ensure there is no\ntearing.(CVE-2025-37800)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mdiobus: Fix potential out-of-bounds clause 45 read/write access\n\nWhen using publicly available tools like \u0026apos;mdio-tools\u0026apos; to read/write data\nfrom/to network interface and its PHY via C45 (clause 45) mdiobus,\nthere is no verification of parameters passed to the ioctl and\nit accepts any mdio address.\nCurrently there is support for 32 addresses in kernel via PHY_MAX_ADDR define,\nbut it is possible to pass higher value than that via ioctl.\nWhile read/write operation should generally fail in this case,\nmdiobus provides stats array, where wrong address may allow out-of-bounds\nread/write.\n\nFix that by adding address verification before C45 read/write operation.\nWhile this excludes this access from any statistics, it improves security of\nread/write operation.(CVE-2025-38110)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mdiobus: Fix potential out-of-bounds read/write access\n\nWhen using publicly available tools like \u0026apos;mdio-tools\u0026apos; to read/write data\nfrom/to network interface and its PHY via mdiobus, there is no verification of\nparameters passed to the ioctl and it accepts any mdio address.\nCurrently there is support for 32 addresses in kernel via PHY_MAX_ADDR define,\nbut it is possible to pass higher value than that via ioctl.\nWhile read/write operation should generally fail in this case,\nmdiobus provides stats array, where wrong address may allow out-of-bounds\nread/write.\n\nFix that by adding address verification before read/write operation.\nWhile this excludes this access from any statistics, it improves security of\nread/write operation.(CVE-2025-38111)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: phy: clear phydev-\u0026gt;devlink when the link is deleted\n\nThere is a potential crash issue when disabling and re-enabling the\nnetwork port. When disabling the network port, phy_detach() calls\ndevice_link_del() to remove the device link, but it does not clear\nphydev-\u0026gt;devlink, so phydev-\u0026gt;devlink is not a NULL pointer. Then the\nnetwork port is re-enabled, but if phy_attach_direct() fails before\ncalling device_link_add(), the code jumps to the \u0026quot;error\u0026quot; label and\ncalls phy_detach(). Since phydev-\u0026gt;devlink retains the old value from\nthe previous attach/detach cycle, device_link_del() uses the old value,\nwhich accesses a NULL pointer and causes a crash. The simplified crash\nlog is as follows.\n\n[   24.702421] Call trace:\n[   24.704856]  device_link_put_kref+0x20/0x120\n[   24.709124]  device_link_del+0x30/0x48\n[   24.712864]  phy_detach+0x24/0x168\n[   24.716261]  phy_attach_direct+0x168/0x3a4\n[   24.720352]  phylink_fwnode_phy_connect+0xc8/0x14c\n[   24.725140]  phylink_of_phy_connect+0x1c/0x34\n\nTherefore, phydev-\u0026gt;devlink needs to be cleared when the device link is\ndeleted.(CVE-2025-38149)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_set_pipapo: prevent overflow in lookup table allocation\n\nWhen calculating the lookup table size, ensure the following\nmultiplication does not overflow:\n\n- desc-\u0026gt;field_len[] maximum value is U8_MAX multiplied by\n  NFT_PIPAPO_GROUPS_PER_BYTE(f) that can be 2, worst case.\n- NFT_PIPAPO_BUCKETS(f-\u0026gt;bb) is 2^8, worst case.\n- sizeof(unsigned long), from sizeof(*f-\u0026gt;lt), lt in\n  struct nft_pipapo_field.\n\nThen, use check_mul_overflow() to multiply by bucket size and then use\ncheck_add_overflow() to the alignment for avx2 (if needed). Finally, add\nlt_size_check_overflow() helper and use it to consolidate this.\n\nWhile at it, replace leftover allocation using the GFP_KERNEL to\nGFP_KERNEL_ACCOUNT for consistency, in pipapo_resize().(CVE-2025-38162)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: add NULL check in automount_fullpath\n\npage is checked for null in __build_path_from_dentry_optional_prefix\nwhen tcon-\u0026gt;origin_fullpath is not set. However, the check is missing when\nit is set.\nAdd a check to prevent a potential NULL pointer dereference.(CVE-2025-38208)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: fix race between nfsd registration and exports_proc\n\nAs of now nfsd calls create_proc_exports_entry() at start of init_nfsd\nand cleanup by remove_proc_entry() at last of exit_nfsd.\n\nWhich causes kernel OOPs if there is race between below 2 operations:\n(i) exportfs -r\n(ii) mount -t nfsd none /proc/fs/nfsd\n\nfor 5.4 kernel ARM64:\n\nCPU 1:\nel1_irq+0xbc/0x180\narch_counter_get_cntvct+0x14/0x18\nrunning_clock+0xc/0x18\npreempt_count_add+0x88/0x110\nprep_new_page+0xb0/0x220\nget_page_from_freelist+0x2d8/0x1778\n__alloc_pages_nodemask+0x15c/0xef0\n__vmalloc_node_range+0x28c/0x478\n__vmalloc_node_flags_caller+0x8c/0xb0\nkvmalloc_node+0x88/0xe0\nnfsd_init_net+0x6c/0x108 [nfsd]\nops_init+0x44/0x170\nregister_pernet_operations+0x114/0x270\nregister_pernet_subsys+0x34/0x50\ninit_nfsd+0xa8/0x718 [nfsd]\ndo_one_initcall+0x54/0x2e0\n\nCPU 2 :\nUnable to handle kernel NULL pointer dereference at virtual address 0000000000000010\n\nPC is at : exports_net_open+0x50/0x68 [nfsd]\n\nCall trace:\nexports_net_open+0x50/0x68 [nfsd]\nexports_proc_open+0x2c/0x38 [nfsd]\nproc_reg_open+0xb8/0x198\ndo_dentry_open+0x1c4/0x418\nvfs_open+0x38/0x48\npath_openat+0x28c/0xf18\ndo_filp_open+0x70/0xe8\ndo_sys_open+0x154/0x248\n\nSometimes it crashes at exports_net_open() and sometimes cache_seq_next_rcu().\n\nand same is happening on latest 6.14 kernel as well:\n\n[    0.000000] Linux version 6.14.0-rc5-next-20250304-dirty\n...\n[  285.455918] Unable to handle kernel paging request at virtual address 00001f4800001f48\n...\n[  285.464902] pc : cache_seq_next_rcu+0x78/0xa4\n...\n[  285.469695] Call trace:\n[  285.470083]  cache_seq_next_rcu+0x78/0xa4 (P)\n[  285.470488]  seq_read+0xe0/0x11c\n[  285.470675]  proc_reg_read+0x9c/0xf0\n[  285.470874]  vfs_read+0xc4/0x2fc\n[  285.471057]  ksys_read+0x6c/0xf4\n[  285.471231]  __arm64_sys_read+0x1c/0x28\n[  285.471428]  invoke_syscall+0x44/0x100\n[  285.471633]  el0_svc_common.constprop.0+0x40/0xe0\n[  285.471870]  do_el0_svc_compat+0x1c/0x34\n[  285.472073]  el0_svc_compat+0x2c/0x80\n[  285.472265]  el0t_32_sync_handler+0x90/0x140\n[  285.472473]  el0t_32_sync+0x19c/0x1a0\n[  285.472887] Code: f9400885 93407c23 937d7c27 11000421 (f86378a3)\n[  285.473422] ---[ end trace 0000000000000000 ]---\n\nIt reproduced simply with below script:\nwhile [ 1 ]\ndo\n/exportfs -r\ndone \u0026amp;\n\nwhile [ 1 ]\ndo\ninsmod /nfsd.ko\nmount -t nfsd none /proc/fs/nfsd\numount /proc/fs/nfsd\nrmmod nfsd\ndone \u0026amp;\n\nSo exporting interfaces to user space shall be done at last and\ncleanup at first place.\n\nWith change there is no Kernel OOPs.(CVE-2025-38232)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix potential deadlock when reconnecting channels\n\nFix cifs_signal_cifsd_for_reconnect() to take the correct lock order\nand prevent the following deadlock from happening\n\n======================================================\nWARNING: possible circular locking dependency detected\n6.16.0-rc3-build2+ #1301 Tainted: G S      W\n------------------------------------------------------\ncifsd/6055 is trying to acquire lock:\nffff88810ad56038 (\u0026amp;tcp_ses-\u0026gt;srv_lock){+.+.}-{3:3}, at: cifs_signal_cifsd_for_reconnect+0x134/0x200\n\nbut task is already holding lock:\nffff888119c64330 (\u0026amp;ret_buf-\u0026gt;chan_lock){+.+.}-{3:3}, at: cifs_signal_cifsd_for_reconnect+0xcf/0x200\n\nwhich lock already depends on the new lock.\n\nthe existing dependency chain (in reverse order) is:\n\n-\u0026gt; #2 (\u0026amp;ret_buf-\u0026gt;chan_lock){+.+.}-{3:3}:\n       validate_chain+0x1cf/0x270\n       __lock_acquire+0x60e/0x780\n       lock_acquire.part.0+0xb4/0x1f0\n       _raw_spin_lock+0x2f/0x40\n       cifs_setup_session+0x81/0x4b0\n       cifs_get_smb_ses+0x771/0x900\n       cifs_mount_get_session+0x7e/0x170\n       cifs_mount+0x92/0x2d0\n       cifs_smb3_do_mount+0x161/0x460\n       smb3_get_tree+0x55/0x90\n       vfs_get_tree+0x46/0x180\n       do_new_mount+0x1b0/0x2e0\n       path_mount+0x6ee/0x740\n       do_mount+0x98/0xe0\n       __do_sys_mount+0x148/0x180\n       do_syscall_64+0xa4/0x260\n       entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\n-\u0026gt; #1 (\u0026amp;ret_buf-\u0026gt;ses_lock){+.+.}-{3:3}:\n       validate_chain+0x1cf/0x270\n       __lock_acquire+0x60e/0x780\n       lock_acquire.part.0+0xb4/0x1f0\n       _raw_spin_lock+0x2f/0x40\n       cifs_match_super+0x101/0x320\n       sget+0xab/0x270\n       cifs_smb3_do_mount+0x1e0/0x460\n       smb3_get_tree+0x55/0x90\n       vfs_get_tree+0x46/0x180\n       do_new_mount+0x1b0/0x2e0\n       path_mount+0x6ee/0x740\n       do_mount+0x98/0xe0\n       __do_sys_mount+0x148/0x180\n       do_syscall_64+0xa4/0x260\n       entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\n-\u0026gt; #0 (\u0026amp;tcp_ses-\u0026gt;srv_lock){+.+.}-{3:3}:\n       check_noncircular+0x95/0xc0\n       check_prev_add+0x115/0x2f0\n       validate_chain+0x1cf/0x270\n       __lock_acquire+0x60e/0x780\n       lock_acquire.part.0+0xb4/0x1f0\n       _raw_spin_lock+0x2f/0x40\n       cifs_signal_cifsd_for_reconnect+0x134/0x200\n       __cifs_reconnect+0x8f/0x500\n       cifs_handle_standard+0x112/0x280\n       cifs_demultiplex_thread+0x64d/0xbc0\n       kthread+0x2f7/0x310\n       ret_from_fork+0x2a/0x230\n       ret_from_fork_asm+0x1a/0x30\n\nother info that might help us debug this:\n\nChain exists of:\n  \u0026amp;tcp_ses-\u0026gt;srv_lock --\u0026gt; \u0026amp;ret_buf-\u0026gt;ses_lock --\u0026gt; \u0026amp;ret_buf-\u0026gt;chan_lock\n\n Possible unsafe locking scenario:\n\n       CPU0                    CPU1\n       ----                    ----\n  lock(\u0026amp;ret_buf-\u0026gt;chan_lock);\n                               lock(\u0026amp;ret_buf-\u0026gt;ses_lock);\n                               lock(\u0026amp;ret_buf-\u0026gt;chan_lock);\n  lock(\u0026amp;tcp_ses-\u0026gt;srv_lock);\n\n *** DEADLOCK ***\n\n3 locks held by cifsd/6055:\n #0: ffffffff857de398 (\u0026amp;cifs_tcp_ses_lock){+.+.}-{3:3}, at: cifs_signal_cifsd_for_reconnect+0x7b/0x200\n #1: ffff888119c64060 (\u0026amp;ret_buf-\u0026gt;ses_lock){+.+.}-{3:3}, at: cifs_signal_cifsd_for_reconnect+0x9c/0x200\n #2: ffff888119c64330 (\u0026amp;ret_buf-\u0026gt;chan_lock){+.+.}-{3:3}, at: cifs_signal_cifsd_for_reconnect+0xcf/0x200(CVE-2025-38244)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: eir: Fix possible crashes on eir_create_adv_data\n\neir_create_adv_data may attempt to add EIR_FLAGS and EIR_TX_POWER\nwithout checking if that would fit.(CVE-2025-38303)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsoftware node: Correct a OOB check in software_node_get_reference_args()\n\nsoftware_node_get_reference_args() wants to get @index-th element, so\nthe property value requires at least \u0026apos;(index + 1) * sizeof(*ref)\u0026apos; bytes\nbut that can not be guaranteed by current OOB check, and may cause OOB\nfor malformed property.\n\nFix by using as OOB check \u0026apos;((index + 1) * sizeof(*ref) \u0026gt; prop-\u0026gt;length)\u0026apos;.(CVE-2025-38342)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN\n\nWe found a few different systems hung up in writeback waiting on the same\npage lock, and one task waiting on the NFS_LAYOUT_DRAIN bit in\npnfs_update_layout(), however the pnfs_layout_hdr\u0026apos;s plh_outstanding count\nwas zero.\n\nIt seems most likely that this is another race between the waiter and waker\nsimilar to commit ed0172af5d6f (\u0026quot;SUNRPC: Fix a race to wake a sync task\u0026quot;).\nFix it up by applying the advised barrier.(CVE-2025-38393)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight\n\nReject migration of SEV{-ES} state if either the source or destination VM\nis actively creating a vCPU, i.e. if kvm_vm_ioctl_create_vcpu() is in the\nsection between incrementing created_vcpus and online_vcpus.  The bulk of\nvCPU creation runs _outside_ of kvm-\u0026gt;lock to allow creating multiple vCPUs\nin parallel, and so sev_info.es_active can get toggled from false=\u0026gt;true in\nthe destination VM after (or during) svm_vcpu_create(), resulting in an\nSEV{-ES} VM effectively having a non-SEV{-ES} vCPU.\n\nThe issue manifests most visibly as a crash when trying to free a vCPU\u0026apos;s\nNULL VMSA page in an SEV-ES VM, but any number of things can go wrong.\n\n  BUG: unable to handle page fault for address: ffffebde00000000\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  PGD 0 P4D 0\n  Oops: Oops: 0000 [#1] SMP KASAN NOPTI\n  CPU: 227 UID: 0 PID: 64063 Comm: syz.5.60023 Tainted: G     U     O        6.15.0-smp-DEV #2 NONE\n  Tainted: [U]=USER, [O]=OOT_MODULE\n  Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.52.0-0 10/28/2024\n  RIP: 0010:constant_test_bit arch/x86/include/asm/bitops.h:206 [inline]\n  RIP: 0010:arch_test_bit arch/x86/include/asm/bitops.h:238 [inline]\n  RIP: 0010:_test_bit include/asm-generic/bitops/instrumented-non-atomic.h:142 [inline]\n  RIP: 0010:PageHead include/linux/page-flags.h:866 [inline]\n  RIP: 0010:___free_pages+0x3e/0x120 mm/page_alloc.c:5067\n  Code: \u0026lt;49\u0026gt; f7 06 40 00 00 00 75 05 45 31 ff eb 0c 66 90 4c 89 f0 4c 39 f0\n  RSP: 0018:ffff8984551978d0 EFLAGS: 00010246\n  RAX: 0000777f80000001 RBX: 0000000000000000 RCX: ffffffff918aeb98\n  RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffebde00000000\n  RBP: 0000000000000000 R08: ffffebde00000007 R09: 1ffffd7bc0000000\n  R10: dffffc0000000000 R11: fffff97bc0000001 R12: dffffc0000000000\n  R13: ffff8983e19751a8 R14: ffffebde00000000 R15: 1ffffd7bc0000000\n  FS:  0000000000000000(0000) GS:ffff89ee661d3000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: ffffebde00000000 CR3: 000000793ceaa000 CR4: 0000000000350ef0\n  DR0: 0000000000000000 DR1: 0000000000000b5f DR2: 0000000000000000\n  DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   sev_free_vcpu+0x413/0x630 arch/x86/kvm/svm/sev.c:3169\n   svm_vcpu_free+0x13a/0x2a0 arch/x86/kvm/svm/svm.c:1515\n   kvm_arch_vcpu_destroy+0x6a/0x1d0 arch/x86/kvm/x86.c:12396\n   kvm_vcpu_destroy virt/kvm/kvm_main.c:470 [inline]\n   kvm_destroy_vcpus+0xd1/0x300 virt/kvm/kvm_main.c:490\n   kvm_arch_destroy_vm+0x636/0x820 arch/x86/kvm/x86.c:12895\n   kvm_put_kvm+0xb8e/0xfb0 virt/kvm/kvm_main.c:1310\n   kvm_vm_release+0x48/0x60 virt/kvm/kvm_main.c:1369\n   __fput+0x3e4/0x9e0 fs/file_table.c:465\n   task_work_run+0x1a9/0x220 kernel/task_work.c:227\n   exit_task_work include/linux/task_work.h:40 [inline]\n   do_exit+0x7f0/0x25b0 kernel/exit.c:953\n   do_group_exit+0x203/0x2d0 kernel/exit.c:1102\n   get_signal+0x1357/0x1480 kernel/signal.c:3034\n   arch_do_signal_or_restart+0x40/0x690 arch/x86/kernel/signal.c:337\n   exit_to_user_mode_loop kernel/entry/common.c:111 [inline]\n   exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]\n   __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]\n   syscall_exit_to_user_mode+0x67/0xb0 kernel/entry/common.c:218\n   do_syscall_64+0x7c/0x150 arch/x86/entry/syscall_64.c:100\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n  RIP: 0033:0x7f87a898e969\n   \u0026lt;/TASK\u0026gt;\n  Modules linked in: gq(O)\n  gsmi: Log Shutdown Reason 0x03\n  CR2: ffffebde00000000\n  ---[ end trace 0000000000000000 ]---\n\nDeliberately don\u0026apos;t check for a NULL VMSA when freeing the vCPU, as crashing\nthe host is likely desirable due to the VMSA being consumed by hardware.\nE.g. if KVM manages to allow VMRUN on the vCPU, hardware may read/write a\nbogus VMSA page.  Accessing P\n---truncated---(CVE-2025-38455)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ns390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again\n\nCommit 7ded842b356d (\u0026quot;s390/bpf: Fix bpf_plt pointer arithmetic\u0026quot;) has\naccidentally removed the critical piece of commit c730fce7c70c\n(\u0026quot;s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL\u0026quot;), causing\nintermittent kernel panics in e.g. perf\u0026apos;s on_switch() prog to reappear.\n\nRestore the fix and add a comment.(CVE-2025-38489)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niommu/amd: Avoid stack buffer overflow from kernel cmdline\n\nWhile the kernel command line is considered trusted in most environments,\navoid writing 1 byte past the end of \u0026quot;acpiid\u0026quot; if the \u0026quot;str\u0026quot; argument is\nmaximum length.(CVE-2025-38676)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niommufd: Prevent ALIGN() overflow\n\nWhen allocating IOVA the candidate range gets aligned to the target\nalignment. If the range is close to ULONG_MAX then the ALIGN() can\nwrap resulting in a corrupted iova.\n\nOpen code the ALIGN() using get_add_overflow() to prevent this.\nThis simplifies the checks as we don\u0026apos;t need to check for length earlier\neither.\n\nConsolidate the two copies of this code under a single helper.\n\nThis bug would allow userspace to create a mapping that overlaps with some\nother mapping or a reserved range.(CVE-2025-38688)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\njfs: upper bound check of tree index in dbAllocAG\n\nWhen computing the tree index in dbAllocAG, we never check if we are\nout of bounds realative to the size of the stree.\nThis could happen in a scenario where the filesystem metadata are\ncorrupted.(CVE-2025-38697)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nhfsplus: don\u0026apos;t use BUG_ON() in hfsplus_create_attributes_file()\n\nWhen the volume header contains erroneous values that do not reflect\nthe actual state of the filesystem, hfsplus_fill_super() assumes that\nthe attributes file is not yet created, which later results in hitting\nBUG_ON() when hfsplus_create_attributes_file() is called. Replace this\nBUG_ON() with -EIO error with a message to suggest running fsck tool.(CVE-2025-38712)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nhfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()\n\nThe hfsplus_readdir() method is capable to crash by calling\nhfsplus_uni2asc():\n\n[  667.121659][ T9805] ==================================================================\n[  667.122651][ T9805] BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0x902/0xa10\n[  667.123627][ T9805] Read of size 2 at addr ffff88802592f40c by task repro/9805\n[  667.124578][ T9805]\n[  667.124876][ T9805] CPU: 3 UID: 0 PID: 9805 Comm: repro Not tainted 6.16.0-rc3 #1 PREEMPT(full)\n[  667.124886][ T9805] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[  667.124890][ T9805] Call Trace:\n[  667.124893][ T9805]  \u0026lt;TASK\u0026gt;\n[  667.124896][ T9805]  dump_stack_lvl+0x10e/0x1f0\n[  667.124911][ T9805]  print_report+0xd0/0x660\n[  667.124920][ T9805]  ? __virt_addr_valid+0x81/0x610\n[  667.124928][ T9805]  ? __phys_addr+0xe8/0x180\n[  667.124934][ T9805]  ? hfsplus_uni2asc+0x902/0xa10\n[  667.124942][ T9805]  kasan_report+0xc6/0x100\n[  667.124950][ T9805]  ? hfsplus_uni2asc+0x902/0xa10\n[  667.124959][ T9805]  hfsplus_uni2asc+0x902/0xa10\n[  667.124966][ T9805]  ? hfsplus_bnode_read+0x14b/0x360\n[  667.124974][ T9805]  hfsplus_readdir+0x845/0xfc0\n[  667.124984][ T9805]  ? __pfx_hfsplus_readdir+0x10/0x10\n[  667.124994][ T9805]  ? stack_trace_save+0x8e/0xc0\n[  667.125008][ T9805]  ? iterate_dir+0x18b/0xb20\n[  667.125015][ T9805]  ? trace_lock_acquire+0x85/0xd0\n[  667.125022][ T9805]  ? lock_acquire+0x30/0x80\n[  667.125029][ T9805]  ? iterate_dir+0x18b/0xb20\n[  667.125037][ T9805]  ? down_read_killable+0x1ed/0x4c0\n[  667.125044][ T9805]  ? putname+0x154/0x1a0\n[  667.125051][ T9805]  ? __pfx_down_read_killable+0x10/0x10\n[  667.125058][ T9805]  ? apparmor_file_permission+0x239/0x3e0\n[  667.125069][ T9805]  iterate_dir+0x296/0xb20\n[  667.125076][ T9805]  __x64_sys_getdents64+0x13c/0x2c0\n[  667.125084][ T9805]  ? __pfx___x64_sys_getdents64+0x10/0x10\n[  667.125091][ T9805]  ? __x64_sys_openat+0x141/0x200\n[  667.125126][ T9805]  ? __pfx_filldir64+0x10/0x10\n[  667.125134][ T9805]  ? do_user_addr_fault+0x7fe/0x12f0\n[  667.125143][ T9805]  do_syscall_64+0xc9/0x480\n[  667.125151][ T9805]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[  667.125158][ T9805] RIP: 0033:0x7fa8753b2fc9\n[  667.125164][ T9805] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 48\n[  667.125172][ T9805] RSP: 002b:00007ffe96f8e0f8 EFLAGS: 00000217 ORIG_RAX: 00000000000000d9\n[  667.125181][ T9805] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa8753b2fc9\n[  667.125185][ T9805] RDX: 0000000000000400 RSI: 00002000000063c0 RDI: 0000000000000004\n[  667.125190][ T9805] RBP: 00007ffe96f8e110 R08: 00007ffe96f8e110 R09: 00007ffe96f8e110\n[  667.125195][ T9805] R10: 0000000000000000 R11: 0000000000000217 R12: 0000556b1e3b4260\n[  667.125199][ T9805] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\n[  667.125207][ T9805]  \u0026lt;/TASK\u0026gt;\n[  667.125210][ T9805]\n[  667.145632][ T9805] Allocated by task 9805:\n[  667.145991][ T9805]  kasan_save_stack+0x20/0x40\n[  667.146352][ T9805]  kasan_save_track+0x14/0x30\n[  667.146717][ T9805]  __kasan_kmalloc+0xaa/0xb0\n[  667.147065][ T9805]  __kmalloc_noprof+0x205/0x550\n[  667.147448][ T9805]  hfsplus_find_init+0x95/0x1f0\n[  667.147813][ T9805]  hfsplus_readdir+0x220/0xfc0\n[  667.148174][ T9805]  iterate_dir+0x296/0xb20\n[  667.148549][ T9805]  __x64_sys_getdents64+0x13c/0x2c0\n[  667.148937][ T9805]  do_syscall_64+0xc9/0x480\n[  667.149291][ T9805]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[  667.149809][ T9805]\n[  667.150030][ T9805] The buggy address belongs to the object at ffff88802592f000\n[  667.150030][ T9805]  which belongs to the cache kmalloc-2k of size 2048\n[  667.151282][ T9805] The buggy address is located 0 bytes to the right of\n[  667.151282][ T9805]  allocated 1036-byte region [ffff88802592f000, ffff88802592f40c)\n[  667.1\n---truncated---(CVE-2025-38713)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nhfsplus: fix slab-out-of-bounds in hfsplus_bnode_read()\n\nThe hfsplus_bnode_read() method can trigger the issue:\n\n[  174.852007][ T9784] ==================================================================\n[  174.852709][ T9784] BUG: KASAN: slab-out-of-bounds in hfsplus_bnode_read+0x2f4/0x360\n[  174.853412][ T9784] Read of size 8 at addr ffff88810b5fc6c0 by task repro/9784\n[  174.854059][ T9784]\n[  174.854272][ T9784] CPU: 1 UID: 0 PID: 9784 Comm: repro Not tainted 6.16.0-rc3 #7 PREEMPT(full)\n[  174.854281][ T9784] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[  174.854286][ T9784] Call Trace:\n[  174.854289][ T9784]  \u0026lt;TASK\u0026gt;\n[  174.854292][ T9784]  dump_stack_lvl+0x10e/0x1f0\n[  174.854305][ T9784]  print_report+0xd0/0x660\n[  174.854315][ T9784]  ? __virt_addr_valid+0x81/0x610\n[  174.854323][ T9784]  ? __phys_addr+0xe8/0x180\n[  174.854330][ T9784]  ? hfsplus_bnode_read+0x2f4/0x360\n[  174.854337][ T9784]  kasan_report+0xc6/0x100\n[  174.854346][ T9784]  ? hfsplus_bnode_read+0x2f4/0x360\n[  174.854354][ T9784]  hfsplus_bnode_read+0x2f4/0x360\n[  174.854362][ T9784]  hfsplus_bnode_dump+0x2ec/0x380\n[  174.854370][ T9784]  ? __pfx_hfsplus_bnode_dump+0x10/0x10\n[  174.854377][ T9784]  ? hfsplus_bnode_write_u16+0x83/0xb0\n[  174.854385][ T9784]  ? srcu_gp_start+0xd0/0x310\n[  174.854393][ T9784]  ? __mark_inode_dirty+0x29e/0xe40\n[  174.854402][ T9784]  hfsplus_brec_remove+0x3d2/0x4e0\n[  174.854411][ T9784]  __hfsplus_delete_attr+0x290/0x3a0\n[  174.854419][ T9784]  ? __pfx_hfs_find_1st_rec_by_cnid+0x10/0x10\n[  174.854427][ T9784]  ? __pfx___hfsplus_delete_attr+0x10/0x10\n[  174.854436][ T9784]  ? __asan_memset+0x23/0x50\n[  174.854450][ T9784]  hfsplus_delete_all_attrs+0x262/0x320\n[  174.854459][ T9784]  ? __pfx_hfsplus_delete_all_attrs+0x10/0x10\n[  174.854469][ T9784]  ? rcu_is_watching+0x12/0xc0\n[  174.854476][ T9784]  ? __mark_inode_dirty+0x29e/0xe40\n[  174.854483][ T9784]  hfsplus_delete_cat+0x845/0xde0\n[  174.854493][ T9784]  ? __pfx_hfsplus_delete_cat+0x10/0x10\n[  174.854507][ T9784]  hfsplus_unlink+0x1ca/0x7c0\n[  174.854516][ T9784]  ? __pfx_hfsplus_unlink+0x10/0x10\n[  174.854525][ T9784]  ? down_write+0x148/0x200\n[  174.854532][ T9784]  ? __pfx_down_write+0x10/0x10\n[  174.854540][ T9784]  vfs_unlink+0x2fe/0x9b0\n[  174.854549][ T9784]  do_unlinkat+0x490/0x670\n[  174.854557][ T9784]  ? __pfx_do_unlinkat+0x10/0x10\n[  174.854565][ T9784]  ? __might_fault+0xbc/0x130\n[  174.854576][ T9784]  ? getname_flags.part.0+0x1c5/0x550\n[  174.854584][ T9784]  __x64_sys_unlink+0xc5/0x110\n[  174.854592][ T9784]  do_syscall_64+0xc9/0x480\n[  174.854600][ T9784]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[  174.854608][ T9784] RIP: 0033:0x7f6fdf4c3167\n[  174.854614][ T9784] Code: f0 ff ff 73 01 c3 48 8b 0d 26 0d 0e 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 08\n[  174.854622][ T9784] RSP: 002b:00007ffcb948bca8 EFLAGS: 00000206 ORIG_RAX: 0000000000000057\n[  174.854630][ T9784] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f6fdf4c3167\n[  174.854636][ T9784] RDX: 00007ffcb948bcc0 RSI: 00007ffcb948bcc0 RDI: 00007ffcb948bd50\n[  174.854641][ T9784] RBP: 00007ffcb948cd90 R08: 0000000000000001 R09: 00007ffcb948bb40\n[  174.854645][ T9784] R10: 00007f6fdf564fc0 R11: 0000000000000206 R12: 0000561e1bc9c2d0\n[  174.854650][ T9784] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\n[  174.854658][ T9784]  \u0026lt;/TASK\u0026gt;\n[  174.854661][ T9784]\n[  174.879281][ T9784] Allocated by task 9784:\n[  174.879664][ T9784]  kasan_save_stack+0x20/0x40\n[  174.880082][ T9784]  kasan_save_track+0x14/0x30\n[  174.880500][ T9784]  __kasan_kmalloc+0xaa/0xb0\n[  174.880908][ T9784]  __kmalloc_noprof+0x205/0x550\n[  174.881337][ T9784]  __hfs_bnode_create+0x107/0x890\n[  174.881779][ T9784]  hfsplus_bnode_find+0x2d0/0xd10\n[  174.882222][ T9784]  hfsplus_brec_find+0x2b0/0x520\n[  174.882659][ T9784]  hfsplus_delete_all_attrs+0x23b/0x3\n---truncated---(CVE-2025-38714)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb3: fix for slab out of bounds on mount to ksmbd\n\nWith KASAN enabled, it is possible to get a slab out of bounds\nduring mount to ksmbd due to missing check in parse_server_interfaces()\n(see below):\n\n BUG: KASAN: slab-out-of-bounds in\n parse_server_interfaces+0x14ee/0x1880 [cifs]\n Read of size 4 at addr ffff8881433dba98 by task mount/9827\n\n CPU: 5 UID: 0 PID: 9827 Comm: mount Tainted: G\n OE       6.16.0-rc2-kasan #2 PREEMPT(voluntary)\n Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\n Hardware name: Dell Inc. Precision Tower 3620/0MWYPT,\n BIOS 2.13.1 06/14/2019\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n dump_stack_lvl+0x9f/0xf0\n print_report+0xd1/0x670\n __virt_addr_valid+0x22c/0x430\n ? parse_server_interfaces+0x14ee/0x1880 [cifs]\n ? kasan_complete_mode_report_info+0x2a/0x1f0\n ? parse_server_interfaces+0x14ee/0x1880 [cifs]\n   kasan_report+0xd6/0x110\n   parse_server_interfaces+0x14ee/0x1880 [cifs]\n   __asan_report_load_n_noabort+0x13/0x20\n   parse_server_interfaces+0x14ee/0x1880 [cifs]\n ? __pfx_parse_server_interfaces+0x10/0x10 [cifs]\n ? trace_hardirqs_on+0x51/0x60\n SMB3_request_interfaces+0x1ad/0x3f0 [cifs]\n ? __pfx_SMB3_request_interfaces+0x10/0x10 [cifs]\n ? SMB2_tcon+0x23c/0x15d0 [cifs]\n smb3_qfs_tcon+0x173/0x2b0 [cifs]\n ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs]\n ? cifs_get_tcon+0x105d/0x2120 [cifs]\n ? do_raw_spin_unlock+0x5d/0x200\n ? cifs_get_tcon+0x105d/0x2120 [cifs]\n ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs]\n cifs_mount_get_tcon+0x369/0xb90 [cifs]\n ? dfs_cache_find+0xe7/0x150 [cifs]\n dfs_mount_share+0x985/0x2970 [cifs]\n ? check_path.constprop.0+0x28/0x50\n ? save_trace+0x54/0x370\n ? __pfx_dfs_mount_share+0x10/0x10 [cifs]\n ? __lock_acquire+0xb82/0x2ba0\n ? __kasan_check_write+0x18/0x20\n cifs_mount+0xbc/0x9e0 [cifs]\n ? __pfx_cifs_mount+0x10/0x10 [cifs]\n ? do_raw_spin_unlock+0x5d/0x200\n ? cifs_setup_cifs_sb+0x29d/0x810 [cifs]\n cifs_smb3_do_mount+0x263/0x1990 [cifs](CVE-2025-38728)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix refcount leak causing resource not released\n\nWhen ksmbd_conn_releasing(opinfo-\u0026gt;conn) returns true,the refcount was not\ndecremented properly, causing a refcount leak that prevents the count from\nreaching zero and the memory from being released.(CVE-2025-39720)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - flush misc workqueue during device shutdown\n\nRepeated loading and unloading of a device specific QAT driver, for\nexample qat_4xxx, in a tight loop can lead to a crash due to a\nuse-after-free scenario. This occurs when a power management (PM)\ninterrupt triggers just before the device-specific driver (e.g.,\nqat_4xxx.ko) is unloaded, while the core driver (intel_qat.ko) remains\nloaded.\n\nSince the driver uses a shared workqueue (`qat_misc_wq`) across all\ndevices and owned by intel_qat.ko, a deferred routine from the\ndevice-specific driver may still be pending in the queue. If this\nroutine executes after the driver is unloaded, it can dereference freed\nmemory, resulting in a page fault and kernel crash like the following:\n\n    BUG: unable to handle page fault for address: ffa000002e50a01c\n    #PF: supervisor read access in kernel mode\n    RIP: 0010:pm_bh_handler+0x1d2/0x250 [intel_qat]\n    Call Trace:\n      pm_bh_handler+0x1d2/0x250 [intel_qat]\n      process_one_work+0x171/0x340\n      worker_thread+0x277/0x3a0\n      kthread+0xf0/0x120\n      ret_from_fork+0x2d/0x50\n\nTo prevent this, flush the misc workqueue during device shutdown to\nensure that all pending work items are completed before the driver is\nunloaded.\n\nNote: This approach may slightly increase shutdown latency if the\nworkqueue contains jobs from other devices, but it ensures correctness\nand stability.(CVE-2025-39721)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Fix filehandle bounds checking in nfs_fh_to_dentry()\n\nThe function needs to check the minimal filehandle length before it can\naccess the embedded filehandle.(CVE-2025-39730)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup()\n\nA soft lockup warning was observed on a relative small system x86-64\nsystem with 16 GB of memory when running a debug kernel with kmemleak\nenabled.\n\n  watchdog: BUG: soft lockup - CPU#8 stuck for 33s! [kworker/8:1:134]\n\nThe test system was running a workload with hot unplug happening in\nparallel.  Then kemleak decided to disable itself due to its inability to\nallocate more kmemleak objects.  The debug kernel has its\nCONFIG_DEBUG_KMEMLEAK_MEM_POOL_SIZE set to 40,000.\n\nThe soft lockup happened in kmemleak_do_cleanup() when the existing\nkmemleak objects were being removed and deleted one-by-one in a loop via a\nworkqueue.  In this particular case, there are at least 40,000 objects\nthat need to be processed and given the slowness of a debug kernel and the\nfact that a raw_spinlock has to be acquired and released in\n__delete_object(), it could take a while to properly handle all these\nobjects.\n\nAs kmemleak has been disabled in this case, the object removal and\ndeletion process can be further optimized as locking isn\u0026apos;t really needed. \nHowever, it is probably not worth the effort to optimize for such an edge\ncase that should rarely happen.  So the simple solution is to call\ncond_resched() at periodic interval in the iteration loop to avoid soft\nlockup.(CVE-2025-39737)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nrcu: Protect -\u0026gt;defer_qs_iw_pending from data race\n\nOn kernels built with CONFIG_IRQ_WORK=y, when rcu_read_unlock() is\ninvoked within an interrupts-disabled region of code [1], it will invoke\nrcu_read_unlock_special(), which uses an irq-work handler to force the\nsystem to notice when the RCU read-side critical section actually ends.\nThat end won\u0026apos;t happen until interrupts are enabled at the soonest.\n\nIn some kernels, such as those booted with rcutree.use_softirq=y, the\nirq-work handler is used unconditionally.\n\nThe per-CPU rcu_data structure\u0026apos;s -\u0026gt;defer_qs_iw_pending field is\nupdated by the irq-work handler and is both read and updated by\nrcu_read_unlock_special().  This resulted in the following KCSAN splat:\n\n------------------------------------------------------------------------\n\nBUG: KCSAN: data-race in rcu_preempt_deferred_qs_handler / rcu_read_unlock_special\n\nread to 0xffff96b95f42d8d8 of 1 bytes by task 90 on cpu 8:\n rcu_read_unlock_special+0x175/0x260\n __rcu_read_unlock+0x92/0xa0\n rt_spin_unlock+0x9b/0xc0\n __local_bh_enable+0x10d/0x170\n __local_bh_enable_ip+0xfb/0x150\n rcu_do_batch+0x595/0xc40\n rcu_cpu_kthread+0x4e9/0x830\n smpboot_thread_fn+0x24d/0x3b0\n kthread+0x3bd/0x410\n ret_from_fork+0x35/0x40\n ret_from_fork_asm+0x1a/0x30\n\nwrite to 0xffff96b95f42d8d8 of 1 bytes by task 88 on cpu 8:\n rcu_preempt_deferred_qs_handler+0x1e/0x30\n irq_work_single+0xaf/0x160\n run_irq_workd+0x91/0xc0\n smpboot_thread_fn+0x24d/0x3b0\n kthread+0x3bd/0x410\n ret_from_fork+0x35/0x40\n ret_from_fork_asm+0x1a/0x30\n\nno locks held by irq_work/8/88.\nirq event stamp: 200272\nhardirqs last  enabled at (200272): [\u0026lt;ffffffffb0f56121\u0026gt;] finish_task_switch+0x131/0x320\nhardirqs last disabled at (200271): [\u0026lt;ffffffffb25c7859\u0026gt;] __schedule+0x129/0xd70\nsoftirqs last  enabled at (0): [\u0026lt;ffffffffb0ee093f\u0026gt;] copy_process+0x4df/0x1cc0\nsoftirqs last disabled at (0): [\u0026lt;0000000000000000\u0026gt;] 0x0\n\n------------------------------------------------------------------------\n\nThe problem is that irq-work handlers run with interrupts enabled, which\nmeans that rcu_preempt_deferred_qs_handler() could be interrupted,\nand that interrupt handler might contain an RCU read-side critical\nsection, which might invoke rcu_read_unlock_special().  In the strict\nKCSAN mode of operation used by RCU, this constitutes a data race on\nthe -\u0026gt;defer_qs_iw_pending field.\n\nThis commit therefore disables interrupts across the portion of the\nrcu_preempt_deferred_qs_handler() that updates the -\u0026gt;defer_qs_iw_pending\nfield.  This suffices because this handler is not a fast path.(CVE-2025-39749)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Fix the setting of capabilities when automounting a new filesystem\n\nCapabilities cannot be inherited when we cross into a new filesystem.\nThey need to be reset to the minimal defaults, and then probed for\nagain.(CVE-2025-39798)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: use array_index_nospec with indices that come from guest\n\nmin and dest_id are guest-controlled indices. Using array_index_nospec()\nafter the bounds checks clamps these values to mitigate speculative execution\nside-channels.(CVE-2025-39823)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\natm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().\n\nsyzbot reported the splat below. [0]\n\nWhen atmtcp_v_open() or atmtcp_v_close() is called via connect()\nor close(), atmtcp_send_control() is called to send an in-kernel\nspecial message.\n\nThe message has ATMTCP_HDR_MAGIC in atmtcp_control.hdr.length.\nAlso, a pointer of struct atm_vcc is set to atmtcp_control.vcc.\n\nThe notable thing is struct atmtcp_control is uAPI but has a\nspace for an in-kernel pointer.\n\n  struct atmtcp_control {\n  \tstruct atmtcp_hdr hdr;\t/* must be first */\n  ...\n  \tatm_kptr_t vcc;\t\t/* both directions */\n  ...\n  } __ATM_API_ALIGN;\n\n  typedef struct { unsigned char _[8]; } __ATM_API_ALIGN atm_kptr_t;\n\nThe special message is processed in atmtcp_recv_control() called\nfrom atmtcp_c_send().\n\natmtcp_c_send() is vcc-\u0026gt;dev-\u0026gt;ops-\u0026gt;send() and called from 2 paths:\n\n  1. .ndo_start_xmit() (vcc-\u0026gt;send() == atm_send_aal0())\n  2. vcc_sendmsg()\n\nThe problem is sendmsg() does not validate the message length and\nuserspace can abuse atmtcp_recv_control() to overwrite any kptr\nby atmtcp_control.\n\nLet\u0026apos;s add a new -\u0026gt;pre_send() hook to validate messages from sendmsg().\n\n[0]:\nOops: general protection fault, probably for non-canonical address 0xdffffc00200000ab: 0000 [#1] SMP KASAN PTI\nKASAN: probably user-memory-access in range [0x0000000100000558-0x000000010000055f]\nCPU: 0 UID: 0 PID: 5865 Comm: syz-executor331 Not tainted 6.17.0-rc1-syzkaller-00215-gbab3ce404553 #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025\nRIP: 0010:atmtcp_recv_control drivers/atm/atmtcp.c:93 [inline]\nRIP: 0010:atmtcp_c_send+0x1da/0x950 drivers/atm/atmtcp.c:297\nCode: 4d 8d 75 1a 4c 89 f0 48 c1 e8 03 42 0f b6 04 20 84 c0 0f 85 15 06 00 00 41 0f b7 1e 4d 8d b7 60 05 00 00 4c 89 f0 48 c1 e8 03 \u0026lt;42\u0026gt; 0f b6 04 20 84 c0 0f 85 13 06 00 00 66 41 89 1e 4d 8d 75 1c 4c\nRSP: 0018:ffffc90003f5f810 EFLAGS: 00010203\nRAX: 00000000200000ab RBX: 0000000000000000 RCX: 0000000000000000\nRDX: ffff88802a510000 RSI: 00000000ffffffff RDI: ffff888030a6068c\nRBP: ffff88802699fb40 R08: ffff888030a606eb R09: 1ffff1100614c0dd\nR10: dffffc0000000000 R11: ffffffff8718fc40 R12: dffffc0000000000\nR13: ffff888030a60680 R14: 000000010000055f R15: 00000000ffffffff\nFS:  00007f8d7e9236c0(0000) GS:ffff888125c1c000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000000000045ad50 CR3: 0000000075bde000 CR4: 00000000003526f0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n vcc_sendmsg+0xa10/0xc60 net/atm/common.c:645\n sock_sendmsg_nosec net/socket.c:714 [inline]\n __sock_sendmsg+0x219/0x270 net/socket.c:729\n ____sys_sendmsg+0x505/0x830 net/socket.c:2614\n ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668\n __sys_sendmsg net/socket.c:2700 [inline]\n __do_sys_sendmsg net/socket.c:2705 [inline]\n __se_sys_sendmsg net/socket.c:2703 [inline]\n __x64_sys_sendmsg+0x19b/0x260 net/socket.c:2703\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f8d7e96a4a9\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f8d7e923198 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\nRAX: ffffffffffffffda RBX: 00007f8d7e9f4308 RCX: 00007f8d7e96a4a9\nRDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000005\nRBP: 00007f8d7e9f4300 R08: 65732f636f72702f R09: 65732f636f72702f\nR10: 65732f636f72702f R11: 0000000000000246 R12: 00007f8d7e9c10ac\nR13: 00007f8d7e9231a0 R14: 0000200000000200 R15: 0000200000000250\n \u0026lt;/TASK\u0026gt;\nModules linked in:(CVE-2025-39828)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncifs: prevent NULL pointer dereference in UTF16 conversion\n\nThere can be a NULL pointer dereference bug here. NULL is passed to\n__cifs_sfu_make_node without checks, which passes it unchecked to\ncifs_strndup_to_utf16, which in turn passes it to\ncifs_local_to_utf16_bytes where \u0026apos;*from\u0026apos; is dereferenced, causing a crash.\n\nThis patch adds a check for NULL \u0026apos;src\u0026apos; in cifs_strndup_to_utf16 and\nreturns NULL early to prevent dereferencing NULL pointer.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE(CVE-2025-39838)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: fix OOB read/write in network-coding decode\n\nbatadv_nc_skb_decode_packet() trusts coded_len and checks only against\nskb-\u0026gt;len. XOR starts at sizeof(struct batadv_unicast_packet), reducing\npayload headroom, and the source skb length is not verified, allowing an\nout-of-bounds read and a small out-of-bounds write.\n\nValidate that coded_len fits within the payload area of both destination\nand source sk_buffs before XORing.(CVE-2025-39839)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix race condition validating r_parent before applying state\n\nAdd validation to ensure the cached parent directory inode matches the\ndirectory info in MDS replies. This prevents client-side race conditions\nwhere concurrent operations (e.g. rename) cause r_parent to become stale\nbetween request initiation and reply processing, which could lead to\napplying state changes to incorrect directory inodes.\n\n[ idryomov: folded a kerneldoc fixup and a follow-up fix from Alex to\n  move CEPH_CAP_PIN reference when r_parent is updated:\n\n  When the parent directory lock is not held, req-\u0026gt;r_parent can become\n  stale and is updated to point to the correct inode.  However, the\n  associated CEPH_CAP_PIN reference was not being adjusted.  The\n  CEPH_CAP_PIN is a reference on an inode that is tracked for\n  accounting purposes.  Moving this pin is important to keep the\n  accounting balanced. When the pin was not moved from the old parent\n  to the new one, it created two problems: The reference on the old,\n  stale parent was never released, causing a reference leak.\n  A reference for the new parent was never acquired, creating the risk\n  of a reference underflow later in ceph_mdsc_release_request().  This\n  patch corrects the logic by releasing the pin from the old parent and\n  acquiring it for the new parent when r_parent is switched.  This\n  ensures reference accounting stays balanced. ](CVE-2025-39927)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path\n\nDuring tests of another unrelated patch I was able to trigger this\nerror: Objects remaining on __kmem_cache_shutdown()(CVE-2025-39929)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\num: virtio_uml: Fix use-after-free after put_device in probe\n\nWhen register_virtio_device() fails in virtio_uml_probe(),\nthe code sets vu_dev-\u0026gt;registered = 1 even though\nthe device was not successfully registered.\nThis can lead to use-after-free or other issues.(CVE-2025-39951)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_qfq: Fix null-deref in agg_dequeue\n\nTo prevent a potential crash in agg_dequeue (net/sched/sch_qfq.c)\nwhen cl-\u0026gt;qdisc-\u0026gt;ops-\u0026gt;peek(cl-\u0026gt;qdisc) returns NULL, we check the return\nvalue before using it, similar to the existing approach in sch_hfsc.c.\n\nTo avoid code duplication, the following changes are made:\n\n1. Changed qdisc_warn_nonwc(include/net/pkt_sched.h) into a static\ninline function.\n\n2. Moved qdisc_peek_len from net/sched/sch_hfsc.c to\ninclude/net/pkt_sched.h so that sch_qfq can reuse it.\n\n3. Applied qdisc_peek_len in agg_dequeue to avoid crashing.(CVE-2025-40083)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Define a proc_layoutcommit for the FlexFiles layout type\n\nAvoid a crash if a pNFS client should happen to send a LAYOUTCOMMIT\noperation on a FlexFiles layout.(CVE-2025-40087)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncifs: parse_dfs_referrals: prevent oob on malformed input\n\nMalicious SMB server can send invalid reply to FSCTL_DFS_GET_REFERRALS\n\n- reply smaller than sizeof(struct get_dfs_referral_rsp)\n- reply with number of referrals smaller than NumberOfReferrals in the\nheader\n\nProcessing of such replies will cause oob.\n\nReturn -EINVAL error on such replies to prevent oob-s.(CVE-2025-40099)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: Fix refcount leak for cifs_sb_tlink\n\nFix three refcount inconsistency issues related to `cifs_sb_tlink`.\n\nComments for `cifs_sb_tlink` state that `cifs_put_tlink()` needs to be\ncalled after successful calls to `cifs_sb_tlink()`. Three calls fail to\nupdate refcount accordingly, leading to possible resource leaks.(CVE-2025-40103)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvfs: Don\u0026apos;t leak disconnected dentries on umount\n\nWhen user calls open_by_handle_at() on some inode that is not cached, we\nwill create disconnected dentry for it. If such dentry is a directory,\nexportfs_decode_fh_raw() will then try to connect this dentry to the\ndentry tree through reconnect_path(). It may happen for various reasons\n(such as corrupted fs or race with rename) that the call to\nlookup_one_unlocked() in reconnect_one() will fail to find the dentry we\nare trying to reconnect and instead create a new dentry under the\nparent. Now this dentry will not be marked as disconnected although the\nparent still may well be disconnected (at least in case this\ninconsistency happened because the fs is corrupted and .. doesn\u0026apos;t point\nto the real parent directory). This creates inconsistency in\ndisconnected flags but AFAICS it was mostly harmless. At least until\ncommit f1ee616214cb (\u0026quot;VFS: don\u0026apos;t keep disconnected dentries on d_anon\u0026quot;)\nwhich removed adding of most disconnected dentries to sb-\u0026gt;s_anon list.\nThus after this commit cleanup of disconnected dentries implicitely\nrelies on the fact that dput() will immediately reclaim such dentries.\nHowever when some leaf dentry isn\u0026apos;t marked as disconnected, as in the\nscenario described above, the reclaim doesn\u0026apos;t happen and the dentries\nare \u0026quot;leaked\u0026quot;. Memory reclaim can eventually reclaim them but otherwise\nthey stay in memory and if umount comes first, we hit infamous \u0026quot;Busy\ninodes after unmount\u0026quot; bug. Make sure all dentries created under a\ndisconnected parent are marked as disconnected as well.(CVE-2025-40105)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Fix Use-after-free in validation\n\nNodes stored in the validation duplicates hashtable come from an arena\nallocator that is cleared at the end of vmw_execbuf_process. All nodes\nare expected to be cleared in vmw_validation_drop_ht but this node escaped\nbecause its resource was destroyed prematurely.(CVE-2025-40111)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Clean up only new IRQ glue on request_irq() failure\n\nThe mlx5_irq_alloc() function can inadvertently free the entire rmap\nand end up in a crash[1] when the other threads tries to access this,\nwhen request_irq() fails due to exhausted IRQ vectors. This commit\nmodifies the cleanup to remove only the specific IRQ mapping that was\njust added.\n\nThis prevents removal of other valid mappings and ensures precise\ncleanup of the failed IRQ allocation\u0026apos;s associated glue object.\n\nNote: This error is observed when both fwctl and rds configs are enabled.\n\n[1]\nmlx5_core 0000:05:00.0: Successfully registered panic handler for port 1\nmlx5_core 0000:05:00.0: mlx5_irq_alloc:293:(pid 66740): Failed to\nrequest irq. err = -28\ninfiniband mlx5_0: mlx5_ib_test_wc:290:(pid 66740): Error -28 while\ntrying to test write-combining support\nmlx5_core 0000:05:00.0: Successfully unregistered panic handler for port 1\nmlx5_core 0000:06:00.0: Successfully registered panic handler for port 1\nmlx5_core 0000:06:00.0: mlx5_irq_alloc:293:(pid 66740): Failed to\nrequest irq. err = -28\ninfiniband mlx5_0: mlx5_ib_test_wc:290:(pid 66740): Error -28 while\ntrying to test write-combining support\nmlx5_core 0000:06:00.0: Successfully unregistered panic handler for port 1\nmlx5_core 0000:03:00.0: mlx5_irq_alloc:293:(pid 28895): Failed to\nrequest irq. err = -28\nmlx5_core 0000:05:00.0: mlx5_irq_alloc:293:(pid 28895): Failed to\nrequest irq. err = -28\ngeneral protection fault, probably for non-canonical address\n0xe277a58fde16f291: 0000 [#1] SMP NOPTI\n\nRIP: 0010:free_irq_cpu_rmap+0x23/0x7d\nCall Trace:\n   \u0026lt;TASK\u0026gt;\n   ? show_trace_log_lvl+0x1d6/0x2f9\n   ? show_trace_log_lvl+0x1d6/0x2f9\n   ? mlx5_irq_alloc.cold+0x5d/0xf3 [mlx5_core]\n   ? __die_body.cold+0x8/0xa\n   ? die_addr+0x39/0x53\n   ? exc_general_protection+0x1c4/0x3e9\n   ? dev_vprintk_emit+0x5f/0x90\n   ? asm_exc_general_protection+0x22/0x27\n   ? free_irq_cpu_rmap+0x23/0x7d\n   mlx5_irq_alloc.cold+0x5d/0xf3 [mlx5_core]\n   irq_pool_request_vector+0x7d/0x90 [mlx5_core]\n   mlx5_irq_request+0x2e/0xe0 [mlx5_core]\n   mlx5_irq_request_vector+0xad/0xf7 [mlx5_core]\n   comp_irq_request_pci+0x64/0xf0 [mlx5_core]\n   create_comp_eq+0x71/0x385 [mlx5_core]\n   ? mlx5e_open_xdpsq+0x11c/0x230 [mlx5_core]\n   mlx5_comp_eqn_get+0x72/0x90 [mlx5_core]\n   ? xas_load+0x8/0x91\n   mlx5_comp_irqn_get+0x40/0x90 [mlx5_core]\n   mlx5e_open_channel+0x7d/0x3c7 [mlx5_core]\n   mlx5e_open_channels+0xad/0x250 [mlx5_core]\n   mlx5e_open_locked+0x3e/0x110 [mlx5_core]\n   mlx5e_open+0x23/0x70 [mlx5_core]\n   __dev_open+0xf1/0x1a5\n   __dev_change_flags+0x1e1/0x249\n   dev_change_flags+0x21/0x5c\n   do_setlink+0x28b/0xcc4\n   ? __nla_parse+0x22/0x3d\n   ? inet6_validate_link_af+0x6b/0x108\n   ? cpumask_next+0x1f/0x35\n   ? __snmp6_fill_stats64.constprop.0+0x66/0x107\n   ? __nla_validate_parse+0x48/0x1e6\n   __rtnl_newlink+0x5ff/0xa57\n   ? kmem_cache_alloc_trace+0x164/0x2ce\n   rtnl_newlink+0x44/0x6e\n   rtnetlink_rcv_msg+0x2bb/0x362\n   ? __netlink_sendskb+0x4c/0x6c\n   ? netlink_unicast+0x28f/0x2ce\n   ? rtnl_calcit.isra.0+0x150/0x146\n   netlink_rcv_skb+0x5f/0x112\n   netlink_unicast+0x213/0x2ce\n   netlink_sendmsg+0x24f/0x4d9\n   __sock_sendmsg+0x65/0x6a\n   ____sys_sendmsg+0x28f/0x2c9\n   ? import_iovec+0x17/0x2b\n   ___sys_sendmsg+0x97/0xe0\n   __sys_sendmsg+0x81/0xd8\n   do_syscall_64+0x35/0x87\n   entry_SYSCALL_64_after_hwframe+0x6e/0x0\nRIP: 0033:0x7fc328603727\nCode: c3 66 90 41 54 41 89 d4 55 48 89 f5 53 89 fb 48 83 ec 10 e8 0b ed\nff ff 44 89 e2 48 89 ee 89 df 41 89 c0 b8 2e 00 00 00 0f 05 \u0026lt;48\u0026gt; 3d 00\nf0 ff ff 77 35 44 89 c7 48 89 44 24 08 e8 44 ed ff ff 48\nRSP: 002b:00007ffe8eb3f1a0 EFLAGS: 00000293 ORIG_RAX: 000000000000002e\nRAX: ffffffffffffffda RBX: 000000000000000d RCX: 00007fc328603727\nRDX: 0000000000000000 RSI: 00007ffe8eb3f1f0 RDI: 000000000000000d\nRBP: 00007ffe8eb3f1f0 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000\nR13: 00000000000\n---truncated---(CVE-2025-40250)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()\n\nThe loops in \u0026apos;qede_tpa_cont()\u0026apos; and \u0026apos;qede_tpa_end()\u0026apos;, iterate\nover \u0026apos;cqe-\u0026gt;len_list[]\u0026apos; using only a zero-length terminator as\nthe stopping condition. If the terminator was missing or\nmalformed, the loop could run past the end of the fixed-size array.\n\nAdd an explicit bound check using ARRAY_SIZE() in both loops to prevent\na potential out-of-bounds access.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2025-40252)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: sg: Do not sleep in atomic context\n\nsg_finish_rem_req() calls blk_rq_unmap_user(). The latter function may\nsleep. Hence, call sg_finish_rem_req() with interrupts enabled instead\nof disabled.(CVE-2025-40259)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvme: nvme-fc: Ensure -\u0026gt;ioerr_work is cancelled in nvme_fc_delete_ctrl()\n\nnvme_fc_delete_assocation() waits for pending I/O to complete before\nreturning, and an error can cause -\u0026gt;ioerr_work to be queued after\ncancel_work_sync() had been called.  Move the call to cancel_work_sync() to\nbe after nvme_fc_delete_association() to ensure -\u0026gt;ioerr_work is not running\nwhen the nvme_fc_ctrl object is freed.  Otherwise the following can occur:\n\n[ 1135.911754] list_del corruption, ff2d24c8093f31f8-\u0026gt;next is NULL\n[ 1135.917705] ------------[ cut here ]------------\n[ 1135.922336] kernel BUG at lib/list_debug.c:52!\n[ 1135.926784] Oops: invalid opcode: 0000 [#1] SMP NOPTI\n[ 1135.931851] CPU: 48 UID: 0 PID: 726 Comm: kworker/u449:23 Kdump: loaded Not tainted 6.12.0 #1 PREEMPT(voluntary)\n[ 1135.943490] Hardware name: Dell Inc. PowerEdge R660/0HGTK9, BIOS 2.5.4 01/16/2025\n[ 1135.950969] Workqueue:  0x0 (nvme-wq)\n[ 1135.954673] RIP: 0010:__list_del_entry_valid_or_report.cold+0xf/0x6f\n[ 1135.961041] Code: c7 c7 98 68 72 94 e8 26 45 fe ff 0f 0b 48 c7 c7 70 68 72 94 e8 18 45 fe ff 0f 0b 48 89 fe 48 c7 c7 80 69 72 94 e8 07 45 fe ff \u0026lt;0f\u0026gt; 0b 48 89 d1 48 c7 c7 a0 6a 72 94 48 89 c2 e8 f3 44 fe ff 0f 0b\n[ 1135.979788] RSP: 0018:ff579b19482d3e50 EFLAGS: 00010046\n[ 1135.985015] RAX: 0000000000000033 RBX: ff2d24c8093f31f0 RCX: 0000000000000000\n[ 1135.992148] RDX: 0000000000000000 RSI: ff2d24d6bfa1d0c0 RDI: ff2d24d6bfa1d0c0\n[ 1135.999278] RBP: ff2d24c8093f31f8 R08: 0000000000000000 R09: ffffffff951e2b08\n[ 1136.006413] R10: ffffffff95122ac8 R11: 0000000000000003 R12: ff2d24c78697c100\n[ 1136.013546] R13: fffffffffffffff8 R14: 0000000000000000 R15: ff2d24c78697c0c0\n[ 1136.020677] FS:  0000000000000000(0000) GS:ff2d24d6bfa00000(0000) knlGS:0000000000000000\n[ 1136.028765] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 1136.034510] CR2: 00007fd207f90b80 CR3: 000000163ea22003 CR4: 0000000000f73ef0\n[ 1136.041641] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[ 1136.048776] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400\n[ 1136.055910] PKRU: 55555554\n[ 1136.058623] Call Trace:\n[ 1136.061074]  \u0026lt;TASK\u0026gt;\n[ 1136.063179]  ? show_trace_log_lvl+0x1b0/0x2f0\n[ 1136.067540]  ? show_trace_log_lvl+0x1b0/0x2f0\n[ 1136.071898]  ? move_linked_works+0x4a/0xa0\n[ 1136.075998]  ? __list_del_entry_valid_or_report.cold+0xf/0x6f\n[ 1136.081744]  ? __die_body.cold+0x8/0x12\n[ 1136.085584]  ? die+0x2e/0x50\n[ 1136.088469]  ? do_trap+0xca/0x110\n[ 1136.091789]  ? do_error_trap+0x65/0x80\n[ 1136.095543]  ? __list_del_entry_valid_or_report.cold+0xf/0x6f\n[ 1136.101289]  ? exc_invalid_op+0x50/0x70\n[ 1136.105127]  ? __list_del_entry_valid_or_report.cold+0xf/0x6f\n[ 1136.110874]  ? asm_exc_invalid_op+0x1a/0x20\n[ 1136.115059]  ? __list_del_entry_valid_or_report.cold+0xf/0x6f\n[ 1136.120806]  move_linked_works+0x4a/0xa0\n[ 1136.124733]  worker_thread+0x216/0x3a0\n[ 1136.128485]  ? __pfx_worker_thread+0x10/0x10\n[ 1136.132758]  kthread+0xfa/0x240\n[ 1136.135904]  ? __pfx_kthread+0x10/0x10\n[ 1136.139657]  ret_from_fork+0x31/0x50\n[ 1136.143236]  ? __pfx_kthread+0x10/0x10\n[ 1136.146988]  ret_from_fork_asm+0x1a/0x30\n[ 1136.150915]  \u0026lt;/TASK\u0026gt;(CVE-2025-40261)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbe2net: pass wrb_params in case of OS2BMC\n\nbe_insert_vlan_in_pkt() is called with the wrb_params argument being NULL\nat be_send_pkt_to_bmc() call site.  This may lead to dereferencing a NULL\npointer when processing a workaround for specific packet, as commit\nbc0c3405abbb (\u0026quot;be2net: fix a Tx stall bug caused by a specific ipv6\npacket\u0026quot;) states.\n\nThe correct way would be to pass the wrb_params from be_xmit().(CVE-2025-40264)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncifs: client: fix memory leak in smb3_fs_context_parse_param\n\nThe user calls fsconfig twice, but when the program exits, free() only\nfrees ctx-\u0026gt;source for the second fsconfig, not the first.\nRegarding fc-\u0026gt;source, there is no code in the fs context related to its\nmemory reclamation.\n\nTo fix this memory leak, release the source memory corresponding to ctx\nor fc before each parsing.\n\nsyzbot reported:\nBUG: memory leak\nunreferenced object 0xffff888128afa360 (size 96):\n  backtrace (crc 79c9c7ba):\n    kstrdup+0x3c/0x80 mm/util.c:84\n    smb3_fs_context_parse_param+0x229b/0x36c0 fs/smb/client/fs_context.c:1444\n\nBUG: memory leak\nunreferenced object 0xffff888112c7d900 (size 96):\n  backtrace (crc 79c9c7ba):\n    smb3_fs_context_fullpath+0x70/0x1b0 fs/smb/client/fs_context.c:629\n    smb3_fs_context_parse_param+0x2266/0x36c0 fs/smb/client/fs_context.c:1438(CVE-2025-40268)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: free copynotify stateid in nfs4_free_ol_stateid()\n\nTypically copynotify stateid is freed either when parent\u0026apos;s stateid\nis being close/freed or in nfsd4_laundromat if the stateid hasn\u0026apos;t\nbeen used in a lease period.\n\nHowever, in case when the server got an OPEN (which created\na parent stateid), followed by a COPY_NOTIFY using that stateid,\nfollowed by a client reboot. New client instance while doing\nCREATE_SESSION would force expire previous state of this client.\nIt leads to the open state being freed thru release_openowner-\u0026gt;\nnfs4_free_ol_stateid() and it finds that it still has copynotify\nstateid associated with it. We currently print a warning and is\ntriggerred\n\nWARNING: CPU: 1 PID: 8858 at fs/nfsd/nfs4state.c:1550 nfs4_free_ol_stateid+0xb0/0x100 [nfsd]\n\nThis patch, instead, frees the associated copynotify stateid here.\n\nIf the parent stateid is freed (without freeing the copynotify\nstateids associated with it), it leads to the list corruption\nwhen laundromat ends up freeing the copynotify state later.\n\n[ 1626.839430] Internal error: Oops - BUG: 00000000f2000800 [#1]  SMP\n[ 1626.842828] Modules linked in: nfnetlink_queue nfnetlink_log bluetooth cfg80211 rpcrdma rdma_cm iw_cm ib_cm ib_core nfsd nfs_acl lockd grace nfs_localio ext4 crc16 mbcache jbd2 overlay uinput snd_seq_dummy snd_hrtimer qrtr rfkill vfat fat uvcvideo snd_hda_codec_generic videobuf2_vmalloc videobuf2_memops snd_hda_intel uvc snd_intel_dspcfg videobuf2_v4l2 videobuf2_common snd_hda_codec snd_hda_core videodev snd_hwdep snd_seq mc snd_seq_device snd_pcm snd_timer snd soundcore sg loop auth_rpcgss vsock_loopback vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport vmw_vmci vsock xfs 8021q garp stp llc mrp nvme ghash_ce e1000e nvme_core sr_mod nvme_keyring nvme_auth cdrom vmwgfx drm_ttm_helper ttm sunrpc dm_mirror dm_region_hash dm_log iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi fuse dm_multipath dm_mod nfnetlink\n[ 1626.855594] CPU: 2 UID: 0 PID: 199 Comm: kworker/u24:33 Kdump: loaded Tainted: G    B   W           6.17.0-rc7+ #22 PREEMPT(voluntary)\n[ 1626.857075] Tainted: [B]=BAD_PAGE, [W]=WARN\n[ 1626.857573] Hardware name: VMware, Inc. VMware20,1/VBSA, BIOS VMW201.00V.24006586.BA64.2406042154 06/04/2024\n[ 1626.858724] Workqueue: nfsd4 laundromat_main [nfsd]\n[ 1626.859304] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\n[ 1626.860010] pc : __list_del_entry_valid_or_report+0x148/0x200\n[ 1626.860601] lr : __list_del_entry_valid_or_report+0x148/0x200\n[ 1626.861182] sp : ffff8000881d7a40\n[ 1626.861521] x29: ffff8000881d7a40 x28: 0000000000000018 x27: ffff0000c2a98200\n[ 1626.862260] x26: 0000000000000600 x25: 0000000000000000 x24: ffff8000881d7b20\n[ 1626.862986] x23: ffff0000c2a981e8 x22: 1fffe00012410e7d x21: ffff0000920873e8\n[ 1626.863701] x20: ffff0000920873e8 x19: ffff000086f22998 x18: 0000000000000000\n[ 1626.864421] x17: 20747562202c3839 x16: 3932326636383030 x15: 3030666666662065\n[ 1626.865092] x14: 6220646c756f6873 x13: 0000000000000001 x12: ffff60004fd9e4a3\n[ 1626.865713] x11: 1fffe0004fd9e4a2 x10: ffff60004fd9e4a2 x9 : dfff800000000000\n[ 1626.866320] x8 : 00009fffb0261b5e x7 : ffff00027ecf2513 x6 : 0000000000000001\n[ 1626.866938] x5 : ffff00027ecf2510 x4 : ffff60004fd9e4a3 x3 : 0000000000000000\n[ 1626.867553] x2 : 0000000000000000 x1 : ffff000096069640 x0 : 000000000000006d\n[ 1626.868167] Call trace:\n[ 1626.868382]  __list_del_entry_valid_or_report+0x148/0x200 (P)\n[ 1626.868876]  _free_cpntf_state_locked+0xd0/0x268 [nfsd]\n[ 1626.869368]  nfs4_laundromat+0x6f8/0x1058 [nfsd]\n[ 1626.869813]  laundromat_main+0x24/0x60 [nfsd]\n[ 1626.870231]  process_one_work+0x584/0x1050\n[ 1626.870595]  worker_thread+0x4c4/0xc60\n[ 1626.870893]  kthread+0x2f8/0x398\n[ 1626.871146]  ret_from_fork+0x10/0x20\n[ 1626.871422] Code: aa1303e1 aa1403e3 910e8000 97bc55d7 (d4210000)\n[ 1626.871892] SMP: stopping secondary CPUs(CVE-2025-40273)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: cancel mesh send timer when hdev removed\n\nmesh_send_done timer is not canceled when hdev is removed, which causes\ncrash if the timer triggers after hdev is gone.\n\nCancel the timer when MGMT removes the hdev, like other MGMT timers.\n\nShould fix the BUG: sporadically seen by BlueZ test bot\n(in \u0026quot;Mesh - Send cancel - 1\u0026quot; test).\n\nLog:\n------\nBUG: KASAN: slab-use-after-free in run_timer_softirq+0x76b/0x7d0\n...\nFreed by task 36:\n kasan_save_stack+0x24/0x50\n kasan_save_track+0x14/0x30\n __kasan_save_free_info+0x3a/0x60\n __kasan_slab_free+0x43/0x70\n kfree+0x103/0x500\n device_release+0x9a/0x210\n kobject_put+0x100/0x1e0\n vhci_release+0x18b/0x240\n------(CVE-2025-40284)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds\n\nAdd bounds checking to prevent writes past framebuffer boundaries when\nrendering text near screen edges. Return early if the Y position is off-screen\nand clip image height to screen boundary. Break from the rendering loop if the\nX position is off-screen. When clipping image width to fit the screen, update\nthe character count to match the clipped width to prevent buffer size\nmismatches.\n\nWithout the character count update, bit_putcs_aligned and bit_putcs_unaligned\nreceive mismatched parameters where the buffer is allocated for the clipped\nwidth but cnt reflects the original larger count, causing out-of-bounds writes.(CVE-2025-40304)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\naccel/habanalabs: support mapping cb with vmalloc-backed coherent memory\n\nWhen IOMMU is enabled, dma_alloc_coherent() with GFP_USER may return\naddresses from the vmalloc range. If such an address is mapped without\nVM_MIXEDMAP, vm_insert_page() will trigger a BUG_ON due to the\nVM_PFNMAP restriction.\n\nFix this by checking for vmalloc addresses and setting VM_MIXEDMAP\nin the VMA before mapping. This ensures safe mapping and avoids kernel\ncrashes. The memory is still driver-allocated and cannot be accessed\ndirectly by userspace.(CVE-2025-40311)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget\n\nIn the __cdnsp_gadget_init() and cdnsp_gadget_exit() functions, the gadget\nstructure (pdev-\u0026gt;gadget) was freed before its endpoints.\nThe endpoints are linked via the ep_list in the gadget structure.\nFreeing the gadget first leaves dangling pointers in the endpoint list.\nWhen the endpoints are subsequently freed, this results in a use-after-free.\n\nFix:\nBy separating the usb_del_gadget_udc() operation into distinct \u0026quot;del\u0026quot; and\n\u0026quot;put\u0026quot; steps, cdnsp_gadget_free_endpoints() can be executed prior to the\nfinal release of the gadget structure with usb_put_gadget().\n\nA patch similar to bb9c74a5bd14(\u0026quot;usb: dwc3: gadget: Free gadget structure\n only after freeing endpoints\u0026quot;).(CVE-2025-40314)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Sync pending IRQ work before freeing ring buffer\n\nFix a race where irq_work can be queued in bpf_ringbuf_commit()\nbut the ring buffer is freed before the work executes.\nIn the syzbot reproducer, a BPF program attached to sched_switch\ntriggers bpf_ringbuf_commit(), queuing an irq_work. If the ring buffer\nis freed before this work executes, the irq_work thread may accesses\nfreed memory.\nCalling `irq_work_sync(\u0026amp;rb-\u0026gt;work)` ensures that all pending irq_work\ncomplete before freeing the buffer.(CVE-2025-40319)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix potential cfid UAF in smb2_query_info_compound\n\nWhen smb2_query_info_compound() retries, a previously allocated cfid may\nhave been freed in the first attempt.\nBecause cfid wasn\u0026apos;t reset on replay, later cleanup could act on a stale\npointer, leading to a potential use-after-free.\n\nReinitialize cfid to NULL under the replay label.\n\nExample trace (trimmed):\n\nrefcount_t: underflow; use-after-free.\nWARNING: CPU: 1 PID: 11224 at ../lib/refcount.c:28 refcount_warn_saturate+0x9c/0x110\n[...]\nRIP: 0010:refcount_warn_saturate+0x9c/0x110\n[...]\nCall Trace:\n \u0026lt;TASK\u0026gt;\n smb2_query_info_compound+0x29c/0x5c0 [cifs f90b72658819bd21c94769b6a652029a07a7172f]\n ? step_into+0x10d/0x690\n ? __legitimize_path+0x28/0x60\n smb2_queryfs+0x6a/0xf0 [cifs f90b72658819bd21c94769b6a652029a07a7172f]\n smb311_queryfs+0x12d/0x140 [cifs f90b72658819bd21c94769b6a652029a07a7172f]\n ? kmem_cache_alloc+0x18a/0x340\n ? getname_flags+0x46/0x1e0\n cifs_statfs+0x9f/0x2b0 [cifs f90b72658819bd21c94769b6a652029a07a7172f]\n statfs_by_dentry+0x67/0x90\n vfs_statfs+0x16/0xd0\n user_statfs+0x54/0xa0\n __do_sys_statfs+0x20/0x50\n do_syscall_64+0x58/0x80(CVE-2025-40320)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: bitblit: bound-check glyph index in bit_putcs*\n\nbit_putcs_aligned()/unaligned() derived the glyph pointer from the\ncharacter value masked by 0xff/0x1ff, which may exceed the actual font\u0026apos;s\nglyph count and read past the end of the built-in font array.\nClamp the index to the actual glyph count before computing the address.\n\nThis fixes a global out-of-bounds read reported by syzbot.(CVE-2025-40322)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Fix crash in nfsd4_read_release()\n\nWhen tracing is enabled, the trace_nfsd_read_done trace point\ncrashes during the pynfs read.testNoFh test.(CVE-2025-40324)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix potential UAF in smb2_close_cached_fid()\n\nfind_or_create_cached_dir() could grab a new reference after kref_put()\nhad seen the refcount drop to zero but before cfid_list_lock is acquired\nin smb2_close_cached_fid(), leading to use-after-free.\n\nSwitch to kref_put_lock() so cfid_release() is called with\ncfid_list_lock held, closing that gap.(CVE-2025-40328)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: storage: sddr55: Reject out-of-bound new_pba\n\nDiscovered by Atuin - Automated Vulnerability Discovery Engine.\n\nnew_pba comes from the status packet returned after each write.\nA bogus device could report values beyond the block count derived\nfrom info-\u0026gt;capacity, letting the driver walk off the end of\npba_to_lba[] and corrupt heap memory.\n\nReject PBAs that exceed the computed block count and fail the\ntransfer so we avoid touching out-of-range mapping entries.(CVE-2025-40345)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ\n\nXDP programs can change the layout of an xdp_buff through\nbpf_xdp_adjust_tail() and bpf_xdp_adjust_head(). Therefore, the driver\ncannot assume the size of the linear data area nor fragments. Fix the\nbug in mlx5 by generating skb according to xdp_buff after XDP programs\nrun.\n\nCurrently, when handling multi-buf XDP, the mlx5 driver assumes the\nlayout of an xdp_buff to be unchanged. That is, the linear data area\ncontinues to be empty and fragments remain the same. This may cause\nthe driver to generate erroneous skb or triggering a kernel\nwarning. When an XDP program added linear data through\nbpf_xdp_adjust_head(), the linear data will be ignored as\nmlx5e_build_linear_skb() builds an skb without linear data and then\npull data from fragments to fill the linear data area. When an XDP\nprogram has shrunk the non-linear data through bpf_xdp_adjust_tail(),\nthe delta passed to __pskb_pull_tail() may exceed the actual nonlinear\ndata size and trigger the BUG_ON in it.\n\nTo fix the issue, first record the original number of fragments. If the\nnumber of fragments changes after the XDP program runs, rewind the end\nfragment pointer by the difference and recalculate the truesize. Then,\nbuild the skb with the linear data area matching the xdp_buff. Finally,\nonly pull data in if there is non-linear data and fill the linear part\nup to 256 bytes.(CVE-2025-40350)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/sysfb: Do not dereference NULL pointer in plane reset\n\nThe plane state in __drm_gem_reset_shadow_plane() can be NULL. Do not\nderef that pointer, but forward NULL to the other plane-reset helpers.\nClears plane-\u0026gt;state to NULL.\n\nv2:\n- fix typo in commit description (Javier)(CVE-2025-40360)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: fix field-spanning memcpy warning in AH output\n\nFix field-spanning memcpy warnings in ah6_output() and\nah6_output_done() where extension headers are copied to/from IPv6\naddress fields, triggering fortify-string warnings about writes beyond\nthe 16-byte address fields.\n\n  memcpy: detected field-spanning write (size 40) of single field \u0026quot;\u0026amp;top_iph-\u0026gt;saddr\u0026quot; at net/ipv6/ah6.c:439 (size 16)\n  WARNING: CPU: 0 PID: 8838 at net/ipv6/ah6.c:439 ah6_output+0xe7e/0x14e0 net/ipv6/ah6.c:439\n\nThe warnings are false positives as the extension headers are\nintentionally placed after the IPv6 header in memory. Fix by properly\ncopying addresses and extension headers separately, and introduce\nhelper functions to avoid code duplication.(CVE-2025-40363)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nblk-cgroup: fix possible deadlock while configuring policy\n\nFollowing deadlock can be triggered easily by lockdep:\n\nWARNING: possible circular locking dependency detected\n6.17.0-rc3-00124-ga12c2658ced0 #1665 Not tainted\n------------------------------------------------------\ncheck/1334 is trying to acquire lock:\nff1100011d9d0678 (\u0026amp;q-\u0026gt;sysfs_lock){+.+.}-{4:4}, at: blk_unregister_queue+0x53/0x180\n\nbut task is already holding lock:\nff1100011d9d00e0 (\u0026amp;q-\u0026gt;q_usage_counter(queue)#3){++++}-{0:0}, at: del_gendisk+0xba/0x110\n\nwhich lock already depends on the new lock.\n\nthe existing dependency chain (in reverse order) is:\n\n-\u0026gt; #2 (\u0026amp;q-\u0026gt;q_usage_counter(queue)#3){++++}-{0:0}:\n       blk_queue_enter+0x40b/0x470\n       blkg_conf_prep+0x7b/0x3c0\n       tg_set_limit+0x10a/0x3e0\n       cgroup_file_write+0xc6/0x420\n       kernfs_fop_write_iter+0x189/0x280\n       vfs_write+0x256/0x490\n       ksys_write+0x83/0x190\n       __x64_sys_write+0x21/0x30\n       x64_sys_call+0x4608/0x4630\n       do_syscall_64+0xdb/0x6b0\n       entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\n-\u0026gt; #1 (\u0026amp;q-\u0026gt;rq_qos_mutex){+.+.}-{4:4}:\n       __mutex_lock+0xd8/0xf50\n       mutex_lock_nested+0x2b/0x40\n       wbt_init+0x17e/0x280\n       wbt_enable_default+0xe9/0x140\n       blk_register_queue+0x1da/0x2e0\n       __add_disk+0x38c/0x5d0\n       add_disk_fwnode+0x89/0x250\n       device_add_disk+0x18/0x30\n       virtblk_probe+0x13a3/0x1800\n       virtio_dev_probe+0x389/0x610\n       really_probe+0x136/0x620\n       __driver_probe_device+0xb3/0x230\n       driver_probe_device+0x2f/0xe0\n       __driver_attach+0x158/0x250\n       bus_for_each_dev+0xa9/0x130\n       driver_attach+0x26/0x40\n       bus_add_driver+0x178/0x3d0\n       driver_register+0x7d/0x1c0\n       __register_virtio_driver+0x2c/0x60\n       virtio_blk_init+0x6f/0xe0\n       do_one_initcall+0x94/0x540\n       kernel_init_freeable+0x56a/0x7b0\n       kernel_init+0x2b/0x270\n       ret_from_fork+0x268/0x4c0\n       ret_from_fork_asm+0x1a/0x30\n\n-\u0026gt; #0 (\u0026amp;q-\u0026gt;sysfs_lock){+.+.}-{4:4}:\n       __lock_acquire+0x1835/0x2940\n       lock_acquire+0xf9/0x450\n       __mutex_lock+0xd8/0xf50\n       mutex_lock_nested+0x2b/0x40\n       blk_unregister_queue+0x53/0x180\n       __del_gendisk+0x226/0x690\n       del_gendisk+0xba/0x110\n       sd_remove+0x49/0xb0 [sd_mod]\n       device_remove+0x87/0xb0\n       device_release_driver_internal+0x11e/0x230\n       device_release_driver+0x1a/0x30\n       bus_remove_device+0x14d/0x220\n       device_del+0x1e1/0x5a0\n       __scsi_remove_device+0x1ff/0x2f0\n       scsi_remove_device+0x37/0x60\n       sdev_store_delete+0x77/0x100\n       dev_attr_store+0x1f/0x40\n       sysfs_kf_write+0x65/0x90\n       kernfs_fop_write_iter+0x189/0x280\n       vfs_write+0x256/0x490\n       ksys_write+0x83/0x190\n       __x64_sys_write+0x21/0x30\n       x64_sys_call+0x4608/0x4630\n       do_syscall_64+0xdb/0x6b0\n       entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nother info that might help us debug this:\n\nChain exists of:\n  \u0026amp;q-\u0026gt;sysfs_lock --\u0026gt; \u0026amp;q-\u0026gt;rq_qos_mutex --\u0026gt; \u0026amp;q-\u0026gt;q_usage_counter(queue)#3\n\n Possible unsafe locking scenario:\n\n       CPU0                    CPU1\n       ----                    ----\n  lock(\u0026amp;q-\u0026gt;q_usage_counter(queue)#3);\n                               lock(\u0026amp;q-\u0026gt;rq_qos_mutex);\n                               lock(\u0026amp;q-\u0026gt;q_usage_counter(queue)#3);\n  lock(\u0026amp;q-\u0026gt;sysfs_lock);\n\nRoot cause is that queue_usage_counter is grabbed with rq_qos_mutex\nheld in blkg_conf_prep(), while queue should be freezed before\nrq_qos_mutex from other context.\n\nThe blk_queue_enter() from blkg_conf_prep() is used to protect against\npolicy deactivation, which is already protected with blkcg_mutex, hence\nconvert blk_queue_enter() to blkcg_mutex to fix this problem. Meanwhile,\nconsider that blkcg_mutex is held after queue is freezed from policy\ndeactivation, also convert blkg_alloc() to use GFP_NOIO.(CVE-2025-68178)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/mediatek: Disable AFBC support on Mediatek DRM driver\n\nCommit c410fa9b07c3 (\u0026quot;drm/mediatek: Add AFBC support to Mediatek DRM\ndriver\u0026quot;) added AFBC support to Mediatek DRM and enabled the\n32x8/split/sparse modifier.\n\nHowever, this is currently broken on Mediatek MT8188 (Genio 700 EVK\nplatform); tested using upstream Kernel and Mesa (v25.2.1), AFBC is used by\ndefault since Mesa v25.0.\n\nKernel trace reports vblank timeouts constantly, and the render is garbled:\n\n```\n[CRTC:62:crtc-0] vblank wait timed out\nWARNING: CPU: 7 PID: 70 at drivers/gpu/drm/drm_atomic_helper.c:1835 drm_atomic_helper_wait_for_vblanks.part.0+0x24c/0x27c\n[...]\nHardware name: MediaTek Genio-700 EVK (DT)\nWorkqueue: events_unbound commit_work\npstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : drm_atomic_helper_wait_for_vblanks.part.0+0x24c/0x27c\nlr : drm_atomic_helper_wait_for_vblanks.part.0+0x24c/0x27c\nsp : ffff80008337bca0\nx29: ffff80008337bcd0 x28: 0000000000000061 x27: 0000000000000000\nx26: 0000000000000001 x25: 0000000000000000 x24: ffff0000c9dcc000\nx23: 0000000000000001 x22: 0000000000000000 x21: ffff0000c66f2f80\nx20: ffff0000c0d7d880 x19: 0000000000000000 x18: 000000000000000a\nx17: 000000040044ffff x16: 005000f2b5503510 x15: 0000000000000000\nx14: 0000000000000000 x13: 74756f2064656d69 x12: 742074696177206b\nx11: 0000000000000058 x10: 0000000000000018 x9 : ffff800082396a70\nx8 : 0000000000057fa8 x7 : 0000000000000cce x6 : ffff8000823eea70\nx5 : ffff0001fef5f408 x4 : ffff80017ccee000 x3 : ffff0000c12cb480\nx2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000c12cb480\nCall trace:\n drm_atomic_helper_wait_for_vblanks.part.0+0x24c/0x27c (P)\n drm_atomic_helper_commit_tail_rpm+0x64/0x80\n commit_tail+0xa4/0x1a4\n commit_work+0x14/0x20\n process_one_work+0x150/0x290\n worker_thread+0x2d0/0x3ec\n kthread+0x12c/0x210\n ret_from_fork+0x10/0x20\n---[ end trace 0000000000000000 ]---\n```\n\nUntil this gets fixed upstream, disable AFBC support on this platform, as\nit\u0026apos;s currently broken with upstream Mesa.(CVE-2025-68184)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnfs4_setup_readdir(): insufficient locking for -\u0026gt;d_parent-\u0026gt;d_inode dereferencing\n\nTheoretically it\u0026apos;s an oopsable race, but I don\u0026apos;t believe one can manage\nto hit it on real hardware; might become doable on a KVM, but it still\nwon\u0026apos;t be easy to attack.\n\nAnyway, it\u0026apos;s easy to deal with - since xdr_encode_hyper() is just a call of\nput_unaligned_be64(), we can put that under -\u0026gt;d_lock and be done with that.(CVE-2025-68185)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nudp_tunnel: use netdev_warn() instead of netdev_WARN()\n\nnetdev_WARN() uses WARN/WARN_ON to print a backtrace along with\nfile and line information. In this case, udp_tunnel_nic_register()\nreturning an error is just a failed operation, not a kernel bug.\n\nudp_tunnel_nic_register() can fail due to a memory allocation\nfailure (kzalloc() or udp_tunnel_nic_alloc()).\nThis is a normal runtime error and not a kernel bug.\n\nReplace netdev_WARN() with netdev_warn() accordingly.(CVE-2025-68191)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvme-multipath: fix lockdep WARN due to partition scan work\n\nBlktests test cases nvme/014, 057 and 058 fail occasionally due to a\nlockdep WARN. As reported in the Closes tag URL, the WARN indicates that\na deadlock can happen due to the dependency among disk-\u0026gt;open_mutex,\nkblockd workqueue completion and partition_scan_work completion.\n\nTo avoid the lockdep WARN and the potential deadlock, cut the dependency\nby running the partition_scan_work not by kblockd workqueue but by\nnvme_wq.(CVE-2025-68218)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncifs: fix memory leak in smb3_fs_context_parse_param error path\n\nAdd proper cleanup of ctx-\u0026gt;source and fc-\u0026gt;source to the\ncifs_parse_mount_err error handler. This ensures that memory allocated\nfor the source strings is correctly freed on all error paths, matching\nthe cleanup already performed in the success path by\nsmb3_cleanup_fs_context_contents().\nPointers are also set to NULL after freeing to prevent potential\ndouble-free issues.\n\nThis change fixes a memory leak originally detected by syzbot. The\nleak occurred when processing Opt_source mount options if an error\nhappened after ctx-\u0026gt;source and fc-\u0026gt;source were successfully\nallocated but before the function completed.\n\nThe specific leak sequence was:\n1. ctx-\u0026gt;source = smb3_fs_context_fullpath(ctx, \u0026apos;/\u0026apos;) allocates memory\n2. fc-\u0026gt;source = kstrdup(ctx-\u0026gt;source, GFP_KERNEL) allocates more memory\n3. A subsequent error jumps to cifs_parse_mount_err\n4. The old error handler freed passwords but not the source strings,\ncausing the memory to leak.\n\nThis issue was not addressed by commit e8c73eb7db0a (\u0026quot;cifs: client:\nfix memory leak in smb3_fs_context_parse_param\u0026quot;), which only fixed\nleaks from repeated fsconfig() calls but not this error path.\n\nPatch updated with minor change suggested by kernel test robot(CVE-2025-68219)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show()\n\nIf the allocation of tl_hba-\u0026gt;sh fails in tcm_loop_driver_probe() and we\nattempt to dereference it in tcm_loop_tpg_address_show() we will get a\nsegfault, see below for an example. So, check tl_hba-\u0026gt;sh before\ndereferencing it.\n\n  Unable to allocate struct scsi_host\n  BUG: kernel NULL pointer dereference, address: 0000000000000194\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  PGD 0 P4D 0\n  Oops: 0000 [#1] PREEMPT SMP NOPTI\n  CPU: 1 PID: 8356 Comm: tokio-runtime-w Not tainted 6.6.104.2-4.azl3 #1\n  Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 09/28/2024\n  RIP: 0010:tcm_loop_tpg_address_show+0x2e/0x50 [tcm_loop]\n...\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   configfs_read_iter+0x12d/0x1d0 [configfs]\n   vfs_read+0x1b5/0x300\n   ksys_read+0x6f/0xf0\n...(CVE-2025-68229)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbinfmt_misc: restore write access before closing files opened by open_exec()\n\nbm_register_write() opens an executable file using open_exec(), which\ninternally calls do_open_execat() and denies write access on the file to\navoid modification while it is being executed.\n\nHowever, when an error occurs, bm_register_write() closes the file using\nfilp_close() directly. This does not restore the write permission, which\nmay cause subsequent write operations on the same file to fail.\n\nFix this by calling exe_file_allow_write_access() before filp_close() to\nrestore the write permission properly.(CVE-2025-68239)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe\n\nThe sit driver\u0026apos;s packet transmission path calls: sit_tunnel_xmit() -\u0026gt;\nupdate_or_create_fnhe(), which lead to fnhe_remove_oldest() being called\nto delete entries exceeding FNHE_RECLAIM_DEPTH+random.\n\nThe race window is between fnhe_remove_oldest() selecting fnheX for\ndeletion and the subsequent kfree_rcu(). During this time, the\nconcurrent path\u0026apos;s __mkroute_output() -\u0026gt; find_exception() can fetch the\nsoon-to-be-deleted fnheX, and rt_bind_exception() then binds it with a\nnew dst using a dst_hold(). When the original fnheX is freed via RCU,\nthe dst reference remains permanently leaked.\n\nCPU 0                             CPU 1\n__mkroute_output()\n  find_exception() [fnheX]\n                                  update_or_create_fnhe()\n                                    fnhe_remove_oldest() [fnheX]\n  rt_bind_exception() [bind dst]\n                                  RCU callback [fnheX freed, dst leak]\n\nThis issue manifests as a device reference count leak and a warning in\ndmesg when unregistering the net device:\n\n  unregister_netdevice: waiting for sitX to become free. Usage count = N\n\nIdo Schimmel provided the simple test validation method [1].\n\nThe fix clears \u0026apos;oldest-\u0026gt;fnhe_daddr\u0026apos; before calling fnhe_flush_routes().\nSince rt_bind_exception() checks this field, setting it to zero prevents\nthe stale fnhe from being reused and bound to a new dst just before it\nis freed.\n\n[1]\nip netns add ns1\nip -n ns1 link set dev lo up\nip -n ns1 address add 192.0.2.1/32 dev lo\nip -n ns1 link add name dummy1 up type dummy\nip -n ns1 route add 192.0.2.2/32 dev dummy1\nip -n ns1 link add name gretap1 up arp off type gretap \\\n    local 192.0.2.1 remote 192.0.2.2\nip -n ns1 route add 198.51.0.0/16 dev gretap1\ntaskset -c 0 ip netns exec ns1 mausezahn gretap1 \\\n    -A 198.51.100.1 -B 198.51.0.0/16 -t udp -p 1000 -c 0 -q \u0026amp;\ntaskset -c 2 ip netns exec ns1 mausezahn gretap1 \\\n    -A 198.51.100.1 -B 198.51.0.0/16 -t udp -p 1000 -c 0 -q \u0026amp;\nsleep 10\nip netns pids ns1 | xargs kill\nip netns del ns1(CVE-2025-68241)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: netpoll: fix incorrect refcount handling causing incorrect cleanup\n\ncommit efa95b01da18 (\u0026quot;netpoll: fix use after free\u0026quot;) incorrectly\nignored the refcount and prematurely set dev-\u0026gt;npinfo to NULL during\nnetpoll cleanup, leading to improper behavior and memory leaks.\n\nScenario causing lack of proper cleanup:\n\n1) A netpoll is associated with a NIC (e.g., eth0) and netdev-\u0026gt;npinfo is\n   allocated, and refcnt = 1\n   - Keep in mind that npinfo is shared among all netpoll instances. In\n     this case, there is just one.\n\n2) Another netpoll is also associated with the same NIC and\n   npinfo-\u0026gt;refcnt += 1.\n   - Now dev-\u0026gt;npinfo-\u0026gt;refcnt = 2;\n   - There is just one npinfo associated to the netdev.\n\n3) When the first netpolls goes to clean up:\n   - The first cleanup succeeds and clears np-\u0026gt;dev-\u0026gt;npinfo, ignoring\n     refcnt.\n     - It basically calls `RCU_INIT_POINTER(np-\u0026gt;dev-\u0026gt;npinfo, NULL);`\n   - Set dev-\u0026gt;npinfo = NULL, without proper cleanup\n   - No -\u0026gt;ndo_netpoll_cleanup() is either called\n\n4) Now the second target tries to clean up\n   - The second cleanup fails because np-\u0026gt;dev-\u0026gt;npinfo is already NULL.\n     * In this case, ops-\u0026gt;ndo_netpoll_cleanup() was never called, and\n       the skb pool is not cleaned as well (for the second netpoll\n       instance)\n  - This leaks npinfo and skbpool skbs, which is clearly reported by\n    kmemleak.\n\nRevert commit efa95b01da18 (\u0026quot;netpoll: fix use after free\u0026quot;) and adds\nclarifying comments emphasizing that npinfo cleanup should only happen\nonce the refcount reaches zero, ensuring stable and correct netpoll\nbehavior.(CVE-2025-68245)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nerofs: avoid infinite loops due to corrupted subpage compact indexes\n\nRobert reported an infinite loop observed by two crafted images.\n\nThe root cause is that `clusterofs` can be larger than `lclustersize`\nfor !NONHEAD `lclusters` in corrupted subpage compact indexes, e.g.:\n\n  blocksize = lclustersize = 512   lcn = 6   clusterofs = 515\n\nMove the corresponding check for full compress indexes to\n`z_erofs_load_lcluster_from_disk()` to also cover subpage compact\ncompress indexes.\n\nIt also fixes the position of `m-\u0026gt;type \u0026gt;= Z_EROFS_LCLUSTER_TYPE_MAX`\ncheck, since it should be placed right after\n`z_erofs_load_{compact,full}_lcluster()`.(CVE-2025-68251)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: storage: Fix memory leak in USB bulk transport\n\nA kernel memory leak was identified by the \u0026apos;ioctl_sg01\u0026apos; test from Linux\nTest Project (LTP). The following bytes were mainly observed: 0x53425355.\n\nWhen USB storage devices incorrectly skip the data phase with status data,\nthe code extracts/validates the CSW from the sg buffer, but fails to clear\nit afterwards. This leaves status protocol data in srb\u0026apos;s transfer buffer,\nsuch as the US_BULK_CS_SIGN \u0026apos;USBS\u0026apos; signature observed here. Thus, this can\nlead to USB protocols leaks to user space through SCSI generic (/dev/sg*)\ninterfaces, such as the one seen here when the LTP test requested 512 KiB.\n\nFix the leak by zeroing the CSW data in srb\u0026apos;s transfer buffer immediately\nafter the validation of devices that skip data phase.\n\nNote: Differently from CVE-2018-1000204, which fixed a big leak by zero-\ning pages at allocation time, this leak occurs after allocation, when USB\nprotocol data is written to already-allocated sg pages.(CVE-2025-68288)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix memory leak in cifs_construct_tcon()\n\nWhen having a multiuser mount with domain= specified and using\ncifscreds, cifs_set_cifscreds() will end up setting @ctx-\u0026gt;domainname,\nso it needs to be freed before leaving cifs_construct_tcon().\n\nThis fixes the following memory leak reported by kmemleak:\n\n  mount.cifs //srv/share /mnt -o domain=ZELDA,multiuser,...\n  su - testuser\n  cifscreds add -d ZELDA -u testuser\n  ...\n  ls /mnt/1\n  ...\n  umount /mnt\n  echo scan \u0026gt; /sys/kernel/debug/kmemleak\n  cat /sys/kernel/debug/kmemleak\n  unreferenced object 0xffff8881203c3f08 (size 8):\n    comm \u0026quot;ls\u0026quot;, pid 5060, jiffies 4307222943\n    hex dump (first 8 bytes):\n      5a 45 4c 44 41 00 cc cc                          ZELDA...\n    backtrace (crc d109a8cf):\n      __kmalloc_node_track_caller_noprof+0x572/0x710\n      kstrdup+0x3a/0x70\n      cifs_sb_tlink+0x1209/0x1770 [cifs]\n      cifs_get_fattr+0xe1/0xf50 [cifs]\n      cifs_get_inode_info+0xb5/0x240 [cifs]\n      cifs_revalidate_dentry_attr+0x2d1/0x470 [cifs]\n      cifs_getattr+0x28e/0x450 [cifs]\n      vfs_getattr_nosec+0x126/0x180\n      vfs_statx+0xf6/0x220\n      do_statx+0xab/0x110\n      __x64_sys_statx+0xd5/0x130\n      do_syscall_64+0xbb/0x380\n      entry_SYSCALL_64_after_hwframe+0x77/0x7f(CVE-2025-68295)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup\n\nProtect vga_switcheroo_client_fb_set() with console lock. Avoids OOB\naccess in fbcon_remap_all(). Without holding the console lock the call\nraces with switching outputs.\n\nVGA switcheroo calls fbcon_remap_all() when switching clients. The fbcon\nfunction uses struct fb_info.node, which is set by register_framebuffer().\nAs the fb-helper code currently sets up VGA switcheroo before registering\nthe framebuffer, the value of node is -1 and therefore not a legal value.\nFor example, fbcon uses the value within set_con2fb_map() [1] as an index\ninto an array.\n\nMoving vga_switcheroo_client_fb_set() after register_framebuffer() can\nresult in VGA switching that does not switch fbcon correctly.\n\nTherefore move vga_switcheroo_client_fb_set() under fbcon_fb_registered(),\nwhich already holds the console lock. Fbdev calls fbcon_fb_registered()\nfrom within register_framebuffer(). Serializes the helper with VGA\nswitcheroo\u0026apos;s call to fbcon_remap_all().\n\nAlthough vga_switcheroo_client_fb_set() takes an instance of struct fb_info\nas parameter, it really only needs the contained fbcon state. Moving the\ncall to fbcon initialization is therefore cleaner than before. Only amdgpu,\ni915, nouveau and radeon support vga_switcheroo. For all other drivers,\nthis change does nothing.(CVE-2025-68296)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sock: Prevent race in socket write iter and sock bind\n\nThere is a potential race condition between sock bind and socket write\niter. bind may free the same cmd via mgmt_pending before write iter sends\nthe cmd, just as syzbot reported in UAF[1].\n\nHere we use hci_dev_lock to synchronize the two, thereby avoiding the\nUAF mentioned in [1].\n\n[1]\nsyzbot reported:\nBUG: KASAN: slab-use-after-free in mgmt_pending_remove+0x3b/0x210 net/bluetooth/mgmt_util.c:316\nRead of size 8 at addr ffff888077164818 by task syz.0.17/5989\nCall Trace:\n mgmt_pending_remove+0x3b/0x210 net/bluetooth/mgmt_util.c:316\n set_link_security+0x5c2/0x710 net/bluetooth/mgmt.c:1918\n hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719\n hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839\n sock_sendmsg_nosec net/socket.c:727 [inline]\n __sock_sendmsg+0x21c/0x270 net/socket.c:742\n sock_write_iter+0x279/0x360 net/socket.c:1195\n\nAllocated by task 5989:\n mgmt_pending_add+0x35/0x140 net/bluetooth/mgmt_util.c:296\n set_link_security+0x557/0x710 net/bluetooth/mgmt.c:1910\n hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719\n hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839\n sock_sendmsg_nosec net/socket.c:727 [inline]\n __sock_sendmsg+0x21c/0x270 net/socket.c:742\n sock_write_iter+0x279/0x360 net/socket.c:1195\n\nFreed by task 5991:\n mgmt_pending_free net/bluetooth/mgmt_util.c:311 [inline]\n mgmt_pending_foreach+0x30d/0x380 net/bluetooth/mgmt_util.c:257\n mgmt_index_removed+0x112/0x2f0 net/bluetooth/mgmt.c:9477\n hci_sock_bind+0xbe9/0x1000 net/bluetooth/hci_sock.c:1314(CVE-2025-68305)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ns390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump\n\nDo not block PCI config accesses through pci_cfg_access_lock() when\nexecuting the s390 variant of PCI error recovery: Acquire just\ndevice_lock() instead of pci_dev_lock() as powerpc\u0026apos;s EEH and\ngenerig PCI AER processing do.\n\nDuring error recovery testing a pair of tasks was reported to be hung:\n\nmlx5_core 0000:00:00.1: mlx5_health_try_recover:338:(pid 5553): health recovery flow aborted, PCI reads still not working\nINFO: task kmcheck:72 blocked for more than 122 seconds.\n      Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1\n\u0026quot;echo 0 \u0026gt; /proc/sys/kernel/hung_task_timeout_secs\u0026quot; disables this message.\ntask:kmcheck         state:D stack:0     pid:72    tgid:72    ppid:2      flags:0x00000000\nCall Trace:\n [\u0026lt;000000065256f030\u0026gt;] __schedule+0x2a0/0x590\n [\u0026lt;000000065256f356\u0026gt;] schedule+0x36/0xe0\n [\u0026lt;000000065256f572\u0026gt;] schedule_preempt_disabled+0x22/0x30\n [\u0026lt;0000000652570a94\u0026gt;] __mutex_lock.constprop.0+0x484/0x8a8\n [\u0026lt;000003ff800673a4\u0026gt;] mlx5_unload_one+0x34/0x58 [mlx5_core]\n [\u0026lt;000003ff8006745c\u0026gt;] mlx5_pci_err_detected+0x94/0x140 [mlx5_core]\n [\u0026lt;0000000652556c5a\u0026gt;] zpci_event_attempt_error_recovery+0xf2/0x398\n [\u0026lt;0000000651b9184a\u0026gt;] __zpci_event_error+0x23a/0x2c0\nINFO: task kworker/u1664:6:1514 blocked for more than 122 seconds.\n      Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1\n\u0026quot;echo 0 \u0026gt; /proc/sys/kernel/hung_task_timeout_secs\u0026quot; disables this message.\ntask:kworker/u1664:6 state:D stack:0     pid:1514  tgid:1514  ppid:2      flags:0x00000000\nWorkqueue: mlx5_health0000:00:00.0 mlx5_fw_fatal_reporter_err_work [mlx5_core]\nCall Trace:\n [\u0026lt;000000065256f030\u0026gt;] __schedule+0x2a0/0x590\n [\u0026lt;000000065256f356\u0026gt;] schedule+0x36/0xe0\n [\u0026lt;0000000652172e28\u0026gt;] pci_wait_cfg+0x80/0xe8\n [\u0026lt;0000000652172f94\u0026gt;] pci_cfg_access_lock+0x74/0x88\n [\u0026lt;000003ff800916b6\u0026gt;] mlx5_vsc_gw_lock+0x36/0x178 [mlx5_core]\n [\u0026lt;000003ff80098824\u0026gt;] mlx5_crdump_collect+0x34/0x1c8 [mlx5_core]\n [\u0026lt;000003ff80074b62\u0026gt;] mlx5_fw_fatal_reporter_dump+0x6a/0xe8 [mlx5_core]\n [\u0026lt;0000000652512242\u0026gt;] devlink_health_do_dump.part.0+0x82/0x168\n [\u0026lt;0000000652513212\u0026gt;] devlink_health_report+0x19a/0x230\n [\u0026lt;000003ff80075a12\u0026gt;] mlx5_fw_fatal_reporter_err_work+0xba/0x1b0 [mlx5_core]\n\nNo kernel log of the exact same error with an upstream kernel is\navailable - but the very same deadlock situation can be constructed there,\ntoo:\n\n- task: kmcheck\n  mlx5_unload_one() tries to acquire devlink lock while the PCI error\n  recovery code has set pdev-\u0026gt;block_cfg_access by way of\n  pci_cfg_access_lock()\n- task: kworker\n  mlx5_crdump_collect() tries to set block_cfg_access through\n  pci_cfg_access_lock() while devlink_health_report() had acquired\n  the devlink lock.\n\nA similar deadlock situation can be reproduced by requesting a\ncrdump with\n  \u0026gt; devlink health dump show pci/\u0026lt;BDF\u0026gt; reporter fw_fatal\n\nwhile PCI error recovery is executed on the same \u0026lt;BDF\u0026gt; physical function\nby mlx5_core\u0026apos;s pci_error_handlers. On s390 this can be injected with\n  \u0026gt; zpcictl --reset-fw \u0026lt;BDF\u0026gt;\n\nTests with this patch failed to reproduce that second deadlock situation,\nthe devlink command is rejected with \u0026quot;kernel answers: Permission denied\u0026quot; -\nand we get a kernel log message of:\n\nmlx5_core 1ed0:00:00.1: mlx5_crdump_collect:50:(pid 254382): crdump: failed to lock vsc gw err -5\n\nbecause the config read of VSC_SEMAPHORE is rejected by the underlying\nhardware.\n\nTwo prior attempts to address this issue have been discussed and\nultimately rejected [see link], with the primary argument that s390\u0026apos;s\nimplementation of PCI error recovery is imposing restrictions that\nneither powerpc\u0026apos;s EEH nor PCI AER handling need. Tests show that PCI\nerror recovery on s390 is running to completion even without blocking\naccess to PCI config space.(CVE-2025-68310)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusbnet: Prevents free active kevent\n\nThe root cause of this issue are:\n1. When probing the usbnet device, executing usbnet_link_change(dev, 0, 0);\nput the kevent work in global workqueue. However, the kevent has not yet\nbeen scheduled when the usbnet device is unregistered. Therefore, executing\nfree_netdev() results in the \u0026quot;free active object (kevent)\u0026quot; error reported\nhere.\n\n2. Another factor is that when calling usbnet_disconnect()-\u0026gt;unregister_netdev(),\nif the usbnet device is up, ndo_stop() is executed to cancel the kevent.\nHowever, because the device is not up, ndo_stop() is not executed.\n\nThe solution to this problem is to cancel the kevent before executing\nfree_netdev().(CVE-2025-68312)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnbd: defer config unlock in nbd_genl_connect\n\nThere is one use-after-free warning when running NBD_CMD_CONNECT and\nNBD_CLEAR_SOCK:\n\nnbd_genl_connect\n  nbd_alloc_and_init_config // config_refs=1\n  nbd_start_device // config_refs=2\n  set NBD_RT_HAS_CONFIG_REF\t\t\topen nbd // config_refs=3\n  recv_work done // config_refs=2\n\t\t\t\t\t\tNBD_CLEAR_SOCK // config_refs=1\n\t\t\t\t\t\tclose nbd // config_refs=0\n  refcount_inc -\u0026gt; uaf\n\n------------[ cut here ]------------\nrefcount_t: addition on 0; use-after-free.\nWARNING: CPU: 24 PID: 1014 at lib/refcount.c:25 refcount_warn_saturate+0x12e/0x290\n nbd_genl_connect+0x16d0/0x1ab0\n genl_family_rcv_msg_doit+0x1f3/0x310\n genl_rcv_msg+0x44a/0x790\n\nThe issue can be easily reproduced by adding a small delay before\nrefcount_inc(\u0026amp;nbd-\u0026gt;config_refs) in nbd_genl_connect():\n\n        mutex_unlock(\u0026amp;nbd-\u0026gt;config_lock);\n        if (!ret) {\n                set_bit(NBD_RT_HAS_CONFIG_REF, \u0026amp;config-\u0026gt;runtime_flags);\n+               printk(\u0026quot;before sleep\\n\u0026quot;);\n+               mdelay(5 * 1000);\n+               printk(\u0026quot;after sleep\\n\u0026quot;);\n                refcount_inc(\u0026amp;nbd-\u0026gt;config_refs);\n                nbd_connect_reply(info, nbd-\u0026gt;index);\n        }(CVE-2025-68366)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmacintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse\n\nThe following warning appears when running syzkaller, and this issue also\nexists in the mainline code.\n\n ------------[ cut here ]------------\n list_add double add: new=ffffffffa57eee28, prev=ffffffffa57eee28, next=ffffffffa5e63100.\n WARNING: CPU: 0 PID: 1491 at lib/list_debug.c:35 __list_add_valid_or_report+0xf7/0x130\n Modules linked in:\n CPU: 0 PID: 1491 Comm: syz.1.28 Not tainted 6.6.0+ #3\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\n RIP: 0010:__list_add_valid_or_report+0xf7/0x130\n RSP: 0018:ff1100010dfb7b78 EFLAGS: 00010282\n RAX: 0000000000000000 RBX: ffffffffa57eee18 RCX: ffffffff97fc9817\n RDX: 0000000000040000 RSI: ffa0000002383000 RDI: 0000000000000001\n RBP: ffffffffa57eee28 R08: 0000000000000001 R09: ffe21c0021bf6f2c\n R10: 0000000000000001 R11: 6464615f7473696c R12: ffffffffa5e63100\n R13: ffffffffa57eee28 R14: ffffffffa57eee28 R15: ff1100010dfb7d48\n FS:  00007fb14398b640(0000) GS:ff11000119600000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 0000000000000000 CR3: 000000010d096005 CR4: 0000000000773ef0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n PKRU: 80000000\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  input_register_handler+0xb3/0x210\n  mac_hid_start_emulation+0x1c5/0x290\n  mac_hid_toggle_emumouse+0x20a/0x240\n  proc_sys_call_handler+0x4c2/0x6e0\n  new_sync_write+0x1b1/0x2d0\n  vfs_write+0x709/0x950\n  ksys_write+0x12a/0x250\n  do_syscall_64+0x5a/0x110\n  entry_SYSCALL_64_after_hwframe+0x78/0xe2\n\nThe WARNING occurs when two processes concurrently write to the mac-hid\nemulation sysctl, causing a race condition in mac_hid_toggle_emumouse().\nBoth processes read old_val=0, then both try to register the input handler,\nleading to a double list_add of the same handler.\n\n  CPU0                             CPU1\n  -------------------------        -------------------------\n  vfs_write() //write 1            vfs_write()  //write 1\n    proc_sys_write()                 proc_sys_write()\n      mac_hid_toggle_emumouse()          mac_hid_toggle_emumouse()\n        old_val = *valp // old_val=0\n                                           old_val = *valp // old_val=0\n                                           mutex_lock_killable()\n                                           proc_dointvec() // *valp=1\n                                           mac_hid_start_emulation()\n                                             input_register_handler()\n                                           mutex_unlock()\n        mutex_lock_killable()\n        proc_dointvec()\n        mac_hid_start_emulation()\n          input_register_handler() //Trigger Warning\n        mutex_unlock()\n\nFix this by moving the old_val read inside the mutex lock region.(CVE-2025-68367)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: smartpqi: Fix device resources accessed after device removal\n\nCorrect possible race conditions during device removal.\n\nPreviously, a scheduled work item to reset a LUN could still execute\nafter the device was removed, leading to use-after-free and other\nresource access issues.\n\nThis race condition occurs because the abort handler may schedule a LUN\nreset concurrently with device removal via sdev_destroy(), leading to\nuse-after-free and improper access to freed resources.\n\n  - Check in the device reset handler if the device is still present in\n    the controller\u0026apos;s SCSI device list before running; if not, the reset\n    is skipped.\n\n  - Cancel any pending TMF work that has not started in sdev_destroy().\n\n  - Ensure device freeing in sdev_destroy() is done while holding the\n    LUN reset mutex to avoid races with ongoing resets.(CVE-2025-68371)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnbd: defer config put in recv_work\n\nThere is one uaf issue in recv_work when running NBD_CLEAR_SOCK and\nNBD_CMD_RECONFIGURE:\n  nbd_genl_connect     // conf_ref=2 (connect and recv_work A)\n  nbd_open\t       // conf_ref=3\n  recv_work A done     // conf_ref=2\n  NBD_CLEAR_SOCK       // conf_ref=1\n  nbd_genl_reconfigure // conf_ref=2 (trigger recv_work B)\n  close nbd\t       // conf_ref=1\n  recv_work B\n    config_put         // conf_ref=0\n    atomic_dec(\u0026amp;config-\u0026gt;recv_threads); -\u0026gt; UAF\n\nOr only running NBD_CLEAR_SOCK:\n  nbd_genl_connect   // conf_ref=2\n  nbd_open \t     // conf_ref=3\n  NBD_CLEAR_SOCK     // conf_ref=2\n  close nbd\n    nbd_release\n      config_put     // conf_ref=1\n  recv_work\n    config_put \t     // conf_ref=0\n    atomic_dec(\u0026amp;config-\u0026gt;recv_threads); -\u0026gt; UAF\n\nCommit 87aac3a80af5 (\u0026quot;nbd: call nbd_config_put() before notifying the\nwaiter\u0026quot;) moved nbd_config_put() to run before waking up the waiter in\nrecv_work, in order to ensure that nbd_start_device_ioctl() would not\nbe woken up while nbd-\u0026gt;task_recv was still uncleared.\n\nHowever, in nbd_start_device_ioctl(), after being woken up it explicitly\ncalls flush_workqueue() to make sure all current works are finished.\nTherefore, there is no need to move the config put ahead of the wakeup.\n\nMove nbd_config_put() to the end of recv_work, so that the reference is\nheld for the whole lifetime of the worker thread. This makes sure the\nconfig cannot be freed while recv_work is still running, even if clear\n+ reconfigure interleave.\n\nIn addition, we don\u0026apos;t need to worry about recv_work dropping the last\nnbd_put (which causes deadlock):\n\npath A (netlink with NBD_CFLAG_DESTROY_ON_DISCONNECT):\n  connect  // nbd_refs=1 (trigger recv_work)\n  open nbd // nbd_refs=2\n  NBD_CLEAR_SOCK\n  close nbd\n    nbd_release\n      nbd_disconnect_and_put\n        flush_workqueue // recv_work done\n      nbd_config_put\n        nbd_put // nbd_refs=1\n      nbd_put // nbd_refs=0\n        queue_work\n\npath B (netlink without NBD_CFLAG_DESTROY_ON_DISCONNECT):\n  connect  // nbd_refs=2 (trigger recv_work)\n  open nbd // nbd_refs=3\n  NBD_CLEAR_SOCK // conf_refs=2\n  close nbd\n    nbd_release\n      nbd_config_put // conf_refs=1\n      nbd_put // nbd_refs=2\n  recv_work done // conf_refs=0, nbd_refs=1\n  rmmod // nbd_refs=0\n\nDepends-on: e2daec488c57 (\u0026quot;nbd: Fix hungtask when nbd_config_put\u0026quot;)(CVE-2025-68372)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmd: fix rcu protection in md_wakeup_thread\n\nWe attempted to use RCU to protect the pointer \u0026apos;thread\u0026apos;, but directly\npassed the value when calling md_wakeup_thread(). This means that the\nRCU pointer has been acquired before rcu_read_lock(), which renders\nrcu_read_lock() ineffective and could lead to a use-after-free.(CVE-2025-68374)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix null deref on srq-\u0026gt;rq.queue after resize failure\n\nA NULL pointer dereference can occur in rxe_srq_chk_attr() when\nibv_modify_srq() is invoked twice in succession under certain error\nconditions. The first call may fail in rxe_queue_resize(), which leads\nrxe_srq_from_attr() to set srq-\u0026gt;rq.queue = NULL. The second call then\ntriggers a crash (null deref) when accessing\nsrq-\u0026gt;rq.queue-\u0026gt;buf-\u0026gt;index_mask.\n\nCall Trace:\n\u0026lt;TASK\u0026gt;\nrxe_modify_srq+0x170/0x480 [rdma_rxe]\n? __pfx_rxe_modify_srq+0x10/0x10 [rdma_rxe]\n? uverbs_try_lock_object+0x4f/0xa0 [ib_uverbs]\n? rdma_lookup_get_uobject+0x1f0/0x380 [ib_uverbs]\nib_uverbs_modify_srq+0x204/0x290 [ib_uverbs]\n? __pfx_ib_uverbs_modify_srq+0x10/0x10 [ib_uverbs]\n? tryinc_node_nr_active+0xe6/0x150\n? uverbs_fill_udata+0xed/0x4f0 [ib_uverbs]\nib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0x2c0/0x470 [ib_uverbs]\n? __pfx_ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0x10/0x10 [ib_uverbs]\n? uverbs_fill_udata+0xed/0x4f0 [ib_uverbs]\nib_uverbs_run_method+0x55a/0x6e0 [ib_uverbs]\n? __pfx_ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0x10/0x10 [ib_uverbs]\nib_uverbs_cmd_verbs+0x54d/0x800 [ib_uverbs]\n? __pfx_ib_uverbs_cmd_verbs+0x10/0x10 [ib_uverbs]\n? __pfx___raw_spin_lock_irqsave+0x10/0x10\n? __pfx_do_vfs_ioctl+0x10/0x10\n? ioctl_has_perm.constprop.0.isra.0+0x2c7/0x4c0\n? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10\nib_uverbs_ioctl+0x13e/0x220 [ib_uverbs]\n? __pfx_ib_uverbs_ioctl+0x10/0x10 [ib_uverbs]\n__x64_sys_ioctl+0x138/0x1c0\ndo_syscall_64+0x82/0x250\n? fdget_pos+0x58/0x4c0\n? ksys_write+0xf3/0x1c0\n? __pfx_ksys_write+0x10/0x10\n? do_syscall_64+0xc8/0x250\n? __pfx_vm_mmap_pgoff+0x10/0x10\n? fget+0x173/0x230\n? fput+0x2a/0x80\n? ksys_mmap_pgoff+0x224/0x4c0\n? do_syscall_64+0xc8/0x250\n? do_user_addr_fault+0x37b/0xfe0\n? clear_bhb_loop+0x50/0xa0\n? clear_bhb_loop+0x50/0xa0\n? clear_bhb_loop+0x50/0xa0\nentry_SYSCALL_64_after_hwframe+0x76/0x7e(CVE-2025-68379)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags\n\nWhen a filesystem is being automounted, it needs to preserve the\nuser-set superblock mount options, such as the \u0026quot;ro\u0026quot; flag.(CVE-2025-68764)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfsnotify: do not generate ACCESS/MODIFY events on child for special files\n\ninotify/fanotify do not allow users with no read access to a file to\nsubscribe to events (e.g. IN_ACCESS/IN_MODIFY), but they do allow the\nsame user to subscribe for watching events on children when the user\nhas access to the parent directory (e.g. /dev).\n\nUsers with no read access to a file but with read access to its parent\ndirectory can still stat the file and see if it was accessed/modified\nvia atime/mtime change.\n\nThe same is not true for special files (e.g. /dev/null). Users will not\ngenerally observe atime/mtime changes when other users read/write to\nspecial files, only when someone sets atime/mtime via utimensat().\n\nAlign fsnotify events with this stat behavior and do not generate\nACCESS/MODIFY events to parent watchers on read/write of special files.\nThe events are still generated to parent watchers on utimensat(). This\ncloses some side-channels that could be possibly used for information\nexfiltration [1].\n\n[1] https://snee.la/pdf/pubs/file-notification-attacks.pdf(CVE-2025-68788)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfuse: missing copy_finish in fuse-over-io-uring argument copies\n\nFix a possible reference count leak of payload pages during\nfuse argument copies.\n\n[Joanne: simplified error cleanup](CVE-2025-68791)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/amd: Check event before enable to avoid GPF\n\nOn AMD machines cpuc-\u0026gt;events[idx] can become NULL in a subtle race\ncondition with NMI-\u0026gt;throttle-\u0026gt;x86_pmu_stop().\n\nCheck event for NULL in amd_pmu_enable_all() before enable to avoid a GPF.\nThis appears to be an AMD only issue.\n\nSyzkaller reported a GPF in amd_pmu_enable_all.\n\nINFO: NMI handler (perf_event_nmi_handler) took too long to run: 13.143\n    msecs\nOops: general protection fault, probably for non-canonical address\n    0xdffffc0000000034: 0000  PREEMPT SMP KASAN NOPTI\nKASAN: null-ptr-deref in range [0x00000000000001a0-0x00000000000001a7]\nCPU: 0 UID: 0 PID: 328415 Comm: repro_36674776 Not tainted 6.12.0-rc1-syzk\nRIP: 0010:x86_pmu_enable_event (arch/x86/events/perf_event.h:1195\n    arch/x86/events/core.c:1430)\nRSP: 0018:ffff888118009d60 EFLAGS: 00010012\nRAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000\nRDX: 0000000000000034 RSI: 0000000000000000 RDI: 00000000000001a0\nRBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000002\nR13: ffff88811802a440 R14: ffff88811802a240 R15: ffff8881132d8601\nFS:  00007f097dfaa700(0000) GS:ffff888118000000(0000) GS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00000000200001c0 CR3: 0000000103d56000 CR4: 00000000000006f0\nCall Trace:\n \u0026lt;IRQ\u0026gt;\namd_pmu_enable_all (arch/x86/events/amd/core.c:760 (discriminator 2))\nx86_pmu_enable (arch/x86/events/core.c:1360)\nevent_sched_out (kernel/events/core.c:1191 kernel/events/core.c:1186\n    kernel/events/core.c:2346)\n__perf_remove_from_context (kernel/events/core.c:2435)\nevent_function (kernel/events/core.c:259)\nremote_function (kernel/events/core.c:92 (discriminator 1)\n    kernel/events/core.c:72 (discriminator 1))\n__flush_smp_call_function_queue (./arch/x86/include/asm/jump_label.h:27\n    ./include/linux/jump_label.h:207 ./include/trace/events/csd.h:64\n    kernel/smp.c:135 kernel/smp.c:540)\n__sysvec_call_function_single (./arch/x86/include/asm/jump_label.h:27\n    ./include/linux/jump_label.h:207\n    ./arch/x86/include/asm/trace/irq_vectors.h:99 arch/x86/kernel/smp.c:272)\nsysvec_call_function_single (arch/x86/kernel/smp.c:266 (discriminator 47)\n    arch/x86/kernel/smp.c:266 (discriminator 47))\n \u0026lt;/IRQ\u0026gt;(CVE-2025-68798)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats\n\nCited commit added a dedicated mutex (instead of RTNL) to protect the\nmulticast route list, so that it will not change while the driver\nperiodically traverses it in order to update the kernel about multicast\nroute stats that were queried from the device.\n\nOne instance of list entry deletion (during route replace) was missed\nand it can result in a use-after-free [1].\n\nFix by acquiring the mutex before deleting the entry from the list and\nreleasing it afterwards.\n\n[1]\nBUG: KASAN: slab-use-after-free in mlxsw_sp_mr_stats_update+0x4a5/0x540 drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c:1006 [mlxsw_spectrum]\nRead of size 8 at addr ffff8881523c2fa8 by task kworker/2:5/22043\n\nCPU: 2 UID: 0 PID: 22043 Comm: kworker/2:5 Not tainted 6.18.0-rc1-custom-g1a3d6d7cd014 #1 PREEMPT(full)\nHardware name: Mellanox Technologies Ltd. MSN2010/SA002610, BIOS 5.6.5 08/24/2017\nWorkqueue: mlxsw_core mlxsw_sp_mr_stats_update [mlxsw_spectrum]\nCall Trace:\n \u0026lt;TASK\u0026gt;\n dump_stack_lvl+0xba/0x110\n print_report+0x174/0x4f5\n kasan_report+0xdf/0x110\n mlxsw_sp_mr_stats_update+0x4a5/0x540 drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c:1006 [mlxsw_spectrum]\n process_one_work+0x9cc/0x18e0\n worker_thread+0x5df/0xe40\n kthread+0x3b8/0x730\n ret_from_fork+0x3e9/0x560\n ret_from_fork_asm+0x1a/0x30\n \u0026lt;/TASK\u0026gt;\n\nAllocated by task 29933:\n kasan_save_stack+0x30/0x50\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0x8f/0xa0\n mlxsw_sp_mr_route_add+0xd8/0x4770 [mlxsw_spectrum]\n mlxsw_sp_router_fibmr_event_work+0x371/0xad0 drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:7965 [mlxsw_spectrum]\n process_one_work+0x9cc/0x18e0\n worker_thread+0x5df/0xe40\n kthread+0x3b8/0x730\n ret_from_fork+0x3e9/0x560\n ret_from_fork_asm+0x1a/0x30\n\nFreed by task 29933:\n kasan_save_stack+0x30/0x50\n kasan_save_track+0x14/0x30\n __kasan_save_free_info+0x3b/0x70\n __kasan_slab_free+0x43/0x70\n kfree+0x14e/0x700\n mlxsw_sp_mr_route_add+0x2dea/0x4770 drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c:444 [mlxsw_spectrum]\n mlxsw_sp_router_fibmr_event_work+0x371/0xad0 drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:7965 [mlxsw_spectrum]\n process_one_work+0x9cc/0x18e0\n worker_thread+0x5df/0xe40\n kthread+0x3b8/0x730\n ret_from_fork+0x3e9/0x560\n ret_from_fork_asm+0x1a/0x30(CVE-2025-68800)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_router: Fix neighbour use-after-free\n\nWe sometimes observe use-after-free when dereferencing a neighbour [1].\nThe problem seems to be that the driver stores a pointer to the\nneighbour, but without holding a reference on it. A reference is only\ntaken when the neighbour is used by a nexthop.\n\nFix by simplifying the reference counting scheme. Always take a\nreference when storing a neighbour pointer in a neighbour entry. Avoid\ntaking a referencing when the neighbour is used by a nexthop as the\nneighbour entry associated with the nexthop already holds a reference.\n\nTested by running the test that uncovered the problem over 300 times.\nWithout this patch the problem was reproduced after a handful of\niterations.\n\n[1]\nBUG: KASAN: slab-use-after-free in mlxsw_sp_neigh_entry_update+0x2d4/0x310\nRead of size 8 at addr ffff88817f8e3420 by task ip/3929\n\nCPU: 3 UID: 0 PID: 3929 Comm: ip Not tainted 6.18.0-rc4-virtme-g36b21a067510 #3 PREEMPT(full)\nHardware name: Nvidia SN5600/VMOD0013, BIOS 5.13 05/31/2023\nCall Trace:\n \u0026lt;TASK\u0026gt;\n dump_stack_lvl+0x6f/0xa0\n print_address_description.constprop.0+0x6e/0x300\n print_report+0xfc/0x1fb\n kasan_report+0xe4/0x110\n mlxsw_sp_neigh_entry_update+0x2d4/0x310\n mlxsw_sp_router_rif_gone_sync+0x35f/0x510\n mlxsw_sp_rif_destroy+0x1ea/0x730\n mlxsw_sp_inetaddr_port_vlan_event+0xa1/0x1b0\n __mlxsw_sp_inetaddr_lag_event+0xcc/0x130\n __mlxsw_sp_inetaddr_event+0xf5/0x3c0\n mlxsw_sp_router_netdevice_event+0x1015/0x1580\n notifier_call_chain+0xcc/0x150\n call_netdevice_notifiers_info+0x7e/0x100\n __netdev_upper_dev_unlink+0x10b/0x210\n netdev_upper_dev_unlink+0x79/0xa0\n vrf_del_slave+0x18/0x50\n do_set_master+0x146/0x7d0\n do_setlink.isra.0+0x9a0/0x2880\n rtnl_newlink+0x637/0xb20\n rtnetlink_rcv_msg+0x6fe/0xb90\n netlink_rcv_skb+0x123/0x380\n netlink_unicast+0x4a3/0x770\n netlink_sendmsg+0x75b/0xc90\n __sock_sendmsg+0xbe/0x160\n ____sys_sendmsg+0x5b2/0x7d0\n ___sys_sendmsg+0xfd/0x180\n __sys_sendmsg+0x124/0x1c0\n do_syscall_64+0xbb/0xfd0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n[...]\n\nAllocated by task 109:\n kasan_save_stack+0x30/0x50\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0x7b/0x90\n __kmalloc_noprof+0x2c1/0x790\n neigh_alloc+0x6af/0x8f0\n ___neigh_create+0x63/0xe90\n mlxsw_sp_nexthop_neigh_init+0x430/0x7e0\n mlxsw_sp_nexthop_type_init+0x212/0x960\n mlxsw_sp_nexthop6_group_info_init.constprop.0+0x81f/0x1280\n mlxsw_sp_nexthop6_group_get+0x392/0x6a0\n mlxsw_sp_fib6_entry_create+0x46a/0xfd0\n mlxsw_sp_router_fib6_replace+0x1ed/0x5f0\n mlxsw_sp_router_fib6_event_work+0x10a/0x2a0\n process_one_work+0xd57/0x1390\n worker_thread+0x4d6/0xd40\n kthread+0x355/0x5b0\n ret_from_fork+0x1d4/0x270\n ret_from_fork_asm+0x11/0x20\n\nFreed by task 154:\n kasan_save_stack+0x30/0x50\n kasan_save_track+0x14/0x30\n __kasan_save_free_info+0x3b/0x60\n __kasan_slab_free+0x43/0x70\n kmem_cache_free_bulk.part.0+0x1eb/0x5e0\n kvfree_rcu_bulk+0x1f2/0x260\n kfree_rcu_work+0x130/0x1b0\n process_one_work+0xd57/0x1390\n worker_thread+0x4d6/0xd40\n kthread+0x355/0x5b0\n ret_from_fork+0x1d4/0x270\n ret_from_fork_asm+0x11/0x20\n\nLast potentially related work creation:\n kasan_save_stack+0x30/0x50\n kasan_record_aux_stack+0x8c/0xa0\n kvfree_call_rcu+0x93/0x5b0\n mlxsw_sp_router_neigh_event_work+0x67d/0x860\n process_one_work+0xd57/0x1390\n worker_thread+0x4d6/0xd40\n kthread+0x355/0x5b0\n ret_from_fork+0x1d4/0x270\n ret_from_fork_asm+0x11/0x20(CVE-2025-68801)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfuse: fix io-uring list corruption for terminated non-committed requests\n\nWhen a request is terminated before it has been committed, the request\nis not removed from the queue\u0026apos;s list. This leaves a dangling list entry\nthat leads to list corruption and use-after-free issues.\n\nRemove the request from the queue\u0026apos;s list for terminated non-committed\nrequests.(CVE-2025-68805)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfuse: fix readahead reclaim deadlock\n\nCommit e26ee4efbc79 (\u0026quot;fuse: allocate ff-\u0026gt;release_args only if release is\nneeded\u0026quot;) skips allocating ff-\u0026gt;release_args if the server does not\nimplement open. However in doing so, fuse_prepare_release() now skips\ngrabbing the reference on the inode, which makes it possible for an\ninode to be evicted from the dcache while there are inflight readahead\nrequests. This causes a deadlock if the server triggers reclaim while\nservicing the readahead request and reclaim attempts to evict the inode\nof the file being read ahead. Since the folio is locked during\nreadahead, when reclaim evicts the fuse inode and fuse_evict_inode()\nattempts to remove all folios associated with the inode from the page\ncache (truncate_inode_pages_range()), reclaim will block forever waiting\nfor the lock since readahead cannot relinquish the lock because it is\nitself blocked in reclaim:\n\n\u0026gt;\u0026gt;\u0026gt; stack_trace(1504735)\n folio_wait_bit_common (mm/filemap.c:1308:4)\n folio_lock (./include/linux/pagemap.h:1052:3)\n truncate_inode_pages_range (mm/truncate.c:336:10)\n fuse_evict_inode (fs/fuse/inode.c:161:2)\n evict (fs/inode.c:704:3)\n dentry_unlink_inode (fs/dcache.c:412:3)\n __dentry_kill (fs/dcache.c:615:3)\n shrink_kill (fs/dcache.c:1060:12)\n shrink_dentry_list (fs/dcache.c:1087:3)\n prune_dcache_sb (fs/dcache.c:1168:2)\n super_cache_scan (fs/super.c:221:10)\n do_shrink_slab (mm/shrinker.c:435:9)\n shrink_slab (mm/shrinker.c:626:10)\n shrink_node (mm/vmscan.c:5951:2)\n shrink_zones (mm/vmscan.c:6195:3)\n do_try_to_free_pages (mm/vmscan.c:6257:3)\n do_swap_page (mm/memory.c:4136:11)\n handle_pte_fault (mm/memory.c:5562:10)\n handle_mm_fault (mm/memory.c:5870:9)\n do_user_addr_fault (arch/x86/mm/fault.c:1338:10)\n handle_page_fault (arch/x86/mm/fault.c:1481:3)\n exc_page_fault (arch/x86/mm/fault.c:1539:2)\n asm_exc_page_fault+0x22/0x27\n\nFix this deadlock by allocating ff-\u0026gt;release_args and grabbing the\nreference on the inode when preparing the file for release even if the\nserver does not implement open. The inode reference will be dropped when\nthe last reference on the fuse file is dropped (see fuse_file_put() -\u0026gt;\nfuse_release_end()).(CVE-2025-68821)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niavf: fix off-by-one issues in iavf_config_rss_reg()\n\nThere are off-by-one bugs when configuring RSS hash key and lookup\ntable, causing out-of-bounds reads to memory [1] and out-of-bounds\nwrites to device registers.\n\nBefore commit 43a3d9ba34c9 (\u0026quot;i40evf: Allow PF driver to configure RSS\u0026quot;),\nthe loop upper bounds were:\n    i \u0026lt;= I40E_VFQF_{HKEY,HLUT}_MAX_INDEX\nwhich is safe since the value is the last valid index.\n\nThat commit changed the bounds to:\n    i \u0026lt;= adapter-\u0026gt;rss_{key,lut}_size / 4\nwhere `rss_{key,lut}_size / 4` is the number of dwords, so the last\nvalid index is `(rss_{key,lut}_size / 4) - 1`. Therefore, using `\u0026lt;=`\naccesses one element past the end.\n\nFix the issues by using `\u0026lt;` instead of `\u0026lt;=`, ensuring we do not exceed\nthe bounds.\n\n[1] KASAN splat about rss_key_size off-by-one\n  BUG: KASAN: slab-out-of-bounds in iavf_config_rss+0x619/0x800\n  Read of size 4 at addr ffff888102c50134 by task kworker/u8:6/63\n\n  CPU: 0 UID: 0 PID: 63 Comm: kworker/u8:6 Not tainted 6.18.0-rc2-enjuk-tnguy-00378-g3005f5b77652-dirty #156 PREEMPT(voluntary)\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n  Workqueue: iavf iavf_watchdog_task\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   dump_stack_lvl+0x6f/0xb0\n   print_report+0x170/0x4f3\n   kasan_report+0xe1/0x1a0\n   iavf_config_rss+0x619/0x800\n   iavf_watchdog_task+0x2be7/0x3230\n   process_one_work+0x7fd/0x1420\n   worker_thread+0x4d1/0xd40\n   kthread+0x344/0x660\n   ret_from_fork+0x249/0x320\n   ret_from_fork_asm+0x1a/0x30\n   \u0026lt;/TASK\u0026gt;\n\n  Allocated by task 63:\n   kasan_save_stack+0x30/0x50\n   kasan_save_track+0x14/0x30\n   __kasan_kmalloc+0x7f/0x90\n   __kmalloc_noprof+0x246/0x6f0\n   iavf_watchdog_task+0x28fc/0x3230\n   process_one_work+0x7fd/0x1420\n   worker_thread+0x4d1/0xd40\n   kthread+0x344/0x660\n   ret_from_fork+0x249/0x320\n   ret_from_fork_asm+0x1a/0x30\n\n  The buggy address belongs to the object at ffff888102c50100\n   which belongs to the cache kmalloc-64 of size 64\n  The buggy address is located 0 bytes to the right of\n   allocated 52-byte region [ffff888102c50100, ffff888102c50134)\n\n  The buggy address belongs to the physical page:\n  page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102c50\n  flags: 0x200000000000000(node=0|zone=2)\n  page_type: f5(slab)\n  raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000\n  raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000\n  page dumped because: kasan: bad access detected\n\n  Memory state around the buggy address:\n   ffff888102c50000: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc\n   ffff888102c50080: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc\n  \u0026gt;ffff888102c50100: 00 00 00 00 00 00 04 fc fc fc fc fc fc fc fc fc\n                                       ^\n   ffff888102c50180: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc\n   ffff888102c50200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc(CVE-2025-71087)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ne1000: fix OOB in e1000_tbi_should_accept()\n\nIn e1000_tbi_should_accept() we read the last byte of the frame via\n\u0026apos;data[length - 1]\u0026apos; to evaluate the TBI workaround. If the descriptor-\nreported length is zero or larger than the actual RX buffer size, this\nread goes out of bounds and can hit unrelated slab objects. The issue\nis observed from the NAPI receive path (e1000_clean_rx_irq):\n\n==================================================================\nBUG: KASAN: slab-out-of-bounds in e1000_tbi_should_accept+0x610/0x790\nRead of size 1 at addr ffff888014114e54 by task sshd/363\n\nCPU: 0 PID: 363 Comm: sshd Not tainted 5.18.0-rc1 #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014\nCall Trace:\n \u0026lt;IRQ\u0026gt;\n dump_stack_lvl+0x5a/0x74\n print_address_description+0x7b/0x440\n print_report+0x101/0x200\n kasan_report+0xc1/0xf0\n e1000_tbi_should_accept+0x610/0x790\n e1000_clean_rx_irq+0xa8c/0x1110\n e1000_clean+0xde2/0x3c10\n __napi_poll+0x98/0x380\n net_rx_action+0x491/0xa20\n __do_softirq+0x2c9/0x61d\n do_softirq+0xd1/0x120\n \u0026lt;/IRQ\u0026gt;\n \u0026lt;TASK\u0026gt;\n __local_bh_enable_ip+0xfe/0x130\n ip_finish_output2+0x7d5/0xb00\n __ip_queue_xmit+0xe24/0x1ab0\n __tcp_transmit_skb+0x1bcb/0x3340\n tcp_write_xmit+0x175d/0x6bd0\n __tcp_push_pending_frames+0x7b/0x280\n tcp_sendmsg_locked+0x2e4f/0x32d0\n tcp_sendmsg+0x24/0x40\n sock_write_iter+0x322/0x430\n vfs_write+0x56c/0xa60\n ksys_write+0xd1/0x190\n do_syscall_64+0x43/0x90\n entry_SYSCALL_64_after_hwframe+0x44/0xae\nRIP: 0033:0x7f511b476b10\nCode: 73 01 c3 48 8b 0d 88 d3 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d f9 2b 2c 00 00 75 10 b8 01 00 00 00 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 8e 9b 01 00 48 89 04 24\nRSP: 002b:00007ffc9211d4e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001\nRAX: ffffffffffffffda RBX: 0000000000004024 RCX: 00007f511b476b10\nRDX: 0000000000004024 RSI: 0000559a9385962c RDI: 0000000000000003\nRBP: 0000559a9383a400 R08: fffffffffffffff0 R09: 0000000000004f00\nR10: 0000000000000070 R11: 0000000000000246 R12: 0000000000000000\nR13: 00007ffc9211d57f R14: 0000559a9347bde7 R15: 0000000000000003\n \u0026lt;/TASK\u0026gt;\nAllocated by task 1:\n __kasan_krealloc+0x131/0x1c0\n krealloc+0x90/0xc0\n add_sysfs_param+0xcb/0x8a0\n kernel_add_sysfs_param+0x81/0xd4\n param_sysfs_builtin+0x138/0x1a6\n param_sysfs_init+0x57/0x5b\n do_one_initcall+0x104/0x250\n do_initcall_level+0x102/0x132\n do_initcalls+0x46/0x74\n kernel_init_freeable+0x28f/0x393\n kernel_init+0x14/0x1a0\n ret_from_fork+0x22/0x30\nThe buggy address belongs to the object at ffff888014114000\n which belongs to the cache kmalloc-2k of size 2048\nThe buggy address is located 1620 bytes to the right of\n 2048-byte region [ffff888014114000, ffff888014114800]\nThe buggy address belongs to the physical page:\npage:ffffea0000504400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14110\nhead:ffffea0000504400 order:3 compound_mapcount:0 compound_pincount:0\nflags: 0x100000000010200(slab|head|node=0|zone=1)\nraw: 0100000000010200 0000000000000000 dead000000000001 ffff888013442000\nraw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000\npage dumped because: kasan: bad access detected\n==================================================================\n\nThis happens because the TBI check unconditionally dereferences the last\nbyte without validating the reported length first:\n\n\tu8 last_byte = *(data + length - 1);\n\nFix by rejecting the frame early if the length is zero, or if it exceeds\nadapter-\u0026gt;rx_buffer_len. This preserves the TBI workaround semantics for\nvalid frames and prevents touching memory beyond the RX buffer.(CVE-2025-71093)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: Handle incorrect num_connectors capability\n\nThe UCSI spec states that the num_connectors field is 7 bits, and the\n8th bit is reserved and should be set to zero.\nSome buggy FW has been known to set this bit, and it can lead to a\nsystem not booting.\nFlag that the FW is not behaving correctly, and auto-fix the value\nso that the system boots correctly.\n\nFound on Lenovo P1 G8 during Linux enablement program. The FW will\nbe fixed, but seemed worth addressing in case it hit platforms that\naren\u0026apos;t officially Linux supported.(CVE-2025-71108)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - zero initialize memory allocated via sock_kmalloc\n\nSeveral crypto user API contexts and requests allocated with\nsock_kmalloc() were left uninitialized, relying on callers to\nset fields explicitly. This resulted in the use of uninitialized\ndata in certain error paths or when new fields are added in the\nfuture.\n\nThe ACVP patches also contain two user-space interface files:\nalgif_kpp.c and algif_akcipher.c. These too rely on proper\ninitialization of their context structures.\n\nA particular issue has been observed with the newly added\n\u0026apos;inflight\u0026apos; variable introduced in af_alg_ctx by commit:\n\n  67b164a871af (\u0026quot;crypto: af_alg - Disallow multiple in-flight AIO requests\u0026quot;)\n\nBecause the context is not memset to zero after allocation,\nthe inflight variable has contained garbage values. As a result,\naf_alg_alloc_areq() has incorrectly returned -EBUSY randomly when\nthe garbage value was interpreted as true:\n\n  https://github.com/gregkh/linux/blame/master/crypto/af_alg.c#L1209\n\nThe check directly tests ctx-\u0026gt;inflight without explicitly\ncomparing against true/false. Since inflight is only ever set to\ntrue or false later, an uninitialized value has triggered\n-EBUSY failures. Zero-initializing memory allocated with\nsock_kmalloc() ensures inflight and other fields start in a known\nstate, removing random issues caused by uninitialized data.(CVE-2025-71113)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/kexec: Enable SMT before waking offline CPUs\n\nIf SMT is disabled or a partial SMT state is enabled, when a new kernel\nimage is loaded for kexec, on reboot the following warning is observed:\n\nkexec: Waking offline cpu 228.\nWARNING: CPU: 0 PID: 9062 at arch/powerpc/kexec/core_64.c:223 kexec_prepare_cpus+0x1b0/0x1bc\n[snip]\n NIP kexec_prepare_cpus+0x1b0/0x1bc\n LR  kexec_prepare_cpus+0x1a0/0x1bc\n Call Trace:\n  kexec_prepare_cpus+0x1a0/0x1bc (unreliable)\n  default_machine_kexec+0x160/0x19c\n  machine_kexec+0x80/0x88\n  kernel_kexec+0xd0/0x118\n  __do_sys_reboot+0x210/0x2c4\n  system_call_exception+0x124/0x320\n  system_call_vectored_common+0x15c/0x2ec\n\nThis occurs as add_cpu() fails due to cpu_bootable() returning false for\nCPUs that fail the cpu_smt_thread_allowed() check or non primary\nthreads if SMT is disabled.\n\nFix the issue by enabling SMT and resetting the number of SMT threads to\nthe number of threads per core, before attempting to wake up all present\nCPUs.(CVE-2025-71119)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Do not register unsupported perf events\n\nSynthetic events currently do not have a function to register perf events.\nThis leads to calling the tracepoint register functions with a NULL\nfunction pointer which triggers:\n\n ------------[ cut here ]------------\n WARNING: kernel/tracepoint.c:175 at tracepoint_add_func+0x357/0x370, CPU#2: perf/2272\n Modules linked in: kvm_intel kvm irqbypass\n CPU: 2 UID: 0 PID: 2272 Comm: perf Not tainted 6.18.0-ftest-11964-ge022764176fc-dirty #323 PREEMPTLAZY\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-debian-1.17.0-1 04/01/2014\n RIP: 0010:tracepoint_add_func+0x357/0x370\n Code: 28 9c e8 4c 0b f5 ff eb 0f 4c 89 f7 48 c7 c6 80 4d 28 9c e8 ab 89 f4 ff 31 c0 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc \u0026lt;0f\u0026gt; 0b 49 c7 c6 ea ff ff ff e9 ee fe ff ff 0f 0b e9 f9 fe ff ff 0f\n RSP: 0018:ffffabc0c44d3c40 EFLAGS: 00010246\n RAX: 0000000000000001 RBX: ffff9380aa9e4060 RCX: 0000000000000000\n RDX: 000000000000000a RSI: ffffffff9e1d4a98 RDI: ffff937fcf5fd6c8\n RBP: 0000000000000001 R08: 0000000000000007 R09: ffff937fcf5fc780\n R10: 0000000000000003 R11: ffffffff9c193910 R12: 000000000000000a\n R13: ffffffff9e1e5888 R14: 0000000000000000 R15: ffffabc0c44d3c78\n FS:  00007f6202f5f340(0000) GS:ffff93819f00f000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 000055d3162281a8 CR3: 0000000106a56003 CR4: 0000000000172ef0\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  tracepoint_probe_register+0x5d/0x90\n  synth_event_reg+0x3c/0x60\n  perf_trace_event_init+0x204/0x340\n  perf_trace_init+0x85/0xd0\n  perf_tp_event_init+0x2e/0x50\n  perf_try_init_event+0x6f/0x230\n  ? perf_event_alloc+0x4bb/0xdc0\n  perf_event_alloc+0x65a/0xdc0\n  __se_sys_perf_event_open+0x290/0x9f0\n  do_syscall_64+0x93/0x7b0\n  ? entry_SYSCALL_64_after_hwframe+0x76/0x7e\n  ? trace_hardirqs_off+0x53/0xc0\n  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nInstead, have the code return -ENODEV, which doesn\u0026apos;t warn and has perf\nerror out with:\n\n # perf record -e synthetic:futex_wait\nError:\nThe sys_perf_event_open() syscall returned with 19 (No such device) for event (synthetic:futex_wait).\n\u0026quot;dmesg | grep -i perf\u0026quot; may provide additional information.\n\nIdeally perf should support synthetic events, but for now just fix the\nwarning. The support can come later.(CVE-2025-71125)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncifs: Fix memory and information leak in smb3_reconfigure()\n\nIn smb3_reconfigure(), if smb3_sync_session_ctx_passwords() fails, the\nfunction returns immediately without freeing and erasing the newly\nallocated new_password and new_password2. This causes both a memory leak\nand a potential information leak.\n\nFix this by calling kfree_sensitive() on both password buffers before\nreturning in this error case.(CVE-2025-71151)","status":"published","published":"2026-02-06T11:10:20Z","modified":"2026-08-18T01:19:32.496570777Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1304","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nptr_ring: do not block hard interrupts in ptr_ring_resize_multiple()\n\nJakub added a lockdep_assert_no_hardirq() check in __page_pool_put_page()\nto increase test coverage.\n\nsyzbot found a splat caused by hard irq blocking in\nptr_ring_resize_multiple() [1]\n\nAs current users of ptr_ring_resize_multiple() do not require\nhard irqs being masked, replace it to only block BH.\n\nRename helpers to better reflect they are safe against BH only.\n\n- ptr_ring_resize_multiple() to ptr_ring_resize_multiple_bh()\n- skb_array_resize_multiple() to skb_array_resize_multiple_bh()\n\n[1]\n\nWARNING: CPU: 1 PID: 9150 at net/core/page_pool.c:709 __page_pool_put_page net/core/page_pool.c:709 [inline]\nWARNING: CPU: 1 PID: 9150 at net/core/page_pool.c:709 page_pool_put_unrefed_netmem+0x157/0xa40 net/core/page_pool.c:780\nModules linked in:\nCPU: 1 UID: 0 PID: 9150 Comm: syz.1.1052 Not tainted 6.11.0-rc3-syzkaller-00202-gf8669d7b5f5d #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024\nRIP: 0010:__page_pool_put_page net/core/page_pool.c:709 [inline]\nRIP: 0010:page_pool_put_unrefed_netmem+0x157/0xa40 net/core/page_pool.c:780\nCode: 74 0e e8 7c aa fb f7 eb 43 e8 75 aa fb f7 eb 3c 65 8b 1d 38 a8 6a 76 31 ff 89 de e8 a3 ae fb f7 85 db 74 0b e8 5a aa fb f7 90 \u0026lt;0f\u0026gt; 0b 90 eb 1d 65 8b 1d 15 a8 6a 76 31 ff 89 de e8 84 ae fb f7 85\nRSP: 0018:ffffc9000bda6b58 EFLAGS: 00010083\nRAX: ffffffff8997e523 RBX: 0000000000000000 RCX: 0000000000040000\nRDX: ffffc9000fbd0000 RSI: 0000000000001842 RDI: 0000000000001843\nRBP: 0000000000000000 R08: ffffffff8997df2c R09: 1ffffd40003a000d\nR10: dffffc0000000000 R11: fffff940003a000e R12: ffffea0001d00040\nR13: ffff88802e8a4000 R14: dffffc0000000000 R15: 00000000ffffffff\nFS:  00007fb7aaf716c0(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fa15a0d4b72 CR3: 00000000561b0000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u0026lt;TASK\u0026gt;\n tun_ptr_free drivers/net/tun.c:617 [inline]\n __ptr_ring_swap_queue include/linux/ptr_ring.h:571 [inline]\n ptr_ring_resize_multiple_noprof include/linux/ptr_ring.h:643 [inline]\n tun_queue_resize drivers/net/tun.c:3694 [inline]\n tun_device_event+0xaaf/0x1080 drivers/net/tun.c:3714\n notifier_call_chain+0x19f/0x3e0 kernel/notifier.c:93\n call_netdevice_notifiers_extack net/core/dev.c:2032 [inline]\n call_netdevice_notifiers net/core/dev.c:2046 [inline]\n dev_change_tx_queue_len+0x158/0x2a0 net/core/dev.c:9024\n do_setlink+0xff6/0x41f0 net/core/rtnetlink.c:2923\n rtnl_setlink+0x40d/0x5a0 net/core/rtnetlink.c:3201\n rtnetlink_rcv_msg+0x73f/0xcf0 net/core/rtnetlink.c:6647\n netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2550(CVE-2024-57994)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params\n\nEach cpu DAI should associate with a widget. However, the topology might\nnot create the right number of DAI widgets for aggregated amps. And it\nwill cause NULL pointer deference.\nCheck that the DAI widget associated with the CPU DAI is valid to prevent\nNULL pointer deference due to missing DAI widgets in topologies with\naggregated amps.(CVE-2024-58012)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndriver core: fix potential NULL pointer dereference in dev_uevent()\n\nIf userspace reads \u0026quot;uevent\u0026quot; device attribute at the same time as another\nthreads unbinds the device from its driver, change to dev-\u0026gt;driver from a\nvalid pointer to NULL may result in crash. Fix this by using READ_ONCE()\nwhen fetching the pointer, and take bus\u0026apos; drivers klist lock to make sure\ndriver instance will not disappear while we access it.\n\nUse WRITE_ONCE() when setting the driver pointer to ensure there is no\ntearing.(CVE-2025-37800)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mdiobus: Fix potential out-of-bounds clause 45 read/write access\n\nWhen using publicly available tools like \u0026apos;mdio-tools\u0026apos; to read/write data\nfrom/to network interface and its PHY via C45 (clause 45) mdiobus,\nthere is no verification of parameters passed to the ioctl and\nit accepts any mdio address.\nCurrently there is support for 32 addresses in kernel via PHY_MAX_ADDR define,\nbut it is possible to pass higher value than that via ioctl.\nWhile read/write operation should generally fail in this case,\nmdiobus provides stats array, where wrong address may allow out-of-bounds\nread/write.\n\nFix that by adding address verification before C45 read/write operation.\nWhile this excludes this access from any statistics, it improves security of\nread/write operation.(CVE-2025-38110)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mdiobus: Fix potential out-of-bounds read/write access\n\nWhen using publicly available tools like \u0026apos;mdio-tools\u0026apos; to read/write data\nfrom/to network interface and its PHY via mdiobus, there is no verification of\nparameters passed to the ioctl and it accepts any mdio address.\nCurrently there is support for 32 addresses in kernel via PHY_MAX_ADDR define,\nbut it is possible to pass higher value than that via ioctl.\nWhile read/write operation should generally fail in this case,\nmdiobus provides stats array, where wrong address may allow out-of-bounds\nread/write.\n\nFix that by adding address verification before read/write operation.\nWhile this excludes this access from any statistics, it improves security of\nread/write operation.(CVE-2025-38111)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: phy: clear phydev-\u0026gt;devlink when the link is deleted\n\nThere is a potential crash issue when disabling and re-enabling the\nnetwork port. When disabling the network port, phy_detach() calls\ndevice_link_del() to remove the device link, but it does not clear\nphydev-\u0026gt;devlink, so phydev-\u0026gt;devlink is not a NULL pointer. Then the\nnetwork port is re-enabled, but if phy_attach_direct() fails before\ncalling device_link_add(), the code jumps to the \u0026quot;error\u0026quot; label and\ncalls phy_detach(). Since phydev-\u0026gt;devlink retains the old value from\nthe previous attach/detach cycle, device_link_del() uses the old value,\nwhich accesses a NULL pointer and causes a crash. The simplified crash\nlog is as follows.\n\n[   24.702421] Call trace:\n[   24.704856]  device_link_put_kref+0x20/0x120\n[   24.709124]  device_link_del+0x30/0x48\n[   24.712864]  phy_detach+0x24/0x168\n[   24.716261]  phy_attach_direct+0x168/0x3a4\n[   24.720352]  phylink_fwnode_phy_connect+0xc8/0x14c\n[   24.725140]  phylink_of_phy_connect+0x1c/0x34\n\nTherefore, phydev-\u0026gt;devlink needs to be cleared when the device link is\ndeleted.(CVE-2025-38149)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_set_pipapo: prevent overflow in lookup table allocation\n\nWhen calculating the lookup table size, ensure the following\nmultiplication does not overflow:\n\n- desc-\u0026gt;field_len[] maximum value is U8_MAX multiplied by\n  NFT_PIPAPO_GROUPS_PER_BYTE(f) that can be 2, worst case.\n- NFT_PIPAPO_BUCKETS(f-\u0026gt;bb) is 2^8, worst case.\n- sizeof(unsigned long), from sizeof(*f-\u0026gt;lt), lt in\n  struct nft_pipapo_field.\n\nThen, use check_mul_overflow() to multiply by bucket size and then use\ncheck_add_overflow() to the alignment for avx2 (if needed). Finally, add\nlt_size_check_overflow() helper and use it to consolidate this.\n\nWhile at it, replace leftover allocation using the GFP_KERNEL to\nGFP_KERNEL_ACCOUNT for consistency, in pipapo_resize().(CVE-2025-38162)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: add NULL check in automount_fullpath\n\npage is checked for null in __build_path_from_dentry_optional_prefix\nwhen tcon-\u0026gt;origin_fullpath is not set. However, the check is missing when\nit is set.\nAdd a check to prevent a potential NULL pointer dereference.(CVE-2025-38208)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: fix race between nfsd registration and exports_proc\n\nAs of now nfsd calls create_proc_exports_entry() at start of init_nfsd\nand cleanup by remove_proc_entry() at last of exit_nfsd.\n\nWhich causes kernel OOPs if there is race between below 2 operations:\n(i) exportfs -r\n(ii) mount -t nfsd none /proc/fs/nfsd\n\nfor 5.4 kernel ARM64:\n\nCPU 1:\nel1_irq+0xbc/0x180\narch_counter_get_cntvct+0x14/0x18\nrunning_clock+0xc/0x18\npreempt_count_add+0x88/0x110\nprep_new_page+0xb0/0x220\nget_page_from_freelist+0x2d8/0x1778\n__alloc_pages_nodemask+0x15c/0xef0\n__vmalloc_node_range+0x28c/0x478\n__vmalloc_node_flags_caller+0x8c/0xb0\nkvmalloc_node+0x88/0xe0\nnfsd_init_net+0x6c/0x108 [nfsd]\nops_init+0x44/0x170\nregister_pernet_operations+0x114/0x270\nregister_pernet_subsys+0x34/0x50\ninit_nfsd+0xa8/0x718 [nfsd]\ndo_one_initcall+0x54/0x2e0\n\nCPU 2 :\nUnable to handle kernel NULL pointer dereference at virtual address 0000000000000010\n\nPC is at : exports_net_open+0x50/0x68 [nfsd]\n\nCall trace:\nexports_net_open+0x50/0x68 [nfsd]\nexports_proc_open+0x2c/0x38 [nfsd]\nproc_reg_open+0xb8/0x198\ndo_dentry_open+0x1c4/0x418\nvfs_open+0x38/0x48\npath_openat+0x28c/0xf18\ndo_filp_open+0x70/0xe8\ndo_sys_open+0x154/0x248\n\nSometimes it crashes at exports_net_open() and sometimes cache_seq_next_rcu().\n\nand same is happening on latest 6.14 kernel as well:\n\n[    0.000000] Linux version 6.14.0-rc5-next-20250304-dirty\n...\n[  285.455918] Unable to handle kernel paging request at virtual address 00001f4800001f48\n...\n[  285.464902] pc : cache_seq_next_rcu+0x78/0xa4\n...\n[  285.469695] Call trace:\n[  285.470083]  cache_seq_next_rcu+0x78/0xa4 (P)\n[  285.470488]  seq_read+0xe0/0x11c\n[  285.470675]  proc_reg_read+0x9c/0xf0\n[  285.470874]  vfs_read+0xc4/0x2fc\n[  285.471057]  ksys_read+0x6c/0xf4\n[  285.471231]  __arm64_sys_read+0x1c/0x28\n[  285.471428]  invoke_syscall+0x44/0x100\n[  285.471633]  el0_svc_common.constprop.0+0x40/0xe0\n[  285.471870]  do_el0_svc_compat+0x1c/0x34\n[  285.472073]  el0_svc_compat+0x2c/0x80\n[  285.472265]  el0t_32_sync_handler+0x90/0x140\n[  285.472473]  el0t_32_sync+0x19c/0x1a0\n[  285.472887] Code: f9400885 93407c23 937d7c27 11000421 (f86378a3)\n[  285.473422] ---[ end trace 0000000000000000 ]---\n\nIt reproduced simply with below script:\nwhile [ 1 ]\ndo\n/exportfs -r\ndone \u0026amp;\n\nwhile [ 1 ]\ndo\ninsmod /nfsd.ko\nmount -t nfsd none /proc/fs/nfsd\numount /proc/fs/nfsd\nrmmod nfsd\ndone \u0026amp;\n\nSo exporting interfaces to user space shall be done at last and\ncleanup at first place.\n\nWith change there is no Kernel OOPs.(CVE-2025-38232)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix potential deadlock when reconnecting channels\n\nFix cifs_signal_cifsd_for_reconnect() to take the correct lock order\nand prevent the following deadlock from happening\n\n======================================================\nWARNING: possible circular locking dependency detected\n6.16.0-rc3-build2+ #1301 Tainted: G S      W\n------------------------------------------------------\ncifsd/6055 is trying to acquire lock:\nffff88810ad56038 (\u0026amp;tcp_ses-\u0026gt;srv_lock){+.+.}-{3:3}, at: cifs_signal_cifsd_for_reconnect+0x134/0x200\n\nbut task is already holding lock:\nffff888119c64330 (\u0026amp;ret_buf-\u0026gt;chan_lock){+.+.}-{3:3}, at: cifs_signal_cifsd_for_reconnect+0xcf/0x200\n\nwhich lock already depends on the new lock.\n\nthe existing dependency chain (in reverse order) is:\n\n-\u0026gt; #2 (\u0026amp;ret_buf-\u0026gt;chan_lock){+.+.}-{3:3}:\n       validate_chain+0x1cf/0x270\n       __lock_acquire+0x60e/0x780\n       lock_acquire.part.0+0xb4/0x1f0\n       _raw_spin_lock+0x2f/0x40\n       cifs_setup_session+0x81/0x4b0\n       cifs_get_smb_ses+0x771/0x900\n       cifs_mount_get_session+0x7e/0x170\n       cifs_mount+0x92/0x2d0\n       cifs_smb3_do_mount+0x161/0x460\n       smb3_get_tree+0x55/0x90\n       vfs_get_tree+0x46/0x180\n       do_new_mount+0x1b0/0x2e0\n       path_mount+0x6ee/0x740\n       do_mount+0x98/0xe0\n       __do_sys_mount+0x148/0x180\n       do_syscall_64+0xa4/0x260\n       entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\n-\u0026gt; #1 (\u0026amp;ret_buf-\u0026gt;ses_lock){+.+.}-{3:3}:\n       validate_chain+0x1cf/0x270\n       __lock_acquire+0x60e/0x780\n       lock_acquire.part.0+0xb4/0x1f0\n       _raw_spin_lock+0x2f/0x40\n       cifs_match_super+0x101/0x320\n       sget+0xab/0x270\n       cifs_smb3_do_mount+0x1e0/0x460\n       smb3_get_tree+0x55/0x90\n       vfs_get_tree+0x46/0x180\n       do_new_mount+0x1b0/0x2e0\n       path_mount+0x6ee/0x740\n       do_mount+0x98/0xe0\n       __do_sys_mount+0x148/0x180\n       do_syscall_64+0xa4/0x260\n       entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\n-\u0026gt; #0 (\u0026amp;tcp_ses-\u0026gt;srv_lock){+.+.}-{3:3}:\n       check_noncircular+0x95/0xc0\n       check_prev_add+0x115/0x2f0\n       validate_chain+0x1cf/0x270\n       __lock_acquire+0x60e/0x780\n       lock_acquire.part.0+0xb4/0x1f0\n       _raw_spin_lock+0x2f/0x40\n       cifs_signal_cifsd_for_reconnect+0x134/0x200\n       __cifs_reconnect+0x8f/0x500\n       cifs_handle_standard+0x112/0x280\n       cifs_demultiplex_thread+0x64d/0xbc0\n       kthread+0x2f7/0x310\n       ret_from_fork+0x2a/0x230\n       ret_from_fork_asm+0x1a/0x30\n\nother info that might help us debug this:\n\nChain exists of:\n  \u0026amp;tcp_ses-\u0026gt;srv_lock --\u0026gt; \u0026amp;ret_buf-\u0026gt;ses_lock --\u0026gt; \u0026amp;ret_buf-\u0026gt;chan_lock\n\n Possible unsafe locking scenario:\n\n       CPU0                    CPU1\n       ----                    ----\n  lock(\u0026amp;ret_buf-\u0026gt;chan_lock);\n                               lock(\u0026amp;ret_buf-\u0026gt;ses_lock);\n                               lock(\u0026amp;ret_buf-\u0026gt;chan_lock);\n  lock(\u0026amp;tcp_ses-\u0026gt;srv_lock);\n\n *** DEADLOCK ***\n\n3 locks held by cifsd/6055:\n #0: ffffffff857de398 (\u0026amp;cifs_tcp_ses_lock){+.+.}-{3:3}, at: cifs_signal_cifsd_for_reconnect+0x7b/0x200\n #1: ffff888119c64060 (\u0026amp;ret_buf-\u0026gt;ses_lock){+.+.}-{3:3}, at: cifs_signal_cifsd_for_reconnect+0x9c/0x200\n #2: ffff888119c64330 (\u0026amp;ret_buf-\u0026gt;chan_lock){+.+.}-{3:3}, at: cifs_signal_cifsd_for_reconnect+0xcf/0x200(CVE-2025-38244)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: eir: Fix possible crashes on eir_create_adv_data\n\neir_create_adv_data may attempt to add EIR_FLAGS and EIR_TX_POWER\nwithout checking if that would fit.(CVE-2025-38303)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsoftware node: Correct a OOB check in software_node_get_reference_args()\n\nsoftware_node_get_reference_args() wants to get @index-th element, so\nthe property value requires at least \u0026apos;(index + 1) * sizeof(*ref)\u0026apos; bytes\nbut that can not be guaranteed by current OOB check, and may cause OOB\nfor malformed property.\n\nFix by using as OOB check \u0026apos;((index + 1) * sizeof(*ref) \u0026gt; prop-\u0026gt;length)\u0026apos;.(CVE-2025-38342)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN\n\nWe found a few different systems hung up in writeback waiting on the same\npage lock, and one task waiting on the NFS_LAYOUT_DRAIN bit in\npnfs_update_layout(), however the pnfs_layout_hdr\u0026apos;s plh_outstanding count\nwas zero.\n\nIt seems most likely that this is another race between the waiter and waker\nsimilar to commit ed0172af5d6f (\u0026quot;SUNRPC: Fix a race to wake a sync task\u0026quot;).\nFix it up by applying the advised barrier.(CVE-2025-38393)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight\n\nReject migration of SEV{-ES} state if either the source or destination VM\nis actively creating a vCPU, i.e. if kvm_vm_ioctl_create_vcpu() is in the\nsection between incrementing created_vcpus and online_vcpus.  The bulk of\nvCPU creation runs _outside_ of kvm-\u0026gt;lock to allow creating multiple vCPUs\nin parallel, and so sev_info.es_active can get toggled from false=\u0026gt;true in\nthe destination VM after (or during) svm_vcpu_create(), resulting in an\nSEV{-ES} VM effectively having a non-SEV{-ES} vCPU.\n\nThe issue manifests most visibly as a crash when trying to free a vCPU\u0026apos;s\nNULL VMSA page in an SEV-ES VM, but any number of things can go wrong.\n\n  BUG: unable to handle page fault for address: ffffebde00000000\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  PGD 0 P4D 0\n  Oops: Oops: 0000 [#1] SMP KASAN NOPTI\n  CPU: 227 UID: 0 PID: 64063 Comm: syz.5.60023 Tainted: G     U     O        6.15.0-smp-DEV #2 NONE\n  Tainted: [U]=USER, [O]=OOT_MODULE\n  Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.52.0-0 10/28/2024\n  RIP: 0010:constant_test_bit arch/x86/include/asm/bitops.h:206 [inline]\n  RIP: 0010:arch_test_bit arch/x86/include/asm/bitops.h:238 [inline]\n  RIP: 0010:_test_bit include/asm-generic/bitops/instrumented-non-atomic.h:142 [inline]\n  RIP: 0010:PageHead include/linux/page-flags.h:866 [inline]\n  RIP: 0010:___free_pages+0x3e/0x120 mm/page_alloc.c:5067\n  Code: \u0026lt;49\u0026gt; f7 06 40 00 00 00 75 05 45 31 ff eb 0c 66 90 4c 89 f0 4c 39 f0\n  RSP: 0018:ffff8984551978d0 EFLAGS: 00010246\n  RAX: 0000777f80000001 RBX: 0000000000000000 RCX: ffffffff918aeb98\n  RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffebde00000000\n  RBP: 0000000000000000 R08: ffffebde00000007 R09: 1ffffd7bc0000000\n  R10: dffffc0000000000 R11: fffff97bc0000001 R12: dffffc0000000000\n  R13: ffff8983e19751a8 R14: ffffebde00000000 R15: 1ffffd7bc0000000\n  FS:  0000000000000000(0000) GS:ffff89ee661d3000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: ffffebde00000000 CR3: 000000793ceaa000 CR4: 0000000000350ef0\n  DR0: 0000000000000000 DR1: 0000000000000b5f DR2: 0000000000000000\n  DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   sev_free_vcpu+0x413/0x630 arch/x86/kvm/svm/sev.c:3169\n   svm_vcpu_free+0x13a/0x2a0 arch/x86/kvm/svm/svm.c:1515\n   kvm_arch_vcpu_destroy+0x6a/0x1d0 arch/x86/kvm/x86.c:12396\n   kvm_vcpu_destroy virt/kvm/kvm_main.c:470 [inline]\n   kvm_destroy_vcpus+0xd1/0x300 virt/kvm/kvm_main.c:490\n   kvm_arch_destroy_vm+0x636/0x820 arch/x86/kvm/x86.c:12895\n   kvm_put_kvm+0xb8e/0xfb0 virt/kvm/kvm_main.c:1310\n   kvm_vm_release+0x48/0x60 virt/kvm/kvm_main.c:1369\n   __fput+0x3e4/0x9e0 fs/file_table.c:465\n   task_work_run+0x1a9/0x220 kernel/task_work.c:227\n   exit_task_work include/linux/task_work.h:40 [inline]\n   do_exit+0x7f0/0x25b0 kernel/exit.c:953\n   do_group_exit+0x203/0x2d0 kernel/exit.c:1102\n   get_signal+0x1357/0x1480 kernel/signal.c:3034\n   arch_do_signal_or_restart+0x40/0x690 arch/x86/kernel/signal.c:337\n   exit_to_user_mode_loop kernel/entry/common.c:111 [inline]\n   exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]\n   __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]\n   syscall_exit_to_user_mode+0x67/0xb0 kernel/entry/common.c:218\n   do_syscall_64+0x7c/0x150 arch/x86/entry/syscall_64.c:100\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n  RIP: 0033:0x7f87a898e969\n   \u0026lt;/TASK\u0026gt;\n  Modules linked in: gq(O)\n  gsmi: Log Shutdown Reason 0x03\n  CR2: ffffebde00000000\n  ---[ end trace 0000000000000000 ]---\n\nDeliberately don\u0026apos;t check for a NULL VMSA when freeing the vCPU, as crashing\nthe host is likely desirable due to the VMSA being consumed by hardware.\nE.g. if KVM manages to allow VMRUN on the vCPU, hardware may read/write a\nbogus VMSA page.  Accessing P\n---truncated---(CVE-2025-38455)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ns390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again\n\nCommit 7ded842b356d (\u0026quot;s390/bpf: Fix bpf_plt pointer arithmetic\u0026quot;) has\naccidentally removed the critical piece of commit c730fce7c70c\n(\u0026quot;s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL\u0026quot;), causing\nintermittent kernel panics in e.g. perf\u0026apos;s on_switch() prog to reappear.\n\nRestore the fix and add a comment.(CVE-2025-38489)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niommu/amd: Avoid stack buffer overflow from kernel cmdline\n\nWhile the kernel command line is considered trusted in most environments,\navoid writing 1 byte past the end of \u0026quot;acpiid\u0026quot; if the \u0026quot;str\u0026quot; argument is\nmaximum length.(CVE-2025-38676)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niommufd: Prevent ALIGN() overflow\n\nWhen allocating IOVA the candidate range gets aligned to the target\nalignment. If the range is close to ULONG_MAX then the ALIGN() can\nwrap resulting in a corrupted iova.\n\nOpen code the ALIGN() using get_add_overflow() to prevent this.\nThis simplifies the checks as we don\u0026apos;t need to check for length earlier\neither.\n\nConsolidate the two copies of this code under a single helper.\n\nThis bug would allow userspace to create a mapping that overlaps with some\nother mapping or a reserved range.(CVE-2025-38688)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\njfs: upper bound check of tree index in dbAllocAG\n\nWhen computing the tree index in dbAllocAG, we never check if we are\nout of bounds realative to the size of the stree.\nThis could happen in a scenario where the filesystem metadata are\ncorrupted.(CVE-2025-38697)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nhfsplus: don\u0026apos;t use BUG_ON() in hfsplus_create_attributes_file()\n\nWhen the volume header contains erroneous values that do not reflect\nthe actual state of the filesystem, hfsplus_fill_super() assumes that\nthe attributes file is not yet created, which later results in hitting\nBUG_ON() when hfsplus_create_attributes_file() is called. Replace this\nBUG_ON() with -EIO error with a message to suggest running fsck tool.(CVE-2025-38712)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nhfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()\n\nThe hfsplus_readdir() method is capable to crash by calling\nhfsplus_uni2asc():\n\n[  667.121659][ T9805] ==================================================================\n[  667.122651][ T9805] BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0x902/0xa10\n[  667.123627][ T9805] Read of size 2 at addr ffff88802592f40c by task repro/9805\n[  667.124578][ T9805]\n[  667.124876][ T9805] CPU: 3 UID: 0 PID: 9805 Comm: repro Not tainted 6.16.0-rc3 #1 PREEMPT(full)\n[  667.124886][ T9805] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[  667.124890][ T9805] Call Trace:\n[  667.124893][ T9805]  \u0026lt;TASK\u0026gt;\n[  667.124896][ T9805]  dump_stack_lvl+0x10e/0x1f0\n[  667.124911][ T9805]  print_report+0xd0/0x660\n[  667.124920][ T9805]  ? __virt_addr_valid+0x81/0x610\n[  667.124928][ T9805]  ? __phys_addr+0xe8/0x180\n[  667.124934][ T9805]  ? hfsplus_uni2asc+0x902/0xa10\n[  667.124942][ T9805]  kasan_report+0xc6/0x100\n[  667.124950][ T9805]  ? hfsplus_uni2asc+0x902/0xa10\n[  667.124959][ T9805]  hfsplus_uni2asc+0x902/0xa10\n[  667.124966][ T9805]  ? hfsplus_bnode_read+0x14b/0x360\n[  667.124974][ T9805]  hfsplus_readdir+0x845/0xfc0\n[  667.124984][ T9805]  ? __pfx_hfsplus_readdir+0x10/0x10\n[  667.124994][ T9805]  ? stack_trace_save+0x8e/0xc0\n[  667.125008][ T9805]  ? iterate_dir+0x18b/0xb20\n[  667.125015][ T9805]  ? trace_lock_acquire+0x85/0xd0\n[  667.125022][ T9805]  ? lock_acquire+0x30/0x80\n[  667.125029][ T9805]  ? iterate_dir+0x18b/0xb20\n[  667.125037][ T9805]  ? down_read_killable+0x1ed/0x4c0\n[  667.125044][ T9805]  ? putname+0x154/0x1a0\n[  667.125051][ T9805]  ? __pfx_down_read_killable+0x10/0x10\n[  667.125058][ T9805]  ? apparmor_file_permission+0x239/0x3e0\n[  667.125069][ T9805]  iterate_dir+0x296/0xb20\n[  667.125076][ T9805]  __x64_sys_getdents64+0x13c/0x2c0\n[  667.125084][ T9805]  ? __pfx___x64_sys_getdents64+0x10/0x10\n[  667.125091][ T9805]  ? __x64_sys_openat+0x141/0x200\n[  667.125126][ T9805]  ? __pfx_filldir64+0x10/0x10\n[  667.125134][ T9805]  ? do_user_addr_fault+0x7fe/0x12f0\n[  667.125143][ T9805]  do_syscall_64+0xc9/0x480\n[  667.125151][ T9805]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[  667.125158][ T9805] RIP: 0033:0x7fa8753b2fc9\n[  667.125164][ T9805] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 48\n[  667.125172][ T9805] RSP: 002b:00007ffe96f8e0f8 EFLAGS: 00000217 ORIG_RAX: 00000000000000d9\n[  667.125181][ T9805] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa8753b2fc9\n[  667.125185][ T9805] RDX: 0000000000000400 RSI: 00002000000063c0 RDI: 0000000000000004\n[  667.125190][ T9805] RBP: 00007ffe96f8e110 R08: 00007ffe96f8e110 R09: 00007ffe96f8e110\n[  667.125195][ T9805] R10: 0000000000000000 R11: 0000000000000217 R12: 0000556b1e3b4260\n[  667.125199][ T9805] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\n[  667.125207][ T9805]  \u0026lt;/TASK\u0026gt;\n[  667.125210][ T9805]\n[  667.145632][ T9805] Allocated by task 9805:\n[  667.145991][ T9805]  kasan_save_stack+0x20/0x40\n[  667.146352][ T9805]  kasan_save_track+0x14/0x30\n[  667.146717][ T9805]  __kasan_kmalloc+0xaa/0xb0\n[  667.147065][ T9805]  __kmalloc_noprof+0x205/0x550\n[  667.147448][ T9805]  hfsplus_find_init+0x95/0x1f0\n[  667.147813][ T9805]  hfsplus_readdir+0x220/0xfc0\n[  667.148174][ T9805]  iterate_dir+0x296/0xb20\n[  667.148549][ T9805]  __x64_sys_getdents64+0x13c/0x2c0\n[  667.148937][ T9805]  do_syscall_64+0xc9/0x480\n[  667.149291][ T9805]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[  667.149809][ T9805]\n[  667.150030][ T9805] The buggy address belongs to the object at ffff88802592f000\n[  667.150030][ T9805]  which belongs to the cache kmalloc-2k of size 2048\n[  667.151282][ T9805] The buggy address is located 0 bytes to the right of\n[  667.151282][ T9805]  allocated 1036-byte region [ffff88802592f000, ffff88802592f40c)\n[  667.1\n---truncated---(CVE-2025-38713)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nhfsplus: fix slab-out-of-bounds in hfsplus_bnode_read()\n\nThe hfsplus_bnode_read() method can trigger the issue:\n\n[  174.852007][ T9784] ==================================================================\n[  174.852709][ T9784] BUG: KASAN: slab-out-of-bounds in hfsplus_bnode_read+0x2f4/0x360\n[  174.853412][ T9784] Read of size 8 at addr ffff88810b5fc6c0 by task repro/9784\n[  174.854059][ T9784]\n[  174.854272][ T9784] CPU: 1 UID: 0 PID: 9784 Comm: repro Not tainted 6.16.0-rc3 #7 PREEMPT(full)\n[  174.854281][ T9784] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[  174.854286][ T9784] Call Trace:\n[  174.854289][ T9784]  \u0026lt;TASK\u0026gt;\n[  174.854292][ T9784]  dump_stack_lvl+0x10e/0x1f0\n[  174.854305][ T9784]  print_report+0xd0/0x660\n[  174.854315][ T9784]  ? __virt_addr_valid+0x81/0x610\n[  174.854323][ T9784]  ? __phys_addr+0xe8/0x180\n[  174.854330][ T9784]  ? hfsplus_bnode_read+0x2f4/0x360\n[  174.854337][ T9784]  kasan_report+0xc6/0x100\n[  174.854346][ T9784]  ? hfsplus_bnode_read+0x2f4/0x360\n[  174.854354][ T9784]  hfsplus_bnode_read+0x2f4/0x360\n[  174.854362][ T9784]  hfsplus_bnode_dump+0x2ec/0x380\n[  174.854370][ T9784]  ? __pfx_hfsplus_bnode_dump+0x10/0x10\n[  174.854377][ T9784]  ? hfsplus_bnode_write_u16+0x83/0xb0\n[  174.854385][ T9784]  ? srcu_gp_start+0xd0/0x310\n[  174.854393][ T9784]  ? __mark_inode_dirty+0x29e/0xe40\n[  174.854402][ T9784]  hfsplus_brec_remove+0x3d2/0x4e0\n[  174.854411][ T9784]  __hfsplus_delete_attr+0x290/0x3a0\n[  174.854419][ T9784]  ? __pfx_hfs_find_1st_rec_by_cnid+0x10/0x10\n[  174.854427][ T9784]  ? __pfx___hfsplus_delete_attr+0x10/0x10\n[  174.854436][ T9784]  ? __asan_memset+0x23/0x50\n[  174.854450][ T9784]  hfsplus_delete_all_attrs+0x262/0x320\n[  174.854459][ T9784]  ? __pfx_hfsplus_delete_all_attrs+0x10/0x10\n[  174.854469][ T9784]  ? rcu_is_watching+0x12/0xc0\n[  174.854476][ T9784]  ? __mark_inode_dirty+0x29e/0xe40\n[  174.854483][ T9784]  hfsplus_delete_cat+0x845/0xde0\n[  174.854493][ T9784]  ? __pfx_hfsplus_delete_cat+0x10/0x10\n[  174.854507][ T9784]  hfsplus_unlink+0x1ca/0x7c0\n[  174.854516][ T9784]  ? __pfx_hfsplus_unlink+0x10/0x10\n[  174.854525][ T9784]  ? down_write+0x148/0x200\n[  174.854532][ T9784]  ? __pfx_down_write+0x10/0x10\n[  174.854540][ T9784]  vfs_unlink+0x2fe/0x9b0\n[  174.854549][ T9784]  do_unlinkat+0x490/0x670\n[  174.854557][ T9784]  ? __pfx_do_unlinkat+0x10/0x10\n[  174.854565][ T9784]  ? __might_fault+0xbc/0x130\n[  174.854576][ T9784]  ? getname_flags.part.0+0x1c5/0x550\n[  174.854584][ T9784]  __x64_sys_unlink+0xc5/0x110\n[  174.854592][ T9784]  do_syscall_64+0xc9/0x480\n[  174.854600][ T9784]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[  174.854608][ T9784] RIP: 0033:0x7f6fdf4c3167\n[  174.854614][ T9784] Code: f0 ff ff 73 01 c3 48 8b 0d 26 0d 0e 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 08\n[  174.854622][ T9784] RSP: 002b:00007ffcb948bca8 EFLAGS: 00000206 ORIG_RAX: 0000000000000057\n[  174.854630][ T9784] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f6fdf4c3167\n[  174.854636][ T9784] RDX: 00007ffcb948bcc0 RSI: 00007ffcb948bcc0 RDI: 00007ffcb948bd50\n[  174.854641][ T9784] RBP: 00007ffcb948cd90 R08: 0000000000000001 R09: 00007ffcb948bb40\n[  174.854645][ T9784] R10: 00007f6fdf564fc0 R11: 0000000000000206 R12: 0000561e1bc9c2d0\n[  174.854650][ T9784] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\n[  174.854658][ T9784]  \u0026lt;/TASK\u0026gt;\n[  174.854661][ T9784]\n[  174.879281][ T9784] Allocated by task 9784:\n[  174.879664][ T9784]  kasan_save_stack+0x20/0x40\n[  174.880082][ T9784]  kasan_save_track+0x14/0x30\n[  174.880500][ T9784]  __kasan_kmalloc+0xaa/0xb0\n[  174.880908][ T9784]  __kmalloc_noprof+0x205/0x550\n[  174.881337][ T9784]  __hfs_bnode_create+0x107/0x890\n[  174.881779][ T9784]  hfsplus_bnode_find+0x2d0/0xd10\n[  174.882222][ T9784]  hfsplus_brec_find+0x2b0/0x520\n[  174.882659][ T9784]  hfsplus_delete_all_attrs+0x23b/0x3\n---truncated---(CVE-2025-38714)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb3: fix for slab out of bounds on mount to ksmbd\n\nWith KASAN enabled, it is possible to get a slab out of bounds\nduring mount to ksmbd due to missing check in parse_server_interfaces()\n(see below):\n\n BUG: KASAN: slab-out-of-bounds in\n parse_server_interfaces+0x14ee/0x1880 [cifs]\n Read of size 4 at addr ffff8881433dba98 by task mount/9827\n\n CPU: 5 UID: 0 PID: 9827 Comm: mount Tainted: G\n OE       6.16.0-rc2-kasan #2 PREEMPT(voluntary)\n Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\n Hardware name: Dell Inc. Precision Tower 3620/0MWYPT,\n BIOS 2.13.1 06/14/2019\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n dump_stack_lvl+0x9f/0xf0\n print_report+0xd1/0x670\n __virt_addr_valid+0x22c/0x430\n ? parse_server_interfaces+0x14ee/0x1880 [cifs]\n ? kasan_complete_mode_report_info+0x2a/0x1f0\n ? parse_server_interfaces+0x14ee/0x1880 [cifs]\n   kasan_report+0xd6/0x110\n   parse_server_interfaces+0x14ee/0x1880 [cifs]\n   __asan_report_load_n_noabort+0x13/0x20\n   parse_server_interfaces+0x14ee/0x1880 [cifs]\n ? __pfx_parse_server_interfaces+0x10/0x10 [cifs]\n ? trace_hardirqs_on+0x51/0x60\n SMB3_request_interfaces+0x1ad/0x3f0 [cifs]\n ? __pfx_SMB3_request_interfaces+0x10/0x10 [cifs]\n ? SMB2_tcon+0x23c/0x15d0 [cifs]\n smb3_qfs_tcon+0x173/0x2b0 [cifs]\n ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs]\n ? cifs_get_tcon+0x105d/0x2120 [cifs]\n ? do_raw_spin_unlock+0x5d/0x200\n ? cifs_get_tcon+0x105d/0x2120 [cifs]\n ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs]\n cifs_mount_get_tcon+0x369/0xb90 [cifs]\n ? dfs_cache_find+0xe7/0x150 [cifs]\n dfs_mount_share+0x985/0x2970 [cifs]\n ? check_path.constprop.0+0x28/0x50\n ? save_trace+0x54/0x370\n ? __pfx_dfs_mount_share+0x10/0x10 [cifs]\n ? __lock_acquire+0xb82/0x2ba0\n ? __kasan_check_write+0x18/0x20\n cifs_mount+0xbc/0x9e0 [cifs]\n ? __pfx_cifs_mount+0x10/0x10 [cifs]\n ? do_raw_spin_unlock+0x5d/0x200\n ? cifs_setup_cifs_sb+0x29d/0x810 [cifs]\n cifs_smb3_do_mount+0x263/0x1990 [cifs](CVE-2025-38728)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix refcount leak causing resource not released\n\nWhen ksmbd_conn_releasing(opinfo-\u0026gt;conn) returns true,the refcount was not\ndecremented properly, causing a refcount leak that prevents the count from\nreaching zero and the memory from being released.(CVE-2025-39720)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - flush misc workqueue during device shutdown\n\nRepeated loading and unloading of a device specific QAT driver, for\nexample qat_4xxx, in a tight loop can lead to a crash due to a\nuse-after-free scenario. This occurs when a power management (PM)\ninterrupt triggers just before the device-specific driver (e.g.,\nqat_4xxx.ko) is unloaded, while the core driver (intel_qat.ko) remains\nloaded.\n\nSince the driver uses a shared workqueue (`qat_misc_wq`) across all\ndevices and owned by intel_qat.ko, a deferred routine from the\ndevice-specific driver may still be pending in the queue. If this\nroutine executes after the driver is unloaded, it can dereference freed\nmemory, resulting in a page fault and kernel crash like the following:\n\n    BUG: unable to handle page fault for address: ffa000002e50a01c\n    #PF: supervisor read access in kernel mode\n    RIP: 0010:pm_bh_handler+0x1d2/0x250 [intel_qat]\n    Call Trace:\n      pm_bh_handler+0x1d2/0x250 [intel_qat]\n      process_one_work+0x171/0x340\n      worker_thread+0x277/0x3a0\n      kthread+0xf0/0x120\n      ret_from_fork+0x2d/0x50\n\nTo prevent this, flush the misc workqueue during device shutdown to\nensure that all pending work items are completed before the driver is\nunloaded.\n\nNote: This approach may slightly increase shutdown latency if the\nworkqueue contains jobs from other devices, but it ensures correctness\nand stability.(CVE-2025-39721)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Fix filehandle bounds checking in nfs_fh_to_dentry()\n\nThe function needs to check the minimal filehandle length before it can\naccess the embedded filehandle.(CVE-2025-39730)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup()\n\nA soft lockup warning was observed on a relative small system x86-64\nsystem with 16 GB of memory when running a debug kernel with kmemleak\nenabled.\n\n  watchdog: BUG: soft lockup - CPU#8 stuck for 33s! [kworker/8:1:134]\n\nThe test system was running a workload with hot unplug happening in\nparallel.  Then kemleak decided to disable itself due to its inability to\nallocate more kmemleak objects.  The debug kernel has its\nCONFIG_DEBUG_KMEMLEAK_MEM_POOL_SIZE set to 40,000.\n\nThe soft lockup happened in kmemleak_do_cleanup() when the existing\nkmemleak objects were being removed and deleted one-by-one in a loop via a\nworkqueue.  In this particular case, there are at least 40,000 objects\nthat need to be processed and given the slowness of a debug kernel and the\nfact that a raw_spinlock has to be acquired and released in\n__delete_object(), it could take a while to properly handle all these\nobjects.\n\nAs kmemleak has been disabled in this case, the object removal and\ndeletion process can be further optimized as locking isn\u0026apos;t really needed. \nHowever, it is probably not worth the effort to optimize for such an edge\ncase that should rarely happen.  So the simple solution is to call\ncond_resched() at periodic interval in the iteration loop to avoid soft\nlockup.(CVE-2025-39737)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nrcu: Protect -\u0026gt;defer_qs_iw_pending from data race\n\nOn kernels built with CONFIG_IRQ_WORK=y, when rcu_read_unlock() is\ninvoked within an interrupts-disabled region of code [1], it will invoke\nrcu_read_unlock_special(), which uses an irq-work handler to force the\nsystem to notice when the RCU read-side critical section actually ends.\nThat end won\u0026apos;t happen until interrupts are enabled at the soonest.\n\nIn some kernels, such as those booted with rcutree.use_softirq=y, the\nirq-work handler is used unconditionally.\n\nThe per-CPU rcu_data structure\u0026apos;s -\u0026gt;defer_qs_iw_pending field is\nupdated by the irq-work handler and is both read and updated by\nrcu_read_unlock_special().  This resulted in the following KCSAN splat:\n\n------------------------------------------------------------------------\n\nBUG: KCSAN: data-race in rcu_preempt_deferred_qs_handler / rcu_read_unlock_special\n\nread to 0xffff96b95f42d8d8 of 1 bytes by task 90 on cpu 8:\n rcu_read_unlock_special+0x175/0x260\n __rcu_read_unlock+0x92/0xa0\n rt_spin_unlock+0x9b/0xc0\n __local_bh_enable+0x10d/0x170\n __local_bh_enable_ip+0xfb/0x150\n rcu_do_batch+0x595/0xc40\n rcu_cpu_kthread+0x4e9/0x830\n smpboot_thread_fn+0x24d/0x3b0\n kthread+0x3bd/0x410\n ret_from_fork+0x35/0x40\n ret_from_fork_asm+0x1a/0x30\n\nwrite to 0xffff96b95f42d8d8 of 1 bytes by task 88 on cpu 8:\n rcu_preempt_deferred_qs_handler+0x1e/0x30\n irq_work_single+0xaf/0x160\n run_irq_workd+0x91/0xc0\n smpboot_thread_fn+0x24d/0x3b0\n kthread+0x3bd/0x410\n ret_from_fork+0x35/0x40\n ret_from_fork_asm+0x1a/0x30\n\nno locks held by irq_work/8/88.\nirq event stamp: 200272\nhardirqs last  enabled at (200272): [\u0026lt;ffffffffb0f56121\u0026gt;] finish_task_switch+0x131/0x320\nhardirqs last disabled at (200271): [\u0026lt;ffffffffb25c7859\u0026gt;] __schedule+0x129/0xd70\nsoftirqs last  enabled at (0): [\u0026lt;ffffffffb0ee093f\u0026gt;] copy_process+0x4df/0x1cc0\nsoftirqs last disabled at (0): [\u0026lt;0000000000000000\u0026gt;] 0x0\n\n------------------------------------------------------------------------\n\nThe problem is that irq-work handlers run with interrupts enabled, which\nmeans that rcu_preempt_deferred_qs_handler() could be interrupted,\nand that interrupt handler might contain an RCU read-side critical\nsection, which might invoke rcu_read_unlock_special().  In the strict\nKCSAN mode of operation used by RCU, this constitutes a data race on\nthe -\u0026gt;defer_qs_iw_pending field.\n\nThis commit therefore disables interrupts across the portion of the\nrcu_preempt_deferred_qs_handler() that updates the -\u0026gt;defer_qs_iw_pending\nfield.  This suffices because this handler is not a fast path.(CVE-2025-39749)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Fix the setting of capabilities when automounting a new filesystem\n\nCapabilities cannot be inherited when we cross into a new filesystem.\nThey need to be reset to the minimal defaults, and then probed for\nagain.(CVE-2025-39798)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: use array_index_nospec with indices that come from guest\n\nmin and dest_id are guest-controlled indices. Using array_index_nospec()\nafter the bounds checks clamps these values to mitigate speculative execution\nside-channels.(CVE-2025-39823)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\natm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().\n\nsyzbot reported the splat below. [0]\n\nWhen atmtcp_v_open() or atmtcp_v_close() is called via connect()\nor close(), atmtcp_send_control() is called to send an in-kernel\nspecial message.\n\nThe message has ATMTCP_HDR_MAGIC in atmtcp_control.hdr.length.\nAlso, a pointer of struct atm_vcc is set to atmtcp_control.vcc.\n\nThe notable thing is struct atmtcp_control is uAPI but has a\nspace for an in-kernel pointer.\n\n  struct atmtcp_control {\n  \tstruct atmtcp_hdr hdr;\t/* must be first */\n  ...\n  \tatm_kptr_t vcc;\t\t/* both directions */\n  ...\n  } __ATM_API_ALIGN;\n\n  typedef struct { unsigned char _[8]; } __ATM_API_ALIGN atm_kptr_t;\n\nThe special message is processed in atmtcp_recv_control() called\nfrom atmtcp_c_send().\n\natmtcp_c_send() is vcc-\u0026gt;dev-\u0026gt;ops-\u0026gt;send() and called from 2 paths:\n\n  1. .ndo_start_xmit() (vcc-\u0026gt;send() == atm_send_aal0())\n  2. vcc_sendmsg()\n\nThe problem is sendmsg() does not validate the message length and\nuserspace can abuse atmtcp_recv_control() to overwrite any kptr\nby atmtcp_control.\n\nLet\u0026apos;s add a new -\u0026gt;pre_send() hook to validate messages from sendmsg().\n\n[0]:\nOops: general protection fault, probably for non-canonical address 0xdffffc00200000ab: 0000 [#1] SMP KASAN PTI\nKASAN: probably user-memory-access in range [0x0000000100000558-0x000000010000055f]\nCPU: 0 UID: 0 PID: 5865 Comm: syz-executor331 Not tainted 6.17.0-rc1-syzkaller-00215-gbab3ce404553 #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025\nRIP: 0010:atmtcp_recv_control drivers/atm/atmtcp.c:93 [inline]\nRIP: 0010:atmtcp_c_send+0x1da/0x950 drivers/atm/atmtcp.c:297\nCode: 4d 8d 75 1a 4c 89 f0 48 c1 e8 03 42 0f b6 04 20 84 c0 0f 85 15 06 00 00 41 0f b7 1e 4d 8d b7 60 05 00 00 4c 89 f0 48 c1 e8 03 \u0026lt;42\u0026gt; 0f b6 04 20 84 c0 0f 85 13 06 00 00 66 41 89 1e 4d 8d 75 1c 4c\nRSP: 0018:ffffc90003f5f810 EFLAGS: 00010203\nRAX: 00000000200000ab RBX: 0000000000000000 RCX: 0000000000000000\nRDX: ffff88802a510000 RSI: 00000000ffffffff RDI: ffff888030a6068c\nRBP: ffff88802699fb40 R08: ffff888030a606eb R09: 1ffff1100614c0dd\nR10: dffffc0000000000 R11: ffffffff8718fc40 R12: dffffc0000000000\nR13: ffff888030a60680 R14: 000000010000055f R15: 00000000ffffffff\nFS:  00007f8d7e9236c0(0000) GS:ffff888125c1c000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000000000045ad50 CR3: 0000000075bde000 CR4: 00000000003526f0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n vcc_sendmsg+0xa10/0xc60 net/atm/common.c:645\n sock_sendmsg_nosec net/socket.c:714 [inline]\n __sock_sendmsg+0x219/0x270 net/socket.c:729\n ____sys_sendmsg+0x505/0x830 net/socket.c:2614\n ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668\n __sys_sendmsg net/socket.c:2700 [inline]\n __do_sys_sendmsg net/socket.c:2705 [inline]\n __se_sys_sendmsg net/socket.c:2703 [inline]\n __x64_sys_sendmsg+0x19b/0x260 net/socket.c:2703\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f8d7e96a4a9\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f8d7e923198 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\nRAX: ffffffffffffffda RBX: 00007f8d7e9f4308 RCX: 00007f8d7e96a4a9\nRDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000005\nRBP: 00007f8d7e9f4300 R08: 65732f636f72702f R09: 65732f636f72702f\nR10: 65732f636f72702f R11: 0000000000000246 R12: 00007f8d7e9c10ac\nR13: 00007f8d7e9231a0 R14: 0000200000000200 R15: 0000200000000250\n \u0026lt;/TASK\u0026gt;\nModules linked in:(CVE-2025-39828)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncifs: prevent NULL pointer dereference in UTF16 conversion\n\nThere can be a NULL pointer dereference bug here. NULL is passed to\n__cifs_sfu_make_node without checks, which passes it unchecked to\ncifs_strndup_to_utf16, which in turn passes it to\ncifs_local_to_utf16_bytes where \u0026apos;*from\u0026apos; is dereferenced, causing a crash.\n\nThis patch adds a check for NULL \u0026apos;src\u0026apos; in cifs_strndup_to_utf16 and\nreturns NULL early to prevent dereferencing NULL pointer.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE(CVE-2025-39838)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: fix OOB read/write in network-coding decode\n\nbatadv_nc_skb_decode_packet() trusts coded_len and checks only against\nskb-\u0026gt;len. XOR starts at sizeof(struct batadv_unicast_packet), reducing\npayload headroom, and the source skb length is not verified, allowing an\nout-of-bounds read and a small out-of-bounds write.\n\nValidate that coded_len fits within the payload area of both destination\nand source sk_buffs before XORing.(CVE-2025-39839)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix race condition validating r_parent before applying state\n\nAdd validation to ensure the cached parent directory inode matches the\ndirectory info in MDS replies. This prevents client-side race conditions\nwhere concurrent operations (e.g. rename) cause r_parent to become stale\nbetween request initiation and reply processing, which could lead to\napplying state changes to incorrect directory inodes.\n\n[ idryomov: folded a kerneldoc fixup and a follow-up fix from Alex to\n  move CEPH_CAP_PIN reference when r_parent is updated:\n\n  When the parent directory lock is not held, req-\u0026gt;r_parent can become\n  stale and is updated to point to the correct inode.  However, the\n  associated CEPH_CAP_PIN reference was not being adjusted.  The\n  CEPH_CAP_PIN is a reference on an inode that is tracked for\n  accounting purposes.  Moving this pin is important to keep the\n  accounting balanced. When the pin was not moved from the old parent\n  to the new one, it created two problems: The reference on the old,\n  stale parent was never released, causing a reference leak.\n  A reference for the new parent was never acquired, creating the risk\n  of a reference underflow later in ceph_mdsc_release_request().  This\n  patch corrects the logic by releasing the pin from the old parent and\n  acquiring it for the new parent when r_parent is switched.  This\n  ensures reference accounting stays balanced. ](CVE-2025-39927)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path\n\nDuring tests of another unrelated patch I was able to trigger this\nerror: Objects remaining on __kmem_cache_shutdown()(CVE-2025-39929)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\num: virtio_uml: Fix use-after-free after put_device in probe\n\nWhen register_virtio_device() fails in virtio_uml_probe(),\nthe code sets vu_dev-\u0026gt;registered = 1 even though\nthe device was not successfully registered.\nThis can lead to use-after-free or other issues.(CVE-2025-39951)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_qfq: Fix null-deref in agg_dequeue\n\nTo prevent a potential crash in agg_dequeue (net/sched/sch_qfq.c)\nwhen cl-\u0026gt;qdisc-\u0026gt;ops-\u0026gt;peek(cl-\u0026gt;qdisc) returns NULL, we check the return\nvalue before using it, similar to the existing approach in sch_hfsc.c.\n\nTo avoid code duplication, the following changes are made:\n\n1. Changed qdisc_warn_nonwc(include/net/pkt_sched.h) into a static\ninline function.\n\n2. Moved qdisc_peek_len from net/sched/sch_hfsc.c to\ninclude/net/pkt_sched.h so that sch_qfq can reuse it.\n\n3. Applied qdisc_peek_len in agg_dequeue to avoid crashing.(CVE-2025-40083)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Define a proc_layoutcommit for the FlexFiles layout type\n\nAvoid a crash if a pNFS client should happen to send a LAYOUTCOMMIT\noperation on a FlexFiles layout.(CVE-2025-40087)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncifs: parse_dfs_referrals: prevent oob on malformed input\n\nMalicious SMB server can send invalid reply to FSCTL_DFS_GET_REFERRALS\n\n- reply smaller than sizeof(struct get_dfs_referral_rsp)\n- reply with number of referrals smaller than NumberOfReferrals in the\nheader\n\nProcessing of such replies will cause oob.\n\nReturn -EINVAL error on such replies to prevent oob-s.(CVE-2025-40099)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: Fix refcount leak for cifs_sb_tlink\n\nFix three refcount inconsistency issues related to `cifs_sb_tlink`.\n\nComments for `cifs_sb_tlink` state that `cifs_put_tlink()` needs to be\ncalled after successful calls to `cifs_sb_tlink()`. Three calls fail to\nupdate refcount accordingly, leading to possible resource leaks.(CVE-2025-40103)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvfs: Don\u0026apos;t leak disconnected dentries on umount\n\nWhen user calls open_by_handle_at() on some inode that is not cached, we\nwill create disconnected dentry for it. If such dentry is a directory,\nexportfs_decode_fh_raw() will then try to connect this dentry to the\ndentry tree through reconnect_path(). It may happen for various reasons\n(such as corrupted fs or race with rename) that the call to\nlookup_one_unlocked() in reconnect_one() will fail to find the dentry we\nare trying to reconnect and instead create a new dentry under the\nparent. Now this dentry will not be marked as disconnected although the\nparent still may well be disconnected (at least in case this\ninconsistency happened because the fs is corrupted and .. doesn\u0026apos;t point\nto the real parent directory). This creates inconsistency in\ndisconnected flags but AFAICS it was mostly harmless. At least until\ncommit f1ee616214cb (\u0026quot;VFS: don\u0026apos;t keep disconnected dentries on d_anon\u0026quot;)\nwhich removed adding of most disconnected dentries to sb-\u0026gt;s_anon list.\nThus after this commit cleanup of disconnected dentries implicitely\nrelies on the fact that dput() will immediately reclaim such dentries.\nHowever when some leaf dentry isn\u0026apos;t marked as disconnected, as in the\nscenario described above, the reclaim doesn\u0026apos;t happen and the dentries\nare \u0026quot;leaked\u0026quot;. Memory reclaim can eventually reclaim them but otherwise\nthey stay in memory and if umount comes first, we hit infamous \u0026quot;Busy\ninodes after unmount\u0026quot; bug. Make sure all dentries created under a\ndisconnected parent are marked as disconnected as well.(CVE-2025-40105)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Fix Use-after-free in validation\n\nNodes stored in the validation duplicates hashtable come from an arena\nallocator that is cleared at the end of vmw_execbuf_process. All nodes\nare expected to be cleared in vmw_validation_drop_ht but this node escaped\nbecause its resource was destroyed prematurely.(CVE-2025-40111)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Clean up only new IRQ glue on request_irq() failure\n\nThe mlx5_irq_alloc() function can inadvertently free the entire rmap\nand end up in a crash[1] when the other threads tries to access this,\nwhen request_irq() fails due to exhausted IRQ vectors. This commit\nmodifies the cleanup to remove only the specific IRQ mapping that was\njust added.\n\nThis prevents removal of other valid mappings and ensures precise\ncleanup of the failed IRQ allocation\u0026apos;s associated glue object.\n\nNote: This error is observed when both fwctl and rds configs are enabled.\n\n[1]\nmlx5_core 0000:05:00.0: Successfully registered panic handler for port 1\nmlx5_core 0000:05:00.0: mlx5_irq_alloc:293:(pid 66740): Failed to\nrequest irq. err = -28\ninfiniband mlx5_0: mlx5_ib_test_wc:290:(pid 66740): Error -28 while\ntrying to test write-combining support\nmlx5_core 0000:05:00.0: Successfully unregistered panic handler for port 1\nmlx5_core 0000:06:00.0: Successfully registered panic handler for port 1\nmlx5_core 0000:06:00.0: mlx5_irq_alloc:293:(pid 66740): Failed to\nrequest irq. err = -28\ninfiniband mlx5_0: mlx5_ib_test_wc:290:(pid 66740): Error -28 while\ntrying to test write-combining support\nmlx5_core 0000:06:00.0: Successfully unregistered panic handler for port 1\nmlx5_core 0000:03:00.0: mlx5_irq_alloc:293:(pid 28895): Failed to\nrequest irq. err = -28\nmlx5_core 0000:05:00.0: mlx5_irq_alloc:293:(pid 28895): Failed to\nrequest irq. err = -28\ngeneral protection fault, probably for non-canonical address\n0xe277a58fde16f291: 0000 [#1] SMP NOPTI\n\nRIP: 0010:free_irq_cpu_rmap+0x23/0x7d\nCall Trace:\n   \u0026lt;TASK\u0026gt;\n   ? show_trace_log_lvl+0x1d6/0x2f9\n   ? show_trace_log_lvl+0x1d6/0x2f9\n   ? mlx5_irq_alloc.cold+0x5d/0xf3 [mlx5_core]\n   ? __die_body.cold+0x8/0xa\n   ? die_addr+0x39/0x53\n   ? exc_general_protection+0x1c4/0x3e9\n   ? dev_vprintk_emit+0x5f/0x90\n   ? asm_exc_general_protection+0x22/0x27\n   ? free_irq_cpu_rmap+0x23/0x7d\n   mlx5_irq_alloc.cold+0x5d/0xf3 [mlx5_core]\n   irq_pool_request_vector+0x7d/0x90 [mlx5_core]\n   mlx5_irq_request+0x2e/0xe0 [mlx5_core]\n   mlx5_irq_request_vector+0xad/0xf7 [mlx5_core]\n   comp_irq_request_pci+0x64/0xf0 [mlx5_core]\n   create_comp_eq+0x71/0x385 [mlx5_core]\n   ? mlx5e_open_xdpsq+0x11c/0x230 [mlx5_core]\n   mlx5_comp_eqn_get+0x72/0x90 [mlx5_core]\n   ? xas_load+0x8/0x91\n   mlx5_comp_irqn_get+0x40/0x90 [mlx5_core]\n   mlx5e_open_channel+0x7d/0x3c7 [mlx5_core]\n   mlx5e_open_channels+0xad/0x250 [mlx5_core]\n   mlx5e_open_locked+0x3e/0x110 [mlx5_core]\n   mlx5e_open+0x23/0x70 [mlx5_core]\n   __dev_open+0xf1/0x1a5\n   __dev_change_flags+0x1e1/0x249\n   dev_change_flags+0x21/0x5c\n   do_setlink+0x28b/0xcc4\n   ? __nla_parse+0x22/0x3d\n   ? inet6_validate_link_af+0x6b/0x108\n   ? cpumask_next+0x1f/0x35\n   ? __snmp6_fill_stats64.constprop.0+0x66/0x107\n   ? __nla_validate_parse+0x48/0x1e6\n   __rtnl_newlink+0x5ff/0xa57\n   ? kmem_cache_alloc_trace+0x164/0x2ce\n   rtnl_newlink+0x44/0x6e\n   rtnetlink_rcv_msg+0x2bb/0x362\n   ? __netlink_sendskb+0x4c/0x6c\n   ? netlink_unicast+0x28f/0x2ce\n   ? rtnl_calcit.isra.0+0x150/0x146\n   netlink_rcv_skb+0x5f/0x112\n   netlink_unicast+0x213/0x2ce\n   netlink_sendmsg+0x24f/0x4d9\n   __sock_sendmsg+0x65/0x6a\n   ____sys_sendmsg+0x28f/0x2c9\n   ? import_iovec+0x17/0x2b\n   ___sys_sendmsg+0x97/0xe0\n   __sys_sendmsg+0x81/0xd8\n   do_syscall_64+0x35/0x87\n   entry_SYSCALL_64_after_hwframe+0x6e/0x0\nRIP: 0033:0x7fc328603727\nCode: c3 66 90 41 54 41 89 d4 55 48 89 f5 53 89 fb 48 83 ec 10 e8 0b ed\nff ff 44 89 e2 48 89 ee 89 df 41 89 c0 b8 2e 00 00 00 0f 05 \u0026lt;48\u0026gt; 3d 00\nf0 ff ff 77 35 44 89 c7 48 89 44 24 08 e8 44 ed ff ff 48\nRSP: 002b:00007ffe8eb3f1a0 EFLAGS: 00000293 ORIG_RAX: 000000000000002e\nRAX: ffffffffffffffda RBX: 000000000000000d RCX: 00007fc328603727\nRDX: 0000000000000000 RSI: 00007ffe8eb3f1f0 RDI: 000000000000000d\nRBP: 00007ffe8eb3f1f0 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000\nR13: 00000000000\n---truncated---(CVE-2025-40250)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()\n\nThe loops in \u0026apos;qede_tpa_cont()\u0026apos; and \u0026apos;qede_tpa_end()\u0026apos;, iterate\nover \u0026apos;cqe-\u0026gt;len_list[]\u0026apos; using only a zero-length terminator as\nthe stopping condition. If the terminator was missing or\nmalformed, the loop could run past the end of the fixed-size array.\n\nAdd an explicit bound check using ARRAY_SIZE() in both loops to prevent\na potential out-of-bounds access.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2025-40252)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: sg: Do not sleep in atomic context\n\nsg_finish_rem_req() calls blk_rq_unmap_user(). The latter function may\nsleep. Hence, call sg_finish_rem_req() with interrupts enabled instead\nof disabled.(CVE-2025-40259)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvme: nvme-fc: Ensure -\u0026gt;ioerr_work is cancelled in nvme_fc_delete_ctrl()\n\nnvme_fc_delete_assocation() waits for pending I/O to complete before\nreturning, and an error can cause -\u0026gt;ioerr_work to be queued after\ncancel_work_sync() had been called.  Move the call to cancel_work_sync() to\nbe after nvme_fc_delete_association() to ensure -\u0026gt;ioerr_work is not running\nwhen the nvme_fc_ctrl object is freed.  Otherwise the following can occur:\n\n[ 1135.911754] list_del corruption, ff2d24c8093f31f8-\u0026gt;next is NULL\n[ 1135.917705] ------------[ cut here ]------------\n[ 1135.922336] kernel BUG at lib/list_debug.c:52!\n[ 1135.926784] Oops: invalid opcode: 0000 [#1] SMP NOPTI\n[ 1135.931851] CPU: 48 UID: 0 PID: 726 Comm: kworker/u449:23 Kdump: loaded Not tainted 6.12.0 #1 PREEMPT(voluntary)\n[ 1135.943490] Hardware name: Dell Inc. PowerEdge R660/0HGTK9, BIOS 2.5.4 01/16/2025\n[ 1135.950969] Workqueue:  0x0 (nvme-wq)\n[ 1135.954673] RIP: 0010:__list_del_entry_valid_or_report.cold+0xf/0x6f\n[ 1135.961041] Code: c7 c7 98 68 72 94 e8 26 45 fe ff 0f 0b 48 c7 c7 70 68 72 94 e8 18 45 fe ff 0f 0b 48 89 fe 48 c7 c7 80 69 72 94 e8 07 45 fe ff \u0026lt;0f\u0026gt; 0b 48 89 d1 48 c7 c7 a0 6a 72 94 48 89 c2 e8 f3 44 fe ff 0f 0b\n[ 1135.979788] RSP: 0018:ff579b19482d3e50 EFLAGS: 00010046\n[ 1135.985015] RAX: 0000000000000033 RBX: ff2d24c8093f31f0 RCX: 0000000000000000\n[ 1135.992148] RDX: 0000000000000000 RSI: ff2d24d6bfa1d0c0 RDI: ff2d24d6bfa1d0c0\n[ 1135.999278] RBP: ff2d24c8093f31f8 R08: 0000000000000000 R09: ffffffff951e2b08\n[ 1136.006413] R10: ffffffff95122ac8 R11: 0000000000000003 R12: ff2d24c78697c100\n[ 1136.013546] R13: fffffffffffffff8 R14: 0000000000000000 R15: ff2d24c78697c0c0\n[ 1136.020677] FS:  0000000000000000(0000) GS:ff2d24d6bfa00000(0000) knlGS:0000000000000000\n[ 1136.028765] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 1136.034510] CR2: 00007fd207f90b80 CR3: 000000163ea22003 CR4: 0000000000f73ef0\n[ 1136.041641] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[ 1136.048776] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400\n[ 1136.055910] PKRU: 55555554\n[ 1136.058623] Call Trace:\n[ 1136.061074]  \u0026lt;TASK\u0026gt;\n[ 1136.063179]  ? show_trace_log_lvl+0x1b0/0x2f0\n[ 1136.067540]  ? show_trace_log_lvl+0x1b0/0x2f0\n[ 1136.071898]  ? move_linked_works+0x4a/0xa0\n[ 1136.075998]  ? __list_del_entry_valid_or_report.cold+0xf/0x6f\n[ 1136.081744]  ? __die_body.cold+0x8/0x12\n[ 1136.085584]  ? die+0x2e/0x50\n[ 1136.088469]  ? do_trap+0xca/0x110\n[ 1136.091789]  ? do_error_trap+0x65/0x80\n[ 1136.095543]  ? __list_del_entry_valid_or_report.cold+0xf/0x6f\n[ 1136.101289]  ? exc_invalid_op+0x50/0x70\n[ 1136.105127]  ? __list_del_entry_valid_or_report.cold+0xf/0x6f\n[ 1136.110874]  ? asm_exc_invalid_op+0x1a/0x20\n[ 1136.115059]  ? __list_del_entry_valid_or_report.cold+0xf/0x6f\n[ 1136.120806]  move_linked_works+0x4a/0xa0\n[ 1136.124733]  worker_thread+0x216/0x3a0\n[ 1136.128485]  ? __pfx_worker_thread+0x10/0x10\n[ 1136.132758]  kthread+0xfa/0x240\n[ 1136.135904]  ? __pfx_kthread+0x10/0x10\n[ 1136.139657]  ret_from_fork+0x31/0x50\n[ 1136.143236]  ? __pfx_kthread+0x10/0x10\n[ 1136.146988]  ret_from_fork_asm+0x1a/0x30\n[ 1136.150915]  \u0026lt;/TASK\u0026gt;(CVE-2025-40261)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbe2net: pass wrb_params in case of OS2BMC\n\nbe_insert_vlan_in_pkt() is called with the wrb_params argument being NULL\nat be_send_pkt_to_bmc() call site.  This may lead to dereferencing a NULL\npointer when processing a workaround for specific packet, as commit\nbc0c3405abbb (\u0026quot;be2net: fix a Tx stall bug caused by a specific ipv6\npacket\u0026quot;) states.\n\nThe correct way would be to pass the wrb_params from be_xmit().(CVE-2025-40264)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncifs: client: fix memory leak in smb3_fs_context_parse_param\n\nThe user calls fsconfig twice, but when the program exits, free() only\nfrees ctx-\u0026gt;source for the second fsconfig, not the first.\nRegarding fc-\u0026gt;source, there is no code in the fs context related to its\nmemory reclamation.\n\nTo fix this memory leak, release the source memory corresponding to ctx\nor fc before each parsing.\n\nsyzbot reported:\nBUG: memory leak\nunreferenced object 0xffff888128afa360 (size 96):\n  backtrace (crc 79c9c7ba):\n    kstrdup+0x3c/0x80 mm/util.c:84\n    smb3_fs_context_parse_param+0x229b/0x36c0 fs/smb/client/fs_context.c:1444\n\nBUG: memory leak\nunreferenced object 0xffff888112c7d900 (size 96):\n  backtrace (crc 79c9c7ba):\n    smb3_fs_context_fullpath+0x70/0x1b0 fs/smb/client/fs_context.c:629\n    smb3_fs_context_parse_param+0x2266/0x36c0 fs/smb/client/fs_context.c:1438(CVE-2025-40268)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: free copynotify stateid in nfs4_free_ol_stateid()\n\nTypically copynotify stateid is freed either when parent\u0026apos;s stateid\nis being close/freed or in nfsd4_laundromat if the stateid hasn\u0026apos;t\nbeen used in a lease period.\n\nHowever, in case when the server got an OPEN (which created\na parent stateid), followed by a COPY_NOTIFY using that stateid,\nfollowed by a client reboot. New client instance while doing\nCREATE_SESSION would force expire previous state of this client.\nIt leads to the open state being freed thru release_openowner-\u0026gt;\nnfs4_free_ol_stateid() and it finds that it still has copynotify\nstateid associated with it. We currently print a warning and is\ntriggerred\n\nWARNING: CPU: 1 PID: 8858 at fs/nfsd/nfs4state.c:1550 nfs4_free_ol_stateid+0xb0/0x100 [nfsd]\n\nThis patch, instead, frees the associated copynotify stateid here.\n\nIf the parent stateid is freed (without freeing the copynotify\nstateids associated with it), it leads to the list corruption\nwhen laundromat ends up freeing the copynotify state later.\n\n[ 1626.839430] Internal error: Oops - BUG: 00000000f2000800 [#1]  SMP\n[ 1626.842828] Modules linked in: nfnetlink_queue nfnetlink_log bluetooth cfg80211 rpcrdma rdma_cm iw_cm ib_cm ib_core nfsd nfs_acl lockd grace nfs_localio ext4 crc16 mbcache jbd2 overlay uinput snd_seq_dummy snd_hrtimer qrtr rfkill vfat fat uvcvideo snd_hda_codec_generic videobuf2_vmalloc videobuf2_memops snd_hda_intel uvc snd_intel_dspcfg videobuf2_v4l2 videobuf2_common snd_hda_codec snd_hda_core videodev snd_hwdep snd_seq mc snd_seq_device snd_pcm snd_timer snd soundcore sg loop auth_rpcgss vsock_loopback vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport vmw_vmci vsock xfs 8021q garp stp llc mrp nvme ghash_ce e1000e nvme_core sr_mod nvme_keyring nvme_auth cdrom vmwgfx drm_ttm_helper ttm sunrpc dm_mirror dm_region_hash dm_log iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi fuse dm_multipath dm_mod nfnetlink\n[ 1626.855594] CPU: 2 UID: 0 PID: 199 Comm: kworker/u24:33 Kdump: loaded Tainted: G    B   W           6.17.0-rc7+ #22 PREEMPT(voluntary)\n[ 1626.857075] Tainted: [B]=BAD_PAGE, [W]=WARN\n[ 1626.857573] Hardware name: VMware, Inc. VMware20,1/VBSA, BIOS VMW201.00V.24006586.BA64.2406042154 06/04/2024\n[ 1626.858724] Workqueue: nfsd4 laundromat_main [nfsd]\n[ 1626.859304] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\n[ 1626.860010] pc : __list_del_entry_valid_or_report+0x148/0x200\n[ 1626.860601] lr : __list_del_entry_valid_or_report+0x148/0x200\n[ 1626.861182] sp : ffff8000881d7a40\n[ 1626.861521] x29: ffff8000881d7a40 x28: 0000000000000018 x27: ffff0000c2a98200\n[ 1626.862260] x26: 0000000000000600 x25: 0000000000000000 x24: ffff8000881d7b20\n[ 1626.862986] x23: ffff0000c2a981e8 x22: 1fffe00012410e7d x21: ffff0000920873e8\n[ 1626.863701] x20: ffff0000920873e8 x19: ffff000086f22998 x18: 0000000000000000\n[ 1626.864421] x17: 20747562202c3839 x16: 3932326636383030 x15: 3030666666662065\n[ 1626.865092] x14: 6220646c756f6873 x13: 0000000000000001 x12: ffff60004fd9e4a3\n[ 1626.865713] x11: 1fffe0004fd9e4a2 x10: ffff60004fd9e4a2 x9 : dfff800000000000\n[ 1626.866320] x8 : 00009fffb0261b5e x7 : ffff00027ecf2513 x6 : 0000000000000001\n[ 1626.866938] x5 : ffff00027ecf2510 x4 : ffff60004fd9e4a3 x3 : 0000000000000000\n[ 1626.867553] x2 : 0000000000000000 x1 : ffff000096069640 x0 : 000000000000006d\n[ 1626.868167] Call trace:\n[ 1626.868382]  __list_del_entry_valid_or_report+0x148/0x200 (P)\n[ 1626.868876]  _free_cpntf_state_locked+0xd0/0x268 [nfsd]\n[ 1626.869368]  nfs4_laundromat+0x6f8/0x1058 [nfsd]\n[ 1626.869813]  laundromat_main+0x24/0x60 [nfsd]\n[ 1626.870231]  process_one_work+0x584/0x1050\n[ 1626.870595]  worker_thread+0x4c4/0xc60\n[ 1626.870893]  kthread+0x2f8/0x398\n[ 1626.871146]  ret_from_fork+0x10/0x20\n[ 1626.871422] Code: aa1303e1 aa1403e3 910e8000 97bc55d7 (d4210000)\n[ 1626.871892] SMP: stopping secondary CPUs(CVE-2025-40273)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: cancel mesh send timer when hdev removed\n\nmesh_send_done timer is not canceled when hdev is removed, which causes\ncrash if the timer triggers after hdev is gone.\n\nCancel the timer when MGMT removes the hdev, like other MGMT timers.\n\nShould fix the BUG: sporadically seen by BlueZ test bot\n(in \u0026quot;Mesh - Send cancel - 1\u0026quot; test).\n\nLog:\n------\nBUG: KASAN: slab-use-after-free in run_timer_softirq+0x76b/0x7d0\n...\nFreed by task 36:\n kasan_save_stack+0x24/0x50\n kasan_save_track+0x14/0x30\n __kasan_save_free_info+0x3a/0x60\n __kasan_slab_free+0x43/0x70\n kfree+0x103/0x500\n device_release+0x9a/0x210\n kobject_put+0x100/0x1e0\n vhci_release+0x18b/0x240\n------(CVE-2025-40284)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds\n\nAdd bounds checking to prevent writes past framebuffer boundaries when\nrendering text near screen edges. Return early if the Y position is off-screen\nand clip image height to screen boundary. Break from the rendering loop if the\nX position is off-screen. When clipping image width to fit the screen, update\nthe character count to match the clipped width to prevent buffer size\nmismatches.\n\nWithout the character count update, bit_putcs_aligned and bit_putcs_unaligned\nreceive mismatched parameters where the buffer is allocated for the clipped\nwidth but cnt reflects the original larger count, causing out-of-bounds writes.(CVE-2025-40304)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\naccel/habanalabs: support mapping cb with vmalloc-backed coherent memory\n\nWhen IOMMU is enabled, dma_alloc_coherent() with GFP_USER may return\naddresses from the vmalloc range. If such an address is mapped without\nVM_MIXEDMAP, vm_insert_page() will trigger a BUG_ON due to the\nVM_PFNMAP restriction.\n\nFix this by checking for vmalloc addresses and setting VM_MIXEDMAP\nin the VMA before mapping. This ensures safe mapping and avoids kernel\ncrashes. The memory is still driver-allocated and cannot be accessed\ndirectly by userspace.(CVE-2025-40311)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget\n\nIn the __cdnsp_gadget_init() and cdnsp_gadget_exit() functions, the gadget\nstructure (pdev-\u0026gt;gadget) was freed before its endpoints.\nThe endpoints are linked via the ep_list in the gadget structure.\nFreeing the gadget first leaves dangling pointers in the endpoint list.\nWhen the endpoints are subsequently freed, this results in a use-after-free.\n\nFix:\nBy separating the usb_del_gadget_udc() operation into distinct \u0026quot;del\u0026quot; and\n\u0026quot;put\u0026quot; steps, cdnsp_gadget_free_endpoints() can be executed prior to the\nfinal release of the gadget structure with usb_put_gadget().\n\nA patch similar to bb9c74a5bd14(\u0026quot;usb: dwc3: gadget: Free gadget structure\n only after freeing endpoints\u0026quot;).(CVE-2025-40314)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Sync pending IRQ work before freeing ring buffer\n\nFix a race where irq_work can be queued in bpf_ringbuf_commit()\nbut the ring buffer is freed before the work executes.\nIn the syzbot reproducer, a BPF program attached to sched_switch\ntriggers bpf_ringbuf_commit(), queuing an irq_work. If the ring buffer\nis freed before this work executes, the irq_work thread may accesses\nfreed memory.\nCalling `irq_work_sync(\u0026amp;rb-\u0026gt;work)` ensures that all pending irq_work\ncomplete before freeing the buffer.(CVE-2025-40319)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix potential cfid UAF in smb2_query_info_compound\n\nWhen smb2_query_info_compound() retries, a previously allocated cfid may\nhave been freed in the first attempt.\nBecause cfid wasn\u0026apos;t reset on replay, later cleanup could act on a stale\npointer, leading to a potential use-after-free.\n\nReinitialize cfid to NULL under the replay label.\n\nExample trace (trimmed):\n\nrefcount_t: underflow; use-after-free.\nWARNING: CPU: 1 PID: 11224 at ../lib/refcount.c:28 refcount_warn_saturate+0x9c/0x110\n[...]\nRIP: 0010:refcount_warn_saturate+0x9c/0x110\n[...]\nCall Trace:\n \u0026lt;TASK\u0026gt;\n smb2_query_info_compound+0x29c/0x5c0 [cifs f90b72658819bd21c94769b6a652029a07a7172f]\n ? step_into+0x10d/0x690\n ? __legitimize_path+0x28/0x60\n smb2_queryfs+0x6a/0xf0 [cifs f90b72658819bd21c94769b6a652029a07a7172f]\n smb311_queryfs+0x12d/0x140 [cifs f90b72658819bd21c94769b6a652029a07a7172f]\n ? kmem_cache_alloc+0x18a/0x340\n ? getname_flags+0x46/0x1e0\n cifs_statfs+0x9f/0x2b0 [cifs f90b72658819bd21c94769b6a652029a07a7172f]\n statfs_by_dentry+0x67/0x90\n vfs_statfs+0x16/0xd0\n user_statfs+0x54/0xa0\n __do_sys_statfs+0x20/0x50\n do_syscall_64+0x58/0x80(CVE-2025-40320)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: bitblit: bound-check glyph index in bit_putcs*\n\nbit_putcs_aligned()/unaligned() derived the glyph pointer from the\ncharacter value masked by 0xff/0x1ff, which may exceed the actual font\u0026apos;s\nglyph count and read past the end of the built-in font array.\nClamp the index to the actual glyph count before computing the address.\n\nThis fixes a global out-of-bounds read reported by syzbot.(CVE-2025-40322)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Fix crash in nfsd4_read_release()\n\nWhen tracing is enabled, the trace_nfsd_read_done trace point\ncrashes during the pynfs read.testNoFh test.(CVE-2025-40324)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix potential UAF in smb2_close_cached_fid()\n\nfind_or_create_cached_dir() could grab a new reference after kref_put()\nhad seen the refcount drop to zero but before cfid_list_lock is acquired\nin smb2_close_cached_fid(), leading to use-after-free.\n\nSwitch to kref_put_lock() so cfid_release() is called with\ncfid_list_lock held, closing that gap.(CVE-2025-40328)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: storage: sddr55: Reject out-of-bound new_pba\n\nDiscovered by Atuin - Automated Vulnerability Discovery Engine.\n\nnew_pba comes from the status packet returned after each write.\nA bogus device could report values beyond the block count derived\nfrom info-\u0026gt;capacity, letting the driver walk off the end of\npba_to_lba[] and corrupt heap memory.\n\nReject PBAs that exceed the computed block count and fail the\ntransfer so we avoid touching out-of-range mapping entries.(CVE-2025-40345)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ\n\nXDP programs can change the layout of an xdp_buff through\nbpf_xdp_adjust_tail() and bpf_xdp_adjust_head(). Therefore, the driver\ncannot assume the size of the linear data area nor fragments. Fix the\nbug in mlx5 by generating skb according to xdp_buff after XDP programs\nrun.\n\nCurrently, when handling multi-buf XDP, the mlx5 driver assumes the\nlayout of an xdp_buff to be unchanged. That is, the linear data area\ncontinues to be empty and fragments remain the same. This may cause\nthe driver to generate erroneous skb or triggering a kernel\nwarning. When an XDP program added linear data through\nbpf_xdp_adjust_head(), the linear data will be ignored as\nmlx5e_build_linear_skb() builds an skb without linear data and then\npull data from fragments to fill the linear data area. When an XDP\nprogram has shrunk the non-linear data through bpf_xdp_adjust_tail(),\nthe delta passed to __pskb_pull_tail() may exceed the actual nonlinear\ndata size and trigger the BUG_ON in it.\n\nTo fix the issue, first record the original number of fragments. If the\nnumber of fragments changes after the XDP program runs, rewind the end\nfragment pointer by the difference and recalculate the truesize. Then,\nbuild the skb with the linear data area matching the xdp_buff. Finally,\nonly pull data in if there is non-linear data and fill the linear part\nup to 256 bytes.(CVE-2025-40350)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/sysfb: Do not dereference NULL pointer in plane reset\n\nThe plane state in __drm_gem_reset_shadow_plane() can be NULL. Do not\nderef that pointer, but forward NULL to the other plane-reset helpers.\nClears plane-\u0026gt;state to NULL.\n\nv2:\n- fix typo in commit description (Javier)(CVE-2025-40360)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: fix field-spanning memcpy warning in AH output\n\nFix field-spanning memcpy warnings in ah6_output() and\nah6_output_done() where extension headers are copied to/from IPv6\naddress fields, triggering fortify-string warnings about writes beyond\nthe 16-byte address fields.\n\n  memcpy: detected field-spanning write (size 40) of single field \u0026quot;\u0026amp;top_iph-\u0026gt;saddr\u0026quot; at net/ipv6/ah6.c:439 (size 16)\n  WARNING: CPU: 0 PID: 8838 at net/ipv6/ah6.c:439 ah6_output+0xe7e/0x14e0 net/ipv6/ah6.c:439\n\nThe warnings are false positives as the extension headers are\nintentionally placed after the IPv6 header in memory. Fix by properly\ncopying addresses and extension headers separately, and introduce\nhelper functions to avoid code duplication.(CVE-2025-40363)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nblk-cgroup: fix possible deadlock while configuring policy\n\nFollowing deadlock can be triggered easily by lockdep:\n\nWARNING: possible circular locking dependency detected\n6.17.0-rc3-00124-ga12c2658ced0 #1665 Not tainted\n------------------------------------------------------\ncheck/1334 is trying to acquire lock:\nff1100011d9d0678 (\u0026amp;q-\u0026gt;sysfs_lock){+.+.}-{4:4}, at: blk_unregister_queue+0x53/0x180\n\nbut task is already holding lock:\nff1100011d9d00e0 (\u0026amp;q-\u0026gt;q_usage_counter(queue)#3){++++}-{0:0}, at: del_gendisk+0xba/0x110\n\nwhich lock already depends on the new lock.\n\nthe existing dependency chain (in reverse order) is:\n\n-\u0026gt; #2 (\u0026amp;q-\u0026gt;q_usage_counter(queue)#3){++++}-{0:0}:\n       blk_queue_enter+0x40b/0x470\n       blkg_conf_prep+0x7b/0x3c0\n       tg_set_limit+0x10a/0x3e0\n       cgroup_file_write+0xc6/0x420\n       kernfs_fop_write_iter+0x189/0x280\n       vfs_write+0x256/0x490\n       ksys_write+0x83/0x190\n       __x64_sys_write+0x21/0x30\n       x64_sys_call+0x4608/0x4630\n       do_syscall_64+0xdb/0x6b0\n       entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\n-\u0026gt; #1 (\u0026amp;q-\u0026gt;rq_qos_mutex){+.+.}-{4:4}:\n       __mutex_lock+0xd8/0xf50\n       mutex_lock_nested+0x2b/0x40\n       wbt_init+0x17e/0x280\n       wbt_enable_default+0xe9/0x140\n       blk_register_queue+0x1da/0x2e0\n       __add_disk+0x38c/0x5d0\n       add_disk_fwnode+0x89/0x250\n       device_add_disk+0x18/0x30\n       virtblk_probe+0x13a3/0x1800\n       virtio_dev_probe+0x389/0x610\n       really_probe+0x136/0x620\n       __driver_probe_device+0xb3/0x230\n       driver_probe_device+0x2f/0xe0\n       __driver_attach+0x158/0x250\n       bus_for_each_dev+0xa9/0x130\n       driver_attach+0x26/0x40\n       bus_add_driver+0x178/0x3d0\n       driver_register+0x7d/0x1c0\n       __register_virtio_driver+0x2c/0x60\n       virtio_blk_init+0x6f/0xe0\n       do_one_initcall+0x94/0x540\n       kernel_init_freeable+0x56a/0x7b0\n       kernel_init+0x2b/0x270\n       ret_from_fork+0x268/0x4c0\n       ret_from_fork_asm+0x1a/0x30\n\n-\u0026gt; #0 (\u0026amp;q-\u0026gt;sysfs_lock){+.+.}-{4:4}:\n       __lock_acquire+0x1835/0x2940\n       lock_acquire+0xf9/0x450\n       __mutex_lock+0xd8/0xf50\n       mutex_lock_nested+0x2b/0x40\n       blk_unregister_queue+0x53/0x180\n       __del_gendisk+0x226/0x690\n       del_gendisk+0xba/0x110\n       sd_remove+0x49/0xb0 [sd_mod]\n       device_remove+0x87/0xb0\n       device_release_driver_internal+0x11e/0x230\n       device_release_driver+0x1a/0x30\n       bus_remove_device+0x14d/0x220\n       device_del+0x1e1/0x5a0\n       __scsi_remove_device+0x1ff/0x2f0\n       scsi_remove_device+0x37/0x60\n       sdev_store_delete+0x77/0x100\n       dev_attr_store+0x1f/0x40\n       sysfs_kf_write+0x65/0x90\n       kernfs_fop_write_iter+0x189/0x280\n       vfs_write+0x256/0x490\n       ksys_write+0x83/0x190\n       __x64_sys_write+0x21/0x30\n       x64_sys_call+0x4608/0x4630\n       do_syscall_64+0xdb/0x6b0\n       entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nother info that might help us debug this:\n\nChain exists of:\n  \u0026amp;q-\u0026gt;sysfs_lock --\u0026gt; \u0026amp;q-\u0026gt;rq_qos_mutex --\u0026gt; \u0026amp;q-\u0026gt;q_usage_counter(queue)#3\n\n Possible unsafe locking scenario:\n\n       CPU0                    CPU1\n       ----                    ----\n  lock(\u0026amp;q-\u0026gt;q_usage_counter(queue)#3);\n                               lock(\u0026amp;q-\u0026gt;rq_qos_mutex);\n                               lock(\u0026amp;q-\u0026gt;q_usage_counter(queue)#3);\n  lock(\u0026amp;q-\u0026gt;sysfs_lock);\n\nRoot cause is that queue_usage_counter is grabbed with rq_qos_mutex\nheld in blkg_conf_prep(), while queue should be freezed before\nrq_qos_mutex from other context.\n\nThe blk_queue_enter() from blkg_conf_prep() is used to protect against\npolicy deactivation, which is already protected with blkcg_mutex, hence\nconvert blk_queue_enter() to blkcg_mutex to fix this problem. Meanwhile,\nconsider that blkcg_mutex is held after queue is freezed from policy\ndeactivation, also convert blkg_alloc() to use GFP_NOIO.(CVE-2025-68178)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/mediatek: Disable AFBC support on Mediatek DRM driver\n\nCommit c410fa9b07c3 (\u0026quot;drm/mediatek: Add AFBC support to Mediatek DRM\ndriver\u0026quot;) added AFBC support to Mediatek DRM and enabled the\n32x8/split/sparse modifier.\n\nHowever, this is currently broken on Mediatek MT8188 (Genio 700 EVK\nplatform); tested using upstream Kernel and Mesa (v25.2.1), AFBC is used by\ndefault since Mesa v25.0.\n\nKernel trace reports vblank timeouts constantly, and the render is garbled:\n\n```\n[CRTC:62:crtc-0] vblank wait timed out\nWARNING: CPU: 7 PID: 70 at drivers/gpu/drm/drm_atomic_helper.c:1835 drm_atomic_helper_wait_for_vblanks.part.0+0x24c/0x27c\n[...]\nHardware name: MediaTek Genio-700 EVK (DT)\nWorkqueue: events_unbound commit_work\npstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : drm_atomic_helper_wait_for_vblanks.part.0+0x24c/0x27c\nlr : drm_atomic_helper_wait_for_vblanks.part.0+0x24c/0x27c\nsp : ffff80008337bca0\nx29: ffff80008337bcd0 x28: 0000000000000061 x27: 0000000000000000\nx26: 0000000000000001 x25: 0000000000000000 x24: ffff0000c9dcc000\nx23: 0000000000000001 x22: 0000000000000000 x21: ffff0000c66f2f80\nx20: ffff0000c0d7d880 x19: 0000000000000000 x18: 000000000000000a\nx17: 000000040044ffff x16: 005000f2b5503510 x15: 0000000000000000\nx14: 0000000000000000 x13: 74756f2064656d69 x12: 742074696177206b\nx11: 0000000000000058 x10: 0000000000000018 x9 : ffff800082396a70\nx8 : 0000000000057fa8 x7 : 0000000000000cce x6 : ffff8000823eea70\nx5 : ffff0001fef5f408 x4 : ffff80017ccee000 x3 : ffff0000c12cb480\nx2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000c12cb480\nCall trace:\n drm_atomic_helper_wait_for_vblanks.part.0+0x24c/0x27c (P)\n drm_atomic_helper_commit_tail_rpm+0x64/0x80\n commit_tail+0xa4/0x1a4\n commit_work+0x14/0x20\n process_one_work+0x150/0x290\n worker_thread+0x2d0/0x3ec\n kthread+0x12c/0x210\n ret_from_fork+0x10/0x20\n---[ end trace 0000000000000000 ]---\n```\n\nUntil this gets fixed upstream, disable AFBC support on this platform, as\nit\u0026apos;s currently broken with upstream Mesa.(CVE-2025-68184)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnfs4_setup_readdir(): insufficient locking for -\u0026gt;d_parent-\u0026gt;d_inode dereferencing\n\nTheoretically it\u0026apos;s an oopsable race, but I don\u0026apos;t believe one can manage\nto hit it on real hardware; might become doable on a KVM, but it still\nwon\u0026apos;t be easy to attack.\n\nAnyway, it\u0026apos;s easy to deal with - since xdr_encode_hyper() is just a call of\nput_unaligned_be64(), we can put that under -\u0026gt;d_lock and be done with that.(CVE-2025-68185)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nudp_tunnel: use netdev_warn() instead of netdev_WARN()\n\nnetdev_WARN() uses WARN/WARN_ON to print a backtrace along with\nfile and line information. In this case, udp_tunnel_nic_register()\nreturning an error is just a failed operation, not a kernel bug.\n\nudp_tunnel_nic_register() can fail due to a memory allocation\nfailure (kzalloc() or udp_tunnel_nic_alloc()).\nThis is a normal runtime error and not a kernel bug.\n\nReplace netdev_WARN() with netdev_warn() accordingly.(CVE-2025-68191)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvme-multipath: fix lockdep WARN due to partition scan work\n\nBlktests test cases nvme/014, 057 and 058 fail occasionally due to a\nlockdep WARN. As reported in the Closes tag URL, the WARN indicates that\na deadlock can happen due to the dependency among disk-\u0026gt;open_mutex,\nkblockd workqueue completion and partition_scan_work completion.\n\nTo avoid the lockdep WARN and the potential deadlock, cut the dependency\nby running the partition_scan_work not by kblockd workqueue but by\nnvme_wq.(CVE-2025-68218)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncifs: fix memory leak in smb3_fs_context_parse_param error path\n\nAdd proper cleanup of ctx-\u0026gt;source and fc-\u0026gt;source to the\ncifs_parse_mount_err error handler. This ensures that memory allocated\nfor the source strings is correctly freed on all error paths, matching\nthe cleanup already performed in the success path by\nsmb3_cleanup_fs_context_contents().\nPointers are also set to NULL after freeing to prevent potential\ndouble-free issues.\n\nThis change fixes a memory leak originally detected by syzbot. The\nleak occurred when processing Opt_source mount options if an error\nhappened after ctx-\u0026gt;source and fc-\u0026gt;source were successfully\nallocated but before the function completed.\n\nThe specific leak sequence was:\n1. ctx-\u0026gt;source = smb3_fs_context_fullpath(ctx, \u0026apos;/\u0026apos;) allocates memory\n2. fc-\u0026gt;source = kstrdup(ctx-\u0026gt;source, GFP_KERNEL) allocates more memory\n3. A subsequent error jumps to cifs_parse_mount_err\n4. The old error handler freed passwords but not the source strings,\ncausing the memory to leak.\n\nThis issue was not addressed by commit e8c73eb7db0a (\u0026quot;cifs: client:\nfix memory leak in smb3_fs_context_parse_param\u0026quot;), which only fixed\nleaks from repeated fsconfig() calls but not this error path.\n\nPatch updated with minor change suggested by kernel test robot(CVE-2025-68219)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show()\n\nIf the allocation of tl_hba-\u0026gt;sh fails in tcm_loop_driver_probe() and we\nattempt to dereference it in tcm_loop_tpg_address_show() we will get a\nsegfault, see below for an example. So, check tl_hba-\u0026gt;sh before\ndereferencing it.\n\n  Unable to allocate struct scsi_host\n  BUG: kernel NULL pointer dereference, address: 0000000000000194\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  PGD 0 P4D 0\n  Oops: 0000 [#1] PREEMPT SMP NOPTI\n  CPU: 1 PID: 8356 Comm: tokio-runtime-w Not tainted 6.6.104.2-4.azl3 #1\n  Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 09/28/2024\n  RIP: 0010:tcm_loop_tpg_address_show+0x2e/0x50 [tcm_loop]\n...\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   configfs_read_iter+0x12d/0x1d0 [configfs]\n   vfs_read+0x1b5/0x300\n   ksys_read+0x6f/0xf0\n...(CVE-2025-68229)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbinfmt_misc: restore write access before closing files opened by open_exec()\n\nbm_register_write() opens an executable file using open_exec(), which\ninternally calls do_open_execat() and denies write access on the file to\navoid modification while it is being executed.\n\nHowever, when an error occurs, bm_register_write() closes the file using\nfilp_close() directly. This does not restore the write permission, which\nmay cause subsequent write operations on the same file to fail.\n\nFix this by calling exe_file_allow_write_access() before filp_close() to\nrestore the write permission properly.(CVE-2025-68239)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe\n\nThe sit driver\u0026apos;s packet transmission path calls: sit_tunnel_xmit() -\u0026gt;\nupdate_or_create_fnhe(), which lead to fnhe_remove_oldest() being called\nto delete entries exceeding FNHE_RECLAIM_DEPTH+random.\n\nThe race window is between fnhe_remove_oldest() selecting fnheX for\ndeletion and the subsequent kfree_rcu(). During this time, the\nconcurrent path\u0026apos;s __mkroute_output() -\u0026gt; find_exception() can fetch the\nsoon-to-be-deleted fnheX, and rt_bind_exception() then binds it with a\nnew dst using a dst_hold(). When the original fnheX is freed via RCU,\nthe dst reference remains permanently leaked.\n\nCPU 0                             CPU 1\n__mkroute_output()\n  find_exception() [fnheX]\n                                  update_or_create_fnhe()\n                                    fnhe_remove_oldest() [fnheX]\n  rt_bind_exception() [bind dst]\n                                  RCU callback [fnheX freed, dst leak]\n\nThis issue manifests as a device reference count leak and a warning in\ndmesg when unregistering the net device:\n\n  unregister_netdevice: waiting for sitX to become free. Usage count = N\n\nIdo Schimmel provided the simple test validation method [1].\n\nThe fix clears \u0026apos;oldest-\u0026gt;fnhe_daddr\u0026apos; before calling fnhe_flush_routes().\nSince rt_bind_exception() checks this field, setting it to zero prevents\nthe stale fnhe from being reused and bound to a new dst just before it\nis freed.\n\n[1]\nip netns add ns1\nip -n ns1 link set dev lo up\nip -n ns1 address add 192.0.2.1/32 dev lo\nip -n ns1 link add name dummy1 up type dummy\nip -n ns1 route add 192.0.2.2/32 dev dummy1\nip -n ns1 link add name gretap1 up arp off type gretap \\\n    local 192.0.2.1 remote 192.0.2.2\nip -n ns1 route add 198.51.0.0/16 dev gretap1\ntaskset -c 0 ip netns exec ns1 mausezahn gretap1 \\\n    -A 198.51.100.1 -B 198.51.0.0/16 -t udp -p 1000 -c 0 -q \u0026amp;\ntaskset -c 2 ip netns exec ns1 mausezahn gretap1 \\\n    -A 198.51.100.1 -B 198.51.0.0/16 -t udp -p 1000 -c 0 -q \u0026amp;\nsleep 10\nip netns pids ns1 | xargs kill\nip netns del ns1(CVE-2025-68241)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: netpoll: fix incorrect refcount handling causing incorrect cleanup\n\ncommit efa95b01da18 (\u0026quot;netpoll: fix use after free\u0026quot;) incorrectly\nignored the refcount and prematurely set dev-\u0026gt;npinfo to NULL during\nnetpoll cleanup, leading to improper behavior and memory leaks.\n\nScenario causing lack of proper cleanup:\n\n1) A netpoll is associated with a NIC (e.g., eth0) and netdev-\u0026gt;npinfo is\n   allocated, and refcnt = 1\n   - Keep in mind that npinfo is shared among all netpoll instances. In\n     this case, there is just one.\n\n2) Another netpoll is also associated with the same NIC and\n   npinfo-\u0026gt;refcnt += 1.\n   - Now dev-\u0026gt;npinfo-\u0026gt;refcnt = 2;\n   - There is just one npinfo associated to the netdev.\n\n3) When the first netpolls goes to clean up:\n   - The first cleanup succeeds and clears np-\u0026gt;dev-\u0026gt;npinfo, ignoring\n     refcnt.\n     - It basically calls `RCU_INIT_POINTER(np-\u0026gt;dev-\u0026gt;npinfo, NULL);`\n   - Set dev-\u0026gt;npinfo = NULL, without proper cleanup\n   - No -\u0026gt;ndo_netpoll_cleanup() is either called\n\n4) Now the second target tries to clean up\n   - The second cleanup fails because np-\u0026gt;dev-\u0026gt;npinfo is already NULL.\n     * In this case, ops-\u0026gt;ndo_netpoll_cleanup() was never called, and\n       the skb pool is not cleaned as well (for the second netpoll\n       instance)\n  - This leaks npinfo and skbpool skbs, which is clearly reported by\n    kmemleak.\n\nRevert commit efa95b01da18 (\u0026quot;netpoll: fix use after free\u0026quot;) and adds\nclarifying comments emphasizing that npinfo cleanup should only happen\nonce the refcount reaches zero, ensuring stable and correct netpoll\nbehavior.(CVE-2025-68245)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nerofs: avoid infinite loops due to corrupted subpage compact indexes\n\nRobert reported an infinite loop observed by two crafted images.\n\nThe root cause is that `clusterofs` can be larger than `lclustersize`\nfor !NONHEAD `lclusters` in corrupted subpage compact indexes, e.g.:\n\n  blocksize = lclustersize = 512   lcn = 6   clusterofs = 515\n\nMove the corresponding check for full compress indexes to\n`z_erofs_load_lcluster_from_disk()` to also cover subpage compact\ncompress indexes.\n\nIt also fixes the position of `m-\u0026gt;type \u0026gt;= Z_EROFS_LCLUSTER_TYPE_MAX`\ncheck, since it should be placed right after\n`z_erofs_load_{compact,full}_lcluster()`.(CVE-2025-68251)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: storage: Fix memory leak in USB bulk transport\n\nA kernel memory leak was identified by the \u0026apos;ioctl_sg01\u0026apos; test from Linux\nTest Project (LTP). The following bytes were mainly observed: 0x53425355.\n\nWhen USB storage devices incorrectly skip the data phase with status data,\nthe code extracts/validates the CSW from the sg buffer, but fails to clear\nit afterwards. This leaves status protocol data in srb\u0026apos;s transfer buffer,\nsuch as the US_BULK_CS_SIGN \u0026apos;USBS\u0026apos; signature observed here. Thus, this can\nlead to USB protocols leaks to user space through SCSI generic (/dev/sg*)\ninterfaces, such as the one seen here when the LTP test requested 512 KiB.\n\nFix the leak by zeroing the CSW data in srb\u0026apos;s transfer buffer immediately\nafter the validation of devices that skip data phase.\n\nNote: Differently from CVE-2018-1000204, which fixed a big leak by zero-\ning pages at allocation time, this leak occurs after allocation, when USB\nprotocol data is written to already-allocated sg pages.(CVE-2025-68288)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix memory leak in cifs_construct_tcon()\n\nWhen having a multiuser mount with domain= specified and using\ncifscreds, cifs_set_cifscreds() will end up setting @ctx-\u0026gt;domainname,\nso it needs to be freed before leaving cifs_construct_tcon().\n\nThis fixes the following memory leak reported by kmemleak:\n\n  mount.cifs //srv/share /mnt -o domain=ZELDA,multiuser,...\n  su - testuser\n  cifscreds add -d ZELDA -u testuser\n  ...\n  ls /mnt/1\n  ...\n  umount /mnt\n  echo scan \u0026gt; /sys/kernel/debug/kmemleak\n  cat /sys/kernel/debug/kmemleak\n  unreferenced object 0xffff8881203c3f08 (size 8):\n    comm \u0026quot;ls\u0026quot;, pid 5060, jiffies 4307222943\n    hex dump (first 8 bytes):\n      5a 45 4c 44 41 00 cc cc                          ZELDA...\n    backtrace (crc d109a8cf):\n      __kmalloc_node_track_caller_noprof+0x572/0x710\n      kstrdup+0x3a/0x70\n      cifs_sb_tlink+0x1209/0x1770 [cifs]\n      cifs_get_fattr+0xe1/0xf50 [cifs]\n      cifs_get_inode_info+0xb5/0x240 [cifs]\n      cifs_revalidate_dentry_attr+0x2d1/0x470 [cifs]\n      cifs_getattr+0x28e/0x450 [cifs]\n      vfs_getattr_nosec+0x126/0x180\n      vfs_statx+0xf6/0x220\n      do_statx+0xab/0x110\n      __x64_sys_statx+0xd5/0x130\n      do_syscall_64+0xbb/0x380\n      entry_SYSCALL_64_after_hwframe+0x77/0x7f(CVE-2025-68295)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup\n\nProtect vga_switcheroo_client_fb_set() with console lock. Avoids OOB\naccess in fbcon_remap_all(). Without holding the console lock the call\nraces with switching outputs.\n\nVGA switcheroo calls fbcon_remap_all() when switching clients. The fbcon\nfunction uses struct fb_info.node, which is set by register_framebuffer().\nAs the fb-helper code currently sets up VGA switcheroo before registering\nthe framebuffer, the value of node is -1 and therefore not a legal value.\nFor example, fbcon uses the value within set_con2fb_map() [1] as an index\ninto an array.\n\nMoving vga_switcheroo_client_fb_set() after register_framebuffer() can\nresult in VGA switching that does not switch fbcon correctly.\n\nTherefore move vga_switcheroo_client_fb_set() under fbcon_fb_registered(),\nwhich already holds the console lock. Fbdev calls fbcon_fb_registered()\nfrom within register_framebuffer(). Serializes the helper with VGA\nswitcheroo\u0026apos;s call to fbcon_remap_all().\n\nAlthough vga_switcheroo_client_fb_set() takes an instance of struct fb_info\nas parameter, it really only needs the contained fbcon state. Moving the\ncall to fbcon initialization is therefore cleaner than before. Only amdgpu,\ni915, nouveau and radeon support vga_switcheroo. For all other drivers,\nthis change does nothing.(CVE-2025-68296)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sock: Prevent race in socket write iter and sock bind\n\nThere is a potential race condition between sock bind and socket write\niter. bind may free the same cmd via mgmt_pending before write iter sends\nthe cmd, just as syzbot reported in UAF[1].\n\nHere we use hci_dev_lock to synchronize the two, thereby avoiding the\nUAF mentioned in [1].\n\n[1]\nsyzbot reported:\nBUG: KASAN: slab-use-after-free in mgmt_pending_remove+0x3b/0x210 net/bluetooth/mgmt_util.c:316\nRead of size 8 at addr ffff888077164818 by task syz.0.17/5989\nCall Trace:\n mgmt_pending_remove+0x3b/0x210 net/bluetooth/mgmt_util.c:316\n set_link_security+0x5c2/0x710 net/bluetooth/mgmt.c:1918\n hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719\n hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839\n sock_sendmsg_nosec net/socket.c:727 [inline]\n __sock_sendmsg+0x21c/0x270 net/socket.c:742\n sock_write_iter+0x279/0x360 net/socket.c:1195\n\nAllocated by task 5989:\n mgmt_pending_add+0x35/0x140 net/bluetooth/mgmt_util.c:296\n set_link_security+0x557/0x710 net/bluetooth/mgmt.c:1910\n hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719\n hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839\n sock_sendmsg_nosec net/socket.c:727 [inline]\n __sock_sendmsg+0x21c/0x270 net/socket.c:742\n sock_write_iter+0x279/0x360 net/socket.c:1195\n\nFreed by task 5991:\n mgmt_pending_free net/bluetooth/mgmt_util.c:311 [inline]\n mgmt_pending_foreach+0x30d/0x380 net/bluetooth/mgmt_util.c:257\n mgmt_index_removed+0x112/0x2f0 net/bluetooth/mgmt.c:9477\n hci_sock_bind+0xbe9/0x1000 net/bluetooth/hci_sock.c:1314(CVE-2025-68305)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ns390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump\n\nDo not block PCI config accesses through pci_cfg_access_lock() when\nexecuting the s390 variant of PCI error recovery: Acquire just\ndevice_lock() instead of pci_dev_lock() as powerpc\u0026apos;s EEH and\ngenerig PCI AER processing do.\n\nDuring error recovery testing a pair of tasks was reported to be hung:\n\nmlx5_core 0000:00:00.1: mlx5_health_try_recover:338:(pid 5553): health recovery flow aborted, PCI reads still not working\nINFO: task kmcheck:72 blocked for more than 122 seconds.\n      Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1\n\u0026quot;echo 0 \u0026gt; /proc/sys/kernel/hung_task_timeout_secs\u0026quot; disables this message.\ntask:kmcheck         state:D stack:0     pid:72    tgid:72    ppid:2      flags:0x00000000\nCall Trace:\n [\u0026lt;000000065256f030\u0026gt;] __schedule+0x2a0/0x590\n [\u0026lt;000000065256f356\u0026gt;] schedule+0x36/0xe0\n [\u0026lt;000000065256f572\u0026gt;] schedule_preempt_disabled+0x22/0x30\n [\u0026lt;0000000652570a94\u0026gt;] __mutex_lock.constprop.0+0x484/0x8a8\n [\u0026lt;000003ff800673a4\u0026gt;] mlx5_unload_one+0x34/0x58 [mlx5_core]\n [\u0026lt;000003ff8006745c\u0026gt;] mlx5_pci_err_detected+0x94/0x140 [mlx5_core]\n [\u0026lt;0000000652556c5a\u0026gt;] zpci_event_attempt_error_recovery+0xf2/0x398\n [\u0026lt;0000000651b9184a\u0026gt;] __zpci_event_error+0x23a/0x2c0\nINFO: task kworker/u1664:6:1514 blocked for more than 122 seconds.\n      Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1\n\u0026quot;echo 0 \u0026gt; /proc/sys/kernel/hung_task_timeout_secs\u0026quot; disables this message.\ntask:kworker/u1664:6 state:D stack:0     pid:1514  tgid:1514  ppid:2      flags:0x00000000\nWorkqueue: mlx5_health0000:00:00.0 mlx5_fw_fatal_reporter_err_work [mlx5_core]\nCall Trace:\n [\u0026lt;000000065256f030\u0026gt;] __schedule+0x2a0/0x590\n [\u0026lt;000000065256f356\u0026gt;] schedule+0x36/0xe0\n [\u0026lt;0000000652172e28\u0026gt;] pci_wait_cfg+0x80/0xe8\n [\u0026lt;0000000652172f94\u0026gt;] pci_cfg_access_lock+0x74/0x88\n [\u0026lt;000003ff800916b6\u0026gt;] mlx5_vsc_gw_lock+0x36/0x178 [mlx5_core]\n [\u0026lt;000003ff80098824\u0026gt;] mlx5_crdump_collect+0x34/0x1c8 [mlx5_core]\n [\u0026lt;000003ff80074b62\u0026gt;] mlx5_fw_fatal_reporter_dump+0x6a/0xe8 [mlx5_core]\n [\u0026lt;0000000652512242\u0026gt;] devlink_health_do_dump.part.0+0x82/0x168\n [\u0026lt;0000000652513212\u0026gt;] devlink_health_report+0x19a/0x230\n [\u0026lt;000003ff80075a12\u0026gt;] mlx5_fw_fatal_reporter_err_work+0xba/0x1b0 [mlx5_core]\n\nNo kernel log of the exact same error with an upstream kernel is\navailable - but the very same deadlock situation can be constructed there,\ntoo:\n\n- task: kmcheck\n  mlx5_unload_one() tries to acquire devlink lock while the PCI error\n  recovery code has set pdev-\u0026gt;block_cfg_access by way of\n  pci_cfg_access_lock()\n- task: kworker\n  mlx5_crdump_collect() tries to set block_cfg_access through\n  pci_cfg_access_lock() while devlink_health_report() had acquired\n  the devlink lock.\n\nA similar deadlock situation can be reproduced by requesting a\ncrdump with\n  \u0026gt; devlink health dump show pci/\u0026lt;BDF\u0026gt; reporter fw_fatal\n\nwhile PCI error recovery is executed on the same \u0026lt;BDF\u0026gt; physical function\nby mlx5_core\u0026apos;s pci_error_handlers. On s390 this can be injected with\n  \u0026gt; zpcictl --reset-fw \u0026lt;BDF\u0026gt;\n\nTests with this patch failed to reproduce that second deadlock situation,\nthe devlink command is rejected with \u0026quot;kernel answers: Permission denied\u0026quot; -\nand we get a kernel log message of:\n\nmlx5_core 1ed0:00:00.1: mlx5_crdump_collect:50:(pid 254382): crdump: failed to lock vsc gw err -5\n\nbecause the config read of VSC_SEMAPHORE is rejected by the underlying\nhardware.\n\nTwo prior attempts to address this issue have been discussed and\nultimately rejected [see link], with the primary argument that s390\u0026apos;s\nimplementation of PCI error recovery is imposing restrictions that\nneither powerpc\u0026apos;s EEH nor PCI AER handling need. Tests show that PCI\nerror recovery on s390 is running to completion even without blocking\naccess to PCI config space.(CVE-2025-68310)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusbnet: Prevents free active kevent\n\nThe root cause of this issue are:\n1. When probing the usbnet device, executing usbnet_link_change(dev, 0, 0);\nput the kevent work in global workqueue. However, the kevent has not yet\nbeen scheduled when the usbnet device is unregistered. Therefore, executing\nfree_netdev() results in the \u0026quot;free active object (kevent)\u0026quot; error reported\nhere.\n\n2. Another factor is that when calling usbnet_disconnect()-\u0026gt;unregister_netdev(),\nif the usbnet device is up, ndo_stop() is executed to cancel the kevent.\nHowever, because the device is not up, ndo_stop() is not executed.\n\nThe solution to this problem is to cancel the kevent before executing\nfree_netdev().(CVE-2025-68312)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnbd: defer config unlock in nbd_genl_connect\n\nThere is one use-after-free warning when running NBD_CMD_CONNECT and\nNBD_CLEAR_SOCK:\n\nnbd_genl_connect\n  nbd_alloc_and_init_config // config_refs=1\n  nbd_start_device // config_refs=2\n  set NBD_RT_HAS_CONFIG_REF\t\t\topen nbd // config_refs=3\n  recv_work done // config_refs=2\n\t\t\t\t\t\tNBD_CLEAR_SOCK // config_refs=1\n\t\t\t\t\t\tclose nbd // config_refs=0\n  refcount_inc -\u0026gt; uaf\n\n------------[ cut here ]------------\nrefcount_t: addition on 0; use-after-free.\nWARNING: CPU: 24 PID: 1014 at lib/refcount.c:25 refcount_warn_saturate+0x12e/0x290\n nbd_genl_connect+0x16d0/0x1ab0\n genl_family_rcv_msg_doit+0x1f3/0x310\n genl_rcv_msg+0x44a/0x790\n\nThe issue can be easily reproduced by adding a small delay before\nrefcount_inc(\u0026amp;nbd-\u0026gt;config_refs) in nbd_genl_connect():\n\n        mutex_unlock(\u0026amp;nbd-\u0026gt;config_lock);\n        if (!ret) {\n                set_bit(NBD_RT_HAS_CONFIG_REF, \u0026amp;config-\u0026gt;runtime_flags);\n+               printk(\u0026quot;before sleep\\n\u0026quot;);\n+               mdelay(5 * 1000);\n+               printk(\u0026quot;after sleep\\n\u0026quot;);\n                refcount_inc(\u0026amp;nbd-\u0026gt;config_refs);\n                nbd_connect_reply(info, nbd-\u0026gt;index);\n        }(CVE-2025-68366)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmacintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse\n\nThe following warning appears when running syzkaller, and this issue also\nexists in the mainline code.\n\n ------------[ cut here ]------------\n list_add double add: new=ffffffffa57eee28, prev=ffffffffa57eee28, next=ffffffffa5e63100.\n WARNING: CPU: 0 PID: 1491 at lib/list_debug.c:35 __list_add_valid_or_report+0xf7/0x130\n Modules linked in:\n CPU: 0 PID: 1491 Comm: syz.1.28 Not tainted 6.6.0+ #3\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\n RIP: 0010:__list_add_valid_or_report+0xf7/0x130\n RSP: 0018:ff1100010dfb7b78 EFLAGS: 00010282\n RAX: 0000000000000000 RBX: ffffffffa57eee18 RCX: ffffffff97fc9817\n RDX: 0000000000040000 RSI: ffa0000002383000 RDI: 0000000000000001\n RBP: ffffffffa57eee28 R08: 0000000000000001 R09: ffe21c0021bf6f2c\n R10: 0000000000000001 R11: 6464615f7473696c R12: ffffffffa5e63100\n R13: ffffffffa57eee28 R14: ffffffffa57eee28 R15: ff1100010dfb7d48\n FS:  00007fb14398b640(0000) GS:ff11000119600000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 0000000000000000 CR3: 000000010d096005 CR4: 0000000000773ef0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n PKRU: 80000000\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  input_register_handler+0xb3/0x210\n  mac_hid_start_emulation+0x1c5/0x290\n  mac_hid_toggle_emumouse+0x20a/0x240\n  proc_sys_call_handler+0x4c2/0x6e0\n  new_sync_write+0x1b1/0x2d0\n  vfs_write+0x709/0x950\n  ksys_write+0x12a/0x250\n  do_syscall_64+0x5a/0x110\n  entry_SYSCALL_64_after_hwframe+0x78/0xe2\n\nThe WARNING occurs when two processes concurrently write to the mac-hid\nemulation sysctl, causing a race condition in mac_hid_toggle_emumouse().\nBoth processes read old_val=0, then both try to register the input handler,\nleading to a double list_add of the same handler.\n\n  CPU0                             CPU1\n  -------------------------        -------------------------\n  vfs_write() //write 1            vfs_write()  //write 1\n    proc_sys_write()                 proc_sys_write()\n      mac_hid_toggle_emumouse()          mac_hid_toggle_emumouse()\n        old_val = *valp // old_val=0\n                                           old_val = *valp // old_val=0\n                                           mutex_lock_killable()\n                                           proc_dointvec() // *valp=1\n                                           mac_hid_start_emulation()\n                                             input_register_handler()\n                                           mutex_unlock()\n        mutex_lock_killable()\n        proc_dointvec()\n        mac_hid_start_emulation()\n          input_register_handler() //Trigger Warning\n        mutex_unlock()\n\nFix this by moving the old_val read inside the mutex lock region.(CVE-2025-68367)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: smartpqi: Fix device resources accessed after device removal\n\nCorrect possible race conditions during device removal.\n\nPreviously, a scheduled work item to reset a LUN could still execute\nafter the device was removed, leading to use-after-free and other\nresource access issues.\n\nThis race condition occurs because the abort handler may schedule a LUN\nreset concurrently with device removal via sdev_destroy(), leading to\nuse-after-free and improper access to freed resources.\n\n  - Check in the device reset handler if the device is still present in\n    the controller\u0026apos;s SCSI device list before running; if not, the reset\n    is skipped.\n\n  - Cancel any pending TMF work that has not started in sdev_destroy().\n\n  - Ensure device freeing in sdev_destroy() is done while holding the\n    LUN reset mutex to avoid races with ongoing resets.(CVE-2025-68371)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnbd: defer config put in recv_work\n\nThere is one uaf issue in recv_work when running NBD_CLEAR_SOCK and\nNBD_CMD_RECONFIGURE:\n  nbd_genl_connect     // conf_ref=2 (connect and recv_work A)\n  nbd_open\t       // conf_ref=3\n  recv_work A done     // conf_ref=2\n  NBD_CLEAR_SOCK       // conf_ref=1\n  nbd_genl_reconfigure // conf_ref=2 (trigger recv_work B)\n  close nbd\t       // conf_ref=1\n  recv_work B\n    config_put         // conf_ref=0\n    atomic_dec(\u0026amp;config-\u0026gt;recv_threads); -\u0026gt; UAF\n\nOr only running NBD_CLEAR_SOCK:\n  nbd_genl_connect   // conf_ref=2\n  nbd_open \t     // conf_ref=3\n  NBD_CLEAR_SOCK     // conf_ref=2\n  close nbd\n    nbd_release\n      config_put     // conf_ref=1\n  recv_work\n    config_put \t     // conf_ref=0\n    atomic_dec(\u0026amp;config-\u0026gt;recv_threads); -\u0026gt; UAF\n\nCommit 87aac3a80af5 (\u0026quot;nbd: call nbd_config_put() before notifying the\nwaiter\u0026quot;) moved nbd_config_put() to run before waking up the waiter in\nrecv_work, in order to ensure that nbd_start_device_ioctl() would not\nbe woken up while nbd-\u0026gt;task_recv was still uncleared.\n\nHowever, in nbd_start_device_ioctl(), after being woken up it explicitly\ncalls flush_workqueue() to make sure all current works are finished.\nTherefore, there is no need to move the config put ahead of the wakeup.\n\nMove nbd_config_put() to the end of recv_work, so that the reference is\nheld for the whole lifetime of the worker thread. This makes sure the\nconfig cannot be freed while recv_work is still running, even if clear\n+ reconfigure interleave.\n\nIn addition, we don\u0026apos;t need to worry about recv_work dropping the last\nnbd_put (which causes deadlock):\n\npath A (netlink with NBD_CFLAG_DESTROY_ON_DISCONNECT):\n  connect  // nbd_refs=1 (trigger recv_work)\n  open nbd // nbd_refs=2\n  NBD_CLEAR_SOCK\n  close nbd\n    nbd_release\n      nbd_disconnect_and_put\n        flush_workqueue // recv_work done\n      nbd_config_put\n        nbd_put // nbd_refs=1\n      nbd_put // nbd_refs=0\n        queue_work\n\npath B (netlink without NBD_CFLAG_DESTROY_ON_DISCONNECT):\n  connect  // nbd_refs=2 (trigger recv_work)\n  open nbd // nbd_refs=3\n  NBD_CLEAR_SOCK // conf_refs=2\n  close nbd\n    nbd_release\n      nbd_config_put // conf_refs=1\n      nbd_put // nbd_refs=2\n  recv_work done // conf_refs=0, nbd_refs=1\n  rmmod // nbd_refs=0\n\nDepends-on: e2daec488c57 (\u0026quot;nbd: Fix hungtask when nbd_config_put\u0026quot;)(CVE-2025-68372)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmd: fix rcu protection in md_wakeup_thread\n\nWe attempted to use RCU to protect the pointer \u0026apos;thread\u0026apos;, but directly\npassed the value when calling md_wakeup_thread(). This means that the\nRCU pointer has been acquired before rcu_read_lock(), which renders\nrcu_read_lock() ineffective and could lead to a use-after-free.(CVE-2025-68374)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix null deref on srq-\u0026gt;rq.queue after resize failure\n\nA NULL pointer dereference can occur in rxe_srq_chk_attr() when\nibv_modify_srq() is invoked twice in succession under certain error\nconditions. The first call may fail in rxe_queue_resize(), which leads\nrxe_srq_from_attr() to set srq-\u0026gt;rq.queue = NULL. The second call then\ntriggers a crash (null deref) when accessing\nsrq-\u0026gt;rq.queue-\u0026gt;buf-\u0026gt;index_mask.\n\nCall Trace:\n\u0026lt;TASK\u0026gt;\nrxe_modify_srq+0x170/0x480 [rdma_rxe]\n? __pfx_rxe_modify_srq+0x10/0x10 [rdma_rxe]\n? uverbs_try_lock_object+0x4f/0xa0 [ib_uverbs]\n? rdma_lookup_get_uobject+0x1f0/0x380 [ib_uverbs]\nib_uverbs_modify_srq+0x204/0x290 [ib_uverbs]\n? __pfx_ib_uverbs_modify_srq+0x10/0x10 [ib_uverbs]\n? tryinc_node_nr_active+0xe6/0x150\n? uverbs_fill_udata+0xed/0x4f0 [ib_uverbs]\nib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0x2c0/0x470 [ib_uverbs]\n? __pfx_ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0x10/0x10 [ib_uverbs]\n? uverbs_fill_udata+0xed/0x4f0 [ib_uverbs]\nib_uverbs_run_method+0x55a/0x6e0 [ib_uverbs]\n? __pfx_ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0x10/0x10 [ib_uverbs]\nib_uverbs_cmd_verbs+0x54d/0x800 [ib_uverbs]\n? __pfx_ib_uverbs_cmd_verbs+0x10/0x10 [ib_uverbs]\n? __pfx___raw_spin_lock_irqsave+0x10/0x10\n? __pfx_do_vfs_ioctl+0x10/0x10\n? ioctl_has_perm.constprop.0.isra.0+0x2c7/0x4c0\n? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10\nib_uverbs_ioctl+0x13e/0x220 [ib_uverbs]\n? __pfx_ib_uverbs_ioctl+0x10/0x10 [ib_uverbs]\n__x64_sys_ioctl+0x138/0x1c0\ndo_syscall_64+0x82/0x250\n? fdget_pos+0x58/0x4c0\n? ksys_write+0xf3/0x1c0\n? __pfx_ksys_write+0x10/0x10\n? do_syscall_64+0xc8/0x250\n? __pfx_vm_mmap_pgoff+0x10/0x10\n? fget+0x173/0x230\n? fput+0x2a/0x80\n? ksys_mmap_pgoff+0x224/0x4c0\n? do_syscall_64+0xc8/0x250\n? do_user_addr_fault+0x37b/0xfe0\n? clear_bhb_loop+0x50/0xa0\n? clear_bhb_loop+0x50/0xa0\n? clear_bhb_loop+0x50/0xa0\nentry_SYSCALL_64_after_hwframe+0x76/0x7e(CVE-2025-68379)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags\n\nWhen a filesystem is being automounted, it needs to preserve the\nuser-set superblock mount options, such as the \u0026quot;ro\u0026quot; flag.(CVE-2025-68764)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfsnotify: do not generate ACCESS/MODIFY events on child for special files\n\ninotify/fanotify do not allow users with no read access to a file to\nsubscribe to events (e.g. IN_ACCESS/IN_MODIFY), but they do allow the\nsame user to subscribe for watching events on children when the user\nhas access to the parent directory (e.g. /dev).\n\nUsers with no read access to a file but with read access to its parent\ndirectory can still stat the file and see if it was accessed/modified\nvia atime/mtime change.\n\nThe same is not true for special files (e.g. /dev/null). Users will not\ngenerally observe atime/mtime changes when other users read/write to\nspecial files, only when someone sets atime/mtime via utimensat().\n\nAlign fsnotify events with this stat behavior and do not generate\nACCESS/MODIFY events to parent watchers on read/write of special files.\nThe events are still generated to parent watchers on utimensat(). This\ncloses some side-channels that could be possibly used for information\nexfiltration [1].\n\n[1] https://snee.la/pdf/pubs/file-notification-attacks.pdf(CVE-2025-68788)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfuse: missing copy_finish in fuse-over-io-uring argument copies\n\nFix a possible reference count leak of payload pages during\nfuse argument copies.\n\n[Joanne: simplified error cleanup](CVE-2025-68791)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/amd: Check event before enable to avoid GPF\n\nOn AMD machines cpuc-\u0026gt;events[idx] can become NULL in a subtle race\ncondition with NMI-\u0026gt;throttle-\u0026gt;x86_pmu_stop().\n\nCheck event for NULL in amd_pmu_enable_all() before enable to avoid a GPF.\nThis appears to be an AMD only issue.\n\nSyzkaller reported a GPF in amd_pmu_enable_all.\n\nINFO: NMI handler (perf_event_nmi_handler) took too long to run: 13.143\n    msecs\nOops: general protection fault, probably for non-canonical address\n    0xdffffc0000000034: 0000  PREEMPT SMP KASAN NOPTI\nKASAN: null-ptr-deref in range [0x00000000000001a0-0x00000000000001a7]\nCPU: 0 UID: 0 PID: 328415 Comm: repro_36674776 Not tainted 6.12.0-rc1-syzk\nRIP: 0010:x86_pmu_enable_event (arch/x86/events/perf_event.h:1195\n    arch/x86/events/core.c:1430)\nRSP: 0018:ffff888118009d60 EFLAGS: 00010012\nRAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000\nRDX: 0000000000000034 RSI: 0000000000000000 RDI: 00000000000001a0\nRBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000002\nR13: ffff88811802a440 R14: ffff88811802a240 R15: ffff8881132d8601\nFS:  00007f097dfaa700(0000) GS:ffff888118000000(0000) GS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00000000200001c0 CR3: 0000000103d56000 CR4: 00000000000006f0\nCall Trace:\n \u0026lt;IRQ\u0026gt;\namd_pmu_enable_all (arch/x86/events/amd/core.c:760 (discriminator 2))\nx86_pmu_enable (arch/x86/events/core.c:1360)\nevent_sched_out (kernel/events/core.c:1191 kernel/events/core.c:1186\n    kernel/events/core.c:2346)\n__perf_remove_from_context (kernel/events/core.c:2435)\nevent_function (kernel/events/core.c:259)\nremote_function (kernel/events/core.c:92 (discriminator 1)\n    kernel/events/core.c:72 (discriminator 1))\n__flush_smp_call_function_queue (./arch/x86/include/asm/jump_label.h:27\n    ./include/linux/jump_label.h:207 ./include/trace/events/csd.h:64\n    kernel/smp.c:135 kernel/smp.c:540)\n__sysvec_call_function_single (./arch/x86/include/asm/jump_label.h:27\n    ./include/linux/jump_label.h:207\n    ./arch/x86/include/asm/trace/irq_vectors.h:99 arch/x86/kernel/smp.c:272)\nsysvec_call_function_single (arch/x86/kernel/smp.c:266 (discriminator 47)\n    arch/x86/kernel/smp.c:266 (discriminator 47))\n \u0026lt;/IRQ\u0026gt;(CVE-2025-68798)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats\n\nCited commit added a dedicated mutex (instead of RTNL) to protect the\nmulticast route list, so that it will not change while the driver\nperiodically traverses it in order to update the kernel about multicast\nroute stats that were queried from the device.\n\nOne instance of list entry deletion (during route replace) was missed\nand it can result in a use-after-free [1].\n\nFix by acquiring the mutex before deleting the entry from the list and\nreleasing it afterwards.\n\n[1]\nBUG: KASAN: slab-use-after-free in mlxsw_sp_mr_stats_update+0x4a5/0x540 drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c:1006 [mlxsw_spectrum]\nRead of size 8 at addr ffff8881523c2fa8 by task kworker/2:5/22043\n\nCPU: 2 UID: 0 PID: 22043 Comm: kworker/2:5 Not tainted 6.18.0-rc1-custom-g1a3d6d7cd014 #1 PREEMPT(full)\nHardware name: Mellanox Technologies Ltd. MSN2010/SA002610, BIOS 5.6.5 08/24/2017\nWorkqueue: mlxsw_core mlxsw_sp_mr_stats_update [mlxsw_spectrum]\nCall Trace:\n \u0026lt;TASK\u0026gt;\n dump_stack_lvl+0xba/0x110\n print_report+0x174/0x4f5\n kasan_report+0xdf/0x110\n mlxsw_sp_mr_stats_update+0x4a5/0x540 drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c:1006 [mlxsw_spectrum]\n process_one_work+0x9cc/0x18e0\n worker_thread+0x5df/0xe40\n kthread+0x3b8/0x730\n ret_from_fork+0x3e9/0x560\n ret_from_fork_asm+0x1a/0x30\n \u0026lt;/TASK\u0026gt;\n\nAllocated by task 29933:\n kasan_save_stack+0x30/0x50\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0x8f/0xa0\n mlxsw_sp_mr_route_add+0xd8/0x4770 [mlxsw_spectrum]\n mlxsw_sp_router_fibmr_event_work+0x371/0xad0 drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:7965 [mlxsw_spectrum]\n process_one_work+0x9cc/0x18e0\n worker_thread+0x5df/0xe40\n kthread+0x3b8/0x730\n ret_from_fork+0x3e9/0x560\n ret_from_fork_asm+0x1a/0x30\n\nFreed by task 29933:\n kasan_save_stack+0x30/0x50\n kasan_save_track+0x14/0x30\n __kasan_save_free_info+0x3b/0x70\n __kasan_slab_free+0x43/0x70\n kfree+0x14e/0x700\n mlxsw_sp_mr_route_add+0x2dea/0x4770 drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c:444 [mlxsw_spectrum]\n mlxsw_sp_router_fibmr_event_work+0x371/0xad0 drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:7965 [mlxsw_spectrum]\n process_one_work+0x9cc/0x18e0\n worker_thread+0x5df/0xe40\n kthread+0x3b8/0x730\n ret_from_fork+0x3e9/0x560\n ret_from_fork_asm+0x1a/0x30(CVE-2025-68800)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_router: Fix neighbour use-after-free\n\nWe sometimes observe use-after-free when dereferencing a neighbour [1].\nThe problem seems to be that the driver stores a pointer to the\nneighbour, but without holding a reference on it. A reference is only\ntaken when the neighbour is used by a nexthop.\n\nFix by simplifying the reference counting scheme. Always take a\nreference when storing a neighbour pointer in a neighbour entry. Avoid\ntaking a referencing when the neighbour is used by a nexthop as the\nneighbour entry associated with the nexthop already holds a reference.\n\nTested by running the test that uncovered the problem over 300 times.\nWithout this patch the problem was reproduced after a handful of\niterations.\n\n[1]\nBUG: KASAN: slab-use-after-free in mlxsw_sp_neigh_entry_update+0x2d4/0x310\nRead of size 8 at addr ffff88817f8e3420 by task ip/3929\n\nCPU: 3 UID: 0 PID: 3929 Comm: ip Not tainted 6.18.0-rc4-virtme-g36b21a067510 #3 PREEMPT(full)\nHardware name: Nvidia SN5600/VMOD0013, BIOS 5.13 05/31/2023\nCall Trace:\n \u0026lt;TASK\u0026gt;\n dump_stack_lvl+0x6f/0xa0\n print_address_description.constprop.0+0x6e/0x300\n print_report+0xfc/0x1fb\n kasan_report+0xe4/0x110\n mlxsw_sp_neigh_entry_update+0x2d4/0x310\n mlxsw_sp_router_rif_gone_sync+0x35f/0x510\n mlxsw_sp_rif_destroy+0x1ea/0x730\n mlxsw_sp_inetaddr_port_vlan_event+0xa1/0x1b0\n __mlxsw_sp_inetaddr_lag_event+0xcc/0x130\n __mlxsw_sp_inetaddr_event+0xf5/0x3c0\n mlxsw_sp_router_netdevice_event+0x1015/0x1580\n notifier_call_chain+0xcc/0x150\n call_netdevice_notifiers_info+0x7e/0x100\n __netdev_upper_dev_unlink+0x10b/0x210\n netdev_upper_dev_unlink+0x79/0xa0\n vrf_del_slave+0x18/0x50\n do_set_master+0x146/0x7d0\n do_setlink.isra.0+0x9a0/0x2880\n rtnl_newlink+0x637/0xb20\n rtnetlink_rcv_msg+0x6fe/0xb90\n netlink_rcv_skb+0x123/0x380\n netlink_unicast+0x4a3/0x770\n netlink_sendmsg+0x75b/0xc90\n __sock_sendmsg+0xbe/0x160\n ____sys_sendmsg+0x5b2/0x7d0\n ___sys_sendmsg+0xfd/0x180\n __sys_sendmsg+0x124/0x1c0\n do_syscall_64+0xbb/0xfd0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n[...]\n\nAllocated by task 109:\n kasan_save_stack+0x30/0x50\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0x7b/0x90\n __kmalloc_noprof+0x2c1/0x790\n neigh_alloc+0x6af/0x8f0\n ___neigh_create+0x63/0xe90\n mlxsw_sp_nexthop_neigh_init+0x430/0x7e0\n mlxsw_sp_nexthop_type_init+0x212/0x960\n mlxsw_sp_nexthop6_group_info_init.constprop.0+0x81f/0x1280\n mlxsw_sp_nexthop6_group_get+0x392/0x6a0\n mlxsw_sp_fib6_entry_create+0x46a/0xfd0\n mlxsw_sp_router_fib6_replace+0x1ed/0x5f0\n mlxsw_sp_router_fib6_event_work+0x10a/0x2a0\n process_one_work+0xd57/0x1390\n worker_thread+0x4d6/0xd40\n kthread+0x355/0x5b0\n ret_from_fork+0x1d4/0x270\n ret_from_fork_asm+0x11/0x20\n\nFreed by task 154:\n kasan_save_stack+0x30/0x50\n kasan_save_track+0x14/0x30\n __kasan_save_free_info+0x3b/0x60\n __kasan_slab_free+0x43/0x70\n kmem_cache_free_bulk.part.0+0x1eb/0x5e0\n kvfree_rcu_bulk+0x1f2/0x260\n kfree_rcu_work+0x130/0x1b0\n process_one_work+0xd57/0x1390\n worker_thread+0x4d6/0xd40\n kthread+0x355/0x5b0\n ret_from_fork+0x1d4/0x270\n ret_from_fork_asm+0x11/0x20\n\nLast potentially related work creation:\n kasan_save_stack+0x30/0x50\n kasan_record_aux_stack+0x8c/0xa0\n kvfree_call_rcu+0x93/0x5b0\n mlxsw_sp_router_neigh_event_work+0x67d/0x860\n process_one_work+0xd57/0x1390\n worker_thread+0x4d6/0xd40\n kthread+0x355/0x5b0\n ret_from_fork+0x1d4/0x270\n ret_from_fork_asm+0x11/0x20(CVE-2025-68801)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfuse: fix io-uring list corruption for terminated non-committed requests\n\nWhen a request is terminated before it has been committed, the request\nis not removed from the queue\u0026apos;s list. This leaves a dangling list entry\nthat leads to list corruption and use-after-free issues.\n\nRemove the request from the queue\u0026apos;s list for terminated non-committed\nrequests.(CVE-2025-68805)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfuse: fix readahead reclaim deadlock\n\nCommit e26ee4efbc79 (\u0026quot;fuse: allocate ff-\u0026gt;release_args only if release is\nneeded\u0026quot;) skips allocating ff-\u0026gt;release_args if the server does not\nimplement open. However in doing so, fuse_prepare_release() now skips\ngrabbing the reference on the inode, which makes it possible for an\ninode to be evicted from the dcache while there are inflight readahead\nrequests. This causes a deadlock if the server triggers reclaim while\nservicing the readahead request and reclaim attempts to evict the inode\nof the file being read ahead. Since the folio is locked during\nreadahead, when reclaim evicts the fuse inode and fuse_evict_inode()\nattempts to remove all folios associated with the inode from the page\ncache (truncate_inode_pages_range()), reclaim will block forever waiting\nfor the lock since readahead cannot relinquish the lock because it is\nitself blocked in reclaim:\n\n\u0026gt;\u0026gt;\u0026gt; stack_trace(1504735)\n folio_wait_bit_common (mm/filemap.c:1308:4)\n folio_lock (./include/linux/pagemap.h:1052:3)\n truncate_inode_pages_range (mm/truncate.c:336:10)\n fuse_evict_inode (fs/fuse/inode.c:161:2)\n evict (fs/inode.c:704:3)\n dentry_unlink_inode (fs/dcache.c:412:3)\n __dentry_kill (fs/dcache.c:615:3)\n shrink_kill (fs/dcache.c:1060:12)\n shrink_dentry_list (fs/dcache.c:1087:3)\n prune_dcache_sb (fs/dcache.c:1168:2)\n super_cache_scan (fs/super.c:221:10)\n do_shrink_slab (mm/shrinker.c:435:9)\n shrink_slab (mm/shrinker.c:626:10)\n shrink_node (mm/vmscan.c:5951:2)\n shrink_zones (mm/vmscan.c:6195:3)\n do_try_to_free_pages (mm/vmscan.c:6257:3)\n do_swap_page (mm/memory.c:4136:11)\n handle_pte_fault (mm/memory.c:5562:10)\n handle_mm_fault (mm/memory.c:5870:9)\n do_user_addr_fault (arch/x86/mm/fault.c:1338:10)\n handle_page_fault (arch/x86/mm/fault.c:1481:3)\n exc_page_fault (arch/x86/mm/fault.c:1539:2)\n asm_exc_page_fault+0x22/0x27\n\nFix this deadlock by allocating ff-\u0026gt;release_args and grabbing the\nreference on the inode when preparing the file for release even if the\nserver does not implement open. The inode reference will be dropped when\nthe last reference on the fuse file is dropped (see fuse_file_put() -\u0026gt;\nfuse_release_end()).(CVE-2025-68821)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niavf: fix off-by-one issues in iavf_config_rss_reg()\n\nThere are off-by-one bugs when configuring RSS hash key and lookup\ntable, causing out-of-bounds reads to memory [1] and out-of-bounds\nwrites to device registers.\n\nBefore commit 43a3d9ba34c9 (\u0026quot;i40evf: Allow PF driver to configure RSS\u0026quot;),\nthe loop upper bounds were:\n    i \u0026lt;= I40E_VFQF_{HKEY,HLUT}_MAX_INDEX\nwhich is safe since the value is the last valid index.\n\nThat commit changed the bounds to:\n    i \u0026lt;= adapter-\u0026gt;rss_{key,lut}_size / 4\nwhere `rss_{key,lut}_size / 4` is the number of dwords, so the last\nvalid index is `(rss_{key,lut}_size / 4) - 1`. Therefore, using `\u0026lt;=`\naccesses one element past the end.\n\nFix the issues by using `\u0026lt;` instead of `\u0026lt;=`, ensuring we do not exceed\nthe bounds.\n\n[1] KASAN splat about rss_key_size off-by-one\n  BUG: KASAN: slab-out-of-bounds in iavf_config_rss+0x619/0x800\n  Read of size 4 at addr ffff888102c50134 by task kworker/u8:6/63\n\n  CPU: 0 UID: 0 PID: 63 Comm: kworker/u8:6 Not tainted 6.18.0-rc2-enjuk-tnguy-00378-g3005f5b77652-dirty #156 PREEMPT(voluntary)\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n  Workqueue: iavf iavf_watchdog_task\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   dump_stack_lvl+0x6f/0xb0\n   print_report+0x170/0x4f3\n   kasan_report+0xe1/0x1a0\n   iavf_config_rss+0x619/0x800\n   iavf_watchdog_task+0x2be7/0x3230\n   process_one_work+0x7fd/0x1420\n   worker_thread+0x4d1/0xd40\n   kthread+0x344/0x660\n   ret_from_fork+0x249/0x320\n   ret_from_fork_asm+0x1a/0x30\n   \u0026lt;/TASK\u0026gt;\n\n  Allocated by task 63:\n   kasan_save_stack+0x30/0x50\n   kasan_save_track+0x14/0x30\n   __kasan_kmalloc+0x7f/0x90\n   __kmalloc_noprof+0x246/0x6f0\n   iavf_watchdog_task+0x28fc/0x3230\n   process_one_work+0x7fd/0x1420\n   worker_thread+0x4d1/0xd40\n   kthread+0x344/0x660\n   ret_from_fork+0x249/0x320\n   ret_from_fork_asm+0x1a/0x30\n\n  The buggy address belongs to the object at ffff888102c50100\n   which belongs to the cache kmalloc-64 of size 64\n  The buggy address is located 0 bytes to the right of\n   allocated 52-byte region [ffff888102c50100, ffff888102c50134)\n\n  The buggy address belongs to the physical page:\n  page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102c50\n  flags: 0x200000000000000(node=0|zone=2)\n  page_type: f5(slab)\n  raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000\n  raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000\n  page dumped because: kasan: bad access detected\n\n  Memory state around the buggy address:\n   ffff888102c50000: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc\n   ffff888102c50080: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc\n  \u0026gt;ffff888102c50100: 00 00 00 00 00 00 04 fc fc fc fc fc fc fc fc fc\n                                       ^\n   ffff888102c50180: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc\n   ffff888102c50200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc(CVE-2025-71087)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ne1000: fix OOB in e1000_tbi_should_accept()\n\nIn e1000_tbi_should_accept() we read the last byte of the frame via\n\u0026apos;data[length - 1]\u0026apos; to evaluate the TBI workaround. If the descriptor-\nreported length is zero or larger than the actual RX buffer size, this\nread goes out of bounds and can hit unrelated slab objects. The issue\nis observed from the NAPI receive path (e1000_clean_rx_irq):\n\n==================================================================\nBUG: KASAN: slab-out-of-bounds in e1000_tbi_should_accept+0x610/0x790\nRead of size 1 at addr ffff888014114e54 by task sshd/363\n\nCPU: 0 PID: 363 Comm: sshd Not tainted 5.18.0-rc1 #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014\nCall Trace:\n \u0026lt;IRQ\u0026gt;\n dump_stack_lvl+0x5a/0x74\n print_address_description+0x7b/0x440\n print_report+0x101/0x200\n kasan_report+0xc1/0xf0\n e1000_tbi_should_accept+0x610/0x790\n e1000_clean_rx_irq+0xa8c/0x1110\n e1000_clean+0xde2/0x3c10\n __napi_poll+0x98/0x380\n net_rx_action+0x491/0xa20\n __do_softirq+0x2c9/0x61d\n do_softirq+0xd1/0x120\n \u0026lt;/IRQ\u0026gt;\n \u0026lt;TASK\u0026gt;\n __local_bh_enable_ip+0xfe/0x130\n ip_finish_output2+0x7d5/0xb00\n __ip_queue_xmit+0xe24/0x1ab0\n __tcp_transmit_skb+0x1bcb/0x3340\n tcp_write_xmit+0x175d/0x6bd0\n __tcp_push_pending_frames+0x7b/0x280\n tcp_sendmsg_locked+0x2e4f/0x32d0\n tcp_sendmsg+0x24/0x40\n sock_write_iter+0x322/0x430\n vfs_write+0x56c/0xa60\n ksys_write+0xd1/0x190\n do_syscall_64+0x43/0x90\n entry_SYSCALL_64_after_hwframe+0x44/0xae\nRIP: 0033:0x7f511b476b10\nCode: 73 01 c3 48 8b 0d 88 d3 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d f9 2b 2c 00 00 75 10 b8 01 00 00 00 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 8e 9b 01 00 48 89 04 24\nRSP: 002b:00007ffc9211d4e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001\nRAX: ffffffffffffffda RBX: 0000000000004024 RCX: 00007f511b476b10\nRDX: 0000000000004024 RSI: 0000559a9385962c RDI: 0000000000000003\nRBP: 0000559a9383a400 R08: fffffffffffffff0 R09: 0000000000004f00\nR10: 0000000000000070 R11: 0000000000000246 R12: 0000000000000000\nR13: 00007ffc9211d57f R14: 0000559a9347bde7 R15: 0000000000000003\n \u0026lt;/TASK\u0026gt;\nAllocated by task 1:\n __kasan_krealloc+0x131/0x1c0\n krealloc+0x90/0xc0\n add_sysfs_param+0xcb/0x8a0\n kernel_add_sysfs_param+0x81/0xd4\n param_sysfs_builtin+0x138/0x1a6\n param_sysfs_init+0x57/0x5b\n do_one_initcall+0x104/0x250\n do_initcall_level+0x102/0x132\n do_initcalls+0x46/0x74\n kernel_init_freeable+0x28f/0x393\n kernel_init+0x14/0x1a0\n ret_from_fork+0x22/0x30\nThe buggy address belongs to the object at ffff888014114000\n which belongs to the cache kmalloc-2k of size 2048\nThe buggy address is located 1620 bytes to the right of\n 2048-byte region [ffff888014114000, ffff888014114800]\nThe buggy address belongs to the physical page:\npage:ffffea0000504400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14110\nhead:ffffea0000504400 order:3 compound_mapcount:0 compound_pincount:0\nflags: 0x100000000010200(slab|head|node=0|zone=1)\nraw: 0100000000010200 0000000000000000 dead000000000001 ffff888013442000\nraw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000\npage dumped because: kasan: bad access detected\n==================================================================\n\nThis happens because the TBI check unconditionally dereferences the last\nbyte without validating the reported length first:\n\n\tu8 last_byte = *(data + length - 1);\n\nFix by rejecting the frame early if the length is zero, or if it exceeds\nadapter-\u0026gt;rx_buffer_len. This preserves the TBI workaround semantics for\nvalid frames and prevents touching memory beyond the RX buffer.(CVE-2025-71093)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: Handle incorrect num_connectors capability\n\nThe UCSI spec states that the num_connectors field is 7 bits, and the\n8th bit is reserved and should be set to zero.\nSome buggy FW has been known to set this bit, and it can lead to a\nsystem not booting.\nFlag that the FW is not behaving correctly, and auto-fix the value\nso that the system boots correctly.\n\nFound on Lenovo P1 G8 during Linux enablement program. The FW will\nbe fixed, but seemed worth addressing in case it hit platforms that\naren\u0026apos;t officially Linux supported.(CVE-2025-71108)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - zero initialize memory allocated via sock_kmalloc\n\nSeveral crypto user API contexts and requests allocated with\nsock_kmalloc() were left uninitialized, relying on callers to\nset fields explicitly. This resulted in the use of uninitialized\ndata in certain error paths or when new fields are added in the\nfuture.\n\nThe ACVP patches also contain two user-space interface files:\nalgif_kpp.c and algif_akcipher.c. These too rely on proper\ninitialization of their context structures.\n\nA particular issue has been observed with the newly added\n\u0026apos;inflight\u0026apos; variable introduced in af_alg_ctx by commit:\n\n  67b164a871af (\u0026quot;crypto: af_alg - Disallow multiple in-flight AIO requests\u0026quot;)\n\nBecause the context is not memset to zero after allocation,\nthe inflight variable has contained garbage values. As a result,\naf_alg_alloc_areq() has incorrectly returned -EBUSY randomly when\nthe garbage value was interpreted as true:\n\n  https://github.com/gregkh/linux/blame/master/crypto/af_alg.c#L1209\n\nThe check directly tests ctx-\u0026gt;inflight without explicitly\ncomparing against true/false. Since inflight is only ever set to\ntrue or false later, an uninitialized value has triggered\n-EBUSY failures. Zero-initializing memory allocated with\nsock_kmalloc() ensures inflight and other fields start in a known\nstate, removing random issues caused by uninitialized data.(CVE-2025-71113)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/kexec: Enable SMT before waking offline CPUs\n\nIf SMT is disabled or a partial SMT state is enabled, when a new kernel\nimage is loaded for kexec, on reboot the following warning is observed:\n\nkexec: Waking offline cpu 228.\nWARNING: CPU: 0 PID: 9062 at arch/powerpc/kexec/core_64.c:223 kexec_prepare_cpus+0x1b0/0x1bc\n[snip]\n NIP kexec_prepare_cpus+0x1b0/0x1bc\n LR  kexec_prepare_cpus+0x1a0/0x1bc\n Call Trace:\n  kexec_prepare_cpus+0x1a0/0x1bc (unreliable)\n  default_machine_kexec+0x160/0x19c\n  machine_kexec+0x80/0x88\n  kernel_kexec+0xd0/0x118\n  __do_sys_reboot+0x210/0x2c4\n  system_call_exception+0x124/0x320\n  system_call_vectored_common+0x15c/0x2ec\n\nThis occurs as add_cpu() fails due to cpu_bootable() returning false for\nCPUs that fail the cpu_smt_thread_allowed() check or non primary\nthreads if SMT is disabled.\n\nFix the issue by enabling SMT and resetting the number of SMT threads to\nthe number of threads per core, before attempting to wake up all present\nCPUs.(CVE-2025-71119)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Do not register unsupported perf events\n\nSynthetic events currently do not have a function to register perf events.\nThis leads to calling the tracepoint register functions with a NULL\nfunction pointer which triggers:\n\n ------------[ cut here ]------------\n WARNING: kernel/tracepoint.c:175 at tracepoint_add_func+0x357/0x370, CPU#2: perf/2272\n Modules linked in: kvm_intel kvm irqbypass\n CPU: 2 UID: 0 PID: 2272 Comm: perf Not tainted 6.18.0-ftest-11964-ge022764176fc-dirty #323 PREEMPTLAZY\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-debian-1.17.0-1 04/01/2014\n RIP: 0010:tracepoint_add_func+0x357/0x370\n Code: 28 9c e8 4c 0b f5 ff eb 0f 4c 89 f7 48 c7 c6 80 4d 28 9c e8 ab 89 f4 ff 31 c0 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc \u0026lt;0f\u0026gt; 0b 49 c7 c6 ea ff ff ff e9 ee fe ff ff 0f 0b e9 f9 fe ff ff 0f\n RSP: 0018:ffffabc0c44d3c40 EFLAGS: 00010246\n RAX: 0000000000000001 RBX: ffff9380aa9e4060 RCX: 0000000000000000\n RDX: 000000000000000a RSI: ffffffff9e1d4a98 RDI: ffff937fcf5fd6c8\n RBP: 0000000000000001 R08: 0000000000000007 R09: ffff937fcf5fc780\n R10: 0000000000000003 R11: ffffffff9c193910 R12: 000000000000000a\n R13: ffffffff9e1e5888 R14: 0000000000000000 R15: ffffabc0c44d3c78\n FS:  00007f6202f5f340(0000) GS:ffff93819f00f000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 000055d3162281a8 CR3: 0000000106a56003 CR4: 0000000000172ef0\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  tracepoint_probe_register+0x5d/0x90\n  synth_event_reg+0x3c/0x60\n  perf_trace_event_init+0x204/0x340\n  perf_trace_init+0x85/0xd0\n  perf_tp_event_init+0x2e/0x50\n  perf_try_init_event+0x6f/0x230\n  ? perf_event_alloc+0x4bb/0xdc0\n  perf_event_alloc+0x65a/0xdc0\n  __se_sys_perf_event_open+0x290/0x9f0\n  do_syscall_64+0x93/0x7b0\n  ? entry_SYSCALL_64_after_hwframe+0x76/0x7e\n  ? trace_hardirqs_off+0x53/0xc0\n  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nInstead, have the code return -ENODEV, which doesn\u0026apos;t warn and has perf\nerror out with:\n\n # perf record -e synthetic:futex_wait\nError:\nThe sys_perf_event_open() syscall returned with 19 (No such device) for event (synthetic:futex_wait).\n\u0026quot;dmesg | grep -i perf\u0026quot; may provide additional information.\n\nIdeally perf should support synthetic events, but for now just fix the\nwarning. The support can come later.(CVE-2025-71125)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncifs: Fix memory and information leak in smb3_reconfigure()\n\nIn smb3_reconfigure(), if smb3_sync_session_ctx_passwords() fails, the\nfunction returns immediately without freeing and erasing the newly\nallocated new_password and new_password2. This causes both a memory leak\nand a potential information leak.\n\nFix this by calling kfree_sensitive() on both password buffers before\nreturning in this error case.(CVE-2025-71151)","status":"published","published":"2026-02-06T11:10:20Z","modified":"2026-08-18T01:19:32.449379768Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1305","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nptr_ring: do not block hard interrupts in ptr_ring_resize_multiple()\n\nJakub added a lockdep_assert_no_hardirq() check in __page_pool_put_page()\nto increase test coverage.\n\nsyzbot found a splat caused by hard irq blocking in\nptr_ring_resize_multiple() [1]\n\nAs current users of ptr_ring_resize_multiple() do not require\nhard irqs being masked, replace it to only block BH.\n\nRename helpers to better reflect they are safe against BH only.\n\n- ptr_ring_resize_multiple() to ptr_ring_resize_multiple_bh()\n- skb_array_resize_multiple() to skb_array_resize_multiple_bh()\n\n[1]\n\nWARNING: CPU: 1 PID: 9150 at net/core/page_pool.c:709 __page_pool_put_page net/core/page_pool.c:709 [inline]\nWARNING: CPU: 1 PID: 9150 at net/core/page_pool.c:709 page_pool_put_unrefed_netmem+0x157/0xa40 net/core/page_pool.c:780\nModules linked in:\nCPU: 1 UID: 0 PID: 9150 Comm: syz.1.1052 Not tainted 6.11.0-rc3-syzkaller-00202-gf8669d7b5f5d #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024\nRIP: 0010:__page_pool_put_page net/core/page_pool.c:709 [inline]\nRIP: 0010:page_pool_put_unrefed_netmem+0x157/0xa40 net/core/page_pool.c:780\nCode: 74 0e e8 7c aa fb f7 eb 43 e8 75 aa fb f7 eb 3c 65 8b 1d 38 a8 6a 76 31 ff 89 de e8 a3 ae fb f7 85 db 74 0b e8 5a aa fb f7 90 \u0026lt;0f\u0026gt; 0b 90 eb 1d 65 8b 1d 15 a8 6a 76 31 ff 89 de e8 84 ae fb f7 85\nRSP: 0018:ffffc9000bda6b58 EFLAGS: 00010083\nRAX: ffffffff8997e523 RBX: 0000000000000000 RCX: 0000000000040000\nRDX: ffffc9000fbd0000 RSI: 0000000000001842 RDI: 0000000000001843\nRBP: 0000000000000000 R08: ffffffff8997df2c R09: 1ffffd40003a000d\nR10: dffffc0000000000 R11: fffff940003a000e R12: ffffea0001d00040\nR13: ffff88802e8a4000 R14: dffffc0000000000 R15: 00000000ffffffff\nFS:  00007fb7aaf716c0(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fa15a0d4b72 CR3: 00000000561b0000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u0026lt;TASK\u0026gt;\n tun_ptr_free drivers/net/tun.c:617 [inline]\n __ptr_ring_swap_queue include/linux/ptr_ring.h:571 [inline]\n ptr_ring_resize_multiple_noprof include/linux/ptr_ring.h:643 [inline]\n tun_queue_resize drivers/net/tun.c:3694 [inline]\n tun_device_event+0xaaf/0x1080 drivers/net/tun.c:3714\n notifier_call_chain+0x19f/0x3e0 kernel/notifier.c:93\n call_netdevice_notifiers_extack net/core/dev.c:2032 [inline]\n call_netdevice_notifiers net/core/dev.c:2046 [inline]\n dev_change_tx_queue_len+0x158/0x2a0 net/core/dev.c:9024\n do_setlink+0xff6/0x41f0 net/core/rtnetlink.c:2923\n rtnl_setlink+0x40d/0x5a0 net/core/rtnetlink.c:3201\n rtnetlink_rcv_msg+0x73f/0xcf0 net/core/rtnetlink.c:6647\n netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2550(CVE-2024-57994)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params\n\nEach cpu DAI should associate with a widget. However, the topology might\nnot create the right number of DAI widgets for aggregated amps. And it\nwill cause NULL pointer deference.\nCheck that the DAI widget associated with the CPU DAI is valid to prevent\nNULL pointer deference due to missing DAI widgets in topologies with\naggregated amps.(CVE-2024-58012)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndriver core: fix potential NULL pointer dereference in dev_uevent()\n\nIf userspace reads \u0026quot;uevent\u0026quot; device attribute at the same time as another\nthreads unbinds the device from its driver, change to dev-\u0026gt;driver from a\nvalid pointer to NULL may result in crash. Fix this by using READ_ONCE()\nwhen fetching the pointer, and take bus\u0026apos; drivers klist lock to make sure\ndriver instance will not disappear while we access it.\n\nUse WRITE_ONCE() when setting the driver pointer to ensure there is no\ntearing.(CVE-2025-37800)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mdiobus: Fix potential out-of-bounds clause 45 read/write access\n\nWhen using publicly available tools like \u0026apos;mdio-tools\u0026apos; to read/write data\nfrom/to network interface and its PHY via C45 (clause 45) mdiobus,\nthere is no verification of parameters passed to the ioctl and\nit accepts any mdio address.\nCurrently there is support for 32 addresses in kernel via PHY_MAX_ADDR define,\nbut it is possible to pass higher value than that via ioctl.\nWhile read/write operation should generally fail in this case,\nmdiobus provides stats array, where wrong address may allow out-of-bounds\nread/write.\n\nFix that by adding address verification before C45 read/write operation.\nWhile this excludes this access from any statistics, it improves security of\nread/write operation.(CVE-2025-38110)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mdiobus: Fix potential out-of-bounds read/write access\n\nWhen using publicly available tools like \u0026apos;mdio-tools\u0026apos; to read/write data\nfrom/to network interface and its PHY via mdiobus, there is no verification of\nparameters passed to the ioctl and it accepts any mdio address.\nCurrently there is support for 32 addresses in kernel via PHY_MAX_ADDR define,\nbut it is possible to pass higher value than that via ioctl.\nWhile read/write operation should generally fail in this case,\nmdiobus provides stats array, where wrong address may allow out-of-bounds\nread/write.\n\nFix that by adding address verification before read/write operation.\nWhile this excludes this access from any statistics, it improves security of\nread/write operation.(CVE-2025-38111)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: phy: clear phydev-\u0026gt;devlink when the link is deleted\n\nThere is a potential crash issue when disabling and re-enabling the\nnetwork port. When disabling the network port, phy_detach() calls\ndevice_link_del() to remove the device link, but it does not clear\nphydev-\u0026gt;devlink, so phydev-\u0026gt;devlink is not a NULL pointer. Then the\nnetwork port is re-enabled, but if phy_attach_direct() fails before\ncalling device_link_add(), the code jumps to the \u0026quot;error\u0026quot; label and\ncalls phy_detach(). Since phydev-\u0026gt;devlink retains the old value from\nthe previous attach/detach cycle, device_link_del() uses the old value,\nwhich accesses a NULL pointer and causes a crash. The simplified crash\nlog is as follows.\n\n[   24.702421] Call trace:\n[   24.704856]  device_link_put_kref+0x20/0x120\n[   24.709124]  device_link_del+0x30/0x48\n[   24.712864]  phy_detach+0x24/0x168\n[   24.716261]  phy_attach_direct+0x168/0x3a4\n[   24.720352]  phylink_fwnode_phy_connect+0xc8/0x14c\n[   24.725140]  phylink_of_phy_connect+0x1c/0x34\n\nTherefore, phydev-\u0026gt;devlink needs to be cleared when the device link is\ndeleted.(CVE-2025-38149)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_set_pipapo: prevent overflow in lookup table allocation\n\nWhen calculating the lookup table size, ensure the following\nmultiplication does not overflow:\n\n- desc-\u0026gt;field_len[] maximum value is U8_MAX multiplied by\n  NFT_PIPAPO_GROUPS_PER_BYTE(f) that can be 2, worst case.\n- NFT_PIPAPO_BUCKETS(f-\u0026gt;bb) is 2^8, worst case.\n- sizeof(unsigned long), from sizeof(*f-\u0026gt;lt), lt in\n  struct nft_pipapo_field.\n\nThen, use check_mul_overflow() to multiply by bucket size and then use\ncheck_add_overflow() to the alignment for avx2 (if needed). Finally, add\nlt_size_check_overflow() helper and use it to consolidate this.\n\nWhile at it, replace leftover allocation using the GFP_KERNEL to\nGFP_KERNEL_ACCOUNT for consistency, in pipapo_resize().(CVE-2025-38162)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: add NULL check in automount_fullpath\n\npage is checked for null in __build_path_from_dentry_optional_prefix\nwhen tcon-\u0026gt;origin_fullpath is not set. However, the check is missing when\nit is set.\nAdd a check to prevent a potential NULL pointer dereference.(CVE-2025-38208)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: fix race between nfsd registration and exports_proc\n\nAs of now nfsd calls create_proc_exports_entry() at start of init_nfsd\nand cleanup by remove_proc_entry() at last of exit_nfsd.\n\nWhich causes kernel OOPs if there is race between below 2 operations:\n(i) exportfs -r\n(ii) mount -t nfsd none /proc/fs/nfsd\n\nfor 5.4 kernel ARM64:\n\nCPU 1:\nel1_irq+0xbc/0x180\narch_counter_get_cntvct+0x14/0x18\nrunning_clock+0xc/0x18\npreempt_count_add+0x88/0x110\nprep_new_page+0xb0/0x220\nget_page_from_freelist+0x2d8/0x1778\n__alloc_pages_nodemask+0x15c/0xef0\n__vmalloc_node_range+0x28c/0x478\n__vmalloc_node_flags_caller+0x8c/0xb0\nkvmalloc_node+0x88/0xe0\nnfsd_init_net+0x6c/0x108 [nfsd]\nops_init+0x44/0x170\nregister_pernet_operations+0x114/0x270\nregister_pernet_subsys+0x34/0x50\ninit_nfsd+0xa8/0x718 [nfsd]\ndo_one_initcall+0x54/0x2e0\n\nCPU 2 :\nUnable to handle kernel NULL pointer dereference at virtual address 0000000000000010\n\nPC is at : exports_net_open+0x50/0x68 [nfsd]\n\nCall trace:\nexports_net_open+0x50/0x68 [nfsd]\nexports_proc_open+0x2c/0x38 [nfsd]\nproc_reg_open+0xb8/0x198\ndo_dentry_open+0x1c4/0x418\nvfs_open+0x38/0x48\npath_openat+0x28c/0xf18\ndo_filp_open+0x70/0xe8\ndo_sys_open+0x154/0x248\n\nSometimes it crashes at exports_net_open() and sometimes cache_seq_next_rcu().\n\nand same is happening on latest 6.14 kernel as well:\n\n[    0.000000] Linux version 6.14.0-rc5-next-20250304-dirty\n...\n[  285.455918] Unable to handle kernel paging request at virtual address 00001f4800001f48\n...\n[  285.464902] pc : cache_seq_next_rcu+0x78/0xa4\n...\n[  285.469695] Call trace:\n[  285.470083]  cache_seq_next_rcu+0x78/0xa4 (P)\n[  285.470488]  seq_read+0xe0/0x11c\n[  285.470675]  proc_reg_read+0x9c/0xf0\n[  285.470874]  vfs_read+0xc4/0x2fc\n[  285.471057]  ksys_read+0x6c/0xf4\n[  285.471231]  __arm64_sys_read+0x1c/0x28\n[  285.471428]  invoke_syscall+0x44/0x100\n[  285.471633]  el0_svc_common.constprop.0+0x40/0xe0\n[  285.471870]  do_el0_svc_compat+0x1c/0x34\n[  285.472073]  el0_svc_compat+0x2c/0x80\n[  285.472265]  el0t_32_sync_handler+0x90/0x140\n[  285.472473]  el0t_32_sync+0x19c/0x1a0\n[  285.472887] Code: f9400885 93407c23 937d7c27 11000421 (f86378a3)\n[  285.473422] ---[ end trace 0000000000000000 ]---\n\nIt reproduced simply with below script:\nwhile [ 1 ]\ndo\n/exportfs -r\ndone \u0026amp;\n\nwhile [ 1 ]\ndo\ninsmod /nfsd.ko\nmount -t nfsd none /proc/fs/nfsd\numount /proc/fs/nfsd\nrmmod nfsd\ndone \u0026amp;\n\nSo exporting interfaces to user space shall be done at last and\ncleanup at first place.\n\nWith change there is no Kernel OOPs.(CVE-2025-38232)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix potential deadlock when reconnecting channels\n\nFix cifs_signal_cifsd_for_reconnect() to take the correct lock order\nand prevent the following deadlock from happening\n\n======================================================\nWARNING: possible circular locking dependency detected\n6.16.0-rc3-build2+ #1301 Tainted: G S      W\n------------------------------------------------------\ncifsd/6055 is trying to acquire lock:\nffff88810ad56038 (\u0026amp;tcp_ses-\u0026gt;srv_lock){+.+.}-{3:3}, at: cifs_signal_cifsd_for_reconnect+0x134/0x200\n\nbut task is already holding lock:\nffff888119c64330 (\u0026amp;ret_buf-\u0026gt;chan_lock){+.+.}-{3:3}, at: cifs_signal_cifsd_for_reconnect+0xcf/0x200\n\nwhich lock already depends on the new lock.\n\nthe existing dependency chain (in reverse order) is:\n\n-\u0026gt; #2 (\u0026amp;ret_buf-\u0026gt;chan_lock){+.+.}-{3:3}:\n       validate_chain+0x1cf/0x270\n       __lock_acquire+0x60e/0x780\n       lock_acquire.part.0+0xb4/0x1f0\n       _raw_spin_lock+0x2f/0x40\n       cifs_setup_session+0x81/0x4b0\n       cifs_get_smb_ses+0x771/0x900\n       cifs_mount_get_session+0x7e/0x170\n       cifs_mount+0x92/0x2d0\n       cifs_smb3_do_mount+0x161/0x460\n       smb3_get_tree+0x55/0x90\n       vfs_get_tree+0x46/0x180\n       do_new_mount+0x1b0/0x2e0\n       path_mount+0x6ee/0x740\n       do_mount+0x98/0xe0\n       __do_sys_mount+0x148/0x180\n       do_syscall_64+0xa4/0x260\n       entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\n-\u0026gt; #1 (\u0026amp;ret_buf-\u0026gt;ses_lock){+.+.}-{3:3}:\n       validate_chain+0x1cf/0x270\n       __lock_acquire+0x60e/0x780\n       lock_acquire.part.0+0xb4/0x1f0\n       _raw_spin_lock+0x2f/0x40\n       cifs_match_super+0x101/0x320\n       sget+0xab/0x270\n       cifs_smb3_do_mount+0x1e0/0x460\n       smb3_get_tree+0x55/0x90\n       vfs_get_tree+0x46/0x180\n       do_new_mount+0x1b0/0x2e0\n       path_mount+0x6ee/0x740\n       do_mount+0x98/0xe0\n       __do_sys_mount+0x148/0x180\n       do_syscall_64+0xa4/0x260\n       entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\n-\u0026gt; #0 (\u0026amp;tcp_ses-\u0026gt;srv_lock){+.+.}-{3:3}:\n       check_noncircular+0x95/0xc0\n       check_prev_add+0x115/0x2f0\n       validate_chain+0x1cf/0x270\n       __lock_acquire+0x60e/0x780\n       lock_acquire.part.0+0xb4/0x1f0\n       _raw_spin_lock+0x2f/0x40\n       cifs_signal_cifsd_for_reconnect+0x134/0x200\n       __cifs_reconnect+0x8f/0x500\n       cifs_handle_standard+0x112/0x280\n       cifs_demultiplex_thread+0x64d/0xbc0\n       kthread+0x2f7/0x310\n       ret_from_fork+0x2a/0x230\n       ret_from_fork_asm+0x1a/0x30\n\nother info that might help us debug this:\n\nChain exists of:\n  \u0026amp;tcp_ses-\u0026gt;srv_lock --\u0026gt; \u0026amp;ret_buf-\u0026gt;ses_lock --\u0026gt; \u0026amp;ret_buf-\u0026gt;chan_lock\n\n Possible unsafe locking scenario:\n\n       CPU0                    CPU1\n       ----                    ----\n  lock(\u0026amp;ret_buf-\u0026gt;chan_lock);\n                               lock(\u0026amp;ret_buf-\u0026gt;ses_lock);\n                               lock(\u0026amp;ret_buf-\u0026gt;chan_lock);\n  lock(\u0026amp;tcp_ses-\u0026gt;srv_lock);\n\n *** DEADLOCK ***\n\n3 locks held by cifsd/6055:\n #0: ffffffff857de398 (\u0026amp;cifs_tcp_ses_lock){+.+.}-{3:3}, at: cifs_signal_cifsd_for_reconnect+0x7b/0x200\n #1: ffff888119c64060 (\u0026amp;ret_buf-\u0026gt;ses_lock){+.+.}-{3:3}, at: cifs_signal_cifsd_for_reconnect+0x9c/0x200\n #2: ffff888119c64330 (\u0026amp;ret_buf-\u0026gt;chan_lock){+.+.}-{3:3}, at: cifs_signal_cifsd_for_reconnect+0xcf/0x200(CVE-2025-38244)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsoftware node: Correct a OOB check in software_node_get_reference_args()\n\nsoftware_node_get_reference_args() wants to get @index-th element, so\nthe property value requires at least \u0026apos;(index + 1) * sizeof(*ref)\u0026apos; bytes\nbut that can not be guaranteed by current OOB check, and may cause OOB\nfor malformed property.\n\nFix by using as OOB check \u0026apos;((index + 1) * sizeof(*ref) \u0026gt; prop-\u0026gt;length)\u0026apos;.(CVE-2025-38342)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN\n\nWe found a few different systems hung up in writeback waiting on the same\npage lock, and one task waiting on the NFS_LAYOUT_DRAIN bit in\npnfs_update_layout(), however the pnfs_layout_hdr\u0026apos;s plh_outstanding count\nwas zero.\n\nIt seems most likely that this is another race between the waiter and waker\nsimilar to commit ed0172af5d6f (\u0026quot;SUNRPC: Fix a race to wake a sync task\u0026quot;).\nFix it up by applying the advised barrier.(CVE-2025-38393)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight\n\nReject migration of SEV{-ES} state if either the source or destination VM\nis actively creating a vCPU, i.e. if kvm_vm_ioctl_create_vcpu() is in the\nsection between incrementing created_vcpus and online_vcpus.  The bulk of\nvCPU creation runs _outside_ of kvm-\u0026gt;lock to allow creating multiple vCPUs\nin parallel, and so sev_info.es_active can get toggled from false=\u0026gt;true in\nthe destination VM after (or during) svm_vcpu_create(), resulting in an\nSEV{-ES} VM effectively having a non-SEV{-ES} vCPU.\n\nThe issue manifests most visibly as a crash when trying to free a vCPU\u0026apos;s\nNULL VMSA page in an SEV-ES VM, but any number of things can go wrong.\n\n  BUG: unable to handle page fault for address: ffffebde00000000\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  PGD 0 P4D 0\n  Oops: Oops: 0000 [#1] SMP KASAN NOPTI\n  CPU: 227 UID: 0 PID: 64063 Comm: syz.5.60023 Tainted: G     U     O        6.15.0-smp-DEV #2 NONE\n  Tainted: [U]=USER, [O]=OOT_MODULE\n  Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.52.0-0 10/28/2024\n  RIP: 0010:constant_test_bit arch/x86/include/asm/bitops.h:206 [inline]\n  RIP: 0010:arch_test_bit arch/x86/include/asm/bitops.h:238 [inline]\n  RIP: 0010:_test_bit include/asm-generic/bitops/instrumented-non-atomic.h:142 [inline]\n  RIP: 0010:PageHead include/linux/page-flags.h:866 [inline]\n  RIP: 0010:___free_pages+0x3e/0x120 mm/page_alloc.c:5067\n  Code: \u0026lt;49\u0026gt; f7 06 40 00 00 00 75 05 45 31 ff eb 0c 66 90 4c 89 f0 4c 39 f0\n  RSP: 0018:ffff8984551978d0 EFLAGS: 00010246\n  RAX: 0000777f80000001 RBX: 0000000000000000 RCX: ffffffff918aeb98\n  RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffebde00000000\n  RBP: 0000000000000000 R08: ffffebde00000007 R09: 1ffffd7bc0000000\n  R10: dffffc0000000000 R11: fffff97bc0000001 R12: dffffc0000000000\n  R13: ffff8983e19751a8 R14: ffffebde00000000 R15: 1ffffd7bc0000000\n  FS:  0000000000000000(0000) GS:ffff89ee661d3000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: ffffebde00000000 CR3: 000000793ceaa000 CR4: 0000000000350ef0\n  DR0: 0000000000000000 DR1: 0000000000000b5f DR2: 0000000000000000\n  DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   sev_free_vcpu+0x413/0x630 arch/x86/kvm/svm/sev.c:3169\n   svm_vcpu_free+0x13a/0x2a0 arch/x86/kvm/svm/svm.c:1515\n   kvm_arch_vcpu_destroy+0x6a/0x1d0 arch/x86/kvm/x86.c:12396\n   kvm_vcpu_destroy virt/kvm/kvm_main.c:470 [inline]\n   kvm_destroy_vcpus+0xd1/0x300 virt/kvm/kvm_main.c:490\n   kvm_arch_destroy_vm+0x636/0x820 arch/x86/kvm/x86.c:12895\n   kvm_put_kvm+0xb8e/0xfb0 virt/kvm/kvm_main.c:1310\n   kvm_vm_release+0x48/0x60 virt/kvm/kvm_main.c:1369\n   __fput+0x3e4/0x9e0 fs/file_table.c:465\n   task_work_run+0x1a9/0x220 kernel/task_work.c:227\n   exit_task_work include/linux/task_work.h:40 [inline]\n   do_exit+0x7f0/0x25b0 kernel/exit.c:953\n   do_group_exit+0x203/0x2d0 kernel/exit.c:1102\n   get_signal+0x1357/0x1480 kernel/signal.c:3034\n   arch_do_signal_or_restart+0x40/0x690 arch/x86/kernel/signal.c:337\n   exit_to_user_mode_loop kernel/entry/common.c:111 [inline]\n   exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]\n   __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]\n   syscall_exit_to_user_mode+0x67/0xb0 kernel/entry/common.c:218\n   do_syscall_64+0x7c/0x150 arch/x86/entry/syscall_64.c:100\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n  RIP: 0033:0x7f87a898e969\n   \u0026lt;/TASK\u0026gt;\n  Modules linked in: gq(O)\n  gsmi: Log Shutdown Reason 0x03\n  CR2: ffffebde00000000\n  ---[ end trace 0000000000000000 ]---\n\nDeliberately don\u0026apos;t check for a NULL VMSA when freeing the vCPU, as crashing\nthe host is likely desirable due to the VMSA being consumed by hardware.\nE.g. if KVM manages to allow VMRUN on the vCPU, hardware may read/write a\nbogus VMSA page.  Accessing P\n---truncated---(CVE-2025-38455)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: Abort __tc_modify_qdisc if parent class does not exist\n\nLion\u0026apos;s patch [1] revealed an ancient bug in the qdisc API.\nWhenever a user creates/modifies a qdisc specifying as a parent another\nqdisc, the qdisc API will, during grafting, detect that the user is\nnot trying to attach to a class and reject. However grafting is\nperformed after qdisc_create (and thus the qdiscs\u0026apos; init callback) is\nexecuted. In qdiscs that eventually call qdisc_tree_reduce_backlog\nduring init or change (such as fq, hhf, choke, etc), an issue\narises. For example, executing the following commands:\n\nsudo tc qdisc add dev lo root handle a: htb default 2\nsudo tc qdisc add dev lo parent a: handle beef fq\n\nQdiscs such as fq, hhf, choke, etc unconditionally invoke\nqdisc_tree_reduce_backlog() in their control path init() or change() which\nthen causes a failure to find the child class; however, that does not stop\nthe unconditional invocation of the assumed child qdisc\u0026apos;s qlen_notify with\na null class. All these qdiscs make the assumption that class is non-null.\n\nThe solution is ensure that qdisc_leaf() which looks up the parent\nclass, and is invoked prior to qdisc_create(), should return failure on\nnot finding the class.\nIn this patch, we leverage qdisc_leaf to return ERR_PTRs whenever the\nparentid doesn\u0026apos;t correspond to a class, so that we can detect it\nearlier on and abort before qdisc_create is called.\n\n[1] https://lore.kernel.org/netdev/(CVE-2025-38457)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niommufd: Prevent ALIGN() overflow\n\nWhen allocating IOVA the candidate range gets aligned to the target\nalignment. If the range is close to ULONG_MAX then the ALIGN() can\nwrap resulting in a corrupted iova.\n\nOpen code the ALIGN() using get_add_overflow() to prevent this.\nThis simplifies the checks as we don\u0026apos;t need to check for length earlier\neither.\n\nConsolidate the two copies of this code under a single helper.\n\nThis bug would allow userspace to create a mapping that overlaps with some\nother mapping or a reserved range.(CVE-2025-38688)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\njfs: upper bound check of tree index in dbAllocAG\n\nWhen computing the tree index in dbAllocAG, we never check if we are\nout of bounds realative to the size of the stree.\nThis could happen in a scenario where the filesystem metadata are\ncorrupted.(CVE-2025-38697)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nhfsplus: don\u0026apos;t use BUG_ON() in hfsplus_create_attributes_file()\n\nWhen the volume header contains erroneous values that do not reflect\nthe actual state of the filesystem, hfsplus_fill_super() assumes that\nthe attributes file is not yet created, which later results in hitting\nBUG_ON() when hfsplus_create_attributes_file() is called. Replace this\nBUG_ON() with -EIO error with a message to suggest running fsck tool.(CVE-2025-38712)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nhfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()\n\nThe hfsplus_readdir() method is capable to crash by calling\nhfsplus_uni2asc():\n\n[  667.121659][ T9805] ==================================================================\n[  667.122651][ T9805] BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0x902/0xa10\n[  667.123627][ T9805] Read of size 2 at addr ffff88802592f40c by task repro/9805\n[  667.124578][ T9805]\n[  667.124876][ T9805] CPU: 3 UID: 0 PID: 9805 Comm: repro Not tainted 6.16.0-rc3 #1 PREEMPT(full)\n[  667.124886][ T9805] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[  667.124890][ T9805] Call Trace:\n[  667.124893][ T9805]  \u0026lt;TASK\u0026gt;\n[  667.124896][ T9805]  dump_stack_lvl+0x10e/0x1f0\n[  667.124911][ T9805]  print_report+0xd0/0x660\n[  667.124920][ T9805]  ? __virt_addr_valid+0x81/0x610\n[  667.124928][ T9805]  ? __phys_addr+0xe8/0x180\n[  667.124934][ T9805]  ? hfsplus_uni2asc+0x902/0xa10\n[  667.124942][ T9805]  kasan_report+0xc6/0x100\n[  667.124950][ T9805]  ? hfsplus_uni2asc+0x902/0xa10\n[  667.124959][ T9805]  hfsplus_uni2asc+0x902/0xa10\n[  667.124966][ T9805]  ? hfsplus_bnode_read+0x14b/0x360\n[  667.124974][ T9805]  hfsplus_readdir+0x845/0xfc0\n[  667.124984][ T9805]  ? __pfx_hfsplus_readdir+0x10/0x10\n[  667.124994][ T9805]  ? stack_trace_save+0x8e/0xc0\n[  667.125008][ T9805]  ? iterate_dir+0x18b/0xb20\n[  667.125015][ T9805]  ? trace_lock_acquire+0x85/0xd0\n[  667.125022][ T9805]  ? lock_acquire+0x30/0x80\n[  667.125029][ T9805]  ? iterate_dir+0x18b/0xb20\n[  667.125037][ T9805]  ? down_read_killable+0x1ed/0x4c0\n[  667.125044][ T9805]  ? putname+0x154/0x1a0\n[  667.125051][ T9805]  ? __pfx_down_read_killable+0x10/0x10\n[  667.125058][ T9805]  ? apparmor_file_permission+0x239/0x3e0\n[  667.125069][ T9805]  iterate_dir+0x296/0xb20\n[  667.125076][ T9805]  __x64_sys_getdents64+0x13c/0x2c0\n[  667.125084][ T9805]  ? __pfx___x64_sys_getdents64+0x10/0x10\n[  667.125091][ T9805]  ? __x64_sys_openat+0x141/0x200\n[  667.125126][ T9805]  ? __pfx_filldir64+0x10/0x10\n[  667.125134][ T9805]  ? do_user_addr_fault+0x7fe/0x12f0\n[  667.125143][ T9805]  do_syscall_64+0xc9/0x480\n[  667.125151][ T9805]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[  667.125158][ T9805] RIP: 0033:0x7fa8753b2fc9\n[  667.125164][ T9805] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 48\n[  667.125172][ T9805] RSP: 002b:00007ffe96f8e0f8 EFLAGS: 00000217 ORIG_RAX: 00000000000000d9\n[  667.125181][ T9805] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa8753b2fc9\n[  667.125185][ T9805] RDX: 0000000000000400 RSI: 00002000000063c0 RDI: 0000000000000004\n[  667.125190][ T9805] RBP: 00007ffe96f8e110 R08: 00007ffe96f8e110 R09: 00007ffe96f8e110\n[  667.125195][ T9805] R10: 0000000000000000 R11: 0000000000000217 R12: 0000556b1e3b4260\n[  667.125199][ T9805] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\n[  667.125207][ T9805]  \u0026lt;/TASK\u0026gt;\n[  667.125210][ T9805]\n[  667.145632][ T9805] Allocated by task 9805:\n[  667.145991][ T9805]  kasan_save_stack+0x20/0x40\n[  667.146352][ T9805]  kasan_save_track+0x14/0x30\n[  667.146717][ T9805]  __kasan_kmalloc+0xaa/0xb0\n[  667.147065][ T9805]  __kmalloc_noprof+0x205/0x550\n[  667.147448][ T9805]  hfsplus_find_init+0x95/0x1f0\n[  667.147813][ T9805]  hfsplus_readdir+0x220/0xfc0\n[  667.148174][ T9805]  iterate_dir+0x296/0xb20\n[  667.148549][ T9805]  __x64_sys_getdents64+0x13c/0x2c0\n[  667.148937][ T9805]  do_syscall_64+0xc9/0x480\n[  667.149291][ T9805]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[  667.149809][ T9805]\n[  667.150030][ T9805] The buggy address belongs to the object at ffff88802592f000\n[  667.150030][ T9805]  which belongs to the cache kmalloc-2k of size 2048\n[  667.151282][ T9805] The buggy address is located 0 bytes to the right of\n[  667.151282][ T9805]  allocated 1036-byte region [ffff88802592f000, ffff88802592f40c)\n[  667.1\n---truncated---(CVE-2025-38713)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nhfsplus: fix slab-out-of-bounds in hfsplus_bnode_read()\n\nThe hfsplus_bnode_read() method can trigger the issue:\n\n[  174.852007][ T9784] ==================================================================\n[  174.852709][ T9784] BUG: KASAN: slab-out-of-bounds in hfsplus_bnode_read+0x2f4/0x360\n[  174.853412][ T9784] Read of size 8 at addr ffff88810b5fc6c0 by task repro/9784\n[  174.854059][ T9784]\n[  174.854272][ T9784] CPU: 1 UID: 0 PID: 9784 Comm: repro Not tainted 6.16.0-rc3 #7 PREEMPT(full)\n[  174.854281][ T9784] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[  174.854286][ T9784] Call Trace:\n[  174.854289][ T9784]  \u0026lt;TASK\u0026gt;\n[  174.854292][ T9784]  dump_stack_lvl+0x10e/0x1f0\n[  174.854305][ T9784]  print_report+0xd0/0x660\n[  174.854315][ T9784]  ? __virt_addr_valid+0x81/0x610\n[  174.854323][ T9784]  ? __phys_addr+0xe8/0x180\n[  174.854330][ T9784]  ? hfsplus_bnode_read+0x2f4/0x360\n[  174.854337][ T9784]  kasan_report+0xc6/0x100\n[  174.854346][ T9784]  ? hfsplus_bnode_read+0x2f4/0x360\n[  174.854354][ T9784]  hfsplus_bnode_read+0x2f4/0x360\n[  174.854362][ T9784]  hfsplus_bnode_dump+0x2ec/0x380\n[  174.854370][ T9784]  ? __pfx_hfsplus_bnode_dump+0x10/0x10\n[  174.854377][ T9784]  ? hfsplus_bnode_write_u16+0x83/0xb0\n[  174.854385][ T9784]  ? srcu_gp_start+0xd0/0x310\n[  174.854393][ T9784]  ? __mark_inode_dirty+0x29e/0xe40\n[  174.854402][ T9784]  hfsplus_brec_remove+0x3d2/0x4e0\n[  174.854411][ T9784]  __hfsplus_delete_attr+0x290/0x3a0\n[  174.854419][ T9784]  ? __pfx_hfs_find_1st_rec_by_cnid+0x10/0x10\n[  174.854427][ T9784]  ? __pfx___hfsplus_delete_attr+0x10/0x10\n[  174.854436][ T9784]  ? __asan_memset+0x23/0x50\n[  174.854450][ T9784]  hfsplus_delete_all_attrs+0x262/0x320\n[  174.854459][ T9784]  ? __pfx_hfsplus_delete_all_attrs+0x10/0x10\n[  174.854469][ T9784]  ? rcu_is_watching+0x12/0xc0\n[  174.854476][ T9784]  ? __mark_inode_dirty+0x29e/0xe40\n[  174.854483][ T9784]  hfsplus_delete_cat+0x845/0xde0\n[  174.854493][ T9784]  ? __pfx_hfsplus_delete_cat+0x10/0x10\n[  174.854507][ T9784]  hfsplus_unlink+0x1ca/0x7c0\n[  174.854516][ T9784]  ? __pfx_hfsplus_unlink+0x10/0x10\n[  174.854525][ T9784]  ? down_write+0x148/0x200\n[  174.854532][ T9784]  ? __pfx_down_write+0x10/0x10\n[  174.854540][ T9784]  vfs_unlink+0x2fe/0x9b0\n[  174.854549][ T9784]  do_unlinkat+0x490/0x670\n[  174.854557][ T9784]  ? __pfx_do_unlinkat+0x10/0x10\n[  174.854565][ T9784]  ? __might_fault+0xbc/0x130\n[  174.854576][ T9784]  ? getname_flags.part.0+0x1c5/0x550\n[  174.854584][ T9784]  __x64_sys_unlink+0xc5/0x110\n[  174.854592][ T9784]  do_syscall_64+0xc9/0x480\n[  174.854600][ T9784]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[  174.854608][ T9784] RIP: 0033:0x7f6fdf4c3167\n[  174.854614][ T9784] Code: f0 ff ff 73 01 c3 48 8b 0d 26 0d 0e 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 08\n[  174.854622][ T9784] RSP: 002b:00007ffcb948bca8 EFLAGS: 00000206 ORIG_RAX: 0000000000000057\n[  174.854630][ T9784] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f6fdf4c3167\n[  174.854636][ T9784] RDX: 00007ffcb948bcc0 RSI: 00007ffcb948bcc0 RDI: 00007ffcb948bd50\n[  174.854641][ T9784] RBP: 00007ffcb948cd90 R08: 0000000000000001 R09: 00007ffcb948bb40\n[  174.854645][ T9784] R10: 00007f6fdf564fc0 R11: 0000000000000206 R12: 0000561e1bc9c2d0\n[  174.854650][ T9784] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\n[  174.854658][ T9784]  \u0026lt;/TASK\u0026gt;\n[  174.854661][ T9784]\n[  174.879281][ T9784] Allocated by task 9784:\n[  174.879664][ T9784]  kasan_save_stack+0x20/0x40\n[  174.880082][ T9784]  kasan_save_track+0x14/0x30\n[  174.880500][ T9784]  __kasan_kmalloc+0xaa/0xb0\n[  174.880908][ T9784]  __kmalloc_noprof+0x205/0x550\n[  174.881337][ T9784]  __hfs_bnode_create+0x107/0x890\n[  174.881779][ T9784]  hfsplus_bnode_find+0x2d0/0xd10\n[  174.882222][ T9784]  hfsplus_brec_find+0x2b0/0x520\n[  174.882659][ T9784]  hfsplus_delete_all_attrs+0x23b/0x3\n---truncated---(CVE-2025-38714)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb3: fix for slab out of bounds on mount to ksmbd\n\nWith KASAN enabled, it is possible to get a slab out of bounds\nduring mount to ksmbd due to missing check in parse_server_interfaces()\n(see below):\n\n BUG: KASAN: slab-out-of-bounds in\n parse_server_interfaces+0x14ee/0x1880 [cifs]\n Read of size 4 at addr ffff8881433dba98 by task mount/9827\n\n CPU: 5 UID: 0 PID: 9827 Comm: mount Tainted: G\n OE       6.16.0-rc2-kasan #2 PREEMPT(voluntary)\n Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\n Hardware name: Dell Inc. Precision Tower 3620/0MWYPT,\n BIOS 2.13.1 06/14/2019\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n dump_stack_lvl+0x9f/0xf0\n print_report+0xd1/0x670\n __virt_addr_valid+0x22c/0x430\n ? parse_server_interfaces+0x14ee/0x1880 [cifs]\n ? kasan_complete_mode_report_info+0x2a/0x1f0\n ? parse_server_interfaces+0x14ee/0x1880 [cifs]\n   kasan_report+0xd6/0x110\n   parse_server_interfaces+0x14ee/0x1880 [cifs]\n   __asan_report_load_n_noabort+0x13/0x20\n   parse_server_interfaces+0x14ee/0x1880 [cifs]\n ? __pfx_parse_server_interfaces+0x10/0x10 [cifs]\n ? trace_hardirqs_on+0x51/0x60\n SMB3_request_interfaces+0x1ad/0x3f0 [cifs]\n ? __pfx_SMB3_request_interfaces+0x10/0x10 [cifs]\n ? SMB2_tcon+0x23c/0x15d0 [cifs]\n smb3_qfs_tcon+0x173/0x2b0 [cifs]\n ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs]\n ? cifs_get_tcon+0x105d/0x2120 [cifs]\n ? do_raw_spin_unlock+0x5d/0x200\n ? cifs_get_tcon+0x105d/0x2120 [cifs]\n ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs]\n cifs_mount_get_tcon+0x369/0xb90 [cifs]\n ? dfs_cache_find+0xe7/0x150 [cifs]\n dfs_mount_share+0x985/0x2970 [cifs]\n ? check_path.constprop.0+0x28/0x50\n ? save_trace+0x54/0x370\n ? __pfx_dfs_mount_share+0x10/0x10 [cifs]\n ? __lock_acquire+0xb82/0x2ba0\n ? __kasan_check_write+0x18/0x20\n cifs_mount+0xbc/0x9e0 [cifs]\n ? __pfx_cifs_mount+0x10/0x10 [cifs]\n ? do_raw_spin_unlock+0x5d/0x200\n ? cifs_setup_cifs_sb+0x29d/0x810 [cifs]\n cifs_smb3_do_mount+0x263/0x1990 [cifs](CVE-2025-38728)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix refcount leak causing resource not released\n\nWhen ksmbd_conn_releasing(opinfo-\u0026gt;conn) returns true,the refcount was not\ndecremented properly, causing a refcount leak that prevents the count from\nreaching zero and the memory from being released.(CVE-2025-39720)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Fix filehandle bounds checking in nfs_fh_to_dentry()\n\nThe function needs to check the minimal filehandle length before it can\naccess the embedded filehandle.(CVE-2025-39730)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup()\n\nA soft lockup warning was observed on a relative small system x86-64\nsystem with 16 GB of memory when running a debug kernel with kmemleak\nenabled.\n\n  watchdog: BUG: soft lockup - CPU#8 stuck for 33s! [kworker/8:1:134]\n\nThe test system was running a workload with hot unplug happening in\nparallel.  Then kemleak decided to disable itself due to its inability to\nallocate more kmemleak objects.  The debug kernel has its\nCONFIG_DEBUG_KMEMLEAK_MEM_POOL_SIZE set to 40,000.\n\nThe soft lockup happened in kmemleak_do_cleanup() when the existing\nkmemleak objects were being removed and deleted one-by-one in a loop via a\nworkqueue.  In this particular case, there are at least 40,000 objects\nthat need to be processed and given the slowness of a debug kernel and the\nfact that a raw_spinlock has to be acquired and released in\n__delete_object(), it could take a while to properly handle all these\nobjects.\n\nAs kmemleak has been disabled in this case, the object removal and\ndeletion process can be further optimized as locking isn\u0026apos;t really needed. \nHowever, it is probably not worth the effort to optimize for such an edge\ncase that should rarely happen.  So the simple solution is to call\ncond_resched() at periodic interval in the iteration loop to avoid soft\nlockup.(CVE-2025-39737)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Fix the setting of capabilities when automounting a new filesystem\n\nCapabilities cannot be inherited when we cross into a new filesystem.\nThey need to be reset to the minimal defaults, and then probed for\nagain.(CVE-2025-39798)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: use array_index_nospec with indices that come from guest\n\nmin and dest_id are guest-controlled indices. Using array_index_nospec()\nafter the bounds checks clamps these values to mitigate speculative execution\nside-channels.(CVE-2025-39823)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\natm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().\n\nsyzbot reported the splat below. [0]\n\nWhen atmtcp_v_open() or atmtcp_v_close() is called via connect()\nor close(), atmtcp_send_control() is called to send an in-kernel\nspecial message.\n\nThe message has ATMTCP_HDR_MAGIC in atmtcp_control.hdr.length.\nAlso, a pointer of struct atm_vcc is set to atmtcp_control.vcc.\n\nThe notable thing is struct atmtcp_control is uAPI but has a\nspace for an in-kernel pointer.\n\n  struct atmtcp_control {\n  \tstruct atmtcp_hdr hdr;\t/* must be first */\n  ...\n  \tatm_kptr_t vcc;\t\t/* both directions */\n  ...\n  } __ATM_API_ALIGN;\n\n  typedef struct { unsigned char _[8]; } __ATM_API_ALIGN atm_kptr_t;\n\nThe special message is processed in atmtcp_recv_control() called\nfrom atmtcp_c_send().\n\natmtcp_c_send() is vcc-\u0026gt;dev-\u0026gt;ops-\u0026gt;send() and called from 2 paths:\n\n  1. .ndo_start_xmit() (vcc-\u0026gt;send() == atm_send_aal0())\n  2. vcc_sendmsg()\n\nThe problem is sendmsg() does not validate the message length and\nuserspace can abuse atmtcp_recv_control() to overwrite any kptr\nby atmtcp_control.\n\nLet\u0026apos;s add a new -\u0026gt;pre_send() hook to validate messages from sendmsg().\n\n[0]:\nOops: general protection fault, probably for non-canonical address 0xdffffc00200000ab: 0000 [#1] SMP KASAN PTI\nKASAN: probably user-memory-access in range [0x0000000100000558-0x000000010000055f]\nCPU: 0 UID: 0 PID: 5865 Comm: syz-executor331 Not tainted 6.17.0-rc1-syzkaller-00215-gbab3ce404553 #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025\nRIP: 0010:atmtcp_recv_control drivers/atm/atmtcp.c:93 [inline]\nRIP: 0010:atmtcp_c_send+0x1da/0x950 drivers/atm/atmtcp.c:297\nCode: 4d 8d 75 1a 4c 89 f0 48 c1 e8 03 42 0f b6 04 20 84 c0 0f 85 15 06 00 00 41 0f b7 1e 4d 8d b7 60 05 00 00 4c 89 f0 48 c1 e8 03 \u0026lt;42\u0026gt; 0f b6 04 20 84 c0 0f 85 13 06 00 00 66 41 89 1e 4d 8d 75 1c 4c\nRSP: 0018:ffffc90003f5f810 EFLAGS: 00010203\nRAX: 00000000200000ab RBX: 0000000000000000 RCX: 0000000000000000\nRDX: ffff88802a510000 RSI: 00000000ffffffff RDI: ffff888030a6068c\nRBP: ffff88802699fb40 R08: ffff888030a606eb R09: 1ffff1100614c0dd\nR10: dffffc0000000000 R11: ffffffff8718fc40 R12: dffffc0000000000\nR13: ffff888030a60680 R14: 000000010000055f R15: 00000000ffffffff\nFS:  00007f8d7e9236c0(0000) GS:ffff888125c1c000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000000000045ad50 CR3: 0000000075bde000 CR4: 00000000003526f0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n vcc_sendmsg+0xa10/0xc60 net/atm/common.c:645\n sock_sendmsg_nosec net/socket.c:714 [inline]\n __sock_sendmsg+0x219/0x270 net/socket.c:729\n ____sys_sendmsg+0x505/0x830 net/socket.c:2614\n ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668\n __sys_sendmsg net/socket.c:2700 [inline]\n __do_sys_sendmsg net/socket.c:2705 [inline]\n __se_sys_sendmsg net/socket.c:2703 [inline]\n __x64_sys_sendmsg+0x19b/0x260 net/socket.c:2703\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f8d7e96a4a9\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f8d7e923198 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\nRAX: ffffffffffffffda RBX: 00007f8d7e9f4308 RCX: 00007f8d7e96a4a9\nRDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000005\nRBP: 00007f8d7e9f4300 R08: 65732f636f72702f R09: 65732f636f72702f\nR10: 65732f636f72702f R11: 0000000000000246 R12: 00007f8d7e9c10ac\nR13: 00007f8d7e9231a0 R14: 0000200000000200 R15: 0000200000000250\n \u0026lt;/TASK\u0026gt;\nModules linked in:(CVE-2025-39828)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: fix OOB read/write in network-coding decode\n\nbatadv_nc_skb_decode_packet() trusts coded_len and checks only against\nskb-\u0026gt;len. XOR starts at sizeof(struct batadv_unicast_packet), reducing\npayload headroom, and the source skb length is not verified, allowing an\nout-of-bounds read and a small out-of-bounds write.\n\nValidate that coded_len fits within the payload area of both destination\nand source sk_buffs before XORing.(CVE-2025-39839)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix race condition validating r_parent before applying state\n\nAdd validation to ensure the cached parent directory inode matches the\ndirectory info in MDS replies. This prevents client-side race conditions\nwhere concurrent operations (e.g. rename) cause r_parent to become stale\nbetween request initiation and reply processing, which could lead to\napplying state changes to incorrect directory inodes.\n\n[ idryomov: folded a kerneldoc fixup and a follow-up fix from Alex to\n  move CEPH_CAP_PIN reference when r_parent is updated:\n\n  When the parent directory lock is not held, req-\u0026gt;r_parent can become\n  stale and is updated to point to the correct inode.  However, the\n  associated CEPH_CAP_PIN reference was not being adjusted.  The\n  CEPH_CAP_PIN is a reference on an inode that is tracked for\n  accounting purposes.  Moving this pin is important to keep the\n  accounting balanced. When the pin was not moved from the old parent\n  to the new one, it created two problems: The reference on the old,\n  stale parent was never released, causing a reference leak.\n  A reference for the new parent was never acquired, creating the risk\n  of a reference underflow later in ceph_mdsc_release_request().  This\n  patch corrects the logic by releasing the pin from the old parent and\n  acquiring it for the new parent when r_parent is switched.  This\n  ensures reference accounting stays balanced. ](CVE-2025-39927)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path\n\nDuring tests of another unrelated patch I was able to trigger this\nerror: Objects remaining on __kmem_cache_shutdown()(CVE-2025-39929)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\num: virtio_uml: Fix use-after-free after put_device in probe\n\nWhen register_virtio_device() fails in virtio_uml_probe(),\nthe code sets vu_dev-\u0026gt;registered = 1 even though\nthe device was not successfully registered.\nThis can lead to use-after-free or other issues.(CVE-2025-39951)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmedia: tuner: xc5000: Fix use-after-free in xc5000_release\n\nThe original code uses cancel_delayed_work() in xc5000_release(), which\ndoes not guarantee that the delayed work item timer_sleep has fully\ncompleted if it was already running. This leads to use-after-free scenarios\nwhere xc5000_release() may free the xc5000_priv while timer_sleep is still\nactive and attempts to dereference the xc5000_priv.\n\nA typical race condition is illustrated below:\n\nCPU 0 (release thread)                 | CPU 1 (delayed work callback)\nxc5000_release()                       | xc5000_do_timer_sleep()\n  cancel_delayed_work()                |\n  hybrid_tuner_release_state(priv)     |\n    kfree(priv)                        |\n                                       |   priv = container_of() // UAF\n\nReplace cancel_delayed_work() with cancel_delayed_work_sync() to ensure\nthat the timer_sleep is properly canceled before the xc5000_priv memory\nis deallocated.\n\nA deadlock concern was considered: xc5000_release() is called in a process\ncontext and is not holding any locks that the timer_sleep work item might\nalso need. Therefore, the use of the _sync() variant is safe here.\n\nThis bug was initially identified through static analysis.\n\n[hverkuil: fix typo in Subject: tunner -\u0026gt; tuner](CVE-2025-39994)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Disallow dirty tracking if incoherent page walk\n\nDirty page tracking relies on the IOMMU atomically updating the dirty bit\nin the paging-structure entry. For this operation to succeed, the paging-\nstructure memory must be coherent between the IOMMU and the CPU. In\nanother word, if the iommu page walk is incoherent, dirty page tracking\ndoesn\u0026apos;t work.\n\nThe Intel VT-d specification, Section 3.10 \u0026quot;Snoop Behavior\u0026quot; states:\n\n\u0026quot;Remapping hardware encountering the need to atomically update A/EA/D bits\n in a paging-structure entry that is not snooped will result in a non-\n recoverable fault.\u0026quot;\n\nTo prevent an IOMMU from being incorrectly configured for dirty page\ntracking when it is operating in an incoherent mode, mark SSADS as\nsupported only when both ecap_slads and ecap_smpwc are supported.(CVE-2025-40058)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Define a proc_layoutcommit for the FlexFiles layout type\n\nAvoid a crash if a pNFS client should happen to send a LAYOUTCOMMIT\noperation on a FlexFiles layout.(CVE-2025-40087)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncifs: parse_dfs_referrals: prevent oob on malformed input\n\nMalicious SMB server can send invalid reply to FSCTL_DFS_GET_REFERRALS\n\n- reply smaller than sizeof(struct get_dfs_referral_rsp)\n- reply with number of referrals smaller than NumberOfReferrals in the\nheader\n\nProcessing of such replies will cause oob.\n\nReturn -EINVAL error on such replies to prevent oob-s.(CVE-2025-40099)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: Fix refcount leak for cifs_sb_tlink\n\nFix three refcount inconsistency issues related to `cifs_sb_tlink`.\n\nComments for `cifs_sb_tlink` state that `cifs_put_tlink()` needs to be\ncalled after successful calls to `cifs_sb_tlink()`. Three calls fail to\nupdate refcount accordingly, leading to possible resource leaks.(CVE-2025-40103)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Fix Use-after-free in validation\n\nNodes stored in the validation duplicates hashtable come from an arena\nallocator that is cleared at the end of vmw_execbuf_process. All nodes\nare expected to be cleared in vmw_validation_drop_ht but this node escaped\nbecause its resource was destroyed prematurely.(CVE-2025-40111)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Clean up only new IRQ glue on request_irq() failure\n\nThe mlx5_irq_alloc() function can inadvertently free the entire rmap\nand end up in a crash[1] when the other threads tries to access this,\nwhen request_irq() fails due to exhausted IRQ vectors. This commit\nmodifies the cleanup to remove only the specific IRQ mapping that was\njust added.\n\nThis prevents removal of other valid mappings and ensures precise\ncleanup of the failed IRQ allocation\u0026apos;s associated glue object.\n\nNote: This error is observed when both fwctl and rds configs are enabled.\n\n[1]\nmlx5_core 0000:05:00.0: Successfully registered panic handler for port 1\nmlx5_core 0000:05:00.0: mlx5_irq_alloc:293:(pid 66740): Failed to\nrequest irq. err = -28\ninfiniband mlx5_0: mlx5_ib_test_wc:290:(pid 66740): Error -28 while\ntrying to test write-combining support\nmlx5_core 0000:05:00.0: Successfully unregistered panic handler for port 1\nmlx5_core 0000:06:00.0: Successfully registered panic handler for port 1\nmlx5_core 0000:06:00.0: mlx5_irq_alloc:293:(pid 66740): Failed to\nrequest irq. err = -28\ninfiniband mlx5_0: mlx5_ib_test_wc:290:(pid 66740): Error -28 while\ntrying to test write-combining support\nmlx5_core 0000:06:00.0: Successfully unregistered panic handler for port 1\nmlx5_core 0000:03:00.0: mlx5_irq_alloc:293:(pid 28895): Failed to\nrequest irq. err = -28\nmlx5_core 0000:05:00.0: mlx5_irq_alloc:293:(pid 28895): Failed to\nrequest irq. err = -28\ngeneral protection fault, probably for non-canonical address\n0xe277a58fde16f291: 0000 [#1] SMP NOPTI\n\nRIP: 0010:free_irq_cpu_rmap+0x23/0x7d\nCall Trace:\n   \u0026lt;TASK\u0026gt;\n   ? show_trace_log_lvl+0x1d6/0x2f9\n   ? show_trace_log_lvl+0x1d6/0x2f9\n   ? mlx5_irq_alloc.cold+0x5d/0xf3 [mlx5_core]\n   ? __die_body.cold+0x8/0xa\n   ? die_addr+0x39/0x53\n   ? exc_general_protection+0x1c4/0x3e9\n   ? dev_vprintk_emit+0x5f/0x90\n   ? asm_exc_general_protection+0x22/0x27\n   ? free_irq_cpu_rmap+0x23/0x7d\n   mlx5_irq_alloc.cold+0x5d/0xf3 [mlx5_core]\n   irq_pool_request_vector+0x7d/0x90 [mlx5_core]\n   mlx5_irq_request+0x2e/0xe0 [mlx5_core]\n   mlx5_irq_request_vector+0xad/0xf7 [mlx5_core]\n   comp_irq_request_pci+0x64/0xf0 [mlx5_core]\n   create_comp_eq+0x71/0x385 [mlx5_core]\n   ? mlx5e_open_xdpsq+0x11c/0x230 [mlx5_core]\n   mlx5_comp_eqn_get+0x72/0x90 [mlx5_core]\n   ? xas_load+0x8/0x91\n   mlx5_comp_irqn_get+0x40/0x90 [mlx5_core]\n   mlx5e_open_channel+0x7d/0x3c7 [mlx5_core]\n   mlx5e_open_channels+0xad/0x250 [mlx5_core]\n   mlx5e_open_locked+0x3e/0x110 [mlx5_core]\n   mlx5e_open+0x23/0x70 [mlx5_core]\n   __dev_open+0xf1/0x1a5\n   __dev_change_flags+0x1e1/0x249\n   dev_change_flags+0x21/0x5c\n   do_setlink+0x28b/0xcc4\n   ? __nla_parse+0x22/0x3d\n   ? inet6_validate_link_af+0x6b/0x108\n   ? cpumask_next+0x1f/0x35\n   ? __snmp6_fill_stats64.constprop.0+0x66/0x107\n   ? __nla_validate_parse+0x48/0x1e6\n   __rtnl_newlink+0x5ff/0xa57\n   ? kmem_cache_alloc_trace+0x164/0x2ce\n   rtnl_newlink+0x44/0x6e\n   rtnetlink_rcv_msg+0x2bb/0x362\n   ? __netlink_sendskb+0x4c/0x6c\n   ? netlink_unicast+0x28f/0x2ce\n   ? rtnl_calcit.isra.0+0x150/0x146\n   netlink_rcv_skb+0x5f/0x112\n   netlink_unicast+0x213/0x2ce\n   netlink_sendmsg+0x24f/0x4d9\n   __sock_sendmsg+0x65/0x6a\n   ____sys_sendmsg+0x28f/0x2c9\n   ? import_iovec+0x17/0x2b\n   ___sys_sendmsg+0x97/0xe0\n   __sys_sendmsg+0x81/0xd8\n   do_syscall_64+0x35/0x87\n   entry_SYSCALL_64_after_hwframe+0x6e/0x0\nRIP: 0033:0x7fc328603727\nCode: c3 66 90 41 54 41 89 d4 55 48 89 f5 53 89 fb 48 83 ec 10 e8 0b ed\nff ff 44 89 e2 48 89 ee 89 df 41 89 c0 b8 2e 00 00 00 0f 05 \u0026lt;48\u0026gt; 3d 00\nf0 ff ff 77 35 44 89 c7 48 89 44 24 08 e8 44 ed ff ff 48\nRSP: 002b:00007ffe8eb3f1a0 EFLAGS: 00000293 ORIG_RAX: 000000000000002e\nRAX: ffffffffffffffda RBX: 000000000000000d RCX: 00007fc328603727\nRDX: 0000000000000000 RSI: 00007ffe8eb3f1f0 RDI: 000000000000000d\nRBP: 00007ffe8eb3f1f0 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000\nR13: 00000000000\n---truncated---(CVE-2025-40250)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()\n\nThe loops in \u0026apos;qede_tpa_cont()\u0026apos; and \u0026apos;qede_tpa_end()\u0026apos;, iterate\nover \u0026apos;cqe-\u0026gt;len_list[]\u0026apos; using only a zero-length terminator as\nthe stopping condition. If the terminator was missing or\nmalformed, the loop could run past the end of the fixed-size array.\n\nAdd an explicit bound check using ARRAY_SIZE() in both loops to prevent\na potential out-of-bounds access.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2025-40252)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: sg: Do not sleep in atomic context\n\nsg_finish_rem_req() calls blk_rq_unmap_user(). The latter function may\nsleep. Hence, call sg_finish_rem_req() with interrupts enabled instead\nof disabled.(CVE-2025-40259)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvme: nvme-fc: Ensure -\u0026gt;ioerr_work is cancelled in nvme_fc_delete_ctrl()\n\nnvme_fc_delete_assocation() waits for pending I/O to complete before\nreturning, and an error can cause -\u0026gt;ioerr_work to be queued after\ncancel_work_sync() had been called.  Move the call to cancel_work_sync() to\nbe after nvme_fc_delete_association() to ensure -\u0026gt;ioerr_work is not running\nwhen the nvme_fc_ctrl object is freed.  Otherwise the following can occur:\n\n[ 1135.911754] list_del corruption, ff2d24c8093f31f8-\u0026gt;next is NULL\n[ 1135.917705] ------------[ cut here ]------------\n[ 1135.922336] kernel BUG at lib/list_debug.c:52!\n[ 1135.926784] Oops: invalid opcode: 0000 [#1] SMP NOPTI\n[ 1135.931851] CPU: 48 UID: 0 PID: 726 Comm: kworker/u449:23 Kdump: loaded Not tainted 6.12.0 #1 PREEMPT(voluntary)\n[ 1135.943490] Hardware name: Dell Inc. PowerEdge R660/0HGTK9, BIOS 2.5.4 01/16/2025\n[ 1135.950969] Workqueue:  0x0 (nvme-wq)\n[ 1135.954673] RIP: 0010:__list_del_entry_valid_or_report.cold+0xf/0x6f\n[ 1135.961041] Code: c7 c7 98 68 72 94 e8 26 45 fe ff 0f 0b 48 c7 c7 70 68 72 94 e8 18 45 fe ff 0f 0b 48 89 fe 48 c7 c7 80 69 72 94 e8 07 45 fe ff \u0026lt;0f\u0026gt; 0b 48 89 d1 48 c7 c7 a0 6a 72 94 48 89 c2 e8 f3 44 fe ff 0f 0b\n[ 1135.979788] RSP: 0018:ff579b19482d3e50 EFLAGS: 00010046\n[ 1135.985015] RAX: 0000000000000033 RBX: ff2d24c8093f31f0 RCX: 0000000000000000\n[ 1135.992148] RDX: 0000000000000000 RSI: ff2d24d6bfa1d0c0 RDI: ff2d24d6bfa1d0c0\n[ 1135.999278] RBP: ff2d24c8093f31f8 R08: 0000000000000000 R09: ffffffff951e2b08\n[ 1136.006413] R10: ffffffff95122ac8 R11: 0000000000000003 R12: ff2d24c78697c100\n[ 1136.013546] R13: fffffffffffffff8 R14: 0000000000000000 R15: ff2d24c78697c0c0\n[ 1136.020677] FS:  0000000000000000(0000) GS:ff2d24d6bfa00000(0000) knlGS:0000000000000000\n[ 1136.028765] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 1136.034510] CR2: 00007fd207f90b80 CR3: 000000163ea22003 CR4: 0000000000f73ef0\n[ 1136.041641] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[ 1136.048776] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400\n[ 1136.055910] PKRU: 55555554\n[ 1136.058623] Call Trace:\n[ 1136.061074]  \u0026lt;TASK\u0026gt;\n[ 1136.063179]  ? show_trace_log_lvl+0x1b0/0x2f0\n[ 1136.067540]  ? show_trace_log_lvl+0x1b0/0x2f0\n[ 1136.071898]  ? move_linked_works+0x4a/0xa0\n[ 1136.075998]  ? __list_del_entry_valid_or_report.cold+0xf/0x6f\n[ 1136.081744]  ? __die_body.cold+0x8/0x12\n[ 1136.085584]  ? die+0x2e/0x50\n[ 1136.088469]  ? do_trap+0xca/0x110\n[ 1136.091789]  ? do_error_trap+0x65/0x80\n[ 1136.095543]  ? __list_del_entry_valid_or_report.cold+0xf/0x6f\n[ 1136.101289]  ? exc_invalid_op+0x50/0x70\n[ 1136.105127]  ? __list_del_entry_valid_or_report.cold+0xf/0x6f\n[ 1136.110874]  ? asm_exc_invalid_op+0x1a/0x20\n[ 1136.115059]  ? __list_del_entry_valid_or_report.cold+0xf/0x6f\n[ 1136.120806]  move_linked_works+0x4a/0xa0\n[ 1136.124733]  worker_thread+0x216/0x3a0\n[ 1136.128485]  ? __pfx_worker_thread+0x10/0x10\n[ 1136.132758]  kthread+0xfa/0x240\n[ 1136.135904]  ? __pfx_kthread+0x10/0x10\n[ 1136.139657]  ret_from_fork+0x31/0x50\n[ 1136.143236]  ? __pfx_kthread+0x10/0x10\n[ 1136.146988]  ret_from_fork_asm+0x1a/0x30\n[ 1136.150915]  \u0026lt;/TASK\u0026gt;(CVE-2025-40261)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbe2net: pass wrb_params in case of OS2BMC\n\nbe_insert_vlan_in_pkt() is called with the wrb_params argument being NULL\nat be_send_pkt_to_bmc() call site.  This may lead to dereferencing a NULL\npointer when processing a workaround for specific packet, as commit\nbc0c3405abbb (\u0026quot;be2net: fix a Tx stall bug caused by a specific ipv6\npacket\u0026quot;) states.\n\nThe correct way would be to pass the wrb_params from be_xmit().(CVE-2025-40264)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncifs: client: fix memory leak in smb3_fs_context_parse_param\n\nThe user calls fsconfig twice, but when the program exits, free() only\nfrees ctx-\u0026gt;source for the second fsconfig, not the first.\nRegarding fc-\u0026gt;source, there is no code in the fs context related to its\nmemory reclamation.\n\nTo fix this memory leak, release the source memory corresponding to ctx\nor fc before each parsing.\n\nsyzbot reported:\nBUG: memory leak\nunreferenced object 0xffff888128afa360 (size 96):\n  backtrace (crc 79c9c7ba):\n    kstrdup+0x3c/0x80 mm/util.c:84\n    smb3_fs_context_parse_param+0x229b/0x36c0 fs/smb/client/fs_context.c:1444\n\nBUG: memory leak\nunreferenced object 0xffff888112c7d900 (size 96):\n  backtrace (crc 79c9c7ba):\n    smb3_fs_context_fullpath+0x70/0x1b0 fs/smb/client/fs_context.c:629\n    smb3_fs_context_parse_param+0x2266/0x36c0 fs/smb/client/fs_context.c:1438(CVE-2025-40268)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: free copynotify stateid in nfs4_free_ol_stateid()\n\nTypically copynotify stateid is freed either when parent\u0026apos;s stateid\nis being close/freed or in nfsd4_laundromat if the stateid hasn\u0026apos;t\nbeen used in a lease period.\n\nHowever, in case when the server got an OPEN (which created\na parent stateid), followed by a COPY_NOTIFY using that stateid,\nfollowed by a client reboot. New client instance while doing\nCREATE_SESSION would force expire previous state of this client.\nIt leads to the open state being freed thru release_openowner-\u0026gt;\nnfs4_free_ol_stateid() and it finds that it still has copynotify\nstateid associated with it. We currently print a warning and is\ntriggerred\n\nWARNING: CPU: 1 PID: 8858 at fs/nfsd/nfs4state.c:1550 nfs4_free_ol_stateid+0xb0/0x100 [nfsd]\n\nThis patch, instead, frees the associated copynotify stateid here.\n\nIf the parent stateid is freed (without freeing the copynotify\nstateids associated with it), it leads to the list corruption\nwhen laundromat ends up freeing the copynotify state later.\n\n[ 1626.839430] Internal error: Oops - BUG: 00000000f2000800 [#1]  SMP\n[ 1626.842828] Modules linked in: nfnetlink_queue nfnetlink_log bluetooth cfg80211 rpcrdma rdma_cm iw_cm ib_cm ib_core nfsd nfs_acl lockd grace nfs_localio ext4 crc16 mbcache jbd2 overlay uinput snd_seq_dummy snd_hrtimer qrtr rfkill vfat fat uvcvideo snd_hda_codec_generic videobuf2_vmalloc videobuf2_memops snd_hda_intel uvc snd_intel_dspcfg videobuf2_v4l2 videobuf2_common snd_hda_codec snd_hda_core videodev snd_hwdep snd_seq mc snd_seq_device snd_pcm snd_timer snd soundcore sg loop auth_rpcgss vsock_loopback vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport vmw_vmci vsock xfs 8021q garp stp llc mrp nvme ghash_ce e1000e nvme_core sr_mod nvme_keyring nvme_auth cdrom vmwgfx drm_ttm_helper ttm sunrpc dm_mirror dm_region_hash dm_log iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi fuse dm_multipath dm_mod nfnetlink\n[ 1626.855594] CPU: 2 UID: 0 PID: 199 Comm: kworker/u24:33 Kdump: loaded Tainted: G    B   W           6.17.0-rc7+ #22 PREEMPT(voluntary)\n[ 1626.857075] Tainted: [B]=BAD_PAGE, [W]=WARN\n[ 1626.857573] Hardware name: VMware, Inc. VMware20,1/VBSA, BIOS VMW201.00V.24006586.BA64.2406042154 06/04/2024\n[ 1626.858724] Workqueue: nfsd4 laundromat_main [nfsd]\n[ 1626.859304] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\n[ 1626.860010] pc : __list_del_entry_valid_or_report+0x148/0x200\n[ 1626.860601] lr : __list_del_entry_valid_or_report+0x148/0x200\n[ 1626.861182] sp : ffff8000881d7a40\n[ 1626.861521] x29: ffff8000881d7a40 x28: 0000000000000018 x27: ffff0000c2a98200\n[ 1626.862260] x26: 0000000000000600 x25: 0000000000000000 x24: ffff8000881d7b20\n[ 1626.862986] x23: ffff0000c2a981e8 x22: 1fffe00012410e7d x21: ffff0000920873e8\n[ 1626.863701] x20: ffff0000920873e8 x19: ffff000086f22998 x18: 0000000000000000\n[ 1626.864421] x17: 20747562202c3839 x16: 3932326636383030 x15: 3030666666662065\n[ 1626.865092] x14: 6220646c756f6873 x13: 0000000000000001 x12: ffff60004fd9e4a3\n[ 1626.865713] x11: 1fffe0004fd9e4a2 x10: ffff60004fd9e4a2 x9 : dfff800000000000\n[ 1626.866320] x8 : 00009fffb0261b5e x7 : ffff00027ecf2513 x6 : 0000000000000001\n[ 1626.866938] x5 : ffff00027ecf2510 x4 : ffff60004fd9e4a3 x3 : 0000000000000000\n[ 1626.867553] x2 : 0000000000000000 x1 : ffff000096069640 x0 : 000000000000006d\n[ 1626.868167] Call trace:\n[ 1626.868382]  __list_del_entry_valid_or_report+0x148/0x200 (P)\n[ 1626.868876]  _free_cpntf_state_locked+0xd0/0x268 [nfsd]\n[ 1626.869368]  nfs4_laundromat+0x6f8/0x1058 [nfsd]\n[ 1626.869813]  laundromat_main+0x24/0x60 [nfsd]\n[ 1626.870231]  process_one_work+0x584/0x1050\n[ 1626.870595]  worker_thread+0x4c4/0xc60\n[ 1626.870893]  kthread+0x2f8/0x398\n[ 1626.871146]  ret_from_fork+0x10/0x20\n[ 1626.871422] Code: aa1303e1 aa1403e3 910e8000 97bc55d7 (d4210000)\n[ 1626.871892] SMP: stopping secondary CPUs(CVE-2025-40273)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: cancel mesh send timer when hdev removed\n\nmesh_send_done timer is not canceled when hdev is removed, which causes\ncrash if the timer triggers after hdev is gone.\n\nCancel the timer when MGMT removes the hdev, like other MGMT timers.\n\nShould fix the BUG: sporadically seen by BlueZ test bot\n(in \u0026quot;Mesh - Send cancel - 1\u0026quot; test).\n\nLog:\n------\nBUG: KASAN: slab-use-after-free in run_timer_softirq+0x76b/0x7d0\n...\nFreed by task 36:\n kasan_save_stack+0x24/0x50\n kasan_save_track+0x14/0x30\n __kasan_save_free_info+0x3a/0x60\n __kasan_slab_free+0x43/0x70\n kfree+0x103/0x500\n device_release+0x9a/0x210\n kobject_put+0x100/0x1e0\n vhci_release+0x18b/0x240\n------(CVE-2025-40284)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds\n\nAdd bounds checking to prevent writes past framebuffer boundaries when\nrendering text near screen edges. Return early if the Y position is off-screen\nand clip image height to screen boundary. Break from the rendering loop if the\nX position is off-screen. When clipping image width to fit the screen, update\nthe character count to match the clipped width to prevent buffer size\nmismatches.\n\nWithout the character count update, bit_putcs_aligned and bit_putcs_unaligned\nreceive mismatched parameters where the buffer is allocated for the clipped\nwidth but cnt reflects the original larger count, causing out-of-bounds writes.(CVE-2025-40304)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\naccel/habanalabs: support mapping cb with vmalloc-backed coherent memory\n\nWhen IOMMU is enabled, dma_alloc_coherent() with GFP_USER may return\naddresses from the vmalloc range. If such an address is mapped without\nVM_MIXEDMAP, vm_insert_page() will trigger a BUG_ON due to the\nVM_PFNMAP restriction.\n\nFix this by checking for vmalloc addresses and setting VM_MIXEDMAP\nin the VMA before mapping. This ensures safe mapping and avoids kernel\ncrashes. The memory is still driver-allocated and cannot be accessed\ndirectly by userspace.(CVE-2025-40311)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: cdns3: gadget: Use-after-free during failed initialization and exit of cdnsp gadget\n\nIn the __cdnsp_gadget_init() and cdnsp_gadget_exit() functions, the gadget\nstructure (pdev-\u0026gt;gadget) was freed before its endpoints.\nThe endpoints are linked via the ep_list in the gadget structure.\nFreeing the gadget first leaves dangling pointers in the endpoint list.\nWhen the endpoints are subsequently freed, this results in a use-after-free.\n\nFix:\nBy separating the usb_del_gadget_udc() operation into distinct \u0026quot;del\u0026quot; and\n\u0026quot;put\u0026quot; steps, cdnsp_gadget_free_endpoints() can be executed prior to the\nfinal release of the gadget structure with usb_put_gadget().\n\nA patch similar to bb9c74a5bd14(\u0026quot;usb: dwc3: gadget: Free gadget structure\n only after freeing endpoints\u0026quot;).(CVE-2025-40314)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Sync pending IRQ work before freeing ring buffer\n\nFix a race where irq_work can be queued in bpf_ringbuf_commit()\nbut the ring buffer is freed before the work executes.\nIn the syzbot reproducer, a BPF program attached to sched_switch\ntriggers bpf_ringbuf_commit(), queuing an irq_work. If the ring buffer\nis freed before this work executes, the irq_work thread may accesses\nfreed memory.\nCalling `irq_work_sync(\u0026amp;rb-\u0026gt;work)` ensures that all pending irq_work\ncomplete before freeing the buffer.(CVE-2025-40319)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix potential cfid UAF in smb2_query_info_compound\n\nWhen smb2_query_info_compound() retries, a previously allocated cfid may\nhave been freed in the first attempt.\nBecause cfid wasn\u0026apos;t reset on replay, later cleanup could act on a stale\npointer, leading to a potential use-after-free.\n\nReinitialize cfid to NULL under the replay label.\n\nExample trace (trimmed):\n\nrefcount_t: underflow; use-after-free.\nWARNING: CPU: 1 PID: 11224 at ../lib/refcount.c:28 refcount_warn_saturate+0x9c/0x110\n[...]\nRIP: 0010:refcount_warn_saturate+0x9c/0x110\n[...]\nCall Trace:\n \u0026lt;TASK\u0026gt;\n smb2_query_info_compound+0x29c/0x5c0 [cifs f90b72658819bd21c94769b6a652029a07a7172f]\n ? step_into+0x10d/0x690\n ? __legitimize_path+0x28/0x60\n smb2_queryfs+0x6a/0xf0 [cifs f90b72658819bd21c94769b6a652029a07a7172f]\n smb311_queryfs+0x12d/0x140 [cifs f90b72658819bd21c94769b6a652029a07a7172f]\n ? kmem_cache_alloc+0x18a/0x340\n ? getname_flags+0x46/0x1e0\n cifs_statfs+0x9f/0x2b0 [cifs f90b72658819bd21c94769b6a652029a07a7172f]\n statfs_by_dentry+0x67/0x90\n vfs_statfs+0x16/0xd0\n user_statfs+0x54/0xa0\n __do_sys_statfs+0x20/0x50\n do_syscall_64+0x58/0x80(CVE-2025-40320)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: bitblit: bound-check glyph index in bit_putcs*\n\nbit_putcs_aligned()/unaligned() derived the glyph pointer from the\ncharacter value masked by 0xff/0x1ff, which may exceed the actual font\u0026apos;s\nglyph count and read past the end of the built-in font array.\nClamp the index to the actual glyph count before computing the address.\n\nThis fixes a global out-of-bounds read reported by syzbot.(CVE-2025-40322)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Fix crash in nfsd4_read_release()\n\nWhen tracing is enabled, the trace_nfsd_read_done trace point\ncrashes during the pynfs read.testNoFh test.(CVE-2025-40324)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix potential UAF in smb2_close_cached_fid()\n\nfind_or_create_cached_dir() could grab a new reference after kref_put()\nhad seen the refcount drop to zero but before cfid_list_lock is acquired\nin smb2_close_cached_fid(), leading to use-after-free.\n\nSwitch to kref_put_lock() so cfid_release() is called with\ncfid_list_lock held, closing that gap.(CVE-2025-40328)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: storage: sddr55: Reject out-of-bound new_pba\n\nDiscovered by Atuin - Automated Vulnerability Discovery Engine.\n\nnew_pba comes from the status packet returned after each write.\nA bogus device could report values beyond the block count derived\nfrom info-\u0026gt;capacity, letting the driver walk off the end of\npba_to_lba[] and corrupt heap memory.\n\nReject PBAs that exceed the computed block count and fail the\ntransfer so we avoid touching out-of-range mapping entries.(CVE-2025-40345)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ\n\nXDP programs can change the layout of an xdp_buff through\nbpf_xdp_adjust_tail() and bpf_xdp_adjust_head(). Therefore, the driver\ncannot assume the size of the linear data area nor fragments. Fix the\nbug in mlx5 by generating skb according to xdp_buff after XDP programs\nrun.\n\nCurrently, when handling multi-buf XDP, the mlx5 driver assumes the\nlayout of an xdp_buff to be unchanged. That is, the linear data area\ncontinues to be empty and fragments remain the same. This may cause\nthe driver to generate erroneous skb or triggering a kernel\nwarning. When an XDP program added linear data through\nbpf_xdp_adjust_head(), the linear data will be ignored as\nmlx5e_build_linear_skb() builds an skb without linear data and then\npull data from fragments to fill the linear data area. When an XDP\nprogram has shrunk the non-linear data through bpf_xdp_adjust_tail(),\nthe delta passed to __pskb_pull_tail() may exceed the actual nonlinear\ndata size and trigger the BUG_ON in it.\n\nTo fix the issue, first record the original number of fragments. If the\nnumber of fragments changes after the XDP program runs, rewind the end\nfragment pointer by the difference and recalculate the truesize. Then,\nbuild the skb with the linear data area matching the xdp_buff. Finally,\nonly pull data in if there is non-linear data and fill the linear part\nup to 256 bytes.(CVE-2025-40350)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/sysfb: Do not dereference NULL pointer in plane reset\n\nThe plane state in __drm_gem_reset_shadow_plane() can be NULL. Do not\nderef that pointer, but forward NULL to the other plane-reset helpers.\nClears plane-\u0026gt;state to NULL.\n\nv2:\n- fix typo in commit description (Javier)(CVE-2025-40360)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: fix field-spanning memcpy warning in AH output\n\nFix field-spanning memcpy warnings in ah6_output() and\nah6_output_done() where extension headers are copied to/from IPv6\naddress fields, triggering fortify-string warnings about writes beyond\nthe 16-byte address fields.\n\n  memcpy: detected field-spanning write (size 40) of single field \u0026quot;\u0026amp;top_iph-\u0026gt;saddr\u0026quot; at net/ipv6/ah6.c:439 (size 16)\n  WARNING: CPU: 0 PID: 8838 at net/ipv6/ah6.c:439 ah6_output+0xe7e/0x14e0 net/ipv6/ah6.c:439\n\nThe warnings are false positives as the extension headers are\nintentionally placed after the IPv6 header in memory. Fix by properly\ncopying addresses and extension headers separately, and introduce\nhelper functions to avoid code duplication.(CVE-2025-40363)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nblk-cgroup: fix possible deadlock while configuring policy\n\nFollowing deadlock can be triggered easily by lockdep:\n\nWARNING: possible circular locking dependency detected\n6.17.0-rc3-00124-ga12c2658ced0 #1665 Not tainted\n------------------------------------------------------\ncheck/1334 is trying to acquire lock:\nff1100011d9d0678 (\u0026amp;q-\u0026gt;sysfs_lock){+.+.}-{4:4}, at: blk_unregister_queue+0x53/0x180\n\nbut task is already holding lock:\nff1100011d9d00e0 (\u0026amp;q-\u0026gt;q_usage_counter(queue)#3){++++}-{0:0}, at: del_gendisk+0xba/0x110\n\nwhich lock already depends on the new lock.\n\nthe existing dependency chain (in reverse order) is:\n\n-\u0026gt; #2 (\u0026amp;q-\u0026gt;q_usage_counter(queue)#3){++++}-{0:0}:\n       blk_queue_enter+0x40b/0x470\n       blkg_conf_prep+0x7b/0x3c0\n       tg_set_limit+0x10a/0x3e0\n       cgroup_file_write+0xc6/0x420\n       kernfs_fop_write_iter+0x189/0x280\n       vfs_write+0x256/0x490\n       ksys_write+0x83/0x190\n       __x64_sys_write+0x21/0x30\n       x64_sys_call+0x4608/0x4630\n       do_syscall_64+0xdb/0x6b0\n       entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\n-\u0026gt; #1 (\u0026amp;q-\u0026gt;rq_qos_mutex){+.+.}-{4:4}:\n       __mutex_lock+0xd8/0xf50\n       mutex_lock_nested+0x2b/0x40\n       wbt_init+0x17e/0x280\n       wbt_enable_default+0xe9/0x140\n       blk_register_queue+0x1da/0x2e0\n       __add_disk+0x38c/0x5d0\n       add_disk_fwnode+0x89/0x250\n       device_add_disk+0x18/0x30\n       virtblk_probe+0x13a3/0x1800\n       virtio_dev_probe+0x389/0x610\n       really_probe+0x136/0x620\n       __driver_probe_device+0xb3/0x230\n       driver_probe_device+0x2f/0xe0\n       __driver_attach+0x158/0x250\n       bus_for_each_dev+0xa9/0x130\n       driver_attach+0x26/0x40\n       bus_add_driver+0x178/0x3d0\n       driver_register+0x7d/0x1c0\n       __register_virtio_driver+0x2c/0x60\n       virtio_blk_init+0x6f/0xe0\n       do_one_initcall+0x94/0x540\n       kernel_init_freeable+0x56a/0x7b0\n       kernel_init+0x2b/0x270\n       ret_from_fork+0x268/0x4c0\n       ret_from_fork_asm+0x1a/0x30\n\n-\u0026gt; #0 (\u0026amp;q-\u0026gt;sysfs_lock){+.+.}-{4:4}:\n       __lock_acquire+0x1835/0x2940\n       lock_acquire+0xf9/0x450\n       __mutex_lock+0xd8/0xf50\n       mutex_lock_nested+0x2b/0x40\n       blk_unregister_queue+0x53/0x180\n       __del_gendisk+0x226/0x690\n       del_gendisk+0xba/0x110\n       sd_remove+0x49/0xb0 [sd_mod]\n       device_remove+0x87/0xb0\n       device_release_driver_internal+0x11e/0x230\n       device_release_driver+0x1a/0x30\n       bus_remove_device+0x14d/0x220\n       device_del+0x1e1/0x5a0\n       __scsi_remove_device+0x1ff/0x2f0\n       scsi_remove_device+0x37/0x60\n       sdev_store_delete+0x77/0x100\n       dev_attr_store+0x1f/0x40\n       sysfs_kf_write+0x65/0x90\n       kernfs_fop_write_iter+0x189/0x280\n       vfs_write+0x256/0x490\n       ksys_write+0x83/0x190\n       __x64_sys_write+0x21/0x30\n       x64_sys_call+0x4608/0x4630\n       do_syscall_64+0xdb/0x6b0\n       entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nother info that might help us debug this:\n\nChain exists of:\n  \u0026amp;q-\u0026gt;sysfs_lock --\u0026gt; \u0026amp;q-\u0026gt;rq_qos_mutex --\u0026gt; \u0026amp;q-\u0026gt;q_usage_counter(queue)#3\n\n Possible unsafe locking scenario:\n\n       CPU0                    CPU1\n       ----                    ----\n  lock(\u0026amp;q-\u0026gt;q_usage_counter(queue)#3);\n                               lock(\u0026amp;q-\u0026gt;rq_qos_mutex);\n                               lock(\u0026amp;q-\u0026gt;q_usage_counter(queue)#3);\n  lock(\u0026amp;q-\u0026gt;sysfs_lock);\n\nRoot cause is that queue_usage_counter is grabbed with rq_qos_mutex\nheld in blkg_conf_prep(), while queue should be freezed before\nrq_qos_mutex from other context.\n\nThe blk_queue_enter() from blkg_conf_prep() is used to protect against\npolicy deactivation, which is already protected with blkcg_mutex, hence\nconvert blk_queue_enter() to blkcg_mutex to fix this problem. Meanwhile,\nconsider that blkcg_mutex is held after queue is freezed from policy\ndeactivation, also convert blkg_alloc() to use GFP_NOIO.(CVE-2025-68178)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/mediatek: Disable AFBC support on Mediatek DRM driver\n\nCommit c410fa9b07c3 (\u0026quot;drm/mediatek: Add AFBC support to Mediatek DRM\ndriver\u0026quot;) added AFBC support to Mediatek DRM and enabled the\n32x8/split/sparse modifier.\n\nHowever, this is currently broken on Mediatek MT8188 (Genio 700 EVK\nplatform); tested using upstream Kernel and Mesa (v25.2.1), AFBC is used by\ndefault since Mesa v25.0.\n\nKernel trace reports vblank timeouts constantly, and the render is garbled:\n\n```\n[CRTC:62:crtc-0] vblank wait timed out\nWARNING: CPU: 7 PID: 70 at drivers/gpu/drm/drm_atomic_helper.c:1835 drm_atomic_helper_wait_for_vblanks.part.0+0x24c/0x27c\n[...]\nHardware name: MediaTek Genio-700 EVK (DT)\nWorkqueue: events_unbound commit_work\npstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : drm_atomic_helper_wait_for_vblanks.part.0+0x24c/0x27c\nlr : drm_atomic_helper_wait_for_vblanks.part.0+0x24c/0x27c\nsp : ffff80008337bca0\nx29: ffff80008337bcd0 x28: 0000000000000061 x27: 0000000000000000\nx26: 0000000000000001 x25: 0000000000000000 x24: ffff0000c9dcc000\nx23: 0000000000000001 x22: 0000000000000000 x21: ffff0000c66f2f80\nx20: ffff0000c0d7d880 x19: 0000000000000000 x18: 000000000000000a\nx17: 000000040044ffff x16: 005000f2b5503510 x15: 0000000000000000\nx14: 0000000000000000 x13: 74756f2064656d69 x12: 742074696177206b\nx11: 0000000000000058 x10: 0000000000000018 x9 : ffff800082396a70\nx8 : 0000000000057fa8 x7 : 0000000000000cce x6 : ffff8000823eea70\nx5 : ffff0001fef5f408 x4 : ffff80017ccee000 x3 : ffff0000c12cb480\nx2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000c12cb480\nCall trace:\n drm_atomic_helper_wait_for_vblanks.part.0+0x24c/0x27c (P)\n drm_atomic_helper_commit_tail_rpm+0x64/0x80\n commit_tail+0xa4/0x1a4\n commit_work+0x14/0x20\n process_one_work+0x150/0x290\n worker_thread+0x2d0/0x3ec\n kthread+0x12c/0x210\n ret_from_fork+0x10/0x20\n---[ end trace 0000000000000000 ]---\n```\n\nUntil this gets fixed upstream, disable AFBC support on this platform, as\nit\u0026apos;s currently broken with upstream Mesa.(CVE-2025-68184)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnfs4_setup_readdir(): insufficient locking for -\u0026gt;d_parent-\u0026gt;d_inode dereferencing\n\nTheoretically it\u0026apos;s an oopsable race, but I don\u0026apos;t believe one can manage\nto hit it on real hardware; might become doable on a KVM, but it still\nwon\u0026apos;t be easy to attack.\n\nAnyway, it\u0026apos;s easy to deal with - since xdr_encode_hyper() is just a call of\nput_unaligned_be64(), we can put that under -\u0026gt;d_lock and be done with that.(CVE-2025-68185)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nudp_tunnel: use netdev_warn() instead of netdev_WARN()\n\nnetdev_WARN() uses WARN/WARN_ON to print a backtrace along with\nfile and line information. In this case, udp_tunnel_nic_register()\nreturning an error is just a failed operation, not a kernel bug.\n\nudp_tunnel_nic_register() can fail due to a memory allocation\nfailure (kzalloc() or udp_tunnel_nic_alloc()).\nThis is a normal runtime error and not a kernel bug.\n\nReplace netdev_WARN() with netdev_warn() accordingly.(CVE-2025-68191)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvme-multipath: fix lockdep WARN due to partition scan work\n\nBlktests test cases nvme/014, 057 and 058 fail occasionally due to a\nlockdep WARN. As reported in the Closes tag URL, the WARN indicates that\na deadlock can happen due to the dependency among disk-\u0026gt;open_mutex,\nkblockd workqueue completion and partition_scan_work completion.\n\nTo avoid the lockdep WARN and the potential deadlock, cut the dependency\nby running the partition_scan_work not by kblockd workqueue but by\nnvme_wq.(CVE-2025-68218)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncifs: fix memory leak in smb3_fs_context_parse_param error path\n\nAdd proper cleanup of ctx-\u0026gt;source and fc-\u0026gt;source to the\ncifs_parse_mount_err error handler. This ensures that memory allocated\nfor the source strings is correctly freed on all error paths, matching\nthe cleanup already performed in the success path by\nsmb3_cleanup_fs_context_contents().\nPointers are also set to NULL after freeing to prevent potential\ndouble-free issues.\n\nThis change fixes a memory leak originally detected by syzbot. The\nleak occurred when processing Opt_source mount options if an error\nhappened after ctx-\u0026gt;source and fc-\u0026gt;source were successfully\nallocated but before the function completed.\n\nThe specific leak sequence was:\n1. ctx-\u0026gt;source = smb3_fs_context_fullpath(ctx, \u0026apos;/\u0026apos;) allocates memory\n2. fc-\u0026gt;source = kstrdup(ctx-\u0026gt;source, GFP_KERNEL) allocates more memory\n3. A subsequent error jumps to cifs_parse_mount_err\n4. The old error handler freed passwords but not the source strings,\ncausing the memory to leak.\n\nThis issue was not addressed by commit e8c73eb7db0a (\u0026quot;cifs: client:\nfix memory leak in smb3_fs_context_parse_param\u0026quot;), which only fixed\nleaks from repeated fsconfig() calls but not this error path.\n\nPatch updated with minor change suggested by kernel test robot(CVE-2025-68219)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show()\n\nIf the allocation of tl_hba-\u0026gt;sh fails in tcm_loop_driver_probe() and we\nattempt to dereference it in tcm_loop_tpg_address_show() we will get a\nsegfault, see below for an example. So, check tl_hba-\u0026gt;sh before\ndereferencing it.\n\n  Unable to allocate struct scsi_host\n  BUG: kernel NULL pointer dereference, address: 0000000000000194\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  PGD 0 P4D 0\n  Oops: 0000 [#1] PREEMPT SMP NOPTI\n  CPU: 1 PID: 8356 Comm: tokio-runtime-w Not tainted 6.6.104.2-4.azl3 #1\n  Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 09/28/2024\n  RIP: 0010:tcm_loop_tpg_address_show+0x2e/0x50 [tcm_loop]\n...\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   configfs_read_iter+0x12d/0x1d0 [configfs]\n   vfs_read+0x1b5/0x300\n   ksys_read+0x6f/0xf0\n...(CVE-2025-68229)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbinfmt_misc: restore write access before closing files opened by open_exec()\n\nbm_register_write() opens an executable file using open_exec(), which\ninternally calls do_open_execat() and denies write access on the file to\navoid modification while it is being executed.\n\nHowever, when an error occurs, bm_register_write() closes the file using\nfilp_close() directly. This does not restore the write permission, which\nmay cause subsequent write operations on the same file to fail.\n\nFix this by calling exe_file_allow_write_access() before filp_close() to\nrestore the write permission properly.(CVE-2025-68239)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe\n\nThe sit driver\u0026apos;s packet transmission path calls: sit_tunnel_xmit() -\u0026gt;\nupdate_or_create_fnhe(), which lead to fnhe_remove_oldest() being called\nto delete entries exceeding FNHE_RECLAIM_DEPTH+random.\n\nThe race window is between fnhe_remove_oldest() selecting fnheX for\ndeletion and the subsequent kfree_rcu(). During this time, the\nconcurrent path\u0026apos;s __mkroute_output() -\u0026gt; find_exception() can fetch the\nsoon-to-be-deleted fnheX, and rt_bind_exception() then binds it with a\nnew dst using a dst_hold(). When the original fnheX is freed via RCU,\nthe dst reference remains permanently leaked.\n\nCPU 0                             CPU 1\n__mkroute_output()\n  find_exception() [fnheX]\n                                  update_or_create_fnhe()\n                                    fnhe_remove_oldest() [fnheX]\n  rt_bind_exception() [bind dst]\n                                  RCU callback [fnheX freed, dst leak]\n\nThis issue manifests as a device reference count leak and a warning in\ndmesg when unregistering the net device:\n\n  unregister_netdevice: waiting for sitX to become free. Usage count = N\n\nIdo Schimmel provided the simple test validation method [1].\n\nThe fix clears \u0026apos;oldest-\u0026gt;fnhe_daddr\u0026apos; before calling fnhe_flush_routes().\nSince rt_bind_exception() checks this field, setting it to zero prevents\nthe stale fnhe from being reused and bound to a new dst just before it\nis freed.\n\n[1]\nip netns add ns1\nip -n ns1 link set dev lo up\nip -n ns1 address add 192.0.2.1/32 dev lo\nip -n ns1 link add name dummy1 up type dummy\nip -n ns1 route add 192.0.2.2/32 dev dummy1\nip -n ns1 link add name gretap1 up arp off type gretap \\\n    local 192.0.2.1 remote 192.0.2.2\nip -n ns1 route add 198.51.0.0/16 dev gretap1\ntaskset -c 0 ip netns exec ns1 mausezahn gretap1 \\\n    -A 198.51.100.1 -B 198.51.0.0/16 -t udp -p 1000 -c 0 -q \u0026amp;\ntaskset -c 2 ip netns exec ns1 mausezahn gretap1 \\\n    -A 198.51.100.1 -B 198.51.0.0/16 -t udp -p 1000 -c 0 -q \u0026amp;\nsleep 10\nip netns pids ns1 | xargs kill\nip netns del ns1(CVE-2025-68241)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: netpoll: fix incorrect refcount handling causing incorrect cleanup\n\ncommit efa95b01da18 (\u0026quot;netpoll: fix use after free\u0026quot;) incorrectly\nignored the refcount and prematurely set dev-\u0026gt;npinfo to NULL during\nnetpoll cleanup, leading to improper behavior and memory leaks.\n\nScenario causing lack of proper cleanup:\n\n1) A netpoll is associated with a NIC (e.g., eth0) and netdev-\u0026gt;npinfo is\n   allocated, and refcnt = 1\n   - Keep in mind that npinfo is shared among all netpoll instances. In\n     this case, there is just one.\n\n2) Another netpoll is also associated with the same NIC and\n   npinfo-\u0026gt;refcnt += 1.\n   - Now dev-\u0026gt;npinfo-\u0026gt;refcnt = 2;\n   - There is just one npinfo associated to the netdev.\n\n3) When the first netpolls goes to clean up:\n   - The first cleanup succeeds and clears np-\u0026gt;dev-\u0026gt;npinfo, ignoring\n     refcnt.\n     - It basically calls `RCU_INIT_POINTER(np-\u0026gt;dev-\u0026gt;npinfo, NULL);`\n   - Set dev-\u0026gt;npinfo = NULL, without proper cleanup\n   - No -\u0026gt;ndo_netpoll_cleanup() is either called\n\n4) Now the second target tries to clean up\n   - The second cleanup fails because np-\u0026gt;dev-\u0026gt;npinfo is already NULL.\n     * In this case, ops-\u0026gt;ndo_netpoll_cleanup() was never called, and\n       the skb pool is not cleaned as well (for the second netpoll\n       instance)\n  - This leaks npinfo and skbpool skbs, which is clearly reported by\n    kmemleak.\n\nRevert commit efa95b01da18 (\u0026quot;netpoll: fix use after free\u0026quot;) and adds\nclarifying comments emphasizing that npinfo cleanup should only happen\nonce the refcount reaches zero, ensuring stable and correct netpoll\nbehavior.(CVE-2025-68245)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nerofs: avoid infinite loops due to corrupted subpage compact indexes\n\nRobert reported an infinite loop observed by two crafted images.\n\nThe root cause is that `clusterofs` can be larger than `lclustersize`\nfor !NONHEAD `lclusters` in corrupted subpage compact indexes, e.g.:\n\n  blocksize = lclustersize = 512   lcn = 6   clusterofs = 515\n\nMove the corresponding check for full compress indexes to\n`z_erofs_load_lcluster_from_disk()` to also cover subpage compact\ncompress indexes.\n\nIt also fixes the position of `m-\u0026gt;type \u0026gt;= Z_EROFS_LCLUSTER_TYPE_MAX`\ncheck, since it should be placed right after\n`z_erofs_load_{compact,full}_lcluster()`.(CVE-2025-68251)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: storage: Fix memory leak in USB bulk transport\n\nA kernel memory leak was identified by the \u0026apos;ioctl_sg01\u0026apos; test from Linux\nTest Project (LTP). The following bytes were mainly observed: 0x53425355.\n\nWhen USB storage devices incorrectly skip the data phase with status data,\nthe code extracts/validates the CSW from the sg buffer, but fails to clear\nit afterwards. This leaves status protocol data in srb\u0026apos;s transfer buffer,\nsuch as the US_BULK_CS_SIGN \u0026apos;USBS\u0026apos; signature observed here. Thus, this can\nlead to USB protocols leaks to user space through SCSI generic (/dev/sg*)\ninterfaces, such as the one seen here when the LTP test requested 512 KiB.\n\nFix the leak by zeroing the CSW data in srb\u0026apos;s transfer buffer immediately\nafter the validation of devices that skip data phase.\n\nNote: Differently from CVE-2018-1000204, which fixed a big leak by zero-\ning pages at allocation time, this leak occurs after allocation, when USB\nprotocol data is written to already-allocated sg pages.(CVE-2025-68288)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix memory leak in cifs_construct_tcon()\n\nWhen having a multiuser mount with domain= specified and using\ncifscreds, cifs_set_cifscreds() will end up setting @ctx-\u0026gt;domainname,\nso it needs to be freed before leaving cifs_construct_tcon().\n\nThis fixes the following memory leak reported by kmemleak:\n\n  mount.cifs //srv/share /mnt -o domain=ZELDA,multiuser,...\n  su - testuser\n  cifscreds add -d ZELDA -u testuser\n  ...\n  ls /mnt/1\n  ...\n  umount /mnt\n  echo scan \u0026gt; /sys/kernel/debug/kmemleak\n  cat /sys/kernel/debug/kmemleak\n  unreferenced object 0xffff8881203c3f08 (size 8):\n    comm \u0026quot;ls\u0026quot;, pid 5060, jiffies 4307222943\n    hex dump (first 8 bytes):\n      5a 45 4c 44 41 00 cc cc                          ZELDA...\n    backtrace (crc d109a8cf):\n      __kmalloc_node_track_caller_noprof+0x572/0x710\n      kstrdup+0x3a/0x70\n      cifs_sb_tlink+0x1209/0x1770 [cifs]\n      cifs_get_fattr+0xe1/0xf50 [cifs]\n      cifs_get_inode_info+0xb5/0x240 [cifs]\n      cifs_revalidate_dentry_attr+0x2d1/0x470 [cifs]\n      cifs_getattr+0x28e/0x450 [cifs]\n      vfs_getattr_nosec+0x126/0x180\n      vfs_statx+0xf6/0x220\n      do_statx+0xab/0x110\n      __x64_sys_statx+0xd5/0x130\n      do_syscall_64+0xbb/0x380\n      entry_SYSCALL_64_after_hwframe+0x77/0x7f(CVE-2025-68295)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup\n\nProtect vga_switcheroo_client_fb_set() with console lock. Avoids OOB\naccess in fbcon_remap_all(). Without holding the console lock the call\nraces with switching outputs.\n\nVGA switcheroo calls fbcon_remap_all() when switching clients. The fbcon\nfunction uses struct fb_info.node, which is set by register_framebuffer().\nAs the fb-helper code currently sets up VGA switcheroo before registering\nthe framebuffer, the value of node is -1 and therefore not a legal value.\nFor example, fbcon uses the value within set_con2fb_map() [1] as an index\ninto an array.\n\nMoving vga_switcheroo_client_fb_set() after register_framebuffer() can\nresult in VGA switching that does not switch fbcon correctly.\n\nTherefore move vga_switcheroo_client_fb_set() under fbcon_fb_registered(),\nwhich already holds the console lock. Fbdev calls fbcon_fb_registered()\nfrom within register_framebuffer(). Serializes the helper with VGA\nswitcheroo\u0026apos;s call to fbcon_remap_all().\n\nAlthough vga_switcheroo_client_fb_set() takes an instance of struct fb_info\nas parameter, it really only needs the contained fbcon state. Moving the\ncall to fbcon initialization is therefore cleaner than before. Only amdgpu,\ni915, nouveau and radeon support vga_switcheroo. For all other drivers,\nthis change does nothing.(CVE-2025-68296)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sock: Prevent race in socket write iter and sock bind\n\nThere is a potential race condition between sock bind and socket write\niter. bind may free the same cmd via mgmt_pending before write iter sends\nthe cmd, just as syzbot reported in UAF[1].\n\nHere we use hci_dev_lock to synchronize the two, thereby avoiding the\nUAF mentioned in [1].\n\n[1]\nsyzbot reported:\nBUG: KASAN: slab-use-after-free in mgmt_pending_remove+0x3b/0x210 net/bluetooth/mgmt_util.c:316\nRead of size 8 at addr ffff888077164818 by task syz.0.17/5989\nCall Trace:\n mgmt_pending_remove+0x3b/0x210 net/bluetooth/mgmt_util.c:316\n set_link_security+0x5c2/0x710 net/bluetooth/mgmt.c:1918\n hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719\n hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839\n sock_sendmsg_nosec net/socket.c:727 [inline]\n __sock_sendmsg+0x21c/0x270 net/socket.c:742\n sock_write_iter+0x279/0x360 net/socket.c:1195\n\nAllocated by task 5989:\n mgmt_pending_add+0x35/0x140 net/bluetooth/mgmt_util.c:296\n set_link_security+0x557/0x710 net/bluetooth/mgmt.c:1910\n hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719\n hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839\n sock_sendmsg_nosec net/socket.c:727 [inline]\n __sock_sendmsg+0x21c/0x270 net/socket.c:742\n sock_write_iter+0x279/0x360 net/socket.c:1195\n\nFreed by task 5991:\n mgmt_pending_free net/bluetooth/mgmt_util.c:311 [inline]\n mgmt_pending_foreach+0x30d/0x380 net/bluetooth/mgmt_util.c:257\n mgmt_index_removed+0x112/0x2f0 net/bluetooth/mgmt.c:9477\n hci_sock_bind+0xbe9/0x1000 net/bluetooth/hci_sock.c:1314(CVE-2025-68305)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ns390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump\n\nDo not block PCI config accesses through pci_cfg_access_lock() when\nexecuting the s390 variant of PCI error recovery: Acquire just\ndevice_lock() instead of pci_dev_lock() as powerpc\u0026apos;s EEH and\ngenerig PCI AER processing do.\n\nDuring error recovery testing a pair of tasks was reported to be hung:\n\nmlx5_core 0000:00:00.1: mlx5_health_try_recover:338:(pid 5553): health recovery flow aborted, PCI reads still not working\nINFO: task kmcheck:72 blocked for more than 122 seconds.\n      Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1\n\u0026quot;echo 0 \u0026gt; /proc/sys/kernel/hung_task_timeout_secs\u0026quot; disables this message.\ntask:kmcheck         state:D stack:0     pid:72    tgid:72    ppid:2      flags:0x00000000\nCall Trace:\n [\u0026lt;000000065256f030\u0026gt;] __schedule+0x2a0/0x590\n [\u0026lt;000000065256f356\u0026gt;] schedule+0x36/0xe0\n [\u0026lt;000000065256f572\u0026gt;] schedule_preempt_disabled+0x22/0x30\n [\u0026lt;0000000652570a94\u0026gt;] __mutex_lock.constprop.0+0x484/0x8a8\n [\u0026lt;000003ff800673a4\u0026gt;] mlx5_unload_one+0x34/0x58 [mlx5_core]\n [\u0026lt;000003ff8006745c\u0026gt;] mlx5_pci_err_detected+0x94/0x140 [mlx5_core]\n [\u0026lt;0000000652556c5a\u0026gt;] zpci_event_attempt_error_recovery+0xf2/0x398\n [\u0026lt;0000000651b9184a\u0026gt;] __zpci_event_error+0x23a/0x2c0\nINFO: task kworker/u1664:6:1514 blocked for more than 122 seconds.\n      Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1\n\u0026quot;echo 0 \u0026gt; /proc/sys/kernel/hung_task_timeout_secs\u0026quot; disables this message.\ntask:kworker/u1664:6 state:D stack:0     pid:1514  tgid:1514  ppid:2      flags:0x00000000\nWorkqueue: mlx5_health0000:00:00.0 mlx5_fw_fatal_reporter_err_work [mlx5_core]\nCall Trace:\n [\u0026lt;000000065256f030\u0026gt;] __schedule+0x2a0/0x590\n [\u0026lt;000000065256f356\u0026gt;] schedule+0x36/0xe0\n [\u0026lt;0000000652172e28\u0026gt;] pci_wait_cfg+0x80/0xe8\n [\u0026lt;0000000652172f94\u0026gt;] pci_cfg_access_lock+0x74/0x88\n [\u0026lt;000003ff800916b6\u0026gt;] mlx5_vsc_gw_lock+0x36/0x178 [mlx5_core]\n [\u0026lt;000003ff80098824\u0026gt;] mlx5_crdump_collect+0x34/0x1c8 [mlx5_core]\n [\u0026lt;000003ff80074b62\u0026gt;] mlx5_fw_fatal_reporter_dump+0x6a/0xe8 [mlx5_core]\n [\u0026lt;0000000652512242\u0026gt;] devlink_health_do_dump.part.0+0x82/0x168\n [\u0026lt;0000000652513212\u0026gt;] devlink_health_report+0x19a/0x230\n [\u0026lt;000003ff80075a12\u0026gt;] mlx5_fw_fatal_reporter_err_work+0xba/0x1b0 [mlx5_core]\n\nNo kernel log of the exact same error with an upstream kernel is\navailable - but the very same deadlock situation can be constructed there,\ntoo:\n\n- task: kmcheck\n  mlx5_unload_one() tries to acquire devlink lock while the PCI error\n  recovery code has set pdev-\u0026gt;block_cfg_access by way of\n  pci_cfg_access_lock()\n- task: kworker\n  mlx5_crdump_collect() tries to set block_cfg_access through\n  pci_cfg_access_lock() while devlink_health_report() had acquired\n  the devlink lock.\n\nA similar deadlock situation can be reproduced by requesting a\ncrdump with\n  \u0026gt; devlink health dump show pci/\u0026lt;BDF\u0026gt; reporter fw_fatal\n\nwhile PCI error recovery is executed on the same \u0026lt;BDF\u0026gt; physical function\nby mlx5_core\u0026apos;s pci_error_handlers. On s390 this can be injected with\n  \u0026gt; zpcictl --reset-fw \u0026lt;BDF\u0026gt;\n\nTests with this patch failed to reproduce that second deadlock situation,\nthe devlink command is rejected with \u0026quot;kernel answers: Permission denied\u0026quot; -\nand we get a kernel log message of:\n\nmlx5_core 1ed0:00:00.1: mlx5_crdump_collect:50:(pid 254382): crdump: failed to lock vsc gw err -5\n\nbecause the config read of VSC_SEMAPHORE is rejected by the underlying\nhardware.\n\nTwo prior attempts to address this issue have been discussed and\nultimately rejected [see link], with the primary argument that s390\u0026apos;s\nimplementation of PCI error recovery is imposing restrictions that\nneither powerpc\u0026apos;s EEH nor PCI AER handling need. Tests show that PCI\nerror recovery on s390 is running to completion even without blocking\naccess to PCI config space.(CVE-2025-68310)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusbnet: Prevents free active kevent\n\nThe root cause of this issue are:\n1. When probing the usbnet device, executing usbnet_link_change(dev, 0, 0);\nput the kevent work in global workqueue. However, the kevent has not yet\nbeen scheduled when the usbnet device is unregistered. Therefore, executing\nfree_netdev() results in the \u0026quot;free active object (kevent)\u0026quot; error reported\nhere.\n\n2. Another factor is that when calling usbnet_disconnect()-\u0026gt;unregister_netdev(),\nif the usbnet device is up, ndo_stop() is executed to cancel the kevent.\nHowever, because the device is not up, ndo_stop() is not executed.\n\nThe solution to this problem is to cancel the kevent before executing\nfree_netdev().(CVE-2025-68312)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnbd: defer config unlock in nbd_genl_connect\n\nThere is one use-after-free warning when running NBD_CMD_CONNECT and\nNBD_CLEAR_SOCK:\n\nnbd_genl_connect\n  nbd_alloc_and_init_config // config_refs=1\n  nbd_start_device // config_refs=2\n  set NBD_RT_HAS_CONFIG_REF\t\t\topen nbd // config_refs=3\n  recv_work done // config_refs=2\n\t\t\t\t\t\tNBD_CLEAR_SOCK // config_refs=1\n\t\t\t\t\t\tclose nbd // config_refs=0\n  refcount_inc -\u0026gt; uaf\n\n------------[ cut here ]------------\nrefcount_t: addition on 0; use-after-free.\nWARNING: CPU: 24 PID: 1014 at lib/refcount.c:25 refcount_warn_saturate+0x12e/0x290\n nbd_genl_connect+0x16d0/0x1ab0\n genl_family_rcv_msg_doit+0x1f3/0x310\n genl_rcv_msg+0x44a/0x790\n\nThe issue can be easily reproduced by adding a small delay before\nrefcount_inc(\u0026amp;nbd-\u0026gt;config_refs) in nbd_genl_connect():\n\n        mutex_unlock(\u0026amp;nbd-\u0026gt;config_lock);\n        if (!ret) {\n                set_bit(NBD_RT_HAS_CONFIG_REF, \u0026amp;config-\u0026gt;runtime_flags);\n+               printk(\u0026quot;before sleep\\n\u0026quot;);\n+               mdelay(5 * 1000);\n+               printk(\u0026quot;after sleep\\n\u0026quot;);\n                refcount_inc(\u0026amp;nbd-\u0026gt;config_refs);\n                nbd_connect_reply(info, nbd-\u0026gt;index);\n        }(CVE-2025-68366)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmacintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse\n\nThe following warning appears when running syzkaller, and this issue also\nexists in the mainline code.\n\n ------------[ cut here ]------------\n list_add double add: new=ffffffffa57eee28, prev=ffffffffa57eee28, next=ffffffffa5e63100.\n WARNING: CPU: 0 PID: 1491 at lib/list_debug.c:35 __list_add_valid_or_report+0xf7/0x130\n Modules linked in:\n CPU: 0 PID: 1491 Comm: syz.1.28 Not tainted 6.6.0+ #3\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\n RIP: 0010:__list_add_valid_or_report+0xf7/0x130\n RSP: 0018:ff1100010dfb7b78 EFLAGS: 00010282\n RAX: 0000000000000000 RBX: ffffffffa57eee18 RCX: ffffffff97fc9817\n RDX: 0000000000040000 RSI: ffa0000002383000 RDI: 0000000000000001\n RBP: ffffffffa57eee28 R08: 0000000000000001 R09: ffe21c0021bf6f2c\n R10: 0000000000000001 R11: 6464615f7473696c R12: ffffffffa5e63100\n R13: ffffffffa57eee28 R14: ffffffffa57eee28 R15: ff1100010dfb7d48\n FS:  00007fb14398b640(0000) GS:ff11000119600000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 0000000000000000 CR3: 000000010d096005 CR4: 0000000000773ef0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n PKRU: 80000000\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  input_register_handler+0xb3/0x210\n  mac_hid_start_emulation+0x1c5/0x290\n  mac_hid_toggle_emumouse+0x20a/0x240\n  proc_sys_call_handler+0x4c2/0x6e0\n  new_sync_write+0x1b1/0x2d0\n  vfs_write+0x709/0x950\n  ksys_write+0x12a/0x250\n  do_syscall_64+0x5a/0x110\n  entry_SYSCALL_64_after_hwframe+0x78/0xe2\n\nThe WARNING occurs when two processes concurrently write to the mac-hid\nemulation sysctl, causing a race condition in mac_hid_toggle_emumouse().\nBoth processes read old_val=0, then both try to register the input handler,\nleading to a double list_add of the same handler.\n\n  CPU0                             CPU1\n  -------------------------        -------------------------\n  vfs_write() //write 1            vfs_write()  //write 1\n    proc_sys_write()                 proc_sys_write()\n      mac_hid_toggle_emumouse()          mac_hid_toggle_emumouse()\n        old_val = *valp // old_val=0\n                                           old_val = *valp // old_val=0\n                                           mutex_lock_killable()\n                                           proc_dointvec() // *valp=1\n                                           mac_hid_start_emulation()\n                                             input_register_handler()\n                                           mutex_unlock()\n        mutex_lock_killable()\n        proc_dointvec()\n        mac_hid_start_emulation()\n          input_register_handler() //Trigger Warning\n        mutex_unlock()\n\nFix this by moving the old_val read inside the mutex lock region.(CVE-2025-68367)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nscsi: smartpqi: Fix device resources accessed after device removal\n\nCorrect possible race conditions during device removal.\n\nPreviously, a scheduled work item to reset a LUN could still execute\nafter the device was removed, leading to use-after-free and other\nresource access issues.\n\nThis race condition occurs because the abort handler may schedule a LUN\nreset concurrently with device removal via sdev_destroy(), leading to\nuse-after-free and improper access to freed resources.\n\n  - Check in the device reset handler if the device is still present in\n    the controller\u0026apos;s SCSI device list before running; if not, the reset\n    is skipped.\n\n  - Cancel any pending TMF work that has not started in sdev_destroy().\n\n  - Ensure device freeing in sdev_destroy() is done while holding the\n    LUN reset mutex to avoid races with ongoing resets.(CVE-2025-68371)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnbd: defer config put in recv_work\n\nThere is one uaf issue in recv_work when running NBD_CLEAR_SOCK and\nNBD_CMD_RECONFIGURE:\n  nbd_genl_connect     // conf_ref=2 (connect and recv_work A)\n  nbd_open\t       // conf_ref=3\n  recv_work A done     // conf_ref=2\n  NBD_CLEAR_SOCK       // conf_ref=1\n  nbd_genl_reconfigure // conf_ref=2 (trigger recv_work B)\n  close nbd\t       // conf_ref=1\n  recv_work B\n    config_put         // conf_ref=0\n    atomic_dec(\u0026amp;config-\u0026gt;recv_threads); -\u0026gt; UAF\n\nOr only running NBD_CLEAR_SOCK:\n  nbd_genl_connect   // conf_ref=2\n  nbd_open \t     // conf_ref=3\n  NBD_CLEAR_SOCK     // conf_ref=2\n  close nbd\n    nbd_release\n      config_put     // conf_ref=1\n  recv_work\n    config_put \t     // conf_ref=0\n    atomic_dec(\u0026amp;config-\u0026gt;recv_threads); -\u0026gt; UAF\n\nCommit 87aac3a80af5 (\u0026quot;nbd: call nbd_config_put() before notifying the\nwaiter\u0026quot;) moved nbd_config_put() to run before waking up the waiter in\nrecv_work, in order to ensure that nbd_start_device_ioctl() would not\nbe woken up while nbd-\u0026gt;task_recv was still uncleared.\n\nHowever, in nbd_start_device_ioctl(), after being woken up it explicitly\ncalls flush_workqueue() to make sure all current works are finished.\nTherefore, there is no need to move the config put ahead of the wakeup.\n\nMove nbd_config_put() to the end of recv_work, so that the reference is\nheld for the whole lifetime of the worker thread. This makes sure the\nconfig cannot be freed while recv_work is still running, even if clear\n+ reconfigure interleave.\n\nIn addition, we don\u0026apos;t need to worry about recv_work dropping the last\nnbd_put (which causes deadlock):\n\npath A (netlink with NBD_CFLAG_DESTROY_ON_DISCONNECT):\n  connect  // nbd_refs=1 (trigger recv_work)\n  open nbd // nbd_refs=2\n  NBD_CLEAR_SOCK\n  close nbd\n    nbd_release\n      nbd_disconnect_and_put\n        flush_workqueue // recv_work done\n      nbd_config_put\n        nbd_put // nbd_refs=1\n      nbd_put // nbd_refs=0\n        queue_work\n\npath B (netlink without NBD_CFLAG_DESTROY_ON_DISCONNECT):\n  connect  // nbd_refs=2 (trigger recv_work)\n  open nbd // nbd_refs=3\n  NBD_CLEAR_SOCK // conf_refs=2\n  close nbd\n    nbd_release\n      nbd_config_put // conf_refs=1\n      nbd_put // nbd_refs=2\n  recv_work done // conf_refs=0, nbd_refs=1\n  rmmod // nbd_refs=0\n\nDepends-on: e2daec488c57 (\u0026quot;nbd: Fix hungtask when nbd_config_put\u0026quot;)(CVE-2025-68372)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmd: fix rcu protection in md_wakeup_thread\n\nWe attempted to use RCU to protect the pointer \u0026apos;thread\u0026apos;, but directly\npassed the value when calling md_wakeup_thread(). This means that the\nRCU pointer has been acquired before rcu_read_lock(), which renders\nrcu_read_lock() ineffective and could lead to a use-after-free.(CVE-2025-68374)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix null deref on srq-\u0026gt;rq.queue after resize failure\n\nA NULL pointer dereference can occur in rxe_srq_chk_attr() when\nibv_modify_srq() is invoked twice in succession under certain error\nconditions. The first call may fail in rxe_queue_resize(), which leads\nrxe_srq_from_attr() to set srq-\u0026gt;rq.queue = NULL. The second call then\ntriggers a crash (null deref) when accessing\nsrq-\u0026gt;rq.queue-\u0026gt;buf-\u0026gt;index_mask.\n\nCall Trace:\n\u0026lt;TASK\u0026gt;\nrxe_modify_srq+0x170/0x480 [rdma_rxe]\n? __pfx_rxe_modify_srq+0x10/0x10 [rdma_rxe]\n? uverbs_try_lock_object+0x4f/0xa0 [ib_uverbs]\n? rdma_lookup_get_uobject+0x1f0/0x380 [ib_uverbs]\nib_uverbs_modify_srq+0x204/0x290 [ib_uverbs]\n? __pfx_ib_uverbs_modify_srq+0x10/0x10 [ib_uverbs]\n? tryinc_node_nr_active+0xe6/0x150\n? uverbs_fill_udata+0xed/0x4f0 [ib_uverbs]\nib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0x2c0/0x470 [ib_uverbs]\n? __pfx_ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0x10/0x10 [ib_uverbs]\n? uverbs_fill_udata+0xed/0x4f0 [ib_uverbs]\nib_uverbs_run_method+0x55a/0x6e0 [ib_uverbs]\n? __pfx_ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0x10/0x10 [ib_uverbs]\nib_uverbs_cmd_verbs+0x54d/0x800 [ib_uverbs]\n? __pfx_ib_uverbs_cmd_verbs+0x10/0x10 [ib_uverbs]\n? __pfx___raw_spin_lock_irqsave+0x10/0x10\n? __pfx_do_vfs_ioctl+0x10/0x10\n? ioctl_has_perm.constprop.0.isra.0+0x2c7/0x4c0\n? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10\nib_uverbs_ioctl+0x13e/0x220 [ib_uverbs]\n? __pfx_ib_uverbs_ioctl+0x10/0x10 [ib_uverbs]\n__x64_sys_ioctl+0x138/0x1c0\ndo_syscall_64+0x82/0x250\n? fdget_pos+0x58/0x4c0\n? ksys_write+0xf3/0x1c0\n? __pfx_ksys_write+0x10/0x10\n? do_syscall_64+0xc8/0x250\n? __pfx_vm_mmap_pgoff+0x10/0x10\n? fget+0x173/0x230\n? fput+0x2a/0x80\n? ksys_mmap_pgoff+0x224/0x4c0\n? do_syscall_64+0xc8/0x250\n? do_user_addr_fault+0x37b/0xfe0\n? clear_bhb_loop+0x50/0xa0\n? clear_bhb_loop+0x50/0xa0\n? clear_bhb_loop+0x50/0xa0\nentry_SYSCALL_64_after_hwframe+0x76/0x7e(CVE-2025-68379)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags\n\nWhen a filesystem is being automounted, it needs to preserve the\nuser-set superblock mount options, such as the \u0026quot;ro\u0026quot; flag.(CVE-2025-68764)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfsnotify: do not generate ACCESS/MODIFY events on child for special files\n\ninotify/fanotify do not allow users with no read access to a file to\nsubscribe to events (e.g. IN_ACCESS/IN_MODIFY), but they do allow the\nsame user to subscribe for watching events on children when the user\nhas access to the parent directory (e.g. /dev).\n\nUsers with no read access to a file but with read access to its parent\ndirectory can still stat the file and see if it was accessed/modified\nvia atime/mtime change.\n\nThe same is not true for special files (e.g. /dev/null). Users will not\ngenerally observe atime/mtime changes when other users read/write to\nspecial files, only when someone sets atime/mtime via utimensat().\n\nAlign fsnotify events with this stat behavior and do not generate\nACCESS/MODIFY events to parent watchers on read/write of special files.\nThe events are still generated to parent watchers on utimensat(). This\ncloses some side-channels that could be possibly used for information\nexfiltration [1].\n\n[1] https://snee.la/pdf/pubs/file-notification-attacks.pdf(CVE-2025-68788)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfuse: missing copy_finish in fuse-over-io-uring argument copies\n\nFix a possible reference count leak of payload pages during\nfuse argument copies.\n\n[Joanne: simplified error cleanup](CVE-2025-68791)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/amd: Check event before enable to avoid GPF\n\nOn AMD machines cpuc-\u0026gt;events[idx] can become NULL in a subtle race\ncondition with NMI-\u0026gt;throttle-\u0026gt;x86_pmu_stop().\n\nCheck event for NULL in amd_pmu_enable_all() before enable to avoid a GPF.\nThis appears to be an AMD only issue.\n\nSyzkaller reported a GPF in amd_pmu_enable_all.\n\nINFO: NMI handler (perf_event_nmi_handler) took too long to run: 13.143\n    msecs\nOops: general protection fault, probably for non-canonical address\n    0xdffffc0000000034: 0000  PREEMPT SMP KASAN NOPTI\nKASAN: null-ptr-deref in range [0x00000000000001a0-0x00000000000001a7]\nCPU: 0 UID: 0 PID: 328415 Comm: repro_36674776 Not tainted 6.12.0-rc1-syzk\nRIP: 0010:x86_pmu_enable_event (arch/x86/events/perf_event.h:1195\n    arch/x86/events/core.c:1430)\nRSP: 0018:ffff888118009d60 EFLAGS: 00010012\nRAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000\nRDX: 0000000000000034 RSI: 0000000000000000 RDI: 00000000000001a0\nRBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000002\nR13: ffff88811802a440 R14: ffff88811802a240 R15: ffff8881132d8601\nFS:  00007f097dfaa700(0000) GS:ffff888118000000(0000) GS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00000000200001c0 CR3: 0000000103d56000 CR4: 00000000000006f0\nCall Trace:\n \u0026lt;IRQ\u0026gt;\namd_pmu_enable_all (arch/x86/events/amd/core.c:760 (discriminator 2))\nx86_pmu_enable (arch/x86/events/core.c:1360)\nevent_sched_out (kernel/events/core.c:1191 kernel/events/core.c:1186\n    kernel/events/core.c:2346)\n__perf_remove_from_context (kernel/events/core.c:2435)\nevent_function (kernel/events/core.c:259)\nremote_function (kernel/events/core.c:92 (discriminator 1)\n    kernel/events/core.c:72 (discriminator 1))\n__flush_smp_call_function_queue (./arch/x86/include/asm/jump_label.h:27\n    ./include/linux/jump_label.h:207 ./include/trace/events/csd.h:64\n    kernel/smp.c:135 kernel/smp.c:540)\n__sysvec_call_function_single (./arch/x86/include/asm/jump_label.h:27\n    ./include/linux/jump_label.h:207\n    ./arch/x86/include/asm/trace/irq_vectors.h:99 arch/x86/kernel/smp.c:272)\nsysvec_call_function_single (arch/x86/kernel/smp.c:266 (discriminator 47)\n    arch/x86/kernel/smp.c:266 (discriminator 47))\n \u0026lt;/IRQ\u0026gt;(CVE-2025-68798)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats\n\nCited commit added a dedicated mutex (instead of RTNL) to protect the\nmulticast route list, so that it will not change while the driver\nperiodically traverses it in order to update the kernel about multicast\nroute stats that were queried from the device.\n\nOne instance of list entry deletion (during route replace) was missed\nand it can result in a use-after-free [1].\n\nFix by acquiring the mutex before deleting the entry from the list and\nreleasing it afterwards.\n\n[1]\nBUG: KASAN: slab-use-after-free in mlxsw_sp_mr_stats_update+0x4a5/0x540 drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c:1006 [mlxsw_spectrum]\nRead of size 8 at addr ffff8881523c2fa8 by task kworker/2:5/22043\n\nCPU: 2 UID: 0 PID: 22043 Comm: kworker/2:5 Not tainted 6.18.0-rc1-custom-g1a3d6d7cd014 #1 PREEMPT(full)\nHardware name: Mellanox Technologies Ltd. MSN2010/SA002610, BIOS 5.6.5 08/24/2017\nWorkqueue: mlxsw_core mlxsw_sp_mr_stats_update [mlxsw_spectrum]\nCall Trace:\n \u0026lt;TASK\u0026gt;\n dump_stack_lvl+0xba/0x110\n print_report+0x174/0x4f5\n kasan_report+0xdf/0x110\n mlxsw_sp_mr_stats_update+0x4a5/0x540 drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c:1006 [mlxsw_spectrum]\n process_one_work+0x9cc/0x18e0\n worker_thread+0x5df/0xe40\n kthread+0x3b8/0x730\n ret_from_fork+0x3e9/0x560\n ret_from_fork_asm+0x1a/0x30\n \u0026lt;/TASK\u0026gt;\n\nAllocated by task 29933:\n kasan_save_stack+0x30/0x50\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0x8f/0xa0\n mlxsw_sp_mr_route_add+0xd8/0x4770 [mlxsw_spectrum]\n mlxsw_sp_router_fibmr_event_work+0x371/0xad0 drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:7965 [mlxsw_spectrum]\n process_one_work+0x9cc/0x18e0\n worker_thread+0x5df/0xe40\n kthread+0x3b8/0x730\n ret_from_fork+0x3e9/0x560\n ret_from_fork_asm+0x1a/0x30\n\nFreed by task 29933:\n kasan_save_stack+0x30/0x50\n kasan_save_track+0x14/0x30\n __kasan_save_free_info+0x3b/0x70\n __kasan_slab_free+0x43/0x70\n kfree+0x14e/0x700\n mlxsw_sp_mr_route_add+0x2dea/0x4770 drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c:444 [mlxsw_spectrum]\n mlxsw_sp_router_fibmr_event_work+0x371/0xad0 drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:7965 [mlxsw_spectrum]\n process_one_work+0x9cc/0x18e0\n worker_thread+0x5df/0xe40\n kthread+0x3b8/0x730\n ret_from_fork+0x3e9/0x560\n ret_from_fork_asm+0x1a/0x30(CVE-2025-68800)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_router: Fix neighbour use-after-free\n\nWe sometimes observe use-after-free when dereferencing a neighbour [1].\nThe problem seems to be that the driver stores a pointer to the\nneighbour, but without holding a reference on it. A reference is only\ntaken when the neighbour is used by a nexthop.\n\nFix by simplifying the reference counting scheme. Always take a\nreference when storing a neighbour pointer in a neighbour entry. Avoid\ntaking a referencing when the neighbour is used by a nexthop as the\nneighbour entry associated with the nexthop already holds a reference.\n\nTested by running the test that uncovered the problem over 300 times.\nWithout this patch the problem was reproduced after a handful of\niterations.\n\n[1]\nBUG: KASAN: slab-use-after-free in mlxsw_sp_neigh_entry_update+0x2d4/0x310\nRead of size 8 at addr ffff88817f8e3420 by task ip/3929\n\nCPU: 3 UID: 0 PID: 3929 Comm: ip Not tainted 6.18.0-rc4-virtme-g36b21a067510 #3 PREEMPT(full)\nHardware name: Nvidia SN5600/VMOD0013, BIOS 5.13 05/31/2023\nCall Trace:\n \u0026lt;TASK\u0026gt;\n dump_stack_lvl+0x6f/0xa0\n print_address_description.constprop.0+0x6e/0x300\n print_report+0xfc/0x1fb\n kasan_report+0xe4/0x110\n mlxsw_sp_neigh_entry_update+0x2d4/0x310\n mlxsw_sp_router_rif_gone_sync+0x35f/0x510\n mlxsw_sp_rif_destroy+0x1ea/0x730\n mlxsw_sp_inetaddr_port_vlan_event+0xa1/0x1b0\n __mlxsw_sp_inetaddr_lag_event+0xcc/0x130\n __mlxsw_sp_inetaddr_event+0xf5/0x3c0\n mlxsw_sp_router_netdevice_event+0x1015/0x1580\n notifier_call_chain+0xcc/0x150\n call_netdevice_notifiers_info+0x7e/0x100\n __netdev_upper_dev_unlink+0x10b/0x210\n netdev_upper_dev_unlink+0x79/0xa0\n vrf_del_slave+0x18/0x50\n do_set_master+0x146/0x7d0\n do_setlink.isra.0+0x9a0/0x2880\n rtnl_newlink+0x637/0xb20\n rtnetlink_rcv_msg+0x6fe/0xb90\n netlink_rcv_skb+0x123/0x380\n netlink_unicast+0x4a3/0x770\n netlink_sendmsg+0x75b/0xc90\n __sock_sendmsg+0xbe/0x160\n ____sys_sendmsg+0x5b2/0x7d0\n ___sys_sendmsg+0xfd/0x180\n __sys_sendmsg+0x124/0x1c0\n do_syscall_64+0xbb/0xfd0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n[...]\n\nAllocated by task 109:\n kasan_save_stack+0x30/0x50\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0x7b/0x90\n __kmalloc_noprof+0x2c1/0x790\n neigh_alloc+0x6af/0x8f0\n ___neigh_create+0x63/0xe90\n mlxsw_sp_nexthop_neigh_init+0x430/0x7e0\n mlxsw_sp_nexthop_type_init+0x212/0x960\n mlxsw_sp_nexthop6_group_info_init.constprop.0+0x81f/0x1280\n mlxsw_sp_nexthop6_group_get+0x392/0x6a0\n mlxsw_sp_fib6_entry_create+0x46a/0xfd0\n mlxsw_sp_router_fib6_replace+0x1ed/0x5f0\n mlxsw_sp_router_fib6_event_work+0x10a/0x2a0\n process_one_work+0xd57/0x1390\n worker_thread+0x4d6/0xd40\n kthread+0x355/0x5b0\n ret_from_fork+0x1d4/0x270\n ret_from_fork_asm+0x11/0x20\n\nFreed by task 154:\n kasan_save_stack+0x30/0x50\n kasan_save_track+0x14/0x30\n __kasan_save_free_info+0x3b/0x60\n __kasan_slab_free+0x43/0x70\n kmem_cache_free_bulk.part.0+0x1eb/0x5e0\n kvfree_rcu_bulk+0x1f2/0x260\n kfree_rcu_work+0x130/0x1b0\n process_one_work+0xd57/0x1390\n worker_thread+0x4d6/0xd40\n kthread+0x355/0x5b0\n ret_from_fork+0x1d4/0x270\n ret_from_fork_asm+0x11/0x20\n\nLast potentially related work creation:\n kasan_save_stack+0x30/0x50\n kasan_record_aux_stack+0x8c/0xa0\n kvfree_call_rcu+0x93/0x5b0\n mlxsw_sp_router_neigh_event_work+0x67d/0x860\n process_one_work+0xd57/0x1390\n worker_thread+0x4d6/0xd40\n kthread+0x355/0x5b0\n ret_from_fork+0x1d4/0x270\n ret_from_fork_asm+0x11/0x20(CVE-2025-68801)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfuse: fix io-uring list corruption for terminated non-committed requests\n\nWhen a request is terminated before it has been committed, the request\nis not removed from the queue\u0026apos;s list. This leaves a dangling list entry\nthat leads to list corruption and use-after-free issues.\n\nRemove the request from the queue\u0026apos;s list for terminated non-committed\nrequests.(CVE-2025-68805)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfuse: fix readahead reclaim deadlock\n\nCommit e26ee4efbc79 (\u0026quot;fuse: allocate ff-\u0026gt;release_args only if release is\nneeded\u0026quot;) skips allocating ff-\u0026gt;release_args if the server does not\nimplement open. However in doing so, fuse_prepare_release() now skips\ngrabbing the reference on the inode, which makes it possible for an\ninode to be evicted from the dcache while there are inflight readahead\nrequests. This causes a deadlock if the server triggers reclaim while\nservicing the readahead request and reclaim attempts to evict the inode\nof the file being read ahead. Since the folio is locked during\nreadahead, when reclaim evicts the fuse inode and fuse_evict_inode()\nattempts to remove all folios associated with the inode from the page\ncache (truncate_inode_pages_range()), reclaim will block forever waiting\nfor the lock since readahead cannot relinquish the lock because it is\nitself blocked in reclaim:\n\n\u0026gt;\u0026gt;\u0026gt; stack_trace(1504735)\n folio_wait_bit_common (mm/filemap.c:1308:4)\n folio_lock (./include/linux/pagemap.h:1052:3)\n truncate_inode_pages_range (mm/truncate.c:336:10)\n fuse_evict_inode (fs/fuse/inode.c:161:2)\n evict (fs/inode.c:704:3)\n dentry_unlink_inode (fs/dcache.c:412:3)\n __dentry_kill (fs/dcache.c:615:3)\n shrink_kill (fs/dcache.c:1060:12)\n shrink_dentry_list (fs/dcache.c:1087:3)\n prune_dcache_sb (fs/dcache.c:1168:2)\n super_cache_scan (fs/super.c:221:10)\n do_shrink_slab (mm/shrinker.c:435:9)\n shrink_slab (mm/shrinker.c:626:10)\n shrink_node (mm/vmscan.c:5951:2)\n shrink_zones (mm/vmscan.c:6195:3)\n do_try_to_free_pages (mm/vmscan.c:6257:3)\n do_swap_page (mm/memory.c:4136:11)\n handle_pte_fault (mm/memory.c:5562:10)\n handle_mm_fault (mm/memory.c:5870:9)\n do_user_addr_fault (arch/x86/mm/fault.c:1338:10)\n handle_page_fault (arch/x86/mm/fault.c:1481:3)\n exc_page_fault (arch/x86/mm/fault.c:1539:2)\n asm_exc_page_fault+0x22/0x27\n\nFix this deadlock by allocating ff-\u0026gt;release_args and grabbing the\nreference on the inode when preparing the file for release even if the\nserver does not implement open. The inode reference will be dropped when\nthe last reference on the fuse file is dropped (see fuse_file_put() -\u0026gt;\nfuse_release_end()).(CVE-2025-68821)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niavf: fix off-by-one issues in iavf_config_rss_reg()\n\nThere are off-by-one bugs when configuring RSS hash key and lookup\ntable, causing out-of-bounds reads to memory [1] and out-of-bounds\nwrites to device registers.\n\nBefore commit 43a3d9ba34c9 (\u0026quot;i40evf: Allow PF driver to configure RSS\u0026quot;),\nthe loop upper bounds were:\n    i \u0026lt;= I40E_VFQF_{HKEY,HLUT}_MAX_INDEX\nwhich is safe since the value is the last valid index.\n\nThat commit changed the bounds to:\n    i \u0026lt;= adapter-\u0026gt;rss_{key,lut}_size / 4\nwhere `rss_{key,lut}_size / 4` is the number of dwords, so the last\nvalid index is `(rss_{key,lut}_size / 4) - 1`. Therefore, using `\u0026lt;=`\naccesses one element past the end.\n\nFix the issues by using `\u0026lt;` instead of `\u0026lt;=`, ensuring we do not exceed\nthe bounds.\n\n[1] KASAN splat about rss_key_size off-by-one\n  BUG: KASAN: slab-out-of-bounds in iavf_config_rss+0x619/0x800\n  Read of size 4 at addr ffff888102c50134 by task kworker/u8:6/63\n\n  CPU: 0 UID: 0 PID: 63 Comm: kworker/u8:6 Not tainted 6.18.0-rc2-enjuk-tnguy-00378-g3005f5b77652-dirty #156 PREEMPT(voluntary)\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n  Workqueue: iavf iavf_watchdog_task\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   dump_stack_lvl+0x6f/0xb0\n   print_report+0x170/0x4f3\n   kasan_report+0xe1/0x1a0\n   iavf_config_rss+0x619/0x800\n   iavf_watchdog_task+0x2be7/0x3230\n   process_one_work+0x7fd/0x1420\n   worker_thread+0x4d1/0xd40\n   kthread+0x344/0x660\n   ret_from_fork+0x249/0x320\n   ret_from_fork_asm+0x1a/0x30\n   \u0026lt;/TASK\u0026gt;\n\n  Allocated by task 63:\n   kasan_save_stack+0x30/0x50\n   kasan_save_track+0x14/0x30\n   __kasan_kmalloc+0x7f/0x90\n   __kmalloc_noprof+0x246/0x6f0\n   iavf_watchdog_task+0x28fc/0x3230\n   process_one_work+0x7fd/0x1420\n   worker_thread+0x4d1/0xd40\n   kthread+0x344/0x660\n   ret_from_fork+0x249/0x320\n   ret_from_fork_asm+0x1a/0x30\n\n  The buggy address belongs to the object at ffff888102c50100\n   which belongs to the cache kmalloc-64 of size 64\n  The buggy address is located 0 bytes to the right of\n   allocated 52-byte region [ffff888102c50100, ffff888102c50134)\n\n  The buggy address belongs to the physical page:\n  page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102c50\n  flags: 0x200000000000000(node=0|zone=2)\n  page_type: f5(slab)\n  raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000\n  raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000\n  page dumped because: kasan: bad access detected\n\n  Memory state around the buggy address:\n   ffff888102c50000: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc\n   ffff888102c50080: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc\n  \u0026gt;ffff888102c50100: 00 00 00 00 00 00 04 fc fc fc fc fc fc fc fc fc\n                                       ^\n   ffff888102c50180: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc\n   ffff888102c50200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc(CVE-2025-71087)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ne1000: fix OOB in e1000_tbi_should_accept()\n\nIn e1000_tbi_should_accept() we read the last byte of the frame via\n\u0026apos;data[length - 1]\u0026apos; to evaluate the TBI workaround. If the descriptor-\nreported length is zero or larger than the actual RX buffer size, this\nread goes out of bounds and can hit unrelated slab objects. The issue\nis observed from the NAPI receive path (e1000_clean_rx_irq):\n\n==================================================================\nBUG: KASAN: slab-out-of-bounds in e1000_tbi_should_accept+0x610/0x790\nRead of size 1 at addr ffff888014114e54 by task sshd/363\n\nCPU: 0 PID: 363 Comm: sshd Not tainted 5.18.0-rc1 #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014\nCall Trace:\n \u0026lt;IRQ\u0026gt;\n dump_stack_lvl+0x5a/0x74\n print_address_description+0x7b/0x440\n print_report+0x101/0x200\n kasan_report+0xc1/0xf0\n e1000_tbi_should_accept+0x610/0x790\n e1000_clean_rx_irq+0xa8c/0x1110\n e1000_clean+0xde2/0x3c10\n __napi_poll+0x98/0x380\n net_rx_action+0x491/0xa20\n __do_softirq+0x2c9/0x61d\n do_softirq+0xd1/0x120\n \u0026lt;/IRQ\u0026gt;\n \u0026lt;TASK\u0026gt;\n __local_bh_enable_ip+0xfe/0x130\n ip_finish_output2+0x7d5/0xb00\n __ip_queue_xmit+0xe24/0x1ab0\n __tcp_transmit_skb+0x1bcb/0x3340\n tcp_write_xmit+0x175d/0x6bd0\n __tcp_push_pending_frames+0x7b/0x280\n tcp_sendmsg_locked+0x2e4f/0x32d0\n tcp_sendmsg+0x24/0x40\n sock_write_iter+0x322/0x430\n vfs_write+0x56c/0xa60\n ksys_write+0xd1/0x190\n do_syscall_64+0x43/0x90\n entry_SYSCALL_64_after_hwframe+0x44/0xae\nRIP: 0033:0x7f511b476b10\nCode: 73 01 c3 48 8b 0d 88 d3 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d f9 2b 2c 00 00 75 10 b8 01 00 00 00 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 8e 9b 01 00 48 89 04 24\nRSP: 002b:00007ffc9211d4e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001\nRAX: ffffffffffffffda RBX: 0000000000004024 RCX: 00007f511b476b10\nRDX: 0000000000004024 RSI: 0000559a9385962c RDI: 0000000000000003\nRBP: 0000559a9383a400 R08: fffffffffffffff0 R09: 0000000000004f00\nR10: 0000000000000070 R11: 0000000000000246 R12: 0000000000000000\nR13: 00007ffc9211d57f R14: 0000559a9347bde7 R15: 0000000000000003\n \u0026lt;/TASK\u0026gt;\nAllocated by task 1:\n __kasan_krealloc+0x131/0x1c0\n krealloc+0x90/0xc0\n add_sysfs_param+0xcb/0x8a0\n kernel_add_sysfs_param+0x81/0xd4\n param_sysfs_builtin+0x138/0x1a6\n param_sysfs_init+0x57/0x5b\n do_one_initcall+0x104/0x250\n do_initcall_level+0x102/0x132\n do_initcalls+0x46/0x74\n kernel_init_freeable+0x28f/0x393\n kernel_init+0x14/0x1a0\n ret_from_fork+0x22/0x30\nThe buggy address belongs to the object at ffff888014114000\n which belongs to the cache kmalloc-2k of size 2048\nThe buggy address is located 1620 bytes to the right of\n 2048-byte region [ffff888014114000, ffff888014114800]\nThe buggy address belongs to the physical page:\npage:ffffea0000504400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14110\nhead:ffffea0000504400 order:3 compound_mapcount:0 compound_pincount:0\nflags: 0x100000000010200(slab|head|node=0|zone=1)\nraw: 0100000000010200 0000000000000000 dead000000000001 ffff888013442000\nraw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000\npage dumped because: kasan: bad access detected\n==================================================================\n\nThis happens because the TBI check unconditionally dereferences the last\nbyte without validating the reported length first:\n\n\tu8 last_byte = *(data + length - 1);\n\nFix by rejecting the frame early if the length is zero, or if it exceeds\nadapter-\u0026gt;rx_buffer_len. This preserves the TBI workaround semantics for\nvalid frames and prevents touching memory beyond the RX buffer.(CVE-2025-71093)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: Handle incorrect num_connectors capability\n\nThe UCSI spec states that the num_connectors field is 7 bits, and the\n8th bit is reserved and should be set to zero.\nSome buggy FW has been known to set this bit, and it can lead to a\nsystem not booting.\nFlag that the FW is not behaving correctly, and auto-fix the value\nso that the system boots correctly.\n\nFound on Lenovo P1 G8 during Linux enablement program. The FW will\nbe fixed, but seemed worth addressing in case it hit platforms that\naren\u0026apos;t officially Linux supported.(CVE-2025-71108)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - zero initialize memory allocated via sock_kmalloc\n\nSeveral crypto user API contexts and requests allocated with\nsock_kmalloc() were left uninitialized, relying on callers to\nset fields explicitly. This resulted in the use of uninitialized\ndata in certain error paths or when new fields are added in the\nfuture.\n\nThe ACVP patches also contain two user-space interface files:\nalgif_kpp.c and algif_akcipher.c. These too rely on proper\ninitialization of their context structures.\n\nA particular issue has been observed with the newly added\n\u0026apos;inflight\u0026apos; variable introduced in af_alg_ctx by commit:\n\n  67b164a871af (\u0026quot;crypto: af_alg - Disallow multiple in-flight AIO requests\u0026quot;)\n\nBecause the context is not memset to zero after allocation,\nthe inflight variable has contained garbage values. As a result,\naf_alg_alloc_areq() has incorrectly returned -EBUSY randomly when\nthe garbage value was interpreted as true:\n\n  https://github.com/gregkh/linux/blame/master/crypto/af_alg.c#L1209\n\nThe check directly tests ctx-\u0026gt;inflight without explicitly\ncomparing against true/false. Since inflight is only ever set to\ntrue or false later, an uninitialized value has triggered\n-EBUSY failures. Zero-initializing memory allocated with\nsock_kmalloc() ensures inflight and other fields start in a known\nstate, removing random issues caused by uninitialized data.(CVE-2025-71113)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/kexec: Enable SMT before waking offline CPUs\n\nIf SMT is disabled or a partial SMT state is enabled, when a new kernel\nimage is loaded for kexec, on reboot the following warning is observed:\n\nkexec: Waking offline cpu 228.\nWARNING: CPU: 0 PID: 9062 at arch/powerpc/kexec/core_64.c:223 kexec_prepare_cpus+0x1b0/0x1bc\n[snip]\n NIP kexec_prepare_cpus+0x1b0/0x1bc\n LR  kexec_prepare_cpus+0x1a0/0x1bc\n Call Trace:\n  kexec_prepare_cpus+0x1a0/0x1bc (unreliable)\n  default_machine_kexec+0x160/0x19c\n  machine_kexec+0x80/0x88\n  kernel_kexec+0xd0/0x118\n  __do_sys_reboot+0x210/0x2c4\n  system_call_exception+0x124/0x320\n  system_call_vectored_common+0x15c/0x2ec\n\nThis occurs as add_cpu() fails due to cpu_bootable() returning false for\nCPUs that fail the cpu_smt_thread_allowed() check or non primary\nthreads if SMT is disabled.\n\nFix the issue by enabling SMT and resetting the number of SMT threads to\nthe number of threads per core, before attempting to wake up all present\nCPUs.(CVE-2025-71119)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Do not register unsupported perf events\n\nSynthetic events currently do not have a function to register perf events.\nThis leads to calling the tracepoint register functions with a NULL\nfunction pointer which triggers:\n\n ------------[ cut here ]------------\n WARNING: kernel/tracepoint.c:175 at tracepoint_add_func+0x357/0x370, CPU#2: perf/2272\n Modules linked in: kvm_intel kvm irqbypass\n CPU: 2 UID: 0 PID: 2272 Comm: perf Not tainted 6.18.0-ftest-11964-ge022764176fc-dirty #323 PREEMPTLAZY\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-debian-1.17.0-1 04/01/2014\n RIP: 0010:tracepoint_add_func+0x357/0x370\n Code: 28 9c e8 4c 0b f5 ff eb 0f 4c 89 f7 48 c7 c6 80 4d 28 9c e8 ab 89 f4 ff 31 c0 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc \u0026lt;0f\u0026gt; 0b 49 c7 c6 ea ff ff ff e9 ee fe ff ff 0f 0b e9 f9 fe ff ff 0f\n RSP: 0018:ffffabc0c44d3c40 EFLAGS: 00010246\n RAX: 0000000000000001 RBX: ffff9380aa9e4060 RCX: 0000000000000000\n RDX: 000000000000000a RSI: ffffffff9e1d4a98 RDI: ffff937fcf5fd6c8\n RBP: 0000000000000001 R08: 0000000000000007 R09: ffff937fcf5fc780\n R10: 0000000000000003 R11: ffffffff9c193910 R12: 000000000000000a\n R13: ffffffff9e1e5888 R14: 0000000000000000 R15: ffffabc0c44d3c78\n FS:  00007f6202f5f340(0000) GS:ffff93819f00f000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 000055d3162281a8 CR3: 0000000106a56003 CR4: 0000000000172ef0\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  tracepoint_probe_register+0x5d/0x90\n  synth_event_reg+0x3c/0x60\n  perf_trace_event_init+0x204/0x340\n  perf_trace_init+0x85/0xd0\n  perf_tp_event_init+0x2e/0x50\n  perf_try_init_event+0x6f/0x230\n  ? perf_event_alloc+0x4bb/0xdc0\n  perf_event_alloc+0x65a/0xdc0\n  __se_sys_perf_event_open+0x290/0x9f0\n  do_syscall_64+0x93/0x7b0\n  ? entry_SYSCALL_64_after_hwframe+0x76/0x7e\n  ? trace_hardirqs_off+0x53/0xc0\n  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nInstead, have the code return -ENODEV, which doesn\u0026apos;t warn and has perf\nerror out with:\n\n # perf record -e synthetic:futex_wait\nError:\nThe sys_perf_event_open() syscall returned with 19 (No such device) for event (synthetic:futex_wait).\n\u0026quot;dmesg | grep -i perf\u0026quot; may provide additional information.\n\nIdeally perf should support synthetic events, but for now just fix the\nwarning. The support can come later.(CVE-2025-71125)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncifs: Fix memory and information leak in smb3_reconfigure()\n\nIn smb3_reconfigure(), if smb3_sync_session_ctx_passwords() fails, the\nfunction returns immediately without freeing and erasing the newly\nallocated new_password and new_password2. This causes both a memory leak\nand a potential information leak.\n\nFix this by calling kfree_sensitive() on both password buffers before\nreturning in this error case.(CVE-2025-71151)","status":"published","published":"2026-02-06T11:10:20Z","modified":"2026-08-18T01:19:32.443986305Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2025-68310","title":"CVE-2025-68310 in linux - Patched by Root","description":"Root has patched CVE-2025-68310 in the linux package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-10-18T03:18:11Z","modified":"2026-10-18T04:17:32.181956529Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:31.514195Z"},{"id":"ROOT-OS-UBUNTU-2204-CVE-2025-68310","title":"CVE-2025-68310 in linux - Patched by Root","description":"Root has patched CVE-2025-68310 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.","status":"published","published":"2026-11-06T13:52:25Z","modified":"2026-11-06T14:16:48.15067581Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-06T14:57:22.237547Z"},{"id":"ROOT-OS-UBUNTU-2404-CVE-2025-68310","title":"CVE-2025-68310 in linux - Patched by Root","description":"Root has patched CVE-2025-68310 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.","status":"published","published":"2026-11-06T15:54:27Z","modified":"2026-11-06T16:17:45.040794951Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-06T16:59:13.24938Z"},{"id":"BELL-CVE-2025-68310","status":"published","published":"2025-12-17T06:06:20.910161Z","modified":"2026-06-25T07:17:35.278445866Z","updated_at":"2026-11-02T15:28:22.77042Z"},{"id":"CVE-2025-68310","title":"s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump\n\nDo not block PCI config accesses through pci_cfg_access_lock() when\nexecuting the s390 variant of PCI error recovery: Acquire just\ndevice_lock() instead of pci_dev_lock() as powerpc's EEH and\ngenerig PCI AER processing do.\n\nDuring error recovery testing a pair of tasks was reported to be hung:\n\nmlx5_core 0000:00:00.1: mlx5_health_try_recover:338:(pid 5553): health recovery flow aborted, PCI reads still not working\nINFO: task kmcheck:72 blocked for more than 122 seconds.\n      Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1\n\"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\ntask:kmcheck         state:D stack:0     pid:72    tgid:72    ppid:2      flags:0x00000000\nCall Trace:\n [\u003c000000065256f030\u003e] __schedule+0x2a0/0x590\n [\u003c000000065256f356\u003e] schedule+0x36/0xe0\n [\u003c000000065256f572\u003e] schedule_preempt_disabled+0x22/0x30\n [\u003c0000000652570a94\u003e] __mutex_lock.constprop.0+0x484/0x8a8\n [\u003c000003ff800673a4\u003e] mlx5_unload_one+0x34/0x58 [mlx5_core]\n [\u003c000003ff8006745c\u003e] mlx5_pci_err_detected+0x94/0x140 [mlx5_core]\n [\u003c0000000652556c5a\u003e] zpci_event_attempt_error_recovery+0xf2/0x398\n [\u003c0000000651b9184a\u003e] __zpci_event_error+0x23a/0x2c0\nINFO: task kworker/u1664:6:1514 blocked for more than 122 seconds.\n      Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1\n\"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\ntask:kworker/u1664:6 state:D stack:0     pid:1514  tgid:1514  ppid:2      flags:0x00000000\nWorkqueue: mlx5_health0000:00:00.0 mlx5_fw_fatal_reporter_err_work [mlx5_core]\nCall Trace:\n [\u003c000000065256f030\u003e] __schedule+0x2a0/0x590\n [\u003c000000065256f356\u003e] schedule+0x36/0xe0\n [\u003c0000000652172e28\u003e] pci_wait_cfg+0x80/0xe8\n [\u003c0000000652172f94\u003e] pci_cfg_access_lock+0x74/0x88\n [\u003c000003ff800916b6\u003e] mlx5_vsc_gw_lock+0x36/0x178 [mlx5_core]\n [\u003c000003ff80098824\u003e] mlx5_crdump_collect+0x34/0x1c8 [mlx5_core]\n [\u003c000003ff80074b62\u003e] mlx5_fw_fatal_reporter_dump+0x6a/0xe8 [mlx5_core]\n [\u003c0000000652512242\u003e] devlink_health_do_dump.part.0+0x82/0x168\n [\u003c0000000652513212\u003e] devlink_health_report+0x19a/0x230\n [\u003c000003ff80075a12\u003e] mlx5_fw_fatal_reporter_err_work+0xba/0x1b0 [mlx5_core]\n\nNo kernel log of the exact same error with an upstream kernel is\navailable - but the very same deadlock situation can be constructed there,\ntoo:\n\n- task: kmcheck\n  mlx5_unload_one() tries to acquire devlink lock while the PCI error\n  recovery code has set pdev-\u003eblock_cfg_access by way of\n  pci_cfg_access_lock()\n- task: kworker\n  mlx5_crdump_collect() tries to set block_cfg_access through\n  pci_cfg_access_lock() while devlink_health_report() had acquired\n  the devlink lock.\n\nA similar deadlock situation can be reproduced by requesting a\ncrdump with\n  \u003e devlink health dump show pci/\u003cBDF\u003e reporter fw_fatal\n\nwhile PCI error recovery is executed on the same \u003cBDF\u003e physical function\nby mlx5_core's pci_error_handlers. On s390 this can be injected with\n  \u003e zpcictl --reset-fw \u003cBDF\u003e\n\nTests with this patch failed to reproduce that second deadlock situation,\nthe devlink command is rejected with \"kernel answers: Permission denied\" -\nand we get a kernel log message of:\n\nmlx5_core 1ed0:00:00.1: mlx5_crdump_collect:50:(pid 254382): crdump: failed to lock vsc gw err -5\n\nbecause the config read of VSC_SEMAPHORE is rejected by the underlying\nhardware.\n\nTwo prior attempts to address this issue have been discussed and\nultimately rejected [see link], with the primary argument that s390's\nimplementation of PCI error recovery is imposing restrictions that\nneither powerpc's EEH nor PCI AER handling need. Tests show that PCI\nerror recovery on s390 is running to completion even without blocking\naccess to PCI config space.","status":"published","published":"2025-12-16T15:39:41.652Z","modified":"2026-10-28T02:30:52.770132638Z","updated_at":"2026-11-02T15:44:52.53036Z"},{"id":"DEBIAN-CVE-2025-68310","description":"In the Linux kernel, the following vulnerability has been resolved:  s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump  Do not block PCI config accesses through pci_cfg_access_lock() when executing the s390 variant of PCI error recovery: Acquire just device_lock() instead of pci_dev_lock() as powerpc's EEH and generig PCI AER processing do.  During error recovery testing a pair of tasks was reported to be hung:  mlx5_core 0000:00:00.1: mlx5_health_try_recover:338:(pid 5553): health recovery flow aborted, PCI reads still not working INFO: task kmcheck:72 blocked for more than 122 seconds.       Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1 \"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message. task:kmcheck         state:D stack:0     pid:72    tgid:72    ppid:2      flags:0x00000000 Call Trace:  [\u003c000000065256f030\u003e] __schedule+0x2a0/0x590  [\u003c000000065256f356\u003e] schedule+0x36/0xe0  [\u003c000000065256f572\u003e] schedule_preempt_disabled+0x22/0x30  [\u003c0000000652570a94\u003e] __mutex_lock.constprop.0+0x484/0x8a8  [\u003c000003ff800673a4\u003e] mlx5_unload_one+0x34/0x58 [mlx5_core]  [\u003c000003ff8006745c\u003e] mlx5_pci_err_detected+0x94/0x140 [mlx5_core]  [\u003c0000000652556c5a\u003e] zpci_event_attempt_error_recovery+0xf2/0x398  [\u003c0000000651b9184a\u003e] __zpci_event_error+0x23a/0x2c0 INFO: task kworker/u1664:6:1514 blocked for more than 122 seconds.       Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1 \"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message. task:kworker/u1664:6 state:D stack:0     pid:1514  tgid:1514  ppid:2      flags:0x00000000 Workqueue: mlx5_health0000:00:00.0 mlx5_fw_fatal_reporter_err_work [mlx5_core] Call Trace:  [\u003c000000065256f030\u003e] __schedule+0x2a0/0x590  [\u003c000000065256f356\u003e] schedule+0x36/0xe0  [\u003c0000000652172e28\u003e] pci_wait_cfg+0x80/0xe8  [\u003c0000000652172f94\u003e] pci_cfg_access_lock+0x74/0x88  [\u003c000003ff800916b6\u003e] mlx5_vsc_gw_lock+0x36/0x178 [mlx5_core]  [\u003c000003ff80098824\u003e] mlx5_crdump_collect+0x34/0x1c8 [mlx5_core]  [\u003c000003ff80074b62\u003e] mlx5_fw_fatal_reporter_dump+0x6a/0xe8 [mlx5_core]  [\u003c0000000652512242\u003e] devlink_health_do_dump.part.0+0x82/0x168  [\u003c0000000652513212\u003e] devlink_health_report+0x19a/0x230  [\u003c000003ff80075a12\u003e] mlx5_fw_fatal_reporter_err_work+0xba/0x1b0 [mlx5_core]  No kernel log of the exact same error with an upstream kernel is available - but the very same deadlock situation can be constructed there, too:  - task: kmcheck   mlx5_unload_one() tries to acquire devlink lock while the PCI error   recovery code has set pdev-\u003eblock_cfg_access by way of   pci_cfg_access_lock() - task: kworker   mlx5_crdump_collect() tries to set block_cfg_access through   pci_cfg_access_lock() while devlink_health_report() had acquired   the devlink lock.  A similar deadlock situation can be reproduced by requesting a crdump with   \u003e devlink health dump show pci/\u003cBDF\u003e reporter fw_fatal  while PCI error recovery is executed on the same \u003cBDF\u003e physical function by mlx5_core's pci_error_handlers. On s390 this can be injected with   \u003e zpcictl --reset-fw \u003cBDF\u003e  Tests with this patch failed to reproduce that second deadlock situation, the devlink command is rejected with \"kernel answers: Permission denied\" - and we get a kernel log message of:  mlx5_core 1ed0:00:00.1: mlx5_crdump_collect:50:(pid 254382): crdump: failed to lock vsc gw err -5  because the config read of VSC_SEMAPHORE is rejected by the underlying hardware.  Two prior attempts to address this issue have been discussed and ultimately rejected [see link], with the primary argument that s390's implementation of PCI error recovery is imposing restrictions that neither powerpc's EEH nor PCI AER handling need. Tests show that PCI error recovery on s390 is running to completion even without blocking access to PCI config space.","status":"published","published":"2025-12-16T16:16:10.547Z","modified":"2026-09-01T20:05:56.931233766Z","updated_at":"2026-11-02T15:45:48.025964Z"},{"id":"DLA-4436-1","title":"linux-6.1 - security update","status":"published","published":"2026-01-14T00:00:00Z","modified":"2026-01-14T13:15:02.066506Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"MGASA-2026-0017","title":"Updated kernel, kmod-virtualbox \u0026 kmod-xtables-addons packages fix security vulnerabilities","description":"Upstream kernel version 6.6.120 fixes bugs and vulnerabilities.\nThe kmod-virtualbox \u0026 kmod-xtables-addons packages have been updated to\nwork with this new kernel.\n","status":"published","published":"2026-01-24T20:25:04Z","modified":"2026-04-16T04:43:32.882687097Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"MGASA-2026-0018","title":"Updated kernel-linus packages fix security vulnerabilities","description":"Vanilla upstream kernel version 6.6.120 fixes bugs and vulnerabilities.\nFor information about the vulnerabilities see the links.\n","status":"published","published":"2026-01-26T20:03:34Z","modified":"2026-04-16T04:42:12.477260681Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:20826-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).\n- CVE-2024-14027: xattr: switch to CLASS(fd) (bsc#1259420).\n- CVE-2025-40181: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (bsc#1253471).\n- CVE-2025-68265: nvme: fix admin request_queue lifetime (bsc#1255360).\n- CVE-2025-68310: s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (bsc#1255160).\n- CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).\n- CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).\n- CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).\n- CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).\n- CVE-2026-23276: net: add xmit recursion limit to tunnel xmit functions (bsc#1260012).\n- CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).\n- CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).\n- CVE-2026-23316: net: ipv4: fix ARM64 alignment fault in multipath hash seed (bsc#1260573).\n- CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).\n- CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).\n- CVE-2026-23346: arm64: io: Rename ioremap_prot() to __ioremap_prot() (bsc#1260529).\n- CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).\n- CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).\n- CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).\n- CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).\n- CVE-2026-23375: mm: thp: deny THP for files on anonymous inodes (bsc#1260576).\n- CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).\n- CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).\n- CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).\n- CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).\n- CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).\n- CVE-2026-23417: bpf: Fix constant blinding for PROBE_MEM32 stores (bsc#1261410).\n- CVE-2026-23436: net: add helpers for lookup and walking netdevs under netdev_lock() (bsc#1261617).\n- CVE-2026-23437: net: shaper: protect late read accesses to the hierarchy (bsc#1261635).\n- CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).\n- CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).\n- CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).\n- CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).\n- CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).\n- CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).\n- CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).\n- CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).\n- CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).\n- CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).\n- CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).\n- CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).\n- CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on wakeup race (bsc#1261694).\n- CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).\n- CVE-2026-31395: bnxt_en: fix OOB access in DBG_BUF_PRODUCER async event handler (bsc#1261786).\n- CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).\n- CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).\n- CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).\n- CVE-2026-31406: xfrm: Fix work re-schedule after cancel in xfrm_nat_keepalive_net_fini() (bsc#1261629).\n- CVE-2026-31407: netfilter: conntrack: add missing netlink policy validations (bsc#1261632).\n- CVE-2026-31411: net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (bsc#1261752).\n- CVE-2026-31415: ipv6: avoid overflows in ip6_datagram_send_ctl() (bsc#1262099).\n- CVE-2026-31416: netfilter: nfnetlink_log: account for netlink header size (bsc#1262100).\n- CVE-2026-31420: bridge: mrp: reject zero test interval to avoid OOM panic (bsc#1262055).\n- CVE-2026-31421: net/sched: cls_fw: fix NULL pointer dereference on shared blocks (bsc#1262061).\n- CVE-2026-31422: net/sched: cls_flow: fix NULL pointer dereference on shared blocks (bsc#1262054).\n- CVE-2026-31423: net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() (bsc#1262063).\n- CVE-2026-31424: netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (bsc#1262053).\n- CVE-2026-31425: rds: ib: reject FRMR registration before IB connection is established (bsc#1262074).\n- CVE-2026-31427: netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp (bsc#1262086).\n- CVE-2026-31428: netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (bsc#1262087).\n- CVE-2026-31435: netfs: Fix read abandonment during retry (bsc#1262601).\n- CVE-2026-31449: ext4: validate p_idx bounds in ext4_ext_correct_indexes (bsc#1262616).\n- CVE-2026-31453: xfs: avoid dereferencing log items after push callbacks (bsc#1262617).\n- CVE-2026-31456: mm/pagewalk: fix race between concurrent split and refault (bsc#1262627).\n- CVE-2026-31494: net: cadence: macb: Synchronize stats calculations (bsc#1262671).\n- CVE-2026-31496: netfilter: nf_conntrack_expect: skip expectations in other netns via proc (bsc#1262673).\n- CVE-2026-31503: udp: Fix wildcard bind conflict check when using hash2 (bsc#1263077).\n- CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263085).\n- CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263093).\n- CVE-2026-31507: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer (bsc#1263095).\n- CVE-2026-31515: af_key: validate families in pfkey_send_migrate() (bsc#1262752).\n- CVE-2026-31519: btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create (bsc#1263012).\n- CVE-2026-31525: bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN (bsc#1262725).\n- CVE-2026-31526: bpf: Fix exception exit lock checking for subprogs (bsc#1262662).\n- CVE-2026-31528: perf: Make sure to use pmu_ctx-\u003epmu for groups (bsc#1263001).\n- CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262758).\n- CVE-2026-31547: drm/xe: Fix missing runtime PM reference in ccs_mode_store (bsc#1263018).\n- CVE-2026-31550: pmdomain: bcm: bcm2835-power: Increase ASB control timeout (bsc#1263104).\n- CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263107).\n- CVE-2026-31565: RDMA/irdma: Fix deadlock during netdev reset with active connections (bsc#1263064).\n- CVE-2026-31579: wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit (bsc#1263074).\n- CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263176).\n- CVE-2026-31588: KVM: x86: Use scratch field in MMIO fragment to hold small write values (bsc#1263165).\n- CVE-2026-31644: net: lan966x: fix use-after-free and leak in lan966x_fdma_reload() (bsc#1263048).\n- CVE-2026-31649: net: stmmac: fix integer underflow in chain mode (bsc#1263582).\n- CVE-2026-31658: net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() (bsc#1263052).\n- CVE-2026-31662: tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (bsc#1263131).\n- CVE-2026-31666: btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref() (bsc#1263138).\n- CVE-2026-31668: seg6: separate dst_cache for input and output paths in seg6 lwtunnel (bsc#1263140).\n- CVE-2026-31669: mptcp: fix slab-use-after-free in __inet_lookup_established (bsc#1263141).\n- CVE-2026-31675: net/sched: sch_netem: fix out-of-bounds access in packet corruption (bsc#1263556).\n- CVE-2026-31678: openvswitch: defer tunnel netdev_put to RCU release (bsc#1263562).\n- CVE-2026-31679: openvswitch: validate MPLS set/set_masked payload length (bsc#1263592).\n- CVE-2026-31681: netfilter: xt_multiport: validate range encoding in checkentry (bsc#1263593).\n- CVE-2026-31682: bridge: br_nd_send: linearize skb before parsing ND options (bsc#1263595).\n- CVE-2026-31684: net: sched: act_csum: validate nested VLAN headers (bsc#1263596).\n- CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263668).\n- CVE-2026-31691: igb: remove napi_synchronize() in igb_down() (bsc#1263604).\n- CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263901).\n- CVE-2026-31700: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (bsc#1263882).\n- CVE-2026-31738: vxlan: validate ND option lengths in vxlan_na_create (bsc#1264059).\n- CVE-2026-31787: xen/privcmd: fix double free via VMA splitting (bsc#1262181).\n- CVE-2026-43009: bpf: Fix incorrect pruning due to atomic fetch precision tracking (bsc#1264014).\n- CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1263931).\n- CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1263933).\n- CVE-2026-43037: ip6_tunnel: clear skb2-\u003ecb in ip4ip6_err() (bsc#1263995).\n- CVE-2026-43038: ipv6: icmp: clear skb2-\u003ecb in ip6_err_gen_icmpv6_unreach() (bsc#1264097).\n- CVE-2026-43045: mshv: Refactor and rename memory region handling functions (bsc#1263942).\n- CVE-2026-43050: atm: lec: fix use-after-free in sock_def_readable() (bsc#1264082).\n- CVE-2026-43060: netfilter: nft_ct: drop pending enqueued packets on removal (bsc#1264183).\n- CVE-2026-43082: net: txgbe: leave space for null terminators on property_entry (bsc#1264233).\n- CVE-2026-43088: net: af_key: zero aligned sockaddr tail in PF_KEY exports (bsc#1264469).\n- CVE-2026-43153: xfs: remove xfs_attr_leaf_hasname (bsc#1264586).\n- CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264848).\n- CVE-2026-43265: KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block() (bsc#1264427).\n- CVE-2026-43329: netfilter: flowtable: strictly check for maximum number of actions (bsc#1265085).\n- CVE-2026-43365: xfs: fix undersized l_iclog_roundoff values (bsc#1265119).\n- CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265116).\n- CVE-2026-43441: net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1264674).\n- CVE-2026-43494: net/rds: reset op_nents when zerocopy page pin fails (bsc#1265626).\n- CVE-2026-43503: net: skbuff: propagate shared-frag marker through frag-transfer helpers (bsc#1265960).\n\nThe following non security issues were fixed:\n\n- accel/qaic: Add overflow check to remap_pfn_range during mmap (git-fixes).\n- ACPI: AGDI: fix missing newline in error message (git-fixes).\n- ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug (git-fixes).\n- ACPI: scan: Use acpi_dev_put() in object add error paths (git-fixes).\n- ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO (git-fixes).\n- ACPI: video: force native backlight on HP OMEN 16 (8A44) (stable-fixes).\n- ACPI: video: Move Lenovo Legion S7 15ACH6 quirk to the right section (git-fixes).\n- ALSA: 6fire: Fix input volume change detection (git-fixes).\n- ALSA: 6fire: fix use-after-free on disconnect (git-fixes).\n- ALSA: aoa: i2sbus: clear stale prepared state (git-fixes).\n- ALSA: aoa: i2sbus: fix OF node lifetime handling (git-fixes).\n- ALSA: aoa: Skip devices with no codecs in i2sbus_resume() (git-fixes).\n- ALSA: aoa: Use guard() for mutex locks (stable-fixes).\n- ALSA: asihpi: avoid write overflow check warning (stable-fixes).\n- ALSA: caiaq: Don't abort when no input device is available (git-fixes).\n- ALSA: caiaq: Fix control_put() result and cache rollback (git-fixes).\n- ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path (git-fixes).\n- ALSA: caiaq: fix usb_dev refcount leak on probe failure (git-fixes).\n- ALSA: caiaq: Handle probe errors properly (git-fixes).\n- ALSA: caiaq: take a reference on the USB device in create_card() (git-fixes).\n- ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() (git-fixes).\n- ALSA: core: Fix potential data race at fasync handling (git-fixes).\n- ALSA: core: Serialize deferred fasync state checks (git-fixes).\n- ALSA: core: Validate compress device numbers without dynamic minors (git-fixes).\n- ALSA: ctxfi: Add fallback to default RSR for S/PDIF (git-fixes).\n- ALSA: ctxfi: Fix missing SPDIFI1 index handling (stable-fixes).\n- ALSA: ctxfi: Limit PTP to a single page (git-fixes).\n- ALSA: firewire-tascam: Do not drop unread control events (git-fixes).\n- ALSA: fireworks: bound device-supplied status before string array lookup (git-fixes).\n- ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 (stable-fixes).\n- ALSA: hda/realtek - fixed speaker no sound update (git-fixes).\n- ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk (stable-fixes).\n- ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx (stable-fixes).\n- ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC (stable-fixes).\n- ALSA: hda/realtek: add quirk for Framework F111:000F (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 (stable-fixes).\n- ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') (git-fixes).\n- ALSA: hda: cs35l41: Put ACPI device on missing physical node (git-fixes).\n- ALSA: hda: cs35l56: Propagate ASP TX source control errors (git-fixes).\n- ALSA: hda: cs35l56: Put ACPI device after setting companion (git-fixes).\n- ALSA: hda: Fix NULL pointer dereference in snd_hda_ctl_add() (git-fixes).\n- ALSA: misc: Use guard() for spin locks (stable-fixes).\n- ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger (stable-fixes).\n- ALSA: pcmtest: fix reference leak on failed device registration (git-fixes).\n- ALSA: pcmtest: Fix resource leaks in module init error paths (git-fixes).\n- ALSA: pcmtest: Return -EFAULT on pattern read copy failure (git-fixes).\n- ALSA: sc6000: Keep the programmed board state in card-private data (git-fixes).\n- ALSA: scarlett2: Add missing error check when initialise Autogain Status (git-fixes).\n- ALSA: scarlett2: Add missing sentinel initializer field (git-fixes).\n- ALSA: seq: Notify client and port info changes (stable-fixes).\n- ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes (stable-fixes).\n- ALSA: usb-audio: apply quirk for MOONDROP JU Jiu (stable-fixes).\n- ALSA: usb-audio: Avoid false E-MU sample-rate notifications (git-fixes).\n- ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() (git-fixes).\n- ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans (git-fixes).\n- ALSA: usb-audio: Bound MIDI endpoint descriptor scans (git-fixes).\n- ALSA: usb-audio: Evaluate packsize caps at the right place (git-fixes).\n- ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch (git-fixes).\n- ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams (git-fixes).\n- ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex (stable-fixes).\n- ALSA: usb-audio: Fix UAC3 cluster descriptor size check (git-fixes).\n- ALSA: usb-audio: midi2: Restart output URBs on resume (git-fixes).\n- ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES (git-fixes).\n- ALSA: virtio: drop an extaneous kernel-doc comment (git-fixes).\n- amdgpu/jpeg: fix deepsleep register for jpeg 5_0_0 and 5_0_2 (stable-fixes).\n- ASoC: amd: acp: Add DMI quirk for Valve Steam Deck OLED (git-fixes).\n- ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF (stable-fixes).\n- ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table (stable-fixes).\n- ASoC: codecs: ab8500: Fix casting of private data (git-fixes).\n- ASoC: cs35l56: Destroy workqueue in probe error path (git-fixes).\n- ASoC: cs35l56: Don't use devres to unregister component (git-fixes).\n- ASoC: cs35l56: Fix hibernate write in runtime resume error path (git-fixes).\n- ASoC: fsl_easrc: Change the type for iec958 channel status controls (git-fixes).\n- ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() (git-fixes).\n- ASoC: fsl_easrc: fix comment typo (git-fixes).\n- ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() (git-fixes).\n- ASoC: fsl_micfil: Add access property for \"VAD Detected\" (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in micfil_quality_set() (git-fixes).\n- ASoC: fsl_xcvr: Fix event generation for cached controls (git-fixes).\n- ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() (git-fixes).\n- ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() (git-fixes).\n- ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error (git-fixes).\n- ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop (git-fixes).\n- ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens (git-fixes).\n- ASoC: qcom: q6apm: move component registration to unmanaged version (git-fixes).\n- ASoC: qcom: q6apm: remove child devices when apm is removed (git-fixes).\n- ASoC: qcom: qdsp6: topology: check widget type before accessing data (git-fixes).\n- ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list (stable-fixes).\n- ASoC: SOF: compress: return the configured codec from get_params (git-fixes).\n- ASoC: SOF: Don't allow pointer operations on unconfigured streams (git-fixes).\n- ASoC: SOF: Intel: hda: Place check before dereference (git-fixes).\n- ASoC: SOF: topology: reject invalid vendor array size in token parser (stable-fixes).\n- ASoC: sti: Return errors from regmap_field_alloc() (git-fixes).\n- ASoC: sti: use managed regmap_field allocations (git-fixes).\n- ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J (stable-fixes).\n- ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 (stable-fixes).\n- backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() (git-fixes).\n- batman-adv: bla: only purge non-released claims (git-fixes).\n- batman-adv: bla: prevent use-after-free when deleting claims (git-fixes).\n- batman-adv: bla: put backbone reference on failed claim hash insert (git-fixes).\n- batman-adv: fix integer overflow on buff_pos (git-fixes).\n- batman-adv: hold claim backbone gateways by reference (git-fixes).\n- batman-adv: reject new tp_meter sessions during teardown (git-fixes).\n- batman-adv: reject oversized global TT response buffers (git-fixes).\n- batman-adv: stop caching unowned originator pointers in BAT IV (git-fixes).\n- bitfield: Add FIELD_MODIFY() helper (jsc#PED-14238).\n- Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling (git-fixes).\n- Bluetooth: btmtk: validate WMT event SKB length before struct access (git-fixes).\n- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (bsc#1260996).\n- Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (git-fixes).\n- Bluetooth: hci_event: fix memset typo (git-fixes).\n- Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt (git-fixes).\n- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (git-fixes).\n- Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (git-fixes).\n- Bluetooth: HIDP: serialise l2cap_unregister_user via hidp_session_sem (git-fixes).\n- Bluetooth: ISO: Fix data-race on dst in iso_sock_connect() (git-fixes).\n- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (git-fixes).\n- Bluetooth: l2cap: fix MPS check in l2cap_ecred_reconf_req (git-fixes).\n- Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (git-fixes).\n- Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() (git-fixes).\n- Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU (git-fixes).\n- Bluetooth: RFCOMM: pull credit byte with skb_pull_data() (git-fixes).\n- Bluetooth: SCO: check for codecs-\u003enum_codecs == 1 before assigning to sco_pi(sk)-\u003ecodec (git-fixes).\n- Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready (git-fixes).\n- Bluetooth: SCO: hold sk properly in sco_conn_ready (git-fixes).\n- Bluetooth: virtio_bt: clamp rx length before skb_put (git-fixes).\n- Bluetooth: virtio_bt: validate rx pkt_type header length (git-fixes).\n- bpf: Add third round of bounds deduction (git-fixes).\n- bpf: Fix u32/s32 bounds when ranges cross min/max boundary (git-fixes).\n- bpf: Improve bounds when s64 crosses sign boundary (git-fixes).\n- bpf: Switch CONFIG_CFI_CLANG to CONFIG_CFI (git-fixes).\n- btrfs: qgroup: update all parent qgroups when doing quick inherit (bsc#1258933).\n- btrfs: reject root items with drop_progress and zero drop_level (git-fixes).\n- btrfs: replace BUG() with error handling in __btrfs_balance() (git-fixes).\n- bus: mhi: host: pci_generic: Switch to async power up to avoid boot delays (git-fixes).\n- bus: rifsc: fix RIF configuration check for peripherals (git-fixes).\n- can: mcp251x: add error handling for power enable in open and resume (stable-fixes).\n- can: raw: fix ro-\u003euniq use-after-free in raw_rcv() (git-fixes).\n- can: ucan: fix devres lifetime (git-fixes).\n- cdc-acm: new quirk for EPSON HMD (stable-fixes).\n- check-for-config-changes: Exclude CC_MS_EXTENSIONS.\n- check-for-config-changes: Exclude HAVE_CFI_ICALL_NORMALIZE_INTEGERS{,_RUSTC}.\n- comedi: dt2815: add hardware detection to prevent crash (stable-fixes).\n- cpufreq: intel_pstate: Drop Arrow Lake from \"scaling factor\" list (bsc#1249104).\n- crypto: af_alg - limit RX SG extraction by receive buffer budget (git-fixes).\n- crypto: algif_aead - Fix minimum RX size check for decryption (git-fixes).\n- crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup (git-fixes).\n- crypto: atmel-ecc - Release client on allocation failure (git-fixes).\n- crypto: atmel-sha204a - Fix error codes in OTP reads (git-fixes).\n- crypto: atmel-sha204a - Fix OTP sysfs read and error handling (git-fixes).\n- crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path (git-fixes).\n- crypto: atmel-sha204a - Fix uninitialized data access on OTP read error (git-fixes).\n- crypto: atmel-tdes - fix DMA sync direction (git-fixes).\n- crypto: ccp - copy IV using skcipher ivsize (git-fixes).\n- crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (git-fixes).\n- crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (git-fixes).\n- crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (git-fixes).\n- crypto: ccree - fix a memory leak in cc_mac_digest() (git-fixes).\n- crypto: drivers - Switch back to struct platform_driver::remove() (jsc#PED-14238).\n- crypto: drivers - Use str_enable_disable-like helpers (jsc#PED-14238).\n- crypto: hisilicon - Fix dma_unmap_single() direction (git-fixes).\n- crypto: iaa - Adjust workqueue allocation type (jsc#PED-14238).\n- crypto: iaa - fix per-node CPU counter reset in rebalance_wq_table() (git-fixes).\n- crypto: iaa - Move compression CRC into request object (jsc#PED-14238).\n- crypto: iaa - Optimize rebalance_wq_table() (jsc#PED-14238).\n- crypto: iaa - Remove potential infinite loop in check_completion() (jsc#PED-14238).\n- crypto: iaa - Remove unreachable pr_debug from iaa_crypto_cleanup_module (jsc#PED-14238).\n- crypto: iaa - Remove unused disable_async argument from iaa_decompress (jsc#PED-14238).\n- crypto: iaa - Replace sprintf with sysfs_emit in sysfs show functions (jsc#PED-14238).\n- crypto: iaa - Simplify init_iaa_device() (jsc#PED-14238).\n- crypto: jitterentropy - replace long-held spinlock with mutex (git-fixes).\n- crypto: nx - Fix packed layout in struct nx842_crypto_header (git-fixes).\n- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (git-fixes).\n- crypto: qat - #undef field_get() before local definition (jsc#PED-14238).\n- crypto: qat - add adf_rl_get_num_svc_aes() in rate limiting (jsc#PED-14238).\n- crypto: qat - add bank state save and restore for qat_420xx (jsc#PED-14238).\n- crypto: qat - add command queue telemetry counters for GEN6 (jsc#PED-14238).\n- crypto: qat - add compression slice count for rate limiting (jsc#PED-14238).\n- crypto: qat - add decompression service for rate limiting (jsc#PED-14238).\n- crypto: qat - add decompression service to telemetry (jsc#PED-14238).\n- crypto: qat - add firmware headers for GEN6 devices (jsc#PED-14238).\n- crypto: qat - add GEN6 firmware loader (jsc#PED-14238).\n- crypto: qat - add get_svc_slice_cnt() in device data structure (jsc#PED-14238).\n- crypto: qat - add live migration enablers for GEN6 devices (jsc#PED-14238).\n- crypto: qat - add macro to write 64-bit values to registers (jsc#PED-14238).\n- crypto: qat - add missing header inclusion (jsc#PED-14238).\n- crypto: qat - add qat_6xxx driver (jsc#PED-14238).\n- crypto: qat - add ring buffer idle telemetry counter for GEN6 (jsc#PED-14238).\n- crypto: qat - add support for decompression service to GEN6 devices (jsc#PED-14238).\n- crypto: qat - consolidate service enums (jsc#PED-14238).\n- crypto: qat - Constify struct pm_status_row (jsc#PED-14238).\n- crypto: qat - disable 4xxx AE cluster when lead engine is fused off (git-fixes).\n- crypto: qat - disable 420xx AE cluster when lead engine is fused off (git-fixes).\n- crypto: qat - do not export adf_cfg_services (jsc#PED-14238).\n- crypto: qat - enable power management debugfs for GEN6 devices (jsc#PED-14238).\n- crypto: qat - enable RAS support for GEN6 devices (jsc#PED-14238).\n- crypto: qat - enable rate limiting feature for GEN6 devices (jsc#PED-14238).\n- crypto: qat - enable reporting of error counters for GEN6 devices (jsc#PED-14238).\n- crypto: qat - enable telemetry for GEN6 devices (jsc#PED-14238).\n- crypto: qat - export adf_get_service_mask() (jsc#PED-14238).\n- crypto: qat - export adf_init_admin_pm() (jsc#PED-14238).\n- crypto: qat - expose configuration functions (jsc#PED-14238).\n- crypto: qat - fix compression instance leak (git-fixes).\n- crypto: qat - fix IRQ cleanup on 6xxx probe failure (git-fixes).\n- crypto: qat - fix object goals in Makefiles (jsc#PED-14238.\n- crypto: qat - fix type mismatch in RAS sysfs show functions (git-fixes).\n- crypto: qat - Fix typo \"accelaration\" (jsc#PED-14238).\n- crypto: qat - fix virtual channel configuration for GEN6 devices (jsc#PED-14238).\n- crypto: qat - include qat_common in top Makefile (jsc#PED-14238).\n- crypto: qat - introduce fuse array (jsc#PED-14238).\n- crypto: qat - make adf_dev_autoreset() static (jsc#PED-14238).\n- crypto: qat - optimize allocations for fw authentication (jsc#PED-14238).\n- crypto: qat - refactor compression template logic (jsc#PED-14238).\n- crypto: qat - refactor FW signing algorithm (jsc#PED-14238).\n- crypto: qat - refactor ring-related debug functions (jsc#PED-14238).\n- crypto: qat - refactor service parsing logic (jsc#PED-14238).\n- crypto: qat - relocate and rename bank state structure definition (jsc#PED-14238).\n- crypto: qat - relocate bank state helper functions (jsc#PED-14238).\n- crypto: qat - relocate power management debugfs helper APIs (jsc#PED-14238).\n- crypto: qat - relocate service related functions (jsc#PED-14238).\n- crypto: qat - remove BITS_IN_DWORD() (jsc#PED-14238).\n- crypto: qat - Remove dst_null support (jsc#PED-14238).\n- crypto: qat - remove duplicate masking for GEN6 devices (jsc#PED-14238).\n- crypto: qat - remove initialization in device class (jsc#PED-14238).\n- crypto: qat - remove redundant FW image size check (jsc#PED-14238).\n- crypto: qat - remove unused adf_devmgr_get_first (jsc#PED-14238).\n- crypto: qat - remove unused members in suof structure (jsc#PED-14238).\n- crypto: qat - rename and relocate timer logic (jsc#PED-14238).\n- crypto: qat - reorder objects in qat_common Makefile (jsc#PED-14238).\n- crypto: qat - replace CHECK_STAT macro with static inline function (jsc#PED-14238).\n- crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() (jsc#PED-14238).\n- crypto: qat - restore ASYM service support for GEN6 devices (jsc#PED-14238).\n- crypto: qat - Return pointer directly in adf_ctl_alloc_resources (jsc#PED-14238).\n- crypto: qat - set command ids as reserved (jsc#PED-14238).\n- crypto: qat - switch to standard pattern for PCI IDs (jsc#PED-14238).\n- crypto: qat - update firmware api (jsc#PED-14238).\n- crypto: qat - use pr_fmt() in adf_gen4_hw_data.c (jsc#PED-14238).\n- crypto: qat - use pr_fmt() in qat uclo.c (jsc#PED-14238).\n- crypto: qat - use simple_strtoull to improve qat_uclo_parse_num (jsc#PED-14238).\n- crypto: qat - use swab32 macro (git-fixes).\n- crypto: qat - validate service in rate limiting sysfs api (jsc#PED-14238).\n- crypto: qat/qat_6xxx - Fix NULL vs IS_ERR() check in adf_probe() (jsc#PED-14238).\n- crypto: sa2ul - Fix AEAD fallback algorithm names (git-fixes).\n- crypto: simd - reject compat registrations without __ prefixes (git-fixes).\n- crypto: talitos - fix SEC1 32k ahash request limitation (git-fixes).\n- crypto: tegra - Disable softirqs before finalizing request (git-fixes).\n- devres: fix missing node debug info in devm_krealloc() (git-fixes).\n- dmaengine: dw-axi-dmac: fix Alignment should match open parenthesis (git-fixes).\n- dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function (git-fixes).\n- dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() (git-fixes).\n- dpll: zl3073x: Add support to adjust phase (bsc#1255752).\n- dpll: zl3073x: Fix output pin phase adjustment sign (bsc#1255752).\n- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (bsc#1255752).\n- dpll: zl3073x: Specify phase adjustment granularity for pins (bsc#1255752).\n- drivers/base/memory: fix memory block reference leak in poison accounting (git-fixes).\n- drm/amd/display: Add NULL check for integrated_info in clk_mgr_construct (git-fixes).\n- drm/amd/display: Allow DCE link encoder without AUX registers (git-fixes).\n- drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths (git-fixes).\n- drm/amd/display: Change dither policy for 10 bpc output back to dithering (git-fixes).\n- drm/amd/display: Correct logic check error for fastboot (git-fixes).\n- drm/amd/display: Disable 10-bit truncation and dithering on DCE 6.x (git-fixes).\n- drm/amd/display: Disable fastboot on DCE 6 too (stable-fixes).\n- drm/amd/display: Read EDID from VBIOS embedded panel info (git-fixes).\n- drm/amd/pm/ci: Clear EnabledForActivity field for memory levels (git-fixes).\n- drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs (git-fixes).\n- drm/amd/pm/ci: Fill DW8 fields from SMC (git-fixes).\n- drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 (git-fixes).\n- drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled (git-fixes).\n- drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board (git-fixes).\n- drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock (git-fixes).\n- drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x (git-fixes).\n- drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) (git-fixes).\n- drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ (stable-fixes).\n- drm/amdgpu/gfx10: look at the right prop for gfx queue priority (git-fixes).\n- drm/amdgpu/gfx11: look at the right prop for gfx queue priority (git-fixes).\n- drm/amdgpu/gmc: Fix AMDGPU_GART_PLACEMENT_LOW to not overlap with VRAM (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.5 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.0 ring (git-fixes).\n- drm/amdgpu/pm: add missing revision check for CI (git-fixes).\n- drm/amdgpu/pm: align Hawaii mclk workaround with radeon (git-fixes).\n- drm/amdgpu/pm: drop SMU driver if version not matched messages (stable-fixes).\n- drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission (git-fixes).\n- drm/amdgpu/vce: Prevent partial address patches (stable-fixes).\n- drm/amdgpu/vcn3: Avoid overflow on msg bound check (git-fixes).\n- drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (stable-fixes).\n- drm/amdgpu/vcn4: Avoid overflow on msg bound check (git-fixes).\n- drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (stable-fixes).\n- drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (stable-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v4.0.5 enc ring (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v5.0.0 enc ring (git-fixes).\n- drm/amdgpu: Add bounds checking to ib_{get,set}_value (stable-fixes).\n- drm/amdgpu: Add default case in DVI mode validation (git-fixes).\n- drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG (git-fixes).\n- drm/amdgpu: fix zero-size GDS range init on RDNA4 (stable-fixes).\n- drm/amdgpu: gate VM CPU HDP flush on reset lock (stable-fixes).\n- drm/amdgpu: replace PASID IDR with XArray (git-fixes).\n- drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count (stable-fixes).\n- drm/amdgpu: zero-initialize GART table on allocation (stable-fixes).\n- drm/amdkfd: Add upper bound check for num_of_nodes (stable-fixes).\n- drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure (stable-fixes).\n- drm/amdkfd: Make all TLB-flushes heavy-weight (stable-fixes).\n- drm/amdkfd: validate SVM ioctl nattr against buffer size (stable-fixes).\n- drm/arcpgu: fix device node leak (git-fixes).\n- drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs (git-fixes).\n- drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check (git-fixes).\n- drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() (git-fixes).\n- drm/bridge: stm_lvds: Do not fail atomic_check on disabled connector (git-fixes).\n- drm/etnaviv: Fix armed job not being pushed to the DRM scheduler (git-fixes).\n- drm/exynos: remove bridge when component_add fails (git-fixes).\n- drm/fb-helper: Fix clipping when damage area spans a single scanline (git-fixes).\n- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (git-fixes).\n- drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup (git-fixes).\n- drm/gma500/oaktrail_lvds: fix hang on init failure (git-fixes).\n- drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init (git-fixes).\n- drm/i915/dp: Fix VSC dynamic range signaling for RGB formats (git-fixes).\n- drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (git-fixes).\n- drm/i915/wm: Verify the correct plane DDB entry (git-fixes).\n- drm/i915: skip __i915_request_skip() for already signaled requests (git-fixes).\n- drm/imagination: Switch reset_reason fields from enum to u32 (git-fixes).\n- drm/komeda: fix integer overflow in AFBC framebuffer size check (git-fixes).\n- drm/loongson: Use managed KMS polling (git-fixes).\n- drm/msm/a6xx: Fix dumping A650+ debugbus blocks (git-fixes).\n- drm/msm/a6xx: Fix HLSQ register dumping (git-fixes).\n- drm/msm/a6xx: Use barriers while updating HFI Q headers (git-fixes).\n- drm/msm/dpu: fix mismatch between power and frequency (git-fixes).\n- drm/msm/dsi: add the missing parameter description (git-fixes).\n- drm/msm/dsi: fix bits_per_pclk (git-fixes).\n- drm/msm/dsi: fix hdisplay calculation for CMD mode panel (git-fixes).\n- drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 (git-fixes).\n- drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata() (git-fixes).\n- drm/msm/shrinker: Fix can_block() logic (git-fixes).\n- drm/nouveau: fix nvkm_device leak on aperture removal failure (git-fixes).\n- drm/nouveau: fix u32 overflow in pushbuf reloc bounds check (git-fixes).\n- drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds (git-fixes).\n- drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds (git-fixes).\n- drm/panel: sharp-ls043t1le01: make use of prepare_prev_first (git-fixes).\n- drm/panel: simple: Correct G190EAN01 prepare timing (git-fixes).\n- drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() (git-fixes).\n- drm/panthor: Fix outdated function documentation (git-fixes).\n- drm/radeon: add missing revision check for CI (git-fixes).\n- drm/sun4i: backend: fix error pointer dereference (git-fixes).\n- drm/sun4i: Fix resource leaks (git-fixes).\n- drm/v3d: Handle error from drm_sched_entity_init() (git-fixes).\n- drm/vc4: Fix a memory leak in hang state error path (git-fixes).\n- drm/vc4: Fix memory leak of BO array in hang state (git-fixes).\n- drm/vc4: platform_get_irq_byname() returns an int (stable-fixes).\n- drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock (git-fixes).\n- drm/vc4: Release runtime PM reference after binding V3D (git-fixes).\n- drm/vram: remove DRM_VRAM_MM_FILE_OPERATIONS from docs (git-fixes).\n- drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked() (git-fixes).\n- drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked() (git-fixes).\n- drm/xe/debugfs: Correct printing of register whitelist ranges (git-fixes).\n- drm/xe/dma-buf: handle empty bo and UAF races (git-fixes).\n- drm/xe/gsc: Fix BO leak on error in query_compatibility_version() (git-fixes).\n- drm/xe/uapi: update used tracking kernel-doc (git-fixes).\n- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (git-fixes).\n- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (git-fixes).\n- dt-bindings: net: Fix Tegra234 MGBE PTP clock (git-fixes).\n- efi/capsule-loader: fix incorrect sizeof in phys array reallocation (git-fixes).\n- efi: pstore: Drop efivar lock when efi_pstore_open() returns with an error (git-fixes).\n- erofs: add GFP_NOIO in the bio completion if needed (git-fixes).\n- ext4: fix fsync(2) for nojournal mode (git-fixes).\n- ext4: make recently_deleted() properly work with lazy itable initialization (git-fixes).\n- ext4: reject mount if bigalloc with s_first_data_block != 0 (git-fixes).\n- extcon: Fixed sysfs duplicate filename issue (git-fixes).\n- extcon: ptn5150: handle pending IRQ events during system resume (git-fixes).\n- fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break (git-fixes).\n- fbdev: offb: fix PCI device reference leak on probe failure (git-fixes).\n- fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO (stable-fixes).\n- fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO (git-fixes).\n- firmware: arm_ffa: Use the correct buffer size during RXTX_MAP (git-fixes).\n- firmware: dmi: Correct an indexing error in dmi.h (git-fixes).\n- firmware: google: framebuffer: Do not mark framebuffer as busy (git-fixes).\n- firmware: google: framebuffer: Do not unregister platform device (git-fixes).\n- gpio: of: clear OF_POPULATED on hog nodes in remove path (git-fixes).\n- gpio: tegra: fix irq_release_resources calling enable instead of disable (git-fixes).\n- gtp: disable BH before calling udp_tunnel_xmit_skb() (git-fixes).\n- HID: alps: fix NULL pointer dereference in alps_raw_event() (git-fixes).\n- HID: amd_sfh: don't log error when device discovery fails with -EOPNOTSUPP (git-fixes).\n- HID: apple: ensure the keyboard backlight is off if suspending (git-fixes).\n- HID: asus: do not abort probe when not necessary (git-fixes).\n- HID: asus: make asus_resume adhere to linux kernel coding standards (git-fixes).\n- HID: core: clamp report_size in s32ton() to avoid undefined shift (stable-fixes).\n- HID: logitech-hidpp: Enable MX Master 4 over bluetooth (stable-fixes).\n- HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure (stable-fixes).\n- HID: multitouch: Check to ensure report responses match the request (stable-fixes).\n- HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 (stable-fixes).\n- HID: roccat: fix use-after-free in roccat_report_event (stable-fixes).\n- HID: usbhid: fix deadlock in hid_post_reset() (git-fixes).\n- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (stable-fixes).\n- hisi_acc_vfio_pci: add eq and aeq interruption restore (git-fixes).\n- hisi_acc_vfio_pci: bugfix cache write-back issue (git-fixes).\n- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (git-fixes).\n- hv_sock: fix ARM64 support (git-fixes).\n- hv_sock: update outdated comment for renamed vsock_stream_recvmsg() (git-fixes).\n- hwmon: (ads7871) Fix endianness bug in 16-bit register reads (git-fixes).\n- hwmon: (corsair-psu) Close HID device on probe errors (git-fixes).\n- hwmon: (lm63) Add locking to avoid TOCTOU (git-fixes).\n- hwmon: (ltc2992) Clamp threshold writes to hardware range (git-fixes).\n- hwmon: (ltc2992) Fix u32 overflow in power read path (git-fixes).\n- hwmon: (ltc4286) Add missing MODULE_IMPORT_NS(\"PMBUS\") (git-fixes).\n- hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt (git-fixes).\n- hwmon: (powerz) Fix use-after-free on USB disconnect (git-fixes).\n- hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data() (git-fixes).\n- i2c: s3c24xx: check the size of the SMBUS message before using it (stable-fixes).\n- i2c: smbus: reject oversized block transfers in the common path (git-fixes).\n- i2c: stm32f7: reinit_completion() per transfer not per msg (git-fixes).\n- i2c: stub: Reject I2C block transfers with invalid length (git-fixes).\n- i2c: tegra: Add HS mode support (bsc#1261550).\n- i2c: tegra: Add Tegra256 support (bsc#1261550).\n- i2c: tegra: Do not configure DMA if not supported (bsc#1261550).\n- i2c: tegra: Don't mark devices with pins as IRQ safe (stable-fixes).\n- i2c: tegra: Update Tegra256 timing parameters (bsc#1261550).\n- i2c: tegra: Use separate variables for fast and fastplus (bsc#1261550).\n- i3c: dw: Fix memory leak in dw_i3c_master_i3c_xfers() (git-fixes).\n- i3c: master: Fix error codes at send_ccc_cmd (git-fixes).\n- i3c: mipi-i3c-hci: fix IBI payload length calculation for final status (git-fixes).\n- ibmveth: Disable GSO for packets with small MSS (bsc#1265144).\n- iio: adc: ad7192: Revert \"properly check spi_get_device_match_data()\" (stable-fixes).\n- iio: adc: ad7768-1: fix one-shot mode data acquisition (git-fixes).\n- iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() (git-fixes).\n- iio: frequency: admv1013: add dev variable (stable-fixes).\n- iio: frequency: admv1013: fix NULL pointer dereference on str (git-fixes).\n- Input: bcm5974 - recover from failed mode switch (stable-fixes).\n- Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table (stable-fixes).\n- Input: uinput - fix circular locking dependency with ff-core (git-fixes).\n- Input: uinput - take event lock when submitting FF request \"event\" (stable-fixes).\n- Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode (stable-fixes).\n- Input: xpad - add support for Razer Wolverine V3 Pro (stable-fixes).\n- interconnect: debugfs: fix devm_kstrdup and kfree mismatch (git-fixes).\n- io_uring/timeout: check unused sqe fields (git-fixes).\n- iommu/amd: move wait_on_sem() out of spinlock (git-fixes bsc#1260593).\n- iommu/amd: serialize sequence allocation under concurrent TLB invalidations (git-fixes bsc#1260593).\n- iommu/vt-d: Remove LPIG from page group response descriptor (jsc#PED-16113).\n- ipmi: Add limits to event and receive message requests (git-fixes).\n- ipmi: Check event message buffer response for bad data (git-fixes).\n- ipmi: ssif_bmc: change log level to dbg in irq callback (git-fixes).\n- ipmi: ssif_bmc: fix message desynchronization after truncated response (git-fixes).\n- ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure (git-fixes).\n- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (git-fixes).\n- KVM: arm64: Allow cacheable stage 2 mapping using VMA flags (git-fixes).\n- KVM: arm64: Assume non-PFNMAP/MIXEDMAP VMAs can be mapped cacheable (git-fixes).\n- KVM: arm64: Block cacheable PFNMAP mapping (git-fixes).\n- KVM: arm64: Consolidate idreg callbacks (git-fixes).\n- KVM: arm64: Discard PC update state on vcpu reset (git-fixes).\n- KVM: arm64: Finalize ID registers only once per VM (git-fixes).\n- KVM: arm64: Fix MTE flag initialization for protected VMs (git-fixes).\n- KVM: arm64: Fix page leak in user_mem_abort() (git-fixes).\n- KVM: arm64: Fix Trace Buffer trap polarity for protected VMs (git-fixes).\n- KVM: arm64: Fix Trace Buffer trapping for protected VMs (git-fixes).\n- KVM: arm64: Fix vma_shift staleness on nested hwpoison path (git-fixes).\n- KVM: arm64: Hide S1POE from guests when not supported by the host (git-fixes).\n- KVM: arm64: Limit clearing of ID_{AA64PFR0,PFR1}_EL1.GIC to userspace irqchip (git-fixes).\n- KVM: arm64: Make all 32bit ID registers fully writable (git-fixes).\n- KVM: arm64: nv: Add trap config for DBGWCR\u003c15\u003e_EL1 (git-fixes).\n- KVM: arm64: nv: Return correct RES0 bits for FGT registers (git-fixes).\n- KVM: arm64: pkvm: Fallback to level-3 mapping on host stage-2 fault (git-fixes).\n- KVM: arm64: Read PMUVer as unsigned (git-fixes).\n- KVM: arm64: Rename the device variable to s2_force_noncacheable (git-fixes).\n- KVM: arm64: Return early from trace helpers when KVM isn't available (git-fixes).\n- KVM: arm64: Set ID_{AA64PFR0,PFR1}_EL1.GIC when GICv3 is configured (git-fixes).\n- KVM: arm64: vgic-v3: Release reserved slot outside of lpi_xa's lock (git-fixes).\n- KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes).\n- KVM: nSVM: Use vcpu-\u003earch.cr2 when updating vmcb12 on nested #VMEXIT (git-fixes).\n- KVM: nVMX: Add consistency check for TSC_MULTIPLIER=0 (git-fixes).\n- KVM: Reject wrapped offset in kvm_reset_dirty_gfn() (git-fixes).\n- KVM: SEV: Disallow LAUNCH_FINISH if vCPUs are actively being created (git-fixes).\n- KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (git-fixes).\n- KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish (git-fixes).\n- KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm-\u003elock (git-fixes).\n- KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU (git-fixes).\n- KVM: SVM: Disallow EFER.LMSLE when not supported by hardware (git-fixes).\n- KVM: SVM: Fix a missing kunmap_local() in sev_gmem_post_populate() (git-fixes).\n- KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC (git-fixes).\n- KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (git-fixes).\n- KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN (git-fixes).\n- KVM: SVM: Properly check RAX in the emulator for SVM instructions (git-fixes).\n- KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (git-fixes).\n- KVM: TDX: Explicitly set user-return MSRs that *may* be clobbered by the TDX-Module (git-fixes).\n- KVM: x86/mmu: Fix UBSAN warning when reading nx_huge_pages parameter (git-fixes).\n- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (git-fixes).\n- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (git-fixes).\n- KVM: x86: Advertise EferLmsleUnsupported to userspace (git-fixes).\n- KVM: x86: check for nEPT/nNPT in slow flush hypercalls (git-fixes).\n- KVM: X86: Fix array_index_nospec protection in __pv_send_ipi (git-fixes).\n- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (git-fixes).\n- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (git-fixes).\n- KVM: x86: Ignore cpuid faulting in SMM (git-fixes).\n- leds: lgm-sso: Remove duplicate assignments for priv-\u003emmap (git-fixes).\n- leds: qcom-lpg: Check for array overflow when selecting the high resolution (stable-fixes).\n- lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() (git-fixes).\n- md/raid1: fix the comparing region of interval tree (bsc#1261555).\n- md/raid1: serialize overlap io for writemostly disk (bsc#1261555).\n- media: amphion: Fix race between m2m job_abort and device_run (git-fixes).\n- media: as102: fix to not free memory after the device is registered in as102_usb_probe() (git-fixes).\n- media: chips-media: wave5: add missing spinlock protection for handle_dynamic_resolution_change() (git-fixes).\n- media: chips-media: wave5: add missing spinlock protection for send_eos_event() (git-fixes).\n- media: chips-media: wave5: fix a potential memory leak in wave5_vdi_init() (git-fixes).\n- media: dib8000: avoid division by 0 in dib8000_set_dds() (git-fixes).\n- media: em28xx: fix use-after-free in em28xx_v4l2_open() (git-fixes).\n- media: hackrf: fix to not free memory after the device is registered in hackrf_probe() (git-fixes).\n- media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() (git-fixes).\n- media: i2c: imx283: Enter full standby when stopping streaming (git-fixes).\n- media: i2c: imx283: Fix hang when going from large to small resolution (git-fixes).\n- media: i2c: imx412: Assert reset GPIO during probe (git-fixes).\n- media: i2c: ov08d10: fix image vertical start setting (git-fixes).\n- media: i2c: ov8856: free control handler on error in ov8856_init_controls() (git-fixes).\n- media: intel/ipu6: fix error pointer dereference (git-fixes).\n- media: mtk-jpeg: fix use-after-free in release path due to uncancelled work (git-fixes).\n- media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 (git-fixes).\n- media: omap3isp: drop the use count of v4l2 pipeline (git-fixes).\n- media: pci: zoran: fix potential memory leak in zoran_probe() (git-fixes).\n- media: rc: streamzap: Error handling in probe (git-fixes).\n- media: rc: xbox_remote: heed DMA restrictions (git-fixes).\n- media: saa7164: add ioremap return checks and cleanups (git-fixes).\n- media: staging: imx: configure src_mux in csi_start (git-fixes).\n- media: staging: imx: request mbus_config in csi_start (git-fixes).\n- media: uvcvideo: Enable VB2_DMABUF for metadata stream (git-fixes).\n- media: videobuf2: Set vma_flags in vb2_dma_sg_mmap (git-fixes).\n- media: vidtv: fix nfeeds state corruption on start_streaming failure (git-fixes).\n- media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections (git-fixes).\n- media: vidtv: fix pass-by-value structs causing MSAN warnings (git-fixes).\n- memory: tegra30-emc: Fix dll_change check (git-fixes).\n- memory: tegra124-emc: Fix dll_change check (git-fixes).\n- mfd: core: Preserve OF node when ACPI handle is present (git-fixes).\n- mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() (git-fixes).\n- mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused (git-fixes).\n- mkspec: Add signature to source list only when it exists.\n- mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration (git-fixes).\n- mmc: vub300: fix NULL-deref on disconnect (git-fixes).\n- modpost: Amend ppc64 save/restfpr symnames for -Os build (bsc#1215199).\n- mtd: docg3: fix use-after-free in docg3_release() (git-fixes).\n- mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions (git-fixes).\n- mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path (git-fixes).\n- mtd: physmap_of_gemini: Fix disabled pinctrl state check (git-fixes).\n- mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob (git-fixes).\n- mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations (git-fixes).\n- mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() (git-fixes).\n- mtd: spi-nor: sst: Fix write enable before AAI sequence (git-fixes).\n- mtd: spi-nor: swp: check SR_TB flag when getting tb_mask (git-fixes).\n- net-shapers: don't free reply skb after genlmsg_reply() (git-fixes).\n- net/mlx5: Fix HCA caps leak on notifier init failure (git-fixes).\n- net/rds: reset op_nents when zerocopy page pin fails (bsc#1265626).\n- net/sched: cls_fw: fix NULL dereference of \"old\" filters before change() (git-fixes).\n- net/sched: fix pedit partial COW leading to page cache corruption (bsc#1265421).\n- net: gro: don't merge zcopy skbs (git-fixes).\n- net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf (git-fixes).\n- net: mana: Add MAC address to vPort logs and clarify error messages (git-fixes).\n- net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq() (git-fixes).\n- net: mana: Don't overwrite port probe error with add_adev result (git-fixes).\n- net: mana: Fix crash from unvalidated SHM offset read from BAR0 during FLR (bsc#1265846).\n- net: mana: Fix EQ leak in mana_remove on NULL port (git-fixes).\n- net: mana: Fix RX skb truesize accounting (bsc#1248754).\n- net: mana: Guard mana_remove against double invocation (git-fixes).\n- net: mana: hardening: Validate adapter_mtu from MANA_QUERY_DEV_CONFIG (git-fixes).\n- net: mana: hardening: Validate doorbell ID from GDMA_REGISTER_DEVICE response (git-fixes).\n- net: mana: Init gf_stats_work before potential error paths in probe (git-fixes).\n- net: mana: Init link_change_work before potential error paths in probe (git-fixes).\n- net: mana: Move current_speed debugfs file to mana_init_port() (git-fixes).\n- net: mana: remove double CQ cleanup in mana_create_rxq error path (git-fixes).\n- net: mana: Set default number of queues to 16 (bsc#1261648).\n- net: mana: Skip WQ object destruction for uninitialized RXQ (git-fixes).\n- net: mana: Use at least SZ_4K in doorbell ID range check (git-fixes).\n- net: mana: Use pci_name() for debugfs directory naming (git-fixes).\n- net: phy: broadcom: Save PHY counters during suspend (git-fixes).\n- net: phy: DP83TC811: add reading of abilities (git-fixes).\n- net: phy: dp83869: fix setting CLK_O_SEL field (git-fixes).\n- net: phy: fix a return path in get_phy_c45_ids() (git-fixes).\n- net: phy: qcom: at803x: Use the correct bit to disable extended next page (git-fixes).\n- net: stmmac: Fix PTP ref clock for Tegra234 (git-fixes).\n- net: usb: asix: ax88772: re-add usbnet_link_change() in phylink callbacks (git-fixes).\n- net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() (git-fixes).\n- net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() (git-fixes).\n- net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit (git-fixes).\n- net: wan: fsl_ucc_hdlc: fix ucc_hdlc_remove (git-fixes).\n- net: wan: fsl_ucc_hdlc: fix uhdlc_memclean (git-fixes).\n- net: wan: fsl_ucc_hdlc: free tx_skbuff in uhdlc_memclean (git-fixes).\n- net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler (git-fixes).\n- NFC: digital: Bounds check NFC-A cascade depth in SDD response handler (git-fixes).\n- nfc: llcp: add missing return after LLCP_CLOSED checks (git-fixes).\n- nfc: pn533: allocate rx skb before consuming bytes (git-fixes).\n- nfc: s3fwrn5: allocate rx skb before consuming bytes (git-fixes).\n- NFC: trf7970a: Ignore antenna noise when checking for RF field (git-fixes).\n- nvme-apple: drop invalid put of admin queue reference count (git-fixes).\n- nvme-auth: Include SC_C in RVAL controller hash (bsc#1260428).\n- nvme-loop: do not cancel I/O and admin tagset during ctrl reset/shutdown (bsc#1262709).\n- nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 (git-fixes).\n- nvme: Allow reauth from sysfs (bsc#1259672).\n- nvme: Expose the tls_configured sysfs for secure concat connections (bsc#1259672).\n- nvme: expose TLS mode (bsc#1259672).\n- nvme: fix admin queue leak on controller reset (git-fixes).\n- nvme: fix PCIe subsystem reset controller state transition (bsc#1261738).\n- nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers (git-fixes).\n- ocfs2: fix possible deadlock between unlink and dio_end_io_write (bsc#1258718).\n- ocfs2: split transactions in dio completion to avoid credit exhaustion (bsc#1258718).\n- openvswitch: vport: fix self-deadlock on release of tunnel ports (git-fixes).\n- panic/printk: replace other_cpu_in_panic() with panic_on_other_cpu() (bsc#1261149).\n- panic/printk: replace this_cpu_in_panic() with panic_on_this_cpu() (bsc#1261149).\n- panic: introduce helper functions for panic state (bsc#1261149).\n- panic: use angle-bracket include for panic.h (bsc#1261149).\n- PCI/AER: Clear only error bits in PCIe Device Status (git-fixes).\n- PCI/AER: Stop ruling out unbound devices as error source (git-fixes).\n- PCI/ASPM: Fix pci_clear_and_set_config_dword() usage (git-fixes).\n- PCI/NPEM: Set LED_HW_PLUGGABLE for hotplug-capable ports (git-fixes).\n- PCI/TPH: Allow TPH enable for RCiEPs (git-fixes).\n- PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well (git-fixes).\n- PCI: dwc: rcar-gen4: Change EPC BAR alignment to 4K as per the documentation (git-fixes).\n- PCI: Enable AtomicOps only if Root Port supports them (git-fixes).\n- PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown (git-fixes).\n- PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup (git-fixes).\n- PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete (git-fixes).\n- PCI: hv: Set default NUMA node to 0 for devices without affinity info (bsc#1261648).\n- PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found (git-fixes).\n- PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion support (git-fixes).\n- PCI: tegra194: Allow system suspend when the Endpoint link is not up (git-fixes).\n- PCI: tegra194: Disable direct speed change for Endpoint mode (git-fixes).\n- PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down (git-fixes).\n- PCI: tegra194: Disable PERST# IRQ only in Endpoint mode (git-fixes).\n- PCI: tegra194: Fix CBB timeout caused by DBI access before core power-on (git-fixes).\n- PCI: tegra194: Fix polling delay for L2 state (git-fixes).\n- PCI: tegra194: Free up Endpoint resources during remove() (git-fixes).\n- PCI: tegra194: Increase LTSSM poll time on surprise link down (git-fixes).\n- PCI: tegra194: Set LTR message request before PCIe link up in Endpoint mode (git-fixes).\n- PCI: tegra194: Use devm_gpiod_get_optional() to parse \"nvidia,refclk-select\" (git-fixes).\n- PCI: tegra194: Use DWC IP core version (git-fixes).\n- pinctrl: abx500: Fix type of 'argument' variable (git-fixes).\n- pinctrl: Fix spelling problem (git-fixes).\n- pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) (stable-fixes).\n- pinctrl: pic32: change all cases of bare 'unsigned' to 'unsigned int' (git-fixes).\n- pinctrl: pic32: use consistent spacing around '+' (git-fixes).\n- pinctrl: pinctrl-pic32: Fix resource leak (git-fixes).\n- pinctrl: realtek: Fix function signature for config argument (git-fixes).\n- pinctrl: renesas: rzg2l: Fix save/restore of {IOLH,IEN,PUPD,SMT} registers (git-fixes).\n- platform/chrome: chromeos_tbmc: Drop wakeup source on remove (git-fixes).\n- platform/surface: surfacepro3_button: Drop wakeup source on remove (git-fixes).\n- platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug (stable-fixes).\n- platform/x86/intel-uncore-freq: Handle autonomous UFS status bit (git-fixes).\n- platform/x86: asus-wmi: adjust screenpad power/brightness handling (git-fixes).\n- platform/x86: asus-wmi: fix screenpad brightness range (git-fixes).\n- platform/x86: dell-wmi-sysman: bound enumeration string aggregation (git-fixes).\n- platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() (git-fixes).\n- platform/x86: hp-wmi: Ignore backlight and FnLock events (stable-fixes).\n- platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup (git-fixes).\n- power: supply: axp288_charger: Do not cancel work before initializing it (git-fixes).\n- power: supply: max17042: avoid overflow when determining health (git-fixes).\n- powerpc/crash: fix backup region offset update to elfcorehdr (bsc#1259535).\n- powerpc/crash: Update backup region offset in elfcorehdr on memory hotplug (bsc#1259535).\n- printk/nbcon/panic: Allow printk kthread to sleep when the system is in panic (bsc#1261149).\n- printk/nbcon: Block printk kthreads when any CPU is in an emergency context (bsc#1261149).\n- printk/nbcon: Release nbcon consoles ownership in atomic flush after each emitted record (bsc#1261149).\n- printk/nbcon: Restore IRQ in atomic flush after each emitted record (bsc#1261149).\n- printk/nbcon: use panic_on_this_cpu() helper (bsc#1261149).\n- printk: Allow printk_trigger_flush() to flush all types (bsc#1262750).\n- printk: Allow to use the printk kthread immediately even for 1st nbcon (jsc#PED-7912).\n- printk: Avoid irq_work for printk_deferred() on suspend (bsc#1262750).\n- printk: Avoid scheduling irq_work on suspend (bsc#1262750).\n- printk: console_flush_one_record() code cleanup (bsc#1261149).\n- printk: Introduce console_flush_one_record (bsc#1261149).\n- printk: Use console_flush_one_record for legacy printer kthread (bsc#1261149).\n- pwm: imx-tpm: Count the number of enabled channels in probe (git-fixes).\n- qat: don't mess with -\u003ed_name (jsc#PED-14238).\n- r8152: fix incorrect register write to USB_UPHY_XTAL (git-fixes).\n- RDMA/irdma: Fix double free related to rereg_user_mr (git-fixes).\n- RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() (git-fixes).\n- RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() (git-fixes).\n- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (git-fixes).\n- RDMA/mana: Validate rx_hash_key_len (git-fixes).\n- RDMA/mana_ib: cleanup the usage of mana_gd_send_request() (git-fixes).\n- RDMA/mana_ib: Disable RX steering on RSS QP destroy (git-fixes).\n- RDMA/mana_ib: Support memory windows (git-fixes).\n- regulator: act8945a: fix OF node reference imbalance (git-fixes).\n- regulator: bd9571mwv: fix OF node reference imbalance (git-fixes).\n- regulator: max77650: fix OF node reference imbalance (git-fixes).\n- regulator: mt6357: fix OF node reference imbalance (git-fixes).\n- regulator: rk808: fix OF node reference imbalance (git-fixes).\n- remoteproc: xlnx: Fix sram property parsing (git-fixes).\n- remoteproc: xlnx: Only access buffer information if IPI is buffered (git-fixes).\n- Revert \"ALSA: usb: Increase volume range that triggers a warning\" (git-fixes).\n- Revert \"serial: 8250: Revert \"drop lockdep annotation from serial8250_clear_IER()\"\" (bsc#1262480).\n- Revert \"serial: 8250: Switch to nbcon console\" (bsc#1262480).\n- rtc: abx80x: Disable alarm feature if no interrupt attached (git-fixes).\n- rtc: ntxec: fix OF node reference imbalance (git-fixes).\n- s390/dasd: Copy detected format information to secondary device (bsc#1259994).\n- s390/dasd: Fix gendisk parent after copy pair swap (bsc#1259994).\n- s390/dasd: Move quiesce state with pprc swap (bsc#1259994).\n- sched/fair: Change likelyhood of nohz.nr_cpus (bsc#1234634 bsc#1258961).\n- sched/fair: Move checking for nohz cpus after time check (bsc#1234634 bsc#1258961).\n- sched/fair: Remove nohz.nr_cpus and use weight of cpumask instead (bsc#1234634 bsc#1258961).\n- scsi: lpfc: Add clean up of aborted NVMe commands during PCI fcn reset (bsc#1262019).\n- scsi: lpfc: Add log messages to fabric login error labels (bsc#1262019).\n- scsi: lpfc: Add PCI ID support for LPe42100 series adapters (bsc#1262019).\n- scsi: lpfc: Add REG_VFI mailbox cmd error handling (bsc#1262019).\n- scsi: lpfc: Break out of IRQ affinity assignment when mask reaches nr_cpu_ids (bsc#1262019).\n- scsi: lpfc: Check ASIC_ID register to aid diagnostics during failed fw updates (bsc#1262019).\n- scsi: lpfc: Cleanup error exit paths in lpfc_fdmi_cmd() and associated messages (bsc#1262019).\n- scsi: lpfc: ELIMINATE kernel-doc warnings in lpfc.h (bsc#1262019).\n- scsi: lpfc: Fix incorrect txcmplq_cnt during cleanup in lpfc_sli_abort_ring() (bsc#1262019).\n- scsi: lpfc: Introduce 128G link speed selection and support (bsc#1262019).\n- scsi: lpfc: Log discarded and insufficient RQE buffer events (bsc#1262019).\n- scsi: lpfc: Log MCQE contents for mbox commands with no context (bsc#1262019).\n- scsi: lpfc: Properly set WC for DPP mapping (bsc#1262019).\n- scsi: lpfc: Reduce pointer chasing when accessing vmid_flag (bsc#1262019).\n- scsi: lpfc: Remove deprecated PBDE feature (bsc#1262019).\n- scsi: lpfc: Remove unnecessary ndlp kref get in lpfc_check_nlp_post_devloss (bsc#1262019).\n- scsi: lpfc: Restrict first burst to non-FCoE and SLI4 adapters only (bsc#1262019).\n- scsi: lpfc: Select mailbox rq_create cmd version based on SLI4 if_type (bsc#1262019).\n- scsi: lpfc: Update class of service bit field to 3 bits for WQE submissions (bsc#1262019).\n- scsi: lpfc: Update construction of SGL when XPSGL is enabled (bsc#1262019).\n- scsi: lpfc: Update copyright year string for 2026 (bsc#1262019).\n- scsi: lpfc: Update log message when ndlp kref get is unsuccessful (bsc#1262019).\n- scsi: lpfc: Update lpfc version to 14.4.0.14 (bsc#1262019).\n- scsi: lpfc: Update lpfc version to 15.0.0.0 (bsc#1262019).\n- scsi: lpfc: Update outdated comment for renamed lpfc_freenode() (bsc#1262019).\n- scsi: lpfc: Use min_t() instead of min() in lpfc_sli4_driver_resource_setup (bsc#1262019).\n- scsi: lpfc: Use the crc32c() function (bsc#1262019).\n- scsi: mpi3mr: Add NULL checks when resetting request and reply queues (git-fixes).\n- scsi: ses: Fix devices attaching to different hosts (git-fixes).\n- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (git-fixes).\n- scsi: target: iscsi: validate CHAP_R length before base64 decode (bsc#1265449).\n- scsi: ufs: ufs-pci: Add support for Intel Wildcat Lake (jsc#PED-13771).\n- selftests/bpf: Test cross-sign 64bits range refinement (git-fixes).\n- selftests/bpf: Test invariants on JSLT crossing sign (git-fixes).\n- selftests/bpf: test refining u32/s32 bounds when ranges cross min/max boundary (git-fixes).\n- selftests: net: build net/lib dependency in all target (bsc#1262245).\n- selinux: don't reserve xattr slot when we won't fill it (stable-fixes).\n- selinux: prune /sys/fs/selinux/disable (stable-fixes).\n- selinux: shrink critical section in sel_write_load() (stable-fixes).\n- serial: 8250: Add serial8250_handle_irq_locked() (bsc#1262480).\n- serial: 8250: Protect LCR write in shutdown (bsc#1262480).\n- serial: 8250_dw: Avoid unnecessary LCR writes (bsc#1262480).\n- serial: 8250_dw: Ensure BUSY is deasserted (bsc#1262480).\n- serial: 8250_dw: Rework dw8250_handle_irq() locking and IIR handling (bsc#1262480).\n- serial: 8250_dw: Rework IIR_NO_INT handling to stop interrupt storm (bsc#1262480).\n- Set CONFIG_INTEL_TSX_MODE to follow upstream AUTO default (bsc#1263044).\n- soc/tegra: cbb: Set ERD on resume for err interrupt (git-fixes).\n- soc: qcom: aoss: compare against normalized cooling state (git-fixes).\n- soc: qcom: llcc: fix v1 SB syndrome register offset (git-fixes).\n- soc: qcom: ocmem: make the core clock optional (git-fixes).\n- soc: qcom: ocmem: register reasons for probe deferrals (git-fixes).\n- soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available (git-fixes).\n- sound: ua101: fix division by zero at probe (git-fixes).\n- soundwire: bus: demote UNATTACHED state warnings to dev_dbg() (git-fixes).\n- soundwire: cadence: Clear message complete before signaling waiting thread (git-fixes).\n- soundwire: debugfs: initialize firmware_file to empty string (git-fixes).\n- spi: aspeed-smc: fix controller deregistration (git-fixes).\n- spi: at91-usart: fix controller deregistration (git-fixes).\n- spi: atmel: fix controller deregistration (git-fixes).\n- spi: bcm63xx: fix controller deregistration (git-fixes).\n- spi: bcmbca-hsspi: fix controller deregistration (git-fixes).\n- spi: cadence: fix controller deregistration (git-fixes).\n- spi: cadence: fix unclocked access on unbind (git-fixes).\n- spi: ch341: fix memory leaks on probe failures (git-fixes).\n- spi: coldfire-qspi: fix controller deregistration (git-fixes).\n- spi: dln2: fix controller deregistration (git-fixes).\n- spi: fix controller cleanup() documentation (git-fixes).\n- spi: fix misleading controller deregistration kernel-doc (git-fixes).\n- spi: fix misleading controller registration kernel-doc (git-fixes).\n- spi: fsl-espi: fix controller deregistration (git-fixes).\n- spi: fsl-qspi: Use reinit_completion() for repeated operations (git-fixes).\n- spi: fsl: fix controller deregistration (git-fixes).\n- spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo (git-fixes).\n- spi: img-spfi: fix controller deregistration (git-fixes).\n- spi: imx: fix runtime pm leak on probe deferral (git-fixes).\n- spi: imx: fix use-after-free on unbind (git-fixes).\n- spi: lantiq-ssc: fix controller deregistration (git-fixes).\n- spi: meson-spicc: fix controller deregistration (git-fixes).\n- spi: microchip-core-qspi: fix controller deregistration (git-fixes).\n- spi: mpc52xx: fix controller deregistration (git-fixes).\n- spi: mpc52xx: fix use-after-free on registration failure (git-fixes).\n- spi: mpc52xx: fix use-after-free on unbind (git-fixes).\n- spi: mtk-nor: fix controller deregistration (git-fixes).\n- spi: mtk-snfi: fix memory leak in probe (git-fixes).\n- spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback (git-fixes).\n- spi: mxic: fix controller deregistration (git-fixes).\n- spi: mxs: fix controller deregistration (git-fixes).\n- spi: npcm-pspi: fix controller deregistration (git-fixes).\n- spi: omap2-mcspi: fix controller deregistration (git-fixes).\n- spi: orion: fix clock imbalance on registration failure (git-fixes).\n- spi: orion: fix controller deregistration (git-fixes).\n- spi: orion: fix runtime pm leak on unbind (git-fixes).\n- spi: pic32-sqi: fix controller deregistration (git-fixes).\n- spi: pic32: fix controller deregistration (git-fixes).\n- spi: pl022: fix controller deregistration (git-fixes).\n- spi: qup: fix controller deregistration (git-fixes).\n- spi: rockchip: fix controller deregistration (git-fixes).\n- spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ (git-fixes).\n- spi: rspi: fix controller deregistration (git-fixes).\n- spi: s3c64xx: fix controller deregistration (git-fixes).\n- spi: s3c64xx: fix NULL-deref on driver unbind (git-fixes).\n- spi: sh-hspi: fix controller deregistration (git-fixes).\n- spi: sprd: fix controller deregistration (git-fixes).\n- spi: st-ssc4: fix controller deregistration (git-fixes).\n- spi: sun4i: fix controller deregistration (git-fixes).\n- spi: sun6i: fix controller deregistration (git-fixes).\n- spi: syncuacer: fix controller deregistration (git-fixes).\n- spi: ti-qspi: fix controller deregistration (git-fixes).\n- spi: topcliff-pch: fix controller deregistration (git-fixes).\n- spi: topcliff-pch: fix use-after-free on unbind (git-fixes).\n- spi: uniphier: fix controller deregistration (git-fixes).\n- spi: uniphier: Simplify clock handling with devm_clk_get_enabled() (stable-fixes).\n- spi: zynq-qspi: fix controller deregistration (git-fixes).\n- spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() (stable-fixes).\n- spi: zynqmp-gqspi: fix controller deregistration (git-fixes).\n- staging: media: atomisp: Disallow all private IOCTLs (git-fixes).\n- staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() (git-fixes).\n- staging: sm750fb: fix division by zero in ps_to_hz() (git-fixes).\n- staging: vme_user: fix root device leak on init failure (git-fixes).\n- tg3: replace placeholder MAC address with device property (git-fixes).\n- thermal/drivers/spear: Fix error condition for reading st,thermal-flags (git-fixes).\n- thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp (git-fixes).\n- thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata (git-fixes).\n- tools/power/turbostat: Fix microcode patch level output for AMD/Hygon (git-fixes).\n- tools: hv: Fix cross-compilation (git-fixes).\n- tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public() (git-fixes).\n- tpm: avoid -Wunused-but-set-variable (git-fixes).\n- tpm: Fix auth session leak in tpm2_get_random() error path (git-fixes).\n- tpm: tpm_tis: add error logging for data transfer (git-fixes).\n- tpm: tpm_tis: stop transmit if retries are exhausted (git-fixes).\n- tpm: Use kfree_sensitive() to free auth session in tpm_dev_release() (git-fixes).\n- tty: serial: ip22zilog: Fix section mispatch warning (git-fixes).\n- udp: Force compute_score to always inline (bsc#1241259).\n- unshare: fix unshare_fs() handling (git-fixes).\n- USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen (git-fixes).\n- usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (git-fixes).\n- usb: chipidea: otg: not wait vbus drop if use role_switch (git-fixes).\n- USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam (stable-fixes).\n- usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer (stable-fixes).\n- usb: gadget: f_hid: Add missing error code (git-fixes).\n- usb: gadget: f_hid: don't call cdev_init while cdev in use (git-fixes).\n- usb: gadget: f_hid: move list and spinlock inits from bind to alloc (stable-fixes).\n- usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() (git-fixes).\n- usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() (git-fixes).\n- usb: gadget: f_uac1_legacy: validate control request size (stable-fixes).\n- usb: gadget: renesas_usb3: validate endpoint index in standard request handlers (git-fixes).\n- usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo (git-fixes).\n- USB: omap_udc: DMA: Don't enable burst 4 mode (git-fixes).\n- usb: port: add delay after usb_hub_set_port_power() (git-fixes).\n- usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive (stable-fixes).\n- USB: serial: io_edgeport: add support for Blackbox IC135A (stable-fixes).\n- USB: serial: option: add MeiG Smart SRM825WN (stable-fixes).\n- USB: serial: option: add support for Rolling Wireless RW135R-GL (stable-fixes).\n- USB: serial: option: add Telit Cinterion FN990A MBIM composition (git-fixes).\n- USB: serial: option: add Telit Cinterion LE910Cx compositions (stable-fixes).\n- usb: storage: Expand range of matched versions for VL817 quirks entry (git-fixes).\n- usb: typec: tcpm: reset internal port states on soft reset AMS (git-fixes).\n- usb: ulpi: fix memory leak on ulpi_register() error paths (git-fixes).\n- usb: usblp: fix heap leak in IEEE 1284 device ID via short response (stable-fixes).\n- usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl (stable-fixes).\n- usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() (git-fixes).\n- usbip: validate number_of_packets in usbip_pack_ret_submit() (git-fixes).\n- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (git-fixes).\n- vfio/pds: Fix memory leak in pds_vfio_dirty_enable() (git-fixes).\n- vfio/pds: Fix missing detach_ioas op (git-fixes).\n- vfio/pds: replace bitmap_free with vfree (git-fixes).\n- vfio/type1: Fix error unwind in migration dirty bitmap allocation (git-fixes).\n- vfio: Fix unbalanced vfio_df_close call in no-iommu mode (git-fixes).\n- vfio: Prevent open_count decrement to negative (git-fixes).\n- virt: arm-cca-guest: fix error check for RSI_INCOMPLETE (git-fixes).\n- virt: sev-guest: Do not use host-controlled page order in cleanup path (git-fixes).\n- virt: tdx-guest: Fix handling of host controlled 'quote' buffer length (git-fixes).\n- virt: tdx-guest: Return error for GetQuote failures (git-fixes).\n- wifi: ath5k: do not access array OOB (git-fixes).\n- wifi: ath9k: Fix typo (git-fixes).\n- wifi: ath10k: fix station lookup failure during disconnect (git-fixes).\n- wifi: ath11k: fix memory leaks in beacon template setup (git-fixes).\n- wifi: ath12k: fix leak in some ath12k_wmi_xxx() functions (git-fixes).\n- wifi: ath12k: use lockdep_assert_in_rcu_read_lock() for RCU assertions (git-fixes).\n- wifi: b43: enforce bounds check on firmware key index in b43_rx() (git-fixes).\n- wifi: b43legacy: enforce bounds check on firmware key index in RX path (git-fixes).\n- wifi: brcmfmac: Fix error pointer dereference (git-fixes).\n- wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task (git-fixes).\n- wifi: brcmfmac: validate bsscfg indices in IF events (stable-fixes).\n- wifi: brcmsmac: Fix dma_free_coherent() size (git-fixes).\n- wifi: cw1200: Revert \"Fix locking in error paths\" (git-fixes).\n- wifi: libertas: notify firmware load wait on disconnect (git-fixes).\n- wifi: mac80211: check ieee80211_rx_data_set_link return in pubsta MLO path (git-fixes).\n- wifi: mac80211: check tdls flag in ieee80211_tdls_oper (stable-fixes).\n- wifi: mac80211: drop stray 'static' from fast-RX rx_result (git-fixes).\n- wifi: mac80211: handle VHT EXT NSS in ieee80211_determine_our_sta_mode() (git-fixes).\n- wifi: mac80211: remove station if connection prep fails (git-fixes).\n- wifi: mac80211: use safe list iteration in radar detect work (git-fixes).\n- wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req() (git-fixes).\n- wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor (stable-fixes).\n- wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling (git-fixes).\n- wifi: mt76: mt7615: fix use_cts_prot support (git-fixes).\n- wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() (git-fixes).\n- wifi: mt76: mt7915: fix use_cts_prot support (git-fixes).\n- wifi: mt76: mt7921: fix 6GHz regulatory update on connection (git-fixes).\n- wifi: mt76: mt7921: fix a potential clc buffer length underflow (git-fixes).\n- wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work (git-fixes).\n- wifi: mt76: mt7921: Place upper limit on station AID (git-fixes).\n- wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() (git-fixes).\n- wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr (git-fixes).\n- wifi: mt76: mt7925: fix incorrect length field in txpower command (git-fixes).\n- wifi: mt76: mt7925: Fix incorrect MLO mode in firmware control (git-fixes).\n- wifi: mt76: mt7925: fix incorrect TLV length in CLC command (git-fixes).\n- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_tx_check_aggr() (git-fixes).\n- wifi: mt76: mt7925: prevent NULL vif dereference in mt7925_mac_write_txwi (git-fixes).\n- wifi: mt76: mt7996: fix FCS error flag check in RX descriptor (git-fixes).\n- wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event (git-fixes).\n- wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work() (git-fixes).\n- wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() (git-fixes).\n- wifi: nl80211: fix NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST usage (git-fixes).\n- wifi: nl80211: require admin perm on SET_PMK / DEL_PMK (git-fixes).\n- wifi: rsi: fix kthread lifetime race between self-exit and external-stop (git-fixes).\n- wifi: rt2x00usb: fix devres lifetime (git-fixes).\n- wifi: rtl8xxxu: fix potential use of uninitialized value (git-fixes).\n- wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet (git-fixes).\n- wifi: rtw88: Add additional USB IDs for RTL8812BU (bsc#1263135).\n- wifi: rtw88: Add BUFFALO WI-U3-866DHP to the USB ID list (bsc#1263135).\n- wifi: rtw88: Add support for Mercusys MA30N and D-Link DWA-T185 rev. A1 (bsc#1263135).\n- wifi: rtw88: check for PCI upstream bridge existence (git-fixes).\n- wifi: rtw88: fix device leak on probe failure (git-fixes).\n- wifi: rtw88: rtw8822bu VID/PID for BUFFALO WI-U2-866DM (bsc#1263135).\n- wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() (git-fixes).\n- wifi: wl1251: validate packet IDs before indexing tx_frames (stable-fixes).\n- x86/acpi/boot: Correct acpi_is_processor_usable() check again (git-fixes).\n- x86/boot/sev: Avoid shared GHCB page for early memory acceptance (git-fixes).\n- x86/boot/sev: Support memory acceptance in the EFI stub under SVSM (git-fixes).\n- x86/boot: Fix page table access in 5-level to 4-level paging transition (git-fixes).\n- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (bsc#1263255).\n- x86/cpufeatures: Free up unused feature bits (bsc#1263255).\n- x86/fred: Fix early boot failures on SEV-ES/SNP guests (git-fixes).\n- x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (git-fixes).\n- x86/sev: Add missing RIP_REL_REF() invocations during sme_enable() (git-fixes).\n- x86/sev: Do not touch VMSA pages during SNP guest memory kdump (git-fixes).\n- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (git-fixes).\n- x86/sev: Fix operator precedence in GHCB_MSR_VMPL_REQ_LEVEL macro (git-fixes).\n- x86/sev: Improve handling of writes to intercepted TSC MSRs (git-fixes).\n- x86/sev: Make sure pages are not skipped during kdump (git-fixes).\n- x86/tsx: Get the tsx= command line parameter with early_param() (bsc#1250951 bsc#1263044).\n- x86/tsx: Make tsx_ctrl_state static (bsc#1250951 bsc#1263044).\n- x86/vmware: Parse MP tables for SEV-SNP enabled guests under VMware hypervisors (git-fixes).\n- X.509: Fix out-of-bounds access when parsing extensions (git-fixes).\n- Xarray: do not return sibling entries from xas_find_marked() (bsc#1263815).\n","status":"published","published":"2026-05-28T12:58:58Z","modified":"2026-05-31T18:24:29.154766683Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:21834-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).\n- CVE-2024-14027: xattr: switch to CLASS(fd) (bsc#1259420).\n- CVE-2025-40181: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (bsc#1253471).\n- CVE-2025-68265: nvme: fix admin request_queue lifetime (bsc#1255360).\n- CVE-2025-68310: s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (bsc#1255160).\n- CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).\n- CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).\n- CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).\n- CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).\n- CVE-2026-23276: net: add xmit recursion limit to tunnel xmit functions (bsc#1260012).\n- CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).\n- CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).\n- CVE-2026-23316: net: ipv4: fix ARM64 alignment fault in multipath hash seed (bsc#1260573).\n- CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).\n- CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).\n- CVE-2026-23346: arm64: io: Rename ioremap_prot() to __ioremap_prot() (bsc#1260529).\n- CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).\n- CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).\n- CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).\n- CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).\n- CVE-2026-23375: mm: thp: deny THP for files on anonymous inodes (bsc#1260576).\n- CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).\n- CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).\n- CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).\n- CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).\n- CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).\n- CVE-2026-23417: bpf: Fix constant blinding for PROBE_MEM32 stores (bsc#1261410).\n- CVE-2026-23436: net: add helpers for lookup and walking netdevs under netdev_lock() (bsc#1261617).\n- CVE-2026-23437: net: shaper: protect late read accesses to the hierarchy (bsc#1261635).\n- CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).\n- CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).\n- CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).\n- CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).\n- CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).\n- CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).\n- CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).\n- CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).\n- CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).\n- CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).\n- CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).\n- CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).\n- CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on wakeup race (bsc#1261694).\n- CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).\n- CVE-2026-31395: bnxt_en: fix OOB access in DBG_BUF_PRODUCER async event handler (bsc#1261786).\n- CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).\n- CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).\n- CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).\n- CVE-2026-31406: xfrm: Fix work re-schedule after cancel in xfrm_nat_keepalive_net_fini() (bsc#1261629).\n- CVE-2026-31407: netfilter: conntrack: add missing netlink policy validations (bsc#1261632).\n- CVE-2026-31411: net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (bsc#1261752).\n- CVE-2026-31415: ipv6: avoid overflows in ip6_datagram_send_ctl() (bsc#1262099).\n- CVE-2026-31416: netfilter: nfnetlink_log: account for netlink header size (bsc#1262100).\n- CVE-2026-31420: bridge: mrp: reject zero test interval to avoid OOM panic (bsc#1262055).\n- CVE-2026-31421: net/sched: cls_fw: fix NULL pointer dereference on shared blocks (bsc#1262061).\n- CVE-2026-31422: net/sched: cls_flow: fix NULL pointer dereference on shared blocks (bsc#1262054).\n- CVE-2026-31423: net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() (bsc#1262063).\n- CVE-2026-31424: netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (bsc#1262053).\n- CVE-2026-31425: rds: ib: reject FRMR registration before IB connection is established (bsc#1262074).\n- CVE-2026-31427: netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp (bsc#1262086).\n- CVE-2026-31428: netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (bsc#1262087).\n- CVE-2026-31435: netfs: Fix read abandonment during retry (bsc#1262601).\n- CVE-2026-31449: ext4: validate p_idx bounds in ext4_ext_correct_indexes (bsc#1262616).\n- CVE-2026-31453: xfs: avoid dereferencing log items after push callbacks (bsc#1262617).\n- CVE-2026-31456: mm/pagewalk: fix race between concurrent split and refault (bsc#1262627).\n- CVE-2026-31494: net: cadence: macb: Synchronize stats calculations (bsc#1262671).\n- CVE-2026-31496: netfilter: nf_conntrack_expect: skip expectations in other netns via proc (bsc#1262673).\n- CVE-2026-31503: udp: Fix wildcard bind conflict check when using hash2 (bsc#1263077).\n- CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263085).\n- CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263093).\n- CVE-2026-31507: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer (bsc#1263095).\n- CVE-2026-31515: af_key: validate families in pfkey_send_migrate() (bsc#1262752).\n- CVE-2026-31519: btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create (bsc#1263012).\n- CVE-2026-31525: bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN (bsc#1262725).\n- CVE-2026-31526: bpf: Fix exception exit lock checking for subprogs (bsc#1262662).\n- CVE-2026-31528: perf: Make sure to use pmu_ctx-\u003epmu for groups (bsc#1263001).\n- CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262758).\n- CVE-2026-31547: drm/xe: Fix missing runtime PM reference in ccs_mode_store (bsc#1263018).\n- CVE-2026-31550: pmdomain: bcm: bcm2835-power: Increase ASB control timeout (bsc#1263104).\n- CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263107).\n- CVE-2026-31565: RDMA/irdma: Fix deadlock during netdev reset with active connections (bsc#1263064).\n- CVE-2026-31579: wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit (bsc#1263074).\n- CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263176).\n- CVE-2026-31588: KVM: x86: Use scratch field in MMIO fragment to hold small write values (bsc#1263165).\n- CVE-2026-31644: net: lan966x: fix use-after-free and leak in lan966x_fdma_reload() (bsc#1263048).\n- CVE-2026-31649: net: stmmac: fix integer underflow in chain mode (bsc#1263582).\n- CVE-2026-31658: net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() (bsc#1263052).\n- CVE-2026-31662: tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (bsc#1263131).\n- CVE-2026-31666: btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref() (bsc#1263138).\n- CVE-2026-31668: seg6: separate dst_cache for input and output paths in seg6 lwtunnel (bsc#1263140).\n- CVE-2026-31669: mptcp: fix slab-use-after-free in __inet_lookup_established (bsc#1263141).\n- CVE-2026-31675: net/sched: sch_netem: fix out-of-bounds access in packet corruption (bsc#1263556).\n- CVE-2026-31678: openvswitch: defer tunnel netdev_put to RCU release (bsc#1263562).\n- CVE-2026-31679: openvswitch: validate MPLS set/set_masked payload length (bsc#1263592).\n- CVE-2026-31681: netfilter: xt_multiport: validate range encoding in checkentry (bsc#1263593).\n- CVE-2026-31682: bridge: br_nd_send: linearize skb before parsing ND options (bsc#1263595).\n- CVE-2026-31684: net: sched: act_csum: validate nested VLAN headers (bsc#1263596).\n- CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263668).\n- CVE-2026-31691: igb: remove napi_synchronize() in igb_down() (bsc#1263604).\n- CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263901).\n- CVE-2026-31700: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (bsc#1263882).\n- CVE-2026-31738: vxlan: validate ND option lengths in vxlan_na_create (bsc#1264059).\n- CVE-2026-31787: xen/privcmd: fix double free via VMA splitting (bsc#1262181).\n- CVE-2026-43009: bpf: Fix incorrect pruning due to atomic fetch precision tracking (bsc#1264014).\n- CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1263931).\n- CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1263933).\n- CVE-2026-43037: ip6_tunnel: clear skb2-\u003ecb in ip4ip6_err() (bsc#1263995).\n- CVE-2026-43038: ipv6: icmp: clear skb2-\u003ecb in ip6_err_gen_icmpv6_unreach() (bsc#1264097).\n- CVE-2026-43045: mshv: Refactor and rename memory region handling functions (bsc#1263942).\n- CVE-2026-43050: atm: lec: fix use-after-free in sock_def_readable() (bsc#1264082).\n- CVE-2026-43060: netfilter: nft_ct: drop pending enqueued packets on removal (bsc#1264183).\n- CVE-2026-43082: net: txgbe: leave space for null terminators on property_entry (bsc#1264233).\n- CVE-2026-43088: net: af_key: zero aligned sockaddr tail in PF_KEY exports (bsc#1264469).\n- CVE-2026-43153: xfs: remove xfs_attr_leaf_hasname (bsc#1264586).\n- CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264848).\n- CVE-2026-43265: KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block() (bsc#1264427).\n- CVE-2026-43329: netfilter: flowtable: strictly check for maximum number of actions (bsc#1265085).\n- CVE-2026-43365: xfs: fix undersized l_iclog_roundoff values (bsc#1265119).\n- CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265116).\n- CVE-2026-43441: net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1264674).\n- CVE-2026-43494: net/rds: reset op_nents when zerocopy page pin fails (bsc#1265626).\n- CVE-2026-43503: net: skbuff: propagate shared-frag marker through frag-transfer helpers (bsc#1265960).\n\nThe following non security issues were fixed:\n\n- accel/qaic: Add overflow check to remap_pfn_range during mmap (git-fixes).\n- ACPI: AGDI: fix missing newline in error message (git-fixes).\n- ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug (git-fixes).\n- ACPI: scan: Use acpi_dev_put() in object add error paths (git-fixes).\n- ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO (git-fixes).\n- ACPI: video: force native backlight on HP OMEN 16 (8A44) (stable-fixes).\n- ACPI: video: Move Lenovo Legion S7 15ACH6 quirk to the right section (git-fixes).\n- ALSA: 6fire: Fix input volume change detection (git-fixes).\n- ALSA: 6fire: fix use-after-free on disconnect (git-fixes).\n- ALSA: aoa: i2sbus: clear stale prepared state (git-fixes).\n- ALSA: aoa: i2sbus: fix OF node lifetime handling (git-fixes).\n- ALSA: aoa: Skip devices with no codecs in i2sbus_resume() (git-fixes).\n- ALSA: aoa: Use guard() for mutex locks (stable-fixes).\n- ALSA: asihpi: avoid write overflow check warning (stable-fixes).\n- ALSA: caiaq: Don't abort when no input device is available (git-fixes).\n- ALSA: caiaq: Fix control_put() result and cache rollback (git-fixes).\n- ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path (git-fixes).\n- ALSA: caiaq: fix usb_dev refcount leak on probe failure (git-fixes).\n- ALSA: caiaq: Handle probe errors properly (git-fixes).\n- ALSA: caiaq: take a reference on the USB device in create_card() (git-fixes).\n- ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() (git-fixes).\n- ALSA: core: Fix potential data race at fasync handling (git-fixes).\n- ALSA: core: Serialize deferred fasync state checks (git-fixes).\n- ALSA: core: Validate compress device numbers without dynamic minors (git-fixes).\n- ALSA: ctxfi: Add fallback to default RSR for S/PDIF (git-fixes).\n- ALSA: ctxfi: Fix missing SPDIFI1 index handling (stable-fixes).\n- ALSA: ctxfi: Limit PTP to a single page (git-fixes).\n- ALSA: firewire-tascam: Do not drop unread control events (git-fixes).\n- ALSA: fireworks: bound device-supplied status before string array lookup (git-fixes).\n- ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 (stable-fixes).\n- ALSA: hda/realtek - fixed speaker no sound update (git-fixes).\n- ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk (stable-fixes).\n- ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx (stable-fixes).\n- ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC (stable-fixes).\n- ALSA: hda/realtek: add quirk for Framework F111:000F (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 (stable-fixes).\n- ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') (git-fixes).\n- ALSA: hda: cs35l41: Put ACPI device on missing physical node (git-fixes).\n- ALSA: hda: cs35l56: Propagate ASP TX source control errors (git-fixes).\n- ALSA: hda: cs35l56: Put ACPI device after setting companion (git-fixes).\n- ALSA: hda: Fix NULL pointer dereference in snd_hda_ctl_add() (git-fixes).\n- ALSA: misc: Use guard() for spin locks (stable-fixes).\n- ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger (stable-fixes).\n- ALSA: pcmtest: fix reference leak on failed device registration (git-fixes).\n- ALSA: pcmtest: Fix resource leaks in module init error paths (git-fixes).\n- ALSA: pcmtest: Return -EFAULT on pattern read copy failure (git-fixes).\n- ALSA: sc6000: Keep the programmed board state in card-private data (git-fixes).\n- ALSA: scarlett2: Add missing error check when initialise Autogain Status (git-fixes).\n- ALSA: scarlett2: Add missing sentinel initializer field (git-fixes).\n- ALSA: seq: Notify client and port info changes (stable-fixes).\n- ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes (stable-fixes).\n- ALSA: usb-audio: apply quirk for MOONDROP JU Jiu (stable-fixes).\n- ALSA: usb-audio: Avoid false E-MU sample-rate notifications (git-fixes).\n- ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() (git-fixes).\n- ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans (git-fixes).\n- ALSA: usb-audio: Bound MIDI endpoint descriptor scans (git-fixes).\n- ALSA: usb-audio: Evaluate packsize caps at the right place (git-fixes).\n- ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch (git-fixes).\n- ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams (git-fixes).\n- ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex (stable-fixes).\n- ALSA: usb-audio: Fix UAC3 cluster descriptor size check (git-fixes).\n- ALSA: usb-audio: midi2: Restart output URBs on resume (git-fixes).\n- ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES (git-fixes).\n- ALSA: virtio: drop an extaneous kernel-doc comment (git-fixes).\n- amdgpu/jpeg: fix deepsleep register for jpeg 5_0_0 and 5_0_2 (stable-fixes).\n- ASoC: amd: acp: Add DMI quirk for Valve Steam Deck OLED (git-fixes).\n- ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF (stable-fixes).\n- ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table (stable-fixes).\n- ASoC: codecs: ab8500: Fix casting of private data (git-fixes).\n- ASoC: cs35l56: Destroy workqueue in probe error path (git-fixes).\n- ASoC: cs35l56: Don't use devres to unregister component (git-fixes).\n- ASoC: cs35l56: Fix hibernate write in runtime resume error path (git-fixes).\n- ASoC: fsl_easrc: Change the type for iec958 channel status controls (git-fixes).\n- ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() (git-fixes).\n- ASoC: fsl_easrc: fix comment typo (git-fixes).\n- ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() (git-fixes).\n- ASoC: fsl_micfil: Add access property for \"VAD Detected\" (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in micfil_quality_set() (git-fixes).\n- ASoC: fsl_xcvr: Fix event generation for cached controls (git-fixes).\n- ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() (git-fixes).\n- ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() (git-fixes).\n- ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error (git-fixes).\n- ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop (git-fixes).\n- ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens (git-fixes).\n- ASoC: qcom: q6apm: move component registration to unmanaged version (git-fixes).\n- ASoC: qcom: q6apm: remove child devices when apm is removed (git-fixes).\n- ASoC: qcom: qdsp6: topology: check widget type before accessing data (git-fixes).\n- ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list (stable-fixes).\n- ASoC: SOF: compress: return the configured codec from get_params (git-fixes).\n- ASoC: SOF: Don't allow pointer operations on unconfigured streams (git-fixes).\n- ASoC: SOF: Intel: hda: Place check before dereference (git-fixes).\n- ASoC: SOF: topology: reject invalid vendor array size in token parser (stable-fixes).\n- ASoC: sti: Return errors from regmap_field_alloc() (git-fixes).\n- ASoC: sti: use managed regmap_field allocations (git-fixes).\n- ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J (stable-fixes).\n- ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 (stable-fixes).\n- backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() (git-fixes).\n- batman-adv: bla: only purge non-released claims (git-fixes).\n- batman-adv: bla: prevent use-after-free when deleting claims (git-fixes).\n- batman-adv: bla: put backbone reference on failed claim hash insert (git-fixes).\n- batman-adv: fix integer overflow on buff_pos (git-fixes).\n- batman-adv: hold claim backbone gateways by reference (git-fixes).\n- batman-adv: reject new tp_meter sessions during teardown (git-fixes).\n- batman-adv: reject oversized global TT response buffers (git-fixes).\n- batman-adv: stop caching unowned originator pointers in BAT IV (git-fixes).\n- bitfield: Add FIELD_MODIFY() helper (jsc#PED-14238).\n- Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling (git-fixes).\n- Bluetooth: btmtk: validate WMT event SKB length before struct access (git-fixes).\n- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (bsc#1260996).\n- Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (git-fixes).\n- Bluetooth: hci_event: fix memset typo (git-fixes).\n- Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt (git-fixes).\n- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (git-fixes).\n- Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (git-fixes).\n- Bluetooth: HIDP: serialise l2cap_unregister_user via hidp_session_sem (git-fixes).\n- Bluetooth: ISO: Fix data-race on dst in iso_sock_connect() (git-fixes).\n- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (git-fixes).\n- Bluetooth: l2cap: fix MPS check in l2cap_ecred_reconf_req (git-fixes).\n- Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (git-fixes).\n- Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() (git-fixes).\n- Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU (git-fixes).\n- Bluetooth: RFCOMM: pull credit byte with skb_pull_data() (git-fixes).\n- Bluetooth: SCO: check for codecs-\u003enum_codecs == 1 before assigning to sco_pi(sk)-\u003ecodec (git-fixes).\n- Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready (git-fixes).\n- Bluetooth: SCO: hold sk properly in sco_conn_ready (git-fixes).\n- Bluetooth: virtio_bt: clamp rx length before skb_put (git-fixes).\n- Bluetooth: virtio_bt: validate rx pkt_type header length (git-fixes).\n- bpf: Add third round of bounds deduction (git-fixes).\n- bpf: Fix u32/s32 bounds when ranges cross min/max boundary (git-fixes).\n- bpf: Improve bounds when s64 crosses sign boundary (git-fixes).\n- bpf: Switch CONFIG_CFI_CLANG to CONFIG_CFI (git-fixes).\n- btrfs: qgroup: update all parent qgroups when doing quick inherit (bsc#1258933).\n- btrfs: reject root items with drop_progress and zero drop_level (git-fixes).\n- btrfs: replace BUG() with error handling in __btrfs_balance() (git-fixes).\n- bus: mhi: host: pci_generic: Switch to async power up to avoid boot delays (git-fixes).\n- bus: rifsc: fix RIF configuration check for peripherals (git-fixes).\n- can: mcp251x: add error handling for power enable in open and resume (stable-fixes).\n- can: raw: fix ro-\u003euniq use-after-free in raw_rcv() (git-fixes).\n- can: ucan: fix devres lifetime (git-fixes).\n- cdc-acm: new quirk for EPSON HMD (stable-fixes).\n- check-for-config-changes: Exclude CC_MS_EXTENSIONS.\n- check-for-config-changes: Exclude HAVE_CFI_ICALL_NORMALIZE_INTEGERS{,_RUSTC}.\n- comedi: dt2815: add hardware detection to prevent crash (stable-fixes).\n- cpufreq: intel_pstate: Drop Arrow Lake from \"scaling factor\" list (bsc#1249104).\n- crypto: af_alg - limit RX SG extraction by receive buffer budget (git-fixes).\n- crypto: algif_aead - Fix minimum RX size check for decryption (git-fixes).\n- crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup (git-fixes).\n- crypto: atmel-ecc - Release client on allocation failure (git-fixes).\n- crypto: atmel-sha204a - Fix error codes in OTP reads (git-fixes).\n- crypto: atmel-sha204a - Fix OTP sysfs read and error handling (git-fixes).\n- crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path (git-fixes).\n- crypto: atmel-sha204a - Fix uninitialized data access on OTP read error (git-fixes).\n- crypto: atmel-tdes - fix DMA sync direction (git-fixes).\n- crypto: ccp - copy IV using skcipher ivsize (git-fixes).\n- crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (git-fixes).\n- crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (git-fixes).\n- crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (git-fixes).\n- crypto: ccree - fix a memory leak in cc_mac_digest() (git-fixes).\n- crypto: drivers - Switch back to struct platform_driver::remove() (jsc#PED-14238).\n- crypto: drivers - Use str_enable_disable-like helpers (jsc#PED-14238).\n- crypto: hisilicon - Fix dma_unmap_single() direction (git-fixes).\n- crypto: iaa - Adjust workqueue allocation type (jsc#PED-14238).\n- crypto: iaa - fix per-node CPU counter reset in rebalance_wq_table() (git-fixes).\n- crypto: iaa - Move compression CRC into request object (jsc#PED-14238).\n- crypto: iaa - Optimize rebalance_wq_table() (jsc#PED-14238).\n- crypto: iaa - Remove potential infinite loop in check_completion() (jsc#PED-14238).\n- crypto: iaa - Remove unreachable pr_debug from iaa_crypto_cleanup_module (jsc#PED-14238).\n- crypto: iaa - Remove unused disable_async argument from iaa_decompress (jsc#PED-14238).\n- crypto: iaa - Replace sprintf with sysfs_emit in sysfs show functions (jsc#PED-14238).\n- crypto: iaa - Simplify init_iaa_device() (jsc#PED-14238).\n- crypto: jitterentropy - replace long-held spinlock with mutex (git-fixes).\n- crypto: nx - Fix packed layout in struct nx842_crypto_header (git-fixes).\n- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (git-fixes).\n- crypto: qat - #undef field_get() before local definition (jsc#PED-14238).\n- crypto: qat - add adf_rl_get_num_svc_aes() in rate limiting (jsc#PED-14238).\n- crypto: qat - add bank state save and restore for qat_420xx (jsc#PED-14238).\n- crypto: qat - add command queue telemetry counters for GEN6 (jsc#PED-14238).\n- crypto: qat - add compression slice count for rate limiting (jsc#PED-14238).\n- crypto: qat - add decompression service for rate limiting (jsc#PED-14238).\n- crypto: qat - add decompression service to telemetry (jsc#PED-14238).\n- crypto: qat - add firmware headers for GEN6 devices (jsc#PED-14238).\n- crypto: qat - add GEN6 firmware loader (jsc#PED-14238).\n- crypto: qat - add get_svc_slice_cnt() in device data structure (jsc#PED-14238).\n- crypto: qat - add live migration enablers for GEN6 devices (jsc#PED-14238).\n- crypto: qat - add macro to write 64-bit values to registers (jsc#PED-14238).\n- crypto: qat - add missing header inclusion (jsc#PED-14238).\n- crypto: qat - add qat_6xxx driver (jsc#PED-14238).\n- crypto: qat - add ring buffer idle telemetry counter for GEN6 (jsc#PED-14238).\n- crypto: qat - add support for decompression service to GEN6 devices (jsc#PED-14238).\n- crypto: qat - consolidate service enums (jsc#PED-14238).\n- crypto: qat - Constify struct pm_status_row (jsc#PED-14238).\n- crypto: qat - disable 4xxx AE cluster when lead engine is fused off (git-fixes).\n- crypto: qat - disable 420xx AE cluster when lead engine is fused off (git-fixes).\n- crypto: qat - do not export adf_cfg_services (jsc#PED-14238).\n- crypto: qat - enable power management debugfs for GEN6 devices (jsc#PED-14238).\n- crypto: qat - enable RAS support for GEN6 devices (jsc#PED-14238).\n- crypto: qat - enable rate limiting feature for GEN6 devices (jsc#PED-14238).\n- crypto: qat - enable reporting of error counters for GEN6 devices (jsc#PED-14238).\n- crypto: qat - enable telemetry for GEN6 devices (jsc#PED-14238).\n- crypto: qat - export adf_get_service_mask() (jsc#PED-14238).\n- crypto: qat - export adf_init_admin_pm() (jsc#PED-14238).\n- crypto: qat - expose configuration functions (jsc#PED-14238).\n- crypto: qat - fix compression instance leak (git-fixes).\n- crypto: qat - fix IRQ cleanup on 6xxx probe failure (git-fixes).\n- crypto: qat - fix object goals in Makefiles (jsc#PED-14238.\n- crypto: qat - fix type mismatch in RAS sysfs show functions (git-fixes).\n- crypto: qat - Fix typo \"accelaration\" (jsc#PED-14238).\n- crypto: qat - fix virtual channel configuration for GEN6 devices (jsc#PED-14238).\n- crypto: qat - include qat_common in top Makefile (jsc#PED-14238).\n- crypto: qat - introduce fuse array (jsc#PED-14238).\n- crypto: qat - make adf_dev_autoreset() static (jsc#PED-14238).\n- crypto: qat - optimize allocations for fw authentication (jsc#PED-14238).\n- crypto: qat - refactor compression template logic (jsc#PED-14238).\n- crypto: qat - refactor FW signing algorithm (jsc#PED-14238).\n- crypto: qat - refactor ring-related debug functions (jsc#PED-14238).\n- crypto: qat - refactor service parsing logic (jsc#PED-14238).\n- crypto: qat - relocate and rename bank state structure definition (jsc#PED-14238).\n- crypto: qat - relocate bank state helper functions (jsc#PED-14238).\n- crypto: qat - relocate power management debugfs helper APIs (jsc#PED-14238).\n- crypto: qat - relocate service related functions (jsc#PED-14238).\n- crypto: qat - remove BITS_IN_DWORD() (jsc#PED-14238).\n- crypto: qat - Remove dst_null support (jsc#PED-14238).\n- crypto: qat - remove duplicate masking for GEN6 devices (jsc#PED-14238).\n- crypto: qat - remove initialization in device class (jsc#PED-14238).\n- crypto: qat - remove redundant FW image size check (jsc#PED-14238).\n- crypto: qat - remove unused adf_devmgr_get_first (jsc#PED-14238).\n- crypto: qat - remove unused members in suof structure (jsc#PED-14238).\n- crypto: qat - rename and relocate timer logic (jsc#PED-14238).\n- crypto: qat - reorder objects in qat_common Makefile (jsc#PED-14238).\n- crypto: qat - replace CHECK_STAT macro with static inline function (jsc#PED-14238).\n- crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() (jsc#PED-14238).\n- crypto: qat - restore ASYM service support for GEN6 devices (jsc#PED-14238).\n- crypto: qat - Return pointer directly in adf_ctl_alloc_resources (jsc#PED-14238).\n- crypto: qat - set command ids as reserved (jsc#PED-14238).\n- crypto: qat - switch to standard pattern for PCI IDs (jsc#PED-14238).\n- crypto: qat - update firmware api (jsc#PED-14238).\n- crypto: qat - use pr_fmt() in adf_gen4_hw_data.c (jsc#PED-14238).\n- crypto: qat - use pr_fmt() in qat uclo.c (jsc#PED-14238).\n- crypto: qat - use simple_strtoull to improve qat_uclo_parse_num (jsc#PED-14238).\n- crypto: qat - use swab32 macro (git-fixes).\n- crypto: qat - validate service in rate limiting sysfs api (jsc#PED-14238).\n- crypto: qat/qat_6xxx - Fix NULL vs IS_ERR() check in adf_probe() (jsc#PED-14238).\n- crypto: sa2ul - Fix AEAD fallback algorithm names (git-fixes).\n- crypto: simd - reject compat registrations without __ prefixes (git-fixes).\n- crypto: talitos - fix SEC1 32k ahash request limitation (git-fixes).\n- crypto: tegra - Disable softirqs before finalizing request (git-fixes).\n- devres: fix missing node debug info in devm_krealloc() (git-fixes).\n- dmaengine: dw-axi-dmac: fix Alignment should match open parenthesis (git-fixes).\n- dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function (git-fixes).\n- dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() (git-fixes).\n- dpll: zl3073x: Add support to adjust phase (bsc#1255752).\n- dpll: zl3073x: Fix output pin phase adjustment sign (bsc#1255752).\n- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (bsc#1255752).\n- dpll: zl3073x: Specify phase adjustment granularity for pins (bsc#1255752).\n- drivers/base/memory: fix memory block reference leak in poison accounting (git-fixes).\n- drm/amd/display: Add NULL check for integrated_info in clk_mgr_construct (git-fixes).\n- drm/amd/display: Allow DCE link encoder without AUX registers (git-fixes).\n- drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths (git-fixes).\n- drm/amd/display: Change dither policy for 10 bpc output back to dithering (git-fixes).\n- drm/amd/display: Correct logic check error for fastboot (git-fixes).\n- drm/amd/display: Disable 10-bit truncation and dithering on DCE 6.x (git-fixes).\n- drm/amd/display: Disable fastboot on DCE 6 too (stable-fixes).\n- drm/amd/display: Read EDID from VBIOS embedded panel info (git-fixes).\n- drm/amd/pm/ci: Clear EnabledForActivity field for memory levels (git-fixes).\n- drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs (git-fixes).\n- drm/amd/pm/ci: Fill DW8 fields from SMC (git-fixes).\n- drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 (git-fixes).\n- drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled (git-fixes).\n- drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board (git-fixes).\n- drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock (git-fixes).\n- drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x (git-fixes).\n- drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) (git-fixes).\n- drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ (stable-fixes).\n- drm/amdgpu/gfx10: look at the right prop for gfx queue priority (git-fixes).\n- drm/amdgpu/gfx11: look at the right prop for gfx queue priority (git-fixes).\n- drm/amdgpu/gmc: Fix AMDGPU_GART_PLACEMENT_LOW to not overlap with VRAM (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.5 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.0 ring (git-fixes).\n- drm/amdgpu/pm: add missing revision check for CI (git-fixes).\n- drm/amdgpu/pm: align Hawaii mclk workaround with radeon (git-fixes).\n- drm/amdgpu/pm: drop SMU driver if version not matched messages (stable-fixes).\n- drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission (git-fixes).\n- drm/amdgpu/vce: Prevent partial address patches (stable-fixes).\n- drm/amdgpu/vcn3: Avoid overflow on msg bound check (git-fixes).\n- drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (stable-fixes).\n- drm/amdgpu/vcn4: Avoid overflow on msg bound check (git-fixes).\n- drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (stable-fixes).\n- drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (stable-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v4.0.5 enc ring (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v5.0.0 enc ring (git-fixes).\n- drm/amdgpu: Add bounds checking to ib_{get,set}_value (stable-fixes).\n- drm/amdgpu: Add default case in DVI mode validation (git-fixes).\n- drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG (git-fixes).\n- drm/amdgpu: fix zero-size GDS range init on RDNA4 (stable-fixes).\n- drm/amdgpu: gate VM CPU HDP flush on reset lock (stable-fixes).\n- drm/amdgpu: replace PASID IDR with XArray (git-fixes).\n- drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count (stable-fixes).\n- drm/amdgpu: zero-initialize GART table on allocation (stable-fixes).\n- drm/amdkfd: Add upper bound check for num_of_nodes (stable-fixes).\n- drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure (stable-fixes).\n- drm/amdkfd: Make all TLB-flushes heavy-weight (stable-fixes).\n- drm/amdkfd: validate SVM ioctl nattr against buffer size (stable-fixes).\n- drm/arcpgu: fix device node leak (git-fixes).\n- drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs (git-fixes).\n- drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check (git-fixes).\n- drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() (git-fixes).\n- drm/bridge: stm_lvds: Do not fail atomic_check on disabled connector (git-fixes).\n- drm/etnaviv: Fix armed job not being pushed to the DRM scheduler (git-fixes).\n- drm/exynos: remove bridge when component_add fails (git-fixes).\n- drm/fb-helper: Fix clipping when damage area spans a single scanline (git-fixes).\n- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (git-fixes).\n- drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup (git-fixes).\n- drm/gma500/oaktrail_lvds: fix hang on init failure (git-fixes).\n- drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init (git-fixes).\n- drm/i915/dp: Fix VSC dynamic range signaling for RGB formats (git-fixes).\n- drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (git-fixes).\n- drm/i915/wm: Verify the correct plane DDB entry (git-fixes).\n- drm/i915: skip __i915_request_skip() for already signaled requests (git-fixes).\n- drm/imagination: Switch reset_reason fields from enum to u32 (git-fixes).\n- drm/komeda: fix integer overflow in AFBC framebuffer size check (git-fixes).\n- drm/loongson: Use managed KMS polling (git-fixes).\n- drm/msm/a6xx: Fix dumping A650+ debugbus blocks (git-fixes).\n- drm/msm/a6xx: Fix HLSQ register dumping (git-fixes).\n- drm/msm/a6xx: Use barriers while updating HFI Q headers (git-fixes).\n- drm/msm/dpu: fix mismatch between power and frequency (git-fixes).\n- drm/msm/dsi: add the missing parameter description (git-fixes).\n- drm/msm/dsi: fix bits_per_pclk (git-fixes).\n- drm/msm/dsi: fix hdisplay calculation for CMD mode panel (git-fixes).\n- drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 (git-fixes).\n- drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata() (git-fixes).\n- drm/msm/shrinker: Fix can_block() logic (git-fixes).\n- drm/nouveau: fix nvkm_device leak on aperture removal failure (git-fixes).\n- drm/nouveau: fix u32 overflow in pushbuf reloc bounds check (git-fixes).\n- drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds (git-fixes).\n- drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds (git-fixes).\n- drm/panel: sharp-ls043t1le01: make use of prepare_prev_first (git-fixes).\n- drm/panel: simple: Correct G190EAN01 prepare timing (git-fixes).\n- drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() (git-fixes).\n- drm/panthor: Fix outdated function documentation (git-fixes).\n- drm/radeon: add missing revision check for CI (git-fixes).\n- drm/sun4i: backend: fix error pointer dereference (git-fixes).\n- drm/sun4i: Fix resource leaks (git-fixes).\n- drm/v3d: Handle error from drm_sched_entity_init() (git-fixes).\n- drm/vc4: Fix a memory leak in hang state error path (git-fixes).\n- drm/vc4: Fix memory leak of BO array in hang state (git-fixes).\n- drm/vc4: platform_get_irq_byname() returns an int (stable-fixes).\n- drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock (git-fixes).\n- drm/vc4: Release runtime PM reference after binding V3D (git-fixes).\n- drm/vram: remove DRM_VRAM_MM_FILE_OPERATIONS from docs (git-fixes).\n- drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked() (git-fixes).\n- drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked() (git-fixes).\n- drm/xe/debugfs: Correct printing of register whitelist ranges (git-fixes).\n- drm/xe/dma-buf: handle empty bo and UAF races (git-fixes).\n- drm/xe/gsc: Fix BO leak on error in query_compatibility_version() (git-fixes).\n- drm/xe/uapi: update used tracking kernel-doc (git-fixes).\n- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (git-fixes).\n- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (git-fixes).\n- dt-bindings: net: Fix Tegra234 MGBE PTP clock (git-fixes).\n- efi/capsule-loader: fix incorrect sizeof in phys array reallocation (git-fixes).\n- efi: pstore: Drop efivar lock when efi_pstore_open() returns with an error (git-fixes).\n- erofs: add GFP_NOIO in the bio completion if needed (git-fixes).\n- ext4: fix fsync(2) for nojournal mode (git-fixes).\n- ext4: make recently_deleted() properly work with lazy itable initialization (git-fixes).\n- ext4: reject mount if bigalloc with s_first_data_block != 0 (git-fixes).\n- extcon: Fixed sysfs duplicate filename issue (git-fixes).\n- extcon: ptn5150: handle pending IRQ events during system resume (git-fixes).\n- fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break (git-fixes).\n- fbdev: offb: fix PCI device reference leak on probe failure (git-fixes).\n- fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO (stable-fixes).\n- fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO (git-fixes).\n- firmware: arm_ffa: Use the correct buffer size during RXTX_MAP (git-fixes).\n- firmware: dmi: Correct an indexing error in dmi.h (git-fixes).\n- firmware: google: framebuffer: Do not mark framebuffer as busy (git-fixes).\n- firmware: google: framebuffer: Do not unregister platform device (git-fixes).\n- gpio: of: clear OF_POPULATED on hog nodes in remove path (git-fixes).\n- gpio: tegra: fix irq_release_resources calling enable instead of disable (git-fixes).\n- gtp: disable BH before calling udp_tunnel_xmit_skb() (git-fixes).\n- HID: alps: fix NULL pointer dereference in alps_raw_event() (git-fixes).\n- HID: amd_sfh: don't log error when device discovery fails with -EOPNOTSUPP (git-fixes).\n- HID: apple: ensure the keyboard backlight is off if suspending (git-fixes).\n- HID: asus: do not abort probe when not necessary (git-fixes).\n- HID: asus: make asus_resume adhere to linux kernel coding standards (git-fixes).\n- HID: core: clamp report_size in s32ton() to avoid undefined shift (stable-fixes).\n- HID: logitech-hidpp: Enable MX Master 4 over bluetooth (stable-fixes).\n- HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure (stable-fixes).\n- HID: multitouch: Check to ensure report responses match the request (stable-fixes).\n- HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 (stable-fixes).\n- HID: roccat: fix use-after-free in roccat_report_event (stable-fixes).\n- HID: usbhid: fix deadlock in hid_post_reset() (git-fixes).\n- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (stable-fixes).\n- hisi_acc_vfio_pci: add eq and aeq interruption restore (git-fixes).\n- hisi_acc_vfio_pci: bugfix cache write-back issue (git-fixes).\n- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (git-fixes).\n- hv_sock: fix ARM64 support (git-fixes).\n- hv_sock: update outdated comment for renamed vsock_stream_recvmsg() (git-fixes).\n- hwmon: (ads7871) Fix endianness bug in 16-bit register reads (git-fixes).\n- hwmon: (corsair-psu) Close HID device on probe errors (git-fixes).\n- hwmon: (lm63) Add locking to avoid TOCTOU (git-fixes).\n- hwmon: (ltc2992) Clamp threshold writes to hardware range (git-fixes).\n- hwmon: (ltc2992) Fix u32 overflow in power read path (git-fixes).\n- hwmon: (ltc4286) Add missing MODULE_IMPORT_NS(\"PMBUS\") (git-fixes).\n- hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt (git-fixes).\n- hwmon: (powerz) Fix use-after-free on USB disconnect (git-fixes).\n- hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data() (git-fixes).\n- i2c: s3c24xx: check the size of the SMBUS message before using it (stable-fixes).\n- i2c: smbus: reject oversized block transfers in the common path (git-fixes).\n- i2c: stm32f7: reinit_completion() per transfer not per msg (git-fixes).\n- i2c: stub: Reject I2C block transfers with invalid length (git-fixes).\n- i2c: tegra: Add HS mode support (bsc#1261550).\n- i2c: tegra: Add Tegra256 support (bsc#1261550).\n- i2c: tegra: Do not configure DMA if not supported (bsc#1261550).\n- i2c: tegra: Don't mark devices with pins as IRQ safe (stable-fixes).\n- i2c: tegra: Update Tegra256 timing parameters (bsc#1261550).\n- i2c: tegra: Use separate variables for fast and fastplus (bsc#1261550).\n- i3c: dw: Fix memory leak in dw_i3c_master_i3c_xfers() (git-fixes).\n- i3c: master: Fix error codes at send_ccc_cmd (git-fixes).\n- i3c: mipi-i3c-hci: fix IBI payload length calculation for final status (git-fixes).\n- ibmveth: Disable GSO for packets with small MSS (bsc#1265144).\n- iio: adc: ad7192: Revert \"properly check spi_get_device_match_data()\" (stable-fixes).\n- iio: adc: ad7768-1: fix one-shot mode data acquisition (git-fixes).\n- iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() (git-fixes).\n- iio: frequency: admv1013: add dev variable (stable-fixes).\n- iio: frequency: admv1013: fix NULL pointer dereference on str (git-fixes).\n- Input: bcm5974 - recover from failed mode switch (stable-fixes).\n- Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table (stable-fixes).\n- Input: uinput - fix circular locking dependency with ff-core (git-fixes).\n- Input: uinput - take event lock when submitting FF request \"event\" (stable-fixes).\n- Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode (stable-fixes).\n- Input: xpad - add support for Razer Wolverine V3 Pro (stable-fixes).\n- interconnect: debugfs: fix devm_kstrdup and kfree mismatch (git-fixes).\n- io_uring/timeout: check unused sqe fields (git-fixes).\n- iommu/amd: move wait_on_sem() out of spinlock (git-fixes bsc#1260593).\n- iommu/amd: serialize sequence allocation under concurrent TLB invalidations (git-fixes bsc#1260593).\n- iommu/vt-d: Remove LPIG from page group response descriptor (jsc#PED-16113).\n- ipmi: Add limits to event and receive message requests (git-fixes).\n- ipmi: Check event message buffer response for bad data (git-fixes).\n- ipmi: ssif_bmc: change log level to dbg in irq callback (git-fixes).\n- ipmi: ssif_bmc: fix message desynchronization after truncated response (git-fixes).\n- ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure (git-fixes).\n- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (git-fixes).\n- KVM: arm64: Allow cacheable stage 2 mapping using VMA flags (git-fixes).\n- KVM: arm64: Assume non-PFNMAP/MIXEDMAP VMAs can be mapped cacheable (git-fixes).\n- KVM: arm64: Block cacheable PFNMAP mapping (git-fixes).\n- KVM: arm64: Consolidate idreg callbacks (git-fixes).\n- KVM: arm64: Discard PC update state on vcpu reset (git-fixes).\n- KVM: arm64: Finalize ID registers only once per VM (git-fixes).\n- KVM: arm64: Fix MTE flag initialization for protected VMs (git-fixes).\n- KVM: arm64: Fix page leak in user_mem_abort() (git-fixes).\n- KVM: arm64: Fix Trace Buffer trap polarity for protected VMs (git-fixes).\n- KVM: arm64: Fix Trace Buffer trapping for protected VMs (git-fixes).\n- KVM: arm64: Fix vma_shift staleness on nested hwpoison path (git-fixes).\n- KVM: arm64: Hide S1POE from guests when not supported by the host (git-fixes).\n- KVM: arm64: Limit clearing of ID_{AA64PFR0,PFR1}_EL1.GIC to userspace irqchip (git-fixes).\n- KVM: arm64: Make all 32bit ID registers fully writable (git-fixes).\n- KVM: arm64: nv: Add trap config for DBGWCR\u003c15\u003e_EL1 (git-fixes).\n- KVM: arm64: nv: Return correct RES0 bits for FGT registers (git-fixes).\n- KVM: arm64: pkvm: Fallback to level-3 mapping on host stage-2 fault (git-fixes).\n- KVM: arm64: Read PMUVer as unsigned (git-fixes).\n- KVM: arm64: Rename the device variable to s2_force_noncacheable (git-fixes).\n- KVM: arm64: Return early from trace helpers when KVM isn't available (git-fixes).\n- KVM: arm64: Set ID_{AA64PFR0,PFR1}_EL1.GIC when GICv3 is configured (git-fixes).\n- KVM: arm64: vgic-v3: Release reserved slot outside of lpi_xa's lock (git-fixes).\n- KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes).\n- KVM: nSVM: Use vcpu-\u003earch.cr2 when updating vmcb12 on nested #VMEXIT (git-fixes).\n- KVM: nVMX: Add consistency check for TSC_MULTIPLIER=0 (git-fixes).\n- KVM: Reject wrapped offset in kvm_reset_dirty_gfn() (git-fixes).\n- KVM: SEV: Disallow LAUNCH_FINISH if vCPUs are actively being created (git-fixes).\n- KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (git-fixes).\n- KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish (git-fixes).\n- KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm-\u003elock (git-fixes).\n- KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU (git-fixes).\n- KVM: SVM: Disallow EFER.LMSLE when not supported by hardware (git-fixes).\n- KVM: SVM: Fix a missing kunmap_local() in sev_gmem_post_populate() (git-fixes).\n- KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC (git-fixes).\n- KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (git-fixes).\n- KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN (git-fixes).\n- KVM: SVM: Properly check RAX in the emulator for SVM instructions (git-fixes).\n- KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (git-fixes).\n- KVM: TDX: Explicitly set user-return MSRs that *may* be clobbered by the TDX-Module (git-fixes).\n- KVM: x86/mmu: Fix UBSAN warning when reading nx_huge_pages parameter (git-fixes).\n- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (git-fixes).\n- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (git-fixes).\n- KVM: x86: Advertise EferLmsleUnsupported to userspace (git-fixes).\n- KVM: x86: check for nEPT/nNPT in slow flush hypercalls (git-fixes).\n- KVM: X86: Fix array_index_nospec protection in __pv_send_ipi (git-fixes).\n- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (git-fixes).\n- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (git-fixes).\n- KVM: x86: Ignore cpuid faulting in SMM (git-fixes).\n- leds: lgm-sso: Remove duplicate assignments for priv-\u003emmap (git-fixes).\n- leds: qcom-lpg: Check for array overflow when selecting the high resolution (stable-fixes).\n- lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() (git-fixes).\n- md/raid1: fix the comparing region of interval tree (bsc#1261555).\n- md/raid1: serialize overlap io for writemostly disk (bsc#1261555).\n- media: amphion: Fix race between m2m job_abort and device_run (git-fixes).\n- media: as102: fix to not free memory after the device is registered in as102_usb_probe() (git-fixes).\n- media: chips-media: wave5: add missing spinlock protection for handle_dynamic_resolution_change() (git-fixes).\n- media: chips-media: wave5: add missing spinlock protection for send_eos_event() (git-fixes).\n- media: chips-media: wave5: fix a potential memory leak in wave5_vdi_init() (git-fixes).\n- media: dib8000: avoid division by 0 in dib8000_set_dds() (git-fixes).\n- media: em28xx: fix use-after-free in em28xx_v4l2_open() (git-fixes).\n- media: hackrf: fix to not free memory after the device is registered in hackrf_probe() (git-fixes).\n- media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() (git-fixes).\n- media: i2c: imx283: Enter full standby when stopping streaming (git-fixes).\n- media: i2c: imx283: Fix hang when going from large to small resolution (git-fixes).\n- media: i2c: imx412: Assert reset GPIO during probe (git-fixes).\n- media: i2c: ov08d10: fix image vertical start setting (git-fixes).\n- media: i2c: ov8856: free control handler on error in ov8856_init_controls() (git-fixes).\n- media: intel/ipu6: fix error pointer dereference (git-fixes).\n- media: mtk-jpeg: fix use-after-free in release path due to uncancelled work (git-fixes).\n- media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 (git-fixes).\n- media: omap3isp: drop the use count of v4l2 pipeline (git-fixes).\n- media: pci: zoran: fix potential memory leak in zoran_probe() (git-fixes).\n- media: rc: streamzap: Error handling in probe (git-fixes).\n- media: rc: xbox_remote: heed DMA restrictions (git-fixes).\n- media: saa7164: add ioremap return checks and cleanups (git-fixes).\n- media: staging: imx: configure src_mux in csi_start (git-fixes).\n- media: staging: imx: request mbus_config in csi_start (git-fixes).\n- media: uvcvideo: Enable VB2_DMABUF for metadata stream (git-fixes).\n- media: videobuf2: Set vma_flags in vb2_dma_sg_mmap (git-fixes).\n- media: vidtv: fix nfeeds state corruption on start_streaming failure (git-fixes).\n- media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections (git-fixes).\n- media: vidtv: fix pass-by-value structs causing MSAN warnings (git-fixes).\n- memory: tegra30-emc: Fix dll_change check (git-fixes).\n- memory: tegra124-emc: Fix dll_change check (git-fixes).\n- mfd: core: Preserve OF node when ACPI handle is present (git-fixes).\n- mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() (git-fixes).\n- mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused (git-fixes).\n- mkspec: Add signature to source list only when it exists.\n- mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration (git-fixes).\n- mmc: vub300: fix NULL-deref on disconnect (git-fixes).\n- modpost: Amend ppc64 save/restfpr symnames for -Os build (bsc#1215199).\n- mtd: docg3: fix use-after-free in docg3_release() (git-fixes).\n- mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions (git-fixes).\n- mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path (git-fixes).\n- mtd: physmap_of_gemini: Fix disabled pinctrl state check (git-fixes).\n- mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob (git-fixes).\n- mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations (git-fixes).\n- mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() (git-fixes).\n- mtd: spi-nor: sst: Fix write enable before AAI sequence (git-fixes).\n- mtd: spi-nor: swp: check SR_TB flag when getting tb_mask (git-fixes).\n- net-shapers: don't free reply skb after genlmsg_reply() (git-fixes).\n- net/mlx5: Fix HCA caps leak on notifier init failure (git-fixes).\n- net/rds: reset op_nents when zerocopy page pin fails (bsc#1265626).\n- net/sched: cls_fw: fix NULL dereference of \"old\" filters before change() (git-fixes).\n- net/sched: fix pedit partial COW leading to page cache corruption (bsc#1265421).\n- net: gro: don't merge zcopy skbs (git-fixes).\n- net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf (git-fixes).\n- net: mana: Add MAC address to vPort logs and clarify error messages (git-fixes).\n- net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq() (git-fixes).\n- net: mana: Don't overwrite port probe error with add_adev result (git-fixes).\n- net: mana: Fix crash from unvalidated SHM offset read from BAR0 during FLR (bsc#1265846).\n- net: mana: Fix EQ leak in mana_remove on NULL port (git-fixes).\n- net: mana: Fix RX skb truesize accounting (bsc#1248754).\n- net: mana: Guard mana_remove against double invocation (git-fixes).\n- net: mana: hardening: Validate adapter_mtu from MANA_QUERY_DEV_CONFIG (git-fixes).\n- net: mana: hardening: Validate doorbell ID from GDMA_REGISTER_DEVICE response (git-fixes).\n- net: mana: Init gf_stats_work before potential error paths in probe (git-fixes).\n- net: mana: Init link_change_work before potential error paths in probe (git-fixes).\n- net: mana: Move current_speed debugfs file to mana_init_port() (git-fixes).\n- net: mana: remove double CQ cleanup in mana_create_rxq error path (git-fixes).\n- net: mana: Set default number of queues to 16 (bsc#1261648).\n- net: mana: Skip WQ object destruction for uninitialized RXQ (git-fixes).\n- net: mana: Use at least SZ_4K in doorbell ID range check (git-fixes).\n- net: mana: Use pci_name() for debugfs directory naming (git-fixes).\n- net: phy: broadcom: Save PHY counters during suspend (git-fixes).\n- net: phy: DP83TC811: add reading of abilities (git-fixes).\n- net: phy: dp83869: fix setting CLK_O_SEL field (git-fixes).\n- net: phy: fix a return path in get_phy_c45_ids() (git-fixes).\n- net: phy: qcom: at803x: Use the correct bit to disable extended next page (git-fixes).\n- net: stmmac: Fix PTP ref clock for Tegra234 (git-fixes).\n- net: usb: asix: ax88772: re-add usbnet_link_change() in phylink callbacks (git-fixes).\n- net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() (git-fixes).\n- net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() (git-fixes).\n- net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit (git-fixes).\n- net: wan: fsl_ucc_hdlc: fix ucc_hdlc_remove (git-fixes).\n- net: wan: fsl_ucc_hdlc: fix uhdlc_memclean (git-fixes).\n- net: wan: fsl_ucc_hdlc: free tx_skbuff in uhdlc_memclean (git-fixes).\n- net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler (git-fixes).\n- NFC: digital: Bounds check NFC-A cascade depth in SDD response handler (git-fixes).\n- nfc: llcp: add missing return after LLCP_CLOSED checks (git-fixes).\n- nfc: pn533: allocate rx skb before consuming bytes (git-fixes).\n- nfc: s3fwrn5: allocate rx skb before consuming bytes (git-fixes).\n- NFC: trf7970a: Ignore antenna noise when checking for RF field (git-fixes).\n- nvme-apple: drop invalid put of admin queue reference count (git-fixes).\n- nvme-auth: Include SC_C in RVAL controller hash (bsc#1260428).\n- nvme-loop: do not cancel I/O and admin tagset during ctrl reset/shutdown (bsc#1262709).\n- nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 (git-fixes).\n- nvme: Allow reauth from sysfs (bsc#1259672).\n- nvme: Expose the tls_configured sysfs for secure concat connections (bsc#1259672).\n- nvme: expose TLS mode (bsc#1259672).\n- nvme: fix admin queue leak on controller reset (git-fixes).\n- nvme: fix PCIe subsystem reset controller state transition (bsc#1261738).\n- nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers (git-fixes).\n- ocfs2: fix possible deadlock between unlink and dio_end_io_write (bsc#1258718).\n- ocfs2: split transactions in dio completion to avoid credit exhaustion (bsc#1258718).\n- openvswitch: vport: fix self-deadlock on release of tunnel ports (git-fixes).\n- panic/printk: replace other_cpu_in_panic() with panic_on_other_cpu() (bsc#1261149).\n- panic/printk: replace this_cpu_in_panic() with panic_on_this_cpu() (bsc#1261149).\n- panic: introduce helper functions for panic state (bsc#1261149).\n- panic: use angle-bracket include for panic.h (bsc#1261149).\n- PCI/AER: Clear only error bits in PCIe Device Status (git-fixes).\n- PCI/AER: Stop ruling out unbound devices as error source (git-fixes).\n- PCI/ASPM: Fix pci_clear_and_set_config_dword() usage (git-fixes).\n- PCI/NPEM: Set LED_HW_PLUGGABLE for hotplug-capable ports (git-fixes).\n- PCI/TPH: Allow TPH enable for RCiEPs (git-fixes).\n- PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well (git-fixes).\n- PCI: dwc: rcar-gen4: Change EPC BAR alignment to 4K as per the documentation (git-fixes).\n- PCI: Enable AtomicOps only if Root Port supports them (git-fixes).\n- PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown (git-fixes).\n- PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup (git-fixes).\n- PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete (git-fixes).\n- PCI: hv: Set default NUMA node to 0 for devices without affinity info (bsc#1261648).\n- PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found (git-fixes).\n- PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion support (git-fixes).\n- PCI: tegra194: Allow system suspend when the Endpoint link is not up (git-fixes).\n- PCI: tegra194: Disable direct speed change for Endpoint mode (git-fixes).\n- PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down (git-fixes).\n- PCI: tegra194: Disable PERST# IRQ only in Endpoint mode (git-fixes).\n- PCI: tegra194: Fix CBB timeout caused by DBI access before core power-on (git-fixes).\n- PCI: tegra194: Fix polling delay for L2 state (git-fixes).\n- PCI: tegra194: Free up Endpoint resources during remove() (git-fixes).\n- PCI: tegra194: Increase LTSSM poll time on surprise link down (git-fixes).\n- PCI: tegra194: Set LTR message request before PCIe link up in Endpoint mode (git-fixes).\n- PCI: tegra194: Use devm_gpiod_get_optional() to parse \"nvidia,refclk-select\" (git-fixes).\n- PCI: tegra194: Use DWC IP core version (git-fixes).\n- pinctrl: abx500: Fix type of 'argument' variable (git-fixes).\n- pinctrl: Fix spelling problem (git-fixes).\n- pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) (stable-fixes).\n- pinctrl: pic32: change all cases of bare 'unsigned' to 'unsigned int' (git-fixes).\n- pinctrl: pic32: use consistent spacing around '+' (git-fixes).\n- pinctrl: pinctrl-pic32: Fix resource leak (git-fixes).\n- pinctrl: realtek: Fix function signature for config argument (git-fixes).\n- pinctrl: renesas: rzg2l: Fix save/restore of {IOLH,IEN,PUPD,SMT} registers (git-fixes).\n- platform/chrome: chromeos_tbmc: Drop wakeup source on remove (git-fixes).\n- platform/surface: surfacepro3_button: Drop wakeup source on remove (git-fixes).\n- platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug (stable-fixes).\n- platform/x86/intel-uncore-freq: Handle autonomous UFS status bit (git-fixes).\n- platform/x86: asus-wmi: adjust screenpad power/brightness handling (git-fixes).\n- platform/x86: asus-wmi: fix screenpad brightness range (git-fixes).\n- platform/x86: dell-wmi-sysman: bound enumeration string aggregation (git-fixes).\n- platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() (git-fixes).\n- platform/x86: hp-wmi: Ignore backlight and FnLock events (stable-fixes).\n- platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup (git-fixes).\n- power: supply: axp288_charger: Do not cancel work before initializing it (git-fixes).\n- power: supply: max17042: avoid overflow when determining health (git-fixes).\n- powerpc/crash: fix backup region offset update to elfcorehdr (bsc#1259535).\n- powerpc/crash: Update backup region offset in elfcorehdr on memory hotplug (bsc#1259535).\n- printk/nbcon/panic: Allow printk kthread to sleep when the system is in panic (bsc#1261149).\n- printk/nbcon: Block printk kthreads when any CPU is in an emergency context (bsc#1261149).\n- printk/nbcon: Release nbcon consoles ownership in atomic flush after each emitted record (bsc#1261149).\n- printk/nbcon: Restore IRQ in atomic flush after each emitted record (bsc#1261149).\n- printk/nbcon: use panic_on_this_cpu() helper (bsc#1261149).\n- printk: Allow printk_trigger_flush() to flush all types (bsc#1262750).\n- printk: Allow to use the printk kthread immediately even for 1st nbcon (jsc#PED-7912).\n- printk: Avoid irq_work for printk_deferred() on suspend (bsc#1262750).\n- printk: Avoid scheduling irq_work on suspend (bsc#1262750).\n- printk: console_flush_one_record() code cleanup (bsc#1261149).\n- printk: Introduce console_flush_one_record (bsc#1261149).\n- printk: Use console_flush_one_record for legacy printer kthread (bsc#1261149).\n- pwm: imx-tpm: Count the number of enabled channels in probe (git-fixes).\n- qat: don't mess with -\u003ed_name (jsc#PED-14238).\n- r8152: fix incorrect register write to USB_UPHY_XTAL (git-fixes).\n- RDMA/irdma: Fix double free related to rereg_user_mr (git-fixes).\n- RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() (git-fixes).\n- RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() (git-fixes).\n- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (git-fixes).\n- RDMA/mana: Validate rx_hash_key_len (git-fixes).\n- RDMA/mana_ib: cleanup the usage of mana_gd_send_request() (git-fixes).\n- RDMA/mana_ib: Disable RX steering on RSS QP destroy (git-fixes).\n- RDMA/mana_ib: Support memory windows (git-fixes).\n- regulator: act8945a: fix OF node reference imbalance (git-fixes).\n- regulator: bd9571mwv: fix OF node reference imbalance (git-fixes).\n- regulator: max77650: fix OF node reference imbalance (git-fixes).\n- regulator: mt6357: fix OF node reference imbalance (git-fixes).\n- regulator: rk808: fix OF node reference imbalance (git-fixes).\n- remoteproc: xlnx: Fix sram property parsing (git-fixes).\n- remoteproc: xlnx: Only access buffer information if IPI is buffered (git-fixes).\n- Revert \"ALSA: usb: Increase volume range that triggers a warning\" (git-fixes).\n- Revert \"serial: 8250: Revert \"drop lockdep annotation from serial8250_clear_IER()\"\" (bsc#1262480).\n- Revert \"serial: 8250: Switch to nbcon console\" (bsc#1262480).\n- rtc: abx80x: Disable alarm feature if no interrupt attached (git-fixes).\n- rtc: ntxec: fix OF node reference imbalance (git-fixes).\n- s390/dasd: Copy detected format information to secondary device (bsc#1259994).\n- s390/dasd: Fix gendisk parent after copy pair swap (bsc#1259994).\n- s390/dasd: Move quiesce state with pprc swap (bsc#1259994).\n- sched/fair: Change likelyhood of nohz.nr_cpus (bsc#1234634 bsc#1258961).\n- sched/fair: Move checking for nohz cpus after time check (bsc#1234634 bsc#1258961).\n- sched/fair: Remove nohz.nr_cpus and use weight of cpumask instead (bsc#1234634 bsc#1258961).\n- scsi: lpfc: Add clean up of aborted NVMe commands during PCI fcn reset (bsc#1262019).\n- scsi: lpfc: Add log messages to fabric login error labels (bsc#1262019).\n- scsi: lpfc: Add PCI ID support for LPe42100 series adapters (bsc#1262019).\n- scsi: lpfc: Add REG_VFI mailbox cmd error handling (bsc#1262019).\n- scsi: lpfc: Break out of IRQ affinity assignment when mask reaches nr_cpu_ids (bsc#1262019).\n- scsi: lpfc: Check ASIC_ID register to aid diagnostics during failed fw updates (bsc#1262019).\n- scsi: lpfc: Cleanup error exit paths in lpfc_fdmi_cmd() and associated messages (bsc#1262019).\n- scsi: lpfc: ELIMINATE kernel-doc warnings in lpfc.h (bsc#1262019).\n- scsi: lpfc: Fix incorrect txcmplq_cnt during cleanup in lpfc_sli_abort_ring() (bsc#1262019).\n- scsi: lpfc: Introduce 128G link speed selection and support (bsc#1262019).\n- scsi: lpfc: Log discarded and insufficient RQE buffer events (bsc#1262019).\n- scsi: lpfc: Log MCQE contents for mbox commands with no context (bsc#1262019).\n- scsi: lpfc: Properly set WC for DPP mapping (bsc#1262019).\n- scsi: lpfc: Reduce pointer chasing when accessing vmid_flag (bsc#1262019).\n- scsi: lpfc: Remove deprecated PBDE feature (bsc#1262019).\n- scsi: lpfc: Remove unnecessary ndlp kref get in lpfc_check_nlp_post_devloss (bsc#1262019).\n- scsi: lpfc: Restrict first burst to non-FCoE and SLI4 adapters only (bsc#1262019).\n- scsi: lpfc: Select mailbox rq_create cmd version based on SLI4 if_type (bsc#1262019).\n- scsi: lpfc: Update class of service bit field to 3 bits for WQE submissions (bsc#1262019).\n- scsi: lpfc: Update construction of SGL when XPSGL is enabled (bsc#1262019).\n- scsi: lpfc: Update copyright year string for 2026 (bsc#1262019).\n- scsi: lpfc: Update log message when ndlp kref get is unsuccessful (bsc#1262019).\n- scsi: lpfc: Update lpfc version to 14.4.0.14 (bsc#1262019).\n- scsi: lpfc: Update lpfc version to 15.0.0.0 (bsc#1262019).\n- scsi: lpfc: Update outdated comment for renamed lpfc_freenode() (bsc#1262019).\n- scsi: lpfc: Use min_t() instead of min() in lpfc_sli4_driver_resource_setup (bsc#1262019).\n- scsi: lpfc: Use the crc32c() function (bsc#1262019).\n- scsi: mpi3mr: Add NULL checks when resetting request and reply queues (git-fixes).\n- scsi: ses: Fix devices attaching to different hosts (git-fixes).\n- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (git-fixes).\n- scsi: target: iscsi: validate CHAP_R length before base64 decode (bsc#1265449).\n- scsi: ufs: ufs-pci: Add support for Intel Wildcat Lake (jsc#PED-13771).\n- selftests/bpf: Test cross-sign 64bits range refinement (git-fixes).\n- selftests/bpf: Test invariants on JSLT crossing sign (git-fixes).\n- selftests/bpf: test refining u32/s32 bounds when ranges cross min/max boundary (git-fixes).\n- selftests: net: build net/lib dependency in all target (bsc#1262245).\n- selinux: don't reserve xattr slot when we won't fill it (stable-fixes).\n- selinux: prune /sys/fs/selinux/disable (stable-fixes).\n- selinux: shrink critical section in sel_write_load() (stable-fixes).\n- serial: 8250: Add serial8250_handle_irq_locked() (bsc#1262480).\n- serial: 8250: Protect LCR write in shutdown (bsc#1262480).\n- serial: 8250_dw: Avoid unnecessary LCR writes (bsc#1262480).\n- serial: 8250_dw: Ensure BUSY is deasserted (bsc#1262480).\n- serial: 8250_dw: Rework dw8250_handle_irq() locking and IIR handling (bsc#1262480).\n- serial: 8250_dw: Rework IIR_NO_INT handling to stop interrupt storm (bsc#1262480).\n- Set CONFIG_INTEL_TSX_MODE to follow upstream AUTO default (bsc#1263044).\n- soc/tegra: cbb: Set ERD on resume for err interrupt (git-fixes).\n- soc: qcom: aoss: compare against normalized cooling state (git-fixes).\n- soc: qcom: llcc: fix v1 SB syndrome register offset (git-fixes).\n- soc: qcom: ocmem: make the core clock optional (git-fixes).\n- soc: qcom: ocmem: register reasons for probe deferrals (git-fixes).\n- soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available (git-fixes).\n- sound: ua101: fix division by zero at probe (git-fixes).\n- soundwire: bus: demote UNATTACHED state warnings to dev_dbg() (git-fixes).\n- soundwire: cadence: Clear message complete before signaling waiting thread (git-fixes).\n- soundwire: debugfs: initialize firmware_file to empty string (git-fixes).\n- spi: aspeed-smc: fix controller deregistration (git-fixes).\n- spi: at91-usart: fix controller deregistration (git-fixes).\n- spi: atmel: fix controller deregistration (git-fixes).\n- spi: bcm63xx: fix controller deregistration (git-fixes).\n- spi: bcmbca-hsspi: fix controller deregistration (git-fixes).\n- spi: cadence: fix controller deregistration (git-fixes).\n- spi: cadence: fix unclocked access on unbind (git-fixes).\n- spi: ch341: fix memory leaks on probe failures (git-fixes).\n- spi: coldfire-qspi: fix controller deregistration (git-fixes).\n- spi: dln2: fix controller deregistration (git-fixes).\n- spi: fix controller cleanup() documentation (git-fixes).\n- spi: fix misleading controller deregistration kernel-doc (git-fixes).\n- spi: fix misleading controller registration kernel-doc (git-fixes).\n- spi: fsl-espi: fix controller deregistration (git-fixes).\n- spi: fsl-qspi: Use reinit_completion() for repeated operations (git-fixes).\n- spi: fsl: fix controller deregistration (git-fixes).\n- spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo (git-fixes).\n- spi: img-spfi: fix controller deregistration (git-fixes).\n- spi: imx: fix runtime pm leak on probe deferral (git-fixes).\n- spi: imx: fix use-after-free on unbind (git-fixes).\n- spi: lantiq-ssc: fix controller deregistration (git-fixes).\n- spi: meson-spicc: fix controller deregistration (git-fixes).\n- spi: microchip-core-qspi: fix controller deregistration (git-fixes).\n- spi: mpc52xx: fix controller deregistration (git-fixes).\n- spi: mpc52xx: fix use-after-free on registration failure (git-fixes).\n- spi: mpc52xx: fix use-after-free on unbind (git-fixes).\n- spi: mtk-nor: fix controller deregistration (git-fixes).\n- spi: mtk-snfi: fix memory leak in probe (git-fixes).\n- spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback (git-fixes).\n- spi: mxic: fix controller deregistration (git-fixes).\n- spi: mxs: fix controller deregistration (git-fixes).\n- spi: npcm-pspi: fix controller deregistration (git-fixes).\n- spi: omap2-mcspi: fix controller deregistration (git-fixes).\n- spi: orion: fix clock imbalance on registration failure (git-fixes).\n- spi: orion: fix controller deregistration (git-fixes).\n- spi: orion: fix runtime pm leak on unbind (git-fixes).\n- spi: pic32-sqi: fix controller deregistration (git-fixes).\n- spi: pic32: fix controller deregistration (git-fixes).\n- spi: pl022: fix controller deregistration (git-fixes).\n- spi: qup: fix controller deregistration (git-fixes).\n- spi: rockchip: fix controller deregistration (git-fixes).\n- spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ (git-fixes).\n- spi: rspi: fix controller deregistration (git-fixes).\n- spi: s3c64xx: fix controller deregistration (git-fixes).\n- spi: s3c64xx: fix NULL-deref on driver unbind (git-fixes).\n- spi: sh-hspi: fix controller deregistration (git-fixes).\n- spi: sprd: fix controller deregistration (git-fixes).\n- spi: st-ssc4: fix controller deregistration (git-fixes).\n- spi: sun4i: fix controller deregistration (git-fixes).\n- spi: sun6i: fix controller deregistration (git-fixes).\n- spi: syncuacer: fix controller deregistration (git-fixes).\n- spi: ti-qspi: fix controller deregistration (git-fixes).\n- spi: topcliff-pch: fix controller deregistration (git-fixes).\n- spi: topcliff-pch: fix use-after-free on unbind (git-fixes).\n- spi: uniphier: fix controller deregistration (git-fixes).\n- spi: uniphier: Simplify clock handling with devm_clk_get_enabled() (stable-fixes).\n- spi: zynq-qspi: fix controller deregistration (git-fixes).\n- spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() (stable-fixes).\n- spi: zynqmp-gqspi: fix controller deregistration (git-fixes).\n- staging: media: atomisp: Disallow all private IOCTLs (git-fixes).\n- staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() (git-fixes).\n- staging: sm750fb: fix division by zero in ps_to_hz() (git-fixes).\n- staging: vme_user: fix root device leak on init failure (git-fixes).\n- tg3: replace placeholder MAC address with device property (git-fixes).\n- thermal/drivers/spear: Fix error condition for reading st,thermal-flags (git-fixes).\n- thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp (git-fixes).\n- thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata (git-fixes).\n- tools/power/turbostat: Fix microcode patch level output for AMD/Hygon (git-fixes).\n- tools: hv: Fix cross-compilation (git-fixes).\n- tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public() (git-fixes).\n- tpm: avoid -Wunused-but-set-variable (git-fixes).\n- tpm: Fix auth session leak in tpm2_get_random() error path (git-fixes).\n- tpm: tpm_tis: add error logging for data transfer (git-fixes).\n- tpm: tpm_tis: stop transmit if retries are exhausted (git-fixes).\n- tpm: Use kfree_sensitive() to free auth session in tpm_dev_release() (git-fixes).\n- tty: serial: ip22zilog: Fix section mispatch warning (git-fixes).\n- udp: Force compute_score to always inline (bsc#1241259).\n- unshare: fix unshare_fs() handling (git-fixes).\n- USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen (git-fixes).\n- usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (git-fixes).\n- usb: chipidea: otg: not wait vbus drop if use role_switch (git-fixes).\n- USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam (stable-fixes).\n- usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer (stable-fixes).\n- usb: gadget: f_hid: Add missing error code (git-fixes).\n- usb: gadget: f_hid: don't call cdev_init while cdev in use (git-fixes).\n- usb: gadget: f_hid: move list and spinlock inits from bind to alloc (stable-fixes).\n- usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() (git-fixes).\n- usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() (git-fixes).\n- usb: gadget: f_uac1_legacy: validate control request size (stable-fixes).\n- usb: gadget: renesas_usb3: validate endpoint index in standard request handlers (git-fixes).\n- usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo (git-fixes).\n- USB: omap_udc: DMA: Don't enable burst 4 mode (git-fixes).\n- usb: port: add delay after usb_hub_set_port_power() (git-fixes).\n- usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive (stable-fixes).\n- USB: serial: io_edgeport: add support for Blackbox IC135A (stable-fixes).\n- USB: serial: option: add MeiG Smart SRM825WN (stable-fixes).\n- USB: serial: option: add support for Rolling Wireless RW135R-GL (stable-fixes).\n- USB: serial: option: add Telit Cinterion FN990A MBIM composition (git-fixes).\n- USB: serial: option: add Telit Cinterion LE910Cx compositions (stable-fixes).\n- usb: storage: Expand range of matched versions for VL817 quirks entry (git-fixes).\n- usb: typec: tcpm: reset internal port states on soft reset AMS (git-fixes).\n- usb: ulpi: fix memory leak on ulpi_register() error paths (git-fixes).\n- usb: usblp: fix heap leak in IEEE 1284 device ID via short response (stable-fixes).\n- usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl (stable-fixes).\n- usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() (git-fixes).\n- usbip: validate number_of_packets in usbip_pack_ret_submit() (git-fixes).\n- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (git-fixes).\n- vfio/pds: Fix memory leak in pds_vfio_dirty_enable() (git-fixes).\n- vfio/pds: Fix missing detach_ioas op (git-fixes).\n- vfio/pds: replace bitmap_free with vfree (git-fixes).\n- vfio/type1: Fix error unwind in migration dirty bitmap allocation (git-fixes).\n- vfio: Fix unbalanced vfio_df_close call in no-iommu mode (git-fixes).\n- vfio: Prevent open_count decrement to negative (git-fixes).\n- virt: arm-cca-guest: fix error check for RSI_INCOMPLETE (git-fixes).\n- virt: sev-guest: Do not use host-controlled page order in cleanup path (git-fixes).\n- virt: tdx-guest: Fix handling of host controlled 'quote' buffer length (git-fixes).\n- virt: tdx-guest: Return error for GetQuote failures (git-fixes).\n- wifi: ath5k: do not access array OOB (git-fixes).\n- wifi: ath9k: Fix typo (git-fixes).\n- wifi: ath10k: fix station lookup failure during disconnect (git-fixes).\n- wifi: ath11k: fix memory leaks in beacon template setup (git-fixes).\n- wifi: ath12k: fix leak in some ath12k_wmi_xxx() functions (git-fixes).\n- wifi: ath12k: use lockdep_assert_in_rcu_read_lock() for RCU assertions (git-fixes).\n- wifi: b43: enforce bounds check on firmware key index in b43_rx() (git-fixes).\n- wifi: b43legacy: enforce bounds check on firmware key index in RX path (git-fixes).\n- wifi: brcmfmac: Fix error pointer dereference (git-fixes).\n- wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task (git-fixes).\n- wifi: brcmfmac: validate bsscfg indices in IF events (stable-fixes).\n- wifi: brcmsmac: Fix dma_free_coherent() size (git-fixes).\n- wifi: cw1200: Revert \"Fix locking in error paths\" (git-fixes).\n- wifi: libertas: notify firmware load wait on disconnect (git-fixes).\n- wifi: mac80211: check ieee80211_rx_data_set_link return in pubsta MLO path (git-fixes).\n- wifi: mac80211: check tdls flag in ieee80211_tdls_oper (stable-fixes).\n- wifi: mac80211: drop stray 'static' from fast-RX rx_result (git-fixes).\n- wifi: mac80211: handle VHT EXT NSS in ieee80211_determine_our_sta_mode() (git-fixes).\n- wifi: mac80211: remove station if connection prep fails (git-fixes).\n- wifi: mac80211: use safe list iteration in radar detect work (git-fixes).\n- wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req() (git-fixes).\n- wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor (stable-fixes).\n- wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling (git-fixes).\n- wifi: mt76: mt7615: fix use_cts_prot support (git-fixes).\n- wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() (git-fixes).\n- wifi: mt76: mt7915: fix use_cts_prot support (git-fixes).\n- wifi: mt76: mt7921: fix 6GHz regulatory update on connection (git-fixes).\n- wifi: mt76: mt7921: fix a potential clc buffer length underflow (git-fixes).\n- wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work (git-fixes).\n- wifi: mt76: mt7921: Place upper limit on station AID (git-fixes).\n- wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() (git-fixes).\n- wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr (git-fixes).\n- wifi: mt76: mt7925: fix incorrect length field in txpower command (git-fixes).\n- wifi: mt76: mt7925: Fix incorrect MLO mode in firmware control (git-fixes).\n- wifi: mt76: mt7925: fix incorrect TLV length in CLC command (git-fixes).\n- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_tx_check_aggr() (git-fixes).\n- wifi: mt76: mt7925: prevent NULL vif dereference in mt7925_mac_write_txwi (git-fixes).\n- wifi: mt76: mt7996: fix FCS error flag check in RX descriptor (git-fixes).\n- wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event (git-fixes).\n- wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work() (git-fixes).\n- wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() (git-fixes).\n- wifi: nl80211: fix NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST usage (git-fixes).\n- wifi: nl80211: require admin perm on SET_PMK / DEL_PMK (git-fixes).\n- wifi: rsi: fix kthread lifetime race between self-exit and external-stop (git-fixes).\n- wifi: rt2x00usb: fix devres lifetime (git-fixes).\n- wifi: rtl8xxxu: fix potential use of uninitialized value (git-fixes).\n- wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet (git-fixes).\n- wifi: rtw88: Add additional USB IDs for RTL8812BU (bsc#1263135).\n- wifi: rtw88: Add BUFFALO WI-U3-866DHP to the USB ID list (bsc#1263135).\n- wifi: rtw88: Add support for Mercusys MA30N and D-Link DWA-T185 rev. A1 (bsc#1263135).\n- wifi: rtw88: check for PCI upstream bridge existence (git-fixes).\n- wifi: rtw88: fix device leak on probe failure (git-fixes).\n- wifi: rtw88: rtw8822bu VID/PID for BUFFALO WI-U2-866DM (bsc#1263135).\n- wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() (git-fixes).\n- wifi: wl1251: validate packet IDs before indexing tx_frames (stable-fixes).\n- x86/acpi/boot: Correct acpi_is_processor_usable() check again (git-fixes).\n- x86/boot/sev: Avoid shared GHCB page for early memory acceptance (git-fixes).\n- x86/boot/sev: Support memory acceptance in the EFI stub under SVSM (git-fixes).\n- x86/boot: Fix page table access in 5-level to 4-level paging transition (git-fixes).\n- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (bsc#1263255).\n- x86/cpufeatures: Free up unused feature bits (bsc#1263255).\n- x86/fred: Fix early boot failures on SEV-ES/SNP guests (git-fixes).\n- x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (git-fixes).\n- x86/sev: Add missing RIP_REL_REF() invocations during sme_enable() (git-fixes).\n- x86/sev: Do not touch VMSA pages during SNP guest memory kdump (git-fixes).\n- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (git-fixes).\n- x86/sev: Fix operator precedence in GHCB_MSR_VMPL_REQ_LEVEL macro (git-fixes).\n- x86/sev: Improve handling of writes to intercepted TSC MSRs (git-fixes).\n- x86/sev: Make sure pages are not skipped during kdump (git-fixes).\n- x86/tsx: Get the tsx= command line parameter with early_param() (bsc#1250951 bsc#1263044).\n- x86/tsx: Make tsx_ctrl_state static (bsc#1250951 bsc#1263044).\n- x86/vmware: Parse MP tables for SEV-SNP enabled guests under VMware hypervisors (git-fixes).\n- X.509: Fix out-of-bounds access when parsing extensions (git-fixes).\n- Xarray: do not return sibling entries from xas_find_marked() (bsc#1263815).\n","status":"published","published":"2026-05-28T11:12:43Z","modified":"2026-07-09T18:24:07.906973973Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:21841-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).\n- CVE-2024-14027: xattr: switch to CLASS(fd) (bsc#1259420).\n- CVE-2025-40181: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (bsc#1253471).\n- CVE-2025-68265: nvme: fix admin request_queue lifetime (bsc#1255360).\n- CVE-2025-68310: s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (bsc#1255160).\n- CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).\n- CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).\n- CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).\n- CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).\n- CVE-2026-23276: net: add xmit recursion limit to tunnel xmit functions (bsc#1260012).\n- CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).\n- CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).\n- CVE-2026-23316: net: ipv4: fix ARM64 alignment fault in multipath hash seed (bsc#1260573).\n- CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).\n- CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).\n- CVE-2026-23346: arm64: io: Rename ioremap_prot() to __ioremap_prot() (bsc#1260529).\n- CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).\n- CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).\n- CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).\n- CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).\n- CVE-2026-23375: mm: thp: deny THP for files on anonymous inodes (bsc#1260576).\n- CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).\n- CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).\n- CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).\n- CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).\n- CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).\n- CVE-2026-23417: bpf: Fix constant blinding for PROBE_MEM32 stores (bsc#1261410).\n- CVE-2026-23436: net: add helpers for lookup and walking netdevs under netdev_lock() (bsc#1261617).\n- CVE-2026-23437: net: shaper: protect late read accesses to the hierarchy (bsc#1261635).\n- CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).\n- CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).\n- CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).\n- CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).\n- CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).\n- CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).\n- CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).\n- CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).\n- CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).\n- CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).\n- CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).\n- CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).\n- CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on wakeup race (bsc#1261694).\n- CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).\n- CVE-2026-31395: bnxt_en: fix OOB access in DBG_BUF_PRODUCER async event handler (bsc#1261786).\n- CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).\n- CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).\n- CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).\n- CVE-2026-31406: xfrm: Fix work re-schedule after cancel in xfrm_nat_keepalive_net_fini() (bsc#1261629).\n- CVE-2026-31407: netfilter: conntrack: add missing netlink policy validations (bsc#1261632).\n- CVE-2026-31411: net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (bsc#1261752).\n- CVE-2026-31415: ipv6: avoid overflows in ip6_datagram_send_ctl() (bsc#1262099).\n- CVE-2026-31416: netfilter: nfnetlink_log: account for netlink header size (bsc#1262100).\n- CVE-2026-31420: bridge: mrp: reject zero test interval to avoid OOM panic (bsc#1262055).\n- CVE-2026-31421: net/sched: cls_fw: fix NULL pointer dereference on shared blocks (bsc#1262061).\n- CVE-2026-31422: net/sched: cls_flow: fix NULL pointer dereference on shared blocks (bsc#1262054).\n- CVE-2026-31423: net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() (bsc#1262063).\n- CVE-2026-31424: netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (bsc#1262053).\n- CVE-2026-31425: rds: ib: reject FRMR registration before IB connection is established (bsc#1262074).\n- CVE-2026-31427: netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp (bsc#1262086).\n- CVE-2026-31428: netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (bsc#1262087).\n- CVE-2026-31435: netfs: Fix read abandonment during retry (bsc#1262601).\n- CVE-2026-31449: ext4: validate p_idx bounds in ext4_ext_correct_indexes (bsc#1262616).\n- CVE-2026-31453: xfs: avoid dereferencing log items after push callbacks (bsc#1262617).\n- CVE-2026-31456: mm/pagewalk: fix race between concurrent split and refault (bsc#1262627).\n- CVE-2026-31494: net: cadence: macb: Synchronize stats calculations (bsc#1262671).\n- CVE-2026-31496: netfilter: nf_conntrack_expect: skip expectations in other netns via proc (bsc#1262673).\n- CVE-2026-31503: udp: Fix wildcard bind conflict check when using hash2 (bsc#1263077).\n- CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263085).\n- CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263093).\n- CVE-2026-31507: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer (bsc#1263095).\n- CVE-2026-31515: af_key: validate families in pfkey_send_migrate() (bsc#1262752).\n- CVE-2026-31519: btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create (bsc#1263012).\n- CVE-2026-31525: bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN (bsc#1262725).\n- CVE-2026-31526: bpf: Fix exception exit lock checking for subprogs (bsc#1262662).\n- CVE-2026-31528: perf: Make sure to use pmu_ctx-\u003epmu for groups (bsc#1263001).\n- CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262758).\n- CVE-2026-31547: drm/xe: Fix missing runtime PM reference in ccs_mode_store (bsc#1263018).\n- CVE-2026-31550: pmdomain: bcm: bcm2835-power: Increase ASB control timeout (bsc#1263104).\n- CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263107).\n- CVE-2026-31565: RDMA/irdma: Fix deadlock during netdev reset with active connections (bsc#1263064).\n- CVE-2026-31579: wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit (bsc#1263074).\n- CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263176).\n- CVE-2026-31588: KVM: x86: Use scratch field in MMIO fragment to hold small write values (bsc#1263165).\n- CVE-2026-31644: net: lan966x: fix use-after-free and leak in lan966x_fdma_reload() (bsc#1263048).\n- CVE-2026-31649: net: stmmac: fix integer underflow in chain mode (bsc#1263582).\n- CVE-2026-31658: net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() (bsc#1263052).\n- CVE-2026-31662: tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (bsc#1263131).\n- CVE-2026-31666: btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref() (bsc#1263138).\n- CVE-2026-31668: seg6: separate dst_cache for input and output paths in seg6 lwtunnel (bsc#1263140).\n- CVE-2026-31669: mptcp: fix slab-use-after-free in __inet_lookup_established (bsc#1263141).\n- CVE-2026-31675: net/sched: sch_netem: fix out-of-bounds access in packet corruption (bsc#1263556).\n- CVE-2026-31678: openvswitch: defer tunnel netdev_put to RCU release (bsc#1263562).\n- CVE-2026-31679: openvswitch: validate MPLS set/set_masked payload length (bsc#1263592).\n- CVE-2026-31681: netfilter: xt_multiport: validate range encoding in checkentry (bsc#1263593).\n- CVE-2026-31682: bridge: br_nd_send: linearize skb before parsing ND options (bsc#1263595).\n- CVE-2026-31684: net: sched: act_csum: validate nested VLAN headers (bsc#1263596).\n- CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263668).\n- CVE-2026-31691: igb: remove napi_synchronize() in igb_down() (bsc#1263604).\n- CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263901).\n- CVE-2026-31700: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (bsc#1263882).\n- CVE-2026-31738: vxlan: validate ND option lengths in vxlan_na_create (bsc#1264059).\n- CVE-2026-31787: xen/privcmd: fix double free via VMA splitting (bsc#1262181).\n- CVE-2026-43009: bpf: Fix incorrect pruning due to atomic fetch precision tracking (bsc#1264014).\n- CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1263931).\n- CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1263933).\n- CVE-2026-43037: ip6_tunnel: clear skb2-\u003ecb in ip4ip6_err() (bsc#1263995).\n- CVE-2026-43038: ipv6: icmp: clear skb2-\u003ecb in ip6_err_gen_icmpv6_unreach() (bsc#1264097).\n- CVE-2026-43045: mshv: Refactor and rename memory region handling functions (bsc#1263942).\n- CVE-2026-43050: atm: lec: fix use-after-free in sock_def_readable() (bsc#1264082).\n- CVE-2026-43060: netfilter: nft_ct: drop pending enqueued packets on removal (bsc#1264183).\n- CVE-2026-43082: net: txgbe: leave space for null terminators on property_entry (bsc#1264233).\n- CVE-2026-43088: net: af_key: zero aligned sockaddr tail in PF_KEY exports (bsc#1264469).\n- CVE-2026-43153: xfs: remove xfs_attr_leaf_hasname (bsc#1264586).\n- CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264848).\n- CVE-2026-43265: KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block() (bsc#1264427).\n- CVE-2026-43329: netfilter: flowtable: strictly check for maximum number of actions (bsc#1265085).\n- CVE-2026-43365: xfs: fix undersized l_iclog_roundoff values (bsc#1265119).\n- CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265116).\n- CVE-2026-43441: net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1264674).\n- CVE-2026-43494: net/rds: reset op_nents when zerocopy page pin fails (bsc#1265626).\n- CVE-2026-43503: net: skbuff: propagate shared-frag marker through frag-transfer helpers (bsc#1265960).\n\nThe following non security issues were fixed:\n\n- accel/qaic: Add overflow check to remap_pfn_range during mmap (git-fixes).\n- ACPI: AGDI: fix missing newline in error message (git-fixes).\n- ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug (git-fixes).\n- ACPI: scan: Use acpi_dev_put() in object add error paths (git-fixes).\n- ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO (git-fixes).\n- ACPI: video: force native backlight on HP OMEN 16 (8A44) (stable-fixes).\n- ACPI: video: Move Lenovo Legion S7 15ACH6 quirk to the right section (git-fixes).\n- ALSA: 6fire: Fix input volume change detection (git-fixes).\n- ALSA: 6fire: fix use-after-free on disconnect (git-fixes).\n- ALSA: aoa: i2sbus: clear stale prepared state (git-fixes).\n- ALSA: aoa: i2sbus: fix OF node lifetime handling (git-fixes).\n- ALSA: aoa: Skip devices with no codecs in i2sbus_resume() (git-fixes).\n- ALSA: aoa: Use guard() for mutex locks (stable-fixes).\n- ALSA: asihpi: avoid write overflow check warning (stable-fixes).\n- ALSA: caiaq: Don't abort when no input device is available (git-fixes).\n- ALSA: caiaq: Fix control_put() result and cache rollback (git-fixes).\n- ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path (git-fixes).\n- ALSA: caiaq: fix usb_dev refcount leak on probe failure (git-fixes).\n- ALSA: caiaq: Handle probe errors properly (git-fixes).\n- ALSA: caiaq: take a reference on the USB device in create_card() (git-fixes).\n- ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() (git-fixes).\n- ALSA: core: Fix potential data race at fasync handling (git-fixes).\n- ALSA: core: Serialize deferred fasync state checks (git-fixes).\n- ALSA: core: Validate compress device numbers without dynamic minors (git-fixes).\n- ALSA: ctxfi: Add fallback to default RSR for S/PDIF (git-fixes).\n- ALSA: ctxfi: Fix missing SPDIFI1 index handling (stable-fixes).\n- ALSA: ctxfi: Limit PTP to a single page (git-fixes).\n- ALSA: firewire-tascam: Do not drop unread control events (git-fixes).\n- ALSA: fireworks: bound device-supplied status before string array lookup (git-fixes).\n- ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 (stable-fixes).\n- ALSA: hda/realtek - fixed speaker no sound update (git-fixes).\n- ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk (stable-fixes).\n- ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx (stable-fixes).\n- ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC (stable-fixes).\n- ALSA: hda/realtek: add quirk for Framework F111:000F (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 (stable-fixes).\n- ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') (git-fixes).\n- ALSA: hda: cs35l41: Put ACPI device on missing physical node (git-fixes).\n- ALSA: hda: cs35l56: Propagate ASP TX source control errors (git-fixes).\n- ALSA: hda: cs35l56: Put ACPI device after setting companion (git-fixes).\n- ALSA: hda: Fix NULL pointer dereference in snd_hda_ctl_add() (git-fixes).\n- ALSA: misc: Use guard() for spin locks (stable-fixes).\n- ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger (stable-fixes).\n- ALSA: pcmtest: fix reference leak on failed device registration (git-fixes).\n- ALSA: pcmtest: Fix resource leaks in module init error paths (git-fixes).\n- ALSA: pcmtest: Return -EFAULT on pattern read copy failure (git-fixes).\n- ALSA: sc6000: Keep the programmed board state in card-private data (git-fixes).\n- ALSA: scarlett2: Add missing error check when initialise Autogain Status (git-fixes).\n- ALSA: scarlett2: Add missing sentinel initializer field (git-fixes).\n- ALSA: seq: Notify client and port info changes (stable-fixes).\n- ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes (stable-fixes).\n- ALSA: usb-audio: apply quirk for MOONDROP JU Jiu (stable-fixes).\n- ALSA: usb-audio: Avoid false E-MU sample-rate notifications (git-fixes).\n- ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() (git-fixes).\n- ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans (git-fixes).\n- ALSA: usb-audio: Bound MIDI endpoint descriptor scans (git-fixes).\n- ALSA: usb-audio: Evaluate packsize caps at the right place (git-fixes).\n- ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch (git-fixes).\n- ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams (git-fixes).\n- ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex (stable-fixes).\n- ALSA: usb-audio: Fix UAC3 cluster descriptor size check (git-fixes).\n- ALSA: usb-audio: midi2: Restart output URBs on resume (git-fixes).\n- ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES (git-fixes).\n- ALSA: virtio: drop an extaneous kernel-doc comment (git-fixes).\n- amdgpu/jpeg: fix deepsleep register for jpeg 5_0_0 and 5_0_2 (stable-fixes).\n- ASoC: amd: acp: Add DMI quirk for Valve Steam Deck OLED (git-fixes).\n- ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF (stable-fixes).\n- ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table (stable-fixes).\n- ASoC: codecs: ab8500: Fix casting of private data (git-fixes).\n- ASoC: cs35l56: Destroy workqueue in probe error path (git-fixes).\n- ASoC: cs35l56: Don't use devres to unregister component (git-fixes).\n- ASoC: cs35l56: Fix hibernate write in runtime resume error path (git-fixes).\n- ASoC: fsl_easrc: Change the type for iec958 channel status controls (git-fixes).\n- ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() (git-fixes).\n- ASoC: fsl_easrc: fix comment typo (git-fixes).\n- ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() (git-fixes).\n- ASoC: fsl_micfil: Add access property for \"VAD Detected\" (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in micfil_quality_set() (git-fixes).\n- ASoC: fsl_xcvr: Fix event generation for cached controls (git-fixes).\n- ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() (git-fixes).\n- ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() (git-fixes).\n- ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error (git-fixes).\n- ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop (git-fixes).\n- ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens (git-fixes).\n- ASoC: qcom: q6apm: move component registration to unmanaged version (git-fixes).\n- ASoC: qcom: q6apm: remove child devices when apm is removed (git-fixes).\n- ASoC: qcom: qdsp6: topology: check widget type before accessing data (git-fixes).\n- ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list (stable-fixes).\n- ASoC: SOF: compress: return the configured codec from get_params (git-fixes).\n- ASoC: SOF: Don't allow pointer operations on unconfigured streams (git-fixes).\n- ASoC: SOF: Intel: hda: Place check before dereference (git-fixes).\n- ASoC: SOF: topology: reject invalid vendor array size in token parser (stable-fixes).\n- ASoC: sti: Return errors from regmap_field_alloc() (git-fixes).\n- ASoC: sti: use managed regmap_field allocations (git-fixes).\n- ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J (stable-fixes).\n- ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 (stable-fixes).\n- backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() (git-fixes).\n- batman-adv: bla: only purge non-released claims (git-fixes).\n- batman-adv: bla: prevent use-after-free when deleting claims (git-fixes).\n- batman-adv: bla: put backbone reference on failed claim hash insert (git-fixes).\n- batman-adv: fix integer overflow on buff_pos (git-fixes).\n- batman-adv: hold claim backbone gateways by reference (git-fixes).\n- batman-adv: reject new tp_meter sessions during teardown (git-fixes).\n- batman-adv: reject oversized global TT response buffers (git-fixes).\n- batman-adv: stop caching unowned originator pointers in BAT IV (git-fixes).\n- bitfield: Add FIELD_MODIFY() helper (jsc#PED-14238).\n- Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling (git-fixes).\n- Bluetooth: btmtk: validate WMT event SKB length before struct access (git-fixes).\n- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (bsc#1260996).\n- Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (git-fixes).\n- Bluetooth: hci_event: fix memset typo (git-fixes).\n- Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt (git-fixes).\n- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (git-fixes).\n- Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (git-fixes).\n- Bluetooth: HIDP: serialise l2cap_unregister_user via hidp_session_sem (git-fixes).\n- Bluetooth: ISO: Fix data-race on dst in iso_sock_connect() (git-fixes).\n- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (git-fixes).\n- Bluetooth: l2cap: fix MPS check in l2cap_ecred_reconf_req (git-fixes).\n- Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (git-fixes).\n- Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() (git-fixes).\n- Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU (git-fixes).\n- Bluetooth: RFCOMM: pull credit byte with skb_pull_data() (git-fixes).\n- Bluetooth: SCO: check for codecs-\u003enum_codecs == 1 before assigning to sco_pi(sk)-\u003ecodec (git-fixes).\n- Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready (git-fixes).\n- Bluetooth: SCO: hold sk properly in sco_conn_ready (git-fixes).\n- Bluetooth: virtio_bt: clamp rx length before skb_put (git-fixes).\n- Bluetooth: virtio_bt: validate rx pkt_type header length (git-fixes).\n- bpf: Add third round of bounds deduction (git-fixes).\n- bpf: Fix u32/s32 bounds when ranges cross min/max boundary (git-fixes).\n- bpf: Improve bounds when s64 crosses sign boundary (git-fixes).\n- bpf: Switch CONFIG_CFI_CLANG to CONFIG_CFI (git-fixes).\n- btrfs: qgroup: update all parent qgroups when doing quick inherit (bsc#1258933).\n- btrfs: reject root items with drop_progress and zero drop_level (git-fixes).\n- btrfs: replace BUG() with error handling in __btrfs_balance() (git-fixes).\n- bus: mhi: host: pci_generic: Switch to async power up to avoid boot delays (git-fixes).\n- bus: rifsc: fix RIF configuration check for peripherals (git-fixes).\n- can: mcp251x: add error handling for power enable in open and resume (stable-fixes).\n- can: raw: fix ro-\u003euniq use-after-free in raw_rcv() (git-fixes).\n- can: ucan: fix devres lifetime (git-fixes).\n- cdc-acm: new quirk for EPSON HMD (stable-fixes).\n- check-for-config-changes: Exclude CC_MS_EXTENSIONS.\n- check-for-config-changes: Exclude HAVE_CFI_ICALL_NORMALIZE_INTEGERS{,_RUSTC}.\n- comedi: dt2815: add hardware detection to prevent crash (stable-fixes).\n- cpufreq: intel_pstate: Drop Arrow Lake from \"scaling factor\" list (bsc#1249104).\n- crypto: af_alg - limit RX SG extraction by receive buffer budget (git-fixes).\n- crypto: algif_aead - Fix minimum RX size check for decryption (git-fixes).\n- crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup (git-fixes).\n- crypto: atmel-ecc - Release client on allocation failure (git-fixes).\n- crypto: atmel-sha204a - Fix error codes in OTP reads (git-fixes).\n- crypto: atmel-sha204a - Fix OTP sysfs read and error handling (git-fixes).\n- crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path (git-fixes).\n- crypto: atmel-sha204a - Fix uninitialized data access on OTP read error (git-fixes).\n- crypto: atmel-tdes - fix DMA sync direction (git-fixes).\n- crypto: ccp - copy IV using skcipher ivsize (git-fixes).\n- crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (git-fixes).\n- crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (git-fixes).\n- crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (git-fixes).\n- crypto: ccree - fix a memory leak in cc_mac_digest() (git-fixes).\n- crypto: drivers - Switch back to struct platform_driver::remove() (jsc#PED-14238).\n- crypto: drivers - Use str_enable_disable-like helpers (jsc#PED-14238).\n- crypto: hisilicon - Fix dma_unmap_single() direction (git-fixes).\n- crypto: iaa - Adjust workqueue allocation type (jsc#PED-14238).\n- crypto: iaa - fix per-node CPU counter reset in rebalance_wq_table() (git-fixes).\n- crypto: iaa - Move compression CRC into request object (jsc#PED-14238).\n- crypto: iaa - Optimize rebalance_wq_table() (jsc#PED-14238).\n- crypto: iaa - Remove potential infinite loop in check_completion() (jsc#PED-14238).\n- crypto: iaa - Remove unreachable pr_debug from iaa_crypto_cleanup_module (jsc#PED-14238).\n- crypto: iaa - Remove unused disable_async argument from iaa_decompress (jsc#PED-14238).\n- crypto: iaa - Replace sprintf with sysfs_emit in sysfs show functions (jsc#PED-14238).\n- crypto: iaa - Simplify init_iaa_device() (jsc#PED-14238).\n- crypto: jitterentropy - replace long-held spinlock with mutex (git-fixes).\n- crypto: nx - Fix packed layout in struct nx842_crypto_header (git-fixes).\n- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (git-fixes).\n- crypto: qat - #undef field_get() before local definition (jsc#PED-14238).\n- crypto: qat - add adf_rl_get_num_svc_aes() in rate limiting (jsc#PED-14238).\n- crypto: qat - add bank state save and restore for qat_420xx (jsc#PED-14238).\n- crypto: qat - add command queue telemetry counters for GEN6 (jsc#PED-14238).\n- crypto: qat - add compression slice count for rate limiting (jsc#PED-14238).\n- crypto: qat - add decompression service for rate limiting (jsc#PED-14238).\n- crypto: qat - add decompression service to telemetry (jsc#PED-14238).\n- crypto: qat - add firmware headers for GEN6 devices (jsc#PED-14238).\n- crypto: qat - add GEN6 firmware loader (jsc#PED-14238).\n- crypto: qat - add get_svc_slice_cnt() in device data structure (jsc#PED-14238).\n- crypto: qat - add live migration enablers for GEN6 devices (jsc#PED-14238).\n- crypto: qat - add macro to write 64-bit values to registers (jsc#PED-14238).\n- crypto: qat - add missing header inclusion (jsc#PED-14238).\n- crypto: qat - add qat_6xxx driver (jsc#PED-14238).\n- crypto: qat - add ring buffer idle telemetry counter for GEN6 (jsc#PED-14238).\n- crypto: qat - add support for decompression service to GEN6 devices (jsc#PED-14238).\n- crypto: qat - consolidate service enums (jsc#PED-14238).\n- crypto: qat - Constify struct pm_status_row (jsc#PED-14238).\n- crypto: qat - disable 4xxx AE cluster when lead engine is fused off (git-fixes).\n- crypto: qat - disable 420xx AE cluster when lead engine is fused off (git-fixes).\n- crypto: qat - do not export adf_cfg_services (jsc#PED-14238).\n- crypto: qat - enable power management debugfs for GEN6 devices (jsc#PED-14238).\n- crypto: qat - enable RAS support for GEN6 devices (jsc#PED-14238).\n- crypto: qat - enable rate limiting feature for GEN6 devices (jsc#PED-14238).\n- crypto: qat - enable reporting of error counters for GEN6 devices (jsc#PED-14238).\n- crypto: qat - enable telemetry for GEN6 devices (jsc#PED-14238).\n- crypto: qat - export adf_get_service_mask() (jsc#PED-14238).\n- crypto: qat - export adf_init_admin_pm() (jsc#PED-14238).\n- crypto: qat - expose configuration functions (jsc#PED-14238).\n- crypto: qat - fix compression instance leak (git-fixes).\n- crypto: qat - fix IRQ cleanup on 6xxx probe failure (git-fixes).\n- crypto: qat - fix object goals in Makefiles (jsc#PED-14238.\n- crypto: qat - fix type mismatch in RAS sysfs show functions (git-fixes).\n- crypto: qat - Fix typo \"accelaration\" (jsc#PED-14238).\n- crypto: qat - fix virtual channel configuration for GEN6 devices (jsc#PED-14238).\n- crypto: qat - include qat_common in top Makefile (jsc#PED-14238).\n- crypto: qat - introduce fuse array (jsc#PED-14238).\n- crypto: qat - make adf_dev_autoreset() static (jsc#PED-14238).\n- crypto: qat - optimize allocations for fw authentication (jsc#PED-14238).\n- crypto: qat - refactor compression template logic (jsc#PED-14238).\n- crypto: qat - refactor FW signing algorithm (jsc#PED-14238).\n- crypto: qat - refactor ring-related debug functions (jsc#PED-14238).\n- crypto: qat - refactor service parsing logic (jsc#PED-14238).\n- crypto: qat - relocate and rename bank state structure definition (jsc#PED-14238).\n- crypto: qat - relocate bank state helper functions (jsc#PED-14238).\n- crypto: qat - relocate power management debugfs helper APIs (jsc#PED-14238).\n- crypto: qat - relocate service related functions (jsc#PED-14238).\n- crypto: qat - remove BITS_IN_DWORD() (jsc#PED-14238).\n- crypto: qat - Remove dst_null support (jsc#PED-14238).\n- crypto: qat - remove duplicate masking for GEN6 devices (jsc#PED-14238).\n- crypto: qat - remove initialization in device class (jsc#PED-14238).\n- crypto: qat - remove redundant FW image size check (jsc#PED-14238).\n- crypto: qat - remove unused adf_devmgr_get_first (jsc#PED-14238).\n- crypto: qat - remove unused members in suof structure (jsc#PED-14238).\n- crypto: qat - rename and relocate timer logic (jsc#PED-14238).\n- crypto: qat - reorder objects in qat_common Makefile (jsc#PED-14238).\n- crypto: qat - replace CHECK_STAT macro with static inline function (jsc#PED-14238).\n- crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() (jsc#PED-14238).\n- crypto: qat - restore ASYM service support for GEN6 devices (jsc#PED-14238).\n- crypto: qat - Return pointer directly in adf_ctl_alloc_resources (jsc#PED-14238).\n- crypto: qat - set command ids as reserved (jsc#PED-14238).\n- crypto: qat - switch to standard pattern for PCI IDs (jsc#PED-14238).\n- crypto: qat - update firmware api (jsc#PED-14238).\n- crypto: qat - use pr_fmt() in adf_gen4_hw_data.c (jsc#PED-14238).\n- crypto: qat - use pr_fmt() in qat uclo.c (jsc#PED-14238).\n- crypto: qat - use simple_strtoull to improve qat_uclo_parse_num (jsc#PED-14238).\n- crypto: qat - use swab32 macro (git-fixes).\n- crypto: qat - validate service in rate limiting sysfs api (jsc#PED-14238).\n- crypto: qat/qat_6xxx - Fix NULL vs IS_ERR() check in adf_probe() (jsc#PED-14238).\n- crypto: sa2ul - Fix AEAD fallback algorithm names (git-fixes).\n- crypto: simd - reject compat registrations without __ prefixes (git-fixes).\n- crypto: talitos - fix SEC1 32k ahash request limitation (git-fixes).\n- crypto: tegra - Disable softirqs before finalizing request (git-fixes).\n- devres: fix missing node debug info in devm_krealloc() (git-fixes).\n- dmaengine: dw-axi-dmac: fix Alignment should match open parenthesis (git-fixes).\n- dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function (git-fixes).\n- dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() (git-fixes).\n- dpll: zl3073x: Add support to adjust phase (bsc#1255752).\n- dpll: zl3073x: Fix output pin phase adjustment sign (bsc#1255752).\n- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (bsc#1255752).\n- dpll: zl3073x: Specify phase adjustment granularity for pins (bsc#1255752).\n- drivers/base/memory: fix memory block reference leak in poison accounting (git-fixes).\n- drm/amd/display: Add NULL check for integrated_info in clk_mgr_construct (git-fixes).\n- drm/amd/display: Allow DCE link encoder without AUX registers (git-fixes).\n- drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths (git-fixes).\n- drm/amd/display: Change dither policy for 10 bpc output back to dithering (git-fixes).\n- drm/amd/display: Correct logic check error for fastboot (git-fixes).\n- drm/amd/display: Disable 10-bit truncation and dithering on DCE 6.x (git-fixes).\n- drm/amd/display: Disable fastboot on DCE 6 too (stable-fixes).\n- drm/amd/display: Read EDID from VBIOS embedded panel info (git-fixes).\n- drm/amd/pm/ci: Clear EnabledForActivity field for memory levels (git-fixes).\n- drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs (git-fixes).\n- drm/amd/pm/ci: Fill DW8 fields from SMC (git-fixes).\n- drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 (git-fixes).\n- drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled (git-fixes).\n- drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board (git-fixes).\n- drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock (git-fixes).\n- drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x (git-fixes).\n- drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) (git-fixes).\n- drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ (stable-fixes).\n- drm/amdgpu/gfx10: look at the right prop for gfx queue priority (git-fixes).\n- drm/amdgpu/gfx11: look at the right prop for gfx queue priority (git-fixes).\n- drm/amdgpu/gmc: Fix AMDGPU_GART_PLACEMENT_LOW to not overlap with VRAM (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.5 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.0 ring (git-fixes).\n- drm/amdgpu/pm: add missing revision check for CI (git-fixes).\n- drm/amdgpu/pm: align Hawaii mclk workaround with radeon (git-fixes).\n- drm/amdgpu/pm: drop SMU driver if version not matched messages (stable-fixes).\n- drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission (git-fixes).\n- drm/amdgpu/vce: Prevent partial address patches (stable-fixes).\n- drm/amdgpu/vcn3: Avoid overflow on msg bound check (git-fixes).\n- drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (stable-fixes).\n- drm/amdgpu/vcn4: Avoid overflow on msg bound check (git-fixes).\n- drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (stable-fixes).\n- drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (stable-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v4.0.5 enc ring (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v5.0.0 enc ring (git-fixes).\n- drm/amdgpu: Add bounds checking to ib_{get,set}_value (stable-fixes).\n- drm/amdgpu: Add default case in DVI mode validation (git-fixes).\n- drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG (git-fixes).\n- drm/amdgpu: fix zero-size GDS range init on RDNA4 (stable-fixes).\n- drm/amdgpu: gate VM CPU HDP flush on reset lock (stable-fixes).\n- drm/amdgpu: replace PASID IDR with XArray (git-fixes).\n- drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count (stable-fixes).\n- drm/amdgpu: zero-initialize GART table on allocation (stable-fixes).\n- drm/amdkfd: Add upper bound check for num_of_nodes (stable-fixes).\n- drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure (stable-fixes).\n- drm/amdkfd: Make all TLB-flushes heavy-weight (stable-fixes).\n- drm/amdkfd: validate SVM ioctl nattr against buffer size (stable-fixes).\n- drm/arcpgu: fix device node leak (git-fixes).\n- drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs (git-fixes).\n- drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check (git-fixes).\n- drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() (git-fixes).\n- drm/bridge: stm_lvds: Do not fail atomic_check on disabled connector (git-fixes).\n- drm/etnaviv: Fix armed job not being pushed to the DRM scheduler (git-fixes).\n- drm/exynos: remove bridge when component_add fails (git-fixes).\n- drm/fb-helper: Fix clipping when damage area spans a single scanline (git-fixes).\n- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (git-fixes).\n- drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup (git-fixes).\n- drm/gma500/oaktrail_lvds: fix hang on init failure (git-fixes).\n- drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init (git-fixes).\n- drm/i915/dp: Fix VSC dynamic range signaling for RGB formats (git-fixes).\n- drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (git-fixes).\n- drm/i915/wm: Verify the correct plane DDB entry (git-fixes).\n- drm/i915: skip __i915_request_skip() for already signaled requests (git-fixes).\n- drm/imagination: Switch reset_reason fields from enum to u32 (git-fixes).\n- drm/komeda: fix integer overflow in AFBC framebuffer size check (git-fixes).\n- drm/loongson: Use managed KMS polling (git-fixes).\n- drm/msm/a6xx: Fix dumping A650+ debugbus blocks (git-fixes).\n- drm/msm/a6xx: Fix HLSQ register dumping (git-fixes).\n- drm/msm/a6xx: Use barriers while updating HFI Q headers (git-fixes).\n- drm/msm/dpu: fix mismatch between power and frequency (git-fixes).\n- drm/msm/dsi: add the missing parameter description (git-fixes).\n- drm/msm/dsi: fix bits_per_pclk (git-fixes).\n- drm/msm/dsi: fix hdisplay calculation for CMD mode panel (git-fixes).\n- drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 (git-fixes).\n- drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata() (git-fixes).\n- drm/msm/shrinker: Fix can_block() logic (git-fixes).\n- drm/nouveau: fix nvkm_device leak on aperture removal failure (git-fixes).\n- drm/nouveau: fix u32 overflow in pushbuf reloc bounds check (git-fixes).\n- drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds (git-fixes).\n- drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds (git-fixes).\n- drm/panel: sharp-ls043t1le01: make use of prepare_prev_first (git-fixes).\n- drm/panel: simple: Correct G190EAN01 prepare timing (git-fixes).\n- drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() (git-fixes).\n- drm/panthor: Fix outdated function documentation (git-fixes).\n- drm/radeon: add missing revision check for CI (git-fixes).\n- drm/sun4i: backend: fix error pointer dereference (git-fixes).\n- drm/sun4i: Fix resource leaks (git-fixes).\n- drm/v3d: Handle error from drm_sched_entity_init() (git-fixes).\n- drm/vc4: Fix a memory leak in hang state error path (git-fixes).\n- drm/vc4: Fix memory leak of BO array in hang state (git-fixes).\n- drm/vc4: platform_get_irq_byname() returns an int (stable-fixes).\n- drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock (git-fixes).\n- drm/vc4: Release runtime PM reference after binding V3D (git-fixes).\n- drm/vram: remove DRM_VRAM_MM_FILE_OPERATIONS from docs (git-fixes).\n- drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked() (git-fixes).\n- drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked() (git-fixes).\n- drm/xe/debugfs: Correct printing of register whitelist ranges (git-fixes).\n- drm/xe/dma-buf: handle empty bo and UAF races (git-fixes).\n- drm/xe/gsc: Fix BO leak on error in query_compatibility_version() (git-fixes).\n- drm/xe/uapi: update used tracking kernel-doc (git-fixes).\n- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (git-fixes).\n- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (git-fixes).\n- dt-bindings: net: Fix Tegra234 MGBE PTP clock (git-fixes).\n- efi/capsule-loader: fix incorrect sizeof in phys array reallocation (git-fixes).\n- efi: pstore: Drop efivar lock when efi_pstore_open() returns with an error (git-fixes).\n- erofs: add GFP_NOIO in the bio completion if needed (git-fixes).\n- ext4: fix fsync(2) for nojournal mode (git-fixes).\n- ext4: make recently_deleted() properly work with lazy itable initialization (git-fixes).\n- ext4: reject mount if bigalloc with s_first_data_block != 0 (git-fixes).\n- extcon: Fixed sysfs duplicate filename issue (git-fixes).\n- extcon: ptn5150: handle pending IRQ events during system resume (git-fixes).\n- fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break (git-fixes).\n- fbdev: offb: fix PCI device reference leak on probe failure (git-fixes).\n- fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO (stable-fixes).\n- fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO (git-fixes).\n- firmware: arm_ffa: Use the correct buffer size during RXTX_MAP (git-fixes).\n- firmware: dmi: Correct an indexing error in dmi.h (git-fixes).\n- firmware: google: framebuffer: Do not mark framebuffer as busy (git-fixes).\n- firmware: google: framebuffer: Do not unregister platform device (git-fixes).\n- gpio: of: clear OF_POPULATED on hog nodes in remove path (git-fixes).\n- gpio: tegra: fix irq_release_resources calling enable instead of disable (git-fixes).\n- gtp: disable BH before calling udp_tunnel_xmit_skb() (git-fixes).\n- HID: alps: fix NULL pointer dereference in alps_raw_event() (git-fixes).\n- HID: amd_sfh: don't log error when device discovery fails with -EOPNOTSUPP (git-fixes).\n- HID: apple: ensure the keyboard backlight is off if suspending (git-fixes).\n- HID: asus: do not abort probe when not necessary (git-fixes).\n- HID: asus: make asus_resume adhere to linux kernel coding standards (git-fixes).\n- HID: core: clamp report_size in s32ton() to avoid undefined shift (stable-fixes).\n- HID: logitech-hidpp: Enable MX Master 4 over bluetooth (stable-fixes).\n- HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure (stable-fixes).\n- HID: multitouch: Check to ensure report responses match the request (stable-fixes).\n- HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 (stable-fixes).\n- HID: roccat: fix use-after-free in roccat_report_event (stable-fixes).\n- HID: usbhid: fix deadlock in hid_post_reset() (git-fixes).\n- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (stable-fixes).\n- hisi_acc_vfio_pci: add eq and aeq interruption restore (git-fixes).\n- hisi_acc_vfio_pci: bugfix cache write-back issue (git-fixes).\n- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (git-fixes).\n- hv_sock: fix ARM64 support (git-fixes).\n- hv_sock: update outdated comment for renamed vsock_stream_recvmsg() (git-fixes).\n- hwmon: (ads7871) Fix endianness bug in 16-bit register reads (git-fixes).\n- hwmon: (corsair-psu) Close HID device on probe errors (git-fixes).\n- hwmon: (lm63) Add locking to avoid TOCTOU (git-fixes).\n- hwmon: (ltc2992) Clamp threshold writes to hardware range (git-fixes).\n- hwmon: (ltc2992) Fix u32 overflow in power read path (git-fixes).\n- hwmon: (ltc4286) Add missing MODULE_IMPORT_NS(\"PMBUS\") (git-fixes).\n- hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt (git-fixes).\n- hwmon: (powerz) Fix use-after-free on USB disconnect (git-fixes).\n- hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data() (git-fixes).\n- i2c: s3c24xx: check the size of the SMBUS message before using it (stable-fixes).\n- i2c: smbus: reject oversized block transfers in the common path (git-fixes).\n- i2c: stm32f7: reinit_completion() per transfer not per msg (git-fixes).\n- i2c: stub: Reject I2C block transfers with invalid length (git-fixes).\n- i2c: tegra: Add HS mode support (bsc#1261550).\n- i2c: tegra: Add Tegra256 support (bsc#1261550).\n- i2c: tegra: Do not configure DMA if not supported (bsc#1261550).\n- i2c: tegra: Don't mark devices with pins as IRQ safe (stable-fixes).\n- i2c: tegra: Update Tegra256 timing parameters (bsc#1261550).\n- i2c: tegra: Use separate variables for fast and fastplus (bsc#1261550).\n- i3c: dw: Fix memory leak in dw_i3c_master_i3c_xfers() (git-fixes).\n- i3c: master: Fix error codes at send_ccc_cmd (git-fixes).\n- i3c: mipi-i3c-hci: fix IBI payload length calculation for final status (git-fixes).\n- ibmveth: Disable GSO for packets with small MSS (bsc#1265144).\n- iio: adc: ad7192: Revert \"properly check spi_get_device_match_data()\" (stable-fixes).\n- iio: adc: ad7768-1: fix one-shot mode data acquisition (git-fixes).\n- iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() (git-fixes).\n- iio: frequency: admv1013: add dev variable (stable-fixes).\n- iio: frequency: admv1013: fix NULL pointer dereference on str (git-fixes).\n- Input: bcm5974 - recover from failed mode switch (stable-fixes).\n- Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table (stable-fixes).\n- Input: uinput - fix circular locking dependency with ff-core (git-fixes).\n- Input: uinput - take event lock when submitting FF request \"event\" (stable-fixes).\n- Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode (stable-fixes).\n- Input: xpad - add support for Razer Wolverine V3 Pro (stable-fixes).\n- interconnect: debugfs: fix devm_kstrdup and kfree mismatch (git-fixes).\n- io_uring/timeout: check unused sqe fields (git-fixes).\n- iommu/amd: move wait_on_sem() out of spinlock (git-fixes bsc#1260593).\n- iommu/amd: serialize sequence allocation under concurrent TLB invalidations (git-fixes bsc#1260593).\n- iommu/vt-d: Remove LPIG from page group response descriptor (jsc#PED-16113).\n- ipmi: Add limits to event and receive message requests (git-fixes).\n- ipmi: Check event message buffer response for bad data (git-fixes).\n- ipmi: ssif_bmc: change log level to dbg in irq callback (git-fixes).\n- ipmi: ssif_bmc: fix message desynchronization after truncated response (git-fixes).\n- ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure (git-fixes).\n- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (git-fixes).\n- KVM: arm64: Allow cacheable stage 2 mapping using VMA flags (git-fixes).\n- KVM: arm64: Assume non-PFNMAP/MIXEDMAP VMAs can be mapped cacheable (git-fixes).\n- KVM: arm64: Block cacheable PFNMAP mapping (git-fixes).\n- KVM: arm64: Consolidate idreg callbacks (git-fixes).\n- KVM: arm64: Discard PC update state on vcpu reset (git-fixes).\n- KVM: arm64: Finalize ID registers only once per VM (git-fixes).\n- KVM: arm64: Fix MTE flag initialization for protected VMs (git-fixes).\n- KVM: arm64: Fix page leak in user_mem_abort() (git-fixes).\n- KVM: arm64: Fix Trace Buffer trap polarity for protected VMs (git-fixes).\n- KVM: arm64: Fix Trace Buffer trapping for protected VMs (git-fixes).\n- KVM: arm64: Fix vma_shift staleness on nested hwpoison path (git-fixes).\n- KVM: arm64: Hide S1POE from guests when not supported by the host (git-fixes).\n- KVM: arm64: Limit clearing of ID_{AA64PFR0,PFR1}_EL1.GIC to userspace irqchip (git-fixes).\n- KVM: arm64: Make all 32bit ID registers fully writable (git-fixes).\n- KVM: arm64: nv: Add trap config for DBGWCR\u003c15\u003e_EL1 (git-fixes).\n- KVM: arm64: nv: Return correct RES0 bits for FGT registers (git-fixes).\n- KVM: arm64: pkvm: Fallback to level-3 mapping on host stage-2 fault (git-fixes).\n- KVM: arm64: Read PMUVer as unsigned (git-fixes).\n- KVM: arm64: Rename the device variable to s2_force_noncacheable (git-fixes).\n- KVM: arm64: Return early from trace helpers when KVM isn't available (git-fixes).\n- KVM: arm64: Set ID_{AA64PFR0,PFR1}_EL1.GIC when GICv3 is configured (git-fixes).\n- KVM: arm64: vgic-v3: Release reserved slot outside of lpi_xa's lock (git-fixes).\n- KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes).\n- KVM: nSVM: Use vcpu-\u003earch.cr2 when updating vmcb12 on nested #VMEXIT (git-fixes).\n- KVM: nVMX: Add consistency check for TSC_MULTIPLIER=0 (git-fixes).\n- KVM: Reject wrapped offset in kvm_reset_dirty_gfn() (git-fixes).\n- KVM: SEV: Disallow LAUNCH_FINISH if vCPUs are actively being created (git-fixes).\n- KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (git-fixes).\n- KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish (git-fixes).\n- KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm-\u003elock (git-fixes).\n- KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU (git-fixes).\n- KVM: SVM: Disallow EFER.LMSLE when not supported by hardware (git-fixes).\n- KVM: SVM: Fix a missing kunmap_local() in sev_gmem_post_populate() (git-fixes).\n- KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC (git-fixes).\n- KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (git-fixes).\n- KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN (git-fixes).\n- KVM: SVM: Properly check RAX in the emulator for SVM instructions (git-fixes).\n- KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (git-fixes).\n- KVM: TDX: Explicitly set user-return MSRs that *may* be clobbered by the TDX-Module (git-fixes).\n- KVM: x86/mmu: Fix UBSAN warning when reading nx_huge_pages parameter (git-fixes).\n- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (git-fixes).\n- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (git-fixes).\n- KVM: x86: Advertise EferLmsleUnsupported to userspace (git-fixes).\n- KVM: x86: check for nEPT/nNPT in slow flush hypercalls (git-fixes).\n- KVM: X86: Fix array_index_nospec protection in __pv_send_ipi (git-fixes).\n- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (git-fixes).\n- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (git-fixes).\n- KVM: x86: Ignore cpuid faulting in SMM (git-fixes).\n- leds: lgm-sso: Remove duplicate assignments for priv-\u003emmap (git-fixes).\n- leds: qcom-lpg: Check for array overflow when selecting the high resolution (stable-fixes).\n- lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() (git-fixes).\n- md/raid1: fix the comparing region of interval tree (bsc#1261555).\n- md/raid1: serialize overlap io for writemostly disk (bsc#1261555).\n- media: amphion: Fix race between m2m job_abort and device_run (git-fixes).\n- media: as102: fix to not free memory after the device is registered in as102_usb_probe() (git-fixes).\n- media: chips-media: wave5: add missing spinlock protection for handle_dynamic_resolution_change() (git-fixes).\n- media: chips-media: wave5: add missing spinlock protection for send_eos_event() (git-fixes).\n- media: chips-media: wave5: fix a potential memory leak in wave5_vdi_init() (git-fixes).\n- media: dib8000: avoid division by 0 in dib8000_set_dds() (git-fixes).\n- media: em28xx: fix use-after-free in em28xx_v4l2_open() (git-fixes).\n- media: hackrf: fix to not free memory after the device is registered in hackrf_probe() (git-fixes).\n- media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() (git-fixes).\n- media: i2c: imx283: Enter full standby when stopping streaming (git-fixes).\n- media: i2c: imx283: Fix hang when going from large to small resolution (git-fixes).\n- media: i2c: imx412: Assert reset GPIO during probe (git-fixes).\n- media: i2c: ov08d10: fix image vertical start setting (git-fixes).\n- media: i2c: ov8856: free control handler on error in ov8856_init_controls() (git-fixes).\n- media: intel/ipu6: fix error pointer dereference (git-fixes).\n- media: mtk-jpeg: fix use-after-free in release path due to uncancelled work (git-fixes).\n- media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 (git-fixes).\n- media: omap3isp: drop the use count of v4l2 pipeline (git-fixes).\n- media: pci: zoran: fix potential memory leak in zoran_probe() (git-fixes).\n- media: rc: streamzap: Error handling in probe (git-fixes).\n- media: rc: xbox_remote: heed DMA restrictions (git-fixes).\n- media: saa7164: add ioremap return checks and cleanups (git-fixes).\n- media: staging: imx: configure src_mux in csi_start (git-fixes).\n- media: staging: imx: request mbus_config in csi_start (git-fixes).\n- media: uvcvideo: Enable VB2_DMABUF for metadata stream (git-fixes).\n- media: videobuf2: Set vma_flags in vb2_dma_sg_mmap (git-fixes).\n- media: vidtv: fix nfeeds state corruption on start_streaming failure (git-fixes).\n- media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections (git-fixes).\n- media: vidtv: fix pass-by-value structs causing MSAN warnings (git-fixes).\n- memory: tegra30-emc: Fix dll_change check (git-fixes).\n- memory: tegra124-emc: Fix dll_change check (git-fixes).\n- mfd: core: Preserve OF node when ACPI handle is present (git-fixes).\n- mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() (git-fixes).\n- mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused (git-fixes).\n- mkspec: Add signature to source list only when it exists.\n- mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration (git-fixes).\n- mmc: vub300: fix NULL-deref on disconnect (git-fixes).\n- modpost: Amend ppc64 save/restfpr symnames for -Os build (bsc#1215199).\n- mtd: docg3: fix use-after-free in docg3_release() (git-fixes).\n- mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions (git-fixes).\n- mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path (git-fixes).\n- mtd: physmap_of_gemini: Fix disabled pinctrl state check (git-fixes).\n- mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob (git-fixes).\n- mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations (git-fixes).\n- mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() (git-fixes).\n- mtd: spi-nor: sst: Fix write enable before AAI sequence (git-fixes).\n- mtd: spi-nor: swp: check SR_TB flag when getting tb_mask (git-fixes).\n- net-shapers: don't free reply skb after genlmsg_reply() (git-fixes).\n- net/mlx5: Fix HCA caps leak on notifier init failure (git-fixes).\n- net/rds: reset op_nents when zerocopy page pin fails (bsc#1265626).\n- net/sched: cls_fw: fix NULL dereference of \"old\" filters before change() (git-fixes).\n- net/sched: fix pedit partial COW leading to page cache corruption (bsc#1265421).\n- net: gro: don't merge zcopy skbs (git-fixes).\n- net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf (git-fixes).\n- net: mana: Add MAC address to vPort logs and clarify error messages (git-fixes).\n- net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq() (git-fixes).\n- net: mana: Don't overwrite port probe error with add_adev result (git-fixes).\n- net: mana: Fix crash from unvalidated SHM offset read from BAR0 during FLR (bsc#1265846).\n- net: mana: Fix EQ leak in mana_remove on NULL port (git-fixes).\n- net: mana: Fix RX skb truesize accounting (bsc#1248754).\n- net: mana: Guard mana_remove against double invocation (git-fixes).\n- net: mana: hardening: Validate adapter_mtu from MANA_QUERY_DEV_CONFIG (git-fixes).\n- net: mana: hardening: Validate doorbell ID from GDMA_REGISTER_DEVICE response (git-fixes).\n- net: mana: Init gf_stats_work before potential error paths in probe (git-fixes).\n- net: mana: Init link_change_work before potential error paths in probe (git-fixes).\n- net: mana: Move current_speed debugfs file to mana_init_port() (git-fixes).\n- net: mana: remove double CQ cleanup in mana_create_rxq error path (git-fixes).\n- net: mana: Set default number of queues to 16 (bsc#1261648).\n- net: mana: Skip WQ object destruction for uninitialized RXQ (git-fixes).\n- net: mana: Use at least SZ_4K in doorbell ID range check (git-fixes).\n- net: mana: Use pci_name() for debugfs directory naming (git-fixes).\n- net: phy: broadcom: Save PHY counters during suspend (git-fixes).\n- net: phy: DP83TC811: add reading of abilities (git-fixes).\n- net: phy: dp83869: fix setting CLK_O_SEL field (git-fixes).\n- net: phy: fix a return path in get_phy_c45_ids() (git-fixes).\n- net: phy: qcom: at803x: Use the correct bit to disable extended next page (git-fixes).\n- net: stmmac: Fix PTP ref clock for Tegra234 (git-fixes).\n- net: usb: asix: ax88772: re-add usbnet_link_change() in phylink callbacks (git-fixes).\n- net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() (git-fixes).\n- net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() (git-fixes).\n- net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit (git-fixes).\n- net: wan: fsl_ucc_hdlc: fix ucc_hdlc_remove (git-fixes).\n- net: wan: fsl_ucc_hdlc: fix uhdlc_memclean (git-fixes).\n- net: wan: fsl_ucc_hdlc: free tx_skbuff in uhdlc_memclean (git-fixes).\n- net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler (git-fixes).\n- NFC: digital: Bounds check NFC-A cascade depth in SDD response handler (git-fixes).\n- nfc: llcp: add missing return after LLCP_CLOSED checks (git-fixes).\n- nfc: pn533: allocate rx skb before consuming bytes (git-fixes).\n- nfc: s3fwrn5: allocate rx skb before consuming bytes (git-fixes).\n- NFC: trf7970a: Ignore antenna noise when checking for RF field (git-fixes).\n- nvme-apple: drop invalid put of admin queue reference count (git-fixes).\n- nvme-auth: Include SC_C in RVAL controller hash (bsc#1260428).\n- nvme-loop: do not cancel I/O and admin tagset during ctrl reset/shutdown (bsc#1262709).\n- nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 (git-fixes).\n- nvme: Allow reauth from sysfs (bsc#1259672).\n- nvme: Expose the tls_configured sysfs for secure concat connections (bsc#1259672).\n- nvme: expose TLS mode (bsc#1259672).\n- nvme: fix admin queue leak on controller reset (git-fixes).\n- nvme: fix PCIe subsystem reset controller state transition (bsc#1261738).\n- nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers (git-fixes).\n- ocfs2: fix possible deadlock between unlink and dio_end_io_write (bsc#1258718).\n- ocfs2: split transactions in dio completion to avoid credit exhaustion (bsc#1258718).\n- openvswitch: vport: fix self-deadlock on release of tunnel ports (git-fixes).\n- panic/printk: replace other_cpu_in_panic() with panic_on_other_cpu() (bsc#1261149).\n- panic/printk: replace this_cpu_in_panic() with panic_on_this_cpu() (bsc#1261149).\n- panic: introduce helper functions for panic state (bsc#1261149).\n- panic: use angle-bracket include for panic.h (bsc#1261149).\n- PCI/AER: Clear only error bits in PCIe Device Status (git-fixes).\n- PCI/AER: Stop ruling out unbound devices as error source (git-fixes).\n- PCI/ASPM: Fix pci_clear_and_set_config_dword() usage (git-fixes).\n- PCI/NPEM: Set LED_HW_PLUGGABLE for hotplug-capable ports (git-fixes).\n- PCI/TPH: Allow TPH enable for RCiEPs (git-fixes).\n- PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well (git-fixes).\n- PCI: dwc: rcar-gen4: Change EPC BAR alignment to 4K as per the documentation (git-fixes).\n- PCI: Enable AtomicOps only if Root Port supports them (git-fixes).\n- PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown (git-fixes).\n- PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup (git-fixes).\n- PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete (git-fixes).\n- PCI: hv: Set default NUMA node to 0 for devices without affinity info (bsc#1261648).\n- PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found (git-fixes).\n- PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion support (git-fixes).\n- PCI: tegra194: Allow system suspend when the Endpoint link is not up (git-fixes).\n- PCI: tegra194: Disable direct speed change for Endpoint mode (git-fixes).\n- PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down (git-fixes).\n- PCI: tegra194: Disable PERST# IRQ only in Endpoint mode (git-fixes).\n- PCI: tegra194: Fix CBB timeout caused by DBI access before core power-on (git-fixes).\n- PCI: tegra194: Fix polling delay for L2 state (git-fixes).\n- PCI: tegra194: Free up Endpoint resources during remove() (git-fixes).\n- PCI: tegra194: Increase LTSSM poll time on surprise link down (git-fixes).\n- PCI: tegra194: Set LTR message request before PCIe link up in Endpoint mode (git-fixes).\n- PCI: tegra194: Use devm_gpiod_get_optional() to parse \"nvidia,refclk-select\" (git-fixes).\n- PCI: tegra194: Use DWC IP core version (git-fixes).\n- pinctrl: abx500: Fix type of 'argument' variable (git-fixes).\n- pinctrl: Fix spelling problem (git-fixes).\n- pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) (stable-fixes).\n- pinctrl: pic32: change all cases of bare 'unsigned' to 'unsigned int' (git-fixes).\n- pinctrl: pic32: use consistent spacing around '+' (git-fixes).\n- pinctrl: pinctrl-pic32: Fix resource leak (git-fixes).\n- pinctrl: realtek: Fix function signature for config argument (git-fixes).\n- pinctrl: renesas: rzg2l: Fix save/restore of {IOLH,IEN,PUPD,SMT} registers (git-fixes).\n- platform/chrome: chromeos_tbmc: Drop wakeup source on remove (git-fixes).\n- platform/surface: surfacepro3_button: Drop wakeup source on remove (git-fixes).\n- platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug (stable-fixes).\n- platform/x86/intel-uncore-freq: Handle autonomous UFS status bit (git-fixes).\n- platform/x86: asus-wmi: adjust screenpad power/brightness handling (git-fixes).\n- platform/x86: asus-wmi: fix screenpad brightness range (git-fixes).\n- platform/x86: dell-wmi-sysman: bound enumeration string aggregation (git-fixes).\n- platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() (git-fixes).\n- platform/x86: hp-wmi: Ignore backlight and FnLock events (stable-fixes).\n- platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup (git-fixes).\n- power: supply: axp288_charger: Do not cancel work before initializing it (git-fixes).\n- power: supply: max17042: avoid overflow when determining health (git-fixes).\n- powerpc/crash: fix backup region offset update to elfcorehdr (bsc#1259535).\n- powerpc/crash: Update backup region offset in elfcorehdr on memory hotplug (bsc#1259535).\n- printk/nbcon/panic: Allow printk kthread to sleep when the system is in panic (bsc#1261149).\n- printk/nbcon: Block printk kthreads when any CPU is in an emergency context (bsc#1261149).\n- printk/nbcon: Release nbcon consoles ownership in atomic flush after each emitted record (bsc#1261149).\n- printk/nbcon: Restore IRQ in atomic flush after each emitted record (bsc#1261149).\n- printk/nbcon: use panic_on_this_cpu() helper (bsc#1261149).\n- printk: Allow printk_trigger_flush() to flush all types (bsc#1262750).\n- printk: Allow to use the printk kthread immediately even for 1st nbcon (jsc#PED-7912).\n- printk: Avoid irq_work for printk_deferred() on suspend (bsc#1262750).\n- printk: Avoid scheduling irq_work on suspend (bsc#1262750).\n- printk: console_flush_one_record() code cleanup (bsc#1261149).\n- printk: Introduce console_flush_one_record (bsc#1261149).\n- printk: Use console_flush_one_record for legacy printer kthread (bsc#1261149).\n- pwm: imx-tpm: Count the number of enabled channels in probe (git-fixes).\n- qat: don't mess with -\u003ed_name (jsc#PED-14238).\n- r8152: fix incorrect register write to USB_UPHY_XTAL (git-fixes).\n- RDMA/irdma: Fix double free related to rereg_user_mr (git-fixes).\n- RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() (git-fixes).\n- RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() (git-fixes).\n- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (git-fixes).\n- RDMA/mana: Validate rx_hash_key_len (git-fixes).\n- RDMA/mana_ib: cleanup the usage of mana_gd_send_request() (git-fixes).\n- RDMA/mana_ib: Disable RX steering on RSS QP destroy (git-fixes).\n- RDMA/mana_ib: Support memory windows (git-fixes).\n- regulator: act8945a: fix OF node reference imbalance (git-fixes).\n- regulator: bd9571mwv: fix OF node reference imbalance (git-fixes).\n- regulator: max77650: fix OF node reference imbalance (git-fixes).\n- regulator: mt6357: fix OF node reference imbalance (git-fixes).\n- regulator: rk808: fix OF node reference imbalance (git-fixes).\n- remoteproc: xlnx: Fix sram property parsing (git-fixes).\n- remoteproc: xlnx: Only access buffer information if IPI is buffered (git-fixes).\n- Revert \"ALSA: usb: Increase volume range that triggers a warning\" (git-fixes).\n- Revert \"serial: 8250: Revert \"drop lockdep annotation from serial8250_clear_IER()\"\" (bsc#1262480).\n- Revert \"serial: 8250: Switch to nbcon console\" (bsc#1262480).\n- rtc: abx80x: Disable alarm feature if no interrupt attached (git-fixes).\n- rtc: ntxec: fix OF node reference imbalance (git-fixes).\n- s390/dasd: Copy detected format information to secondary device (bsc#1259994).\n- s390/dasd: Fix gendisk parent after copy pair swap (bsc#1259994).\n- s390/dasd: Move quiesce state with pprc swap (bsc#1259994).\n- sched/fair: Change likelyhood of nohz.nr_cpus (bsc#1234634 bsc#1258961).\n- sched/fair: Move checking for nohz cpus after time check (bsc#1234634 bsc#1258961).\n- sched/fair: Remove nohz.nr_cpus and use weight of cpumask instead (bsc#1234634 bsc#1258961).\n- scsi: lpfc: Add clean up of aborted NVMe commands during PCI fcn reset (bsc#1262019).\n- scsi: lpfc: Add log messages to fabric login error labels (bsc#1262019).\n- scsi: lpfc: Add PCI ID support for LPe42100 series adapters (bsc#1262019).\n- scsi: lpfc: Add REG_VFI mailbox cmd error handling (bsc#1262019).\n- scsi: lpfc: Break out of IRQ affinity assignment when mask reaches nr_cpu_ids (bsc#1262019).\n- scsi: lpfc: Check ASIC_ID register to aid diagnostics during failed fw updates (bsc#1262019).\n- scsi: lpfc: Cleanup error exit paths in lpfc_fdmi_cmd() and associated messages (bsc#1262019).\n- scsi: lpfc: ELIMINATE kernel-doc warnings in lpfc.h (bsc#1262019).\n- scsi: lpfc: Fix incorrect txcmplq_cnt during cleanup in lpfc_sli_abort_ring() (bsc#1262019).\n- scsi: lpfc: Introduce 128G link speed selection and support (bsc#1262019).\n- scsi: lpfc: Log discarded and insufficient RQE buffer events (bsc#1262019).\n- scsi: lpfc: Log MCQE contents for mbox commands with no context (bsc#1262019).\n- scsi: lpfc: Properly set WC for DPP mapping (bsc#1262019).\n- scsi: lpfc: Reduce pointer chasing when accessing vmid_flag (bsc#1262019).\n- scsi: lpfc: Remove deprecated PBDE feature (bsc#1262019).\n- scsi: lpfc: Remove unnecessary ndlp kref get in lpfc_check_nlp_post_devloss (bsc#1262019).\n- scsi: lpfc: Restrict first burst to non-FCoE and SLI4 adapters only (bsc#1262019).\n- scsi: lpfc: Select mailbox rq_create cmd version based on SLI4 if_type (bsc#1262019).\n- scsi: lpfc: Update class of service bit field to 3 bits for WQE submissions (bsc#1262019).\n- scsi: lpfc: Update construction of SGL when XPSGL is enabled (bsc#1262019).\n- scsi: lpfc: Update copyright year string for 2026 (bsc#1262019).\n- scsi: lpfc: Update log message when ndlp kref get is unsuccessful (bsc#1262019).\n- scsi: lpfc: Update lpfc version to 14.4.0.14 (bsc#1262019).\n- scsi: lpfc: Update lpfc version to 15.0.0.0 (bsc#1262019).\n- scsi: lpfc: Update outdated comment for renamed lpfc_freenode() (bsc#1262019).\n- scsi: lpfc: Use min_t() instead of min() in lpfc_sli4_driver_resource_setup (bsc#1262019).\n- scsi: lpfc: Use the crc32c() function (bsc#1262019).\n- scsi: mpi3mr: Add NULL checks when resetting request and reply queues (git-fixes).\n- scsi: ses: Fix devices attaching to different hosts (git-fixes).\n- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (git-fixes).\n- scsi: target: iscsi: validate CHAP_R length before base64 decode (bsc#1265449).\n- scsi: ufs: ufs-pci: Add support for Intel Wildcat Lake (jsc#PED-13771).\n- selftests/bpf: Test cross-sign 64bits range refinement (git-fixes).\n- selftests/bpf: Test invariants on JSLT crossing sign (git-fixes).\n- selftests/bpf: test refining u32/s32 bounds when ranges cross min/max boundary (git-fixes).\n- selftests: net: build net/lib dependency in all target (bsc#1262245).\n- selinux: don't reserve xattr slot when we won't fill it (stable-fixes).\n- selinux: prune /sys/fs/selinux/disable (stable-fixes).\n- selinux: shrink critical section in sel_write_load() (stable-fixes).\n- serial: 8250: Add serial8250_handle_irq_locked() (bsc#1262480).\n- serial: 8250: Protect LCR write in shutdown (bsc#1262480).\n- serial: 8250_dw: Avoid unnecessary LCR writes (bsc#1262480).\n- serial: 8250_dw: Ensure BUSY is deasserted (bsc#1262480).\n- serial: 8250_dw: Rework dw8250_handle_irq() locking and IIR handling (bsc#1262480).\n- serial: 8250_dw: Rework IIR_NO_INT handling to stop interrupt storm (bsc#1262480).\n- Set CONFIG_INTEL_TSX_MODE to follow upstream AUTO default (bsc#1263044).\n- soc/tegra: cbb: Set ERD on resume for err interrupt (git-fixes).\n- soc: qcom: aoss: compare against normalized cooling state (git-fixes).\n- soc: qcom: llcc: fix v1 SB syndrome register offset (git-fixes).\n- soc: qcom: ocmem: make the core clock optional (git-fixes).\n- soc: qcom: ocmem: register reasons for probe deferrals (git-fixes).\n- soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available (git-fixes).\n- sound: ua101: fix division by zero at probe (git-fixes).\n- soundwire: bus: demote UNATTACHED state warnings to dev_dbg() (git-fixes).\n- soundwire: cadence: Clear message complete before signaling waiting thread (git-fixes).\n- soundwire: debugfs: initialize firmware_file to empty string (git-fixes).\n- spi: aspeed-smc: fix controller deregistration (git-fixes).\n- spi: at91-usart: fix controller deregistration (git-fixes).\n- spi: atmel: fix controller deregistration (git-fixes).\n- spi: bcm63xx: fix controller deregistration (git-fixes).\n- spi: bcmbca-hsspi: fix controller deregistration (git-fixes).\n- spi: cadence: fix controller deregistration (git-fixes).\n- spi: cadence: fix unclocked access on unbind (git-fixes).\n- spi: ch341: fix memory leaks on probe failures (git-fixes).\n- spi: coldfire-qspi: fix controller deregistration (git-fixes).\n- spi: dln2: fix controller deregistration (git-fixes).\n- spi: fix controller cleanup() documentation (git-fixes).\n- spi: fix misleading controller deregistration kernel-doc (git-fixes).\n- spi: fix misleading controller registration kernel-doc (git-fixes).\n- spi: fsl-espi: fix controller deregistration (git-fixes).\n- spi: fsl-qspi: Use reinit_completion() for repeated operations (git-fixes).\n- spi: fsl: fix controller deregistration (git-fixes).\n- spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo (git-fixes).\n- spi: img-spfi: fix controller deregistration (git-fixes).\n- spi: imx: fix runtime pm leak on probe deferral (git-fixes).\n- spi: imx: fix use-after-free on unbind (git-fixes).\n- spi: lantiq-ssc: fix controller deregistration (git-fixes).\n- spi: meson-spicc: fix controller deregistration (git-fixes).\n- spi: microchip-core-qspi: fix controller deregistration (git-fixes).\n- spi: mpc52xx: fix controller deregistration (git-fixes).\n- spi: mpc52xx: fix use-after-free on registration failure (git-fixes).\n- spi: mpc52xx: fix use-after-free on unbind (git-fixes).\n- spi: mtk-nor: fix controller deregistration (git-fixes).\n- spi: mtk-snfi: fix memory leak in probe (git-fixes).\n- spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback (git-fixes).\n- spi: mxic: fix controller deregistration (git-fixes).\n- spi: mxs: fix controller deregistration (git-fixes).\n- spi: npcm-pspi: fix controller deregistration (git-fixes).\n- spi: omap2-mcspi: fix controller deregistration (git-fixes).\n- spi: orion: fix clock imbalance on registration failure (git-fixes).\n- spi: orion: fix controller deregistration (git-fixes).\n- spi: orion: fix runtime pm leak on unbind (git-fixes).\n- spi: pic32-sqi: fix controller deregistration (git-fixes).\n- spi: pic32: fix controller deregistration (git-fixes).\n- spi: pl022: fix controller deregistration (git-fixes).\n- spi: qup: fix controller deregistration (git-fixes).\n- spi: rockchip: fix controller deregistration (git-fixes).\n- spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ (git-fixes).\n- spi: rspi: fix controller deregistration (git-fixes).\n- spi: s3c64xx: fix controller deregistration (git-fixes).\n- spi: s3c64xx: fix NULL-deref on driver unbind (git-fixes).\n- spi: sh-hspi: fix controller deregistration (git-fixes).\n- spi: sprd: fix controller deregistration (git-fixes).\n- spi: st-ssc4: fix controller deregistration (git-fixes).\n- spi: sun4i: fix controller deregistration (git-fixes).\n- spi: sun6i: fix controller deregistration (git-fixes).\n- spi: syncuacer: fix controller deregistration (git-fixes).\n- spi: ti-qspi: fix controller deregistration (git-fixes).\n- spi: topcliff-pch: fix controller deregistration (git-fixes).\n- spi: topcliff-pch: fix use-after-free on unbind (git-fixes).\n- spi: uniphier: fix controller deregistration (git-fixes).\n- spi: uniphier: Simplify clock handling with devm_clk_get_enabled() (stable-fixes).\n- spi: zynq-qspi: fix controller deregistration (git-fixes).\n- spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() (stable-fixes).\n- spi: zynqmp-gqspi: fix controller deregistration (git-fixes).\n- staging: media: atomisp: Disallow all private IOCTLs (git-fixes).\n- staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() (git-fixes).\n- staging: sm750fb: fix division by zero in ps_to_hz() (git-fixes).\n- staging: vme_user: fix root device leak on init failure (git-fixes).\n- tg3: replace placeholder MAC address with device property (git-fixes).\n- thermal/drivers/spear: Fix error condition for reading st,thermal-flags (git-fixes).\n- thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp (git-fixes).\n- thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata (git-fixes).\n- tools/power/turbostat: Fix microcode patch level output for AMD/Hygon (git-fixes).\n- tools: hv: Fix cross-compilation (git-fixes).\n- tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public() (git-fixes).\n- tpm: avoid -Wunused-but-set-variable (git-fixes).\n- tpm: Fix auth session leak in tpm2_get_random() error path (git-fixes).\n- tpm: tpm_tis: add error logging for data transfer (git-fixes).\n- tpm: tpm_tis: stop transmit if retries are exhausted (git-fixes).\n- tpm: Use kfree_sensitive() to free auth session in tpm_dev_release() (git-fixes).\n- tty: serial: ip22zilog: Fix section mispatch warning (git-fixes).\n- udp: Force compute_score to always inline (bsc#1241259).\n- unshare: fix unshare_fs() handling (git-fixes).\n- USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen (git-fixes).\n- usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (git-fixes).\n- usb: chipidea: otg: not wait vbus drop if use role_switch (git-fixes).\n- USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam (stable-fixes).\n- usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer (stable-fixes).\n- usb: gadget: f_hid: Add missing error code (git-fixes).\n- usb: gadget: f_hid: don't call cdev_init while cdev in use (git-fixes).\n- usb: gadget: f_hid: move list and spinlock inits from bind to alloc (stable-fixes).\n- usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() (git-fixes).\n- usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() (git-fixes).\n- usb: gadget: f_uac1_legacy: validate control request size (stable-fixes).\n- usb: gadget: renesas_usb3: validate endpoint index in standard request handlers (git-fixes).\n- usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo (git-fixes).\n- USB: omap_udc: DMA: Don't enable burst 4 mode (git-fixes).\n- usb: port: add delay after usb_hub_set_port_power() (git-fixes).\n- usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive (stable-fixes).\n- USB: serial: io_edgeport: add support for Blackbox IC135A (stable-fixes).\n- USB: serial: option: add MeiG Smart SRM825WN (stable-fixes).\n- USB: serial: option: add support for Rolling Wireless RW135R-GL (stable-fixes).\n- USB: serial: option: add Telit Cinterion FN990A MBIM composition (git-fixes).\n- USB: serial: option: add Telit Cinterion LE910Cx compositions (stable-fixes).\n- usb: storage: Expand range of matched versions for VL817 quirks entry (git-fixes).\n- usb: typec: tcpm: reset internal port states on soft reset AMS (git-fixes).\n- usb: ulpi: fix memory leak on ulpi_register() error paths (git-fixes).\n- usb: usblp: fix heap leak in IEEE 1284 device ID via short response (stable-fixes).\n- usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl (stable-fixes).\n- usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() (git-fixes).\n- usbip: validate number_of_packets in usbip_pack_ret_submit() (git-fixes).\n- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (git-fixes).\n- vfio/pds: Fix memory leak in pds_vfio_dirty_enable() (git-fixes).\n- vfio/pds: Fix missing detach_ioas op (git-fixes).\n- vfio/pds: replace bitmap_free with vfree (git-fixes).\n- vfio/type1: Fix error unwind in migration dirty bitmap allocation (git-fixes).\n- vfio: Fix unbalanced vfio_df_close call in no-iommu mode (git-fixes).\n- vfio: Prevent open_count decrement to negative (git-fixes).\n- virt: arm-cca-guest: fix error check for RSI_INCOMPLETE (git-fixes).\n- virt: sev-guest: Do not use host-controlled page order in cleanup path (git-fixes).\n- virt: tdx-guest: Fix handling of host controlled 'quote' buffer length (git-fixes).\n- virt: tdx-guest: Return error for GetQuote failures (git-fixes).\n- wifi: ath5k: do not access array OOB (git-fixes).\n- wifi: ath9k: Fix typo (git-fixes).\n- wifi: ath10k: fix station lookup failure during disconnect (git-fixes).\n- wifi: ath11k: fix memory leaks in beacon template setup (git-fixes).\n- wifi: ath12k: fix leak in some ath12k_wmi_xxx() functions (git-fixes).\n- wifi: ath12k: use lockdep_assert_in_rcu_read_lock() for RCU assertions (git-fixes).\n- wifi: b43: enforce bounds check on firmware key index in b43_rx() (git-fixes).\n- wifi: b43legacy: enforce bounds check on firmware key index in RX path (git-fixes).\n- wifi: brcmfmac: Fix error pointer dereference (git-fixes).\n- wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task (git-fixes).\n- wifi: brcmfmac: validate bsscfg indices in IF events (stable-fixes).\n- wifi: brcmsmac: Fix dma_free_coherent() size (git-fixes).\n- wifi: cw1200: Revert \"Fix locking in error paths\" (git-fixes).\n- wifi: libertas: notify firmware load wait on disconnect (git-fixes).\n- wifi: mac80211: check ieee80211_rx_data_set_link return in pubsta MLO path (git-fixes).\n- wifi: mac80211: check tdls flag in ieee80211_tdls_oper (stable-fixes).\n- wifi: mac80211: drop stray 'static' from fast-RX rx_result (git-fixes).\n- wifi: mac80211: handle VHT EXT NSS in ieee80211_determine_our_sta_mode() (git-fixes).\n- wifi: mac80211: remove station if connection prep fails (git-fixes).\n- wifi: mac80211: use safe list iteration in radar detect work (git-fixes).\n- wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req() (git-fixes).\n- wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor (stable-fixes).\n- wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling (git-fixes).\n- wifi: mt76: mt7615: fix use_cts_prot support (git-fixes).\n- wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() (git-fixes).\n- wifi: mt76: mt7915: fix use_cts_prot support (git-fixes).\n- wifi: mt76: mt7921: fix 6GHz regulatory update on connection (git-fixes).\n- wifi: mt76: mt7921: fix a potential clc buffer length underflow (git-fixes).\n- wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work (git-fixes).\n- wifi: mt76: mt7921: Place upper limit on station AID (git-fixes).\n- wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() (git-fixes).\n- wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr (git-fixes).\n- wifi: mt76: mt7925: fix incorrect length field in txpower command (git-fixes).\n- wifi: mt76: mt7925: Fix incorrect MLO mode in firmware control (git-fixes).\n- wifi: mt76: mt7925: fix incorrect TLV length in CLC command (git-fixes).\n- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_tx_check_aggr() (git-fixes).\n- wifi: mt76: mt7925: prevent NULL vif dereference in mt7925_mac_write_txwi (git-fixes).\n- wifi: mt76: mt7996: fix FCS error flag check in RX descriptor (git-fixes).\n- wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event (git-fixes).\n- wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work() (git-fixes).\n- wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() (git-fixes).\n- wifi: nl80211: fix NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST usage (git-fixes).\n- wifi: nl80211: require admin perm on SET_PMK / DEL_PMK (git-fixes).\n- wifi: rsi: fix kthread lifetime race between self-exit and external-stop (git-fixes).\n- wifi: rt2x00usb: fix devres lifetime (git-fixes).\n- wifi: rtl8xxxu: fix potential use of uninitialized value (git-fixes).\n- wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet (git-fixes).\n- wifi: rtw88: Add additional USB IDs for RTL8812BU (bsc#1263135).\n- wifi: rtw88: Add BUFFALO WI-U3-866DHP to the USB ID list (bsc#1263135).\n- wifi: rtw88: Add support for Mercusys MA30N and D-Link DWA-T185 rev. A1 (bsc#1263135).\n- wifi: rtw88: check for PCI upstream bridge existence (git-fixes).\n- wifi: rtw88: fix device leak on probe failure (git-fixes).\n- wifi: rtw88: rtw8822bu VID/PID for BUFFALO WI-U2-866DM (bsc#1263135).\n- wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() (git-fixes).\n- wifi: wl1251: validate packet IDs before indexing tx_frames (stable-fixes).\n- x86/acpi/boot: Correct acpi_is_processor_usable() check again (git-fixes).\n- x86/boot/sev: Avoid shared GHCB page for early memory acceptance (git-fixes).\n- x86/boot/sev: Support memory acceptance in the EFI stub under SVSM (git-fixes).\n- x86/boot: Fix page table access in 5-level to 4-level paging transition (git-fixes).\n- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (bsc#1263255).\n- x86/cpufeatures: Free up unused feature bits (bsc#1263255).\n- x86/fred: Fix early boot failures on SEV-ES/SNP guests (git-fixes).\n- x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (git-fixes).\n- x86/sev: Add missing RIP_REL_REF() invocations during sme_enable() (git-fixes).\n- x86/sev: Do not touch VMSA pages during SNP guest memory kdump (git-fixes).\n- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (git-fixes).\n- x86/sev: Fix operator precedence in GHCB_MSR_VMPL_REQ_LEVEL macro (git-fixes).\n- x86/sev: Improve handling of writes to intercepted TSC MSRs (git-fixes).\n- x86/sev: Make sure pages are not skipped during kdump (git-fixes).\n- x86/tsx: Get the tsx= command line parameter with early_param() (bsc#1250951 bsc#1263044).\n- x86/tsx: Make tsx_ctrl_state static (bsc#1250951 bsc#1263044).\n- x86/vmware: Parse MP tables for SEV-SNP enabled guests under VMware hypervisors (git-fixes).\n- X.509: Fix out-of-bounds access when parsing extensions (git-fixes).\n- Xarray: do not return sibling entries from xas_find_marked() (bsc#1263815).\n","status":"published","published":"2026-05-28T11:40:20Z","modified":"2026-05-31T18:24:29.197819689Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:21845-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).\n- CVE-2024-14027: xattr: switch to CLASS(fd) (bsc#1259420).\n- CVE-2025-40181: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (bsc#1253471).\n- CVE-2025-68265: nvme: fix admin request_queue lifetime (bsc#1255360).\n- CVE-2025-68310: s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (bsc#1255160).\n- CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).\n- CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).\n- CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).\n- CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).\n- CVE-2026-23276: net: add xmit recursion limit to tunnel xmit functions (bsc#1260012).\n- CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).\n- CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).\n- CVE-2026-23316: net: ipv4: fix ARM64 alignment fault in multipath hash seed (bsc#1260573).\n- CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).\n- CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).\n- CVE-2026-23346: arm64: io: Rename ioremap_prot() to __ioremap_prot() (bsc#1260529).\n- CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).\n- CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).\n- CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).\n- CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).\n- CVE-2026-23375: mm: thp: deny THP for files on anonymous inodes (bsc#1260576).\n- CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).\n- CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).\n- CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).\n- CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).\n- CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).\n- CVE-2026-23417: bpf: Fix constant blinding for PROBE_MEM32 stores (bsc#1261410).\n- CVE-2026-23436: net: add helpers for lookup and walking netdevs under netdev_lock() (bsc#1261617).\n- CVE-2026-23437: net: shaper: protect late read accesses to the hierarchy (bsc#1261635).\n- CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).\n- CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).\n- CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).\n- CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).\n- CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).\n- CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).\n- CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).\n- CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).\n- CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).\n- CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).\n- CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).\n- CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).\n- CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on wakeup race (bsc#1261694).\n- CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).\n- CVE-2026-31395: bnxt_en: fix OOB access in DBG_BUF_PRODUCER async event handler (bsc#1261786).\n- CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).\n- CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).\n- CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).\n- CVE-2026-31406: xfrm: Fix work re-schedule after cancel in xfrm_nat_keepalive_net_fini() (bsc#1261629).\n- CVE-2026-31407: netfilter: conntrack: add missing netlink policy validations (bsc#1261632).\n- CVE-2026-31411: net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (bsc#1261752).\n- CVE-2026-31415: ipv6: avoid overflows in ip6_datagram_send_ctl() (bsc#1262099).\n- CVE-2026-31416: netfilter: nfnetlink_log: account for netlink header size (bsc#1262100).\n- CVE-2026-31420: bridge: mrp: reject zero test interval to avoid OOM panic (bsc#1262055).\n- CVE-2026-31421: net/sched: cls_fw: fix NULL pointer dereference on shared blocks (bsc#1262061).\n- CVE-2026-31422: net/sched: cls_flow: fix NULL pointer dereference on shared blocks (bsc#1262054).\n- CVE-2026-31423: net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() (bsc#1262063).\n- CVE-2026-31424: netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (bsc#1262053).\n- CVE-2026-31425: rds: ib: reject FRMR registration before IB connection is established (bsc#1262074).\n- CVE-2026-31427: netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp (bsc#1262086).\n- CVE-2026-31428: netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (bsc#1262087).\n- CVE-2026-31435: netfs: Fix read abandonment during retry (bsc#1262601).\n- CVE-2026-31449: ext4: validate p_idx bounds in ext4_ext_correct_indexes (bsc#1262616).\n- CVE-2026-31453: xfs: avoid dereferencing log items after push callbacks (bsc#1262617).\n- CVE-2026-31456: mm/pagewalk: fix race between concurrent split and refault (bsc#1262627).\n- CVE-2026-31494: net: cadence: macb: Synchronize stats calculations (bsc#1262671).\n- CVE-2026-31496: netfilter: nf_conntrack_expect: skip expectations in other netns via proc (bsc#1262673).\n- CVE-2026-31503: udp: Fix wildcard bind conflict check when using hash2 (bsc#1263077).\n- CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263085).\n- CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263093).\n- CVE-2026-31507: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer (bsc#1263095).\n- CVE-2026-31515: af_key: validate families in pfkey_send_migrate() (bsc#1262752).\n- CVE-2026-31519: btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create (bsc#1263012).\n- CVE-2026-31525: bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN (bsc#1262725).\n- CVE-2026-31526: bpf: Fix exception exit lock checking for subprogs (bsc#1262662).\n- CVE-2026-31528: perf: Make sure to use pmu_ctx-\u003epmu for groups (bsc#1263001).\n- CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262758).\n- CVE-2026-31547: drm/xe: Fix missing runtime PM reference in ccs_mode_store (bsc#1263018).\n- CVE-2026-31550: pmdomain: bcm: bcm2835-power: Increase ASB control timeout (bsc#1263104).\n- CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263107).\n- CVE-2026-31565: RDMA/irdma: Fix deadlock during netdev reset with active connections (bsc#1263064).\n- CVE-2026-31579: wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit (bsc#1263074).\n- CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263176).\n- CVE-2026-31588: KVM: x86: Use scratch field in MMIO fragment to hold small write values (bsc#1263165).\n- CVE-2026-31644: net: lan966x: fix use-after-free and leak in lan966x_fdma_reload() (bsc#1263048).\n- CVE-2026-31649: net: stmmac: fix integer underflow in chain mode (bsc#1263582).\n- CVE-2026-31658: net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() (bsc#1263052).\n- CVE-2026-31662: tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (bsc#1263131).\n- CVE-2026-31666: btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref() (bsc#1263138).\n- CVE-2026-31668: seg6: separate dst_cache for input and output paths in seg6 lwtunnel (bsc#1263140).\n- CVE-2026-31669: mptcp: fix slab-use-after-free in __inet_lookup_established (bsc#1263141).\n- CVE-2026-31675: net/sched: sch_netem: fix out-of-bounds access in packet corruption (bsc#1263556).\n- CVE-2026-31678: openvswitch: defer tunnel netdev_put to RCU release (bsc#1263562).\n- CVE-2026-31679: openvswitch: validate MPLS set/set_masked payload length (bsc#1263592).\n- CVE-2026-31681: netfilter: xt_multiport: validate range encoding in checkentry (bsc#1263593).\n- CVE-2026-31682: bridge: br_nd_send: linearize skb before parsing ND options (bsc#1263595).\n- CVE-2026-31684: net: sched: act_csum: validate nested VLAN headers (bsc#1263596).\n- CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263668).\n- CVE-2026-31691: igb: remove napi_synchronize() in igb_down() (bsc#1263604).\n- CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263901).\n- CVE-2026-31700: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (bsc#1263882).\n- CVE-2026-31738: vxlan: validate ND option lengths in vxlan_na_create (bsc#1264059).\n- CVE-2026-31787: xen/privcmd: fix double free via VMA splitting (bsc#1262181).\n- CVE-2026-43009: bpf: Fix incorrect pruning due to atomic fetch precision tracking (bsc#1264014).\n- CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1263931).\n- CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1263933).\n- CVE-2026-43037: ip6_tunnel: clear skb2-\u003ecb in ip4ip6_err() (bsc#1263995).\n- CVE-2026-43038: ipv6: icmp: clear skb2-\u003ecb in ip6_err_gen_icmpv6_unreach() (bsc#1264097).\n- CVE-2026-43045: mshv: Refactor and rename memory region handling functions (bsc#1263942).\n- CVE-2026-43050: atm: lec: fix use-after-free in sock_def_readable() (bsc#1264082).\n- CVE-2026-43060: netfilter: nft_ct: drop pending enqueued packets on removal (bsc#1264183).\n- CVE-2026-43082: net: txgbe: leave space for null terminators on property_entry (bsc#1264233).\n- CVE-2026-43088: net: af_key: zero aligned sockaddr tail in PF_KEY exports (bsc#1264469).\n- CVE-2026-43153: xfs: remove xfs_attr_leaf_hasname (bsc#1264586).\n- CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264848).\n- CVE-2026-43265: KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block() (bsc#1264427).\n- CVE-2026-43329: netfilter: flowtable: strictly check for maximum number of actions (bsc#1265085).\n- CVE-2026-43365: xfs: fix undersized l_iclog_roundoff values (bsc#1265119).\n- CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265116).\n- CVE-2026-43441: net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1264674).\n- CVE-2026-43494: net/rds: reset op_nents when zerocopy page pin fails (bsc#1265626).\n- CVE-2026-43503: net: skbuff: propagate shared-frag marker through frag-transfer helpers (bsc#1265960).\n\nThe following non security issues were fixed:\n\n- accel/qaic: Add overflow check to remap_pfn_range during mmap (git-fixes).\n- ACPI: AGDI: fix missing newline in error message (git-fixes).\n- ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug (git-fixes).\n- ACPI: scan: Use acpi_dev_put() in object add error paths (git-fixes).\n- ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO (git-fixes).\n- ACPI: video: force native backlight on HP OMEN 16 (8A44) (stable-fixes).\n- ACPI: video: Move Lenovo Legion S7 15ACH6 quirk to the right section (git-fixes).\n- ALSA: 6fire: Fix input volume change detection (git-fixes).\n- ALSA: 6fire: fix use-after-free on disconnect (git-fixes).\n- ALSA: aoa: i2sbus: clear stale prepared state (git-fixes).\n- ALSA: aoa: i2sbus: fix OF node lifetime handling (git-fixes).\n- ALSA: aoa: Skip devices with no codecs in i2sbus_resume() (git-fixes).\n- ALSA: aoa: Use guard() for mutex locks (stable-fixes).\n- ALSA: asihpi: avoid write overflow check warning (stable-fixes).\n- ALSA: caiaq: Don't abort when no input device is available (git-fixes).\n- ALSA: caiaq: Fix control_put() result and cache rollback (git-fixes).\n- ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path (git-fixes).\n- ALSA: caiaq: fix usb_dev refcount leak on probe failure (git-fixes).\n- ALSA: caiaq: Handle probe errors properly (git-fixes).\n- ALSA: caiaq: take a reference on the USB device in create_card() (git-fixes).\n- ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() (git-fixes).\n- ALSA: core: Fix potential data race at fasync handling (git-fixes).\n- ALSA: core: Serialize deferred fasync state checks (git-fixes).\n- ALSA: core: Validate compress device numbers without dynamic minors (git-fixes).\n- ALSA: ctxfi: Add fallback to default RSR for S/PDIF (git-fixes).\n- ALSA: ctxfi: Fix missing SPDIFI1 index handling (stable-fixes).\n- ALSA: ctxfi: Limit PTP to a single page (git-fixes).\n- ALSA: firewire-tascam: Do not drop unread control events (git-fixes).\n- ALSA: fireworks: bound device-supplied status before string array lookup (git-fixes).\n- ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 (stable-fixes).\n- ALSA: hda/realtek - fixed speaker no sound update (git-fixes).\n- ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk (stable-fixes).\n- ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx (stable-fixes).\n- ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC (stable-fixes).\n- ALSA: hda/realtek: add quirk for Framework F111:000F (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 (stable-fixes).\n- ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') (git-fixes).\n- ALSA: hda: cs35l41: Put ACPI device on missing physical node (git-fixes).\n- ALSA: hda: cs35l56: Propagate ASP TX source control errors (git-fixes).\n- ALSA: hda: cs35l56: Put ACPI device after setting companion (git-fixes).\n- ALSA: hda: Fix NULL pointer dereference in snd_hda_ctl_add() (git-fixes).\n- ALSA: misc: Use guard() for spin locks (stable-fixes).\n- ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger (stable-fixes).\n- ALSA: pcmtest: fix reference leak on failed device registration (git-fixes).\n- ALSA: pcmtest: Fix resource leaks in module init error paths (git-fixes).\n- ALSA: pcmtest: Return -EFAULT on pattern read copy failure (git-fixes).\n- ALSA: sc6000: Keep the programmed board state in card-private data (git-fixes).\n- ALSA: scarlett2: Add missing error check when initialise Autogain Status (git-fixes).\n- ALSA: scarlett2: Add missing sentinel initializer field (git-fixes).\n- ALSA: seq: Notify client and port info changes (stable-fixes).\n- ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes (stable-fixes).\n- ALSA: usb-audio: apply quirk for MOONDROP JU Jiu (stable-fixes).\n- ALSA: usb-audio: Avoid false E-MU sample-rate notifications (git-fixes).\n- ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() (git-fixes).\n- ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans (git-fixes).\n- ALSA: usb-audio: Bound MIDI endpoint descriptor scans (git-fixes).\n- ALSA: usb-audio: Evaluate packsize caps at the right place (git-fixes).\n- ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch (git-fixes).\n- ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams (git-fixes).\n- ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex (stable-fixes).\n- ALSA: usb-audio: Fix UAC3 cluster descriptor size check (git-fixes).\n- ALSA: usb-audio: midi2: Restart output URBs on resume (git-fixes).\n- ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES (git-fixes).\n- ALSA: virtio: drop an extaneous kernel-doc comment (git-fixes).\n- amdgpu/jpeg: fix deepsleep register for jpeg 5_0_0 and 5_0_2 (stable-fixes).\n- ASoC: amd: acp: Add DMI quirk for Valve Steam Deck OLED (git-fixes).\n- ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF (stable-fixes).\n- ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table (stable-fixes).\n- ASoC: codecs: ab8500: Fix casting of private data (git-fixes).\n- ASoC: cs35l56: Destroy workqueue in probe error path (git-fixes).\n- ASoC: cs35l56: Don't use devres to unregister component (git-fixes).\n- ASoC: cs35l56: Fix hibernate write in runtime resume error path (git-fixes).\n- ASoC: fsl_easrc: Change the type for iec958 channel status controls (git-fixes).\n- ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() (git-fixes).\n- ASoC: fsl_easrc: fix comment typo (git-fixes).\n- ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() (git-fixes).\n- ASoC: fsl_micfil: Add access property for \"VAD Detected\" (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in micfil_quality_set() (git-fixes).\n- ASoC: fsl_xcvr: Fix event generation for cached controls (git-fixes).\n- ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() (git-fixes).\n- ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() (git-fixes).\n- ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error (git-fixes).\n- ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop (git-fixes).\n- ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens (git-fixes).\n- ASoC: qcom: q6apm: move component registration to unmanaged version (git-fixes).\n- ASoC: qcom: q6apm: remove child devices when apm is removed (git-fixes).\n- ASoC: qcom: qdsp6: topology: check widget type before accessing data (git-fixes).\n- ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list (stable-fixes).\n- ASoC: SOF: compress: return the configured codec from get_params (git-fixes).\n- ASoC: SOF: Don't allow pointer operations on unconfigured streams (git-fixes).\n- ASoC: SOF: Intel: hda: Place check before dereference (git-fixes).\n- ASoC: SOF: topology: reject invalid vendor array size in token parser (stable-fixes).\n- ASoC: sti: Return errors from regmap_field_alloc() (git-fixes).\n- ASoC: sti: use managed regmap_field allocations (git-fixes).\n- ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J (stable-fixes).\n- ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 (stable-fixes).\n- backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() (git-fixes).\n- batman-adv: bla: only purge non-released claims (git-fixes).\n- batman-adv: bla: prevent use-after-free when deleting claims (git-fixes).\n- batman-adv: bla: put backbone reference on failed claim hash insert (git-fixes).\n- batman-adv: fix integer overflow on buff_pos (git-fixes).\n- batman-adv: hold claim backbone gateways by reference (git-fixes).\n- batman-adv: reject new tp_meter sessions during teardown (git-fixes).\n- batman-adv: reject oversized global TT response buffers (git-fixes).\n- batman-adv: stop caching unowned originator pointers in BAT IV (git-fixes).\n- bitfield: Add FIELD_MODIFY() helper (jsc#PED-14238).\n- Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling (git-fixes).\n- Bluetooth: btmtk: validate WMT event SKB length before struct access (git-fixes).\n- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (bsc#1260996).\n- Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (git-fixes).\n- Bluetooth: hci_event: fix memset typo (git-fixes).\n- Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt (git-fixes).\n- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (git-fixes).\n- Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (git-fixes).\n- Bluetooth: HIDP: serialise l2cap_unregister_user via hidp_session_sem (git-fixes).\n- Bluetooth: ISO: Fix data-race on dst in iso_sock_connect() (git-fixes).\n- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (git-fixes).\n- Bluetooth: l2cap: fix MPS check in l2cap_ecred_reconf_req (git-fixes).\n- Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (git-fixes).\n- Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() (git-fixes).\n- Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU (git-fixes).\n- Bluetooth: RFCOMM: pull credit byte with skb_pull_data() (git-fixes).\n- Bluetooth: SCO: check for codecs-\u003enum_codecs == 1 before assigning to sco_pi(sk)-\u003ecodec (git-fixes).\n- Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready (git-fixes).\n- Bluetooth: SCO: hold sk properly in sco_conn_ready (git-fixes).\n- Bluetooth: virtio_bt: clamp rx length before skb_put (git-fixes).\n- Bluetooth: virtio_bt: validate rx pkt_type header length (git-fixes).\n- bpf: Add third round of bounds deduction (git-fixes).\n- bpf: Fix u32/s32 bounds when ranges cross min/max boundary (git-fixes).\n- bpf: Improve bounds when s64 crosses sign boundary (git-fixes).\n- bpf: Switch CONFIG_CFI_CLANG to CONFIG_CFI (git-fixes).\n- btrfs: qgroup: update all parent qgroups when doing quick inherit (bsc#1258933).\n- btrfs: reject root items with drop_progress and zero drop_level (git-fixes).\n- btrfs: replace BUG() with error handling in __btrfs_balance() (git-fixes).\n- bus: mhi: host: pci_generic: Switch to async power up to avoid boot delays (git-fixes).\n- bus: rifsc: fix RIF configuration check for peripherals (git-fixes).\n- can: mcp251x: add error handling for power enable in open and resume (stable-fixes).\n- can: raw: fix ro-\u003euniq use-after-free in raw_rcv() (git-fixes).\n- can: ucan: fix devres lifetime (git-fixes).\n- cdc-acm: new quirk for EPSON HMD (stable-fixes).\n- check-for-config-changes: Exclude CC_MS_EXTENSIONS.\n- check-for-config-changes: Exclude HAVE_CFI_ICALL_NORMALIZE_INTEGERS{,_RUSTC}.\n- comedi: dt2815: add hardware detection to prevent crash (stable-fixes).\n- cpufreq: intel_pstate: Drop Arrow Lake from \"scaling factor\" list (bsc#1249104).\n- crypto: af_alg - limit RX SG extraction by receive buffer budget (git-fixes).\n- crypto: algif_aead - Fix minimum RX size check for decryption (git-fixes).\n- crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup (git-fixes).\n- crypto: atmel-ecc - Release client on allocation failure (git-fixes).\n- crypto: atmel-sha204a - Fix error codes in OTP reads (git-fixes).\n- crypto: atmel-sha204a - Fix OTP sysfs read and error handling (git-fixes).\n- crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path (git-fixes).\n- crypto: atmel-sha204a - Fix uninitialized data access on OTP read error (git-fixes).\n- crypto: atmel-tdes - fix DMA sync direction (git-fixes).\n- crypto: ccp - copy IV using skcipher ivsize (git-fixes).\n- crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (git-fixes).\n- crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (git-fixes).\n- crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (git-fixes).\n- crypto: ccree - fix a memory leak in cc_mac_digest() (git-fixes).\n- crypto: drivers - Switch back to struct platform_driver::remove() (jsc#PED-14238).\n- crypto: drivers - Use str_enable_disable-like helpers (jsc#PED-14238).\n- crypto: hisilicon - Fix dma_unmap_single() direction (git-fixes).\n- crypto: iaa - Adjust workqueue allocation type (jsc#PED-14238).\n- crypto: iaa - fix per-node CPU counter reset in rebalance_wq_table() (git-fixes).\n- crypto: iaa - Move compression CRC into request object (jsc#PED-14238).\n- crypto: iaa - Optimize rebalance_wq_table() (jsc#PED-14238).\n- crypto: iaa - Remove potential infinite loop in check_completion() (jsc#PED-14238).\n- crypto: iaa - Remove unreachable pr_debug from iaa_crypto_cleanup_module (jsc#PED-14238).\n- crypto: iaa - Remove unused disable_async argument from iaa_decompress (jsc#PED-14238).\n- crypto: iaa - Replace sprintf with sysfs_emit in sysfs show functions (jsc#PED-14238).\n- crypto: iaa - Simplify init_iaa_device() (jsc#PED-14238).\n- crypto: jitterentropy - replace long-held spinlock with mutex (git-fixes).\n- crypto: nx - Fix packed layout in struct nx842_crypto_header (git-fixes).\n- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (git-fixes).\n- crypto: qat - #undef field_get() before local definition (jsc#PED-14238).\n- crypto: qat - add adf_rl_get_num_svc_aes() in rate limiting (jsc#PED-14238).\n- crypto: qat - add bank state save and restore for qat_420xx (jsc#PED-14238).\n- crypto: qat - add command queue telemetry counters for GEN6 (jsc#PED-14238).\n- crypto: qat - add compression slice count for rate limiting (jsc#PED-14238).\n- crypto: qat - add decompression service for rate limiting (jsc#PED-14238).\n- crypto: qat - add decompression service to telemetry (jsc#PED-14238).\n- crypto: qat - add firmware headers for GEN6 devices (jsc#PED-14238).\n- crypto: qat - add GEN6 firmware loader (jsc#PED-14238).\n- crypto: qat - add get_svc_slice_cnt() in device data structure (jsc#PED-14238).\n- crypto: qat - add live migration enablers for GEN6 devices (jsc#PED-14238).\n- crypto: qat - add macro to write 64-bit values to registers (jsc#PED-14238).\n- crypto: qat - add missing header inclusion (jsc#PED-14238).\n- crypto: qat - add qat_6xxx driver (jsc#PED-14238).\n- crypto: qat - add ring buffer idle telemetry counter for GEN6 (jsc#PED-14238).\n- crypto: qat - add support for decompression service to GEN6 devices (jsc#PED-14238).\n- crypto: qat - consolidate service enums (jsc#PED-14238).\n- crypto: qat - Constify struct pm_status_row (jsc#PED-14238).\n- crypto: qat - disable 4xxx AE cluster when lead engine is fused off (git-fixes).\n- crypto: qat - disable 420xx AE cluster when lead engine is fused off (git-fixes).\n- crypto: qat - do not export adf_cfg_services (jsc#PED-14238).\n- crypto: qat - enable power management debugfs for GEN6 devices (jsc#PED-14238).\n- crypto: qat - enable RAS support for GEN6 devices (jsc#PED-14238).\n- crypto: qat - enable rate limiting feature for GEN6 devices (jsc#PED-14238).\n- crypto: qat - enable reporting of error counters for GEN6 devices (jsc#PED-14238).\n- crypto: qat - enable telemetry for GEN6 devices (jsc#PED-14238).\n- crypto: qat - export adf_get_service_mask() (jsc#PED-14238).\n- crypto: qat - export adf_init_admin_pm() (jsc#PED-14238).\n- crypto: qat - expose configuration functions (jsc#PED-14238).\n- crypto: qat - fix compression instance leak (git-fixes).\n- crypto: qat - fix IRQ cleanup on 6xxx probe failure (git-fixes).\n- crypto: qat - fix object goals in Makefiles (jsc#PED-14238.\n- crypto: qat - fix type mismatch in RAS sysfs show functions (git-fixes).\n- crypto: qat - Fix typo \"accelaration\" (jsc#PED-14238).\n- crypto: qat - fix virtual channel configuration for GEN6 devices (jsc#PED-14238).\n- crypto: qat - include qat_common in top Makefile (jsc#PED-14238).\n- crypto: qat - introduce fuse array (jsc#PED-14238).\n- crypto: qat - make adf_dev_autoreset() static (jsc#PED-14238).\n- crypto: qat - optimize allocations for fw authentication (jsc#PED-14238).\n- crypto: qat - refactor compression template logic (jsc#PED-14238).\n- crypto: qat - refactor FW signing algorithm (jsc#PED-14238).\n- crypto: qat - refactor ring-related debug functions (jsc#PED-14238).\n- crypto: qat - refactor service parsing logic (jsc#PED-14238).\n- crypto: qat - relocate and rename bank state structure definition (jsc#PED-14238).\n- crypto: qat - relocate bank state helper functions (jsc#PED-14238).\n- crypto: qat - relocate power management debugfs helper APIs (jsc#PED-14238).\n- crypto: qat - relocate service related functions (jsc#PED-14238).\n- crypto: qat - remove BITS_IN_DWORD() (jsc#PED-14238).\n- crypto: qat - Remove dst_null support (jsc#PED-14238).\n- crypto: qat - remove duplicate masking for GEN6 devices (jsc#PED-14238).\n- crypto: qat - remove initialization in device class (jsc#PED-14238).\n- crypto: qat - remove redundant FW image size check (jsc#PED-14238).\n- crypto: qat - remove unused adf_devmgr_get_first (jsc#PED-14238).\n- crypto: qat - remove unused members in suof structure (jsc#PED-14238).\n- crypto: qat - rename and relocate timer logic (jsc#PED-14238).\n- crypto: qat - reorder objects in qat_common Makefile (jsc#PED-14238).\n- crypto: qat - replace CHECK_STAT macro with static inline function (jsc#PED-14238).\n- crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() (jsc#PED-14238).\n- crypto: qat - restore ASYM service support for GEN6 devices (jsc#PED-14238).\n- crypto: qat - Return pointer directly in adf_ctl_alloc_resources (jsc#PED-14238).\n- crypto: qat - set command ids as reserved (jsc#PED-14238).\n- crypto: qat - switch to standard pattern for PCI IDs (jsc#PED-14238).\n- crypto: qat - update firmware api (jsc#PED-14238).\n- crypto: qat - use pr_fmt() in adf_gen4_hw_data.c (jsc#PED-14238).\n- crypto: qat - use pr_fmt() in qat uclo.c (jsc#PED-14238).\n- crypto: qat - use simple_strtoull to improve qat_uclo_parse_num (jsc#PED-14238).\n- crypto: qat - use swab32 macro (git-fixes).\n- crypto: qat - validate service in rate limiting sysfs api (jsc#PED-14238).\n- crypto: qat/qat_6xxx - Fix NULL vs IS_ERR() check in adf_probe() (jsc#PED-14238).\n- crypto: sa2ul - Fix AEAD fallback algorithm names (git-fixes).\n- crypto: simd - reject compat registrations without __ prefixes (git-fixes).\n- crypto: talitos - fix SEC1 32k ahash request limitation (git-fixes).\n- crypto: tegra - Disable softirqs before finalizing request (git-fixes).\n- devres: fix missing node debug info in devm_krealloc() (git-fixes).\n- dmaengine: dw-axi-dmac: fix Alignment should match open parenthesis (git-fixes).\n- dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function (git-fixes).\n- dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() (git-fixes).\n- dpll: zl3073x: Add support to adjust phase (bsc#1255752).\n- dpll: zl3073x: Fix output pin phase adjustment sign (bsc#1255752).\n- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (bsc#1255752).\n- dpll: zl3073x: Specify phase adjustment granularity for pins (bsc#1255752).\n- drivers/base/memory: fix memory block reference leak in poison accounting (git-fixes).\n- drm/amd/display: Add NULL check for integrated_info in clk_mgr_construct (git-fixes).\n- drm/amd/display: Allow DCE link encoder without AUX registers (git-fixes).\n- drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths (git-fixes).\n- drm/amd/display: Change dither policy for 10 bpc output back to dithering (git-fixes).\n- drm/amd/display: Correct logic check error for fastboot (git-fixes).\n- drm/amd/display: Disable 10-bit truncation and dithering on DCE 6.x (git-fixes).\n- drm/amd/display: Disable fastboot on DCE 6 too (stable-fixes).\n- drm/amd/display: Read EDID from VBIOS embedded panel info (git-fixes).\n- drm/amd/pm/ci: Clear EnabledForActivity field for memory levels (git-fixes).\n- drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs (git-fixes).\n- drm/amd/pm/ci: Fill DW8 fields from SMC (git-fixes).\n- drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 (git-fixes).\n- drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled (git-fixes).\n- drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board (git-fixes).\n- drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock (git-fixes).\n- drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x (git-fixes).\n- drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) (git-fixes).\n- drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ (stable-fixes).\n- drm/amdgpu/gfx10: look at the right prop for gfx queue priority (git-fixes).\n- drm/amdgpu/gfx11: look at the right prop for gfx queue priority (git-fixes).\n- drm/amdgpu/gmc: Fix AMDGPU_GART_PLACEMENT_LOW to not overlap with VRAM (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.5 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.0 ring (git-fixes).\n- drm/amdgpu/pm: add missing revision check for CI (git-fixes).\n- drm/amdgpu/pm: align Hawaii mclk workaround with radeon (git-fixes).\n- drm/amdgpu/pm: drop SMU driver if version not matched messages (stable-fixes).\n- drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission (git-fixes).\n- drm/amdgpu/vce: Prevent partial address patches (stable-fixes).\n- drm/amdgpu/vcn3: Avoid overflow on msg bound check (git-fixes).\n- drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (stable-fixes).\n- drm/amdgpu/vcn4: Avoid overflow on msg bound check (git-fixes).\n- drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (stable-fixes).\n- drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (stable-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v4.0.5 enc ring (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v5.0.0 enc ring (git-fixes).\n- drm/amdgpu: Add bounds checking to ib_{get,set}_value (stable-fixes).\n- drm/amdgpu: Add default case in DVI mode validation (git-fixes).\n- drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG (git-fixes).\n- drm/amdgpu: fix zero-size GDS range init on RDNA4 (stable-fixes).\n- drm/amdgpu: gate VM CPU HDP flush on reset lock (stable-fixes).\n- drm/amdgpu: replace PASID IDR with XArray (git-fixes).\n- drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count (stable-fixes).\n- drm/amdgpu: zero-initialize GART table on allocation (stable-fixes).\n- drm/amdkfd: Add upper bound check for num_of_nodes (stable-fixes).\n- drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure (stable-fixes).\n- drm/amdkfd: Make all TLB-flushes heavy-weight (stable-fixes).\n- drm/amdkfd: validate SVM ioctl nattr against buffer size (stable-fixes).\n- drm/arcpgu: fix device node leak (git-fixes).\n- drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs (git-fixes).\n- drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check (git-fixes).\n- drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() (git-fixes).\n- drm/bridge: stm_lvds: Do not fail atomic_check on disabled connector (git-fixes).\n- drm/etnaviv: Fix armed job not being pushed to the DRM scheduler (git-fixes).\n- drm/exynos: remove bridge when component_add fails (git-fixes).\n- drm/fb-helper: Fix clipping when damage area spans a single scanline (git-fixes).\n- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (git-fixes).\n- drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup (git-fixes).\n- drm/gma500/oaktrail_lvds: fix hang on init failure (git-fixes).\n- drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init (git-fixes).\n- drm/i915/dp: Fix VSC dynamic range signaling for RGB formats (git-fixes).\n- drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (git-fixes).\n- drm/i915/wm: Verify the correct plane DDB entry (git-fixes).\n- drm/i915: skip __i915_request_skip() for already signaled requests (git-fixes).\n- drm/imagination: Switch reset_reason fields from enum to u32 (git-fixes).\n- drm/komeda: fix integer overflow in AFBC framebuffer size check (git-fixes).\n- drm/loongson: Use managed KMS polling (git-fixes).\n- drm/msm/a6xx: Fix dumping A650+ debugbus blocks (git-fixes).\n- drm/msm/a6xx: Fix HLSQ register dumping (git-fixes).\n- drm/msm/a6xx: Use barriers while updating HFI Q headers (git-fixes).\n- drm/msm/dpu: fix mismatch between power and frequency (git-fixes).\n- drm/msm/dsi: add the missing parameter description (git-fixes).\n- drm/msm/dsi: fix bits_per_pclk (git-fixes).\n- drm/msm/dsi: fix hdisplay calculation for CMD mode panel (git-fixes).\n- drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 (git-fixes).\n- drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata() (git-fixes).\n- drm/msm/shrinker: Fix can_block() logic (git-fixes).\n- drm/nouveau: fix nvkm_device leak on aperture removal failure (git-fixes).\n- drm/nouveau: fix u32 overflow in pushbuf reloc bounds check (git-fixes).\n- drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds (git-fixes).\n- drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds (git-fixes).\n- drm/panel: sharp-ls043t1le01: make use of prepare_prev_first (git-fixes).\n- drm/panel: simple: Correct G190EAN01 prepare timing (git-fixes).\n- drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() (git-fixes).\n- drm/panthor: Fix outdated function documentation (git-fixes).\n- drm/radeon: add missing revision check for CI (git-fixes).\n- drm/sun4i: backend: fix error pointer dereference (git-fixes).\n- drm/sun4i: Fix resource leaks (git-fixes).\n- drm/v3d: Handle error from drm_sched_entity_init() (git-fixes).\n- drm/vc4: Fix a memory leak in hang state error path (git-fixes).\n- drm/vc4: Fix memory leak of BO array in hang state (git-fixes).\n- drm/vc4: platform_get_irq_byname() returns an int (stable-fixes).\n- drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock (git-fixes).\n- drm/vc4: Release runtime PM reference after binding V3D (git-fixes).\n- drm/vram: remove DRM_VRAM_MM_FILE_OPERATIONS from docs (git-fixes).\n- drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked() (git-fixes).\n- drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked() (git-fixes).\n- drm/xe/debugfs: Correct printing of register whitelist ranges (git-fixes).\n- drm/xe/dma-buf: handle empty bo and UAF races (git-fixes).\n- drm/xe/gsc: Fix BO leak on error in query_compatibility_version() (git-fixes).\n- drm/xe/uapi: update used tracking kernel-doc (git-fixes).\n- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (git-fixes).\n- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (git-fixes).\n- dt-bindings: net: Fix Tegra234 MGBE PTP clock (git-fixes).\n- efi/capsule-loader: fix incorrect sizeof in phys array reallocation (git-fixes).\n- efi: pstore: Drop efivar lock when efi_pstore_open() returns with an error (git-fixes).\n- erofs: add GFP_NOIO in the bio completion if needed (git-fixes).\n- ext4: fix fsync(2) for nojournal mode (git-fixes).\n- ext4: make recently_deleted() properly work with lazy itable initialization (git-fixes).\n- ext4: reject mount if bigalloc with s_first_data_block != 0 (git-fixes).\n- extcon: Fixed sysfs duplicate filename issue (git-fixes).\n- extcon: ptn5150: handle pending IRQ events during system resume (git-fixes).\n- fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break (git-fixes).\n- fbdev: offb: fix PCI device reference leak on probe failure (git-fixes).\n- fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO (stable-fixes).\n- fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO (git-fixes).\n- firmware: arm_ffa: Use the correct buffer size during RXTX_MAP (git-fixes).\n- firmware: dmi: Correct an indexing error in dmi.h (git-fixes).\n- firmware: google: framebuffer: Do not mark framebuffer as busy (git-fixes).\n- firmware: google: framebuffer: Do not unregister platform device (git-fixes).\n- gpio: of: clear OF_POPULATED on hog nodes in remove path (git-fixes).\n- gpio: tegra: fix irq_release_resources calling enable instead of disable (git-fixes).\n- gtp: disable BH before calling udp_tunnel_xmit_skb() (git-fixes).\n- HID: alps: fix NULL pointer dereference in alps_raw_event() (git-fixes).\n- HID: amd_sfh: don't log error when device discovery fails with -EOPNOTSUPP (git-fixes).\n- HID: apple: ensure the keyboard backlight is off if suspending (git-fixes).\n- HID: asus: do not abort probe when not necessary (git-fixes).\n- HID: asus: make asus_resume adhere to linux kernel coding standards (git-fixes).\n- HID: core: clamp report_size in s32ton() to avoid undefined shift (stable-fixes).\n- HID: logitech-hidpp: Enable MX Master 4 over bluetooth (stable-fixes).\n- HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure (stable-fixes).\n- HID: multitouch: Check to ensure report responses match the request (stable-fixes).\n- HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 (stable-fixes).\n- HID: roccat: fix use-after-free in roccat_report_event (stable-fixes).\n- HID: usbhid: fix deadlock in hid_post_reset() (git-fixes).\n- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (stable-fixes).\n- hisi_acc_vfio_pci: add eq and aeq interruption restore (git-fixes).\n- hisi_acc_vfio_pci: bugfix cache write-back issue (git-fixes).\n- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (git-fixes).\n- hv_sock: fix ARM64 support (git-fixes).\n- hv_sock: update outdated comment for renamed vsock_stream_recvmsg() (git-fixes).\n- hwmon: (ads7871) Fix endianness bug in 16-bit register reads (git-fixes).\n- hwmon: (corsair-psu) Close HID device on probe errors (git-fixes).\n- hwmon: (lm63) Add locking to avoid TOCTOU (git-fixes).\n- hwmon: (ltc2992) Clamp threshold writes to hardware range (git-fixes).\n- hwmon: (ltc2992) Fix u32 overflow in power read path (git-fixes).\n- hwmon: (ltc4286) Add missing MODULE_IMPORT_NS(\"PMBUS\") (git-fixes).\n- hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt (git-fixes).\n- hwmon: (powerz) Fix use-after-free on USB disconnect (git-fixes).\n- hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data() (git-fixes).\n- i2c: s3c24xx: check the size of the SMBUS message before using it (stable-fixes).\n- i2c: smbus: reject oversized block transfers in the common path (git-fixes).\n- i2c: stm32f7: reinit_completion() per transfer not per msg (git-fixes).\n- i2c: stub: Reject I2C block transfers with invalid length (git-fixes).\n- i2c: tegra: Add HS mode support (bsc#1261550).\n- i2c: tegra: Add Tegra256 support (bsc#1261550).\n- i2c: tegra: Do not configure DMA if not supported (bsc#1261550).\n- i2c: tegra: Don't mark devices with pins as IRQ safe (stable-fixes).\n- i2c: tegra: Update Tegra256 timing parameters (bsc#1261550).\n- i2c: tegra: Use separate variables for fast and fastplus (bsc#1261550).\n- i3c: dw: Fix memory leak in dw_i3c_master_i3c_xfers() (git-fixes).\n- i3c: master: Fix error codes at send_ccc_cmd (git-fixes).\n- i3c: mipi-i3c-hci: fix IBI payload length calculation for final status (git-fixes).\n- ibmveth: Disable GSO for packets with small MSS (bsc#1265144).\n- iio: adc: ad7192: Revert \"properly check spi_get_device_match_data()\" (stable-fixes).\n- iio: adc: ad7768-1: fix one-shot mode data acquisition (git-fixes).\n- iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() (git-fixes).\n- iio: frequency: admv1013: add dev variable (stable-fixes).\n- iio: frequency: admv1013: fix NULL pointer dereference on str (git-fixes).\n- Input: bcm5974 - recover from failed mode switch (stable-fixes).\n- Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table (stable-fixes).\n- Input: uinput - fix circular locking dependency with ff-core (git-fixes).\n- Input: uinput - take event lock when submitting FF request \"event\" (stable-fixes).\n- Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode (stable-fixes).\n- Input: xpad - add support for Razer Wolverine V3 Pro (stable-fixes).\n- interconnect: debugfs: fix devm_kstrdup and kfree mismatch (git-fixes).\n- io_uring/timeout: check unused sqe fields (git-fixes).\n- iommu/amd: move wait_on_sem() out of spinlock (git-fixes bsc#1260593).\n- iommu/amd: serialize sequence allocation under concurrent TLB invalidations (git-fixes bsc#1260593).\n- iommu/vt-d: Remove LPIG from page group response descriptor (jsc#PED-16113).\n- ipmi: Add limits to event and receive message requests (git-fixes).\n- ipmi: Check event message buffer response for bad data (git-fixes).\n- ipmi: ssif_bmc: change log level to dbg in irq callback (git-fixes).\n- ipmi: ssif_bmc: fix message desynchronization after truncated response (git-fixes).\n- ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure (git-fixes).\n- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (git-fixes).\n- KVM: arm64: Allow cacheable stage 2 mapping using VMA flags (git-fixes).\n- KVM: arm64: Assume non-PFNMAP/MIXEDMAP VMAs can be mapped cacheable (git-fixes).\n- KVM: arm64: Block cacheable PFNMAP mapping (git-fixes).\n- KVM: arm64: Consolidate idreg callbacks (git-fixes).\n- KVM: arm64: Discard PC update state on vcpu reset (git-fixes).\n- KVM: arm64: Finalize ID registers only once per VM (git-fixes).\n- KVM: arm64: Fix MTE flag initialization for protected VMs (git-fixes).\n- KVM: arm64: Fix page leak in user_mem_abort() (git-fixes).\n- KVM: arm64: Fix Trace Buffer trap polarity for protected VMs (git-fixes).\n- KVM: arm64: Fix Trace Buffer trapping for protected VMs (git-fixes).\n- KVM: arm64: Fix vma_shift staleness on nested hwpoison path (git-fixes).\n- KVM: arm64: Hide S1POE from guests when not supported by the host (git-fixes).\n- KVM: arm64: Limit clearing of ID_{AA64PFR0,PFR1}_EL1.GIC to userspace irqchip (git-fixes).\n- KVM: arm64: Make all 32bit ID registers fully writable (git-fixes).\n- KVM: arm64: nv: Add trap config for DBGWCR\u003c15\u003e_EL1 (git-fixes).\n- KVM: arm64: nv: Return correct RES0 bits for FGT registers (git-fixes).\n- KVM: arm64: pkvm: Fallback to level-3 mapping on host stage-2 fault (git-fixes).\n- KVM: arm64: Read PMUVer as unsigned (git-fixes).\n- KVM: arm64: Rename the device variable to s2_force_noncacheable (git-fixes).\n- KVM: arm64: Return early from trace helpers when KVM isn't available (git-fixes).\n- KVM: arm64: Set ID_{AA64PFR0,PFR1}_EL1.GIC when GICv3 is configured (git-fixes).\n- KVM: arm64: vgic-v3: Release reserved slot outside of lpi_xa's lock (git-fixes).\n- KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes).\n- KVM: nSVM: Use vcpu-\u003earch.cr2 when updating vmcb12 on nested #VMEXIT (git-fixes).\n- KVM: nVMX: Add consistency check for TSC_MULTIPLIER=0 (git-fixes).\n- KVM: Reject wrapped offset in kvm_reset_dirty_gfn() (git-fixes).\n- KVM: SEV: Disallow LAUNCH_FINISH if vCPUs are actively being created (git-fixes).\n- KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (git-fixes).\n- KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish (git-fixes).\n- KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm-\u003elock (git-fixes).\n- KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU (git-fixes).\n- KVM: SVM: Disallow EFER.LMSLE when not supported by hardware (git-fixes).\n- KVM: SVM: Fix a missing kunmap_local() in sev_gmem_post_populate() (git-fixes).\n- KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC (git-fixes).\n- KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (git-fixes).\n- KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN (git-fixes).\n- KVM: SVM: Properly check RAX in the emulator for SVM instructions (git-fixes).\n- KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (git-fixes).\n- KVM: TDX: Explicitly set user-return MSRs that *may* be clobbered by the TDX-Module (git-fixes).\n- KVM: x86/mmu: Fix UBSAN warning when reading nx_huge_pages parameter (git-fixes).\n- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (git-fixes).\n- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (git-fixes).\n- KVM: x86: Advertise EferLmsleUnsupported to userspace (git-fixes).\n- KVM: x86: check for nEPT/nNPT in slow flush hypercalls (git-fixes).\n- KVM: X86: Fix array_index_nospec protection in __pv_send_ipi (git-fixes).\n- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (git-fixes).\n- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (git-fixes).\n- KVM: x86: Ignore cpuid faulting in SMM (git-fixes).\n- leds: lgm-sso: Remove duplicate assignments for priv-\u003emmap (git-fixes).\n- leds: qcom-lpg: Check for array overflow when selecting the high resolution (stable-fixes).\n- lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() (git-fixes).\n- md/raid1: fix the comparing region of interval tree (bsc#1261555).\n- md/raid1: serialize overlap io for writemostly disk (bsc#1261555).\n- media: amphion: Fix race between m2m job_abort and device_run (git-fixes).\n- media: as102: fix to not free memory after the device is registered in as102_usb_probe() (git-fixes).\n- media: chips-media: wave5: add missing spinlock protection for handle_dynamic_resolution_change() (git-fixes).\n- media: chips-media: wave5: add missing spinlock protection for send_eos_event() (git-fixes).\n- media: chips-media: wave5: fix a potential memory leak in wave5_vdi_init() (git-fixes).\n- media: dib8000: avoid division by 0 in dib8000_set_dds() (git-fixes).\n- media: em28xx: fix use-after-free in em28xx_v4l2_open() (git-fixes).\n- media: hackrf: fix to not free memory after the device is registered in hackrf_probe() (git-fixes).\n- media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() (git-fixes).\n- media: i2c: imx283: Enter full standby when stopping streaming (git-fixes).\n- media: i2c: imx283: Fix hang when going from large to small resolution (git-fixes).\n- media: i2c: imx412: Assert reset GPIO during probe (git-fixes).\n- media: i2c: ov08d10: fix image vertical start setting (git-fixes).\n- media: i2c: ov8856: free control handler on error in ov8856_init_controls() (git-fixes).\n- media: intel/ipu6: fix error pointer dereference (git-fixes).\n- media: mtk-jpeg: fix use-after-free in release path due to uncancelled work (git-fixes).\n- media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 (git-fixes).\n- media: omap3isp: drop the use count of v4l2 pipeline (git-fixes).\n- media: pci: zoran: fix potential memory leak in zoran_probe() (git-fixes).\n- media: rc: streamzap: Error handling in probe (git-fixes).\n- media: rc: xbox_remote: heed DMA restrictions (git-fixes).\n- media: saa7164: add ioremap return checks and cleanups (git-fixes).\n- media: staging: imx: configure src_mux in csi_start (git-fixes).\n- media: staging: imx: request mbus_config in csi_start (git-fixes).\n- media: uvcvideo: Enable VB2_DMABUF for metadata stream (git-fixes).\n- media: videobuf2: Set vma_flags in vb2_dma_sg_mmap (git-fixes).\n- media: vidtv: fix nfeeds state corruption on start_streaming failure (git-fixes).\n- media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections (git-fixes).\n- media: vidtv: fix pass-by-value structs causing MSAN warnings (git-fixes).\n- memory: tegra30-emc: Fix dll_change check (git-fixes).\n- memory: tegra124-emc: Fix dll_change check (git-fixes).\n- mfd: core: Preserve OF node when ACPI handle is present (git-fixes).\n- mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() (git-fixes).\n- mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused (git-fixes).\n- mkspec: Add signature to source list only when it exists.\n- mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration (git-fixes).\n- mmc: vub300: fix NULL-deref on disconnect (git-fixes).\n- modpost: Amend ppc64 save/restfpr symnames for -Os build (bsc#1215199).\n- mtd: docg3: fix use-after-free in docg3_release() (git-fixes).\n- mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions (git-fixes).\n- mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path (git-fixes).\n- mtd: physmap_of_gemini: Fix disabled pinctrl state check (git-fixes).\n- mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob (git-fixes).\n- mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations (git-fixes).\n- mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() (git-fixes).\n- mtd: spi-nor: sst: Fix write enable before AAI sequence (git-fixes).\n- mtd: spi-nor: swp: check SR_TB flag when getting tb_mask (git-fixes).\n- net-shapers: don't free reply skb after genlmsg_reply() (git-fixes).\n- net/mlx5: Fix HCA caps leak on notifier init failure (git-fixes).\n- net/rds: reset op_nents when zerocopy page pin fails (bsc#1265626).\n- net/sched: cls_fw: fix NULL dereference of \"old\" filters before change() (git-fixes).\n- net/sched: fix pedit partial COW leading to page cache corruption (bsc#1265421).\n- net: gro: don't merge zcopy skbs (git-fixes).\n- net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf (git-fixes).\n- net: mana: Add MAC address to vPort logs and clarify error messages (git-fixes).\n- net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq() (git-fixes).\n- net: mana: Don't overwrite port probe error with add_adev result (git-fixes).\n- net: mana: Fix crash from unvalidated SHM offset read from BAR0 during FLR (bsc#1265846).\n- net: mana: Fix EQ leak in mana_remove on NULL port (git-fixes).\n- net: mana: Fix RX skb truesize accounting (bsc#1248754).\n- net: mana: Guard mana_remove against double invocation (git-fixes).\n- net: mana: hardening: Validate adapter_mtu from MANA_QUERY_DEV_CONFIG (git-fixes).\n- net: mana: hardening: Validate doorbell ID from GDMA_REGISTER_DEVICE response (git-fixes).\n- net: mana: Init gf_stats_work before potential error paths in probe (git-fixes).\n- net: mana: Init link_change_work before potential error paths in probe (git-fixes).\n- net: mana: Move current_speed debugfs file to mana_init_port() (git-fixes).\n- net: mana: remove double CQ cleanup in mana_create_rxq error path (git-fixes).\n- net: mana: Set default number of queues to 16 (bsc#1261648).\n- net: mana: Skip WQ object destruction for uninitialized RXQ (git-fixes).\n- net: mana: Use at least SZ_4K in doorbell ID range check (git-fixes).\n- net: mana: Use pci_name() for debugfs directory naming (git-fixes).\n- net: phy: broadcom: Save PHY counters during suspend (git-fixes).\n- net: phy: DP83TC811: add reading of abilities (git-fixes).\n- net: phy: dp83869: fix setting CLK_O_SEL field (git-fixes).\n- net: phy: fix a return path in get_phy_c45_ids() (git-fixes).\n- net: phy: qcom: at803x: Use the correct bit to disable extended next page (git-fixes).\n- net: stmmac: Fix PTP ref clock for Tegra234 (git-fixes).\n- net: usb: asix: ax88772: re-add usbnet_link_change() in phylink callbacks (git-fixes).\n- net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() (git-fixes).\n- net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() (git-fixes).\n- net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit (git-fixes).\n- net: wan: fsl_ucc_hdlc: fix ucc_hdlc_remove (git-fixes).\n- net: wan: fsl_ucc_hdlc: fix uhdlc_memclean (git-fixes).\n- net: wan: fsl_ucc_hdlc: free tx_skbuff in uhdlc_memclean (git-fixes).\n- net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler (git-fixes).\n- NFC: digital: Bounds check NFC-A cascade depth in SDD response handler (git-fixes).\n- nfc: llcp: add missing return after LLCP_CLOSED checks (git-fixes).\n- nfc: pn533: allocate rx skb before consuming bytes (git-fixes).\n- nfc: s3fwrn5: allocate rx skb before consuming bytes (git-fixes).\n- NFC: trf7970a: Ignore antenna noise when checking for RF field (git-fixes).\n- nvme-apple: drop invalid put of admin queue reference count (git-fixes).\n- nvme-auth: Include SC_C in RVAL controller hash (bsc#1260428).\n- nvme-loop: do not cancel I/O and admin tagset during ctrl reset/shutdown (bsc#1262709).\n- nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 (git-fixes).\n- nvme: Allow reauth from sysfs (bsc#1259672).\n- nvme: Expose the tls_configured sysfs for secure concat connections (bsc#1259672).\n- nvme: expose TLS mode (bsc#1259672).\n- nvme: fix admin queue leak on controller reset (git-fixes).\n- nvme: fix PCIe subsystem reset controller state transition (bsc#1261738).\n- nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers (git-fixes).\n- ocfs2: fix possible deadlock between unlink and dio_end_io_write (bsc#1258718).\n- ocfs2: split transactions in dio completion to avoid credit exhaustion (bsc#1258718).\n- openvswitch: vport: fix self-deadlock on release of tunnel ports (git-fixes).\n- panic/printk: replace other_cpu_in_panic() with panic_on_other_cpu() (bsc#1261149).\n- panic/printk: replace this_cpu_in_panic() with panic_on_this_cpu() (bsc#1261149).\n- panic: introduce helper functions for panic state (bsc#1261149).\n- panic: use angle-bracket include for panic.h (bsc#1261149).\n- PCI/AER: Clear only error bits in PCIe Device Status (git-fixes).\n- PCI/AER: Stop ruling out unbound devices as error source (git-fixes).\n- PCI/ASPM: Fix pci_clear_and_set_config_dword() usage (git-fixes).\n- PCI/NPEM: Set LED_HW_PLUGGABLE for hotplug-capable ports (git-fixes).\n- PCI/TPH: Allow TPH enable for RCiEPs (git-fixes).\n- PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well (git-fixes).\n- PCI: dwc: rcar-gen4: Change EPC BAR alignment to 4K as per the documentation (git-fixes).\n- PCI: Enable AtomicOps only if Root Port supports them (git-fixes).\n- PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown (git-fixes).\n- PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup (git-fixes).\n- PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete (git-fixes).\n- PCI: hv: Set default NUMA node to 0 for devices without affinity info (bsc#1261648).\n- PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found (git-fixes).\n- PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion support (git-fixes).\n- PCI: tegra194: Allow system suspend when the Endpoint link is not up (git-fixes).\n- PCI: tegra194: Disable direct speed change for Endpoint mode (git-fixes).\n- PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down (git-fixes).\n- PCI: tegra194: Disable PERST# IRQ only in Endpoint mode (git-fixes).\n- PCI: tegra194: Fix CBB timeout caused by DBI access before core power-on (git-fixes).\n- PCI: tegra194: Fix polling delay for L2 state (git-fixes).\n- PCI: tegra194: Free up Endpoint resources during remove() (git-fixes).\n- PCI: tegra194: Increase LTSSM poll time on surprise link down (git-fixes).\n- PCI: tegra194: Set LTR message request before PCIe link up in Endpoint mode (git-fixes).\n- PCI: tegra194: Use devm_gpiod_get_optional() to parse \"nvidia,refclk-select\" (git-fixes).\n- PCI: tegra194: Use DWC IP core version (git-fixes).\n- pinctrl: abx500: Fix type of 'argument' variable (git-fixes).\n- pinctrl: Fix spelling problem (git-fixes).\n- pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) (stable-fixes).\n- pinctrl: pic32: change all cases of bare 'unsigned' to 'unsigned int' (git-fixes).\n- pinctrl: pic32: use consistent spacing around '+' (git-fixes).\n- pinctrl: pinctrl-pic32: Fix resource leak (git-fixes).\n- pinctrl: realtek: Fix function signature for config argument (git-fixes).\n- pinctrl: renesas: rzg2l: Fix save/restore of {IOLH,IEN,PUPD,SMT} registers (git-fixes).\n- platform/chrome: chromeos_tbmc: Drop wakeup source on remove (git-fixes).\n- platform/surface: surfacepro3_button: Drop wakeup source on remove (git-fixes).\n- platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug (stable-fixes).\n- platform/x86/intel-uncore-freq: Handle autonomous UFS status bit (git-fixes).\n- platform/x86: asus-wmi: adjust screenpad power/brightness handling (git-fixes).\n- platform/x86: asus-wmi: fix screenpad brightness range (git-fixes).\n- platform/x86: dell-wmi-sysman: bound enumeration string aggregation (git-fixes).\n- platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() (git-fixes).\n- platform/x86: hp-wmi: Ignore backlight and FnLock events (stable-fixes).\n- platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup (git-fixes).\n- power: supply: axp288_charger: Do not cancel work before initializing it (git-fixes).\n- power: supply: max17042: avoid overflow when determining health (git-fixes).\n- powerpc/crash: fix backup region offset update to elfcorehdr (bsc#1259535).\n- powerpc/crash: Update backup region offset in elfcorehdr on memory hotplug (bsc#1259535).\n- printk/nbcon/panic: Allow printk kthread to sleep when the system is in panic (bsc#1261149).\n- printk/nbcon: Block printk kthreads when any CPU is in an emergency context (bsc#1261149).\n- printk/nbcon: Release nbcon consoles ownership in atomic flush after each emitted record (bsc#1261149).\n- printk/nbcon: Restore IRQ in atomic flush after each emitted record (bsc#1261149).\n- printk/nbcon: use panic_on_this_cpu() helper (bsc#1261149).\n- printk: Allow printk_trigger_flush() to flush all types (bsc#1262750).\n- printk: Allow to use the printk kthread immediately even for 1st nbcon (jsc#PED-7912).\n- printk: Avoid irq_work for printk_deferred() on suspend (bsc#1262750).\n- printk: Avoid scheduling irq_work on suspend (bsc#1262750).\n- printk: console_flush_one_record() code cleanup (bsc#1261149).\n- printk: Introduce console_flush_one_record (bsc#1261149).\n- printk: Use console_flush_one_record for legacy printer kthread (bsc#1261149).\n- pwm: imx-tpm: Count the number of enabled channels in probe (git-fixes).\n- qat: don't mess with -\u003ed_name (jsc#PED-14238).\n- r8152: fix incorrect register write to USB_UPHY_XTAL (git-fixes).\n- RDMA/irdma: Fix double free related to rereg_user_mr (git-fixes).\n- RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() (git-fixes).\n- RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() (git-fixes).\n- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (git-fixes).\n- RDMA/mana: Validate rx_hash_key_len (git-fixes).\n- RDMA/mana_ib: cleanup the usage of mana_gd_send_request() (git-fixes).\n- RDMA/mana_ib: Disable RX steering on RSS QP destroy (git-fixes).\n- RDMA/mana_ib: Support memory windows (git-fixes).\n- regulator: act8945a: fix OF node reference imbalance (git-fixes).\n- regulator: bd9571mwv: fix OF node reference imbalance (git-fixes).\n- regulator: max77650: fix OF node reference imbalance (git-fixes).\n- regulator: mt6357: fix OF node reference imbalance (git-fixes).\n- regulator: rk808: fix OF node reference imbalance (git-fixes).\n- remoteproc: xlnx: Fix sram property parsing (git-fixes).\n- remoteproc: xlnx: Only access buffer information if IPI is buffered (git-fixes).\n- Revert \"ALSA: usb: Increase volume range that triggers a warning\" (git-fixes).\n- Revert \"serial: 8250: Revert \"drop lockdep annotation from serial8250_clear_IER()\"\" (bsc#1262480).\n- Revert \"serial: 8250: Switch to nbcon console\" (bsc#1262480).\n- rtc: abx80x: Disable alarm feature if no interrupt attached (git-fixes).\n- rtc: ntxec: fix OF node reference imbalance (git-fixes).\n- s390/dasd: Copy detected format information to secondary device (bsc#1259994).\n- s390/dasd: Fix gendisk parent after copy pair swap (bsc#1259994).\n- s390/dasd: Move quiesce state with pprc swap (bsc#1259994).\n- sched/fair: Change likelyhood of nohz.nr_cpus (bsc#1234634 bsc#1258961).\n- sched/fair: Move checking for nohz cpus after time check (bsc#1234634 bsc#1258961).\n- sched/fair: Remove nohz.nr_cpus and use weight of cpumask instead (bsc#1234634 bsc#1258961).\n- scsi: lpfc: Add clean up of aborted NVMe commands during PCI fcn reset (bsc#1262019).\n- scsi: lpfc: Add log messages to fabric login error labels (bsc#1262019).\n- scsi: lpfc: Add PCI ID support for LPe42100 series adapters (bsc#1262019).\n- scsi: lpfc: Add REG_VFI mailbox cmd error handling (bsc#1262019).\n- scsi: lpfc: Break out of IRQ affinity assignment when mask reaches nr_cpu_ids (bsc#1262019).\n- scsi: lpfc: Check ASIC_ID register to aid diagnostics during failed fw updates (bsc#1262019).\n- scsi: lpfc: Cleanup error exit paths in lpfc_fdmi_cmd() and associated messages (bsc#1262019).\n- scsi: lpfc: ELIMINATE kernel-doc warnings in lpfc.h (bsc#1262019).\n- scsi: lpfc: Fix incorrect txcmplq_cnt during cleanup in lpfc_sli_abort_ring() (bsc#1262019).\n- scsi: lpfc: Introduce 128G link speed selection and support (bsc#1262019).\n- scsi: lpfc: Log discarded and insufficient RQE buffer events (bsc#1262019).\n- scsi: lpfc: Log MCQE contents for mbox commands with no context (bsc#1262019).\n- scsi: lpfc: Properly set WC for DPP mapping (bsc#1262019).\n- scsi: lpfc: Reduce pointer chasing when accessing vmid_flag (bsc#1262019).\n- scsi: lpfc: Remove deprecated PBDE feature (bsc#1262019).\n- scsi: lpfc: Remove unnecessary ndlp kref get in lpfc_check_nlp_post_devloss (bsc#1262019).\n- scsi: lpfc: Restrict first burst to non-FCoE and SLI4 adapters only (bsc#1262019).\n- scsi: lpfc: Select mailbox rq_create cmd version based on SLI4 if_type (bsc#1262019).\n- scsi: lpfc: Update class of service bit field to 3 bits for WQE submissions (bsc#1262019).\n- scsi: lpfc: Update construction of SGL when XPSGL is enabled (bsc#1262019).\n- scsi: lpfc: Update copyright year string for 2026 (bsc#1262019).\n- scsi: lpfc: Update log message when ndlp kref get is unsuccessful (bsc#1262019).\n- scsi: lpfc: Update lpfc version to 14.4.0.14 (bsc#1262019).\n- scsi: lpfc: Update lpfc version to 15.0.0.0 (bsc#1262019).\n- scsi: lpfc: Update outdated comment for renamed lpfc_freenode() (bsc#1262019).\n- scsi: lpfc: Use min_t() instead of min() in lpfc_sli4_driver_resource_setup (bsc#1262019).\n- scsi: lpfc: Use the crc32c() function (bsc#1262019).\n- scsi: mpi3mr: Add NULL checks when resetting request and reply queues (git-fixes).\n- scsi: ses: Fix devices attaching to different hosts (git-fixes).\n- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (git-fixes).\n- scsi: target: iscsi: validate CHAP_R length before base64 decode (bsc#1265449).\n- scsi: ufs: ufs-pci: Add support for Intel Wildcat Lake (jsc#PED-13771).\n- selftests/bpf: Test cross-sign 64bits range refinement (git-fixes).\n- selftests/bpf: Test invariants on JSLT crossing sign (git-fixes).\n- selftests/bpf: test refining u32/s32 bounds when ranges cross min/max boundary (git-fixes).\n- selftests: net: build net/lib dependency in all target (bsc#1262245).\n- selinux: don't reserve xattr slot when we won't fill it (stable-fixes).\n- selinux: prune /sys/fs/selinux/disable (stable-fixes).\n- selinux: shrink critical section in sel_write_load() (stable-fixes).\n- serial: 8250: Add serial8250_handle_irq_locked() (bsc#1262480).\n- serial: 8250: Protect LCR write in shutdown (bsc#1262480).\n- serial: 8250_dw: Avoid unnecessary LCR writes (bsc#1262480).\n- serial: 8250_dw: Ensure BUSY is deasserted (bsc#1262480).\n- serial: 8250_dw: Rework dw8250_handle_irq() locking and IIR handling (bsc#1262480).\n- serial: 8250_dw: Rework IIR_NO_INT handling to stop interrupt storm (bsc#1262480).\n- Set CONFIG_INTEL_TSX_MODE to follow upstream AUTO default (bsc#1263044).\n- soc/tegra: cbb: Set ERD on resume for err interrupt (git-fixes).\n- soc: qcom: aoss: compare against normalized cooling state (git-fixes).\n- soc: qcom: llcc: fix v1 SB syndrome register offset (git-fixes).\n- soc: qcom: ocmem: make the core clock optional (git-fixes).\n- soc: qcom: ocmem: register reasons for probe deferrals (git-fixes).\n- soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available (git-fixes).\n- sound: ua101: fix division by zero at probe (git-fixes).\n- soundwire: bus: demote UNATTACHED state warnings to dev_dbg() (git-fixes).\n- soundwire: cadence: Clear message complete before signaling waiting thread (git-fixes).\n- soundwire: debugfs: initialize firmware_file to empty string (git-fixes).\n- spi: aspeed-smc: fix controller deregistration (git-fixes).\n- spi: at91-usart: fix controller deregistration (git-fixes).\n- spi: atmel: fix controller deregistration (git-fixes).\n- spi: bcm63xx: fix controller deregistration (git-fixes).\n- spi: bcmbca-hsspi: fix controller deregistration (git-fixes).\n- spi: cadence: fix controller deregistration (git-fixes).\n- spi: cadence: fix unclocked access on unbind (git-fixes).\n- spi: ch341: fix memory leaks on probe failures (git-fixes).\n- spi: coldfire-qspi: fix controller deregistration (git-fixes).\n- spi: dln2: fix controller deregistration (git-fixes).\n- spi: fix controller cleanup() documentation (git-fixes).\n- spi: fix misleading controller deregistration kernel-doc (git-fixes).\n- spi: fix misleading controller registration kernel-doc (git-fixes).\n- spi: fsl-espi: fix controller deregistration (git-fixes).\n- spi: fsl-qspi: Use reinit_completion() for repeated operations (git-fixes).\n- spi: fsl: fix controller deregistration (git-fixes).\n- spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo (git-fixes).\n- spi: img-spfi: fix controller deregistration (git-fixes).\n- spi: imx: fix runtime pm leak on probe deferral (git-fixes).\n- spi: imx: fix use-after-free on unbind (git-fixes).\n- spi: lantiq-ssc: fix controller deregistration (git-fixes).\n- spi: meson-spicc: fix controller deregistration (git-fixes).\n- spi: microchip-core-qspi: fix controller deregistration (git-fixes).\n- spi: mpc52xx: fix controller deregistration (git-fixes).\n- spi: mpc52xx: fix use-after-free on registration failure (git-fixes).\n- spi: mpc52xx: fix use-after-free on unbind (git-fixes).\n- spi: mtk-nor: fix controller deregistration (git-fixes).\n- spi: mtk-snfi: fix memory leak in probe (git-fixes).\n- spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback (git-fixes).\n- spi: mxic: fix controller deregistration (git-fixes).\n- spi: mxs: fix controller deregistration (git-fixes).\n- spi: npcm-pspi: fix controller deregistration (git-fixes).\n- spi: omap2-mcspi: fix controller deregistration (git-fixes).\n- spi: orion: fix clock imbalance on registration failure (git-fixes).\n- spi: orion: fix controller deregistration (git-fixes).\n- spi: orion: fix runtime pm leak on unbind (git-fixes).\n- spi: pic32-sqi: fix controller deregistration (git-fixes).\n- spi: pic32: fix controller deregistration (git-fixes).\n- spi: pl022: fix controller deregistration (git-fixes).\n- spi: qup: fix controller deregistration (git-fixes).\n- spi: rockchip: fix controller deregistration (git-fixes).\n- spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ (git-fixes).\n- spi: rspi: fix controller deregistration (git-fixes).\n- spi: s3c64xx: fix controller deregistration (git-fixes).\n- spi: s3c64xx: fix NULL-deref on driver unbind (git-fixes).\n- spi: sh-hspi: fix controller deregistration (git-fixes).\n- spi: sprd: fix controller deregistration (git-fixes).\n- spi: st-ssc4: fix controller deregistration (git-fixes).\n- spi: sun4i: fix controller deregistration (git-fixes).\n- spi: sun6i: fix controller deregistration (git-fixes).\n- spi: syncuacer: fix controller deregistration (git-fixes).\n- spi: ti-qspi: fix controller deregistration (git-fixes).\n- spi: topcliff-pch: fix controller deregistration (git-fixes).\n- spi: topcliff-pch: fix use-after-free on unbind (git-fixes).\n- spi: uniphier: fix controller deregistration (git-fixes).\n- spi: uniphier: Simplify clock handling with devm_clk_get_enabled() (stable-fixes).\n- spi: zynq-qspi: fix controller deregistration (git-fixes).\n- spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() (stable-fixes).\n- spi: zynqmp-gqspi: fix controller deregistration (git-fixes).\n- staging: media: atomisp: Disallow all private IOCTLs (git-fixes).\n- staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() (git-fixes).\n- staging: sm750fb: fix division by zero in ps_to_hz() (git-fixes).\n- staging: vme_user: fix root device leak on init failure (git-fixes).\n- tg3: replace placeholder MAC address with device property (git-fixes).\n- thermal/drivers/spear: Fix error condition for reading st,thermal-flags (git-fixes).\n- thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp (git-fixes).\n- thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata (git-fixes).\n- tools/power/turbostat: Fix microcode patch level output for AMD/Hygon (git-fixes).\n- tools: hv: Fix cross-compilation (git-fixes).\n- tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public() (git-fixes).\n- tpm: avoid -Wunused-but-set-variable (git-fixes).\n- tpm: Fix auth session leak in tpm2_get_random() error path (git-fixes).\n- tpm: tpm_tis: add error logging for data transfer (git-fixes).\n- tpm: tpm_tis: stop transmit if retries are exhausted (git-fixes).\n- tpm: Use kfree_sensitive() to free auth session in tpm_dev_release() (git-fixes).\n- tty: serial: ip22zilog: Fix section mispatch warning (git-fixes).\n- udp: Force compute_score to always inline (bsc#1241259).\n- unshare: fix unshare_fs() handling (git-fixes).\n- USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen (git-fixes).\n- usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (git-fixes).\n- usb: chipidea: otg: not wait vbus drop if use role_switch (git-fixes).\n- USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam (stable-fixes).\n- usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer (stable-fixes).\n- usb: gadget: f_hid: Add missing error code (git-fixes).\n- usb: gadget: f_hid: don't call cdev_init while cdev in use (git-fixes).\n- usb: gadget: f_hid: move list and spinlock inits from bind to alloc (stable-fixes).\n- usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() (git-fixes).\n- usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() (git-fixes).\n- usb: gadget: f_uac1_legacy: validate control request size (stable-fixes).\n- usb: gadget: renesas_usb3: validate endpoint index in standard request handlers (git-fixes).\n- usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo (git-fixes).\n- USB: omap_udc: DMA: Don't enable burst 4 mode (git-fixes).\n- usb: port: add delay after usb_hub_set_port_power() (git-fixes).\n- usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive (stable-fixes).\n- USB: serial: io_edgeport: add support for Blackbox IC135A (stable-fixes).\n- USB: serial: option: add MeiG Smart SRM825WN (stable-fixes).\n- USB: serial: option: add support for Rolling Wireless RW135R-GL (stable-fixes).\n- USB: serial: option: add Telit Cinterion FN990A MBIM composition (git-fixes).\n- USB: serial: option: add Telit Cinterion LE910Cx compositions (stable-fixes).\n- usb: storage: Expand range of matched versions for VL817 quirks entry (git-fixes).\n- usb: typec: tcpm: reset internal port states on soft reset AMS (git-fixes).\n- usb: ulpi: fix memory leak on ulpi_register() error paths (git-fixes).\n- usb: usblp: fix heap leak in IEEE 1284 device ID via short response (stable-fixes).\n- usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl (stable-fixes).\n- usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() (git-fixes).\n- usbip: validate number_of_packets in usbip_pack_ret_submit() (git-fixes).\n- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (git-fixes).\n- vfio/pds: Fix memory leak in pds_vfio_dirty_enable() (git-fixes).\n- vfio/pds: Fix missing detach_ioas op (git-fixes).\n- vfio/pds: replace bitmap_free with vfree (git-fixes).\n- vfio/type1: Fix error unwind in migration dirty bitmap allocation (git-fixes).\n- vfio: Fix unbalanced vfio_df_close call in no-iommu mode (git-fixes).\n- vfio: Prevent open_count decrement to negative (git-fixes).\n- virt: arm-cca-guest: fix error check for RSI_INCOMPLETE (git-fixes).\n- virt: sev-guest: Do not use host-controlled page order in cleanup path (git-fixes).\n- virt: tdx-guest: Fix handling of host controlled 'quote' buffer length (git-fixes).\n- virt: tdx-guest: Return error for GetQuote failures (git-fixes).\n- wifi: ath5k: do not access array OOB (git-fixes).\n- wifi: ath9k: Fix typo (git-fixes).\n- wifi: ath10k: fix station lookup failure during disconnect (git-fixes).\n- wifi: ath11k: fix memory leaks in beacon template setup (git-fixes).\n- wifi: ath12k: fix leak in some ath12k_wmi_xxx() functions (git-fixes).\n- wifi: ath12k: use lockdep_assert_in_rcu_read_lock() for RCU assertions (git-fixes).\n- wifi: b43: enforce bounds check on firmware key index in b43_rx() (git-fixes).\n- wifi: b43legacy: enforce bounds check on firmware key index in RX path (git-fixes).\n- wifi: brcmfmac: Fix error pointer dereference (git-fixes).\n- wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task (git-fixes).\n- wifi: brcmfmac: validate bsscfg indices in IF events (stable-fixes).\n- wifi: brcmsmac: Fix dma_free_coherent() size (git-fixes).\n- wifi: cw1200: Revert \"Fix locking in error paths\" (git-fixes).\n- wifi: libertas: notify firmware load wait on disconnect (git-fixes).\n- wifi: mac80211: check ieee80211_rx_data_set_link return in pubsta MLO path (git-fixes).\n- wifi: mac80211: check tdls flag in ieee80211_tdls_oper (stable-fixes).\n- wifi: mac80211: drop stray 'static' from fast-RX rx_result (git-fixes).\n- wifi: mac80211: handle VHT EXT NSS in ieee80211_determine_our_sta_mode() (git-fixes).\n- wifi: mac80211: remove station if connection prep fails (git-fixes).\n- wifi: mac80211: use safe list iteration in radar detect work (git-fixes).\n- wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req() (git-fixes).\n- wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor (stable-fixes).\n- wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling (git-fixes).\n- wifi: mt76: mt7615: fix use_cts_prot support (git-fixes).\n- wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() (git-fixes).\n- wifi: mt76: mt7915: fix use_cts_prot support (git-fixes).\n- wifi: mt76: mt7921: fix 6GHz regulatory update on connection (git-fixes).\n- wifi: mt76: mt7921: fix a potential clc buffer length underflow (git-fixes).\n- wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work (git-fixes).\n- wifi: mt76: mt7921: Place upper limit on station AID (git-fixes).\n- wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() (git-fixes).\n- wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr (git-fixes).\n- wifi: mt76: mt7925: fix incorrect length field in txpower command (git-fixes).\n- wifi: mt76: mt7925: Fix incorrect MLO mode in firmware control (git-fixes).\n- wifi: mt76: mt7925: fix incorrect TLV length in CLC command (git-fixes).\n- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_tx_check_aggr() (git-fixes).\n- wifi: mt76: mt7925: prevent NULL vif dereference in mt7925_mac_write_txwi (git-fixes).\n- wifi: mt76: mt7996: fix FCS error flag check in RX descriptor (git-fixes).\n- wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event (git-fixes).\n- wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work() (git-fixes).\n- wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() (git-fixes).\n- wifi: nl80211: fix NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST usage (git-fixes).\n- wifi: nl80211: require admin perm on SET_PMK / DEL_PMK (git-fixes).\n- wifi: rsi: fix kthread lifetime race between self-exit and external-stop (git-fixes).\n- wifi: rt2x00usb: fix devres lifetime (git-fixes).\n- wifi: rtl8xxxu: fix potential use of uninitialized value (git-fixes).\n- wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet (git-fixes).\n- wifi: rtw88: Add additional USB IDs for RTL8812BU (bsc#1263135).\n- wifi: rtw88: Add BUFFALO WI-U3-866DHP to the USB ID list (bsc#1263135).\n- wifi: rtw88: Add support for Mercusys MA30N and D-Link DWA-T185 rev. A1 (bsc#1263135).\n- wifi: rtw88: check for PCI upstream bridge existence (git-fixes).\n- wifi: rtw88: fix device leak on probe failure (git-fixes).\n- wifi: rtw88: rtw8822bu VID/PID for BUFFALO WI-U2-866DM (bsc#1263135).\n- wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() (git-fixes).\n- wifi: wl1251: validate packet IDs before indexing tx_frames (stable-fixes).\n- x86/acpi/boot: Correct acpi_is_processor_usable() check again (git-fixes).\n- x86/boot/sev: Avoid shared GHCB page for early memory acceptance (git-fixes).\n- x86/boot/sev: Support memory acceptance in the EFI stub under SVSM (git-fixes).\n- x86/boot: Fix page table access in 5-level to 4-level paging transition (git-fixes).\n- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (bsc#1263255).\n- x86/cpufeatures: Free up unused feature bits (bsc#1263255).\n- x86/fred: Fix early boot failures on SEV-ES/SNP guests (git-fixes).\n- x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (git-fixes).\n- x86/sev: Add missing RIP_REL_REF() invocations during sme_enable() (git-fixes).\n- x86/sev: Do not touch VMSA pages during SNP guest memory kdump (git-fixes).\n- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (git-fixes).\n- x86/sev: Fix operator precedence in GHCB_MSR_VMPL_REQ_LEVEL macro (git-fixes).\n- x86/sev: Improve handling of writes to intercepted TSC MSRs (git-fixes).\n- x86/sev: Make sure pages are not skipped during kdump (git-fixes).\n- x86/tsx: Get the tsx= command line parameter with early_param() (bsc#1250951 bsc#1263044).\n- x86/tsx: Make tsx_ctrl_state static (bsc#1250951 bsc#1263044).\n- x86/vmware: Parse MP tables for SEV-SNP enabled guests under VMware hypervisors (git-fixes).\n- X.509: Fix out-of-bounds access when parsing extensions (git-fixes).\n- Xarray: do not return sibling entries from xas_find_marked() (bsc#1263815).\n","status":"published","published":"2026-05-28T11:49:10Z","modified":"2026-06-02T18:24:25.768544597Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:21860-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).\n- CVE-2024-14027: xattr: switch to CLASS(fd) (bsc#1259420).\n- CVE-2025-40181: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (bsc#1253471).\n- CVE-2025-68265: nvme: fix admin request_queue lifetime (bsc#1255360).\n- CVE-2025-68310: s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (bsc#1255160).\n- CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).\n- CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).\n- CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).\n- CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).\n- CVE-2026-23276: net: add xmit recursion limit to tunnel xmit functions (bsc#1260012).\n- CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).\n- CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).\n- CVE-2026-23316: net: ipv4: fix ARM64 alignment fault in multipath hash seed (bsc#1260573).\n- CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).\n- CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).\n- CVE-2026-23346: arm64: io: Rename ioremap_prot() to __ioremap_prot() (bsc#1260529).\n- CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).\n- CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).\n- CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).\n- CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).\n- CVE-2026-23375: mm: thp: deny THP for files on anonymous inodes (bsc#1260576).\n- CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).\n- CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).\n- CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).\n- CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).\n- CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).\n- CVE-2026-23417: bpf: Fix constant blinding for PROBE_MEM32 stores (bsc#1261410).\n- CVE-2026-23436: net: add helpers for lookup and walking netdevs under netdev_lock() (bsc#1261617).\n- CVE-2026-23437: net: shaper: protect late read accesses to the hierarchy (bsc#1261635).\n- CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).\n- CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).\n- CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).\n- CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).\n- CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).\n- CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).\n- CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).\n- CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).\n- CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).\n- CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).\n- CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).\n- CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).\n- CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on wakeup race (bsc#1261694).\n- CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).\n- CVE-2026-31395: bnxt_en: fix OOB access in DBG_BUF_PRODUCER async event handler (bsc#1261786).\n- CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).\n- CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).\n- CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).\n- CVE-2026-31406: xfrm: Fix work re-schedule after cancel in xfrm_nat_keepalive_net_fini() (bsc#1261629).\n- CVE-2026-31407: netfilter: conntrack: add missing netlink policy validations (bsc#1261632).\n- CVE-2026-31411: net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (bsc#1261752).\n- CVE-2026-31415: ipv6: avoid overflows in ip6_datagram_send_ctl() (bsc#1262099).\n- CVE-2026-31416: netfilter: nfnetlink_log: account for netlink header size (bsc#1262100).\n- CVE-2026-31420: bridge: mrp: reject zero test interval to avoid OOM panic (bsc#1262055).\n- CVE-2026-31421: net/sched: cls_fw: fix NULL pointer dereference on shared blocks (bsc#1262061).\n- CVE-2026-31422: net/sched: cls_flow: fix NULL pointer dereference on shared blocks (bsc#1262054).\n- CVE-2026-31423: net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() (bsc#1262063).\n- CVE-2026-31424: netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (bsc#1262053).\n- CVE-2026-31425: rds: ib: reject FRMR registration before IB connection is established (bsc#1262074).\n- CVE-2026-31427: netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp (bsc#1262086).\n- CVE-2026-31428: netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (bsc#1262087).\n- CVE-2026-31435: netfs: Fix read abandonment during retry (bsc#1262601).\n- CVE-2026-31449: ext4: validate p_idx bounds in ext4_ext_correct_indexes (bsc#1262616).\n- CVE-2026-31453: xfs: avoid dereferencing log items after push callbacks (bsc#1262617).\n- CVE-2026-31456: mm/pagewalk: fix race between concurrent split and refault (bsc#1262627).\n- CVE-2026-31494: net: cadence: macb: Synchronize stats calculations (bsc#1262671).\n- CVE-2026-31496: netfilter: nf_conntrack_expect: skip expectations in other netns via proc (bsc#1262673).\n- CVE-2026-31503: udp: Fix wildcard bind conflict check when using hash2 (bsc#1263077).\n- CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263085).\n- CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263093).\n- CVE-2026-31507: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer (bsc#1263095).\n- CVE-2026-31515: af_key: validate families in pfkey_send_migrate() (bsc#1262752).\n- CVE-2026-31519: btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create (bsc#1263012).\n- CVE-2026-31525: bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN (bsc#1262725).\n- CVE-2026-31526: bpf: Fix exception exit lock checking for subprogs (bsc#1262662).\n- CVE-2026-31528: perf: Make sure to use pmu_ctx-\u003epmu for groups (bsc#1263001).\n- CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262758).\n- CVE-2026-31547: drm/xe: Fix missing runtime PM reference in ccs_mode_store (bsc#1263018).\n- CVE-2026-31550: pmdomain: bcm: bcm2835-power: Increase ASB control timeout (bsc#1263104).\n- CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263107).\n- CVE-2026-31565: RDMA/irdma: Fix deadlock during netdev reset with active connections (bsc#1263064).\n- CVE-2026-31579: wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit (bsc#1263074).\n- CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263176).\n- CVE-2026-31588: KVM: x86: Use scratch field in MMIO fragment to hold small write values (bsc#1263165).\n- CVE-2026-31644: net: lan966x: fix use-after-free and leak in lan966x_fdma_reload() (bsc#1263048).\n- CVE-2026-31649: net: stmmac: fix integer underflow in chain mode (bsc#1263582).\n- CVE-2026-31658: net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() (bsc#1263052).\n- CVE-2026-31662: tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (bsc#1263131).\n- CVE-2026-31666: btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref() (bsc#1263138).\n- CVE-2026-31668: seg6: separate dst_cache for input and output paths in seg6 lwtunnel (bsc#1263140).\n- CVE-2026-31669: mptcp: fix slab-use-after-free in __inet_lookup_established (bsc#1263141).\n- CVE-2026-31675: net/sched: sch_netem: fix out-of-bounds access in packet corruption (bsc#1263556).\n- CVE-2026-31678: openvswitch: defer tunnel netdev_put to RCU release (bsc#1263562).\n- CVE-2026-31679: openvswitch: validate MPLS set/set_masked payload length (bsc#1263592).\n- CVE-2026-31681: netfilter: xt_multiport: validate range encoding in checkentry (bsc#1263593).\n- CVE-2026-31682: bridge: br_nd_send: linearize skb before parsing ND options (bsc#1263595).\n- CVE-2026-31684: net: sched: act_csum: validate nested VLAN headers (bsc#1263596).\n- CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263668).\n- CVE-2026-31691: igb: remove napi_synchronize() in igb_down() (bsc#1263604).\n- CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263901).\n- CVE-2026-31700: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (bsc#1263882).\n- CVE-2026-31738: vxlan: validate ND option lengths in vxlan_na_create (bsc#1264059).\n- CVE-2026-31787: xen/privcmd: fix double free via VMA splitting (bsc#1262181).\n- CVE-2026-43009: bpf: Fix incorrect pruning due to atomic fetch precision tracking (bsc#1264014).\n- CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1263931).\n- CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1263933).\n- CVE-2026-43037: ip6_tunnel: clear skb2-\u003ecb in ip4ip6_err() (bsc#1263995).\n- CVE-2026-43038: ipv6: icmp: clear skb2-\u003ecb in ip6_err_gen_icmpv6_unreach() (bsc#1264097).\n- CVE-2026-43045: mshv: Refactor and rename memory region handling functions (bsc#1263942).\n- CVE-2026-43050: atm: lec: fix use-after-free in sock_def_readable() (bsc#1264082).\n- CVE-2026-43060: netfilter: nft_ct: drop pending enqueued packets on removal (bsc#1264183).\n- CVE-2026-43082: net: txgbe: leave space for null terminators on property_entry (bsc#1264233).\n- CVE-2026-43088: net: af_key: zero aligned sockaddr tail in PF_KEY exports (bsc#1264469).\n- CVE-2026-43153: xfs: remove xfs_attr_leaf_hasname (bsc#1264586).\n- CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264848).\n- CVE-2026-43265: KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block() (bsc#1264427).\n- CVE-2026-43329: netfilter: flowtable: strictly check for maximum number of actions (bsc#1265085).\n- CVE-2026-43365: xfs: fix undersized l_iclog_roundoff values (bsc#1265119).\n- CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265116).\n- CVE-2026-43441: net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1264674).\n- CVE-2026-43494: net/rds: reset op_nents when zerocopy page pin fails (bsc#1265626).\n- CVE-2026-43503: net: skbuff: propagate shared-frag marker through frag-transfer helpers (bsc#1265960).\n\nThe following non security issues were fixed:\n\n- accel/qaic: Add overflow check to remap_pfn_range during mmap (git-fixes).\n- ACPI: AGDI: fix missing newline in error message (git-fixes).\n- ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug (git-fixes).\n- ACPI: scan: Use acpi_dev_put() in object add error paths (git-fixes).\n- ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO (git-fixes).\n- ACPI: video: force native backlight on HP OMEN 16 (8A44) (stable-fixes).\n- ACPI: video: Move Lenovo Legion S7 15ACH6 quirk to the right section (git-fixes).\n- ALSA: 6fire: Fix input volume change detection (git-fixes).\n- ALSA: 6fire: fix use-after-free on disconnect (git-fixes).\n- ALSA: aoa: i2sbus: clear stale prepared state (git-fixes).\n- ALSA: aoa: i2sbus: fix OF node lifetime handling (git-fixes).\n- ALSA: aoa: Skip devices with no codecs in i2sbus_resume() (git-fixes).\n- ALSA: aoa: Use guard() for mutex locks (stable-fixes).\n- ALSA: asihpi: avoid write overflow check warning (stable-fixes).\n- ALSA: caiaq: Don't abort when no input device is available (git-fixes).\n- ALSA: caiaq: Fix control_put() result and cache rollback (git-fixes).\n- ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path (git-fixes).\n- ALSA: caiaq: fix usb_dev refcount leak on probe failure (git-fixes).\n- ALSA: caiaq: Handle probe errors properly (git-fixes).\n- ALSA: caiaq: take a reference on the USB device in create_card() (git-fixes).\n- ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() (git-fixes).\n- ALSA: core: Fix potential data race at fasync handling (git-fixes).\n- ALSA: core: Serialize deferred fasync state checks (git-fixes).\n- ALSA: core: Validate compress device numbers without dynamic minors (git-fixes).\n- ALSA: ctxfi: Add fallback to default RSR for S/PDIF (git-fixes).\n- ALSA: ctxfi: Fix missing SPDIFI1 index handling (stable-fixes).\n- ALSA: ctxfi: Limit PTP to a single page (git-fixes).\n- ALSA: firewire-tascam: Do not drop unread control events (git-fixes).\n- ALSA: fireworks: bound device-supplied status before string array lookup (git-fixes).\n- ALSA: hda/hdmi: Add quirk for TUXEDO IBS14G6 (stable-fixes).\n- ALSA: hda/realtek - fixed speaker no sound update (git-fixes).\n- ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk (stable-fixes).\n- ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx (stable-fixes).\n- ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC (stable-fixes).\n- ALSA: hda/realtek: add quirk for Framework F111:000F (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 (stable-fixes).\n- ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') (git-fixes).\n- ALSA: hda: cs35l41: Put ACPI device on missing physical node (git-fixes).\n- ALSA: hda: cs35l56: Propagate ASP TX source control errors (git-fixes).\n- ALSA: hda: cs35l56: Put ACPI device after setting companion (git-fixes).\n- ALSA: hda: Fix NULL pointer dereference in snd_hda_ctl_add() (git-fixes).\n- ALSA: misc: Use guard() for spin locks (stable-fixes).\n- ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger (stable-fixes).\n- ALSA: pcmtest: fix reference leak on failed device registration (git-fixes).\n- ALSA: pcmtest: Fix resource leaks in module init error paths (git-fixes).\n- ALSA: pcmtest: Return -EFAULT on pattern read copy failure (git-fixes).\n- ALSA: sc6000: Keep the programmed board state in card-private data (git-fixes).\n- ALSA: scarlett2: Add missing error check when initialise Autogain Status (git-fixes).\n- ALSA: scarlett2: Add missing sentinel initializer field (git-fixes).\n- ALSA: seq: Notify client and port info changes (stable-fixes).\n- ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes (stable-fixes).\n- ALSA: usb-audio: apply quirk for MOONDROP JU Jiu (stable-fixes).\n- ALSA: usb-audio: Avoid false E-MU sample-rate notifications (git-fixes).\n- ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() (git-fixes).\n- ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans (git-fixes).\n- ALSA: usb-audio: Bound MIDI endpoint descriptor scans (git-fixes).\n- ALSA: usb-audio: Evaluate packsize caps at the right place (git-fixes).\n- ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch (git-fixes).\n- ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams (git-fixes).\n- ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex (stable-fixes).\n- ALSA: usb-audio: Fix UAC3 cluster descriptor size check (git-fixes).\n- ALSA: usb-audio: midi2: Restart output URBs on resume (git-fixes).\n- ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES (git-fixes).\n- ALSA: virtio: drop an extaneous kernel-doc comment (git-fixes).\n- amdgpu/jpeg: fix deepsleep register for jpeg 5_0_0 and 5_0_2 (stable-fixes).\n- ASoC: amd: acp: Add DMI quirk for Valve Steam Deck OLED (git-fixes).\n- ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF (stable-fixes).\n- ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table (stable-fixes).\n- ASoC: codecs: ab8500: Fix casting of private data (git-fixes).\n- ASoC: cs35l56: Destroy workqueue in probe error path (git-fixes).\n- ASoC: cs35l56: Don't use devres to unregister component (git-fixes).\n- ASoC: cs35l56: Fix hibernate write in runtime resume error path (git-fixes).\n- ASoC: fsl_easrc: Change the type for iec958 channel status controls (git-fixes).\n- ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() (git-fixes).\n- ASoC: fsl_easrc: fix comment typo (git-fixes).\n- ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() (git-fixes).\n- ASoC: fsl_micfil: Add access property for \"VAD Detected\" (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in micfil_quality_set() (git-fixes).\n- ASoC: fsl_xcvr: Fix event generation for cached controls (git-fixes).\n- ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() (git-fixes).\n- ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() (git-fixes).\n- ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error (git-fixes).\n- ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop (git-fixes).\n- ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens (git-fixes).\n- ASoC: qcom: q6apm: move component registration to unmanaged version (git-fixes).\n- ASoC: qcom: q6apm: remove child devices when apm is removed (git-fixes).\n- ASoC: qcom: qdsp6: topology: check widget type before accessing data (git-fixes).\n- ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list (stable-fixes).\n- ASoC: SOF: compress: return the configured codec from get_params (git-fixes).\n- ASoC: SOF: Don't allow pointer operations on unconfigured streams (git-fixes).\n- ASoC: SOF: Intel: hda: Place check before dereference (git-fixes).\n- ASoC: SOF: topology: reject invalid vendor array size in token parser (stable-fixes).\n- ASoC: sti: Return errors from regmap_field_alloc() (git-fixes).\n- ASoC: sti: use managed regmap_field allocations (git-fixes).\n- ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J (stable-fixes).\n- ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 (stable-fixes).\n- backlight: sky81452-backlight: Check return value of devm_gpiod_get_optional() in sky81452_bl_parse_dt() (git-fixes).\n- batman-adv: bla: only purge non-released claims (git-fixes).\n- batman-adv: bla: prevent use-after-free when deleting claims (git-fixes).\n- batman-adv: bla: put backbone reference on failed claim hash insert (git-fixes).\n- batman-adv: fix integer overflow on buff_pos (git-fixes).\n- batman-adv: hold claim backbone gateways by reference (git-fixes).\n- batman-adv: reject new tp_meter sessions during teardown (git-fixes).\n- batman-adv: reject oversized global TT response buffers (git-fixes).\n- batman-adv: stop caching unowned originator pointers in BAT IV (git-fixes).\n- bitfield: Add FIELD_MODIFY() helper (jsc#PED-14238).\n- Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling (git-fixes).\n- Bluetooth: btmtk: validate WMT event SKB length before struct access (git-fixes).\n- Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI frames (bsc#1260996).\n- Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (git-fixes).\n- Bluetooth: hci_event: fix memset typo (git-fixes).\n- Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt (git-fixes).\n- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (git-fixes).\n- Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (git-fixes).\n- Bluetooth: HIDP: serialise l2cap_unregister_user via hidp_session_sem (git-fixes).\n- Bluetooth: ISO: Fix data-race on dst in iso_sock_connect() (git-fixes).\n- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (git-fixes).\n- Bluetooth: l2cap: fix MPS check in l2cap_ecred_reconf_req (git-fixes).\n- Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (git-fixes).\n- Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() (git-fixes).\n- Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU (git-fixes).\n- Bluetooth: RFCOMM: pull credit byte with skb_pull_data() (git-fixes).\n- Bluetooth: SCO: check for codecs-\u003enum_codecs == 1 before assigning to sco_pi(sk)-\u003ecodec (git-fixes).\n- Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready (git-fixes).\n- Bluetooth: SCO: hold sk properly in sco_conn_ready (git-fixes).\n- Bluetooth: virtio_bt: clamp rx length before skb_put (git-fixes).\n- Bluetooth: virtio_bt: validate rx pkt_type header length (git-fixes).\n- bpf: Add third round of bounds deduction (git-fixes).\n- bpf: Fix u32/s32 bounds when ranges cross min/max boundary (git-fixes).\n- bpf: Improve bounds when s64 crosses sign boundary (git-fixes).\n- bpf: Switch CONFIG_CFI_CLANG to CONFIG_CFI (git-fixes).\n- btrfs: qgroup: update all parent qgroups when doing quick inherit (bsc#1258933).\n- btrfs: reject root items with drop_progress and zero drop_level (git-fixes).\n- btrfs: replace BUG() with error handling in __btrfs_balance() (git-fixes).\n- bus: mhi: host: pci_generic: Switch to async power up to avoid boot delays (git-fixes).\n- bus: rifsc: fix RIF configuration check for peripherals (git-fixes).\n- can: mcp251x: add error handling for power enable in open and resume (stable-fixes).\n- can: raw: fix ro-\u003euniq use-after-free in raw_rcv() (git-fixes).\n- can: ucan: fix devres lifetime (git-fixes).\n- cdc-acm: new quirk for EPSON HMD (stable-fixes).\n- check-for-config-changes: Exclude CC_MS_EXTENSIONS.\n- check-for-config-changes: Exclude HAVE_CFI_ICALL_NORMALIZE_INTEGERS{,_RUSTC}.\n- comedi: dt2815: add hardware detection to prevent crash (stable-fixes).\n- cpufreq: intel_pstate: Drop Arrow Lake from \"scaling factor\" list (bsc#1249104).\n- crypto: af_alg - limit RX SG extraction by receive buffer budget (git-fixes).\n- crypto: algif_aead - Fix minimum RX size check for decryption (git-fixes).\n- crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup (git-fixes).\n- crypto: atmel-ecc - Release client on allocation failure (git-fixes).\n- crypto: atmel-sha204a - Fix error codes in OTP reads (git-fixes).\n- crypto: atmel-sha204a - Fix OTP sysfs read and error handling (git-fixes).\n- crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path (git-fixes).\n- crypto: atmel-sha204a - Fix uninitialized data access on OTP read error (git-fixes).\n- crypto: atmel-tdes - fix DMA sync direction (git-fixes).\n- crypto: ccp - copy IV using skcipher ivsize (git-fixes).\n- crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (git-fixes).\n- crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (git-fixes).\n- crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (git-fixes).\n- crypto: ccree - fix a memory leak in cc_mac_digest() (git-fixes).\n- crypto: drivers - Switch back to struct platform_driver::remove() (jsc#PED-14238).\n- crypto: drivers - Use str_enable_disable-like helpers (jsc#PED-14238).\n- crypto: hisilicon - Fix dma_unmap_single() direction (git-fixes).\n- crypto: iaa - Adjust workqueue allocation type (jsc#PED-14238).\n- crypto: iaa - fix per-node CPU counter reset in rebalance_wq_table() (git-fixes).\n- crypto: iaa - Move compression CRC into request object (jsc#PED-14238).\n- crypto: iaa - Optimize rebalance_wq_table() (jsc#PED-14238).\n- crypto: iaa - Remove potential infinite loop in check_completion() (jsc#PED-14238).\n- crypto: iaa - Remove unreachable pr_debug from iaa_crypto_cleanup_module (jsc#PED-14238).\n- crypto: iaa - Remove unused disable_async argument from iaa_decompress (jsc#PED-14238).\n- crypto: iaa - Replace sprintf with sysfs_emit in sysfs show functions (jsc#PED-14238).\n- crypto: iaa - Simplify init_iaa_device() (jsc#PED-14238).\n- crypto: jitterentropy - replace long-held spinlock with mutex (git-fixes).\n- crypto: nx - Fix packed layout in struct nx842_crypto_header (git-fixes).\n- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (git-fixes).\n- crypto: qat - #undef field_get() before local definition (jsc#PED-14238).\n- crypto: qat - add adf_rl_get_num_svc_aes() in rate limiting (jsc#PED-14238).\n- crypto: qat - add bank state save and restore for qat_420xx (jsc#PED-14238).\n- crypto: qat - add command queue telemetry counters for GEN6 (jsc#PED-14238).\n- crypto: qat - add compression slice count for rate limiting (jsc#PED-14238).\n- crypto: qat - add decompression service for rate limiting (jsc#PED-14238).\n- crypto: qat - add decompression service to telemetry (jsc#PED-14238).\n- crypto: qat - add firmware headers for GEN6 devices (jsc#PED-14238).\n- crypto: qat - add GEN6 firmware loader (jsc#PED-14238).\n- crypto: qat - add get_svc_slice_cnt() in device data structure (jsc#PED-14238).\n- crypto: qat - add live migration enablers for GEN6 devices (jsc#PED-14238).\n- crypto: qat - add macro to write 64-bit values to registers (jsc#PED-14238).\n- crypto: qat - add missing header inclusion (jsc#PED-14238).\n- crypto: qat - add qat_6xxx driver (jsc#PED-14238).\n- crypto: qat - add ring buffer idle telemetry counter for GEN6 (jsc#PED-14238).\n- crypto: qat - add support for decompression service to GEN6 devices (jsc#PED-14238).\n- crypto: qat - consolidate service enums (jsc#PED-14238).\n- crypto: qat - Constify struct pm_status_row (jsc#PED-14238).\n- crypto: qat - disable 4xxx AE cluster when lead engine is fused off (git-fixes).\n- crypto: qat - disable 420xx AE cluster when lead engine is fused off (git-fixes).\n- crypto: qat - do not export adf_cfg_services (jsc#PED-14238).\n- crypto: qat - enable power management debugfs for GEN6 devices (jsc#PED-14238).\n- crypto: qat - enable RAS support for GEN6 devices (jsc#PED-14238).\n- crypto: qat - enable rate limiting feature for GEN6 devices (jsc#PED-14238).\n- crypto: qat - enable reporting of error counters for GEN6 devices (jsc#PED-14238).\n- crypto: qat - enable telemetry for GEN6 devices (jsc#PED-14238).\n- crypto: qat - export adf_get_service_mask() (jsc#PED-14238).\n- crypto: qat - export adf_init_admin_pm() (jsc#PED-14238).\n- crypto: qat - expose configuration functions (jsc#PED-14238).\n- crypto: qat - fix compression instance leak (git-fixes).\n- crypto: qat - fix IRQ cleanup on 6xxx probe failure (git-fixes).\n- crypto: qat - fix object goals in Makefiles (jsc#PED-14238.\n- crypto: qat - fix type mismatch in RAS sysfs show functions (git-fixes).\n- crypto: qat - Fix typo \"accelaration\" (jsc#PED-14238).\n- crypto: qat - fix virtual channel configuration for GEN6 devices (jsc#PED-14238).\n- crypto: qat - include qat_common in top Makefile (jsc#PED-14238).\n- crypto: qat - introduce fuse array (jsc#PED-14238).\n- crypto: qat - make adf_dev_autoreset() static (jsc#PED-14238).\n- crypto: qat - optimize allocations for fw authentication (jsc#PED-14238).\n- crypto: qat - refactor compression template logic (jsc#PED-14238).\n- crypto: qat - refactor FW signing algorithm (jsc#PED-14238).\n- crypto: qat - refactor ring-related debug functions (jsc#PED-14238).\n- crypto: qat - refactor service parsing logic (jsc#PED-14238).\n- crypto: qat - relocate and rename bank state structure definition (jsc#PED-14238).\n- crypto: qat - relocate bank state helper functions (jsc#PED-14238).\n- crypto: qat - relocate power management debugfs helper APIs (jsc#PED-14238).\n- crypto: qat - relocate service related functions (jsc#PED-14238).\n- crypto: qat - remove BITS_IN_DWORD() (jsc#PED-14238).\n- crypto: qat - Remove dst_null support (jsc#PED-14238).\n- crypto: qat - remove duplicate masking for GEN6 devices (jsc#PED-14238).\n- crypto: qat - remove initialization in device class (jsc#PED-14238).\n- crypto: qat - remove redundant FW image size check (jsc#PED-14238).\n- crypto: qat - remove unused adf_devmgr_get_first (jsc#PED-14238).\n- crypto: qat - remove unused members in suof structure (jsc#PED-14238).\n- crypto: qat - rename and relocate timer logic (jsc#PED-14238).\n- crypto: qat - reorder objects in qat_common Makefile (jsc#PED-14238).\n- crypto: qat - replace CHECK_STAT macro with static inline function (jsc#PED-14238).\n- crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user() (jsc#PED-14238).\n- crypto: qat - restore ASYM service support for GEN6 devices (jsc#PED-14238).\n- crypto: qat - Return pointer directly in adf_ctl_alloc_resources (jsc#PED-14238).\n- crypto: qat - set command ids as reserved (jsc#PED-14238).\n- crypto: qat - switch to standard pattern for PCI IDs (jsc#PED-14238).\n- crypto: qat - update firmware api (jsc#PED-14238).\n- crypto: qat - use pr_fmt() in adf_gen4_hw_data.c (jsc#PED-14238).\n- crypto: qat - use pr_fmt() in qat uclo.c (jsc#PED-14238).\n- crypto: qat - use simple_strtoull to improve qat_uclo_parse_num (jsc#PED-14238).\n- crypto: qat - use swab32 macro (git-fixes).\n- crypto: qat - validate service in rate limiting sysfs api (jsc#PED-14238).\n- crypto: qat/qat_6xxx - Fix NULL vs IS_ERR() check in adf_probe() (jsc#PED-14238).\n- crypto: sa2ul - Fix AEAD fallback algorithm names (git-fixes).\n- crypto: simd - reject compat registrations without __ prefixes (git-fixes).\n- crypto: talitos - fix SEC1 32k ahash request limitation (git-fixes).\n- crypto: tegra - Disable softirqs before finalizing request (git-fixes).\n- devres: fix missing node debug info in devm_krealloc() (git-fixes).\n- dmaengine: dw-axi-dmac: fix Alignment should match open parenthesis (git-fixes).\n- dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function (git-fixes).\n- dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() (git-fixes).\n- dpll: zl3073x: Add support to adjust phase (bsc#1255752).\n- dpll: zl3073x: Fix output pin phase adjustment sign (bsc#1255752).\n- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (bsc#1255752).\n- dpll: zl3073x: Specify phase adjustment granularity for pins (bsc#1255752).\n- drivers/base/memory: fix memory block reference leak in poison accounting (git-fixes).\n- drm/amd/display: Add NULL check for integrated_info in clk_mgr_construct (git-fixes).\n- drm/amd/display: Allow DCE link encoder without AUX registers (git-fixes).\n- drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths (git-fixes).\n- drm/amd/display: Change dither policy for 10 bpc output back to dithering (git-fixes).\n- drm/amd/display: Correct logic check error for fastboot (git-fixes).\n- drm/amd/display: Disable 10-bit truncation and dithering on DCE 6.x (git-fixes).\n- drm/amd/display: Disable fastboot on DCE 6 too (stable-fixes).\n- drm/amd/display: Read EDID from VBIOS embedded panel info (git-fixes).\n- drm/amd/pm/ci: Clear EnabledForActivity field for memory levels (git-fixes).\n- drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs (git-fixes).\n- drm/amd/pm/ci: Fill DW8 fields from SMC (git-fixes).\n- drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 (git-fixes).\n- drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled (git-fixes).\n- drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board (git-fixes).\n- drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock (git-fixes).\n- drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x (git-fixes).\n- drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) (git-fixes).\n- drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ (stable-fixes).\n- drm/amdgpu/gfx10: look at the right prop for gfx queue priority (git-fixes).\n- drm/amdgpu/gfx11: look at the right prop for gfx queue priority (git-fixes).\n- drm/amdgpu/gmc: Fix AMDGPU_GART_PLACEMENT_LOW to not overlap with VRAM (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.5 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.0 ring (git-fixes).\n- drm/amdgpu/pm: add missing revision check for CI (git-fixes).\n- drm/amdgpu/pm: align Hawaii mclk workaround with radeon (git-fixes).\n- drm/amdgpu/pm: drop SMU driver if version not matched messages (stable-fixes).\n- drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission (git-fixes).\n- drm/amdgpu/vce: Prevent partial address patches (stable-fixes).\n- drm/amdgpu/vcn3: Avoid overflow on msg bound check (git-fixes).\n- drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (stable-fixes).\n- drm/amdgpu/vcn4: Avoid overflow on msg bound check (git-fixes).\n- drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (stable-fixes).\n- drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (stable-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v4.0.5 enc ring (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v5.0.0 enc ring (git-fixes).\n- drm/amdgpu: Add bounds checking to ib_{get,set}_value (stable-fixes).\n- drm/amdgpu: Add default case in DVI mode validation (git-fixes).\n- drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG (git-fixes).\n- drm/amdgpu: fix zero-size GDS range init on RDNA4 (stable-fixes).\n- drm/amdgpu: gate VM CPU HDP flush on reset lock (stable-fixes).\n- drm/amdgpu: replace PASID IDR with XArray (git-fixes).\n- drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count (stable-fixes).\n- drm/amdgpu: zero-initialize GART table on allocation (stable-fixes).\n- drm/amdkfd: Add upper bound check for num_of_nodes (stable-fixes).\n- drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure (stable-fixes).\n- drm/amdkfd: Make all TLB-flushes heavy-weight (stable-fixes).\n- drm/amdkfd: validate SVM ioctl nattr against buffer size (stable-fixes).\n- drm/arcpgu: fix device node leak (git-fixes).\n- drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs (git-fixes).\n- drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check (git-fixes).\n- drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() (git-fixes).\n- drm/bridge: stm_lvds: Do not fail atomic_check on disabled connector (git-fixes).\n- drm/etnaviv: Fix armed job not being pushed to the DRM scheduler (git-fixes).\n- drm/exynos: remove bridge when component_add fails (git-fixes).\n- drm/fb-helper: Fix clipping when damage area spans a single scanline (git-fixes).\n- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (git-fixes).\n- drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup (git-fixes).\n- drm/gma500/oaktrail_lvds: fix hang on init failure (git-fixes).\n- drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init (git-fixes).\n- drm/i915/dp: Fix VSC dynamic range signaling for RGB formats (git-fixes).\n- drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (git-fixes).\n- drm/i915/wm: Verify the correct plane DDB entry (git-fixes).\n- drm/i915: skip __i915_request_skip() for already signaled requests (git-fixes).\n- drm/imagination: Switch reset_reason fields from enum to u32 (git-fixes).\n- drm/komeda: fix integer overflow in AFBC framebuffer size check (git-fixes).\n- drm/loongson: Use managed KMS polling (git-fixes).\n- drm/msm/a6xx: Fix dumping A650+ debugbus blocks (git-fixes).\n- drm/msm/a6xx: Fix HLSQ register dumping (git-fixes).\n- drm/msm/a6xx: Use barriers while updating HFI Q headers (git-fixes).\n- drm/msm/dpu: fix mismatch between power and frequency (git-fixes).\n- drm/msm/dsi: add the missing parameter description (git-fixes).\n- drm/msm/dsi: fix bits_per_pclk (git-fixes).\n- drm/msm/dsi: fix hdisplay calculation for CMD mode panel (git-fixes).\n- drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 (git-fixes).\n- drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata() (git-fixes).\n- drm/msm/shrinker: Fix can_block() logic (git-fixes).\n- drm/nouveau: fix nvkm_device leak on aperture removal failure (git-fixes).\n- drm/nouveau: fix u32 overflow in pushbuf reloc bounds check (git-fixes).\n- drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds (git-fixes).\n- drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds (git-fixes).\n- drm/panel: sharp-ls043t1le01: make use of prepare_prev_first (git-fixes).\n- drm/panel: simple: Correct G190EAN01 prepare timing (git-fixes).\n- drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() (git-fixes).\n- drm/panthor: Fix outdated function documentation (git-fixes).\n- drm/radeon: add missing revision check for CI (git-fixes).\n- drm/sun4i: backend: fix error pointer dereference (git-fixes).\n- drm/sun4i: Fix resource leaks (git-fixes).\n- drm/v3d: Handle error from drm_sched_entity_init() (git-fixes).\n- drm/vc4: Fix a memory leak in hang state error path (git-fixes).\n- drm/vc4: Fix memory leak of BO array in hang state (git-fixes).\n- drm/vc4: platform_get_irq_byname() returns an int (stable-fixes).\n- drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock (git-fixes).\n- drm/vc4: Release runtime PM reference after binding V3D (git-fixes).\n- drm/vram: remove DRM_VRAM_MM_FILE_OPERATIONS from docs (git-fixes).\n- drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked() (git-fixes).\n- drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked() (git-fixes).\n- drm/xe/debugfs: Correct printing of register whitelist ranges (git-fixes).\n- drm/xe/dma-buf: handle empty bo and UAF races (git-fixes).\n- drm/xe/gsc: Fix BO leak on error in query_compatibility_version() (git-fixes).\n- drm/xe/uapi: update used tracking kernel-doc (git-fixes).\n- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (git-fixes).\n- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (git-fixes).\n- dt-bindings: net: Fix Tegra234 MGBE PTP clock (git-fixes).\n- efi/capsule-loader: fix incorrect sizeof in phys array reallocation (git-fixes).\n- efi: pstore: Drop efivar lock when efi_pstore_open() returns with an error (git-fixes).\n- erofs: add GFP_NOIO in the bio completion if needed (git-fixes).\n- ext4: fix fsync(2) for nojournal mode (git-fixes).\n- ext4: make recently_deleted() properly work with lazy itable initialization (git-fixes).\n- ext4: reject mount if bigalloc with s_first_data_block != 0 (git-fixes).\n- extcon: Fixed sysfs duplicate filename issue (git-fixes).\n- extcon: ptn5150: handle pending IRQ events during system resume (git-fixes).\n- fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break (git-fixes).\n- fbdev: offb: fix PCI device reference leak on probe failure (git-fixes).\n- fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO (stable-fixes).\n- fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO (git-fixes).\n- firmware: arm_ffa: Use the correct buffer size during RXTX_MAP (git-fixes).\n- firmware: dmi: Correct an indexing error in dmi.h (git-fixes).\n- firmware: google: framebuffer: Do not mark framebuffer as busy (git-fixes).\n- firmware: google: framebuffer: Do not unregister platform device (git-fixes).\n- gpio: of: clear OF_POPULATED on hog nodes in remove path (git-fixes).\n- gpio: tegra: fix irq_release_resources calling enable instead of disable (git-fixes).\n- gtp: disable BH before calling udp_tunnel_xmit_skb() (git-fixes).\n- HID: alps: fix NULL pointer dereference in alps_raw_event() (git-fixes).\n- HID: amd_sfh: don't log error when device discovery fails with -EOPNOTSUPP (git-fixes).\n- HID: apple: ensure the keyboard backlight is off if suspending (git-fixes).\n- HID: asus: do not abort probe when not necessary (git-fixes).\n- HID: asus: make asus_resume adhere to linux kernel coding standards (git-fixes).\n- HID: core: clamp report_size in s32ton() to avoid undefined shift (stable-fixes).\n- HID: logitech-hidpp: Enable MX Master 4 over bluetooth (stable-fixes).\n- HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure (stable-fixes).\n- HID: multitouch: Check to ensure report responses match the request (stable-fixes).\n- HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 (stable-fixes).\n- HID: roccat: fix use-after-free in roccat_report_event (stable-fixes).\n- HID: usbhid: fix deadlock in hid_post_reset() (git-fixes).\n- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (stable-fixes).\n- hisi_acc_vfio_pci: add eq and aeq interruption restore (git-fixes).\n- hisi_acc_vfio_pci: bugfix cache write-back issue (git-fixes).\n- hisi_acc_vfio_pci: bugfix the problem of uninstalling driver (git-fixes).\n- hv_sock: fix ARM64 support (git-fixes).\n- hv_sock: update outdated comment for renamed vsock_stream_recvmsg() (git-fixes).\n- hwmon: (ads7871) Fix endianness bug in 16-bit register reads (git-fixes).\n- hwmon: (corsair-psu) Close HID device on probe errors (git-fixes).\n- hwmon: (lm63) Add locking to avoid TOCTOU (git-fixes).\n- hwmon: (ltc2992) Clamp threshold writes to hardware range (git-fixes).\n- hwmon: (ltc2992) Fix u32 overflow in power read path (git-fixes).\n- hwmon: (ltc4286) Add missing MODULE_IMPORT_NS(\"PMBUS\") (git-fixes).\n- hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt (git-fixes).\n- hwmon: (powerz) Fix use-after-free on USB disconnect (git-fixes).\n- hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data() (git-fixes).\n- i2c: s3c24xx: check the size of the SMBUS message before using it (stable-fixes).\n- i2c: smbus: reject oversized block transfers in the common path (git-fixes).\n- i2c: stm32f7: reinit_completion() per transfer not per msg (git-fixes).\n- i2c: stub: Reject I2C block transfers with invalid length (git-fixes).\n- i2c: tegra: Add HS mode support (bsc#1261550).\n- i2c: tegra: Add Tegra256 support (bsc#1261550).\n- i2c: tegra: Do not configure DMA if not supported (bsc#1261550).\n- i2c: tegra: Don't mark devices with pins as IRQ safe (stable-fixes).\n- i2c: tegra: Update Tegra256 timing parameters (bsc#1261550).\n- i2c: tegra: Use separate variables for fast and fastplus (bsc#1261550).\n- i3c: dw: Fix memory leak in dw_i3c_master_i3c_xfers() (git-fixes).\n- i3c: master: Fix error codes at send_ccc_cmd (git-fixes).\n- i3c: mipi-i3c-hci: fix IBI payload length calculation for final status (git-fixes).\n- ibmveth: Disable GSO for packets with small MSS (bsc#1265144).\n- iio: adc: ad7192: Revert \"properly check spi_get_device_match_data()\" (stable-fixes).\n- iio: adc: ad7768-1: fix one-shot mode data acquisition (git-fixes).\n- iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() (git-fixes).\n- iio: frequency: admv1013: add dev variable (stable-fixes).\n- iio: frequency: admv1013: fix NULL pointer dereference on str (git-fixes).\n- Input: bcm5974 - recover from failed mode switch (stable-fixes).\n- Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table (stable-fixes).\n- Input: uinput - fix circular locking dependency with ff-core (git-fixes).\n- Input: uinput - take event lock when submitting FF request \"event\" (stable-fixes).\n- Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode (stable-fixes).\n- Input: xpad - add support for Razer Wolverine V3 Pro (stable-fixes).\n- interconnect: debugfs: fix devm_kstrdup and kfree mismatch (git-fixes).\n- io_uring/timeout: check unused sqe fields (git-fixes).\n- iommu/amd: move wait_on_sem() out of spinlock (git-fixes bsc#1260593).\n- iommu/amd: serialize sequence allocation under concurrent TLB invalidations (git-fixes bsc#1260593).\n- iommu/vt-d: Remove LPIG from page group response descriptor (jsc#PED-16113).\n- ipmi: Add limits to event and receive message requests (git-fixes).\n- ipmi: Check event message buffer response for bad data (git-fixes).\n- ipmi: ssif_bmc: change log level to dbg in irq callback (git-fixes).\n- ipmi: ssif_bmc: fix message desynchronization after truncated response (git-fixes).\n- ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure (git-fixes).\n- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (git-fixes).\n- KVM: arm64: Allow cacheable stage 2 mapping using VMA flags (git-fixes).\n- KVM: arm64: Assume non-PFNMAP/MIXEDMAP VMAs can be mapped cacheable (git-fixes).\n- KVM: arm64: Block cacheable PFNMAP mapping (git-fixes).\n- KVM: arm64: Consolidate idreg callbacks (git-fixes).\n- KVM: arm64: Discard PC update state on vcpu reset (git-fixes).\n- KVM: arm64: Finalize ID registers only once per VM (git-fixes).\n- KVM: arm64: Fix MTE flag initialization for protected VMs (git-fixes).\n- KVM: arm64: Fix page leak in user_mem_abort() (git-fixes).\n- KVM: arm64: Fix Trace Buffer trap polarity for protected VMs (git-fixes).\n- KVM: arm64: Fix Trace Buffer trapping for protected VMs (git-fixes).\n- KVM: arm64: Fix vma_shift staleness on nested hwpoison path (git-fixes).\n- KVM: arm64: Hide S1POE from guests when not supported by the host (git-fixes).\n- KVM: arm64: Limit clearing of ID_{AA64PFR0,PFR1}_EL1.GIC to userspace irqchip (git-fixes).\n- KVM: arm64: Make all 32bit ID registers fully writable (git-fixes).\n- KVM: arm64: nv: Add trap config for DBGWCR\u003c15\u003e_EL1 (git-fixes).\n- KVM: arm64: nv: Return correct RES0 bits for FGT registers (git-fixes).\n- KVM: arm64: pkvm: Fallback to level-3 mapping on host stage-2 fault (git-fixes).\n- KVM: arm64: Read PMUVer as unsigned (git-fixes).\n- KVM: arm64: Rename the device variable to s2_force_noncacheable (git-fixes).\n- KVM: arm64: Return early from trace helpers when KVM isn't available (git-fixes).\n- KVM: arm64: Set ID_{AA64PFR0,PFR1}_EL1.GIC when GICv3 is configured (git-fixes).\n- KVM: arm64: vgic-v3: Release reserved slot outside of lpi_xa's lock (git-fixes).\n- KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes).\n- KVM: nSVM: Use vcpu-\u003earch.cr2 when updating vmcb12 on nested #VMEXIT (git-fixes).\n- KVM: nVMX: Add consistency check for TSC_MULTIPLIER=0 (git-fixes).\n- KVM: Reject wrapped offset in kvm_reset_dirty_gfn() (git-fixes).\n- KVM: SEV: Disallow LAUNCH_FINISH if vCPUs are actively being created (git-fixes).\n- KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (git-fixes).\n- KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish (git-fixes).\n- KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm-\u003elock (git-fixes).\n- KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU (git-fixes).\n- KVM: SVM: Disallow EFER.LMSLE when not supported by hardware (git-fixes).\n- KVM: SVM: Fix a missing kunmap_local() in sev_gmem_post_populate() (git-fixes).\n- KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC (git-fixes).\n- KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (git-fixes).\n- KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN (git-fixes).\n- KVM: SVM: Properly check RAX in the emulator for SVM instructions (git-fixes).\n- KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (git-fixes).\n- KVM: TDX: Explicitly set user-return MSRs that *may* be clobbered by the TDX-Module (git-fixes).\n- KVM: x86/mmu: Fix UBSAN warning when reading nx_huge_pages parameter (git-fixes).\n- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (git-fixes).\n- KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (git-fixes).\n- KVM: x86: Advertise EferLmsleUnsupported to userspace (git-fixes).\n- KVM: x86: check for nEPT/nNPT in slow flush hypercalls (git-fixes).\n- KVM: X86: Fix array_index_nospec protection in __pv_send_ipi (git-fixes).\n- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (git-fixes).\n- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (git-fixes).\n- KVM: x86: Ignore cpuid faulting in SMM (git-fixes).\n- leds: lgm-sso: Remove duplicate assignments for priv-\u003emmap (git-fixes).\n- leds: qcom-lpg: Check for array overflow when selecting the high resolution (stable-fixes).\n- lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() (git-fixes).\n- md/raid1: fix the comparing region of interval tree (bsc#1261555).\n- md/raid1: serialize overlap io for writemostly disk (bsc#1261555).\n- media: amphion: Fix race between m2m job_abort and device_run (git-fixes).\n- media: as102: fix to not free memory after the device is registered in as102_usb_probe() (git-fixes).\n- media: chips-media: wave5: add missing spinlock protection for handle_dynamic_resolution_change() (git-fixes).\n- media: chips-media: wave5: add missing spinlock protection for send_eos_event() (git-fixes).\n- media: chips-media: wave5: fix a potential memory leak in wave5_vdi_init() (git-fixes).\n- media: dib8000: avoid division by 0 in dib8000_set_dds() (git-fixes).\n- media: em28xx: fix use-after-free in em28xx_v4l2_open() (git-fixes).\n- media: hackrf: fix to not free memory after the device is registered in hackrf_probe() (git-fixes).\n- media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() (git-fixes).\n- media: i2c: imx283: Enter full standby when stopping streaming (git-fixes).\n- media: i2c: imx283: Fix hang when going from large to small resolution (git-fixes).\n- media: i2c: imx412: Assert reset GPIO during probe (git-fixes).\n- media: i2c: ov08d10: fix image vertical start setting (git-fixes).\n- media: i2c: ov8856: free control handler on error in ov8856_init_controls() (git-fixes).\n- media: intel/ipu6: fix error pointer dereference (git-fixes).\n- media: mtk-jpeg: fix use-after-free in release path due to uncancelled work (git-fixes).\n- media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 (git-fixes).\n- media: omap3isp: drop the use count of v4l2 pipeline (git-fixes).\n- media: pci: zoran: fix potential memory leak in zoran_probe() (git-fixes).\n- media: rc: streamzap: Error handling in probe (git-fixes).\n- media: rc: xbox_remote: heed DMA restrictions (git-fixes).\n- media: saa7164: add ioremap return checks and cleanups (git-fixes).\n- media: staging: imx: configure src_mux in csi_start (git-fixes).\n- media: staging: imx: request mbus_config in csi_start (git-fixes).\n- media: uvcvideo: Enable VB2_DMABUF for metadata stream (git-fixes).\n- media: videobuf2: Set vma_flags in vb2_dma_sg_mmap (git-fixes).\n- media: vidtv: fix nfeeds state corruption on start_streaming failure (git-fixes).\n- media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections (git-fixes).\n- media: vidtv: fix pass-by-value structs causing MSAN warnings (git-fixes).\n- memory: tegra30-emc: Fix dll_change check (git-fixes).\n- memory: tegra124-emc: Fix dll_change check (git-fixes).\n- mfd: core: Preserve OF node when ACPI handle is present (git-fixes).\n- mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() (git-fixes).\n- mfd: stpmic1: Attempt system shutdown twice in case PMIC is confused (git-fixes).\n- mkspec: Add signature to source list only when it exists.\n- mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration (git-fixes).\n- mmc: vub300: fix NULL-deref on disconnect (git-fixes).\n- modpost: Amend ppc64 save/restfpr symnames for -Os build (bsc#1215199).\n- mtd: docg3: fix use-after-free in docg3_release() (git-fixes).\n- mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions (git-fixes).\n- mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path (git-fixes).\n- mtd: physmap_of_gemini: Fix disabled pinctrl state check (git-fixes).\n- mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob (git-fixes).\n- mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations (git-fixes).\n- mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() (git-fixes).\n- mtd: spi-nor: sst: Fix write enable before AAI sequence (git-fixes).\n- mtd: spi-nor: swp: check SR_TB flag when getting tb_mask (git-fixes).\n- net-shapers: don't free reply skb after genlmsg_reply() (git-fixes).\n- net/mlx5: Fix HCA caps leak on notifier init failure (git-fixes).\n- net/rds: reset op_nents when zerocopy page pin fails (bsc#1265626).\n- net/sched: cls_fw: fix NULL dereference of \"old\" filters before change() (git-fixes).\n- net/sched: fix pedit partial COW leading to page cache corruption (bsc#1265421).\n- net: gro: don't merge zcopy skbs (git-fixes).\n- net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf (git-fixes).\n- net: mana: Add MAC address to vPort logs and clarify error messages (git-fixes).\n- net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq() (git-fixes).\n- net: mana: Don't overwrite port probe error with add_adev result (git-fixes).\n- net: mana: Fix crash from unvalidated SHM offset read from BAR0 during FLR (bsc#1265846).\n- net: mana: Fix EQ leak in mana_remove on NULL port (git-fixes).\n- net: mana: Fix RX skb truesize accounting (bsc#1248754).\n- net: mana: Guard mana_remove against double invocation (git-fixes).\n- net: mana: hardening: Validate adapter_mtu from MANA_QUERY_DEV_CONFIG (git-fixes).\n- net: mana: hardening: Validate doorbell ID from GDMA_REGISTER_DEVICE response (git-fixes).\n- net: mana: Init gf_stats_work before potential error paths in probe (git-fixes).\n- net: mana: Init link_change_work before potential error paths in probe (git-fixes).\n- net: mana: Move current_speed debugfs file to mana_init_port() (git-fixes).\n- net: mana: remove double CQ cleanup in mana_create_rxq error path (git-fixes).\n- net: mana: Set default number of queues to 16 (bsc#1261648).\n- net: mana: Skip WQ object destruction for uninitialized RXQ (git-fixes).\n- net: mana: Use at least SZ_4K in doorbell ID range check (git-fixes).\n- net: mana: Use pci_name() for debugfs directory naming (git-fixes).\n- net: phy: broadcom: Save PHY counters during suspend (git-fixes).\n- net: phy: DP83TC811: add reading of abilities (git-fixes).\n- net: phy: dp83869: fix setting CLK_O_SEL field (git-fixes).\n- net: phy: fix a return path in get_phy_c45_ids() (git-fixes).\n- net: phy: qcom: at803x: Use the correct bit to disable extended next page (git-fixes).\n- net: stmmac: Fix PTP ref clock for Tegra234 (git-fixes).\n- net: usb: asix: ax88772: re-add usbnet_link_change() in phylink callbacks (git-fixes).\n- net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() (git-fixes).\n- net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() (git-fixes).\n- net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit (git-fixes).\n- net: wan: fsl_ucc_hdlc: fix ucc_hdlc_remove (git-fixes).\n- net: wan: fsl_ucc_hdlc: fix uhdlc_memclean (git-fixes).\n- net: wan: fsl_ucc_hdlc: free tx_skbuff in uhdlc_memclean (git-fixes).\n- net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler (git-fixes).\n- NFC: digital: Bounds check NFC-A cascade depth in SDD response handler (git-fixes).\n- nfc: llcp: add missing return after LLCP_CLOSED checks (git-fixes).\n- nfc: pn533: allocate rx skb before consuming bytes (git-fixes).\n- nfc: s3fwrn5: allocate rx skb before consuming bytes (git-fixes).\n- NFC: trf7970a: Ignore antenna noise when checking for RF field (git-fixes).\n- nvme-apple: drop invalid put of admin queue reference count (git-fixes).\n- nvme-auth: Include SC_C in RVAL controller hash (bsc#1260428).\n- nvme-loop: do not cancel I/O and admin tagset during ctrl reset/shutdown (bsc#1262709).\n- nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston OM3SGP4 (git-fixes).\n- nvme: Allow reauth from sysfs (bsc#1259672).\n- nvme: Expose the tls_configured sysfs for secure concat connections (bsc#1259672).\n- nvme: expose TLS mode (bsc#1259672).\n- nvme: fix admin queue leak on controller reset (git-fixes).\n- nvme: fix PCIe subsystem reset controller state transition (bsc#1261738).\n- nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers (git-fixes).\n- ocfs2: fix possible deadlock between unlink and dio_end_io_write (bsc#1258718).\n- ocfs2: split transactions in dio completion to avoid credit exhaustion (bsc#1258718).\n- openvswitch: vport: fix self-deadlock on release of tunnel ports (git-fixes).\n- panic/printk: replace other_cpu_in_panic() with panic_on_other_cpu() (bsc#1261149).\n- panic/printk: replace this_cpu_in_panic() with panic_on_this_cpu() (bsc#1261149).\n- panic: introduce helper functions for panic state (bsc#1261149).\n- panic: use angle-bracket include for panic.h (bsc#1261149).\n- PCI/AER: Clear only error bits in PCIe Device Status (git-fixes).\n- PCI/AER: Stop ruling out unbound devices as error source (git-fixes).\n- PCI/ASPM: Fix pci_clear_and_set_config_dword() usage (git-fixes).\n- PCI/NPEM: Set LED_HW_PLUGGABLE for hotplug-capable ports (git-fixes).\n- PCI/TPH: Allow TPH enable for RCiEPs (git-fixes).\n- PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well (git-fixes).\n- PCI: dwc: rcar-gen4: Change EPC BAR alignment to 4K as per the documentation (git-fixes).\n- PCI: Enable AtomicOps only if Root Port supports them (git-fixes).\n- PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown (git-fixes).\n- PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup (git-fixes).\n- PCI: epf-mhi: Return 0, not remaining timeout, when eDMA ops complete (git-fixes).\n- PCI: hv: Set default NUMA node to 0 for devices without affinity info (bsc#1261648).\n- PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found (git-fixes).\n- PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion support (git-fixes).\n- PCI: tegra194: Allow system suspend when the Endpoint link is not up (git-fixes).\n- PCI: tegra194: Disable direct speed change for Endpoint mode (git-fixes).\n- PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down (git-fixes).\n- PCI: tegra194: Disable PERST# IRQ only in Endpoint mode (git-fixes).\n- PCI: tegra194: Fix CBB timeout caused by DBI access before core power-on (git-fixes).\n- PCI: tegra194: Fix polling delay for L2 state (git-fixes).\n- PCI: tegra194: Free up Endpoint resources during remove() (git-fixes).\n- PCI: tegra194: Increase LTSSM poll time on surprise link down (git-fixes).\n- PCI: tegra194: Set LTR message request before PCIe link up in Endpoint mode (git-fixes).\n- PCI: tegra194: Use devm_gpiod_get_optional() to parse \"nvidia,refclk-select\" (git-fixes).\n- PCI: tegra194: Use DWC IP core version (git-fixes).\n- pinctrl: abx500: Fix type of 'argument' variable (git-fixes).\n- pinctrl: Fix spelling problem (git-fixes).\n- pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) (stable-fixes).\n- pinctrl: pic32: change all cases of bare 'unsigned' to 'unsigned int' (git-fixes).\n- pinctrl: pic32: use consistent spacing around '+' (git-fixes).\n- pinctrl: pinctrl-pic32: Fix resource leak (git-fixes).\n- pinctrl: realtek: Fix function signature for config argument (git-fixes).\n- pinctrl: renesas: rzg2l: Fix save/restore of {IOLH,IEN,PUPD,SMT} registers (git-fixes).\n- platform/chrome: chromeos_tbmc: Drop wakeup source on remove (git-fixes).\n- platform/surface: surfacepro3_button: Drop wakeup source on remove (git-fixes).\n- platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug (stable-fixes).\n- platform/x86/intel-uncore-freq: Handle autonomous UFS status bit (git-fixes).\n- platform/x86: asus-wmi: adjust screenpad power/brightness handling (git-fixes).\n- platform/x86: asus-wmi: fix screenpad brightness range (git-fixes).\n- platform/x86: dell-wmi-sysman: bound enumeration string aggregation (git-fixes).\n- platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() (git-fixes).\n- platform/x86: hp-wmi: Ignore backlight and FnLock events (stable-fixes).\n- platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup (git-fixes).\n- power: supply: axp288_charger: Do not cancel work before initializing it (git-fixes).\n- power: supply: max17042: avoid overflow when determining health (git-fixes).\n- powerpc/crash: fix backup region offset update to elfcorehdr (bsc#1259535).\n- powerpc/crash: Update backup region offset in elfcorehdr on memory hotplug (bsc#1259535).\n- printk/nbcon/panic: Allow printk kthread to sleep when the system is in panic (bsc#1261149).\n- printk/nbcon: Block printk kthreads when any CPU is in an emergency context (bsc#1261149).\n- printk/nbcon: Release nbcon consoles ownership in atomic flush after each emitted record (bsc#1261149).\n- printk/nbcon: Restore IRQ in atomic flush after each emitted record (bsc#1261149).\n- printk/nbcon: use panic_on_this_cpu() helper (bsc#1261149).\n- printk: Allow printk_trigger_flush() to flush all types (bsc#1262750).\n- printk: Allow to use the printk kthread immediately even for 1st nbcon (jsc#PED-7912).\n- printk: Avoid irq_work for printk_deferred() on suspend (bsc#1262750).\n- printk: Avoid scheduling irq_work on suspend (bsc#1262750).\n- printk: console_flush_one_record() code cleanup (bsc#1261149).\n- printk: Introduce console_flush_one_record (bsc#1261149).\n- printk: Use console_flush_one_record for legacy printer kthread (bsc#1261149).\n- pwm: imx-tpm: Count the number of enabled channels in probe (git-fixes).\n- qat: don't mess with -\u003ed_name (jsc#PED-14238).\n- r8152: fix incorrect register write to USB_UPHY_XTAL (git-fixes).\n- RDMA/irdma: Fix double free related to rereg_user_mr (git-fixes).\n- RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() (git-fixes).\n- RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() (git-fixes).\n- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (git-fixes).\n- RDMA/mana: Validate rx_hash_key_len (git-fixes).\n- RDMA/mana_ib: cleanup the usage of mana_gd_send_request() (git-fixes).\n- RDMA/mana_ib: Disable RX steering on RSS QP destroy (git-fixes).\n- RDMA/mana_ib: Support memory windows (git-fixes).\n- regulator: act8945a: fix OF node reference imbalance (git-fixes).\n- regulator: bd9571mwv: fix OF node reference imbalance (git-fixes).\n- regulator: max77650: fix OF node reference imbalance (git-fixes).\n- regulator: mt6357: fix OF node reference imbalance (git-fixes).\n- regulator: rk808: fix OF node reference imbalance (git-fixes).\n- remoteproc: xlnx: Fix sram property parsing (git-fixes).\n- remoteproc: xlnx: Only access buffer information if IPI is buffered (git-fixes).\n- Revert \"ALSA: usb: Increase volume range that triggers a warning\" (git-fixes).\n- Revert \"serial: 8250: Revert \"drop lockdep annotation from serial8250_clear_IER()\"\" (bsc#1262480).\n- Revert \"serial: 8250: Switch to nbcon console\" (bsc#1262480).\n- rtc: abx80x: Disable alarm feature if no interrupt attached (git-fixes).\n- rtc: ntxec: fix OF node reference imbalance (git-fixes).\n- s390/dasd: Copy detected format information to secondary device (bsc#1259994).\n- s390/dasd: Fix gendisk parent after copy pair swap (bsc#1259994).\n- s390/dasd: Move quiesce state with pprc swap (bsc#1259994).\n- sched/fair: Change likelyhood of nohz.nr_cpus (bsc#1234634 bsc#1258961).\n- sched/fair: Move checking for nohz cpus after time check (bsc#1234634 bsc#1258961).\n- sched/fair: Remove nohz.nr_cpus and use weight of cpumask instead (bsc#1234634 bsc#1258961).\n- scsi: lpfc: Add clean up of aborted NVMe commands during PCI fcn reset (bsc#1262019).\n- scsi: lpfc: Add log messages to fabric login error labels (bsc#1262019).\n- scsi: lpfc: Add PCI ID support for LPe42100 series adapters (bsc#1262019).\n- scsi: lpfc: Add REG_VFI mailbox cmd error handling (bsc#1262019).\n- scsi: lpfc: Break out of IRQ affinity assignment when mask reaches nr_cpu_ids (bsc#1262019).\n- scsi: lpfc: Check ASIC_ID register to aid diagnostics during failed fw updates (bsc#1262019).\n- scsi: lpfc: Cleanup error exit paths in lpfc_fdmi_cmd() and associated messages (bsc#1262019).\n- scsi: lpfc: ELIMINATE kernel-doc warnings in lpfc.h (bsc#1262019).\n- scsi: lpfc: Fix incorrect txcmplq_cnt during cleanup in lpfc_sli_abort_ring() (bsc#1262019).\n- scsi: lpfc: Introduce 128G link speed selection and support (bsc#1262019).\n- scsi: lpfc: Log discarded and insufficient RQE buffer events (bsc#1262019).\n- scsi: lpfc: Log MCQE contents for mbox commands with no context (bsc#1262019).\n- scsi: lpfc: Properly set WC for DPP mapping (bsc#1262019).\n- scsi: lpfc: Reduce pointer chasing when accessing vmid_flag (bsc#1262019).\n- scsi: lpfc: Remove deprecated PBDE feature (bsc#1262019).\n- scsi: lpfc: Remove unnecessary ndlp kref get in lpfc_check_nlp_post_devloss (bsc#1262019).\n- scsi: lpfc: Restrict first burst to non-FCoE and SLI4 adapters only (bsc#1262019).\n- scsi: lpfc: Select mailbox rq_create cmd version based on SLI4 if_type (bsc#1262019).\n- scsi: lpfc: Update class of service bit field to 3 bits for WQE submissions (bsc#1262019).\n- scsi: lpfc: Update construction of SGL when XPSGL is enabled (bsc#1262019).\n- scsi: lpfc: Update copyright year string for 2026 (bsc#1262019).\n- scsi: lpfc: Update log message when ndlp kref get is unsuccessful (bsc#1262019).\n- scsi: lpfc: Update lpfc version to 14.4.0.14 (bsc#1262019).\n- scsi: lpfc: Update lpfc version to 15.0.0.0 (bsc#1262019).\n- scsi: lpfc: Update outdated comment for renamed lpfc_freenode() (bsc#1262019).\n- scsi: lpfc: Use min_t() instead of min() in lpfc_sli4_driver_resource_setup (bsc#1262019).\n- scsi: lpfc: Use the crc32c() function (bsc#1262019).\n- scsi: mpi3mr: Add NULL checks when resetting request and reply queues (git-fixes).\n- scsi: ses: Fix devices attaching to different hosts (git-fixes).\n- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (git-fixes).\n- scsi: target: iscsi: validate CHAP_R length before base64 decode (bsc#1265449).\n- scsi: ufs: ufs-pci: Add support for Intel Wildcat Lake (jsc#PED-13771).\n- selftests/bpf: Test cross-sign 64bits range refinement (git-fixes).\n- selftests/bpf: Test invariants on JSLT crossing sign (git-fixes).\n- selftests/bpf: test refining u32/s32 bounds when ranges cross min/max boundary (git-fixes).\n- selftests: net: build net/lib dependency in all target (bsc#1262245).\n- selinux: don't reserve xattr slot when we won't fill it (stable-fixes).\n- selinux: prune /sys/fs/selinux/disable (stable-fixes).\n- selinux: shrink critical section in sel_write_load() (stable-fixes).\n- serial: 8250: Add serial8250_handle_irq_locked() (bsc#1262480).\n- serial: 8250: Protect LCR write in shutdown (bsc#1262480).\n- serial: 8250_dw: Avoid unnecessary LCR writes (bsc#1262480).\n- serial: 8250_dw: Ensure BUSY is deasserted (bsc#1262480).\n- serial: 8250_dw: Rework dw8250_handle_irq() locking and IIR handling (bsc#1262480).\n- serial: 8250_dw: Rework IIR_NO_INT handling to stop interrupt storm (bsc#1262480).\n- Set CONFIG_INTEL_TSX_MODE to follow upstream AUTO default (bsc#1263044).\n- soc/tegra: cbb: Set ERD on resume for err interrupt (git-fixes).\n- soc: qcom: aoss: compare against normalized cooling state (git-fixes).\n- soc: qcom: llcc: fix v1 SB syndrome register offset (git-fixes).\n- soc: qcom: ocmem: make the core clock optional (git-fixes).\n- soc: qcom: ocmem: register reasons for probe deferrals (git-fixes).\n- soc: qcom: ocmem: return -EPROBE_DEFER is ocmem is not available (git-fixes).\n- sound: ua101: fix division by zero at probe (git-fixes).\n- soundwire: bus: demote UNATTACHED state warnings to dev_dbg() (git-fixes).\n- soundwire: cadence: Clear message complete before signaling waiting thread (git-fixes).\n- soundwire: debugfs: initialize firmware_file to empty string (git-fixes).\n- spi: aspeed-smc: fix controller deregistration (git-fixes).\n- spi: at91-usart: fix controller deregistration (git-fixes).\n- spi: atmel: fix controller deregistration (git-fixes).\n- spi: bcm63xx: fix controller deregistration (git-fixes).\n- spi: bcmbca-hsspi: fix controller deregistration (git-fixes).\n- spi: cadence: fix controller deregistration (git-fixes).\n- spi: cadence: fix unclocked access on unbind (git-fixes).\n- spi: ch341: fix memory leaks on probe failures (git-fixes).\n- spi: coldfire-qspi: fix controller deregistration (git-fixes).\n- spi: dln2: fix controller deregistration (git-fixes).\n- spi: fix controller cleanup() documentation (git-fixes).\n- spi: fix misleading controller deregistration kernel-doc (git-fixes).\n- spi: fix misleading controller registration kernel-doc (git-fixes).\n- spi: fsl-espi: fix controller deregistration (git-fixes).\n- spi: fsl-qspi: Use reinit_completion() for repeated operations (git-fixes).\n- spi: fsl: fix controller deregistration (git-fixes).\n- spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo (git-fixes).\n- spi: img-spfi: fix controller deregistration (git-fixes).\n- spi: imx: fix runtime pm leak on probe deferral (git-fixes).\n- spi: imx: fix use-after-free on unbind (git-fixes).\n- spi: lantiq-ssc: fix controller deregistration (git-fixes).\n- spi: meson-spicc: fix controller deregistration (git-fixes).\n- spi: microchip-core-qspi: fix controller deregistration (git-fixes).\n- spi: mpc52xx: fix controller deregistration (git-fixes).\n- spi: mpc52xx: fix use-after-free on registration failure (git-fixes).\n- spi: mpc52xx: fix use-after-free on unbind (git-fixes).\n- spi: mtk-nor: fix controller deregistration (git-fixes).\n- spi: mtk-snfi: fix memory leak in probe (git-fixes).\n- spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback (git-fixes).\n- spi: mxic: fix controller deregistration (git-fixes).\n- spi: mxs: fix controller deregistration (git-fixes).\n- spi: npcm-pspi: fix controller deregistration (git-fixes).\n- spi: omap2-mcspi: fix controller deregistration (git-fixes).\n- spi: orion: fix clock imbalance on registration failure (git-fixes).\n- spi: orion: fix controller deregistration (git-fixes).\n- spi: orion: fix runtime pm leak on unbind (git-fixes).\n- spi: pic32-sqi: fix controller deregistration (git-fixes).\n- spi: pic32: fix controller deregistration (git-fixes).\n- spi: pl022: fix controller deregistration (git-fixes).\n- spi: qup: fix controller deregistration (git-fixes).\n- spi: rockchip: fix controller deregistration (git-fixes).\n- spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ (git-fixes).\n- spi: rspi: fix controller deregistration (git-fixes).\n- spi: s3c64xx: fix controller deregistration (git-fixes).\n- spi: s3c64xx: fix NULL-deref on driver unbind (git-fixes).\n- spi: sh-hspi: fix controller deregistration (git-fixes).\n- spi: sprd: fix controller deregistration (git-fixes).\n- spi: st-ssc4: fix controller deregistration (git-fixes).\n- spi: sun4i: fix controller deregistration (git-fixes).\n- spi: sun6i: fix controller deregistration (git-fixes).\n- spi: syncuacer: fix controller deregistration (git-fixes).\n- spi: ti-qspi: fix controller deregistration (git-fixes).\n- spi: topcliff-pch: fix controller deregistration (git-fixes).\n- spi: topcliff-pch: fix use-after-free on unbind (git-fixes).\n- spi: uniphier: fix controller deregistration (git-fixes).\n- spi: uniphier: Simplify clock handling with devm_clk_get_enabled() (stable-fixes).\n- spi: zynq-qspi: fix controller deregistration (git-fixes).\n- spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() (stable-fixes).\n- spi: zynqmp-gqspi: fix controller deregistration (git-fixes).\n- staging: media: atomisp: Disallow all private IOCTLs (git-fixes).\n- staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() (git-fixes).\n- staging: sm750fb: fix division by zero in ps_to_hz() (git-fixes).\n- staging: vme_user: fix root device leak on init failure (git-fixes).\n- tg3: replace placeholder MAC address with device property (git-fixes).\n- thermal/drivers/spear: Fix error condition for reading st,thermal-flags (git-fixes).\n- thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp (git-fixes).\n- thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata (git-fixes).\n- tools/power/turbostat: Fix microcode patch level output for AMD/Hygon (git-fixes).\n- tools: hv: Fix cross-compilation (git-fixes).\n- tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public() (git-fixes).\n- tpm: avoid -Wunused-but-set-variable (git-fixes).\n- tpm: Fix auth session leak in tpm2_get_random() error path (git-fixes).\n- tpm: tpm_tis: add error logging for data transfer (git-fixes).\n- tpm: tpm_tis: stop transmit if retries are exhausted (git-fixes).\n- tpm: Use kfree_sensitive() to free auth session in tpm_dev_release() (git-fixes).\n- tty: serial: ip22zilog: Fix section mispatch warning (git-fixes).\n- udp: Force compute_score to always inline (bsc#1241259).\n- unshare: fix unshare_fs() handling (git-fixes).\n- USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen (git-fixes).\n- usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (git-fixes).\n- usb: chipidea: otg: not wait vbus drop if use role_switch (git-fixes).\n- USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam (stable-fixes).\n- usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer (stable-fixes).\n- usb: gadget: f_hid: Add missing error code (git-fixes).\n- usb: gadget: f_hid: don't call cdev_init while cdev in use (git-fixes).\n- usb: gadget: f_hid: move list and spinlock inits from bind to alloc (stable-fixes).\n- usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() (git-fixes).\n- usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() (git-fixes).\n- usb: gadget: f_uac1_legacy: validate control request size (stable-fixes).\n- usb: gadget: renesas_usb3: validate endpoint index in standard request handlers (git-fixes).\n- usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo (git-fixes).\n- USB: omap_udc: DMA: Don't enable burst 4 mode (git-fixes).\n- usb: port: add delay after usb_hub_set_port_power() (git-fixes).\n- usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive (stable-fixes).\n- USB: serial: io_edgeport: add support for Blackbox IC135A (stable-fixes).\n- USB: serial: option: add MeiG Smart SRM825WN (stable-fixes).\n- USB: serial: option: add support for Rolling Wireless RW135R-GL (stable-fixes).\n- USB: serial: option: add Telit Cinterion FN990A MBIM composition (git-fixes).\n- USB: serial: option: add Telit Cinterion LE910Cx compositions (stable-fixes).\n- usb: storage: Expand range of matched versions for VL817 quirks entry (git-fixes).\n- usb: typec: tcpm: reset internal port states on soft reset AMS (git-fixes).\n- usb: ulpi: fix memory leak on ulpi_register() error paths (git-fixes).\n- usb: usblp: fix heap leak in IEEE 1284 device ID via short response (stable-fixes).\n- usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl (stable-fixes).\n- usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() (git-fixes).\n- usbip: validate number_of_packets in usbip_pack_ret_submit() (git-fixes).\n- vfio/pci: Lock upstream bridge for vfio_pci_core_disable() (git-fixes).\n- vfio/pds: Fix memory leak in pds_vfio_dirty_enable() (git-fixes).\n- vfio/pds: Fix missing detach_ioas op (git-fixes).\n- vfio/pds: replace bitmap_free with vfree (git-fixes).\n- vfio/type1: Fix error unwind in migration dirty bitmap allocation (git-fixes).\n- vfio: Fix unbalanced vfio_df_close call in no-iommu mode (git-fixes).\n- vfio: Prevent open_count decrement to negative (git-fixes).\n- virt: arm-cca-guest: fix error check for RSI_INCOMPLETE (git-fixes).\n- virt: sev-guest: Do not use host-controlled page order in cleanup path (git-fixes).\n- virt: tdx-guest: Fix handling of host controlled 'quote' buffer length (git-fixes).\n- virt: tdx-guest: Return error for GetQuote failures (git-fixes).\n- wifi: ath5k: do not access array OOB (git-fixes).\n- wifi: ath9k: Fix typo (git-fixes).\n- wifi: ath10k: fix station lookup failure during disconnect (git-fixes).\n- wifi: ath11k: fix memory leaks in beacon template setup (git-fixes).\n- wifi: ath12k: fix leak in some ath12k_wmi_xxx() functions (git-fixes).\n- wifi: ath12k: use lockdep_assert_in_rcu_read_lock() for RCU assertions (git-fixes).\n- wifi: b43: enforce bounds check on firmware key index in b43_rx() (git-fixes).\n- wifi: b43legacy: enforce bounds check on firmware key index in RX path (git-fixes).\n- wifi: brcmfmac: Fix error pointer dereference (git-fixes).\n- wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task (git-fixes).\n- wifi: brcmfmac: validate bsscfg indices in IF events (stable-fixes).\n- wifi: brcmsmac: Fix dma_free_coherent() size (git-fixes).\n- wifi: cw1200: Revert \"Fix locking in error paths\" (git-fixes).\n- wifi: libertas: notify firmware load wait on disconnect (git-fixes).\n- wifi: mac80211: check ieee80211_rx_data_set_link return in pubsta MLO path (git-fixes).\n- wifi: mac80211: check tdls flag in ieee80211_tdls_oper (stable-fixes).\n- wifi: mac80211: drop stray 'static' from fast-RX rx_result (git-fixes).\n- wifi: mac80211: handle VHT EXT NSS in ieee80211_determine_our_sta_mode() (git-fixes).\n- wifi: mac80211: remove station if connection prep fails (git-fixes).\n- wifi: mac80211: use safe list iteration in radar detect work (git-fixes).\n- wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req() (git-fixes).\n- wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor (stable-fixes).\n- wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling (git-fixes).\n- wifi: mt76: mt7615: fix use_cts_prot support (git-fixes).\n- wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() (git-fixes).\n- wifi: mt76: mt7915: fix use_cts_prot support (git-fixes).\n- wifi: mt76: mt7921: fix 6GHz regulatory update on connection (git-fixes).\n- wifi: mt76: mt7921: fix a potential clc buffer length underflow (git-fixes).\n- wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work (git-fixes).\n- wifi: mt76: mt7921: Place upper limit on station AID (git-fixes).\n- wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() (git-fixes).\n- wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr (git-fixes).\n- wifi: mt76: mt7925: fix incorrect length field in txpower command (git-fixes).\n- wifi: mt76: mt7925: Fix incorrect MLO mode in firmware control (git-fixes).\n- wifi: mt76: mt7925: fix incorrect TLV length in CLC command (git-fixes).\n- wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_tx_check_aggr() (git-fixes).\n- wifi: mt76: mt7925: prevent NULL vif dereference in mt7925_mac_write_txwi (git-fixes).\n- wifi: mt76: mt7996: fix FCS error flag check in RX descriptor (git-fixes).\n- wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event (git-fixes).\n- wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work() (git-fixes).\n- wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() (git-fixes).\n- wifi: nl80211: fix NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST usage (git-fixes).\n- wifi: nl80211: require admin perm on SET_PMK / DEL_PMK (git-fixes).\n- wifi: rsi: fix kthread lifetime race between self-exit and external-stop (git-fixes).\n- wifi: rt2x00usb: fix devres lifetime (git-fixes).\n- wifi: rtl8xxxu: fix potential use of uninitialized value (git-fixes).\n- wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet (git-fixes).\n- wifi: rtw88: Add additional USB IDs for RTL8812BU (bsc#1263135).\n- wifi: rtw88: Add BUFFALO WI-U3-866DHP to the USB ID list (bsc#1263135).\n- wifi: rtw88: Add support for Mercusys MA30N and D-Link DWA-T185 rev. A1 (bsc#1263135).\n- wifi: rtw88: check for PCI upstream bridge existence (git-fixes).\n- wifi: rtw88: fix device leak on probe failure (git-fixes).\n- wifi: rtw88: rtw8822bu VID/PID for BUFFALO WI-U2-866DM (bsc#1263135).\n- wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() (git-fixes).\n- wifi: wl1251: validate packet IDs before indexing tx_frames (stable-fixes).\n- x86/acpi/boot: Correct acpi_is_processor_usable() check again (git-fixes).\n- x86/boot/sev: Avoid shared GHCB page for early memory acceptance (git-fixes).\n- x86/boot/sev: Support memory acceptance in the EFI stub under SVSM (git-fixes).\n- x86/boot: Fix page table access in 5-level to 4-level paging transition (git-fixes).\n- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (bsc#1263255).\n- x86/cpufeatures: Free up unused feature bits (bsc#1263255).\n- x86/fred: Fix early boot failures on SEV-ES/SNP guests (git-fixes).\n- x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() (git-fixes).\n- x86/sev: Add missing RIP_REL_REF() invocations during sme_enable() (git-fixes).\n- x86/sev: Do not touch VMSA pages during SNP guest memory kdump (git-fixes).\n- x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero (git-fixes).\n- x86/sev: Fix operator precedence in GHCB_MSR_VMPL_REQ_LEVEL macro (git-fixes).\n- x86/sev: Improve handling of writes to intercepted TSC MSRs (git-fixes).\n- x86/sev: Make sure pages are not skipped during kdump (git-fixes).\n- x86/tsx: Get the tsx= command line parameter with early_param() (bsc#1250951 bsc#1263044).\n- x86/tsx: Make tsx_ctrl_state static (bsc#1250951 bsc#1263044).\n- x86/vmware: Parse MP tables for SEV-SNP enabled guests under VMware hypervisors (git-fixes).\n- X.509: Fix out-of-bounds access when parsing extensions (git-fixes).\n- Xarray: do not return sibling entries from xas_find_marked() (bsc#1263815).\n","status":"published","published":"2026-05-28T11:40:20Z","modified":"2026-06-02T18:24:31.043353389Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:2217-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).\n- CVE-2025-68310: s390/pci: Use pci_uevent_ers() in PCI recovery (bsc#1255160).\n- CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).\n- CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).\n- CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).\n- CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).\n- CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).\n- CVE-2026-23262: gve: Fix stats report corruption on queue count change (bsc#1259870).\n- CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).\n- CVE-2026-23276: net: move dev_xmit_recursion() helpers to net/core/dev.h (bsc#1260012).\n- CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).\n- CVE-2026-23304: ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() (bsc#1260544).\n- CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).\n- CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).\n- CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).\n- CVE-2026-23335: RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() (bsc#1260550).\n- CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).\n- CVE-2026-23343: xdp: produce a warning when calculated tailroom is negative (bsc#1260527).\n- CVE-2026-23346: mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (bsc#1260529).\n- CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).\n- CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).\n- CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).\n- CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).\n- CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).\n- CVE-2026-23383: bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing (bsc#1260497).\n- CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).\n- CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).\n- CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).\n- CVE-2026-23395: Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ (bsc#1260580).\n- CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).\n- CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).\n- CVE-2026-23412: netfilter: bpf: defer hook memory release until rcu readers are done (bsc#1261412).\n- CVE-2026-23419: net/rds: Fix circular locking dependency in rds_tcp_tune (bsc#1261507).\n- CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).\n- CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).\n- CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).\n- CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).\n- CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).\n- CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).\n- CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).\n- CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).\n- CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).\n- CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).\n- CVE-2026-23461: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (bsc#1261707).\n- CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).\n- CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).\n- CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).\n- CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on wakeup race (bsc#1261694).\n- CVE-2026-31395: bnxt_en: fix OOB access in DBG_BUF_PRODUCER async event handler (bsc#1261786).\n- CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).\n- CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).\n- CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).\n- CVE-2026-31404: xfs: avoid dereferencing log items after push callbacks (bsc#1261628).\n- CVE-2026-31407: netfilter: conntrack: add missing netlink policy validations (bsc#1261632).\n- CVE-2026-31411: net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (bsc#1261752).\n- CVE-2026-31415: ipv6: avoid overflows in ip6_datagram_send_ctl() (bsc#1262099).\n- CVE-2026-31416: netfilter: nfnetlink_log: account for netlink header size (bsc#1262100).\n- CVE-2026-31420: bridge: mrp: reject zero test interval to avoid OOM panic (bsc#1262055).\n- CVE-2026-31421: net/sched: cls_fw: fix NULL pointer dereference on shared blocks (bsc#1262061).\n- CVE-2026-31422: net/sched: cls_flow: fix NULL pointer dereference on shared blocks (bsc#1262054).\n- CVE-2026-31423: net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() (bsc#1262063).\n- CVE-2026-31424: netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (bsc#1262053).\n- CVE-2026-31425: rds: ib: reject FRMR registration before IB connection is established (bsc#1262074).\n- CVE-2026-31427: netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp (bsc#1262086).\n- CVE-2026-31428: netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (bsc#1262087).\n- CVE-2026-31436: dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() (bsc#1262602).\n- CVE-2026-31449: ext4: validate p_idx bounds in ext4_ext_correct_indexes (bsc#1262616).\n- CVE-2026-31470: virt: tdx-guest: Fix handling of host controlled 'quote' buffer length (bsc#1262665).\n- CVE-2026-31488: drm/amd/display: Do not skip unrelated mode changes in DSC validation (bsc#1262746).\n- CVE-2026-31494: net: cadence: macb: Synchronize stats calculations (bsc#1262671).\n- CVE-2026-31496: netfilter: nf_conntrack_expect: skip expectations in other netns via proc (bsc#1262673).\n- CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263085).\n- CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263093).\n- CVE-2026-31507: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer (bsc#1263095).\n- CVE-2026-31512: Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()\n  (bsc#1262734).\n- CVE-2026-31515: af_key: validate families in pfkey_send_migrate() (bsc#1262752).\n- CVE-2026-31519: btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create (bsc#1263012).\n- CVE-2026-31525: bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN (bsc#1262725).\n- CVE-2026-31528: perf: Make sure to use pmu_ctx-\u003epmu for groups (bsc#1263001).\n- CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262758).\n- CVE-2026-31547: drm/xe: Fix missing runtime PM reference in ccs_mode_store (bsc#1263018).\n- CVE-2026-31550: pmdomain: bcm: bcm2835-power: Increase ASB control timeout (bsc#1263104).\n- CVE-2026-31565: RDMA/irdma: Fix deadlock during netdev reset with active connections (bsc#1263064).\n- CVE-2026-31570: can: gw: fix OOB heap access in cgw_csum_crc8_rel() (bsc#1263065).\n- CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263176).\n- CVE-2026-31588: KVM: x86: Use scratch field in MMIO fragment to hold small write values (bsc#1263165).\n- CVE-2026-31602: ALSA: ctxfi: Limit PTP to a single page (bsc#1263723).\n- CVE-2026-31607: usbip: validate number_of_packets in usbip_pack_ret_submit() (bsc#1263600).\n- CVE-2026-31622: NFC: digital: Bounds check NFC-A cascade depth in SDD response handler (bsc#1263797).\n- CVE-2026-31649: net: stmmac: fix integer underflow in chain mode (bsc#1263582).\n- CVE-2026-31656: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (bsc#1263170).\n- CVE-2026-31662: tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (bsc#1263131).\n- CVE-2026-31668: seg6: separate dst_cache for input and output paths in seg6 lwtunnel (bsc#1263140).\n- CVE-2026-31669: mptcp: fix slab-use-after-free in __inet_lookup_established (bsc#1263141).\n- CVE-2026-31675: net/sched: sch_netem: fix out-of-bounds access in packet corruption (bsc#1263556).\n- CVE-2026-31679: openvswitch: validate MPLS set/set_masked payload length (bsc#1263592).\n- CVE-2026-31681: netfilter: xt_multiport: validate range encoding in checkentry (bsc#1263593).\n- CVE-2026-31682: bridge: br_nd_send: linearize skb before parsing ND options (bsc#1263595).\n- CVE-2026-31684: net: sched: act_csum: validate nested VLAN headers (bsc#1263596).\n- CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263668).\n- CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263901).\n- CVE-2026-31700: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (bsc#1263882).\n- CVE-2026-31738: vxlan: validate ND option lengths in vxlan_na_create (bsc#1264059).\n- CVE-2026-31787: xen/privcmd: fix double free via VMA splitting (bsc#1262181).\n- CVE-2026-43009: bpf: Fix incorrect pruning due to atomic fetch precision tracking (bsc#1264014).\n- CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1263931).\n- CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1263933).\n- CVE-2026-43037: ip6_tunnel: clear skb2-\u003ecb in ip4ip6_err() (bsc#1263995).\n- CVE-2026-43038: ipv6: icmp: clear skb2-\u003ecb in ip6_err_gen_icmpv6_unreach() (bsc#1264097).\n- CVE-2026-43044: crypto: caam - fix DMA corruption on long hmac keys (bsc#1264087).\n- CVE-2026-43050: atm: lec: fix use-after-free in sock_def_readable() (bsc#1264082).\n- CVE-2026-43060: netfilter: nft_ct: drop pending enqueued packets on removal (bsc#1264183).\n- CVE-2026-43088: net: af_key: zero aligned sockaddr tail in PF_KEY exports (bsc#1264469).\n- CVE-2026-43110: wifi: brcmfmac: validate bsscfg indices in IF events (bsc#1264482).\n- CVE-2026-43120: RDMA/irdma: Fix double free related to rereg_user_mr.\n- CVE-2026-43126: ALSA: mixer: oss: Add card disconnect checkpoints (bsc#1264634).\n- CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264848).\n- CVE-2026-43214: KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (bsc#1264651).\n- CVE-2026-43265: KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block() (bsc#1264427).\n- CVE-2026-43329: netfilter: flowtable: strictly check for maximum number of actions (bsc#1265085).\n- CVE-2026-43330: crypto: caam - fix overflow on long hmac keys (bsc#1264801).\n- CVE-2026-43334: Bluetooth: SMP: force responder MITM requirements before building the pairing response (bsc#1265090).\n- CVE-2026-43365: xfs: fix undersized l_iclog_roundoff values (bsc#1265119).\n- CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265116).\n- CVE-2026-43419: ceph: fix memory leaks in ceph_mdsc_build_path() (bsc#1264661).\n- CVE-2026-43437: ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() (bsc#1265126).\n- CVE-2026-43441: net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1264674).\n- CVE-2026-43494: net/rds: reset op_nents when zerocopy page pin fails (bsc#1265626).\n- CVE-2026-43503: net: skbuff: propagate shared-frag marker through frag-transfer helpers (bsc#1265960).\n\nThe following non security issues were fixed:\n\n- accel/qaic: Add overflow check to remap_pfn_range during mmap (git-fixes).\n- ACPI: AGDI: fix missing newline in error message (git-fixes).\n- ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug (git-fixes).\n- ACPI: scan: Use acpi_dev_put() in object add error paths (git-fixes).\n- ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO (git-fixes).\n- ACPI: video: force native backlight on HP OMEN 16 (8A44) (stable-fixes).\n- ALSA: 6fire: Fix input volume change detection (git-fixes).\n- ALSA: 6fire: fix use-after-free on disconnect (git-fixes).\n- ALSA: aoa: i2sbus: clear stale prepared state (git-fixes).\n- ALSA: aoa: i2sbus: fix OF node lifetime handling (git-fixes).\n- ALSA: aoa: Skip devices with no codecs in i2sbus_resume() (git-fixes).\n- ALSA: aoa: Use guard() for mutex locks (stable-fixes).\n- ALSA: asihpi: avoid write overflow check warning (stable-fixes).\n- ALSA: caiaq: Don't abort when no input device is available (git-fixes).\n- ALSA: caiaq: Fix control_put() result and cache rollback (git-fixes).\n- ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path (git-fixes).\n- ALSA: caiaq: fix usb_dev refcount leak on probe failure (git-fixes).\n- ALSA: caiaq: Handle probe errors properly (git-fixes).\n- ALSA: caiaq: take a reference on the USB device in create_card() (git-fixes).\n- ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() (git-fixes).\n- ALSA: core: Fix potential data race at fasync handling (git-fixes).\n- ALSA: core: Serialize deferred fasync state checks (git-fixes).\n- ALSA: core: Validate compress device numbers without dynamic minors (git-fixes).\n- ALSA: ctxfi: Add fallback to default RSR for S/PDIF (git-fixes).\n- ALSA: ctxfi: Fix missing SPDIFI1 index handling (stable-fixes).\n- ALSA: ctxfi: Limit PTP to a single page (git-fixes).\n- ALSA: firewire-tascam: Do not drop unread control events (git-fixes).\n- ALSA: fireworks: bound device-supplied status before string array lookup (git-fixes).\n- ALSA: hda/realtek - fixed speaker no sound update (git-fixes).\n- ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk (stable-fixes).\n- ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx (stable-fixes).\n- ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC (stable-fixes).\n- ALSA: hda/realtek: add quirk for Framework F111:000F (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 (stable-fixes).\n- ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') (git-fixes).\n- ALSA: hda: cs35l41: Put ACPI device on missing physical node (git-fixes).\n- ALSA: hda: cs35l56: Propagate ASP TX source control errors (git-fixes).\n- ALSA: hda: cs35l56: Put ACPI device after setting companion (git-fixes).\n- ALSA: hda: Fix NULL pointer dereference in snd_hda_ctl_add() (git-fixes).\n- ALSA: misc: Use guard() for spin locks (stable-fixes).\n- ALSA: scarlett2: Add missing error check when initialise Autogain Status (git-fixes).\n- ALSA: scarlett2: Add missing sentinel initializer field (git-fixes).\n- ALSA: seq: Notify client and port info changes (stable-fixes).\n- ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes (stable-fixes).\n- ALSA: usb-audio: apply quirk for MOONDROP JU Jiu (stable-fixes).\n- ALSA: usb-audio: Avoid false E-MU sample-rate notifications (git-fixes).\n- ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() (git-fixes).\n- ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans (git-fixes).\n- ALSA: usb-audio: Bound MIDI endpoint descriptor scans (git-fixes).\n- ALSA: usb-audio: Evaluate packsize caps at the right place (git-fixes).\n- ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch (git-fixes).\n- ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams (git-fixes).\n- ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex (stable-fixes).\n- ALSA: usb-audio: Fix UAC3 cluster descriptor size check (git-fixes).\n- ALSA: usb-audio: midi2: Restart output URBs on resume (git-fixes).\n- ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES (git-fixes).\n- amdgpu/jpeg: fix deepsleep register for jpeg 5_0_0 and 5_0_2 (stable-fixes).\n- ASoC: amd: acp: Add DMI quirk for Valve Steam Deck OLED (git-fixes).\n- ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF (stable-fixes).\n- ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table (stable-fixes).\n- ASoC: codecs: ab8500: Fix casting of private data (git-fixes).\n- ASoC: cs35l56: Destroy workqueue in probe error path (git-fixes).\n- ASoC: cs35l56: Don't use devres to unregister component (git-fixes).\n- ASoC: cs35l56: Fix hibernate write in runtime resume error path (git-fixes).\n- ASoC: fsl_easrc: Change the type for iec958 channel status controls (git-fixes).\n- ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() (git-fixes).\n- ASoC: fsl_easrc: fix comment typo (git-fixes).\n- ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() (git-fixes).\n- ASoC: fsl_micfil: Add access property for 'VAD Detected' (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in micfil_quality_set() (git-fixes).\n- ASoC: fsl_xcvr: Fix event generation for cached controls (git-fixes).\n- ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() (git-fixes).\n- ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() (git-fixes).\n- ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error (git-fixes).\n- ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop (git-fixes).\n- ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens (git-fixes).\n- ASoC: qcom: q6apm: move component registration to unmanaged version (git-fixes).\n- ASoC: qcom: q6apm: remove child devices when apm is removed (git-fixes).\n- ASoC: qcom: qdsp6: topology: check widget type before accessing data (git-fixes).\n- ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list (stable-fixes).\n- ASoC: SOF: compress: return the configured codec from get_params (git-fixes).\n- ASoC: SOF: Don't allow pointer operations on unconfigured streams (git-fixes).\n- ASoC: SOF: Intel: hda: Place check before dereference (git-fixes).\n- ASoC: SOF: topology: reject invalid vendor array size in token parser (stable-fixes).\n- ASoC: sti: Return errors from regmap_field_alloc() (git-fixes).\n- ASoC: sti: use managed regmap_field allocations (git-fixes).\n- ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J (stable-fixes).\n- ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 (stable-fixes).\n- batman-adv: bla: only purge non-released claims (git-fixes).\n- batman-adv: bla: prevent use-after-free when deleting claims (git-fixes).\n- batman-adv: bla: put backbone reference on failed claim hash insert (git-fixes).\n- batman-adv: fix integer overflow on buff_pos (git-fixes).\n- batman-adv: hold claim backbone gateways by reference (git-fixes).\n- batman-adv: reject new tp_meter sessions during teardown (git-fixes).\n- batman-adv: reject oversized global TT response buffers (git-fixes).\n- batman-adv: stop caching unowned originator pointers in BAT IV (git-fixes).\n- Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling (git-fixes).\n- Bluetooth: btmtk: validate WMT event SKB length before struct access (git-fixes).\n- Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (git-fixes).\n- Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt (git-fixes).\n- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (git-fixes).\n- Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (git-fixes).\n- Bluetooth: HIDP: serialise l2cap_unregister_user via hidp_session_sem (git-fixes).\n- Bluetooth: ISO: Fix data-race on dst in iso_sock_connect() (git-fixes).\n- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (git-fixes).\n- Bluetooth: l2cap: fix MPS check in l2cap_ecred_reconf_req (git-fixes).\n- Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (git-fixes).\n- Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() (git-fixes).\n- Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU (git-fixes).\n- Bluetooth: RFCOMM: pull credit byte with skb_pull_data() (git-fixes).\n- Bluetooth: SCO: check for codecs-\u003enum_codecs == 1 before assigning to sco_pi(sk)-\u003ecodec (git-fixes).\n- Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready (git-fixes).\n- Bluetooth: SCO: hold sk properly in sco_conn_ready (git-fixes).\n- Bluetooth: virtio_bt: clamp rx length before skb_put (git-fixes).\n- Bluetooth: virtio_bt: validate rx pkt_type header length (git-fixes).\n- btrfs: do not skip logging new dentries when logging a new name (git-fixes).\n- btrfs: reject root items with drop_progress and zero drop_level (git-fixes).\n- btrfs: replace BUG() with error handling in __btrfs_balance() (git-fixes).\n- can: mcp251x: add error handling for power enable in open and resume (stable-fixes).\n- can: raw: fix ro-\u003euniq use-after-free in raw_rcv() (git-fixes).\n- can: ucan: fix devres lifetime (git-fixes).\n- cdc-acm: new quirk for EPSON HMD (stable-fixes).\n- cgroup/cpuset: Fix incorrect change to effective_xcpus in partition_xcpus_del() (bsc#1241166).\n- cgroup/cpuset: Fix incorrect use of cpuset_update_tasks_cpumask() in update_cpumasks_hier() (bsc#1241166).\n- check-for-config-changes: Exclude CC_MS_EXTENSIONS.\n- check-for-config-changes: Exclude HAVE_CFI_ICALL_NORMALIZE_INTEGERS{,_RUSTC}.\n- checkpatch: add support for Assisted-by tag (stable-fixes).\n- comedi: dt2815: add hardware detection to prevent crash (stable-fixes).\n- cpufreq: intel_pstate: Drop Arrow Lake from 'scaling factor' list (bsc#1249104).\n- crypto: algif_aead - Fix minimum RX size check for decryption (git-fixes).\n- crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit (git-fixes).\n- crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup (git-fixes).\n- crypto: atmel-ecc - Release client on allocation failure (git-fixes).\n- crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path (git-fixes).\n- crypto: atmel-tdes - fix DMA sync direction (git-fixes).\n- crypto: authencesn - reject short ahash digests during instance creation (git-fixes).\n- crypto: ccp - copy IV using skcipher ivsize (git-fixes).\n- crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (git-fixes).\n- crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (git-fixes).\n- crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (git-fixes).\n- crypto: ccree - fix a memory leak in cc_mac_digest() (git-fixes).\n- crypto: hisilicon - Fix dma_unmap_single() direction (git-fixes).\n- crypto: jitterentropy - replace long-held spinlock with mutex (git-fixes).\n- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (git-fixes).\n- crypto: qat - fix type mismatch in RAS sysfs show functions (git-fixes).\n- crypto: qat - use swab32 macro (git-fixes).\n- crypto: sa2ul - Fix AEAD fallback algorithm names (git-fixes).\n- crypto: simd - reject compat registrations without __ prefixes (git-fixes).\n- crypto: talitos - fix SEC1 32k ahash request limitation (git-fixes).\n- crypto: testmgr - Hide ENOENT errors (stable-fixes).\n- crypto: testmgr - Hide ENOENT errors better (git-fixes).\n- devres: fix missing node debug info in devm_krealloc() (git-fixes).\n- dm init: ensure device probing has finished in dm-mod.waitfor= (git-fixes).\n- dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function (git-fixes).\n- dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() (git-fixes).\n- dpll: zl3073x: Add support to adjust phase (bsc#1255752).\n- dpll: zl3073x: Fix output pin phase adjustment sign (bsc#1255752).\n- dpll: zl3073x: Fix output pin registration (bsc#1255752).\n- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (bsc#1255752).\n- dpll: zl3073x: Specify phase adjustment granularity for pins (bsc#1255752).\n- drm/amd/display: Add NULL check for integrated_info in clk_mgr_construct (git-fixes).\n- drm/amd/display: Allow DCE link encoder without AUX registers (git-fixes).\n- drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths (git-fixes).\n- drm/amd/display: Change dither policy for 10 bpc output back to dithering (git-fixes).\n- drm/amd/display: Correct logic check error for fastboot (git-fixes).\n- drm/amd/display: Disable 10-bit truncation and dithering on DCE 6.x (git-fixes).\n- drm/amd/display: Disable fastboot on DCE 6 too (stable-fixes).\n- drm/amd/display: Read EDID from VBIOS embedded panel info (git-fixes).\n- drm/amd/pm/ci: Clear EnabledForActivity field for memory levels (git-fixes).\n- drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs (git-fixes).\n- drm/amd/pm/ci: Fill DW8 fields from SMC (git-fixes).\n- drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 (git-fixes).\n- drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled (git-fixes).\n- drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board (git-fixes).\n- drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock (git-fixes).\n- drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x (git-fixes).\n- drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) (git-fixes).\n- drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ (stable-fixes).\n- drm/amdgpu/gfx10: look at the right prop for gfx queue priority (git-fixes).\n- drm/amdgpu/gfx11: look at the right prop for gfx queue priority (git-fixes).\n- drm/amdgpu/gmc: Fix AMDGPU_GART_PLACEMENT_LOW to not overlap with VRAM (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.5 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.0 ring (git-fixes).\n- drm/amdgpu/pm: add missing revision check for CI (git-fixes).\n- drm/amdgpu/pm: align Hawaii mclk workaround with radeon (git-fixes).\n- drm/amdgpu/pm: drop SMU driver if version not matched messages (stable-fixes).\n- drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission (git-fixes).\n- drm/amdgpu/vce: Prevent partial address patches (stable-fixes).\n- drm/amdgpu/vcn3: Avoid overflow on msg bound check (git-fixes).\n- drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (stable-fixes).\n- drm/amdgpu/vcn4: Avoid overflow on msg bound check (git-fixes).\n- drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (stable-fixes).\n- drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (stable-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v4.0.5 enc ring (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v5.0.0 enc ring (git-fixes).\n- drm/amdgpu: Add bounds checking to ib_{get,set}_value (stable-fixes).\n- drm/amdgpu: Add default case in DVI mode validation (git-fixes).\n- drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG (git-fixes).\n- drm/amdgpu: fix the idr allocation flags (git-fixes).\n- drm/amdgpu: fix zero-size GDS range init on RDNA4 (stable-fixes).\n- drm/amdgpu: gate VM CPU HDP flush on reset lock (stable-fixes).\n- drm/amdgpu: replace PASID IDR with XArray (git-fixes).\n- drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count (stable-fixes).\n- drm/amdgpu: zero-initialize GART table on allocation (stable-fixes).\n- drm/amdkfd: Add upper bound check for num_of_nodes (stable-fixes).\n- drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure (stable-fixes).\n- drm/amdkfd: Make all TLB-flushes heavy-weight (stable-fixes).\n- drm/amdkfd: validate SVM ioctl nattr against buffer size (stable-fixes).\n- drm/arcpgu: fix device node leak (git-fixes).\n- drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs (git-fixes).\n- drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check (git-fixes).\n- drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() (git-fixes).\n- drm/bridge: stm_lvds: Do not fail atomic_check on disabled connector (git-fixes).\n- drm/etnaviv: Fix armed job not being pushed to the DRM scheduler (git-fixes).\n- drm/exynos: remove bridge when component_add fails (git-fixes).\n- drm/fb-helper: Fix clipping when damage area spans a single scanline (git-fixes).\n- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (git-fixes).\n- drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup (git-fixes).\n- drm/gma500/oaktrail_lvds: fix hang on init failure (git-fixes).\n- drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init (git-fixes).\n- drm/i915/dp: Fix VSC dynamic range signaling for RGB formats (git-fixes).\n- drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (git-fixes).\n- drm/i915/wm: Verify the correct plane DDB entry (git-fixes).\n- drm/i915: skip __i915_request_skip() for already signaled requests (git-fixes).\n- drm/imagination: Switch reset_reason fields from enum to u32 (git-fixes).\n- drm/komeda: fix integer overflow in AFBC framebuffer size check (git-fixes).\n- drm/loongson: Use managed KMS polling (git-fixes).\n- drm/msm/a6xx: Fix dumping A650+ debugbus blocks (git-fixes).\n- drm/msm/a6xx: Fix HLSQ register dumping (git-fixes).\n- drm/msm/a6xx: Use barriers while updating HFI Q headers (git-fixes).\n- drm/msm/dpu: fix mismatch between power and frequency (git-fixes).\n- drm/msm/dsi: add the missing parameter description (git-fixes).\n- drm/msm/dsi: fix bits_per_pclk (git-fixes).\n- drm/msm/dsi: fix hdisplay calculation for CMD mode panel (git-fixes).\n- drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 (git-fixes).\n- drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata() (git-fixes).\n- drm/msm/shrinker: Fix can_block() logic (git-fixes).\n- drm/msm: add missing MODULE_DEVICE_ID definitions (git-fixes).\n- drm/nouveau: fix nvkm_device leak on aperture removal failure (git-fixes).\n- drm/nouveau: fix u32 overflow in pushbuf reloc bounds check (git-fixes).\n- drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds (git-fixes).\n- drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds (git-fixes).\n- drm/panel: sharp-ls043t1le01: make use of prepare_prev_first (git-fixes).\n- drm/panel: simple: Correct G190EAN01 prepare timing (git-fixes).\n- drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() (git-fixes).\n- drm/panthor: Fix outdated function documentation (git-fixes).\n- drm/radeon: add missing revision check for CI (git-fixes).\n- drm/sun4i: backend: fix error pointer dereference (git-fixes).\n- drm/sun4i: Fix resource leaks (git-fixes).\n- drm/v3d: Handle error from drm_sched_entity_init() (git-fixes).\n- drm/vc4: Fix a memory leak in hang state error path (git-fixes).\n- drm/vc4: Fix memory leak of BO array in hang state (git-fixes).\n- drm/vc4: platform_get_irq_byname() returns an int (stable-fixes).\n- drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock (git-fixes).\n- drm/vc4: Release runtime PM reference after binding V3D (git-fixes).\n- drm/vram: remove DRM_VRAM_MM_FILE_OPERATIONS from docs (git-fixes).\n- drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked() (git-fixes).\n- drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked() (git-fixes).\n- drm/xe/debugfs: Correct printing of register whitelist ranges (git-fixes).\n- drm/xe/dma-buf: handle empty bo and UAF races (git-fixes).\n- drm/xe/gsc: Fix BO leak on error in query_compatibility_version() (git-fixes).\n- drm/xe/uapi: update used tracking kernel-doc (git-fixes).\n- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (git-fixes).\n- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (git-fixes).\n- dt-bindings: net: Fix Tegra234 MGBE PTP clock (git-fixes).\n- efi/capsule-loader: fix incorrect sizeof in phys array reallocation (git-fixes).\n- efi: pstore: Drop efivar lock when efi_pstore_open() returns with an error (git-fixes).\n- ext4: fix fsync(2) for nojournal mode (git-fixes).\n- ext4: make recently_deleted() properly work with lazy itable initialization (git-fixes).\n- ext4: reject mount if bigalloc with s_first_data_block != 0 (git-fixes).\n- extcon: ptn5150: handle pending IRQ events during system resume (git-fixes).\n- fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break (git-fixes).\n- fbdev: offb: fix PCI device reference leak on probe failure (git-fixes).\n- fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO (stable-fixes).\n- fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free (stable-fixes).\n- fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO (git-fixes).\n- firmware: dmi: Correct an indexing error in dmi.h (git-fixes).\n- gpio: tegra: fix irq_release_resources calling enable instead of disable (git-fixes).\n- gtp: disable BH before calling udp_tunnel_xmit_skb() (git-fixes).\n- HID: alps: fix NULL pointer dereference in alps_raw_event() (git-fixes).\n- HID: asus: do not abort probe when not necessary (git-fixes).\n- HID: asus: make asus_resume adhere to linux kernel coding standards (git-fixes).\n- HID: core: clamp report_size in s32ton() to avoid undefined shift (stable-fixes).\n- HID: multitouch: Check to ensure report responses match the request (stable-fixes).\n- HID: playstation: Clamp num_touch_reports (git-fixes).\n- HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 (stable-fixes).\n- HID: roccat: fix use-after-free in roccat_report_event (stable-fixes).\n- HID: usbhid: fix deadlock in hid_post_reset() (git-fixes).\n- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (stable-fixes).\n- hv_sock: fix ARM64 support (git-fixes).\n- hwmon: (ads7871) Fix endianness bug in 16-bit register reads (git-fixes).\n- hwmon: (corsair-psu) Close HID device on probe errors (git-fixes).\n- hwmon: (lm63) Add locking to avoid TOCTOU (git-fixes).\n- hwmon: (ltc2992) Clamp threshold writes to hardware range (git-fixes).\n- hwmon: (ltc2992) Fix u32 overflow in power read path (git-fixes).\n- i2c: s3c24xx: check the size of the SMBUS message before using it (stable-fixes).\n- i2c: smbus: reject oversized block transfers in the common path (git-fixes).\n- i2c: stm32f7: reinit_completion() per transfer not per msg (git-fixes).\n- i2c: stub: Reject I2C block transfers with invalid length (git-fixes).\n- i3c: master: Fix error codes at send_ccc_cmd (git-fixes).\n- i3c: mipi-i3c-hci: fix IBI payload length calculation for final status (git-fixes).\n- ibmveth: Disable GSO for packets with small MSS (bsc#1265144).\n- ice: set max queues in alloc_etherdev_mqs() (git-fixes).\n- iio: adc: ad7768-1: fix one-shot mode data acquisition (git-fixes).\n- iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() (git-fixes).\n- iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() (git-fixes).\n- Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table (stable-fixes).\n- Input: uinput - fix circular locking dependency with ff-core (git-fixes).\n- Input: uinput - take event lock when submitting FF request 'event' (stable-fixes).\n- Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode (stable-fixes).\n- Input: xpad - add support for Razer Wolverine V3 Pro (stable-fixes).\n- intel_idle: add Clearwater Forest SoC support (jsc#PED-10383).\n- ipmi: Add limits to event and receive message requests (git-fixes).\n- ipmi: Check event message buffer response for bad data (git-fixes).\n- ipmi: ssif_bmc: change log level to dbg in irq callback (git-fixes).\n- ipmi: ssif_bmc: fix message desynchronization after truncated response (git-fixes).\n- ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure (git-fixes).\n- irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter (git-fixes).\n- kdump, documentation: describe craskernel CMA reservation (jsc#PED-7249).\n- KVM: Reject wrapped offset in kvm_reset_dirty_gfn() (git-fixes).\n- KVM: SVM: Fix a missing kunmap_local() in sev_gmem_post_populate() (git-fixes).\n- KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (git-fixes).\n- KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN (git-fixes).\n- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (bsc#1259461).\n- KVM: x86/mmu: Retry fault before acquiring mmu_lock if mapping is changing (bsc#1253122).\n- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (git-fixes).\n- KVM: x86: check for nEPT/nNPT in slow flush hypercalls (git-fixes).\n- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (git-fixes).\n- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (git-fixes).\n- KVM: x86: Ignore cpuid faulting in SMM (git-fixes).\n- leds: lgm-sso: Remove duplicate assignments for priv-\u003emmap (git-fixes).\n- leds: qcom-lpg: Check for array overflow when selecting the high resolution (stable-fixes).\n- lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() (git-fixes).\n- md/raid1: fix the comparing region of interval tree (bsc#1261555).\n- md/raid1: serialize overlap io for writemostly disk (bsc#1261555).\n- media: amphion: Fix race between m2m job_abort and device_run (git-fixes).\n- media: as102: fix to not free memory after the device is registered in as102_usb_probe() (git-fixes).\n- media: chips-media: wave5: add missing spinlock protection for handle_dynamic_resolution_change() (git-fixes).\n- media: chips-media: wave5: add missing spinlock protection for send_eos_event() (git-fixes).\n- media: chips-media: wave5: fix a potential memory leak in wave5_vdi_init() (git-fixes).\n- media: dib8000: avoid division by 0 in dib8000_set_dds() (git-fixes).\n- media: em28xx: fix use-after-free in em28xx_v4l2_open() (git-fixes).\n- media: hackrf: fix to not free memory after the device is registered in hackrf_probe() (git-fixes).\n- media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() (git-fixes).\n- media: i2c: imx412: Assert reset GPIO during probe (git-fixes).\n- media: i2c: ov08d10: fix image vertical start setting (git-fixes).\n- media: i2c: ov8856: free control handler on error in ov8856_init_controls() (git-fixes).\n- media: intel/ipu6: fix error pointer dereference (git-fixes).\n- media: mtk-jpeg: fix use-after-free in release path due to uncancelled work (git-fixes).\n- media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 (git-fixes).\n- media: omap3isp: drop the use count of v4l2 pipeline (git-fixes).\n- media: pci: zoran: fix potential memory leak in zoran_probe() (git-fixes).\n- media: rc: streamzap: Error handling in probe (git-fixes).\n- media: rc: xbox_remote: heed DMA restrictions (git-fixes).\n- media: saa7164: add ioremap return checks and cleanups (git-fixes).\n- media: staging: imx: configure src_mux in csi_start (git-fixes).\n- media: staging: imx: request mbus_config in csi_start (git-fixes).\n- media: uvcvideo: Enable VB2_DMABUF for metadata stream (git-fixes).\n- media: videobuf2: Set vma_flags in vb2_dma_sg_mmap (git-fixes).\n- media: vidtv: fix nfeeds state corruption on start_streaming failure (git-fixes).\n- media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections (git-fixes).\n- media: vidtv: fix pass-by-value structs causing MSAN warnings (git-fixes).\n- memory: tegra30-emc: Fix dll_change check (git-fixes).\n- memory: tegra124-emc: Fix dll_change check (git-fixes).\n- mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() (git-fixes).\n- mkspec: Add signature to source list only when it exists.\n- mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration (git-fixes).\n- mmc: vub300: fix NULL-deref on disconnect (git-fixes).\n- modpost: Amend ppc64 save/restfpr symnames for -Os build (bsc#1215199).\n- mtd: docg3: Convert to platform remove callback returning void (stable-fixes).\n- mtd: docg3: fix use-after-free in docg3_release() (git-fixes).\n- mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions (git-fixes).\n- mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path (git-fixes).\n- mtd: physmap_of_gemini: Fix disabled pinctrl state check (git-fixes).\n- mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob (git-fixes).\n- mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations (git-fixes).\n- mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() (git-fixes).\n- mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()` (stable-fixes).\n- mtd: spi-nor: sst: Fix SST write failure (git-fixes).\n- mtd: spi-nor: sst: Fix write enable before AAI sequence (git-fixes).\n- mtd: spi-nor: swp: check SR_TB flag when getting tb_mask (git-fixes).\n- net/rds: reset op_nents when zerocopy page pin fails (bsc#1265626).\n- net/sched: cls_fw: fix NULL dereference of 'old' filters before change() (git-fixes).\n- net/sched: fix pedit partial COW leading to page cache corruption (bsc#1265421).\n- net: gro: don't merge zcopy skbs (git-fixes).\n- net: mana: Add MAC address to vPort logs and clarify error messages (git-fixes).\n- net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq() (git-fixes).\n- net: mana: Don't overwrite port probe error with add_adev result (git-fixes).\n- net: mana: Fix crash from unvalidated SHM offset read from BAR0 during FLR (bsc#1265846).\n- net: mana: Fix EQ leak in mana_remove on NULL port (git-fixes).\n- net: mana: Fix RX skb truesize accounting (bsc#1248754).\n- net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown (git-fixes).\n- net: mana: Guard mana_remove against double invocation (git-fixes).\n- net: mana: hardening: Validate adapter_mtu from MANA_QUERY_DEV_CONFIG (git-fixes).\n- net: mana: hardening: Validate doorbell ID from GDMA_REGISTER_DEVICE response (git-fixes).\n- net: mana: Init gf_stats_work before potential error paths in probe (git-fixes).\n- net: mana: Init link_change_work before potential error paths in probe (git-fixes).\n- net: mana: remove double CQ cleanup in mana_create_rxq error path (git-fixes).\n- net: mana: Set default number of queues to 16 (bsc#1261648).\n- net: mana: Skip WQ object destruction for uninitialized RXQ (git-fixes).\n- net: mana: Use at least SZ_4K in doorbell ID range check (git-fixes).\n- net: mana: Use pci_name() for debugfs directory naming (git-fixes).\n- net: phy: dp83869: fix setting CLK_O_SEL field (git-fixes).\n- net: stmmac: Fix PTP ref clock for Tegra234 (git-fixes).\n- net: usb: asix: ax88772: re-add usbnet_link_change() in phylink callbacks (git-fixes).\n- net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() (git-fixes).\n- net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() (git-fixes).\n- net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit (git-fixes).\n- net: wan: fsl_ucc_hdlc: fix ucc_hdlc_remove (git-fixes).\n- net: wan: fsl_ucc_hdlc: fix uhdlc_memclean (git-fixes).\n- net: wan: fsl_ucc_hdlc: free tx_skbuff in uhdlc_memclean (git-fixes).\n- NFC: digital: Bounds check NFC-A cascade depth in SDD response handler (git-fixes).\n- nfc: llcp: add missing return after LLCP_CLOSED checks (git-fixes).\n- nfc: pn533: allocate rx skb before consuming bytes (git-fixes).\n- nfc: s3fwrn5: allocate rx skb before consuming bytes (git-fixes).\n- NFC: trf7970a: Ignore antenna noise when checking for RF field (git-fixes).\n- nvme-auth: Include SC_C in RVAL controller hash (bsc#1260428).\n- nvme-fabrics: use kfree_sensitive() for DHCHAP secrets (git-fixes).\n- nvme-loop: do not cancel I/O and admin tagset during ctrl reset/shutdown (bsc#1262709).\n- nvme-pci: cap queue creation to used queues (git-fixes).\n- nvme-pci: ensure we're polling a polled queue (git-fixes).\n- nvme: Allow reauth from sysfs (bsc#1259672).\n- nvme: Expose the tls_configured sysfs for secure concat connections (bsc#1259672).\n- nvme: expose TLS mode (bsc#1259672).\n- nvme: fix PCIe subsystem reset controller state transition (bsc#1261738).\n- nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers (git-fixes).\n- ocfs2: fix possible deadlock between unlink and dio_end_io_write (bsc#1258718).\n- ocfs2: split transactions in dio completion to avoid credit exhaustion (bsc#1258718).\n- Partial revert 'x86/xen: fix balloon target initialization for PVH dom0' (bsc#1262599).\n- PCI/AER: Clear only error bits in PCIe Device Status (git-fixes).\n- PCI/AER: Stop ruling out unbound devices as error source (git-fixes).\n- PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well (git-fixes).\n- PCI: Enable AtomicOps only if Root Port supports them (git-fixes).\n- PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown (git-fixes).\n- PCI: hv: Set default NUMA node to 0 for devices without affinity info (git-fixes).\n- PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found (git-fixes).\n- PCI: tegra194: Allow system suspend when the Endpoint link is not up (git-fixes).\n- PCI: tegra194: Disable direct speed change for Endpoint mode (git-fixes).\n- PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down (git-fixes).\n- PCI: tegra194: Disable PERST# IRQ only in Endpoint mode (git-fixes).\n- PCI: tegra194: Fix polling delay for L2 state (git-fixes).\n- PCI: tegra194: Increase LTSSM poll time on surprise link down (git-fixes).\n- PCI: tegra194: Set LTR message request before PCIe link up in Endpoint mode (git-fixes).\n- PCI: tegra194: Use devm_gpiod_get_optional() to parse 'nvidia,refclk-select' (git-fixes).\n- PCI: tegra194: Use DWC IP core version (git-fixes).\n- pinctrl: abx500: Fix type of 'argument' variable (git-fixes).\n- pinctrl: Fix spelling problem (git-fixes).\n- pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) (stable-fixes).\n- pinctrl: pic32: change all cases of bare 'unsigned' to 'unsigned int' (git-fixes).\n- pinctrl: pic32: use consistent spacing around '+' (git-fixes).\n- pinctrl: pinctrl-pic32: Fix resource leak (git-fixes).\n- platform/chrome: chromeos_tbmc: Drop wakeup source on remove (git-fixes).\n- platform/surface: surfacepro3_button: Drop wakeup source on remove (git-fixes).\n- platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug (stable-fixes).\n- platform/x86/intel-uncore-freq: Handle autonomous UFS status bit (git-fixes).\n- platform/x86/intel: power-domains: Add Clearwater Forest support (jsc#PED-16221).\n- platform/x86: dell-wmi-sysman: bound enumeration string aggregation (git-fixes).\n- platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() (git-fixes).\n- platform/x86: hp-wmi: Ignore backlight and FnLock events (stable-fixes).\n- platform/x86: ISST: Add Clearwater Forest to support list (jsc#PED-16221).\n- platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup (git-fixes).\n- power: supply: axp288_charger: Do not cancel work before initializing it (git-fixes).\n- power: supply: max17042: avoid overflow when determining health (git-fixes).\n- powerpc/crash: adjust the elfcorehdr size (jsc#PED-11175 git-fixes).\n- powerpc/crash: fix backup region offset update to elfcorehdr (bsc#1259535).\n- powerpc/crash: Update backup region offset in elfcorehdr on memory hotplug (bsc#1259535).\n- powerpc/kdump: Fix size calculation for hot-removed memory ranges (jsc#PED-11175 git-fixes).\n- RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() (git-fixes).\n- RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() (git-fixes).\n- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (git-fixes).\n- RDMA/mana: Validate rx_hash_key_len (git-fixes).\n- RDMA/mana_ib: cleanup the usage of mana_gd_send_request() (git-fixes).\n- RDMA/mana_ib: Disable RX steering on RSS QP destroy (git-fixes).\n- RDMA/mana_ib: Support memory windows (git-fixes).\n- regulator: act8945a: fix OF node reference imbalance (git-fixes).\n- regulator: bd9571mwv: fix OF node reference imbalance (git-fixes).\n- regulator: max77650: fix OF node reference imbalance (git-fixes).\n- regulator: mt6357: fix OF node reference imbalance (git-fixes).\n- remoteproc: xlnx: Only access buffer information if IPI is buffered (git-fixes).\n- Revert 'ALSA: usb: Increase volume range that triggers a warning' (git-fixes).\n- rtc: abx80x: Disable alarm feature if no interrupt attached (git-fixes).\n- rtc: ntxec: fix OF node reference imbalance (git-fixes).\n- s390/dasd: Copy detected format information to secondary device (bsc#1259995).\n- s390/dasd: Fix gendisk parent after copy pair swap (bsc#1259995).\n- s390/dasd: Move quiesce state with pprc swap (bsc#1259995).\n- sched/balancing: Switch the 'DEFINE_SPINLOCK(balancing)' spinlock into an 'atomic_t sched_balance_running' flag\n  (bsc#1253754).\n- sched/fair: Change likelyhood of nohz.nr_cpus (bsc#1234634 bsc#1258961).\n- sched/fair: Have SD_SERIALIZE affect newidle balancing (bsc#1253754).\n- sched/fair: Move checking for nohz cpus after time check (bsc#1234634 bsc#1258961).\n- sched/fair: Remove nohz.nr_cpus and use weight of cpumask instead (bsc#1234634 bsc#1258961).\n- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (bsc#1253754).\n- scsi: lpfc: Add clean up of aborted NVMe commands during PCI fcn reset (bsc#1262019).\n- scsi: lpfc: Add log messages to fabric login error labels (bsc#1262019).\n- scsi: lpfc: Add PCI ID support for LPe42100 series adapters (bsc#1262019).\n- scsi: lpfc: Add REG_VFI mailbox cmd error handling (bsc#1262019).\n- scsi: lpfc: Break out of IRQ affinity assignment when mask reaches nr_cpu_ids (bsc#1262019).\n- scsi: lpfc: Check ASIC_ID register to aid diagnostics during failed fw updates (bsc#1262019).\n- scsi: lpfc: Cleanup error exit paths in lpfc_fdmi_cmd() and associated messages (bsc#1262019).\n- scsi: lpfc: ELIMINATE kernel-doc warnings in lpfc.h (bsc#1262019).\n- scsi: lpfc: Fix incorrect txcmplq_cnt during cleanup in lpfc_sli_abort_ring() (bsc#1262019).\n- scsi: lpfc: Introduce 128G link speed selection and support (bsc#1262019).\n- scsi: lpfc: Log discarded and insufficient RQE buffer events (bsc#1262019).\n- scsi: lpfc: Log MCQE contents for mbox commands with no context (bsc#1262019).\n- scsi: lpfc: Properly set WC for DPP mapping (bsc#1262019).\n- scsi: lpfc: Reduce pointer chasing when accessing vmid_flag (bsc#1262019).\n- scsi: lpfc: Remove deprecated PBDE feature (bsc#1262019).\n- scsi: lpfc: Remove unnecessary ndlp kref get in lpfc_check_nlp_post_devloss (bsc#1262019).\n- scsi: lpfc: Restrict first burst to non-FCoE and SLI4 adapters only (bsc#1262019).\n- scsi: lpfc: Select mailbox rq_create cmd version based on SLI4 if_type (bsc#1262019).\n- scsi: lpfc: Update class of service bit field to 3 bits for WQE submissions (bsc#1262019).\n- scsi: lpfc: Update construction of SGL when XPSGL is enabled (bsc#1262019).\n- scsi: lpfc: Update copyright year string for 2026 (bsc#1262019).\n- scsi: lpfc: Update log message when ndlp kref get is unsuccessful (bsc#1262019).\n- scsi: lpfc: Update lpfc version to 14.4.0.14 (bsc#1262019).\n- scsi: lpfc: Update lpfc version to 15.0.0.0 (bsc#1262019).\n- scsi: lpfc: Update outdated comment for renamed lpfc_freenode() (bsc#1262019).\n- scsi: lpfc: Use min_t() instead of min() in lpfc_sli4_driver_resource_setup (bsc#1262019).\n- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (git-fixes).\n- scsi: target: iscsi: validate CHAP_R length before base64 decode (bsc#1265449).\n- selftests/powerpc: make sub-folders buildable on their own (bsc#1261669 ltc#212590).\n- selftests/powerpc: Re-order *FLAGS to follow lib.mk (bsc#1261669 ltc#212590).\n- selftests/powerpc: Suppress -Wmaybe-uninitialized with GCC 15 (bsc#1261669 ltc#212590).\n- serial: 8250: Add serial8250_handle_irq_locked() (bsc#1262480).\n- serial: 8250: Protect LCR write in shutdown (bsc#1262480).\n- serial: 8250_dw: Avoid unnecessary LCR writes (bsc#1262480).\n- serial: 8250_dw: Ensure BUSY is deasserted (bsc#1262480).\n- serial: 8250_dw: Rework dw8250_handle_irq() locking and IIR handling (bsc#1262480).\n- serial: 8250_dw: Rework IIR_NO_INT handling to stop interrupt storm (bsc#1262480).\n- soc/tegra: cbb: Set ERD on resume for err interrupt (git-fixes).\n- soc: qcom: aoss: compare against normalized cooling state (git-fixes).\n- soc: qcom: llcc: fix v1 SB syndrome register offset (git-fixes).\n- sound: ua101: fix division by zero at probe (git-fixes).\n- soundwire: bus: demote UNATTACHED state warnings to dev_dbg() (git-fixes).\n- soundwire: cadence: Clear message complete before signaling waiting thread (git-fixes).\n- spi: at91-usart: fix controller deregistration (git-fixes).\n- spi: atmel: fix controller deregistration (git-fixes).\n- spi: cadence: fix controller deregistration (git-fixes).\n- spi: fix controller cleanup() documentation (git-fixes).\n- spi: fix misleading controller deregistration kernel-doc (git-fixes).\n- spi: fix misleading controller registration kernel-doc (git-fixes).\n- spi: fsl-qspi: Use reinit_completion() for repeated operations (git-fixes).\n- spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo (git-fixes).\n- spi: imx: fix runtime pm leak on probe deferral (git-fixes).\n- spi: imx: fix use-after-free on unbind (git-fixes).\n- spi: microchip-core-qspi: fix controller deregistration (git-fixes).\n- spi: microchip-core-qspi: Use helper function devm_clk_get_enabled() (stable-fixes).\n- spi: mpc52xx: fix use-after-free on unbind (git-fixes).\n- spi: mtk-nor: fix controller deregistration (git-fixes).\n- spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback (git-fixes).\n- spi: omap2-mcspi: fix controller deregistration (git-fixes).\n- spi: orion: fix clock imbalance on registration failure (git-fixes).\n- spi: orion: fix runtime pm leak on unbind (git-fixes).\n- spi: rockchip: fix controller deregistration (git-fixes).\n- spi: rspi: fix controller deregistration (git-fixes).\n- spi: sh-hspi: fix controller deregistration (git-fixes).\n- spi: spi-ti-qspi: Convert to platform remove callback returning void (stable-fixes).\n- spi: sprd: fix controller deregistration (git-fixes).\n- spi: sun4i: fix controller deregistration (git-fixes).\n- spi: sun4i: switch to use modern name (stable-fixes).\n- spi: syncuacer: fix controller deregistration (git-fixes).\n- spi: synquacer: switch to use modern name (stable-fixes).\n- spi: uniphier: fix controller deregistration (git-fixes).\n- spi: uniphier: Simplify clock handling with devm_clk_get_enabled() (stable-fixes).\n- spi: uniphier: switch to use modern name (stable-fixes).\n- spi: zynq-qspi: switch to use modern name (stable-fixes).\n- spi: zynqmp-gqspi: fix controller deregistration (git-fixes).\n- staging: media: atomisp: Disallow all private IOCTLs (git-fixes).\n- staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() (git-fixes).\n- staging: sm750fb: fix division by zero in ps_to_hz() (git-fixes).\n- staging: vme_user: added bound check to geoid (stable-fixes).\n- staging: vme_user: fix root device leak on init failure (git-fixes).\n- tg3: Fix race for querying speed/duplex (bsc#1257183).\n- tg3: replace placeholder MAC address with device property (git-fixes).\n- thermal/drivers/spear: Fix error condition for reading st,thermal-flags (git-fixes).\n- thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp (git-fixes).\n- thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata (git-fixes).\n- tpm: avoid -Wunused-but-set-variable (git-fixes).\n- tpm: tpm_tis: add error logging for data transfer (git-fixes).\n- tpm: tpm_tis: stop transmit if retries are exhausted (git-fixes).\n- tty: tty_io: update timestamps on all device nodes (bsc#1262020).\n- unshare: fix unshare_fs() handling (git-fixes).\n- USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen (stable-fixes).\n- usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (git-fixes).\n- usb: chipidea: otg: not wait vbus drop if use role_switch (git-fixes).\n- USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam (stable-fixes).\n- usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer (stable-fixes).\n- usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() (git-fixes).\n- usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() (stable-fixes).\n- usb: gadget: f_uac1_legacy: validate control request size (stable-fixes).\n- usb: gadget: renesas_usb3: validate endpoint index in standard request handlers (git-fixes).\n- USB: omap_udc: DMA: Don't enable burst 4 mode (git-fixes).\n- usb: port: add delay after usb_hub_set_port_power() (git-fixes).\n- usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive (stable-fixes).\n- USB: serial: io_edgeport: add support for Blackbox IC135A (stable-fixes).\n- USB: serial: option: add MeiG Smart SRM825WN (stable-fixes).\n- USB: serial: option: add support for Rolling Wireless RW135R-GL (stable-fixes).\n- USB: serial: option: add Telit Cinterion FN990A MBIM composition (stable-fixes).\n- USB: serial: option: add Telit Cinterion LE910Cx compositions (stable-fixes).\n- usb: storage: Expand range of matched versions for VL817 quirks entry (stable-fixes).\n- usb: typec: tcpm: reset internal port states on soft reset AMS (git-fixes).\n- usb: ulpi: fix memory leak on ulpi_register() error paths (git-fixes).\n- usb: usblp: fix heap leak in IEEE 1284 device ID via short response (stable-fixes).\n- usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl (stable-fixes).\n- usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() (git-fixes).\n- usbip: validate number_of_packets in usbip_pack_ret_submit() (git-fixes).\n- virt: tdx-guest: Fix handling of host controlled 'quote' buffer length (git-fixes).\n- virt: tdx-guest: Return error for GetQuote failures (git-fixes).\n- wifi: ath5k: do not access array OOB (git-fixes).\n- wifi: ath9k: Fix typo (git-fixes).\n- wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session (git-fixes).\n- wifi: ath11k: skip status ring entry processing (stable-fixes).\n- wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation (stable-fixes).\n- wifi: ath12k: fix leak in some ath12k_wmi_xxx() functions (git-fixes).\n- wifi: b43: enforce bounds check on firmware key index in b43_rx() (git-fixes).\n- wifi: b43legacy: enforce bounds check on firmware key index in RX path (git-fixes).\n- wifi: brcmfmac: Fix error pointer dereference (git-fixes).\n- wifi: brcmfmac: validate bsscfg indices in IF events (stable-fixes).\n- wifi: brcmsmac: Fix dma_free_coherent() size (git-fixes).\n- wifi: cw1200: Revert 'Fix locking in error paths' (git-fixes).\n- wifi: libertas: notify firmware load wait on disconnect (git-fixes).\n- wifi: mac80211: check ieee80211_rx_data_set_link return in pubsta MLO path (git-fixes).\n- wifi: mac80211: check tdls flag in ieee80211_tdls_oper (stable-fixes).\n- wifi: mac80211: drop stray 'static' from fast-RX rx_result (git-fixes).\n- wifi: mac80211: handle VHT EXT NSS in ieee80211_determine_our_sta_mode() (git-fixes).\n- wifi: mac80211: remove station if connection prep fails (git-fixes).\n- wifi: mac80211: use safe list iteration in radar detect work (git-fixes).\n- wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor (stable-fixes).\n- wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling (git-fixes).\n- wifi: mt76: mt7615: fix use_cts_prot support (git-fixes).\n- wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() (git-fixes).\n- wifi: mt76: mt7915: fix use_cts_prot support (git-fixes).\n- wifi: mt76: mt7921: fix 6GHz regulatory update on connection (git-fixes).\n- wifi: mt76: mt7921: fix a potential clc buffer length underflow (git-fixes).\n- wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work (git-fixes).\n- wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() (git-fixes).\n- wifi: mt76: mt7925: fix incorrect length field in txpower command (git-fixes).\n- wifi: mt76: mt7996: fix FCS error flag check in RX descriptor (git-fixes).\n- wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event (git-fixes).\n- wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() (git-fixes).\n- wifi: nl80211: fix NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST usage (git-fixes).\n- wifi: nl80211: require admin perm on SET_PMK / DEL_PMK (git-fixes).\n- wifi: rsi: fix kthread lifetime race between self-exit and external-stop (git-fixes).\n- wifi: rt2x00usb: fix devres lifetime (git-fixes).\n- wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet (git-fixes).\n- wifi: rtw88: check for PCI upstream bridge existence (git-fixes).\n- wifi: rtw88: fix device leak on probe failure (git-fixes).\n- wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() (git-fixes).\n- wifi: wl1251: validate packet IDs before indexing tx_frames (stable-fixes).\n- workqueue: Break up enum definitions and give names to the types (bsc#1260522).\n- workqueue: Clean up enum work_bits and related constants (bsc#1260522).\n- workqueue: Factor out work_grab_pending() from __cancel_work_sync() (bsc#1260522).\n- workqueue: Fix UBSAN 'subtraction overflow' error in shift_and_mask() (bsc#1260522).\n- workqueue: Implement disable/enable for (delayed) work items (bsc#1260522).\n- workqueue: Introduce work_cancel_flags (bsc#1260522).\n- workqueue: Make @flags handling consistent across set_work_data() and friends (bsc#1260522).\n- workqueue: Preserve OFFQ bits in cancel[_sync] paths (bsc#1260522).\n- workqueue: Rename __cancel_work_timer() to __cancel_timer_sync() (bsc#1260522).\n- workqueue: Reorganize flush and cancel[_sync] functions (bsc#1260522).\n- x86/boot/64: Clear most of CR4 in startup_64(), except PAE, MCE and LA57 (git-fixes).\n- x86/boot/sev: Avoid shared GHCB page for early memory acceptance (git-fixes).\n- x86/boot: Don't add the EFI stub to targets, again (git-fixes).\n- x86/boot: Fix page table access in 5-level to 4-level paging transition (git-fixes).\n- x86/CPU/AMD: Add models 0x60-0x6f to the Zen5 range (bsc#1263255).\n- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (bsc#1263255).\n- x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (git-fixes).\n- x86/cpufeatures: Free up unused feature bits (bsc#1263255).\n- x86/fred: Remove ENDBR64 from FRED entry points (git-fixes).\n- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (jsc#PED-16245).\n- X.509: Fix out-of-bounds access when parsing extensions (git-fixes).\n- Xarray: do not return sibling entries from xas_find_marked() (bsc#1263815).\n- xfrm: esp: avoid in-place decrypt on shared skb frags (bsc#1264449).\n","status":"published","published":"2026-06-02T05:58:33Z","modified":"2026-06-03T08:30:23.364112563Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:2238-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).\n- CVE-2025-54518: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (bsc#1264013).\n- CVE-2025-68310: s390/pci: Use pci_uevent_ers() in PCI recovery (bsc#1255160).\n- CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).\n- CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).\n- CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).\n- CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).\n- CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).\n- CVE-2026-23262: gve: Fix stats report corruption on queue count change (bsc#1259870).\n- CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).\n- CVE-2026-23276: net: move dev_xmit_recursion() helpers to net/core/dev.h (bsc#1260012).\n- CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).\n- CVE-2026-23304: ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() (bsc#1260544).\n- CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).\n- CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).\n- CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).\n- CVE-2026-23335: RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() (bsc#1260550).\n- CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).\n- CVE-2026-23343: xdp: produce a warning when calculated tailroom is negative (bsc#1260527).\n- CVE-2026-23346: mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (bsc#1260529).\n- CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).\n- CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).\n- CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).\n- CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).\n- CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).\n- CVE-2026-23383: bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing (bsc#1260497).\n- CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).\n- CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).\n- CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).\n- CVE-2026-23395: Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ (bsc#1260580).\n- CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).\n- CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).\n- CVE-2026-23412: netfilter: bpf: defer hook memory release until rcu readers are done (bsc#1261412).\n- CVE-2026-23419: net/rds: Fix circular locking dependency in rds_tcp_tune (bsc#1261507).\n- CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).\n- CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).\n- CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).\n- CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).\n- CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).\n- CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).\n- CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).\n- CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).\n- CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).\n- CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).\n- CVE-2026-23461: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (bsc#1261707).\n- CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).\n- CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).\n- CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).\n- CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on wakeup race (bsc#1261694).\n- CVE-2026-31395: bnxt_en: fix OOB access in DBG_BUF_PRODUCER async event handler (bsc#1261786).\n- CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).\n- CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).\n- CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).\n- CVE-2026-31404: xfs: avoid dereferencing log items after push callbacks (bsc#1261628).\n- CVE-2026-31407: netfilter: conntrack: add missing netlink policy validations (bsc#1261632).\n- CVE-2026-31411: net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (bsc#1261752).\n- CVE-2026-31415: ipv6: avoid overflows in ip6_datagram_send_ctl() (bsc#1262099).\n- CVE-2026-31416: netfilter: nfnetlink_log: account for netlink header size (bsc#1262100).\n- CVE-2026-31420: bridge: mrp: reject zero test interval to avoid OOM panic (bsc#1262055).\n- CVE-2026-31421: net/sched: cls_fw: fix NULL pointer dereference on shared blocks (bsc#1262061).\n- CVE-2026-31422: net/sched: cls_flow: fix NULL pointer dereference on shared blocks (bsc#1262054).\n- CVE-2026-31423: net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() (bsc#1262063).\n- CVE-2026-31424: netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (bsc#1262053).\n- CVE-2026-31425: rds: ib: reject FRMR registration before IB connection is established (bsc#1262074).\n- CVE-2026-31427: netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp (bsc#1262086).\n- CVE-2026-31428: netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (bsc#1262087).\n- CVE-2026-31436: dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() (bsc#1262602).\n- CVE-2026-31449: ext4: validate p_idx bounds in ext4_ext_correct_indexes (bsc#1262616).\n- CVE-2026-31470: virt: tdx-guest: Fix handling of host controlled 'quote' buffer length (bsc#1262665).\n- CVE-2026-31488: drm/amd/display: Do not skip unrelated mode changes in DSC validation (bsc#1262746).\n- CVE-2026-31494: net: cadence: macb: Synchronize stats calculations (bsc#1262671).\n- CVE-2026-31496: netfilter: nf_conntrack_expect: skip expectations in other netns via proc (bsc#1262673).\n- CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263085).\n- CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263093).\n- CVE-2026-31507: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer (bsc#1263095).\n- CVE-2026-31512: Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()\n  (bsc#1262734).\n- CVE-2026-31515: af_key: validate families in pfkey_send_migrate() (bsc#1262752).\n- CVE-2026-31519: btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create (bsc#1263012).\n- CVE-2026-31525: bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN (bsc#1262725).\n- CVE-2026-31528: perf: Make sure to use pmu_ctx-\u003epmu for groups (bsc#1263001).\n- CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262758).\n- CVE-2026-31547: drm/xe: Fix missing runtime PM reference in ccs_mode_store (bsc#1263018).\n- CVE-2026-31550: pmdomain: bcm: bcm2835-power: Increase ASB control timeout (bsc#1263104).\n- CVE-2026-31565: RDMA/irdma: Fix deadlock during netdev reset with active connections (bsc#1263064).\n- CVE-2026-31570: can: gw: fix OOB heap access in cgw_csum_crc8_rel() (bsc#1263065).\n- CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263176).\n- CVE-2026-31588: KVM: x86: Use scratch field in MMIO fragment to hold small write values (bsc#1263165).\n- CVE-2026-31602: ALSA: ctxfi: Limit PTP to a single page (bsc#1263723).\n- CVE-2026-31607: usbip: validate number_of_packets in usbip_pack_ret_submit() (bsc#1263600).\n- CVE-2026-31622: NFC: digital: Bounds check NFC-A cascade depth in SDD response handler (bsc#1263797).\n- CVE-2026-31649: net: stmmac: fix integer underflow in chain mode (bsc#1263582).\n- CVE-2026-31656: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (bsc#1263170).\n- CVE-2026-31662: tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (bsc#1263131).\n- CVE-2026-31668: seg6: separate dst_cache for input and output paths in seg6 lwtunnel (bsc#1263140).\n- CVE-2026-31669: mptcp: fix slab-use-after-free in __inet_lookup_established (bsc#1263141).\n- CVE-2026-31675: net/sched: sch_netem: fix out-of-bounds access in packet corruption (bsc#1263556).\n- CVE-2026-31679: openvswitch: validate MPLS set/set_masked payload length (bsc#1263592).\n- CVE-2026-31681: netfilter: xt_multiport: validate range encoding in checkentry (bsc#1263593).\n- CVE-2026-31682: bridge: br_nd_send: linearize skb before parsing ND options (bsc#1263595).\n- CVE-2026-31684: net: sched: act_csum: validate nested VLAN headers (bsc#1263596).\n- CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263668).\n- CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263901).\n- CVE-2026-31700: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (bsc#1263882).\n- CVE-2026-31738: vxlan: validate ND option lengths in vxlan_na_create (bsc#1264059).\n- CVE-2026-31787: xen/privcmd: fix double free via VMA splitting (bsc#1262181).\n- CVE-2026-43009: bpf: Fix incorrect pruning due to atomic fetch precision tracking (bsc#1264014).\n- CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1263931).\n- CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1263933).\n- CVE-2026-43037: ip6_tunnel: clear skb2-\u003ecb in ip4ip6_err() (bsc#1263995).\n- CVE-2026-43038: ipv6: icmp: clear skb2-\u003ecb in ip6_err_gen_icmpv6_unreach() (bsc#1264097).\n- CVE-2026-43044: crypto: caam - fix DMA corruption on long hmac keys (bsc#1264087).\n- CVE-2026-43050: atm: lec: fix use-after-free in sock_def_readable() (bsc#1264082).\n- CVE-2026-43060: netfilter: nft_ct: drop pending enqueued packets on removal (bsc#1264183).\n- CVE-2026-43088: net: af_key: zero aligned sockaddr tail in PF_KEY exports (bsc#1264469).\n- CVE-2026-43110: wifi: brcmfmac: validate bsscfg indices in IF events (bsc#1264482).\n- CVE-2026-43120: RDMA/irdma: Fix double free related to rereg_user_mr.\n- CVE-2026-43126: ALSA: mixer: oss: Add card disconnect checkpoints (bsc#1264634).\n- CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264848).\n- CVE-2026-43214: KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (bsc#1264651).\n- CVE-2026-43265: KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block() (bsc#1264427).\n- CVE-2026-43329: netfilter: flowtable: strictly check for maximum number of actions (bsc#1265085).\n- CVE-2026-43330: crypto: caam - fix overflow on long hmac keys (bsc#1264801).\n- CVE-2026-43334: Bluetooth: SMP: force responder MITM requirements before building the pairing response (bsc#1265090).\n- CVE-2026-43365: xfs: fix undersized l_iclog_roundoff values (bsc#1265119).\n- CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265116).\n- CVE-2026-43419: ceph: fix memory leaks in ceph_mdsc_build_path() (bsc#1264661).\n- CVE-2026-43437: ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() (bsc#1265126).\n- CVE-2026-43441: net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1264674).\n- CVE-2026-43494: net/rds: reset op_nents when zerocopy page pin fails (bsc#1265626).\n- CVE-2026-43503: net: skbuff: propagate shared-frag marker through frag-transfer helpers (bsc#1265960).\n- CVE-2026-46300: net: skbuff: preserve shared-frag marker during coalescing (bsc#1265209).\n- CVE-2026-46331: kernel: net/sched: fix pedit partial COW leading to page cache (bsc#1265421)\n\nThe following non security issues were fixed:\n\n- accel/qaic: Add overflow check to remap_pfn_range during mmap (git-fixes).\n- ACPI: AGDI: fix missing newline in error message (git-fixes).\n- ACPI: CPPC: Fix related_cpus inconsistency during CPU hotplug (git-fixes).\n- ACPI: scan: Use acpi_dev_put() in object add error paths (git-fixes).\n- ACPI: video: Add backlight=native quirk for Dell OptiPlex 7770 AIO (git-fixes).\n- ACPI: video: force native backlight on HP OMEN 16 (8A44) (stable-fixes).\n- ALSA: 6fire: Fix input volume change detection (git-fixes).\n- ALSA: 6fire: fix use-after-free on disconnect (git-fixes).\n- ALSA: aoa: i2sbus: clear stale prepared state (git-fixes).\n- ALSA: aoa: i2sbus: fix OF node lifetime handling (git-fixes).\n- ALSA: aoa: Skip devices with no codecs in i2sbus_resume() (git-fixes).\n- ALSA: aoa: Use guard() for mutex locks (stable-fixes).\n- ALSA: asihpi: avoid write overflow check warning (stable-fixes).\n- ALSA: caiaq: Don't abort when no input device is available (git-fixes).\n- ALSA: caiaq: Fix control_put() result and cache rollback (git-fixes).\n- ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path (git-fixes).\n- ALSA: caiaq: fix usb_dev refcount leak on probe failure (git-fixes).\n- ALSA: caiaq: Handle probe errors properly (git-fixes).\n- ALSA: caiaq: take a reference on the USB device in create_card() (git-fixes).\n- ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() (git-fixes).\n- ALSA: core: Fix potential data race at fasync handling (git-fixes).\n- ALSA: core: Serialize deferred fasync state checks (git-fixes).\n- ALSA: core: Validate compress device numbers without dynamic minors (git-fixes).\n- ALSA: ctxfi: Add fallback to default RSR for S/PDIF (git-fixes).\n- ALSA: ctxfi: Fix missing SPDIFI1 index handling (stable-fixes).\n- ALSA: ctxfi: Limit PTP to a single page (git-fixes).\n- ALSA: firewire-tascam: Do not drop unread control events (git-fixes).\n- ALSA: fireworks: bound device-supplied status before string array lookup (git-fixes).\n- ALSA: hda/realtek - fixed speaker no sound update (git-fixes).\n- ALSA: hda/realtek: Add HP ENVY Laptop 13-ba0xxx quirk (stable-fixes).\n- ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg0xxx (stable-fixes).\n- ALSA: hda/realtek: Add quirk for ASUS ROG Flow Z13-KJP GZ302EAC (stable-fixes).\n- ALSA: hda/realtek: add quirk for Framework F111:000F (stable-fixes).\n- ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IAH10 (stable-fixes).\n- ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}') (git-fixes).\n- ALSA: hda: cs35l41: Put ACPI device on missing physical node (git-fixes).\n- ALSA: hda: cs35l56: Propagate ASP TX source control errors (git-fixes).\n- ALSA: hda: cs35l56: Put ACPI device after setting companion (git-fixes).\n- ALSA: hda: Fix NULL pointer dereference in snd_hda_ctl_add() (git-fixes).\n- ALSA: misc: Use guard() for spin locks (stable-fixes).\n- ALSA: scarlett2: Add missing error check when initialise Autogain Status (git-fixes).\n- ALSA: scarlett2: Add missing sentinel initializer field (git-fixes).\n- ALSA: seq: Notify client and port info changes (stable-fixes).\n- ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes (stable-fixes).\n- ALSA: usb-audio: apply quirk for MOONDROP JU Jiu (stable-fixes).\n- ALSA: usb-audio: Avoid false E-MU sample-rate notifications (git-fixes).\n- ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() (git-fixes).\n- ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans (git-fixes).\n- ALSA: usb-audio: Bound MIDI endpoint descriptor scans (git-fixes).\n- ALSA: usb-audio: Evaluate packsize caps at the right place (git-fixes).\n- ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch (git-fixes).\n- ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams (git-fixes).\n- ALSA: usb-audio: Fix quirk flags for NeuralDSP Quad Cortex (stable-fixes).\n- ALSA: usb-audio: Fix UAC3 cluster descriptor size check (git-fixes).\n- ALSA: usb-audio: midi2: Restart output URBs on resume (git-fixes).\n- ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES (git-fixes).\n- amdgpu/jpeg: fix deepsleep register for jpeg 5_0_0 and 5_0_2 (stable-fixes).\n- ASoC: amd: acp: Add DMI quirk for Valve Steam Deck OLED (git-fixes).\n- ASoC: amd: yc: Add DMI entry for HP Laptop 15-fc0xxx (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for ASUS EXPERTBOOK BM1403CDA (stable-fixes).\n- ASoC: amd: yc: Add DMI quirk for Thin A15 B7VF (stable-fixes).\n- ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product line in quirk table (stable-fixes).\n- ASoC: codecs: ab8500: Fix casting of private data (git-fixes).\n- ASoC: cs35l56: Destroy workqueue in probe error path (git-fixes).\n- ASoC: cs35l56: Don't use devres to unregister component (git-fixes).\n- ASoC: cs35l56: Fix hibernate write in runtime resume error path (git-fixes).\n- ASoC: fsl_easrc: Change the type for iec958 channel status controls (git-fixes).\n- ASoC: fsl_easrc: Check the variable range in fsl_easrc_iec958_put_bits() (git-fixes).\n- ASoC: fsl_easrc: fix comment typo (git-fixes).\n- ASoC: fsl_easrc: Fix value type in fsl_easrc_iec958_get_bits() (git-fixes).\n- ASoC: fsl_micfil: Add access property for 'VAD Detected' (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in hwvad_put_enable() (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in hwvad_put_init_mode() (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in micfil_put_dc_remover_state() (git-fixes).\n- ASoC: fsl_micfil: Fix event generation in micfil_quality_set() (git-fixes).\n- ASoC: fsl_xcvr: Fix event generation for cached controls (git-fixes).\n- ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_arc_mode_put() (git-fixes).\n- ASoC: fsl_xcvr: Fix event generation in fsl_xcvr_mode_put() (git-fixes).\n- ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error (git-fixes).\n- ASoC: qcom: q6apm-dai: reset queue ptr on trigger stop (git-fixes).\n- ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens (git-fixes).\n- ASoC: qcom: q6apm: move component registration to unmanaged version (git-fixes).\n- ASoC: qcom: q6apm: remove child devices when apm is removed (git-fixes).\n- ASoC: qcom: qdsp6: topology: check widget type before accessing data (git-fixes).\n- ASoC: soc-core: call missing INIT_LIST_HEAD() for card_aux_list (stable-fixes).\n- ASoC: SOF: compress: return the configured codec from get_params (git-fixes).\n- ASoC: SOF: Don't allow pointer operations on unconfigured streams (git-fixes).\n- ASoC: SOF: Intel: hda: Place check before dereference (git-fixes).\n- ASoC: SOF: topology: reject invalid vendor array size in token parser (stable-fixes).\n- ASoC: sti: Return errors from regmap_field_alloc() (git-fixes).\n- ASoC: sti: use managed regmap_field allocations (git-fixes).\n- ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J (stable-fixes).\n- ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585 (stable-fixes).\n- batman-adv: bla: only purge non-released claims (git-fixes).\n- batman-adv: bla: prevent use-after-free when deleting claims (git-fixes).\n- batman-adv: bla: put backbone reference on failed claim hash insert (git-fixes).\n- batman-adv: fix integer overflow on buff_pos (git-fixes).\n- batman-adv: hold claim backbone gateways by reference (git-fixes).\n- batman-adv: reject new tp_meter sessions during teardown (git-fixes).\n- batman-adv: reject oversized global TT response buffers (git-fixes).\n- batman-adv: stop caching unowned originator pointers in BAT IV (git-fixes).\n- Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling (git-fixes).\n- Bluetooth: btmtk: validate WMT event SKB length before struct access (git-fixes).\n- Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (git-fixes).\n- Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt (git-fixes).\n- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (git-fixes).\n- Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (git-fixes).\n- Bluetooth: HIDP: serialise l2cap_unregister_user via hidp_session_sem (git-fixes).\n- Bluetooth: ISO: Fix data-race on dst in iso_sock_connect() (git-fixes).\n- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (git-fixes).\n- Bluetooth: l2cap: fix MPS check in l2cap_ecred_reconf_req (git-fixes).\n- Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (git-fixes).\n- Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() (git-fixes).\n- Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU (git-fixes).\n- Bluetooth: RFCOMM: pull credit byte with skb_pull_data() (git-fixes).\n- Bluetooth: SCO: check for codecs-\u003enum_codecs == 1 before assigning to sco_pi(sk)-\u003ecodec (git-fixes).\n- Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready (git-fixes).\n- Bluetooth: SCO: hold sk properly in sco_conn_ready (git-fixes).\n- Bluetooth: virtio_bt: clamp rx length before skb_put (git-fixes).\n- Bluetooth: virtio_bt: validate rx pkt_type header length (git-fixes).\n- btrfs: do not skip logging new dentries when logging a new name (git-fixes).\n- btrfs: reject root items with drop_progress and zero drop_level (git-fixes).\n- btrfs: replace BUG() with error handling in __btrfs_balance() (git-fixes).\n- can: mcp251x: add error handling for power enable in open and resume (stable-fixes).\n- can: raw: fix ro-\u003euniq use-after-free in raw_rcv() (git-fixes).\n- can: ucan: fix devres lifetime (git-fixes).\n- cdc-acm: new quirk for EPSON HMD (stable-fixes).\n- cgroup/cpuset: Fix incorrect change to effective_xcpus in partition_xcpus_del() (bsc#1241166).\n- cgroup/cpuset: Fix incorrect use of cpuset_update_tasks_cpumask() in update_cpumasks_hier() (bsc#1241166).\n- check-for-config-changes: Exclude CC_MS_EXTENSIONS.\n- check-for-config-changes: Exclude HAVE_CFI_ICALL_NORMALIZE_INTEGERS{,_RUSTC}.\n- checkpatch: add support for Assisted-by tag (stable-fixes).\n- comedi: dt2815: add hardware detection to prevent crash (stable-fixes).\n- cpufreq: intel_pstate: Drop Arrow Lake from 'scaling factor' list (bsc#1249104).\n- crypto: algif_aead - Fix minimum RX size check for decryption (git-fixes).\n- crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated as 64-bit (git-fixes).\n- crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup (git-fixes).\n- crypto: atmel-ecc - Release client on allocation failure (git-fixes).\n- crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path (git-fixes).\n- crypto: atmel-tdes - fix DMA sync direction (git-fixes).\n- crypto: authencesn - reject short ahash digests during instance creation (git-fixes).\n- crypto: ccp - copy IV using skcipher ivsize (git-fixes).\n- crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (git-fixes).\n- crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (git-fixes).\n- crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (git-fixes).\n- crypto: ccree - fix a memory leak in cc_mac_digest() (git-fixes).\n- crypto: hisilicon - Fix dma_unmap_single() direction (git-fixes).\n- crypto: jitterentropy - replace long-held spinlock with mutex (git-fixes).\n- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (git-fixes).\n- crypto: qat - fix type mismatch in RAS sysfs show functions (git-fixes).\n- crypto: qat - use swab32 macro (git-fixes).\n- crypto: sa2ul - Fix AEAD fallback algorithm names (git-fixes).\n- crypto: simd - reject compat registrations without __ prefixes (git-fixes).\n- crypto: talitos - fix SEC1 32k ahash request limitation (git-fixes).\n- crypto: testmgr - Hide ENOENT errors (stable-fixes).\n- crypto: testmgr - Hide ENOENT errors better (git-fixes).\n- devres: fix missing node debug info in devm_krealloc() (git-fixes).\n- dm init: ensure device probing has finished in dm-mod.waitfor= (git-fixes).\n- dmaengine: dw-axi-dmac: Remove unnecessary return statement from void function (git-fixes).\n- dmaengine: mxs-dma: Fix missing return value from of_dma_controller_register() (git-fixes).\n- dpll: zl3073x: Add support to adjust phase (bsc#1255752).\n- dpll: zl3073x: Fix output pin phase adjustment sign (bsc#1255752).\n- dpll: zl3073x: Fix output pin registration (bsc#1255752).\n- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (bsc#1255752).\n- dpll: zl3073x: Specify phase adjustment granularity for pins (bsc#1255752).\n- drm/amd/display: Add NULL check for integrated_info in clk_mgr_construct (git-fixes).\n- drm/amd/display: Allow DCE link encoder without AUX registers (git-fixes).\n- drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths (git-fixes).\n- drm/amd/display: Change dither policy for 10 bpc output back to dithering (git-fixes).\n- drm/amd/display: Correct logic check error for fastboot (git-fixes).\n- drm/amd/display: Disable 10-bit truncation and dithering on DCE 6.x (git-fixes).\n- drm/amd/display: Disable fastboot on DCE 6 too (stable-fixes).\n- drm/amd/display: Read EDID from VBIOS embedded panel info (git-fixes).\n- drm/amd/pm/ci: Clear EnabledForActivity field for memory levels (git-fixes).\n- drm/amd/pm/ci: Disable MCLK DPM on problematic CI ASICs (git-fixes).\n- drm/amd/pm/ci: Fill DW8 fields from SMC (git-fixes).\n- drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0 (git-fixes).\n- drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled (git-fixes).\n- drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board (git-fixes).\n- drm/amd/pm/smu7: Fix SMU7 voltage dependency on display clock (git-fixes).\n- drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x (git-fixes).\n- drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2) (git-fixes).\n- drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ (stable-fixes).\n- drm/amdgpu/gfx10: look at the right prop for gfx queue priority (git-fixes).\n- drm/amdgpu/gfx11: look at the right prop for gfx queue priority (git-fixes).\n- drm/amdgpu/gmc: Fix AMDGPU_GART_PLACEMENT_LOW to not overlap with VRAM (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.5 ring (git-fixes).\n- drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.0 ring (git-fixes).\n- drm/amdgpu/pm: add missing revision check for CI (git-fixes).\n- drm/amdgpu/pm: align Hawaii mclk workaround with radeon (git-fixes).\n- drm/amdgpu/pm: drop SMU driver if version not matched messages (stable-fixes).\n- drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission (git-fixes).\n- drm/amdgpu/vce: Prevent partial address patches (stable-fixes).\n- drm/amdgpu/vcn3: Avoid overflow on msg bound check (git-fixes).\n- drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (stable-fixes).\n- drm/amdgpu/vcn4: Avoid overflow on msg bound check (git-fixes).\n- drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (stable-fixes).\n- drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (stable-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v4.0.5 enc ring (git-fixes).\n- drm/amdgpu/vcn: set no_user_fence for VCN v5.0.0 enc ring (git-fixes).\n- drm/amdgpu: Add bounds checking to ib_{get,set}_value (stable-fixes).\n- drm/amdgpu: Add default case in DVI mode validation (git-fixes).\n- drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG (git-fixes).\n- drm/amdgpu: fix the idr allocation flags (git-fixes).\n- drm/amdgpu: fix zero-size GDS range init on RDNA4 (stable-fixes).\n- drm/amdgpu: gate VM CPU HDP flush on reset lock (stable-fixes).\n- drm/amdgpu: replace PASID IDR with XArray (git-fixes).\n- drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count (stable-fixes).\n- drm/amdgpu: zero-initialize GART table on allocation (stable-fixes).\n- drm/amdkfd: Add upper bound check for num_of_nodes (stable-fixes).\n- drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure (stable-fixes).\n- drm/amdkfd: Make all TLB-flushes heavy-weight (stable-fixes).\n- drm/amdkfd: validate SVM ioctl nattr against buffer size (stable-fixes).\n- drm/arcpgu: fix device node leak (git-fixes).\n- drm/bridge: cadence: cdns-mhdp8546-core: Add mode_valid hook to drm_bridge_funcs (git-fixes).\n- drm/bridge: cadence: cdns-mhdp8546-core: Handle HDCP state in bridge atomic check (git-fixes).\n- drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() (git-fixes).\n- drm/bridge: stm_lvds: Do not fail atomic_check on disabled connector (git-fixes).\n- drm/etnaviv: Fix armed job not being pushed to the DRM scheduler (git-fixes).\n- drm/exynos: remove bridge when component_add fails (git-fixes).\n- drm/fb-helper: Fix clipping when damage area spans a single scanline (git-fixes).\n- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (git-fixes).\n- drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup (git-fixes).\n- drm/gma500/oaktrail_lvds: fix hang on init failure (git-fixes).\n- drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init (git-fixes).\n- drm/i915/dp: Fix VSC dynamic range signaling for RGB formats (git-fixes).\n- drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (git-fixes).\n- drm/i915/wm: Verify the correct plane DDB entry (git-fixes).\n- drm/i915: skip __i915_request_skip() for already signaled requests (git-fixes).\n- drm/imagination: Switch reset_reason fields from enum to u32 (git-fixes).\n- drm/komeda: fix integer overflow in AFBC framebuffer size check (git-fixes).\n- drm/loongson: Use managed KMS polling (git-fixes).\n- drm/msm/a6xx: Fix dumping A650+ debugbus blocks (git-fixes).\n- drm/msm/a6xx: Fix HLSQ register dumping (git-fixes).\n- drm/msm/a6xx: Use barriers while updating HFI Q headers (git-fixes).\n- drm/msm/dpu: fix mismatch between power and frequency (git-fixes).\n- drm/msm/dsi: add the missing parameter description (git-fixes).\n- drm/msm/dsi: fix bits_per_pclk (git-fixes).\n- drm/msm/dsi: fix hdisplay calculation for CMD mode panel (git-fixes).\n- drm/msm/dsi: rename MSM8998 DSI version from V2_2_0 to V2_0_0 (git-fixes).\n- drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata() (git-fixes).\n- drm/msm/shrinker: Fix can_block() logic (git-fixes).\n- drm/msm: add missing MODULE_DEVICE_ID definitions (git-fixes).\n- drm/nouveau: fix nvkm_device leak on aperture removal failure (git-fixes).\n- drm/nouveau: fix u32 overflow in pushbuf reloc bounds check (git-fixes).\n- drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds (git-fixes).\n- drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds (git-fixes).\n- drm/panel: sharp-ls043t1le01: make use of prepare_prev_first (git-fixes).\n- drm/panel: simple: Correct G190EAN01 prepare timing (git-fixes).\n- drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout() (git-fixes).\n- drm/panthor: Fix outdated function documentation (git-fixes).\n- drm/radeon: add missing revision check for CI (git-fixes).\n- drm/sun4i: backend: fix error pointer dereference (git-fixes).\n- drm/sun4i: Fix resource leaks (git-fixes).\n- drm/v3d: Handle error from drm_sched_entity_init() (git-fixes).\n- drm/vc4: Fix a memory leak in hang state error path (git-fixes).\n- drm/vc4: Fix memory leak of BO array in hang state (git-fixes).\n- drm/vc4: platform_get_irq_byname() returns an int (stable-fixes).\n- drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock (git-fixes).\n- drm/vc4: Release runtime PM reference after binding V3D (git-fixes).\n- drm/vram: remove DRM_VRAM_MM_FILE_OPERATIONS from docs (git-fixes).\n- drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked() (git-fixes).\n- drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked() (git-fixes).\n- drm/xe/debugfs: Correct printing of register whitelist ranges (git-fixes).\n- drm/xe/dma-buf: handle empty bo and UAF races (git-fixes).\n- drm/xe/gsc: Fix BO leak on error in query_compatibility_version() (git-fixes).\n- drm/xe/uapi: update used tracking kernel-doc (git-fixes).\n- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (git-fixes).\n- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (git-fixes).\n- dt-bindings: net: Fix Tegra234 MGBE PTP clock (git-fixes).\n- efi/capsule-loader: fix incorrect sizeof in phys array reallocation (git-fixes).\n- efi: pstore: Drop efivar lock when efi_pstore_open() returns with an error (git-fixes).\n- ext4: fix fsync(2) for nojournal mode (git-fixes).\n- ext4: make recently_deleted() properly work with lazy itable initialization (git-fixes).\n- ext4: reject mount if bigalloc with s_first_data_block != 0 (git-fixes).\n- extcon: ptn5150: handle pending IRQ events during system resume (git-fixes).\n- fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break (git-fixes).\n- fbdev: offb: fix PCI device reference leak on probe failure (git-fixes).\n- fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO (stable-fixes).\n- fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free (stable-fixes).\n- fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO (git-fixes).\n- firmware: dmi: Correct an indexing error in dmi.h (git-fixes).\n- gpio: tegra: fix irq_release_resources calling enable instead of disable (git-fixes).\n- gtp: disable BH before calling udp_tunnel_xmit_skb() (git-fixes).\n- HID: alps: fix NULL pointer dereference in alps_raw_event() (git-fixes).\n- HID: asus: do not abort probe when not necessary (git-fixes).\n- HID: asus: make asus_resume adhere to linux kernel coding standards (git-fixes).\n- HID: core: clamp report_size in s32ton() to avoid undefined shift (stable-fixes).\n- HID: multitouch: Check to ensure report responses match the request (stable-fixes).\n- HID: playstation: Clamp num_touch_reports (git-fixes).\n- HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 (stable-fixes).\n- HID: roccat: fix use-after-free in roccat_report_event (stable-fixes).\n- HID: usbhid: fix deadlock in hid_post_reset() (git-fixes).\n- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (stable-fixes).\n- hv_sock: fix ARM64 support (git-fixes).\n- hwmon: (ads7871) Fix endianness bug in 16-bit register reads (git-fixes).\n- hwmon: (corsair-psu) Close HID device on probe errors (git-fixes).\n- hwmon: (lm63) Add locking to avoid TOCTOU (git-fixes).\n- hwmon: (ltc2992) Clamp threshold writes to hardware range (git-fixes).\n- hwmon: (ltc2992) Fix u32 overflow in power read path (git-fixes).\n- i2c: s3c24xx: check the size of the SMBUS message before using it (stable-fixes).\n- i2c: smbus: reject oversized block transfers in the common path (git-fixes).\n- i2c: stm32f7: reinit_completion() per transfer not per msg (git-fixes).\n- i2c: stub: Reject I2C block transfers with invalid length (git-fixes).\n- i3c: master: Fix error codes at send_ccc_cmd (git-fixes).\n- i3c: mipi-i3c-hci: fix IBI payload length calculation for final status (git-fixes).\n- ibmveth: Disable GSO for packets with small MSS (bsc#1265144).\n- ice: set max queues in alloc_etherdev_mqs() (git-fixes).\n- iio: adc: ad7768-1: fix one-shot mode data acquisition (git-fixes).\n- iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() (git-fixes).\n- iio: adc: ti-ads7950: use iio_push_to_buffers_with_ts_unaligned() (git-fixes).\n- Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table (stable-fixes).\n- Input: uinput - fix circular locking dependency with ff-core (git-fixes).\n- Input: uinput - take event lock when submitting FF request 'event' (stable-fixes).\n- Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode (stable-fixes).\n- Input: xpad - add support for Razer Wolverine V3 Pro (stable-fixes).\n- intel_idle: add Clearwater Forest SoC support (jsc#PED-10383).\n- ipmi: Add limits to event and receive message requests (git-fixes).\n- ipmi: Check event message buffer response for bad data (git-fixes).\n- ipmi: ssif_bmc: change log level to dbg in irq callback (git-fixes).\n- ipmi: ssif_bmc: fix message desynchronization after truncated response (git-fixes).\n- ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure (git-fixes).\n- irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter (git-fixes).\n- kdump, documentation: describe craskernel CMA reservation (jsc#PED-7249).\n- KVM: Reject wrapped offset in kvm_reset_dirty_gfn() (git-fixes).\n- KVM: SVM: Fix a missing kunmap_local() in sev_gmem_post_populate() (git-fixes).\n- KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN (git-fixes).\n- KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN (git-fixes).\n- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (bsc#1259461).\n- KVM: x86/mmu: Retry fault before acquiring mmu_lock if mapping is changing (bsc#1253122).\n- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls (git-fixes).\n- KVM: x86: check for nEPT/nNPT in slow flush hypercalls (git-fixes).\n- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (git-fixes).\n- KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (git-fixes).\n- KVM: x86: Ignore cpuid faulting in SMM (git-fixes).\n- leds: lgm-sso: Remove duplicate assignments for priv-\u003emmap (git-fixes).\n- leds: qcom-lpg: Check for array overflow when selecting the high resolution (stable-fixes).\n- lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug() (git-fixes).\n- md/raid1: fix the comparing region of interval tree (bsc#1261555).\n- md/raid1: serialize overlap io for writemostly disk (bsc#1261555).\n- media: amphion: Fix race between m2m job_abort and device_run (git-fixes).\n- media: as102: fix to not free memory after the device is registered in as102_usb_probe() (git-fixes).\n- media: chips-media: wave5: add missing spinlock protection for handle_dynamic_resolution_change() (git-fixes).\n- media: chips-media: wave5: add missing spinlock protection for send_eos_event() (git-fixes).\n- media: chips-media: wave5: fix a potential memory leak in wave5_vdi_init() (git-fixes).\n- media: dib8000: avoid division by 0 in dib8000_set_dds() (git-fixes).\n- media: em28xx: fix use-after-free in em28xx_v4l2_open() (git-fixes).\n- media: hackrf: fix to not free memory after the device is registered in hackrf_probe() (git-fixes).\n- media: i2c: imx219: Check return value of devm_gpiod_get_optional() in imx219_probe() (git-fixes).\n- media: i2c: imx412: Assert reset GPIO during probe (git-fixes).\n- media: i2c: ov08d10: fix image vertical start setting (git-fixes).\n- media: i2c: ov8856: free control handler on error in ov8856_init_controls() (git-fixes).\n- media: intel/ipu6: fix error pointer dereference (git-fixes).\n- media: mtk-jpeg: fix use-after-free in release path due to uncancelled work (git-fixes).\n- media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 (git-fixes).\n- media: omap3isp: drop the use count of v4l2 pipeline (git-fixes).\n- media: pci: zoran: fix potential memory leak in zoran_probe() (git-fixes).\n- media: rc: streamzap: Error handling in probe (git-fixes).\n- media: rc: xbox_remote: heed DMA restrictions (git-fixes).\n- media: saa7164: add ioremap return checks and cleanups (git-fixes).\n- media: staging: imx: configure src_mux in csi_start (git-fixes).\n- media: staging: imx: request mbus_config in csi_start (git-fixes).\n- media: uvcvideo: Enable VB2_DMABUF for metadata stream (git-fixes).\n- media: videobuf2: Set vma_flags in vb2_dma_sg_mmap (git-fixes).\n- media: vidtv: fix nfeeds state corruption on start_streaming failure (git-fixes).\n- media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections (git-fixes).\n- media: vidtv: fix pass-by-value structs causing MSAN warnings (git-fixes).\n- memory: tegra30-emc: Fix dll_change check (git-fixes).\n- memory: tegra124-emc: Fix dll_change check (git-fixes).\n- mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata() (git-fixes).\n- mkspec: Add signature to source list only when it exists.\n- mmc: sdhci-of-dwcmshc: Disable clock before DLL configuration (git-fixes).\n- mmc: vub300: fix NULL-deref on disconnect (git-fixes).\n- modpost: Amend ppc64 save/restfpr symnames for -Os build (bsc#1215199).\n- mtd: docg3: Convert to platform remove callback returning void (stable-fixes).\n- mtd: docg3: fix use-after-free in docg3_release() (git-fixes).\n- mtd: parsers: ofpart: call of_node_get() for dedicated subpartitions (git-fixes).\n- mtd: parsers: ofpart: call of_node_put() only in ofpart_fail path (git-fixes).\n- mtd: physmap_of_gemini: Fix disabled pinctrl state check (git-fixes).\n- mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob (git-fixes).\n- mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations (git-fixes).\n- mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show() (git-fixes).\n- mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()` (stable-fixes).\n- mtd: spi-nor: sst: Fix SST write failure (git-fixes).\n- mtd: spi-nor: sst: Fix write enable before AAI sequence (git-fixes).\n- mtd: spi-nor: swp: check SR_TB flag when getting tb_mask (git-fixes).\n- net/rds: reset op_nents when zerocopy page pin fails (bsc#1265626).\n- net/sched: cls_fw: fix NULL dereference of 'old' filters before change() (git-fixes).\n- net: gro: don't merge zcopy skbs (git-fixes).\n- net: mana: Add MAC address to vPort logs and clarify error messages (git-fixes).\n- net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq() (git-fixes).\n- net: mana: Don't overwrite port probe error with add_adev result (git-fixes).\n- net: mana: Fix crash from unvalidated SHM offset read from BAR0 during FLR (bsc#1265846).\n- net: mana: Fix EQ leak in mana_remove on NULL port (git-fixes).\n- net: mana: Fix RX skb truesize accounting (bsc#1248754).\n- net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown (git-fixes).\n- net: mana: Guard mana_remove against double invocation (git-fixes).\n- net: mana: hardening: Validate adapter_mtu from MANA_QUERY_DEV_CONFIG (git-fixes).\n- net: mana: hardening: Validate doorbell ID from GDMA_REGISTER_DEVICE response (git-fixes).\n- net: mana: Init gf_stats_work before potential error paths in probe (git-fixes).\n- net: mana: Init link_change_work before potential error paths in probe (git-fixes).\n- net: mana: remove double CQ cleanup in mana_create_rxq error path (git-fixes).\n- net: mana: Set default number of queues to 16 (bsc#1261648).\n- net: mana: Skip WQ object destruction for uninitialized RXQ (git-fixes).\n- net: mana: Use at least SZ_4K in doorbell ID range check (git-fixes).\n- net: mana: Use pci_name() for debugfs directory naming (git-fixes).\n- net: phy: dp83869: fix setting CLK_O_SEL field (git-fixes).\n- net: stmmac: Fix PTP ref clock for Tegra234 (git-fixes).\n- net: usb: asix: ax88772: re-add usbnet_link_change() in phylink callbacks (git-fixes).\n- net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() (git-fixes).\n- net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() (git-fixes).\n- net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit (git-fixes).\n- net: wan: fsl_ucc_hdlc: fix ucc_hdlc_remove (git-fixes).\n- net: wan: fsl_ucc_hdlc: fix uhdlc_memclean (git-fixes).\n- net: wan: fsl_ucc_hdlc: free tx_skbuff in uhdlc_memclean (git-fixes).\n- NFC: digital: Bounds check NFC-A cascade depth in SDD response handler (git-fixes).\n- nfc: llcp: add missing return after LLCP_CLOSED checks (git-fixes).\n- nfc: pn533: allocate rx skb before consuming bytes (git-fixes).\n- nfc: s3fwrn5: allocate rx skb before consuming bytes (git-fixes).\n- NFC: trf7970a: Ignore antenna noise when checking for RF field (git-fixes).\n- nvme-auth: Include SC_C in RVAL controller hash (bsc#1260428).\n- nvme-fabrics: use kfree_sensitive() for DHCHAP secrets (git-fixes).\n- nvme-loop: do not cancel I/O and admin tagset during ctrl reset/shutdown (bsc#1262709).\n- nvme-pci: cap queue creation to used queues (git-fixes).\n- nvme-pci: ensure we're polling a polled queue (git-fixes).\n- nvme: Allow reauth from sysfs (bsc#1259672).\n- nvme: Expose the tls_configured sysfs for secure concat connections (bsc#1259672).\n- nvme: expose TLS mode (bsc#1259672).\n- nvme: fix PCIe subsystem reset controller state transition (bsc#1261738).\n- nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers (git-fixes).\n- ocfs2: fix possible deadlock between unlink and dio_end_io_write (bsc#1258718).\n- ocfs2: split transactions in dio completion to avoid credit exhaustion (bsc#1258718).\n- Partial revert 'x86/xen: fix balloon target initialization for PVH dom0' (bsc#1262599).\n- PCI/AER: Clear only error bits in PCIe Device Status (git-fixes).\n- PCI/AER: Stop ruling out unbound devices as error source (git-fixes).\n- PCI: dwc: Apply ECRC workaround to DesignWare 5.00a as well (git-fixes).\n- PCI: Enable AtomicOps only if Root Port supports them (git-fixes).\n- PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown (git-fixes).\n- PCI: hv: Set default NUMA node to 0 for devices without affinity info (git-fixes).\n- PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found (git-fixes).\n- PCI: tegra194: Allow system suspend when the Endpoint link is not up (git-fixes).\n- PCI: tegra194: Disable direct speed change for Endpoint mode (git-fixes).\n- PCI: tegra194: Disable LTSSM after transition to Detect on surprise link down (git-fixes).\n- PCI: tegra194: Disable PERST# IRQ only in Endpoint mode (git-fixes).\n- PCI: tegra194: Fix polling delay for L2 state (git-fixes).\n- PCI: tegra194: Increase LTSSM poll time on surprise link down (git-fixes).\n- PCI: tegra194: Set LTR message request before PCIe link up in Endpoint mode (git-fixes).\n- PCI: tegra194: Use devm_gpiod_get_optional() to parse 'nvidia,refclk-select' (git-fixes).\n- PCI: tegra194: Use DWC IP core version (git-fixes).\n- pinctrl: abx500: Fix type of 'argument' variable (git-fixes).\n- pinctrl: Fix spelling problem (git-fixes).\n- pinctrl: intel: Fix the revision for new features (1kOhm PD, HW debouncer) (stable-fixes).\n- pinctrl: pic32: change all cases of bare 'unsigned' to 'unsigned int' (git-fixes).\n- pinctrl: pic32: use consistent spacing around '+' (git-fixes).\n- pinctrl: pinctrl-pic32: Fix resource leak (git-fixes).\n- platform/chrome: chromeos_tbmc: Drop wakeup source on remove (git-fixes).\n- platform/surface: surfacepro3_button: Drop wakeup source on remove (git-fixes).\n- platform/x86/amd: pmc: Add Thinkpad L14 Gen3 to quirk_s2idle_bug (stable-fixes).\n- platform/x86/intel-uncore-freq: Handle autonomous UFS status bit (git-fixes).\n- platform/x86/intel: power-domains: Add Clearwater Forest support (jsc#PED-16221).\n- platform/x86: dell-wmi-sysman: bound enumeration string aggregation (git-fixes).\n- platform/x86: dell_rbu: avoid uninit value usage in packet_size_write() (git-fixes).\n- platform/x86: hp-wmi: Ignore backlight and FnLock events (stable-fixes).\n- platform/x86: ISST: Add Clearwater Forest to support list (jsc#PED-16221).\n- platform/x86: panasonic-laptop: Fix OPTD notifier registration and cleanup (git-fixes).\n- power: supply: axp288_charger: Do not cancel work before initializing it (git-fixes).\n- power: supply: max17042: avoid overflow when determining health (git-fixes).\n- powerpc/crash: adjust the elfcorehdr size (jsc#PED-11175 git-fixes).\n- powerpc/crash: fix backup region offset update to elfcorehdr (bsc#1259535).\n- powerpc/crash: Update backup region offset in elfcorehdr on memory hotplug (bsc#1259535).\n- powerpc/kdump: Fix size calculation for hot-removed memory ranges (jsc#PED-11175 git-fixes).\n- RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() (git-fixes).\n- RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() (git-fixes).\n- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (git-fixes).\n- RDMA/mana: Validate rx_hash_key_len (git-fixes).\n- RDMA/mana_ib: cleanup the usage of mana_gd_send_request() (git-fixes).\n- RDMA/mana_ib: Disable RX steering on RSS QP destroy (git-fixes).\n- RDMA/mana_ib: Support memory windows (git-fixes).\n- regulator: act8945a: fix OF node reference imbalance (git-fixes).\n- regulator: bd9571mwv: fix OF node reference imbalance (git-fixes).\n- regulator: max77650: fix OF node reference imbalance (git-fixes).\n- regulator: mt6357: fix OF node reference imbalance (git-fixes).\n- remoteproc: xlnx: Only access buffer information if IPI is buffered (git-fixes).\n- Revert 'ALSA: usb: Increase volume range that triggers a warning' (git-fixes).\n- rtc: abx80x: Disable alarm feature if no interrupt attached (git-fixes).\n- rtc: ntxec: fix OF node reference imbalance (git-fixes).\n- s390/dasd: Copy detected format information to secondary device (bsc#1259995).\n- s390/dasd: Fix gendisk parent after copy pair swap (bsc#1259995).\n- s390/dasd: Move quiesce state with pprc swap (bsc#1259995).\n- sched/balancing: Switch the 'DEFINE_SPINLOCK(balancing)' spinlock into an 'atomic_t sched_balance_running' flag\n  (bsc#1253754).\n- sched/fair: Change likelyhood of nohz.nr_cpus (bsc#1234634 bsc#1258961).\n- sched/fair: Have SD_SERIALIZE affect newidle balancing (bsc#1253754).\n- sched/fair: Move checking for nohz cpus after time check (bsc#1234634 bsc#1258961).\n- sched/fair: Remove nohz.nr_cpus and use weight of cpumask instead (bsc#1234634 bsc#1258961).\n- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (bsc#1253754).\n- scsi: lpfc: Add clean up of aborted NVMe commands during PCI fcn reset (bsc#1262019).\n- scsi: lpfc: Add log messages to fabric login error labels (bsc#1262019).\n- scsi: lpfc: Add PCI ID support for LPe42100 series adapters (bsc#1262019).\n- scsi: lpfc: Add REG_VFI mailbox cmd error handling (bsc#1262019).\n- scsi: lpfc: Break out of IRQ affinity assignment when mask reaches nr_cpu_ids (bsc#1262019).\n- scsi: lpfc: Check ASIC_ID register to aid diagnostics during failed fw updates (bsc#1262019).\n- scsi: lpfc: Cleanup error exit paths in lpfc_fdmi_cmd() and associated messages (bsc#1262019).\n- scsi: lpfc: ELIMINATE kernel-doc warnings in lpfc.h (bsc#1262019).\n- scsi: lpfc: Fix incorrect txcmplq_cnt during cleanup in lpfc_sli_abort_ring() (bsc#1262019).\n- scsi: lpfc: Introduce 128G link speed selection and support (bsc#1262019).\n- scsi: lpfc: Log discarded and insufficient RQE buffer events (bsc#1262019).\n- scsi: lpfc: Log MCQE contents for mbox commands with no context (bsc#1262019).\n- scsi: lpfc: Properly set WC for DPP mapping (bsc#1262019).\n- scsi: lpfc: Reduce pointer chasing when accessing vmid_flag (bsc#1262019).\n- scsi: lpfc: Remove deprecated PBDE feature (bsc#1262019).\n- scsi: lpfc: Remove unnecessary ndlp kref get in lpfc_check_nlp_post_devloss (bsc#1262019).\n- scsi: lpfc: Restrict first burst to non-FCoE and SLI4 adapters only (bsc#1262019).\n- scsi: lpfc: Select mailbox rq_create cmd version based on SLI4 if_type (bsc#1262019).\n- scsi: lpfc: Update class of service bit field to 3 bits for WQE submissions (bsc#1262019).\n- scsi: lpfc: Update construction of SGL when XPSGL is enabled (bsc#1262019).\n- scsi: lpfc: Update copyright year string for 2026 (bsc#1262019).\n- scsi: lpfc: Update log message when ndlp kref get is unsuccessful (bsc#1262019).\n- scsi: lpfc: Update lpfc version to 14.4.0.14 (bsc#1262019).\n- scsi: lpfc: Update lpfc version to 15.0.0.0 (bsc#1262019).\n- scsi: lpfc: Update outdated comment for renamed lpfc_freenode() (bsc#1262019).\n- scsi: lpfc: Use min_t() instead of min() in lpfc_sli4_driver_resource_setup (bsc#1262019).\n- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (git-fixes).\n- scsi: target: iscsi: validate CHAP_R length before base64 decode (bsc#1265449).\n- selftests/powerpc: make sub-folders buildable on their own (bsc#1261669 ltc#212590).\n- selftests/powerpc: Re-order *FLAGS to follow lib.mk (bsc#1261669 ltc#212590).\n- selftests/powerpc: Suppress -Wmaybe-uninitialized with GCC 15 (bsc#1261669 ltc#212590).\n- serial: 8250: Add serial8250_handle_irq_locked() (bsc#1262480).\n- serial: 8250: Protect LCR write in shutdown (bsc#1262480).\n- serial: 8250_dw: Avoid unnecessary LCR writes (bsc#1262480).\n- serial: 8250_dw: Ensure BUSY is deasserted (bsc#1262480).\n- serial: 8250_dw: Rework dw8250_handle_irq() locking and IIR handling (bsc#1262480).\n- serial: 8250_dw: Rework IIR_NO_INT handling to stop interrupt storm (bsc#1262480).\n- soc/tegra: cbb: Set ERD on resume for err interrupt (git-fixes).\n- soc: qcom: aoss: compare against normalized cooling state (git-fixes).\n- soc: qcom: llcc: fix v1 SB syndrome register offset (git-fixes).\n- sound: ua101: fix division by zero at probe (git-fixes).\n- soundwire: bus: demote UNATTACHED state warnings to dev_dbg() (git-fixes).\n- soundwire: cadence: Clear message complete before signaling waiting thread (git-fixes).\n- spi: at91-usart: fix controller deregistration (git-fixes).\n- spi: atmel: fix controller deregistration (git-fixes).\n- spi: cadence: fix controller deregistration (git-fixes).\n- spi: fix controller cleanup() documentation (git-fixes).\n- spi: fix misleading controller deregistration kernel-doc (git-fixes).\n- spi: fix misleading controller registration kernel-doc (git-fixes).\n- spi: fsl-qspi: Use reinit_completion() for repeated operations (git-fixes).\n- spi: hisi-kunpeng: prevent infinite while() loop in hisi_spi_flush_fifo (git-fixes).\n- spi: imx: fix runtime pm leak on probe deferral (git-fixes).\n- spi: imx: fix use-after-free on unbind (git-fixes).\n- spi: microchip-core-qspi: fix controller deregistration (git-fixes).\n- spi: microchip-core-qspi: Use helper function devm_clk_get_enabled() (stable-fixes).\n- spi: mpc52xx: fix use-after-free on unbind (git-fixes).\n- spi: mtk-nor: fix controller deregistration (git-fixes).\n- spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback (git-fixes).\n- spi: omap2-mcspi: fix controller deregistration (git-fixes).\n- spi: orion: fix clock imbalance on registration failure (git-fixes).\n- spi: orion: fix runtime pm leak on unbind (git-fixes).\n- spi: rockchip: fix controller deregistration (git-fixes).\n- spi: rspi: fix controller deregistration (git-fixes).\n- spi: sh-hspi: fix controller deregistration (git-fixes).\n- spi: spi-ti-qspi: Convert to platform remove callback returning void (stable-fixes).\n- spi: sprd: fix controller deregistration (git-fixes).\n- spi: sun4i: fix controller deregistration (git-fixes).\n- spi: sun4i: switch to use modern name (stable-fixes).\n- spi: syncuacer: fix controller deregistration (git-fixes).\n- spi: synquacer: switch to use modern name (stable-fixes).\n- spi: uniphier: fix controller deregistration (git-fixes).\n- spi: uniphier: Simplify clock handling with devm_clk_get_enabled() (stable-fixes).\n- spi: uniphier: switch to use modern name (stable-fixes).\n- spi: zynq-qspi: switch to use modern name (stable-fixes).\n- spi: zynqmp-gqspi: fix controller deregistration (git-fixes).\n- staging: media: atomisp: Disallow all private IOCTLs (git-fixes).\n- staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() (git-fixes).\n- staging: sm750fb: fix division by zero in ps_to_hz() (git-fixes).\n- staging: vme_user: added bound check to geoid (stable-fixes).\n- staging: vme_user: fix root device leak on init failure (git-fixes).\n- tg3: Fix race for querying speed/duplex (bsc#1257183).\n- tg3: replace placeholder MAC address with device property (git-fixes).\n- thermal/drivers/spear: Fix error condition for reading st,thermal-flags (git-fixes).\n- thermal/drivers/sprd: Fix raw temperature clamping in sprd_thm_rawdata_to_temp (git-fixes).\n- thermal/drivers/sprd: Fix temperature clamping in sprd_thm_temp_to_rawdata (git-fixes).\n- tpm: avoid -Wunused-but-set-variable (git-fixes).\n- tpm: tpm_tis: add error logging for data transfer (git-fixes).\n- tpm: tpm_tis: stop transmit if retries are exhausted (git-fixes).\n- tty: tty_io: update timestamps on all device nodes (bsc#1262020).\n- unshare: fix unshare_fs() handling (git-fixes).\n- USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen (stable-fixes).\n- usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (git-fixes).\n- usb: chipidea: otg: not wait vbus drop if use role_switch (git-fixes).\n- USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam (stable-fixes).\n- usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer (stable-fixes).\n- usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() (git-fixes).\n- usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() (stable-fixes).\n- usb: gadget: f_uac1_legacy: validate control request size (stable-fixes).\n- usb: gadget: renesas_usb3: validate endpoint index in standard request handlers (git-fixes).\n- USB: omap_udc: DMA: Don't enable burst 4 mode (git-fixes).\n- usb: port: add delay after usb_hub_set_port_power() (git-fixes).\n- usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive (stable-fixes).\n- USB: serial: io_edgeport: add support for Blackbox IC135A (stable-fixes).\n- USB: serial: option: add MeiG Smart SRM825WN (stable-fixes).\n- USB: serial: option: add support for Rolling Wireless RW135R-GL (stable-fixes).\n- USB: serial: option: add Telit Cinterion FN990A MBIM composition (stable-fixes).\n- USB: serial: option: add Telit Cinterion LE910Cx compositions (stable-fixes).\n- usb: storage: Expand range of matched versions for VL817 quirks entry (stable-fixes).\n- usb: typec: tcpm: reset internal port states on soft reset AMS (git-fixes).\n- usb: ulpi: fix memory leak on ulpi_register() error paths (git-fixes).\n- usb: usblp: fix heap leak in IEEE 1284 device ID via short response (stable-fixes).\n- usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl (stable-fixes).\n- usb: xhci: Make usb_host_endpoint.hcpriv survive endpoint_disable() (git-fixes).\n- usbip: validate number_of_packets in usbip_pack_ret_submit() (git-fixes).\n- virt: tdx-guest: Fix handling of host controlled 'quote' buffer length (git-fixes).\n- virt: tdx-guest: Return error for GetQuote failures (git-fixes).\n- wifi: ath5k: do not access array OOB (git-fixes).\n- wifi: ath9k: Fix typo (git-fixes).\n- wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session (git-fixes).\n- wifi: ath11k: skip status ring entry processing (stable-fixes).\n- wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation (stable-fixes).\n- wifi: ath12k: fix leak in some ath12k_wmi_xxx() functions (git-fixes).\n- wifi: b43: enforce bounds check on firmware key index in b43_rx() (git-fixes).\n- wifi: b43legacy: enforce bounds check on firmware key index in RX path (git-fixes).\n- wifi: brcmfmac: Fix error pointer dereference (git-fixes).\n- wifi: brcmfmac: validate bsscfg indices in IF events (stable-fixes).\n- wifi: brcmsmac: Fix dma_free_coherent() size (git-fixes).\n- wifi: cw1200: Revert 'Fix locking in error paths' (git-fixes).\n- wifi: libertas: notify firmware load wait on disconnect (git-fixes).\n- wifi: mac80211: check ieee80211_rx_data_set_link return in pubsta MLO path (git-fixes).\n- wifi: mac80211: check tdls flag in ieee80211_tdls_oper (stable-fixes).\n- wifi: mac80211: drop stray 'static' from fast-RX rx_result (git-fixes).\n- wifi: mac80211: handle VHT EXT NSS in ieee80211_determine_our_sta_mode() (git-fixes).\n- wifi: mac80211: remove station if connection prep fails (git-fixes).\n- wifi: mac80211: use safe list iteration in radar detect work (git-fixes).\n- wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor (stable-fixes).\n- wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling (git-fixes).\n- wifi: mt76: mt7615: fix use_cts_prot support (git-fixes).\n- wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() (git-fixes).\n- wifi: mt76: mt7915: fix use_cts_prot support (git-fixes).\n- wifi: mt76: mt7921: fix 6GHz regulatory update on connection (git-fixes).\n- wifi: mt76: mt7921: fix a potential clc buffer length underflow (git-fixes).\n- wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work (git-fixes).\n- wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr() (git-fixes).\n- wifi: mt76: mt7925: fix incorrect length field in txpower command (git-fixes).\n- wifi: mt76: mt7996: fix FCS error flag check in RX descriptor (git-fixes).\n- wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event (git-fixes).\n- wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt() (git-fixes).\n- wifi: nl80211: fix NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST usage (git-fixes).\n- wifi: nl80211: require admin perm on SET_PMK / DEL_PMK (git-fixes).\n- wifi: rsi: fix kthread lifetime race between self-exit and external-stop (git-fixes).\n- wifi: rt2x00usb: fix devres lifetime (git-fixes).\n- wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet (git-fixes).\n- wifi: rtw88: check for PCI upstream bridge existence (git-fixes).\n- wifi: rtw88: fix device leak on probe failure (git-fixes).\n- wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap() (git-fixes).\n- wifi: wl1251: validate packet IDs before indexing tx_frames (stable-fixes).\n- workqueue: Break up enum definitions and give names to the types (bsc#1260522).\n- workqueue: Clean up enum work_bits and related constants (bsc#1260522).\n- workqueue: Factor out work_grab_pending() from __cancel_work_sync() (bsc#1260522).\n- workqueue: Fix UBSAN 'subtraction overflow' error in shift_and_mask() (bsc#1260522).\n- workqueue: Implement disable/enable for (delayed) work items (bsc#1260522).\n- workqueue: Introduce work_cancel_flags (bsc#1260522).\n- workqueue: Make @flags handling consistent across set_work_data() and friends (bsc#1260522).\n- workqueue: Preserve OFFQ bits in cancel[_sync] paths (bsc#1260522).\n- workqueue: Rename __cancel_work_timer() to __cancel_timer_sync() (bsc#1260522).\n- workqueue: Reorganize flush and cancel[_sync] functions (bsc#1260522).\n- x86/boot/64: Clear most of CR4 in startup_64(), except PAE, MCE and LA57 (git-fixes).\n- x86/boot/sev: Avoid shared GHCB page for early memory acceptance (git-fixes).\n- x86/boot: Don't add the EFI stub to targets, again (git-fixes).\n- x86/boot: Fix page table access in 5-level to 4-level paging transition (git-fixes).\n- x86/CPU/AMD: Add models 0x60-0x6f to the Zen5 range (bsc#1263255).\n- x86/CPU/AMD: Add X86_FEATURE_ZEN6 (bsc#1263255).\n- x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (git-fixes).\n- x86/cpufeatures: Free up unused feature bits (bsc#1263255).\n- x86/fred: Remove ENDBR64 from FRED entry points (git-fixes).\n- x86: KVM: Advertise CPUIDs for new instructions in Clearwater Forest (jsc#PED-16245).\n- X.509: Fix out-of-bounds access when parsing extensions (git-fixes).\n- Xarray: do not return sibling entries from xas_find_marked() (bsc#1263815).\n- xfrm: esp: avoid in-place decrypt on shared skb frags (bsc#1264449).\n","status":"published","published":"2026-06-30T10:03:11Z","modified":"2026-07-01T09:59:29.1306508Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"UBUNTU-CVE-2025-68310","description":"In the Linux kernel, the following vulnerability has been resolved: s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump Do not block PCI config accesses through pci_cfg_access_lock() when executing the s390 variant of PCI error recovery: Acquire just device_lock() instead of pci_dev_lock() as powerpc's EEH and generig PCI AER processing do. During error recovery testing a pair of tasks was reported to be hung: mlx5_core 0000:00:00.1: mlx5_health_try_recover:338:(pid 5553): health recovery flow aborted, PCI reads still not working INFO: task kmcheck:72 blocked for more than 122 seconds.       Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1 \"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message. task:kmcheck         state:D stack:0     pid:72    tgid:72    ppid:2 flags:0x00000000 Call Trace:  [\u003c000000065256f030\u003e] __schedule+0x2a0/0x590  [\u003c000000065256f356\u003e] schedule+0x36/0xe0  [\u003c000000065256f572\u003e] schedule_preempt_disabled+0x22/0x30  [\u003c0000000652570a94\u003e] __mutex_lock.constprop.0+0x484/0x8a8  [\u003c000003ff800673a4\u003e] mlx5_unload_one+0x34/0x58 [mlx5_core]  [\u003c000003ff8006745c\u003e] mlx5_pci_err_detected+0x94/0x140 [mlx5_core]  [\u003c0000000652556c5a\u003e] zpci_event_attempt_error_recovery+0xf2/0x398  [\u003c0000000651b9184a\u003e] __zpci_event_error+0x23a/0x2c0 INFO: task kworker/u1664:6:1514 blocked for more than 122 seconds.       Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1 \"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message. task:kworker/u1664:6 state:D stack:0     pid:1514  tgid:1514  ppid:2 flags:0x00000000 Workqueue: mlx5_health0000:00:00.0 mlx5_fw_fatal_reporter_err_work [mlx5_core] Call Trace:  [\u003c000000065256f030\u003e] __schedule+0x2a0/0x590  [\u003c000000065256f356\u003e] schedule+0x36/0xe0  [\u003c0000000652172e28\u003e] pci_wait_cfg+0x80/0xe8  [\u003c0000000652172f94\u003e] pci_cfg_access_lock+0x74/0x88  [\u003c000003ff800916b6\u003e] mlx5_vsc_gw_lock+0x36/0x178 [mlx5_core]  [\u003c000003ff80098824\u003e] mlx5_crdump_collect+0x34/0x1c8 [mlx5_core]  [\u003c000003ff80074b62\u003e] mlx5_fw_fatal_reporter_dump+0x6a/0xe8 [mlx5_core]  [\u003c0000000652512242\u003e] devlink_health_do_dump.part.0+0x82/0x168  [\u003c0000000652513212\u003e] devlink_health_report+0x19a/0x230  [\u003c000003ff80075a12\u003e] mlx5_fw_fatal_reporter_err_work+0xba/0x1b0 [mlx5_core] No kernel log of the exact same error with an upstream kernel is available - but the very same deadlock situation can be constructed there, too: - task: kmcheck   mlx5_unload_one() tries to acquire devlink lock while the PCI error   recovery code has set pdev-\u003eblock_cfg_access by way of   pci_cfg_access_lock() - task: kworker   mlx5_crdump_collect() tries to set block_cfg_access through   pci_cfg_access_lock() while devlink_health_report() had acquired   the devlink lock. A similar deadlock situation can be reproduced by requesting a crdump with   \u003e devlink health dump show pci/\u003cBDF\u003e reporter fw_fatal while PCI error recovery is executed on the same \u003cBDF\u003e physical function by mlx5_core's pci_error_handlers. On s390 this can be injected with   \u003e zpcictl --reset-fw \u003cBDF\u003e Tests with this patch failed to reproduce that second deadlock situation, the devlink command is rejected with \"kernel answers: Permission denied\" - and we get a kernel log message of: mlx5_core 1ed0:00:00.1: mlx5_crdump_collect:50:(pid 254382): crdump: failed to lock vsc gw err -5 because the config read of VSC_SEMAPHORE is rejected by the underlying hardware. Two prior attempts to address this issue have been discussed and ultimately rejected [see link], with the primary argument that s390's implementation of PCI error recovery is imposing restrictions that neither powerpc's EEH nor PCI AER handling need. Tests show that PCI error recovery on s390 is running to completion even without blocking access to PCI config space.","status":"published","published":"2025-12-16T16:16:00Z","modified":"2026-11-11T09:39:18.035667788Z","updated_at":"2026-11-11T10:01:10.45104Z"},{"id":"USN-8029-1","title":"linux, linux-raspi, linux-realtime vulnerabilities","description":"Several security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - MIPS architecture;\n  - Nios II architecture;\n  - PA-RISC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - Sun Sparc architecture;\n  - x86 architecture;\n  - Xtensa architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Drivers core;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Hardware random number generator core;\n  - Character device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - CXL (Compute Express Link) drivers;\n  - Device frequency scaling framework;\n  - ARM SCMI message protocol;\n  - GPIO subsystem;\n  - GPU drivers;\n  - Hardware monitoring drivers;\n  - HW tracing;\n  - InfiniBand drivers;\n  - Input Device (Miscellaneous) drivers;\n  - IOMMU subsystem;\n  - ISDN/mISDN subsystem;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - Fastrpc Driver;\n  - PCI Endpoint Test driver;\n  - VMware Balloon Driver;\n  - MOST (Media Oriented Systems Transport) drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - NVME drivers;\n  - PCI subsystem;\n  - Performance monitor drivers;\n  - Pin controllers subsystem;\n  - Mellanox platform drivers;\n  - x86 platform drivers;\n  - ARM PM domains;\n  - PPS (Pulse Per Second) driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - Remote Processor subsystem;\n  - SCSI subsystem;\n  - SPI subsystem;\n  - Trusted Execution Environment drivers;\n  - Thunderbolt and USB4 drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Userspace I/O drivers;\n  - Cadence USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - vDPA drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Framebuffer layer;\n  - Xen hypervisor drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EROFS file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - GFS2 file system;\n  - JFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - Proc file system;\n  - Diskquota system;\n  - SMB network file system;\n  - BPF subsystem;\n  - Mellanox drivers;\n  - Memory management;\n  - Virtio network driver;\n  - Bluetooth subsystem;\n  - IP tunnels definitions;\n  - io_uring subsystem;\n  - Kernel crash support code;\n  - Perf events;\n  - Kernel futex primitives;\n  - PID allocator;\n  - Scheduler infrastructure;\n  - Syscalls implementation;\n  - Timer subsystem;\n  - Tracing infrastructure;\n  - 9P file system network protocol;\n  - Ethernet bridge;\n  - Networking core;\n  - IPv4 networking;\n  - IPv6 networking;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - Network traffic control;\n  - SCTP protocol;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - VMware vSockets driver;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Integrity Measurement Architecture(IMA) framework;\n  - ALSA framework;\n  - HD-audio driver;\n  - AMD SoC Alsa drivers;\n  - WCD audio codecs;\n  - Intel ASoC drivers;\n  - USB sound devices;\n  - KVM subsystem;\n(CVE-2025-40001, CVE-2025-40002, CVE-2025-40003, CVE-2025-40004,\nCVE-2025-40029, CVE-2025-40030, CVE-2025-40031, CVE-2025-40032,\nCVE-2025-40033, CVE-2025-40034, CVE-2025-40035, CVE-2025-40036,\nCVE-2025-40037, CVE-2025-40038, CVE-2025-40039, CVE-2025-40040,\nCVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40045,\nCVE-2025-40046, CVE-2025-40047, CVE-2025-40048, CVE-2025-40049,\nCVE-2025-40050, CVE-2025-40051, CVE-2025-40052, CVE-2025-40053,\nCVE-2025-40054, CVE-2025-40055, CVE-2025-40056, CVE-2025-40057,\nCVE-2025-40058, CVE-2025-40059, CVE-2025-40060, CVE-2025-40061,\nCVE-2025-40062, CVE-2025-40063, CVE-2025-40064, CVE-2025-40065,\nCVE-2025-40066, CVE-2025-40067, CVE-2025-40068, CVE-2025-40069,\nCVE-2025-40070, CVE-2025-40071, CVE-2025-40072, CVE-2025-40073,\nCVE-2025-40074, CVE-2025-40075, CVE-2025-40076, CVE-2025-40077,\nCVE-2025-40078, CVE-2025-40079, CVE-2025-40080, CVE-2025-40081,\nCVE-2025-40082, CVE-2025-40084, CVE-2025-40085, CVE-2025-40086,\nCVE-2025-40087, CVE-2025-40088, CVE-2025-40089, CVE-2025-40091,\nCVE-2025-40092, CVE-2025-40093, CVE-2025-40094, CVE-2025-40095,\nCVE-2025-40096, CVE-2025-40097, CVE-2025-40098, CVE-2025-40099,\nCVE-2025-40100, CVE-2025-40101, CVE-2025-40102, CVE-2025-40103,\nCVE-2025-40104, CVE-2025-40105, CVE-2025-40106, CVE-2025-40110,\nCVE-2025-40111, CVE-2025-40112, CVE-2025-40113, CVE-2025-40115,\nCVE-2025-40116, CVE-2025-40117, CVE-2025-40118, CVE-2025-40119,\nCVE-2025-40120, CVE-2025-40121, CVE-2025-40122, CVE-2025-40123,\nCVE-2025-40124, CVE-2025-40125, CVE-2025-40126, CVE-2025-40127,\nCVE-2025-40129, CVE-2025-40130, CVE-2025-40131, CVE-2025-40132,\nCVE-2025-40133, CVE-2025-40134, CVE-2025-40135, CVE-2025-40136,\nCVE-2025-40137, CVE-2025-40138, CVE-2025-40139, CVE-2025-40140,\nCVE-2025-40141, CVE-2025-40142, CVE-2025-40143, CVE-2025-40145,\nCVE-2025-40146, CVE-2025-40147, CVE-2025-40148, CVE-2025-40149,\nCVE-2025-40150, CVE-2025-40152, CVE-2025-40153, CVE-2025-40154,\nCVE-2025-40155, CVE-2025-40156, CVE-2025-40158, CVE-2025-40159,\nCVE-2025-40160, CVE-2025-40161, CVE-2025-40162, CVE-2025-40163,\nCVE-2025-40164, CVE-2025-40165, CVE-2025-40166, CVE-2025-40167,\nCVE-2025-40168, CVE-2025-40169, CVE-2025-40170, CVE-2025-40171,\nCVE-2025-40172, CVE-2025-40173, CVE-2025-40174, CVE-2025-40175,\nCVE-2025-40176, CVE-2025-40177, CVE-2025-40178, CVE-2025-40179,\nCVE-2025-40180, CVE-2025-40181, CVE-2025-40182, CVE-2025-40183,\nCVE-2025-40184, CVE-2025-40185, CVE-2025-40186, CVE-2025-40187,\nCVE-2025-40188, CVE-2025-40189, CVE-2025-40191, CVE-2025-40192,\nCVE-2025-40193, CVE-2025-40194, CVE-2025-40195, CVE-2025-40196,\nCVE-2025-40198, CVE-2025-40199, CVE-2025-40200, CVE-2025-40201,\nCVE-2025-40203, CVE-2025-40204, CVE-2025-40205, CVE-2025-40206,\nCVE-2025-40207, CVE-2025-40208, CVE-2025-40209, CVE-2025-40210,\nCVE-2025-40211, CVE-2025-40212, CVE-2025-40213, CVE-2025-40217,\nCVE-2025-40218, CVE-2025-40219, CVE-2025-40220, CVE-2025-40221,\nCVE-2025-40222, CVE-2025-40223, CVE-2025-40224, CVE-2025-40225,\nCVE-2025-40226, CVE-2025-40227, CVE-2025-40228, CVE-2025-40229,\nCVE-2025-40230, CVE-2025-40231, CVE-2025-40233, CVE-2025-40234,\nCVE-2025-40235, CVE-2025-40236, CVE-2025-40237, CVE-2025-40238,\nCVE-2025-40239, CVE-2025-40240, CVE-2025-40241, CVE-2025-40242,\nCVE-2025-40243, CVE-2025-40244, CVE-2025-40245, CVE-2025-40256,\nCVE-2025-40267, CVE-2025-40268, CVE-2025-40269, CVE-2025-40270,\nCVE-2025-40271, CVE-2025-40272, CVE-2025-40273, CVE-2025-40274,\nCVE-2025-40275, CVE-2025-40276, CVE-2025-40277, CVE-2025-40278,\nCVE-2025-40279, CVE-2025-40280, CVE-2025-40281, CVE-2025-40282,\nCVE-2025-40283, CVE-2025-40284, CVE-2025-40285, CVE-2025-40286,\nCVE-2025-40287, CVE-2025-40288, CVE-2025-40289, CVE-2025-40291,\nCVE-2025-40292, CVE-2025-40293, CVE-2025-40294, CVE-2025-40295,\nCVE-2025-40296, CVE-2025-40297, CVE-2025-40298, CVE-2025-40299,\nCVE-2025-40301, CVE-2025-40302, CVE-2025-40303, CVE-2025-40304,\nCVE-2025-40305, CVE-2025-40306, CVE-2025-40307, CVE-2025-40308,\nCVE-2025-40309, CVE-2025-40310, CVE-2025-40311, CVE-2025-40312,\nCVE-2025-40313, CVE-2025-40314, CVE-2025-40315, CVE-2025-40316,\nCVE-2025-40317, CVE-2025-40318, CVE-2025-40319, CVE-2025-40320,\nCVE-2025-40321, CVE-2025-40322, CVE-2025-40323, CVE-2025-40324,\nCVE-2025-40326, CVE-2025-40327, CVE-2025-40328, CVE-2025-40329,\nCVE-2025-40330, CVE-2025-40331, CVE-2025-40332, CVE-2025-40333,\nCVE-2025-40334, CVE-2025-40335, CVE-2025-40336, CVE-2025-40337,\nCVE-2025-40338, CVE-2025-40339, CVE-2025-40340, CVE-2025-40341,\nCVE-2025-40342, CVE-2025-40343, CVE-2025-40344, CVE-2025-40346,\nCVE-2025-40347, CVE-2025-40349, CVE-2025-40350, CVE-2025-40351,\nCVE-2025-40352, CVE-2025-40353, CVE-2025-40354, CVE-2025-40355,\nCVE-2025-40356, CVE-2025-40357, CVE-2025-40358, CVE-2025-40359,\nCVE-2025-40360, CVE-2025-40362, CVE-2025-40363, CVE-2025-68167,\nCVE-2025-68168, CVE-2025-68169, CVE-2025-68170, CVE-2025-68171,\nCVE-2025-68172, CVE-2025-68173, CVE-2025-68174, CVE-2025-68175,\nCVE-2025-68176, CVE-2025-68177, CVE-2025-68178, CVE-2025-68179,\nCVE-2025-68180, CVE-2025-68181, CVE-2025-68182, CVE-2025-68183,\nCVE-2025-68184, CVE-2025-68185, CVE-2025-68186, CVE-2025-68187,\nCVE-2025-68188, CVE-2025-68189, CVE-2025-68190, CVE-2025-68191,\nCVE-2025-68192, CVE-2025-68193, CVE-2025-68194, CVE-2025-68196,\nCVE-2025-68197, CVE-2025-68198, CVE-2025-68199, CVE-2025-68200,\nCVE-2025-68201, CVE-2025-68202, CVE-2025-68204, CVE-2025-68205,\nCVE-2025-68206, CVE-2025-68207, CVE-2025-68208, CVE-2025-68209,\nCVE-2025-68210, CVE-2025-68211, CVE-2025-68239, CVE-2025-68240,\nCVE-2025-68241, CVE-2025-68242, CVE-2025-68243, CVE-2025-68244,\nCVE-2025-68245, CVE-2025-68246, CVE-2025-68247, CVE-2025-68248,\nCVE-2025-68249, CVE-2025-68250, CVE-2025-68251, CVE-2025-68253,\nCVE-2025-68309, CVE-2025-68310, CVE-2025-68311, CVE-2025-68312,\nCVE-2025-68313, CVE-2025-68314, CVE-2025-68315, CVE-2025-68316,\nCVE-2025-68317, CVE-2025-68318, CVE-2025-68319, CVE-2025-68320,\nCVE-2025-68321, CVE-2025-68322, CVE-2025-68734)\n","status":"published","published":"2026-02-12T09:15:01Z","modified":"2026-11-03T14:34:42.37518646Z","updated_at":"2026-11-03T15:16:54.00292Z"},{"id":"USN-8029-2","title":"linux-aws, linux-oracle vulnerabilities","description":"Several security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - MIPS architecture;\n  - Nios II architecture;\n  - PA-RISC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - Sun Sparc architecture;\n  - x86 architecture;\n  - Xtensa architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Drivers core;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Hardware random number generator core;\n  - Character device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - CXL (Compute Express Link) drivers;\n  - Device frequency scaling framework;\n  - ARM SCMI message protocol;\n  - GPIO subsystem;\n  - GPU drivers;\n  - Hardware monitoring drivers;\n  - HW tracing;\n  - InfiniBand drivers;\n  - Input Device (Miscellaneous) drivers;\n  - IOMMU subsystem;\n  - ISDN/mISDN subsystem;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - Fastrpc Driver;\n  - PCI Endpoint Test driver;\n  - VMware Balloon Driver;\n  - MOST (Media Oriented Systems Transport) drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - NVME drivers;\n  - PCI subsystem;\n  - Performance monitor drivers;\n  - Pin controllers subsystem;\n  - Mellanox platform drivers;\n  - x86 platform drivers;\n  - ARM PM domains;\n  - PPS (Pulse Per Second) driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - Remote Processor subsystem;\n  - SCSI subsystem;\n  - SPI subsystem;\n  - Trusted Execution Environment drivers;\n  - Thunderbolt and USB4 drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Userspace I/O drivers;\n  - Cadence USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - vDPA drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Framebuffer layer;\n  - Xen hypervisor drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EROFS file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - GFS2 file system;\n  - JFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - Proc file system;\n  - Diskquota system;\n  - SMB network file system;\n  - BPF subsystem;\n  - Mellanox drivers;\n  - Memory management;\n  - Virtio network driver;\n  - Bluetooth subsystem;\n  - IP tunnels definitions;\n  - io_uring subsystem;\n  - Kernel crash support code;\n  - Perf events;\n  - Kernel futex primitives;\n  - PID allocator;\n  - Scheduler infrastructure;\n  - Syscalls implementation;\n  - Timer subsystem;\n  - Tracing infrastructure;\n  - 9P file system network protocol;\n  - Ethernet bridge;\n  - Networking core;\n  - IPv4 networking;\n  - IPv6 networking;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - Network traffic control;\n  - SCTP protocol;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - VMware vSockets driver;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Integrity Measurement Architecture(IMA) framework;\n  - ALSA framework;\n  - HD-audio driver;\n  - AMD SoC Alsa drivers;\n  - WCD audio codecs;\n  - Intel ASoC drivers;\n  - USB sound devices;\n  - KVM subsystem;\n(CVE-2025-40001, CVE-2025-40002, CVE-2025-40003, CVE-2025-40004,\nCVE-2025-40029, CVE-2025-40030, CVE-2025-40031, CVE-2025-40032,\nCVE-2025-40033, CVE-2025-40034, CVE-2025-40035, CVE-2025-40036,\nCVE-2025-40037, CVE-2025-40038, CVE-2025-40039, CVE-2025-40040,\nCVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40045,\nCVE-2025-40046, CVE-2025-40047, CVE-2025-40048, CVE-2025-40049,\nCVE-2025-40050, CVE-2025-40051, CVE-2025-40052, CVE-2025-40053,\nCVE-2025-40054, CVE-2025-40055, CVE-2025-40056, CVE-2025-40057,\nCVE-2025-40058, CVE-2025-40059, CVE-2025-40060, CVE-2025-40061,\nCVE-2025-40062, CVE-2025-40063, CVE-2025-40064, CVE-2025-40065,\nCVE-2025-40066, CVE-2025-40067, CVE-2025-40068, CVE-2025-40069,\nCVE-2025-40070, CVE-2025-40071, CVE-2025-40072, CVE-2025-40073,\nCVE-2025-40074, CVE-2025-40075, CVE-2025-40076, CVE-2025-40077,\nCVE-2025-40078, CVE-2025-40079, CVE-2025-40080, CVE-2025-40081,\nCVE-2025-40082, CVE-2025-40084, CVE-2025-40085, CVE-2025-40086,\nCVE-2025-40087, CVE-2025-40088, CVE-2025-40089, CVE-2025-40091,\nCVE-2025-40092, CVE-2025-40093, CVE-2025-40094, CVE-2025-40095,\nCVE-2025-40096, CVE-2025-40097, CVE-2025-40098, CVE-2025-40099,\nCVE-2025-40100, CVE-2025-40101, CVE-2025-40102, CVE-2025-40103,\nCVE-2025-40104, CVE-2025-40105, CVE-2025-40106, CVE-2025-40110,\nCVE-2025-40111, CVE-2025-40112, CVE-2025-40113, CVE-2025-40115,\nCVE-2025-40116, CVE-2025-40117, CVE-2025-40118, CVE-2025-40119,\nCVE-2025-40120, CVE-2025-40121, CVE-2025-40122, CVE-2025-40123,\nCVE-2025-40124, CVE-2025-40125, CVE-2025-40126, CVE-2025-40127,\nCVE-2025-40129, CVE-2025-40130, CVE-2025-40131, CVE-2025-40132,\nCVE-2025-40133, CVE-2025-40134, CVE-2025-40135, CVE-2025-40136,\nCVE-2025-40137, CVE-2025-40138, CVE-2025-40139, CVE-2025-40140,\nCVE-2025-40141, CVE-2025-40142, CVE-2025-40143, CVE-2025-40145,\nCVE-2025-40146, CVE-2025-40147, CVE-2025-40148, CVE-2025-40149,\nCVE-2025-40150, CVE-2025-40152, CVE-2025-40153, CVE-2025-40154,\nCVE-2025-40155, CVE-2025-40156, CVE-2025-40158, CVE-2025-40159,\nCVE-2025-40160, CVE-2025-40161, CVE-2025-40162, CVE-2025-40163,\nCVE-2025-40164, CVE-2025-40165, CVE-2025-40166, CVE-2025-40167,\nCVE-2025-40168, CVE-2025-40169, CVE-2025-40170, CVE-2025-40171,\nCVE-2025-40172, CVE-2025-40173, CVE-2025-40174, CVE-2025-40175,\nCVE-2025-40176, CVE-2025-40177, CVE-2025-40178, CVE-2025-40179,\nCVE-2025-40180, CVE-2025-40181, CVE-2025-40182, CVE-2025-40183,\nCVE-2025-40184, CVE-2025-40185, CVE-2025-40186, CVE-2025-40187,\nCVE-2025-40188, CVE-2025-40189, CVE-2025-40191, CVE-2025-40192,\nCVE-2025-40193, CVE-2025-40194, CVE-2025-40195, CVE-2025-40196,\nCVE-2025-40198, CVE-2025-40199, CVE-2025-40200, CVE-2025-40201,\nCVE-2025-40203, CVE-2025-40204, CVE-2025-40205, CVE-2025-40206,\nCVE-2025-40207, CVE-2025-40208, CVE-2025-40209, CVE-2025-40210,\nCVE-2025-40211, CVE-2025-40212, CVE-2025-40213, CVE-2025-40217,\nCVE-2025-40218, CVE-2025-40219, CVE-2025-40220, CVE-2025-40221,\nCVE-2025-40222, CVE-2025-40223, CVE-2025-40224, CVE-2025-40225,\nCVE-2025-40226, CVE-2025-40227, CVE-2025-40228, CVE-2025-40229,\nCVE-2025-40230, CVE-2025-40231, CVE-2025-40233, CVE-2025-40234,\nCVE-2025-40235, CVE-2025-40236, CVE-2025-40237, CVE-2025-40238,\nCVE-2025-40239, CVE-2025-40240, CVE-2025-40241, CVE-2025-40242,\nCVE-2025-40243, CVE-2025-40244, CVE-2025-40245, CVE-2025-40256,\nCVE-2025-40267, CVE-2025-40268, CVE-2025-40269, CVE-2025-40270,\nCVE-2025-40271, CVE-2025-40272, CVE-2025-40273, CVE-2025-40274,\nCVE-2025-40275, CVE-2025-40276, CVE-2025-40277, CVE-2025-40278,\nCVE-2025-40279, CVE-2025-40280, CVE-2025-40281, CVE-2025-40282,\nCVE-2025-40283, CVE-2025-40284, CVE-2025-40285, CVE-2025-40286,\nCVE-2025-40287, CVE-2025-40288, CVE-2025-40289, CVE-2025-40291,\nCVE-2025-40292, CVE-2025-40293, CVE-2025-40294, CVE-2025-40295,\nCVE-2025-40296, CVE-2025-40297, CVE-2025-40298, CVE-2025-40299,\nCVE-2025-40301, CVE-2025-40302, CVE-2025-40303, CVE-2025-40304,\nCVE-2025-40305, CVE-2025-40306, CVE-2025-40307, CVE-2025-40308,\nCVE-2025-40309, CVE-2025-40310, CVE-2025-40311, CVE-2025-40312,\nCVE-2025-40313, CVE-2025-40314, CVE-2025-40315, CVE-2025-40316,\nCVE-2025-40317, CVE-2025-40318, CVE-2025-40319, CVE-2025-40320,\nCVE-2025-40321, CVE-2025-40322, CVE-2025-40323, CVE-2025-40324,\nCVE-2025-40326, CVE-2025-40327, CVE-2025-40328, CVE-2025-40329,\nCVE-2025-40330, CVE-2025-40331, CVE-2025-40332, CVE-2025-40333,\nCVE-2025-40334, CVE-2025-40335, CVE-2025-40336, CVE-2025-40337,\nCVE-2025-40338, CVE-2025-40339, CVE-2025-40340, CVE-2025-40341,\nCVE-2025-40342, CVE-2025-40343, CVE-2025-40344, CVE-2025-40346,\nCVE-2025-40347, CVE-2025-40349, CVE-2025-40350, CVE-2025-40351,\nCVE-2025-40352, CVE-2025-40353, CVE-2025-40354, CVE-2025-40355,\nCVE-2025-40356, CVE-2025-40357, CVE-2025-40358, CVE-2025-40359,\nCVE-2025-40360, CVE-2025-40362, CVE-2025-40363, CVE-2025-68167,\nCVE-2025-68168, CVE-2025-68169, CVE-2025-68170, CVE-2025-68171,\nCVE-2025-68172, CVE-2025-68173, CVE-2025-68174, CVE-2025-68175,\nCVE-2025-68176, CVE-2025-68177, CVE-2025-68178, CVE-2025-68179,\nCVE-2025-68180, CVE-2025-68181, CVE-2025-68182, CVE-2025-68183,\nCVE-2025-68184, CVE-2025-68185, CVE-2025-68186, CVE-2025-68187,\nCVE-2025-68188, CVE-2025-68189, CVE-2025-68190, CVE-2025-68191,\nCVE-2025-68192, CVE-2025-68193, CVE-2025-68194, CVE-2025-68196,\nCVE-2025-68197, CVE-2025-68198, CVE-2025-68199, CVE-2025-68200,\nCVE-2025-68201, CVE-2025-68202, CVE-2025-68204, CVE-2025-68205,\nCVE-2025-68206, CVE-2025-68207, CVE-2025-68208, CVE-2025-68209,\nCVE-2025-68210, CVE-2025-68211, CVE-2025-68239, CVE-2025-68240,\nCVE-2025-68241, CVE-2025-68242, CVE-2025-68243, CVE-2025-68244,\nCVE-2025-68245, CVE-2025-68246, CVE-2025-68247, CVE-2025-68248,\nCVE-2025-68249, CVE-2025-68250, CVE-2025-68251, CVE-2025-68253,\nCVE-2025-68309, CVE-2025-68310, CVE-2025-68311, CVE-2025-68312,\nCVE-2025-68313, CVE-2025-68314, CVE-2025-68315, CVE-2025-68316,\nCVE-2025-68317, CVE-2025-68318, CVE-2025-68319, CVE-2025-68320,\nCVE-2025-68321, CVE-2025-68322, CVE-2025-68734)\n","status":"published","published":"2026-02-17T12:49:18Z","modified":"2026-11-03T14:35:03.428875576Z","updated_at":"2026-11-03T15:16:36.034517Z"},{"id":"USN-8029-3","title":"linux-azure vulnerabilities","description":"Several security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - MIPS architecture;\n  - Nios II architecture;\n  - PA-RISC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - Sun Sparc architecture;\n  - x86 architecture;\n  - Xtensa architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Drivers core;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Hardware random number generator core;\n  - Character device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - CXL (Compute Express Link) drivers;\n  - Device frequency scaling framework;\n  - ARM SCMI message protocol;\n  - GPIO subsystem;\n  - GPU drivers;\n  - Hardware monitoring drivers;\n  - HW tracing;\n  - InfiniBand drivers;\n  - Input Device (Miscellaneous) drivers;\n  - IOMMU subsystem;\n  - ISDN/mISDN subsystem;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - Fastrpc Driver;\n  - PCI Endpoint Test driver;\n  - VMware Balloon Driver;\n  - MOST (Media Oriented Systems Transport) drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - NVME drivers;\n  - PCI subsystem;\n  - Performance monitor drivers;\n  - Pin controllers subsystem;\n  - Mellanox platform drivers;\n  - x86 platform drivers;\n  - ARM PM domains;\n  - PPS (Pulse Per Second) driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - Remote Processor subsystem;\n  - SCSI subsystem;\n  - SPI subsystem;\n  - Trusted Execution Environment drivers;\n  - Thunderbolt and USB4 drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Userspace I/O drivers;\n  - Cadence USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - vDPA drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Framebuffer layer;\n  - Xen hypervisor drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EROFS file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - GFS2 file system;\n  - JFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - Proc file system;\n  - Diskquota system;\n  - SMB network file system;\n  - BPF subsystem;\n  - Mellanox drivers;\n  - Memory management;\n  - Virtio network driver;\n  - Bluetooth subsystem;\n  - IP tunnels definitions;\n  - io_uring subsystem;\n  - Kernel crash support code;\n  - Perf events;\n  - Kernel futex primitives;\n  - PID allocator;\n  - Scheduler infrastructure;\n  - Syscalls implementation;\n  - Timer subsystem;\n  - Tracing infrastructure;\n  - 9P file system network protocol;\n  - Ethernet bridge;\n  - Networking core;\n  - IPv4 networking;\n  - IPv6 networking;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - Network traffic control;\n  - SCTP protocol;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - VMware vSockets driver;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Integrity Measurement Architecture(IMA) framework;\n  - ALSA framework;\n  - HD-audio driver;\n  - AMD SoC Alsa drivers;\n  - WCD audio codecs;\n  - Intel ASoC drivers;\n  - USB sound devices;\n  - KVM subsystem;\n(CVE-2025-40001, CVE-2025-40002, CVE-2025-40003, CVE-2025-40004,\nCVE-2025-40029, CVE-2025-40030, CVE-2025-40031, CVE-2025-40032,\nCVE-2025-40033, CVE-2025-40034, CVE-2025-40035, CVE-2025-40036,\nCVE-2025-40037, CVE-2025-40038, CVE-2025-40039, CVE-2025-40040,\nCVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40045,\nCVE-2025-40046, CVE-2025-40047, CVE-2025-40048, CVE-2025-40049,\nCVE-2025-40050, CVE-2025-40051, CVE-2025-40052, CVE-2025-40053,\nCVE-2025-40054, CVE-2025-40055, CVE-2025-40056, CVE-2025-40057,\nCVE-2025-40058, CVE-2025-40059, CVE-2025-40060, CVE-2025-40061,\nCVE-2025-40062, CVE-2025-40063, CVE-2025-40064, CVE-2025-40065,\nCVE-2025-40066, CVE-2025-40067, CVE-2025-40068, CVE-2025-40069,\nCVE-2025-40070, CVE-2025-40071, CVE-2025-40072, CVE-2025-40073,\nCVE-2025-40074, CVE-2025-40075, CVE-2025-40076, CVE-2025-40077,\nCVE-2025-40078, CVE-2025-40079, CVE-2025-40080, CVE-2025-40081,\nCVE-2025-40082, CVE-2025-40084, CVE-2025-40085, CVE-2025-40086,\nCVE-2025-40087, CVE-2025-40088, CVE-2025-40089, CVE-2025-40091,\nCVE-2025-40092, CVE-2025-40093, CVE-2025-40094, CVE-2025-40095,\nCVE-2025-40096, CVE-2025-40097, CVE-2025-40098, CVE-2025-40099,\nCVE-2025-40100, CVE-2025-40101, CVE-2025-40102, CVE-2025-40103,\nCVE-2025-40104, CVE-2025-40105, CVE-2025-40106, CVE-2025-40110,\nCVE-2025-40111, CVE-2025-40112, CVE-2025-40113, CVE-2025-40115,\nCVE-2025-40116, CVE-2025-40117, CVE-2025-40118, CVE-2025-40119,\nCVE-2025-40120, CVE-2025-40121, CVE-2025-40122, CVE-2025-40123,\nCVE-2025-40124, CVE-2025-40125, CVE-2025-40126, CVE-2025-40127,\nCVE-2025-40129, CVE-2025-40130, CVE-2025-40131, CVE-2025-40132,\nCVE-2025-40133, CVE-2025-40134, CVE-2025-40135, CVE-2025-40136,\nCVE-2025-40137, CVE-2025-40138, CVE-2025-40139, CVE-2025-40140,\nCVE-2025-40141, CVE-2025-40142, CVE-2025-40143, CVE-2025-40145,\nCVE-2025-40146, CVE-2025-40147, CVE-2025-40148, CVE-2025-40149,\nCVE-2025-40150, CVE-2025-40152, CVE-2025-40153, CVE-2025-40154,\nCVE-2025-40155, CVE-2025-40156, CVE-2025-40158, CVE-2025-40159,\nCVE-2025-40160, CVE-2025-40161, CVE-2025-40162, CVE-2025-40163,\nCVE-2025-40164, CVE-2025-40165, CVE-2025-40166, CVE-2025-40167,\nCVE-2025-40168, CVE-2025-40169, CVE-2025-40170, CVE-2025-40171,\nCVE-2025-40172, CVE-2025-40173, CVE-2025-40174, CVE-2025-40175,\nCVE-2025-40176, CVE-2025-40177, CVE-2025-40178, CVE-2025-40179,\nCVE-2025-40180, CVE-2025-40181, CVE-2025-40182, CVE-2025-40183,\nCVE-2025-40184, CVE-2025-40185, CVE-2025-40186, CVE-2025-40187,\nCVE-2025-40188, CVE-2025-40189, CVE-2025-40191, CVE-2025-40192,\nCVE-2025-40193, CVE-2025-40194, CVE-2025-40195, CVE-2025-40196,\nCVE-2025-40198, CVE-2025-40199, CVE-2025-40200, CVE-2025-40201,\nCVE-2025-40203, CVE-2025-40204, CVE-2025-40205, CVE-2025-40206,\nCVE-2025-40207, CVE-2025-40208, CVE-2025-40209, CVE-2025-40210,\nCVE-2025-40211, CVE-2025-40212, CVE-2025-40213, CVE-2025-40217,\nCVE-2025-40218, CVE-2025-40219, CVE-2025-40220, CVE-2025-40221,\nCVE-2025-40222, CVE-2025-40223, CVE-2025-40224, CVE-2025-40225,\nCVE-2025-40226, CVE-2025-40227, CVE-2025-40228, CVE-2025-40229,\nCVE-2025-40230, CVE-2025-40231, CVE-2025-40233, CVE-2025-40234,\nCVE-2025-40235, CVE-2025-40236, CVE-2025-40237, CVE-2025-40238,\nCVE-2025-40239, CVE-2025-40240, CVE-2025-40241, CVE-2025-40242,\nCVE-2025-40243, CVE-2025-40244, CVE-2025-40245, CVE-2025-40256,\nCVE-2025-40267, CVE-2025-40268, CVE-2025-40269, CVE-2025-40270,\nCVE-2025-40271, CVE-2025-40272, CVE-2025-40273, CVE-2025-40274,\nCVE-2025-40275, CVE-2025-40276, CVE-2025-40277, CVE-2025-40278,\nCVE-2025-40279, CVE-2025-40280, CVE-2025-40281, CVE-2025-40282,\nCVE-2025-40283, CVE-2025-40284, CVE-2025-40285, CVE-2025-40286,\nCVE-2025-40287, CVE-2025-40288, CVE-2025-40289, CVE-2025-40291,\nCVE-2025-40292, CVE-2025-40293, CVE-2025-40294, CVE-2025-40295,\nCVE-2025-40296, CVE-2025-40297, CVE-2025-40298, CVE-2025-40299,\nCVE-2025-40301, CVE-2025-40302, CVE-2025-40303, CVE-2025-40304,\nCVE-2025-40305, CVE-2025-40306, CVE-2025-40307, CVE-2025-40308,\nCVE-2025-40309, CVE-2025-40310, CVE-2025-40311, CVE-2025-40312,\nCVE-2025-40313, CVE-2025-40314, CVE-2025-40315, CVE-2025-40316,\nCVE-2025-40317, CVE-2025-40318, CVE-2025-40319, CVE-2025-40320,\nCVE-2025-40321, CVE-2025-40322, CVE-2025-40323, CVE-2025-40324,\nCVE-2025-40326, CVE-2025-40327, CVE-2025-40328, CVE-2025-40329,\nCVE-2025-40330, CVE-2025-40331, CVE-2025-40332, CVE-2025-40333,\nCVE-2025-40334, CVE-2025-40335, CVE-2025-40336, CVE-2025-40337,\nCVE-2025-40338, CVE-2025-40339, CVE-2025-40340, CVE-2025-40341,\nCVE-2025-40342, CVE-2025-40343, CVE-2025-40344, CVE-2025-40346,\nCVE-2025-40347, CVE-2025-40349, CVE-2025-40350, CVE-2025-40351,\nCVE-2025-40352, CVE-2025-40353, CVE-2025-40354, CVE-2025-40355,\nCVE-2025-40356, CVE-2025-40357, CVE-2025-40358, CVE-2025-40359,\nCVE-2025-40360, CVE-2025-40362, CVE-2025-40363, CVE-2025-68167,\nCVE-2025-68168, CVE-2025-68169, CVE-2025-68170, CVE-2025-68171,\nCVE-2025-68172, CVE-2025-68173, CVE-2025-68174, CVE-2025-68175,\nCVE-2025-68176, CVE-2025-68177, CVE-2025-68178, CVE-2025-68179,\nCVE-2025-68180, CVE-2025-68181, CVE-2025-68182, CVE-2025-68183,\nCVE-2025-68184, CVE-2025-68185, CVE-2025-68186, CVE-2025-68187,\nCVE-2025-68188, CVE-2025-68189, CVE-2025-68190, CVE-2025-68191,\nCVE-2025-68192, CVE-2025-68193, CVE-2025-68194, CVE-2025-68196,\nCVE-2025-68197, CVE-2025-68198, CVE-2025-68199, CVE-2025-68200,\nCVE-2025-68201, CVE-2025-68202, CVE-2025-68204, CVE-2025-68205,\nCVE-2025-68206, CVE-2025-68207, CVE-2025-68208, CVE-2025-68209,\nCVE-2025-68210, CVE-2025-68211, CVE-2025-68239, CVE-2025-68240,\nCVE-2025-68241, CVE-2025-68242, CVE-2025-68243, CVE-2025-68244,\nCVE-2025-68245, CVE-2025-68246, CVE-2025-68247, CVE-2025-68248,\nCVE-2025-68249, CVE-2025-68250, CVE-2025-68251, CVE-2025-68253,\nCVE-2025-68309, CVE-2025-68310, CVE-2025-68311, CVE-2025-68312,\nCVE-2025-68313, CVE-2025-68314, CVE-2025-68315, CVE-2025-68316,\nCVE-2025-68317, CVE-2025-68318, CVE-2025-68319, CVE-2025-68320,\nCVE-2025-68321, CVE-2025-68322, CVE-2025-68734)\n","status":"published","published":"2026-02-24T11:20:31Z","modified":"2026-11-03T14:35:00.15213949Z","updated_at":"2026-11-03T15:16:40.267874Z"},{"id":"USN-8030-1","title":"linux-gcp vulnerabilities","description":"Several security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - MIPS architecture;\n  - Nios II architecture;\n  - PA-RISC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - Sun Sparc architecture;\n  - x86 architecture;\n  - Xtensa architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Drivers core;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Hardware random number generator core;\n  - Character device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - CXL (Compute Express Link) drivers;\n  - Device frequency scaling framework;\n  - ARM SCMI message protocol;\n  - GPIO subsystem;\n  - GPU drivers;\n  - Hardware monitoring drivers;\n  - HW tracing;\n  - InfiniBand drivers;\n  - Input Device (Miscellaneous) drivers;\n  - IOMMU subsystem;\n  - ISDN/mISDN subsystem;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - Fastrpc Driver;\n  - PCI Endpoint Test driver;\n  - VMware Balloon Driver;\n  - MOST (Media Oriented Systems Transport) drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - NVME drivers;\n  - PCI subsystem;\n  - Performance monitor drivers;\n  - Pin controllers subsystem;\n  - Mellanox platform drivers;\n  - x86 platform drivers;\n  - ARM PM domains;\n  - PPS (Pulse Per Second) driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - Remote Processor subsystem;\n  - SCSI subsystem;\n  - SPI subsystem;\n  - Trusted Execution Environment drivers;\n  - Thunderbolt and USB4 drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Userspace I/O drivers;\n  - Cadence USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - vDPA drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Framebuffer layer;\n  - Xen hypervisor drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EROFS file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - GFS2 file system;\n  - JFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - Proc file system;\n  - Diskquota system;\n  - SMB network file system;\n  - BPF subsystem;\n  - Mellanox drivers;\n  - Memory management;\n  - Virtio network driver;\n  - Bluetooth subsystem;\n  - IP tunnels definitions;\n  - io_uring subsystem;\n  - Kernel crash support code;\n  - Perf events;\n  - Kernel futex primitives;\n  - PID allocator;\n  - Scheduler infrastructure;\n  - Syscalls implementation;\n  - Timer subsystem;\n  - Tracing infrastructure;\n  - 9P file system network protocol;\n  - Ethernet bridge;\n  - Networking core;\n  - IPv4 networking;\n  - IPv6 networking;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - Network traffic control;\n  - SCTP protocol;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - VMware vSockets driver;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Integrity Measurement Architecture(IMA) framework;\n  - ALSA framework;\n  - HD-audio driver;\n  - AMD SoC Alsa drivers;\n  - WCD audio codecs;\n  - Intel ASoC drivers;\n  - USB sound devices;\n  - KVM subsystem;\n(CVE-2025-40001, CVE-2025-40002, CVE-2025-40003, CVE-2025-40004,\nCVE-2025-40029, CVE-2025-40030, CVE-2025-40031, CVE-2025-40032,\nCVE-2025-40033, CVE-2025-40034, CVE-2025-40035, CVE-2025-40036,\nCVE-2025-40037, CVE-2025-40038, CVE-2025-40039, CVE-2025-40040,\nCVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40045,\nCVE-2025-40046, CVE-2025-40047, CVE-2025-40048, CVE-2025-40049,\nCVE-2025-40050, CVE-2025-40051, CVE-2025-40052, CVE-2025-40053,\nCVE-2025-40054, CVE-2025-40055, CVE-2025-40056, CVE-2025-40057,\nCVE-2025-40058, CVE-2025-40059, CVE-2025-40060, CVE-2025-40061,\nCVE-2025-40062, CVE-2025-40063, CVE-2025-40064, CVE-2025-40065,\nCVE-2025-40066, CVE-2025-40067, CVE-2025-40068, CVE-2025-40069,\nCVE-2025-40070, CVE-2025-40071, CVE-2025-40072, CVE-2025-40073,\nCVE-2025-40074, CVE-2025-40075, CVE-2025-40076, CVE-2025-40077,\nCVE-2025-40078, CVE-2025-40079, CVE-2025-40080, CVE-2025-40081,\nCVE-2025-40082, CVE-2025-40084, CVE-2025-40085, CVE-2025-40086,\nCVE-2025-40087, CVE-2025-40088, CVE-2025-40089, CVE-2025-40091,\nCVE-2025-40092, CVE-2025-40093, CVE-2025-40094, CVE-2025-40095,\nCVE-2025-40096, CVE-2025-40097, CVE-2025-40098, CVE-2025-40099,\nCVE-2025-40100, CVE-2025-40101, CVE-2025-40102, CVE-2025-40103,\nCVE-2025-40104, CVE-2025-40105, CVE-2025-40106, CVE-2025-40110,\nCVE-2025-40111, CVE-2025-40112, CVE-2025-40113, CVE-2025-40115,\nCVE-2025-40116, CVE-2025-40117, CVE-2025-40118, CVE-2025-40119,\nCVE-2025-40120, CVE-2025-40121, CVE-2025-40122, CVE-2025-40123,\nCVE-2025-40124, CVE-2025-40125, CVE-2025-40126, CVE-2025-40127,\nCVE-2025-40129, CVE-2025-40130, CVE-2025-40131, CVE-2025-40132,\nCVE-2025-40133, CVE-2025-40134, CVE-2025-40135, CVE-2025-40136,\nCVE-2025-40137, CVE-2025-40138, CVE-2025-40139, CVE-2025-40140,\nCVE-2025-40141, CVE-2025-40142, CVE-2025-40143, CVE-2025-40145,\nCVE-2025-40146, CVE-2025-40147, CVE-2025-40148, CVE-2025-40149,\nCVE-2025-40150, CVE-2025-40152, CVE-2025-40153, CVE-2025-40154,\nCVE-2025-40155, CVE-2025-40156, CVE-2025-40158, CVE-2025-40159,\nCVE-2025-40160, CVE-2025-40161, CVE-2025-40162, CVE-2025-40163,\nCVE-2025-40164, CVE-2025-40165, CVE-2025-40166, CVE-2025-40167,\nCVE-2025-40168, CVE-2025-40169, CVE-2025-40170, CVE-2025-40171,\nCVE-2025-40172, CVE-2025-40173, CVE-2025-40174, CVE-2025-40175,\nCVE-2025-40176, CVE-2025-40177, CVE-2025-40178, CVE-2025-40179,\nCVE-2025-40180, CVE-2025-40182, CVE-2025-40183, CVE-2025-40184,\nCVE-2025-40185, CVE-2025-40186, CVE-2025-40187, CVE-2025-40188,\nCVE-2025-40189, CVE-2025-40191, CVE-2025-40192, CVE-2025-40193,\nCVE-2025-40194, CVE-2025-40195, CVE-2025-40196, CVE-2025-40198,\nCVE-2025-40199, CVE-2025-40200, CVE-2025-40201, CVE-2025-40203,\nCVE-2025-40204, CVE-2025-40205, CVE-2025-40206, CVE-2025-40207,\nCVE-2025-40208, CVE-2025-40209, CVE-2025-40210, CVE-2025-40211,\nCVE-2025-40212, CVE-2025-40213, CVE-2025-40217, CVE-2025-40218,\nCVE-2025-40219, CVE-2025-40220, CVE-2025-40221, CVE-2025-40222,\nCVE-2025-40223, CVE-2025-40224, CVE-2025-40225, CVE-2025-40226,\nCVE-2025-40227, CVE-2025-40228, CVE-2025-40229, CVE-2025-40230,\nCVE-2025-40231, CVE-2025-40233, CVE-2025-40234, CVE-2025-40235,\nCVE-2025-40236, CVE-2025-40237, CVE-2025-40238, CVE-2025-40239,\nCVE-2025-40240, CVE-2025-40241, CVE-2025-40242, CVE-2025-40243,\nCVE-2025-40244, CVE-2025-40245, CVE-2025-40256, CVE-2025-40267,\nCVE-2025-40268, CVE-2025-40269, CVE-2025-40270, CVE-2025-40271,\nCVE-2025-40272, CVE-2025-40273, CVE-2025-40274, CVE-2025-40275,\nCVE-2025-40276, CVE-2025-40277, CVE-2025-40278, CVE-2025-40279,\nCVE-2025-40280, CVE-2025-40281, CVE-2025-40282, CVE-2025-40283,\nCVE-2025-40284, CVE-2025-40285, CVE-2025-40286, CVE-2025-40287,\nCVE-2025-40288, CVE-2025-40289, CVE-2025-40291, CVE-2025-40292,\nCVE-2025-40293, CVE-2025-40294, CVE-2025-40295, CVE-2025-40296,\nCVE-2025-40297, CVE-2025-40298, CVE-2025-40299, CVE-2025-40301,\nCVE-2025-40302, CVE-2025-40303, CVE-2025-40304, CVE-2025-40305,\nCVE-2025-40306, CVE-2025-40307, CVE-2025-40308, CVE-2025-40309,\nCVE-2025-40310, CVE-2025-40311, CVE-2025-40312, CVE-2025-40313,\nCVE-2025-40314, CVE-2025-40315, CVE-2025-40316, CVE-2025-40317,\nCVE-2025-40318, CVE-2025-40319, CVE-2025-40320, CVE-2025-40321,\nCVE-2025-40322, CVE-2025-40323, CVE-2025-40324, CVE-2025-40326,\nCVE-2025-40327, CVE-2025-40328, CVE-2025-40329, CVE-2025-40330,\nCVE-2025-40331, CVE-2025-40332, CVE-2025-40333, CVE-2025-40334,\nCVE-2025-40335, CVE-2025-40336, CVE-2025-40337, CVE-2025-40338,\nCVE-2025-40339, CVE-2025-40340, CVE-2025-40341, CVE-2025-40342,\nCVE-2025-40343, CVE-2025-40344, CVE-2025-40346, CVE-2025-40347,\nCVE-2025-40349, CVE-2025-40350, CVE-2025-40351, CVE-2025-40352,\nCVE-2025-40353, CVE-2025-40354, CVE-2025-40355, CVE-2025-40356,\nCVE-2025-40357, CVE-2025-40358, CVE-2025-40359, CVE-2025-40360,\nCVE-2025-40362, CVE-2025-40363, CVE-2025-68167, CVE-2025-68168,\nCVE-2025-68169, CVE-2025-68170, CVE-2025-68171, CVE-2025-68172,\nCVE-2025-68173, CVE-2025-68174, CVE-2025-68175, CVE-2025-68176,\nCVE-2025-68177, CVE-2025-68178, CVE-2025-68179, CVE-2025-68180,\nCVE-2025-68181, CVE-2025-68182, CVE-2025-68183, CVE-2025-68184,\nCVE-2025-68185, CVE-2025-68186, CVE-2025-68187, CVE-2025-68188,\nCVE-2025-68189, CVE-2025-68190, CVE-2025-68191, CVE-2025-68192,\nCVE-2025-68193, CVE-2025-68194, CVE-2025-68196, CVE-2025-68197,\nCVE-2025-68198, CVE-2025-68199, CVE-2025-68200, CVE-2025-68201,\nCVE-2025-68202, CVE-2025-68204, CVE-2025-68205, CVE-2025-68206,\nCVE-2025-68207, CVE-2025-68208, CVE-2025-68209, CVE-2025-68210,\nCVE-2025-68211, CVE-2025-68239, CVE-2025-68240, CVE-2025-68241,\nCVE-2025-68242, CVE-2025-68243, CVE-2025-68244, CVE-2025-68245,\nCVE-2025-68246, CVE-2025-68247, CVE-2025-68248, CVE-2025-68249,\nCVE-2025-68250, CVE-2025-68251, CVE-2025-68253, CVE-2025-68309,\nCVE-2025-68310, CVE-2025-68311, CVE-2025-68312, CVE-2025-68313,\nCVE-2025-68314, CVE-2025-68315, CVE-2025-68316, CVE-2025-68317,\nCVE-2025-68318, CVE-2025-68319, CVE-2025-68320, CVE-2025-68321,\nCVE-2025-68322, CVE-2025-68734)\n","status":"published","published":"2026-02-12T09:39:54Z","modified":"2026-11-03T14:34:59.664448895Z","updated_at":"2026-11-03T15:16:40.267874Z"},{"id":"USN-8048-1","title":"linux-oem-6.17 vulnerabilities","description":"Several security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - MIPS architecture;\n  - Nios II architecture;\n  - PA-RISC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - Sun Sparc architecture;\n  - x86 architecture;\n  - Xtensa architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Drivers core;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Hardware random number generator core;\n  - Character device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - CXL (Compute Express Link) drivers;\n  - Device frequency scaling framework;\n  - ARM SCMI message protocol;\n  - GPIO subsystem;\n  - GPU drivers;\n  - Hardware monitoring drivers;\n  - HW tracing;\n  - InfiniBand drivers;\n  - Input Device (Miscellaneous) drivers;\n  - IOMMU subsystem;\n  - ISDN/mISDN subsystem;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - Fastrpc Driver;\n  - PCI Endpoint Test driver;\n  - VMware Balloon Driver;\n  - MOST (Media Oriented Systems Transport) drivers;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - NVME drivers;\n  - PCI subsystem;\n  - Performance monitor drivers;\n  - Pin controllers subsystem;\n  - Mellanox platform drivers;\n  - x86 platform drivers;\n  - ARM PM domains;\n  - PPS (Pulse Per Second) driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - Remote Processor subsystem;\n  - SCSI subsystem;\n  - SPI subsystem;\n  - Trusted Execution Environment drivers;\n  - Thunderbolt and USB4 drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Userspace I/O drivers;\n  - Cadence USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - vDPA drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Framebuffer layer;\n  - Xen hypervisor drivers;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EROFS file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - GFS2 file system;\n  - JFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - Proc file system;\n  - Diskquota system;\n  - SMB network file system;\n  - BPF subsystem;\n  - Mellanox drivers;\n  - Memory management;\n  - Virtio network driver;\n  - Bluetooth subsystem;\n  - IP tunnels definitions;\n  - io_uring subsystem;\n  - Kernel crash support code;\n  - Perf events;\n  - Kernel futex primitives;\n  - PID allocator;\n  - Scheduler infrastructure;\n  - Syscalls implementation;\n  - Timer subsystem;\n  - Tracing infrastructure;\n  - 9P file system network protocol;\n  - Ethernet bridge;\n  - Networking core;\n  - IPv4 networking;\n  - IPv6 networking;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - Network traffic control;\n  - SCTP protocol;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - VMware vSockets driver;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Integrity Measurement Architecture(IMA) framework;\n  - ALSA framework;\n  - HD-audio driver;\n  - AMD SoC Alsa drivers;\n  - WCD audio codecs;\n  - Intel ASoC drivers;\n  - USB sound devices;\n  - KVM subsystem;\n(CVE-2025-40001, CVE-2025-40002, CVE-2025-40003, CVE-2025-40004,\nCVE-2025-40029, CVE-2025-40030, CVE-2025-40031, CVE-2025-40032,\nCVE-2025-40033, CVE-2025-40034, CVE-2025-40035, CVE-2025-40036,\nCVE-2025-40037, CVE-2025-40038, CVE-2025-40039, CVE-2025-40040,\nCVE-2025-40041, CVE-2025-40042, CVE-2025-40043, CVE-2025-40044,\nCVE-2025-40045, CVE-2025-40046, CVE-2025-40047, CVE-2025-40048,\nCVE-2025-40049, CVE-2025-40050, CVE-2025-40051, CVE-2025-40052,\nCVE-2025-40053, CVE-2025-40054, CVE-2025-40055, CVE-2025-40056,\nCVE-2025-40057, CVE-2025-40058, CVE-2025-40059, CVE-2025-40060,\nCVE-2025-40061, CVE-2025-40062, CVE-2025-40063, CVE-2025-40064,\nCVE-2025-40065, CVE-2025-40066, CVE-2025-40067, CVE-2025-40068,\nCVE-2025-40069, CVE-2025-40070, CVE-2025-40071, CVE-2025-40072,\nCVE-2025-40073, CVE-2025-40074, CVE-2025-40075, CVE-2025-40076,\nCVE-2025-40077, CVE-2025-40078, CVE-2025-40079, CVE-2025-40080,\nCVE-2025-40081, CVE-2025-40082, CVE-2025-40084, CVE-2025-40085,\nCVE-2025-40086, CVE-2025-40087, CVE-2025-40088, CVE-2025-40089,\nCVE-2025-40091, CVE-2025-40092, CVE-2025-40093, CVE-2025-40094,\nCVE-2025-40095, CVE-2025-40096, CVE-2025-40097, CVE-2025-40098,\nCVE-2025-40099, CVE-2025-40100, CVE-2025-40101, CVE-2025-40102,\nCVE-2025-40103, CVE-2025-40104, CVE-2025-40105, CVE-2025-40106,\nCVE-2025-40110, CVE-2025-40111, CVE-2025-40112, CVE-2025-40113,\nCVE-2025-40115, CVE-2025-40116, CVE-2025-40117, CVE-2025-40118,\nCVE-2025-40119, CVE-2025-40120, CVE-2025-40121, CVE-2025-40122,\nCVE-2025-40123, CVE-2025-40124, CVE-2025-40125, CVE-2025-40126,\nCVE-2025-40127, CVE-2025-40129, CVE-2025-40130, CVE-2025-40131,\nCVE-2025-40132, CVE-2025-40133, CVE-2025-40134, CVE-2025-40135,\nCVE-2025-40136, CVE-2025-40137, CVE-2025-40138, CVE-2025-40139,\nCVE-2025-40140, CVE-2025-40141, CVE-2025-40142, CVE-2025-40143,\nCVE-2025-40145, CVE-2025-40146, CVE-2025-40147, CVE-2025-40148,\nCVE-2025-40149, CVE-2025-40150, CVE-2025-40151, CVE-2025-40152,\nCVE-2025-40153, CVE-2025-40154, CVE-2025-40155, CVE-2025-40156,\nCVE-2025-40158, CVE-2025-40159, CVE-2025-40160, CVE-2025-40161,\nCVE-2025-40162, CVE-2025-40163, CVE-2025-40164, CVE-2025-40165,\nCVE-2025-40166, CVE-2025-40167, CVE-2025-40168, CVE-2025-40169,\nCVE-2025-40170, CVE-2025-40171, CVE-2025-40173, CVE-2025-40174,\nCVE-2025-40175, CVE-2025-40176, CVE-2025-40178, CVE-2025-40179,\nCVE-2025-40180, CVE-2025-40181, CVE-2025-40182, CVE-2025-40183,\nCVE-2025-40184, CVE-2025-40185, CVE-2025-40186, CVE-2025-40187,\nCVE-2025-40188, CVE-2025-40189, CVE-2025-40191, CVE-2025-40192,\nCVE-2025-40193, CVE-2025-40194, CVE-2025-40195, CVE-2025-40196,\nCVE-2025-40198, CVE-2025-40199, CVE-2025-40200, CVE-2025-40201,\nCVE-2025-40203, CVE-2025-40204, CVE-2025-40205, CVE-2025-40206,\nCVE-2025-40207, CVE-2025-40208, CVE-2025-40209, CVE-2025-40210,\nCVE-2025-40211, CVE-2025-40212, CVE-2025-40213, CVE-2025-40217,\nCVE-2025-40218, CVE-2025-40219, CVE-2025-40220, CVE-2025-40221,\nCVE-2025-40222, CVE-2025-40223, CVE-2025-40224, CVE-2025-40225,\nCVE-2025-40226, CVE-2025-40227, CVE-2025-40228, CVE-2025-40229,\nCVE-2025-40230, CVE-2025-40231, CVE-2025-40233, CVE-2025-40234,\nCVE-2025-40235, CVE-2025-40236, CVE-2025-40237, CVE-2025-40238,\nCVE-2025-40239, CVE-2025-40240, CVE-2025-40241, CVE-2025-40242,\nCVE-2025-40243, CVE-2025-40244, CVE-2025-40245, CVE-2025-40256,\nCVE-2025-40267, CVE-2025-40268, CVE-2025-40269, CVE-2025-40270,\nCVE-2025-40271, CVE-2025-40272, CVE-2025-40273, CVE-2025-40274,\nCVE-2025-40275, CVE-2025-40276, CVE-2025-40277, CVE-2025-40278,\nCVE-2025-40279, CVE-2025-40280, CVE-2025-40281, CVE-2025-40282,\nCVE-2025-40283, CVE-2025-40284, CVE-2025-40285, CVE-2025-40286,\nCVE-2025-40287, CVE-2025-40288, CVE-2025-40289, CVE-2025-40291,\nCVE-2025-40292, CVE-2025-40293, CVE-2025-40294, CVE-2025-40295,\nCVE-2025-40296, CVE-2025-40297, CVE-2025-40298, CVE-2025-40299,\nCVE-2025-40301, CVE-2025-40302, CVE-2025-40303, CVE-2025-40304,\nCVE-2025-40305, CVE-2025-40306, CVE-2025-40307, CVE-2025-40308,\nCVE-2025-40309, CVE-2025-40310, CVE-2025-40311, CVE-2025-40312,\nCVE-2025-40313, CVE-2025-40314, CVE-2025-40315, CVE-2025-40316,\nCVE-2025-40317, CVE-2025-40318, CVE-2025-40319, CVE-2025-40320,\nCVE-2025-40321, CVE-2025-40322, CVE-2025-40323, CVE-2025-40324,\nCVE-2025-40326, CVE-2025-40327, CVE-2025-40328, CVE-2025-40329,\nCVE-2025-40330, CVE-2025-40331, CVE-2025-40332, CVE-2025-40333,\nCVE-2025-40334, CVE-2025-40335, CVE-2025-40336, CVE-2025-40337,\nCVE-2025-40338, CVE-2025-40339, CVE-2025-40340, CVE-2025-40341,\nCVE-2025-40342, CVE-2025-40343, CVE-2025-40344, CVE-2025-40346,\nCVE-2025-40347, CVE-2025-40349, CVE-2025-40350, CVE-2025-40351,\nCVE-2025-40352, CVE-2025-40353, CVE-2025-40354, CVE-2025-40355,\nCVE-2025-40356, CVE-2025-40357, CVE-2025-40358, CVE-2025-40359,\nCVE-2025-40360, CVE-2025-40362, CVE-2025-40363, CVE-2025-68167,\nCVE-2025-68168, CVE-2025-68169, CVE-2025-68170, CVE-2025-68171,\nCVE-2025-68172, CVE-2025-68173, CVE-2025-68174, CVE-2025-68175,\nCVE-2025-68176, CVE-2025-68177, CVE-2025-68178, CVE-2025-68179,\nCVE-2025-68180, CVE-2025-68181, CVE-2025-68182, CVE-2025-68183,\nCVE-2025-68184, CVE-2025-68185, CVE-2025-68186, CVE-2025-68187,\nCVE-2025-68188, CVE-2025-68189, CVE-2025-68190, CVE-2025-68191,\nCVE-2025-68192, CVE-2025-68193, CVE-2025-68194, CVE-2025-68196,\nCVE-2025-68197, CVE-2025-68198, CVE-2025-68199, CVE-2025-68200,\nCVE-2025-68201, CVE-2025-68202, CVE-2025-68204, CVE-2025-68205,\nCVE-2025-68206, CVE-2025-68207, CVE-2025-68208, CVE-2025-68209,\nCVE-2025-68210, CVE-2025-68211, CVE-2025-68239, CVE-2025-68240,\nCVE-2025-68241, CVE-2025-68242, CVE-2025-68243, CVE-2025-68244,\nCVE-2025-68245, CVE-2025-68246, CVE-2025-68247, CVE-2025-68248,\nCVE-2025-68249, CVE-2025-68250, CVE-2025-68251, CVE-2025-68253,\nCVE-2025-68309, CVE-2025-68310, CVE-2025-68311, CVE-2025-68312,\nCVE-2025-68313, CVE-2025-68314, CVE-2025-68315, CVE-2025-68317,\nCVE-2025-68318, CVE-2025-68319, CVE-2025-68320, CVE-2025-68321,\nCVE-2025-68322, CVE-2025-68734)\n","status":"published","published":"2026-02-17T15:24:04Z","modified":"2026-11-03T14:35:01.29943175Z","updated_at":"2026-11-03T15:16:36.034517Z"},{"id":"USN-8095-1","title":"linux, linux-aws, linux-gcp, linux-gcp-6.8, linux-gke, linux-gkeop, linux-hwe-6.8, linux-ibm, linux-ibm-6.8, linux-lowlatency, linux-lowlatency-hwe-6.8, linux-oracle, linux-oracle-6.8 vulnerabilities","description":"\nQualys discovered that several vulnerabilities existed in the AppArmor\nLinux kernel Security Module (LSM). An unprivileged local attacker could\nuse these issues to load, replace, and remove arbitrary AppArmor profiles\ncausing denial of service, exposure of sensitive information (kernel\nmemory), local privilege escalation, or possibly escape a container.\n(LP: #2143853)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - MIPS architecture;\n  - Nios II architecture;\n  - PA-RISC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - Sun Sparc architecture;\n  - User-Mode Linux (UML);\n  - x86 architecture;\n  - Xtensa architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - ATM drivers;\n  - Drivers core;\n  - Block device driver;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Hardware random number generator core;\n  - Character device driver;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - DMA engine subsystem;\n  - ARM SCMI message protocol;\n  - EFI core;\n  - Intel Stratix 10 firmware drivers;\n  - GPU drivers;\n  - HID subsystem;\n  - CoreSight HW tracing drivers;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - Input Device (Tablet) drivers;\n  - IOMMU subsystem;\n  - ISDN/mISDN subsystem;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - Fastrpc Driver;\n  - MOST (Media Oriented Systems Transport) drivers;\n  - MTD block device drivers;\n  - Ethernet bonding driver;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - Texas Instruments network drivers;\n  - Ethernet team driver;\n  - NVME drivers;\n  - PCI subsystem;\n  - PCCARD (PCMCIA/CardBus) bus subsystem;\n  - Performance monitor drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - ARM PM domains;\n  - PPS (Pulse Per Second) driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - Texas Instruments SoC drivers;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - TTY drivers;\n  - Userspace I/O drivers;\n  - Cadence USB3 driver;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Renesas USBHS Controller drivers;\n  - USB Mass Storage drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Framebuffer layer;\n  - Xen hypervisor drivers;\n  - AFS file system;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - File systems infrastructure;\n  - EFI Variable file system;\n  - exFAT file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - GFS2 file system;\n  - HFS file system;\n  - HFS+ file system;\n  - HugeTLB file system;\n  - JFS file system;\n  - KERNFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - OrangeFS file system;\n  - Proc file system;\n  - Diskquota system;\n  - SMB network file system;\n  - SquashFS file system;\n  - UDF file system;\n  - XFS file system;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - BPF subsystem;\n  - Mellanox drivers;\n  - NFS page cache wrapper;\n  - Memory management;\n  - Memory Management;\n  - Media input infrastructure;\n  - Bluetooth subsystem;\n  - IP tunnels definitions;\n  - Network traffic control;\n  - Rose network layer;\n  - Network sockets;\n  - io_uring subsystem;\n  - Control group (cgroup);\n  - Kernel crash support code;\n  - Kernel futex primitives;\n  - PID allocator;\n  - Scheduler infrastructure;\n  - Syscalls implementation;\n  - Timer subsystem;\n  - Tracing infrastructure;\n  - 9P file system network protocol;\n  - Amateur Radio drivers;\n  - B.A.T.M.A.N. meshing protocol;\n  - Ethernet bridge;\n  - Ceph Core library;\n  - Networking core;\n  - Devlink API;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - Open vSwitch;\n  - RF switch subsystem;\n  - SCTP protocol;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Intel ASoC drivers;\n  - QCOM ASoC drivers;\n  - USB sound devices;\n(CVE-2025-21833, CVE-2025-22103, CVE-2025-22105, CVE-2025-22106,\nCVE-2025-22107, CVE-2025-22113, CVE-2025-22121, CVE-2025-22124,\nCVE-2025-22125, CVE-2025-23129, CVE-2025-23130, CVE-2025-23133,\nCVE-2025-23143, CVE-2025-37860, CVE-2025-38105, CVE-2025-38502,\nCVE-2025-38556, CVE-2025-38627, CVE-2025-38643, CVE-2025-38709,\nCVE-2025-39678, CVE-2025-39697, CVE-2025-39805, CVE-2025-39806,\nCVE-2025-39807, CVE-2025-39808, CVE-2025-39810, CVE-2025-39811,\nCVE-2025-39812, CVE-2025-39813, CVE-2025-39815, CVE-2025-39817,\nCVE-2025-39819, CVE-2025-39823, CVE-2025-39824, CVE-2025-39825,\nCVE-2025-39826, CVE-2025-39827, CVE-2025-39828, CVE-2025-39829,\nCVE-2025-39832, CVE-2025-39835, CVE-2025-39836, CVE-2025-39838,\nCVE-2025-39839, CVE-2025-39841, CVE-2025-39842, CVE-2025-39843,\nCVE-2025-39844, CVE-2025-39845, CVE-2025-39846, CVE-2025-39847,\nCVE-2025-39848, CVE-2025-39849, CVE-2025-39850, CVE-2025-39851,\nCVE-2025-39852, CVE-2025-39853, CVE-2025-39854, CVE-2025-39857,\nCVE-2025-39860, CVE-2025-39861, CVE-2025-39863, CVE-2025-39864,\nCVE-2025-39865, CVE-2025-39866, CVE-2025-39869, CVE-2025-39870,\nCVE-2025-39871, CVE-2025-39873, CVE-2025-39876, CVE-2025-39877,\nCVE-2025-39880, CVE-2025-39881, CVE-2025-39883, CVE-2025-39885,\nCVE-2025-39886, CVE-2025-39891, CVE-2025-39894, CVE-2025-39895,\nCVE-2025-39897, CVE-2025-39899, CVE-2025-39901, CVE-2025-39902,\nCVE-2025-39907, CVE-2025-39909, CVE-2025-39911, CVE-2025-39913,\nCVE-2025-39914, CVE-2025-39916, CVE-2025-39920, CVE-2025-39923,\nCVE-2025-39927, CVE-2025-39929, CVE-2025-39931, CVE-2025-39932,\nCVE-2025-39934, CVE-2025-39937, CVE-2025-39938, CVE-2025-39940,\nCVE-2025-39942, CVE-2025-39943, CVE-2025-39944, CVE-2025-39945,\nCVE-2025-39947, CVE-2025-39948, CVE-2025-39949, CVE-2025-39950,\nCVE-2025-39951, CVE-2025-39952, CVE-2025-39953, CVE-2025-39955,\nCVE-2025-39957, CVE-2025-39961, CVE-2025-39965, CVE-2025-39967,\nCVE-2025-39968, CVE-2025-39969, CVE-2025-39970, CVE-2025-39971,\nCVE-2025-39972, CVE-2025-39973, CVE-2025-39977, CVE-2025-39978,\nCVE-2025-39980, CVE-2025-39981, CVE-2025-39982, CVE-2025-39985,\nCVE-2025-39986, CVE-2025-39987, CVE-2025-39988, CVE-2025-39991,\nCVE-2025-39992, CVE-2025-39994, CVE-2025-39995, CVE-2025-39996,\nCVE-2025-39998, CVE-2025-40000, CVE-2025-40001, CVE-2025-40006,\nCVE-2025-40008, CVE-2025-40009, CVE-2025-40010, CVE-2025-40011,\nCVE-2025-40013, CVE-2025-40016, CVE-2025-40020, CVE-2025-40021,\nCVE-2025-40024, CVE-2025-40026, CVE-2025-40027, CVE-2025-40029,\nCVE-2025-40030, CVE-2025-40031, CVE-2025-40032, CVE-2025-40033,\nCVE-2025-40035, CVE-2025-40036, CVE-2025-40037, CVE-2025-40038,\nCVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40047,\nCVE-2025-40048, CVE-2025-40049, CVE-2025-40051, CVE-2025-40052,\nCVE-2025-40053, CVE-2025-40055, CVE-2025-40056, CVE-2025-40057,\nCVE-2025-40058, CVE-2025-40059, CVE-2025-40060, CVE-2025-40061,\nCVE-2025-40062, CVE-2025-40067, CVE-2025-40068, CVE-2025-40070,\nCVE-2025-40071, CVE-2025-40077, CVE-2025-40078, CVE-2025-40079,\nCVE-2025-40080, CVE-2025-40081, CVE-2025-40083, CVE-2025-40084,\nCVE-2025-40085, CVE-2025-40087, CVE-2025-40088, CVE-2025-40092,\nCVE-2025-40093, CVE-2025-40094, CVE-2025-40095, CVE-2025-40096,\nCVE-2025-40099, CVE-2025-40100, CVE-2025-40101, CVE-2025-40103,\nCVE-2025-40104, CVE-2025-40105, CVE-2025-40106, CVE-2025-40107,\nCVE-2025-40109, CVE-2025-40110, CVE-2025-40111, CVE-2025-40112,\nCVE-2025-40115, CVE-2025-40116, CVE-2025-40118, CVE-2025-40120,\nCVE-2025-40121, CVE-2025-40123, CVE-2025-40124, CVE-2025-40125,\nCVE-2025-40126, CVE-2025-40127, CVE-2025-40129, CVE-2025-40134,\nCVE-2025-40137, CVE-2025-40140, CVE-2025-40141, CVE-2025-40153,\nCVE-2025-40154, CVE-2025-40155, CVE-2025-40156, CVE-2025-40159,\nCVE-2025-40160, CVE-2025-40165, CVE-2025-40166, CVE-2025-40167,\nCVE-2025-40169, CVE-2025-40171, CVE-2025-40172, CVE-2025-40173,\nCVE-2025-40176, CVE-2025-40178, CVE-2025-40179, CVE-2025-40180,\nCVE-2025-40183, CVE-2025-40187, CVE-2025-40188, CVE-2025-40192,\nCVE-2025-40193, CVE-2025-40194, CVE-2025-40196, CVE-2025-40198,\nCVE-2025-40200, CVE-2025-40201, CVE-2025-40204, CVE-2025-40205,\nCVE-2025-40206, CVE-2025-40207, CVE-2025-40211, CVE-2025-40218,\nCVE-2025-40219, CVE-2025-40220, CVE-2025-40221, CVE-2025-40223,\nCVE-2025-40226, CVE-2025-40231, CVE-2025-40233, CVE-2025-40235,\nCVE-2025-40237, CVE-2025-40238, CVE-2025-40240, CVE-2025-40242,\nCVE-2025-40243, CVE-2025-40244, CVE-2025-40245, CVE-2025-40248,\nCVE-2025-40250, CVE-2025-40251, CVE-2025-40252, CVE-2025-40253,\nCVE-2025-40254, CVE-2025-40257, CVE-2025-40258, CVE-2025-40259,\nCVE-2025-40261, CVE-2025-40262, CVE-2025-40263, CVE-2025-40264,\nCVE-2025-40266, CVE-2025-40268, CVE-2025-40269, CVE-2025-40271,\nCVE-2025-40272, CVE-2025-40273, CVE-2025-40275, CVE-2025-40277,\nCVE-2025-40278, CVE-2025-40279, CVE-2025-40280, CVE-2025-40281,\nCVE-2025-40282, CVE-2025-40283, CVE-2025-40284, CVE-2025-40285,\nCVE-2025-40286, CVE-2025-40287, CVE-2025-40288, CVE-2025-40289,\nCVE-2025-40292, CVE-2025-40293, CVE-2025-40294, CVE-2025-40301,\nCVE-2025-40303, CVE-2025-40304, CVE-2025-40305, CVE-2025-40306,\nCVE-2025-40307, CVE-2025-40308, CVE-2025-40309, CVE-2025-40310,\nCVE-2025-40311, CVE-2025-40312, CVE-2025-40313, CVE-2025-40314,\nCVE-2025-40315, CVE-2025-40317, CVE-2025-40318, CVE-2025-40319,\nCVE-2025-40320, CVE-2025-40321, CVE-2025-40322, CVE-2025-40323,\nCVE-2025-40324, CVE-2025-40328, CVE-2025-40329, CVE-2025-40331,\nCVE-2025-40333, CVE-2025-40337, CVE-2025-40339, CVE-2025-40341,\nCVE-2025-40342, CVE-2025-40343, CVE-2025-40345, CVE-2025-40346,\nCVE-2025-40347, CVE-2025-40349, CVE-2025-40350, CVE-2025-40351,\nCVE-2025-40353, CVE-2025-40358, CVE-2025-40360, CVE-2025-40363,\nCVE-2025-68168, CVE-2025-68171, CVE-2025-68172, CVE-2025-68173,\nCVE-2025-68176, CVE-2025-68177, CVE-2025-68178, CVE-2025-68179,\nCVE-2025-68180, CVE-2025-68183, CVE-2025-68184, CVE-2025-68185,\nCVE-2025-68190, CVE-2025-68191, CVE-2025-68192, CVE-2025-68194,\nCVE-2025-68198, CVE-2025-68200, CVE-2025-68201, CVE-2025-68204,\nCVE-2025-68208, CVE-2025-68213, CVE-2025-68214, CVE-2025-68217,\nCVE-2025-68218, CVE-2025-68219, CVE-2025-68220, CVE-2025-68222,\nCVE-2025-68223, CVE-2025-68227, CVE-2025-68229, CVE-2025-68231,\nCVE-2025-68233, CVE-2025-68235, CVE-2025-68237, CVE-2025-68238,\nCVE-2025-68241, CVE-2025-68244, CVE-2025-68245, CVE-2025-68246,\nCVE-2025-68249, CVE-2025-68282, CVE-2025-68283, CVE-2025-68284,\nCVE-2025-68285, CVE-2025-68286, CVE-2025-68287, CVE-2025-68288,\nCVE-2025-68289, CVE-2025-68290, CVE-2025-68295, CVE-2025-68297,\nCVE-2025-68301, CVE-2025-68302, CVE-2025-68303, CVE-2025-68305,\nCVE-2025-68307, CVE-2025-68308, CVE-2025-68310, CVE-2025-68311,\nCVE-2025-68312, CVE-2025-68313, CVE-2025-68315, CVE-2025-68320,\nCVE-2025-68321, CVE-2025-68322, CVE-2025-68327, CVE-2025-68328,\nCVE-2025-68330, CVE-2025-68331, CVE-2025-68339, CVE-2025-68340,\nCVE-2025-68342, CVE-2025-68343, CVE-2025-68734)\n","status":"published","published":"2026-03-16T14:03:41Z","modified":"2026-11-03T14:38:36.494075469Z","updated_at":"2026-11-03T15:14:17.286738Z"},{"id":"USN-8095-2","title":"linux-fips, linux-aws-fips, linux-gcp-fips vulnerabilities","description":"\nQualys discovered that several vulnerabilities existed in the AppArmor\nLinux kernel Security Module (LSM). An unprivileged local attacker could\nuse these issues to load, replace, and remove arbitrary AppArmor profiles\ncausing denial of service, exposure of sensitive information (kernel\nmemory), local privilege escalation, or possibly escape a container.\n(LP: #2143853)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - MIPS architecture;\n  - Nios II architecture;\n  - PA-RISC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - Sun Sparc architecture;\n  - User-Mode Linux (UML);\n  - x86 architecture;\n  - Xtensa architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - ATM drivers;\n  - Drivers core;\n  - Block device driver;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Hardware random number generator core;\n  - Character device driver;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - DMA engine subsystem;\n  - ARM SCMI message protocol;\n  - EFI core;\n  - Intel Stratix 10 firmware drivers;\n  - GPU drivers;\n  - HID subsystem;\n  - CoreSight HW tracing drivers;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - Input Device (Tablet) drivers;\n  - IOMMU subsystem;\n  - ISDN/mISDN subsystem;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - Fastrpc Driver;\n  - MOST (Media Oriented Systems Transport) drivers;\n  - MTD block device drivers;\n  - Ethernet bonding driver;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - Texas Instruments network drivers;\n  - Ethernet team driver;\n  - NVME drivers;\n  - PCI subsystem;\n  - PCCARD (PCMCIA/CardBus) bus subsystem;\n  - Performance monitor drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - ARM PM domains;\n  - PPS (Pulse Per Second) driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - Texas Instruments SoC drivers;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - TTY drivers;\n  - Userspace I/O drivers;\n  - Cadence USB3 driver;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Renesas USBHS Controller drivers;\n  - USB Mass Storage drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Framebuffer layer;\n  - Xen hypervisor drivers;\n  - AFS file system;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - File systems infrastructure;\n  - EFI Variable file system;\n  - exFAT file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - GFS2 file system;\n  - HFS file system;\n  - HFS+ file system;\n  - HugeTLB file system;\n  - JFS file system;\n  - KERNFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - OrangeFS file system;\n  - Proc file system;\n  - Diskquota system;\n  - SMB network file system;\n  - SquashFS file system;\n  - UDF file system;\n  - XFS file system;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - BPF subsystem;\n  - Mellanox drivers;\n  - NFS page cache wrapper;\n  - Memory management;\n  - Memory Management;\n  - Media input infrastructure;\n  - Bluetooth subsystem;\n  - IP tunnels definitions;\n  - Network traffic control;\n  - Rose network layer;\n  - Network sockets;\n  - io_uring subsystem;\n  - Control group (cgroup);\n  - Kernel crash support code;\n  - Kernel futex primitives;\n  - PID allocator;\n  - Scheduler infrastructure;\n  - Syscalls implementation;\n  - Timer subsystem;\n  - Tracing infrastructure;\n  - 9P file system network protocol;\n  - Amateur Radio drivers;\n  - B.A.T.M.A.N. meshing protocol;\n  - Ethernet bridge;\n  - Ceph Core library;\n  - Networking core;\n  - Devlink API;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - Open vSwitch;\n  - RF switch subsystem;\n  - SCTP protocol;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Intel ASoC drivers;\n  - QCOM ASoC drivers;\n  - USB sound devices;\n(CVE-2025-21833, CVE-2025-22103, CVE-2025-22105, CVE-2025-22106,\nCVE-2025-22107, CVE-2025-22113, CVE-2025-22121, CVE-2025-22124,\nCVE-2025-22125, CVE-2025-23129, CVE-2025-23130, CVE-2025-23133,\nCVE-2025-23143, CVE-2025-37860, CVE-2025-38105, CVE-2025-38502,\nCVE-2025-38556, CVE-2025-38627, CVE-2025-38643, CVE-2025-38709,\nCVE-2025-39678, CVE-2025-39697, CVE-2025-39805, CVE-2025-39806,\nCVE-2025-39807, CVE-2025-39808, CVE-2025-39810, CVE-2025-39811,\nCVE-2025-39812, CVE-2025-39813, CVE-2025-39815, CVE-2025-39817,\nCVE-2025-39819, CVE-2025-39823, CVE-2025-39824, CVE-2025-39825,\nCVE-2025-39826, CVE-2025-39827, CVE-2025-39828, CVE-2025-39829,\nCVE-2025-39832, CVE-2025-39835, CVE-2025-39836, CVE-2025-39838,\nCVE-2025-39839, CVE-2025-39841, CVE-2025-39842, CVE-2025-39843,\nCVE-2025-39844, CVE-2025-39845, CVE-2025-39846, CVE-2025-39847,\nCVE-2025-39848, CVE-2025-39849, CVE-2025-39850, CVE-2025-39851,\nCVE-2025-39852, CVE-2025-39853, CVE-2025-39854, CVE-2025-39857,\nCVE-2025-39860, CVE-2025-39861, CVE-2025-39863, CVE-2025-39864,\nCVE-2025-39865, CVE-2025-39866, CVE-2025-39869, CVE-2025-39870,\nCVE-2025-39871, CVE-2025-39873, CVE-2025-39876, CVE-2025-39877,\nCVE-2025-39880, CVE-2025-39881, CVE-2025-39883, CVE-2025-39885,\nCVE-2025-39886, CVE-2025-39891, CVE-2025-39894, CVE-2025-39895,\nCVE-2025-39897, CVE-2025-39899, CVE-2025-39901, CVE-2025-39902,\nCVE-2025-39907, CVE-2025-39909, CVE-2025-39911, CVE-2025-39913,\nCVE-2025-39914, CVE-2025-39916, CVE-2025-39920, CVE-2025-39923,\nCVE-2025-39927, CVE-2025-39929, CVE-2025-39931, CVE-2025-39932,\nCVE-2025-39934, CVE-2025-39937, CVE-2025-39938, CVE-2025-39940,\nCVE-2025-39942, CVE-2025-39943, CVE-2025-39944, CVE-2025-39945,\nCVE-2025-39947, CVE-2025-39948, CVE-2025-39949, CVE-2025-39950,\nCVE-2025-39951, CVE-2025-39952, CVE-2025-39953, CVE-2025-39955,\nCVE-2025-39957, CVE-2025-39961, CVE-2025-39965, CVE-2025-39967,\nCVE-2025-39968, CVE-2025-39969, CVE-2025-39970, CVE-2025-39971,\nCVE-2025-39972, CVE-2025-39973, CVE-2025-39977, CVE-2025-39978,\nCVE-2025-39980, CVE-2025-39981, CVE-2025-39982, CVE-2025-39985,\nCVE-2025-39986, CVE-2025-39987, CVE-2025-39988, CVE-2025-39991,\nCVE-2025-39992, CVE-2025-39994, CVE-2025-39995, CVE-2025-39996,\nCVE-2025-39998, CVE-2025-40000, CVE-2025-40001, CVE-2025-40006,\nCVE-2025-40008, CVE-2025-40009, CVE-2025-40010, CVE-2025-40011,\nCVE-2025-40013, CVE-2025-40016, CVE-2025-40020, CVE-2025-40021,\nCVE-2025-40024, CVE-2025-40026, CVE-2025-40027, CVE-2025-40029,\nCVE-2025-40030, CVE-2025-40031, CVE-2025-40032, CVE-2025-40033,\nCVE-2025-40035, CVE-2025-40036, CVE-2025-40037, CVE-2025-40038,\nCVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40047,\nCVE-2025-40048, CVE-2025-40049, CVE-2025-40051, CVE-2025-40052,\nCVE-2025-40053, CVE-2025-40055, CVE-2025-40056, CVE-2025-40057,\nCVE-2025-40058, CVE-2025-40059, CVE-2025-40060, CVE-2025-40061,\nCVE-2025-40062, CVE-2025-40067, CVE-2025-40068, CVE-2025-40070,\nCVE-2025-40071, CVE-2025-40077, CVE-2025-40078, CVE-2025-40079,\nCVE-2025-40080, CVE-2025-40081, CVE-2025-40083, CVE-2025-40084,\nCVE-2025-40085, CVE-2025-40087, CVE-2025-40088, CVE-2025-40092,\nCVE-2025-40093, CVE-2025-40094, CVE-2025-40095, CVE-2025-40096,\nCVE-2025-40099, CVE-2025-40100, CVE-2025-40101, CVE-2025-40103,\nCVE-2025-40104, CVE-2025-40105, CVE-2025-40106, CVE-2025-40107,\nCVE-2025-40109, CVE-2025-40110, CVE-2025-40111, CVE-2025-40112,\nCVE-2025-40115, CVE-2025-40116, CVE-2025-40118, CVE-2025-40120,\nCVE-2025-40121, CVE-2025-40123, CVE-2025-40124, CVE-2025-40125,\nCVE-2025-40126, CVE-2025-40127, CVE-2025-40129, CVE-2025-40134,\nCVE-2025-40137, CVE-2025-40140, CVE-2025-40141, CVE-2025-40153,\nCVE-2025-40154, CVE-2025-40155, CVE-2025-40156, CVE-2025-40159,\nCVE-2025-40160, CVE-2025-40165, CVE-2025-40166, CVE-2025-40167,\nCVE-2025-40169, CVE-2025-40171, CVE-2025-40172, CVE-2025-40173,\nCVE-2025-40176, CVE-2025-40178, CVE-2025-40179, CVE-2025-40180,\nCVE-2025-40183, CVE-2025-40187, CVE-2025-40188, CVE-2025-40192,\nCVE-2025-40193, CVE-2025-40194, CVE-2025-40196, CVE-2025-40198,\nCVE-2025-40200, CVE-2025-40201, CVE-2025-40204, CVE-2025-40205,\nCVE-2025-40206, CVE-2025-40207, CVE-2025-40211, CVE-2025-40218,\nCVE-2025-40219, CVE-2025-40220, CVE-2025-40221, CVE-2025-40223,\nCVE-2025-40226, CVE-2025-40231, CVE-2025-40233, CVE-2025-40235,\nCVE-2025-40237, CVE-2025-40238, CVE-2025-40240, CVE-2025-40242,\nCVE-2025-40243, CVE-2025-40244, CVE-2025-40245, CVE-2025-40248,\nCVE-2025-40250, CVE-2025-40251, CVE-2025-40252, CVE-2025-40253,\nCVE-2025-40254, CVE-2025-40257, CVE-2025-40258, CVE-2025-40259,\nCVE-2025-40261, CVE-2025-40262, CVE-2025-40263, CVE-2025-40264,\nCVE-2025-40266, CVE-2025-40268, CVE-2025-40269, CVE-2025-40271,\nCVE-2025-40272, CVE-2025-40273, CVE-2025-40275, CVE-2025-40277,\nCVE-2025-40278, CVE-2025-40279, CVE-2025-40280, CVE-2025-40281,\nCVE-2025-40282, CVE-2025-40283, CVE-2025-40284, CVE-2025-40285,\nCVE-2025-40286, CVE-2025-40287, CVE-2025-40288, CVE-2025-40289,\nCVE-2025-40292, CVE-2025-40293, CVE-2025-40294, CVE-2025-40301,\nCVE-2025-40303, CVE-2025-40304, CVE-2025-40305, CVE-2025-40306,\nCVE-2025-40307, CVE-2025-40308, CVE-2025-40309, CVE-2025-40310,\nCVE-2025-40311, CVE-2025-40312, CVE-2025-40313, CVE-2025-40314,\nCVE-2025-40315, CVE-2025-40317, CVE-2025-40318, CVE-2025-40319,\nCVE-2025-40320, CVE-2025-40321, CVE-2025-40322, CVE-2025-40323,\nCVE-2025-40324, CVE-2025-40328, CVE-2025-40329, CVE-2025-40331,\nCVE-2025-40333, CVE-2025-40337, CVE-2025-40339, CVE-2025-40341,\nCVE-2025-40342, CVE-2025-40343, CVE-2025-40345, CVE-2025-40346,\nCVE-2025-40347, CVE-2025-40349, CVE-2025-40350, CVE-2025-40351,\nCVE-2025-40353, CVE-2025-40358, CVE-2025-40360, CVE-2025-40363,\nCVE-2025-68168, CVE-2025-68171, CVE-2025-68172, CVE-2025-68173,\nCVE-2025-68176, CVE-2025-68177, CVE-2025-68178, CVE-2025-68179,\nCVE-2025-68180, CVE-2025-68183, CVE-2025-68184, CVE-2025-68185,\nCVE-2025-68190, CVE-2025-68191, CVE-2025-68192, CVE-2025-68194,\nCVE-2025-68198, CVE-2025-68200, CVE-2025-68201, CVE-2025-68204,\nCVE-2025-68208, CVE-2025-68213, CVE-2025-68214, CVE-2025-68217,\nCVE-2025-68218, CVE-2025-68219, CVE-2025-68220, CVE-2025-68222,\nCVE-2025-68223, CVE-2025-68227, CVE-2025-68229, CVE-2025-68231,\nCVE-2025-68233, CVE-2025-68235, CVE-2025-68237, CVE-2025-68238,\nCVE-2025-68241, CVE-2025-68244, CVE-2025-68245, CVE-2025-68246,\nCVE-2025-68249, CVE-2025-68282, CVE-2025-68283, CVE-2025-68284,\nCVE-2025-68285, CVE-2025-68286, CVE-2025-68287, CVE-2025-68288,\nCVE-2025-68289, CVE-2025-68290, CVE-2025-68295, CVE-2025-68297,\nCVE-2025-68301, CVE-2025-68302, CVE-2025-68303, CVE-2025-68305,\nCVE-2025-68307, CVE-2025-68308, CVE-2025-68310, CVE-2025-68311,\nCVE-2025-68312, CVE-2025-68313, CVE-2025-68315, CVE-2025-68320,\nCVE-2025-68321, CVE-2025-68322, CVE-2025-68327, CVE-2025-68328,\nCVE-2025-68330, CVE-2025-68331, CVE-2025-68339, CVE-2025-68340,\nCVE-2025-68342, CVE-2025-68343, CVE-2025-68734)\n","status":"published","published":"2026-03-16T23:02:27Z","modified":"2026-11-03T14:35:38.945380735Z","updated_at":"2026-11-03T15:16:05.953168Z"},{"id":"USN-8095-3","title":"linux-realtime, linux-realtime-6.8 vulnerabilities","description":"Qualys discovered that several vulnerabilities existed in the AppArmor\nLinux kernel Security Module (LSM). An unprivileged local attacker could\nuse these issues to load, replace, and remove arbitrary AppArmor profiles\ncausing denial of service, exposure of sensitive information (kernel\nmemory), local privilege escalation, or possibly escape a container.\n(LP: #2143853)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - MIPS architecture;\n  - Nios II architecture;\n  - PA-RISC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - Sun Sparc architecture;\n  - User-Mode Linux (UML);\n  - x86 architecture;\n  - Xtensa architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - ATM drivers;\n  - Drivers core;\n  - Block device driver;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Hardware random number generator core;\n  - Character device driver;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - DMA engine subsystem;\n  - ARM SCMI message protocol;\n  - EFI core;\n  - Intel Stratix 10 firmware drivers;\n  - GPU drivers;\n  - HID subsystem;\n  - CoreSight HW tracing drivers;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - Input Device (Tablet) drivers;\n  - IOMMU subsystem;\n  - ISDN/mISDN subsystem;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - Fastrpc Driver;\n  - MOST (Media Oriented Systems Transport) drivers;\n  - MTD block device drivers;\n  - Ethernet bonding driver;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - Texas Instruments network drivers;\n  - Ethernet team driver;\n  - NVME drivers;\n  - PCI subsystem;\n  - PCCARD (PCMCIA/CardBus) bus subsystem;\n  - Performance monitor drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - ARM PM domains;\n  - PPS (Pulse Per Second) driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - Texas Instruments SoC drivers;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - TTY drivers;\n  - Userspace I/O drivers;\n  - Cadence USB3 driver;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Renesas USBHS Controller drivers;\n  - USB Mass Storage drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Framebuffer layer;\n  - Xen hypervisor drivers;\n  - AFS file system;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - File systems infrastructure;\n  - EFI Variable file system;\n  - exFAT file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - GFS2 file system;\n  - HFS file system;\n  - HFS+ file system;\n  - HugeTLB file system;\n  - JFS file system;\n  - KERNFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - OrangeFS file system;\n  - Proc file system;\n  - Diskquota system;\n  - SMB network file system;\n  - SquashFS file system;\n  - UDF file system;\n  - XFS file system;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - BPF subsystem;\n  - Mellanox drivers;\n  - NFS page cache wrapper;\n  - Memory management;\n  - Memory Management;\n  - Media input infrastructure;\n  - Bluetooth subsystem;\n  - IP tunnels definitions;\n  - Network traffic control;\n  - Rose network layer;\n  - Network sockets;\n  - io_uring subsystem;\n  - Control group (cgroup);\n  - Kernel crash support code;\n  - Kernel futex primitives;\n  - PID allocator;\n  - Scheduler infrastructure;\n  - Syscalls implementation;\n  - Timer subsystem;\n  - Tracing infrastructure;\n  - 9P file system network protocol;\n  - Amateur Radio drivers;\n  - B.A.T.M.A.N. meshing protocol;\n  - Ethernet bridge;\n  - Ceph Core library;\n  - Networking core;\n  - Devlink API;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - Open vSwitch;\n  - RF switch subsystem;\n  - SCTP protocol;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Intel ASoC drivers;\n  - QCOM ASoC drivers;\n  - USB sound devices;\n(CVE-2025-21833, CVE-2025-22103, CVE-2025-22105, CVE-2025-22106,\nCVE-2025-22107, CVE-2025-22113, CVE-2025-22121, CVE-2025-22124,\nCVE-2025-22125, CVE-2025-23129, CVE-2025-23130, CVE-2025-23133,\nCVE-2025-23143, CVE-2025-37860, CVE-2025-38105, CVE-2025-38502,\nCVE-2025-38556, CVE-2025-38627, CVE-2025-38643, CVE-2025-38709,\nCVE-2025-39678, CVE-2025-39697, CVE-2025-39805, CVE-2025-39806,\nCVE-2025-39807, CVE-2025-39808, CVE-2025-39810, CVE-2025-39811,\nCVE-2025-39812, CVE-2025-39813, CVE-2025-39815, CVE-2025-39817,\nCVE-2025-39819, CVE-2025-39823, CVE-2025-39824, CVE-2025-39825,\nCVE-2025-39826, CVE-2025-39827, CVE-2025-39828, CVE-2025-39829,\nCVE-2025-39832, CVE-2025-39835, CVE-2025-39836, CVE-2025-39838,\nCVE-2025-39839, CVE-2025-39841, CVE-2025-39842, CVE-2025-39843,\nCVE-2025-39844, CVE-2025-39845, CVE-2025-39846, CVE-2025-39847,\nCVE-2025-39848, CVE-2025-39849, CVE-2025-39850, CVE-2025-39851,\nCVE-2025-39852, CVE-2025-39853, CVE-2025-39854, CVE-2025-39857,\nCVE-2025-39860, CVE-2025-39861, CVE-2025-39863, CVE-2025-39864,\nCVE-2025-39865, CVE-2025-39866, CVE-2025-39869, CVE-2025-39870,\nCVE-2025-39871, CVE-2025-39873, CVE-2025-39876, CVE-2025-39877,\nCVE-2025-39880, CVE-2025-39881, CVE-2025-39883, CVE-2025-39885,\nCVE-2025-39886, CVE-2025-39891, CVE-2025-39894, CVE-2025-39895,\nCVE-2025-39897, CVE-2025-39899, CVE-2025-39901, CVE-2025-39902,\nCVE-2025-39907, CVE-2025-39909, CVE-2025-39911, CVE-2025-39913,\nCVE-2025-39914, CVE-2025-39916, CVE-2025-39920, CVE-2025-39923,\nCVE-2025-39927, CVE-2025-39929, CVE-2025-39931, CVE-2025-39932,\nCVE-2025-39934, CVE-2025-39937, CVE-2025-39938, CVE-2025-39940,\nCVE-2025-39942, CVE-2025-39943, CVE-2025-39944, CVE-2025-39945,\nCVE-2025-39947, CVE-2025-39948, CVE-2025-39949, CVE-2025-39950,\nCVE-2025-39951, CVE-2025-39952, CVE-2025-39953, CVE-2025-39955,\nCVE-2025-39957, CVE-2025-39961, CVE-2025-39965, CVE-2025-39967,\nCVE-2025-39968, CVE-2025-39969, CVE-2025-39970, CVE-2025-39971,\nCVE-2025-39972, CVE-2025-39973, CVE-2025-39977, CVE-2025-39978,\nCVE-2025-39980, CVE-2025-39981, CVE-2025-39982, CVE-2025-39985,\nCVE-2025-39986, CVE-2025-39987, CVE-2025-39988, CVE-2025-39991,\nCVE-2025-39992, CVE-2025-39994, CVE-2025-39995, CVE-2025-39996,\nCVE-2025-39998, CVE-2025-40000, CVE-2025-40001, CVE-2025-40006,\nCVE-2025-40008, CVE-2025-40009, CVE-2025-40010, CVE-2025-40011,\nCVE-2025-40013, CVE-2025-40016, CVE-2025-40020, CVE-2025-40021,\nCVE-2025-40024, CVE-2025-40026, CVE-2025-40027, CVE-2025-40029,\nCVE-2025-40030, CVE-2025-40031, CVE-2025-40032, CVE-2025-40033,\nCVE-2025-40035, CVE-2025-40036, CVE-2025-40037, CVE-2025-40038,\nCVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40047,\nCVE-2025-40048, CVE-2025-40049, CVE-2025-40051, CVE-2025-40052,\nCVE-2025-40053, CVE-2025-40055, CVE-2025-40056, CVE-2025-40057,\nCVE-2025-40058, CVE-2025-40059, CVE-2025-40060, CVE-2025-40061,\nCVE-2025-40062, CVE-2025-40067, CVE-2025-40068, CVE-2025-40070,\nCVE-2025-40071, CVE-2025-40077, CVE-2025-40078, CVE-2025-40079,\nCVE-2025-40080, CVE-2025-40081, CVE-2025-40083, CVE-2025-40084,\nCVE-2025-40085, CVE-2025-40087, CVE-2025-40088, CVE-2025-40092,\nCVE-2025-40093, CVE-2025-40094, CVE-2025-40095, CVE-2025-40096,\nCVE-2025-40099, CVE-2025-40100, CVE-2025-40101, CVE-2025-40103,\nCVE-2025-40104, CVE-2025-40105, CVE-2025-40106, CVE-2025-40107,\nCVE-2025-40109, CVE-2025-40110, CVE-2025-40111, CVE-2025-40112,\nCVE-2025-40115, CVE-2025-40116, CVE-2025-40118, CVE-2025-40120,\nCVE-2025-40121, CVE-2025-40123, CVE-2025-40124, CVE-2025-40125,\nCVE-2025-40126, CVE-2025-40127, CVE-2025-40129, CVE-2025-40134,\nCVE-2025-40137, CVE-2025-40140, CVE-2025-40141, CVE-2025-40153,\nCVE-2025-40154, CVE-2025-40155, CVE-2025-40156, CVE-2025-40159,\nCVE-2025-40160, CVE-2025-40165, CVE-2025-40166, CVE-2025-40167,\nCVE-2025-40169, CVE-2025-40171, CVE-2025-40172, CVE-2025-40173,\nCVE-2025-40176, CVE-2025-40178, CVE-2025-40179, CVE-2025-40180,\nCVE-2025-40183, CVE-2025-40187, CVE-2025-40188, CVE-2025-40192,\nCVE-2025-40193, CVE-2025-40194, CVE-2025-40196, CVE-2025-40198,\nCVE-2025-40200, CVE-2025-40201, CVE-2025-40204, CVE-2025-40205,\nCVE-2025-40206, CVE-2025-40207, CVE-2025-40211, CVE-2025-40218,\nCVE-2025-40219, CVE-2025-40220, CVE-2025-40221, CVE-2025-40223,\nCVE-2025-40226, CVE-2025-40231, CVE-2025-40233, CVE-2025-40235,\nCVE-2025-40237, CVE-2025-40238, CVE-2025-40240, CVE-2025-40242,\nCVE-2025-40243, CVE-2025-40244, CVE-2025-40245, CVE-2025-40248,\nCVE-2025-40250, CVE-2025-40251, CVE-2025-40252, CVE-2025-40253,\nCVE-2025-40254, CVE-2025-40257, CVE-2025-40258, CVE-2025-40259,\nCVE-2025-40261, CVE-2025-40262, CVE-2025-40263, CVE-2025-40264,\nCVE-2025-40266, CVE-2025-40268, CVE-2025-40269, CVE-2025-40271,\nCVE-2025-40272, CVE-2025-40273, CVE-2025-40275, CVE-2025-40277,\nCVE-2025-40278, CVE-2025-40279, CVE-2025-40280, CVE-2025-40281,\nCVE-2025-40282, CVE-2025-40283, CVE-2025-40284, CVE-2025-40285,\nCVE-2025-40286, CVE-2025-40287, CVE-2025-40288, CVE-2025-40289,\nCVE-2025-40292, CVE-2025-40293, CVE-2025-40294, CVE-2025-40301,\nCVE-2025-40303, CVE-2025-40304, CVE-2025-40305, CVE-2025-40306,\nCVE-2025-40307, CVE-2025-40308, CVE-2025-40309, CVE-2025-40310,\nCVE-2025-40311, CVE-2025-40312, CVE-2025-40313, CVE-2025-40314,\nCVE-2025-40315, CVE-2025-40317, CVE-2025-40318, CVE-2025-40319,\nCVE-2025-40320, CVE-2025-40321, CVE-2025-40322, CVE-2025-40323,\nCVE-2025-40324, CVE-2025-40328, CVE-2025-40329, CVE-2025-40331,\nCVE-2025-40333, CVE-2025-40337, CVE-2025-40339, CVE-2025-40341,\nCVE-2025-40342, CVE-2025-40343, CVE-2025-40345, CVE-2025-40346,\nCVE-2025-40347, CVE-2025-40349, CVE-2025-40350, CVE-2025-40351,\nCVE-2025-40353, CVE-2025-40358, CVE-2025-40360, CVE-2025-40363,\nCVE-2025-68168, CVE-2025-68171, CVE-2025-68172, CVE-2025-68173,\nCVE-2025-68176, CVE-2025-68177, CVE-2025-68178, CVE-2025-68179,\nCVE-2025-68180, CVE-2025-68183, CVE-2025-68184, CVE-2025-68185,\nCVE-2025-68190, CVE-2025-68191, CVE-2025-68192, CVE-2025-68194,\nCVE-2025-68198, CVE-2025-68200, CVE-2025-68201, CVE-2025-68204,\nCVE-2025-68208, CVE-2025-68213, CVE-2025-68214, CVE-2025-68217,\nCVE-2025-68218, CVE-2025-68219, CVE-2025-68220, CVE-2025-68222,\nCVE-2025-68223, CVE-2025-68227, CVE-2025-68229, CVE-2025-68231,\nCVE-2025-68233, CVE-2025-68235, CVE-2025-68237, CVE-2025-68238,\nCVE-2025-68241, CVE-2025-68244, CVE-2025-68245, CVE-2025-68246,\nCVE-2025-68249, CVE-2025-68282, CVE-2025-68283, CVE-2025-68284,\nCVE-2025-68285, CVE-2025-68286, CVE-2025-68287, CVE-2025-68288,\nCVE-2025-68289, CVE-2025-68290, CVE-2025-68295, CVE-2025-68297,\nCVE-2025-68301, CVE-2025-68302, CVE-2025-68303, CVE-2025-68305,\nCVE-2025-68307, CVE-2025-68308, CVE-2025-68310, CVE-2025-68311,\nCVE-2025-68312, CVE-2025-68313, CVE-2025-68315, CVE-2025-68320,\nCVE-2025-68321, CVE-2025-68322, CVE-2025-68327, CVE-2025-68328,\nCVE-2025-68330, CVE-2025-68331, CVE-2025-68339, CVE-2025-68340,\nCVE-2025-68342, CVE-2025-68343, CVE-2025-68734)\n","status":"published","published":"2026-03-17T18:06:26Z","modified":"2026-11-03T14:34:41.040000385Z","updated_at":"2026-11-03T15:16:54.00292Z"},{"id":"USN-8095-4","title":"linux-aws-6.8 vulnerabilities","description":"Qualys discovered that several vulnerabilities existed in the AppArmor\nLinux kernel Security Module (LSM). An unprivileged local attacker could\nuse these issues to load, replace, and remove arbitrary AppArmor profiles\ncausing denial of service, exposure of sensitive information (kernel\nmemory), local privilege escalation, or possibly escape a container.\n(LP: #2143853)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - MIPS architecture;\n  - Nios II architecture;\n  - PA-RISC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - Sun Sparc architecture;\n  - User-Mode Linux (UML);\n  - x86 architecture;\n  - Xtensa architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - ATM drivers;\n  - Drivers core;\n  - Block device driver;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Hardware random number generator core;\n  - Character device driver;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - DMA engine subsystem;\n  - ARM SCMI message protocol;\n  - EFI core;\n  - Intel Stratix 10 firmware drivers;\n  - GPU drivers;\n  - HID subsystem;\n  - CoreSight HW tracing drivers;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - Input Device (Tablet) drivers;\n  - IOMMU subsystem;\n  - ISDN/mISDN subsystem;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - Fastrpc Driver;\n  - MOST (Media Oriented Systems Transport) drivers;\n  - MTD block device drivers;\n  - Ethernet bonding driver;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - Texas Instruments network drivers;\n  - Ethernet team driver;\n  - NVME drivers;\n  - PCI subsystem;\n  - PCCARD (PCMCIA/CardBus) bus subsystem;\n  - Performance monitor drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - ARM PM domains;\n  - PPS (Pulse Per Second) driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - Texas Instruments SoC drivers;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - TTY drivers;\n  - Userspace I/O drivers;\n  - Cadence USB3 driver;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Renesas USBHS Controller drivers;\n  - USB Mass Storage drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Framebuffer layer;\n  - Xen hypervisor drivers;\n  - AFS file system;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - File systems infrastructure;\n  - EFI Variable file system;\n  - exFAT file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - GFS2 file system;\n  - HFS file system;\n  - HFS+ file system;\n  - HugeTLB file system;\n  - JFS file system;\n  - KERNFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - OrangeFS file system;\n  - Proc file system;\n  - Diskquota system;\n  - SMB network file system;\n  - SquashFS file system;\n  - UDF file system;\n  - XFS file system;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - BPF subsystem;\n  - Mellanox drivers;\n  - NFS page cache wrapper;\n  - Memory management;\n  - Memory Management;\n  - Media input infrastructure;\n  - Bluetooth subsystem;\n  - IP tunnels definitions;\n  - Network traffic control;\n  - Rose network layer;\n  - Network sockets;\n  - io_uring subsystem;\n  - Control group (cgroup);\n  - Kernel crash support code;\n  - Kernel futex primitives;\n  - PID allocator;\n  - Scheduler infrastructure;\n  - Syscalls implementation;\n  - Timer subsystem;\n  - Tracing infrastructure;\n  - 9P file system network protocol;\n  - Amateur Radio drivers;\n  - B.A.T.M.A.N. meshing protocol;\n  - Ethernet bridge;\n  - Ceph Core library;\n  - Networking core;\n  - Devlink API;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - Open vSwitch;\n  - RF switch subsystem;\n  - SCTP protocol;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Intel ASoC drivers;\n  - QCOM ASoC drivers;\n  - USB sound devices;\n(CVE-2025-21833, CVE-2025-22103, CVE-2025-22105, CVE-2025-22106,\nCVE-2025-22107, CVE-2025-22113, CVE-2025-22121, CVE-2025-22124,\nCVE-2025-22125, CVE-2025-23129, CVE-2025-23130, CVE-2025-23133,\nCVE-2025-23143, CVE-2025-37860, CVE-2025-38105, CVE-2025-38502,\nCVE-2025-38556, CVE-2025-38627, CVE-2025-38643, CVE-2025-38709,\nCVE-2025-39678, CVE-2025-39697, CVE-2025-39805, CVE-2025-39806,\nCVE-2025-39807, CVE-2025-39808, CVE-2025-39810, CVE-2025-39811,\nCVE-2025-39812, CVE-2025-39813, CVE-2025-39815, CVE-2025-39817,\nCVE-2025-39819, CVE-2025-39823, CVE-2025-39824, CVE-2025-39825,\nCVE-2025-39826, CVE-2025-39827, CVE-2025-39828, CVE-2025-39829,\nCVE-2025-39832, CVE-2025-39835, CVE-2025-39836, CVE-2025-39838,\nCVE-2025-39839, CVE-2025-39841, CVE-2025-39842, CVE-2025-39843,\nCVE-2025-39844, CVE-2025-39845, CVE-2025-39846, CVE-2025-39847,\nCVE-2025-39848, CVE-2025-39849, CVE-2025-39850, CVE-2025-39851,\nCVE-2025-39852, CVE-2025-39853, CVE-2025-39854, CVE-2025-39857,\nCVE-2025-39860, CVE-2025-39861, CVE-2025-39863, CVE-2025-39864,\nCVE-2025-39865, CVE-2025-39866, CVE-2025-39869, CVE-2025-39870,\nCVE-2025-39871, CVE-2025-39873, CVE-2025-39876, CVE-2025-39877,\nCVE-2025-39880, CVE-2025-39881, CVE-2025-39883, CVE-2025-39885,\nCVE-2025-39886, CVE-2025-39891, CVE-2025-39894, CVE-2025-39895,\nCVE-2025-39897, CVE-2025-39899, CVE-2025-39901, CVE-2025-39902,\nCVE-2025-39907, CVE-2025-39909, CVE-2025-39911, CVE-2025-39913,\nCVE-2025-39914, CVE-2025-39916, CVE-2025-39920, CVE-2025-39923,\nCVE-2025-39927, CVE-2025-39929, CVE-2025-39931, CVE-2025-39932,\nCVE-2025-39934, CVE-2025-39937, CVE-2025-39938, CVE-2025-39940,\nCVE-2025-39942, CVE-2025-39943, CVE-2025-39944, CVE-2025-39945,\nCVE-2025-39947, CVE-2025-39948, CVE-2025-39949, CVE-2025-39950,\nCVE-2025-39951, CVE-2025-39952, CVE-2025-39953, CVE-2025-39955,\nCVE-2025-39957, CVE-2025-39961, CVE-2025-39965, CVE-2025-39967,\nCVE-2025-39968, CVE-2025-39969, CVE-2025-39970, CVE-2025-39971,\nCVE-2025-39972, CVE-2025-39973, CVE-2025-39977, CVE-2025-39978,\nCVE-2025-39980, CVE-2025-39981, CVE-2025-39982, CVE-2025-39985,\nCVE-2025-39986, CVE-2025-39987, CVE-2025-39988, CVE-2025-39991,\nCVE-2025-39992, CVE-2025-39994, CVE-2025-39995, CVE-2025-39996,\nCVE-2025-39998, CVE-2025-40000, CVE-2025-40001, CVE-2025-40006,\nCVE-2025-40008, CVE-2025-40009, CVE-2025-40010, CVE-2025-40011,\nCVE-2025-40013, CVE-2025-40016, CVE-2025-40020, CVE-2025-40021,\nCVE-2025-40024, CVE-2025-40026, CVE-2025-40027, CVE-2025-40029,\nCVE-2025-40030, CVE-2025-40031, CVE-2025-40032, CVE-2025-40033,\nCVE-2025-40035, CVE-2025-40036, CVE-2025-40037, CVE-2025-40038,\nCVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40047,\nCVE-2025-40048, CVE-2025-40049, CVE-2025-40051, CVE-2025-40052,\nCVE-2025-40053, CVE-2025-40055, CVE-2025-40056, CVE-2025-40057,\nCVE-2025-40058, CVE-2025-40059, CVE-2025-40060, CVE-2025-40061,\nCVE-2025-40062, CVE-2025-40067, CVE-2025-40068, CVE-2025-40070,\nCVE-2025-40071, CVE-2025-40077, CVE-2025-40078, CVE-2025-40079,\nCVE-2025-40080, CVE-2025-40081, CVE-2025-40083, CVE-2025-40084,\nCVE-2025-40085, CVE-2025-40087, CVE-2025-40088, CVE-2025-40092,\nCVE-2025-40093, CVE-2025-40094, CVE-2025-40095, CVE-2025-40096,\nCVE-2025-40099, CVE-2025-40100, CVE-2025-40101, CVE-2025-40103,\nCVE-2025-40104, CVE-2025-40105, CVE-2025-40106, CVE-2025-40107,\nCVE-2025-40109, CVE-2025-40110, CVE-2025-40111, CVE-2025-40112,\nCVE-2025-40115, CVE-2025-40116, CVE-2025-40118, CVE-2025-40120,\nCVE-2025-40121, CVE-2025-40123, CVE-2025-40124, CVE-2025-40125,\nCVE-2025-40126, CVE-2025-40127, CVE-2025-40129, CVE-2025-40134,\nCVE-2025-40137, CVE-2025-40140, CVE-2025-40141, CVE-2025-40153,\nCVE-2025-40154, CVE-2025-40155, CVE-2025-40156, CVE-2025-40159,\nCVE-2025-40160, CVE-2025-40165, CVE-2025-40166, CVE-2025-40167,\nCVE-2025-40169, CVE-2025-40171, CVE-2025-40172, CVE-2025-40173,\nCVE-2025-40176, CVE-2025-40178, CVE-2025-40179, CVE-2025-40180,\nCVE-2025-40183, CVE-2025-40187, CVE-2025-40188, CVE-2025-40192,\nCVE-2025-40193, CVE-2025-40194, CVE-2025-40196, CVE-2025-40198,\nCVE-2025-40200, CVE-2025-40201, CVE-2025-40204, CVE-2025-40205,\nCVE-2025-40206, CVE-2025-40207, CVE-2025-40211, CVE-2025-40218,\nCVE-2025-40219, CVE-2025-40220, CVE-2025-40221, CVE-2025-40223,\nCVE-2025-40226, CVE-2025-40231, CVE-2025-40233, CVE-2025-40235,\nCVE-2025-40237, CVE-2025-40238, CVE-2025-40240, CVE-2025-40242,\nCVE-2025-40243, CVE-2025-40244, CVE-2025-40245, CVE-2025-40248,\nCVE-2025-40250, CVE-2025-40251, CVE-2025-40252, CVE-2025-40253,\nCVE-2025-40254, CVE-2025-40257, CVE-2025-40258, CVE-2025-40259,\nCVE-2025-40261, CVE-2025-40262, CVE-2025-40263, CVE-2025-40264,\nCVE-2025-40266, CVE-2025-40268, CVE-2025-40269, CVE-2025-40271,\nCVE-2025-40272, CVE-2025-40273, CVE-2025-40275, CVE-2025-40277,\nCVE-2025-40278, CVE-2025-40279, CVE-2025-40280, CVE-2025-40281,\nCVE-2025-40282, CVE-2025-40283, CVE-2025-40284, CVE-2025-40285,\nCVE-2025-40286, CVE-2025-40287, CVE-2025-40288, CVE-2025-40289,\nCVE-2025-40292, CVE-2025-40293, CVE-2025-40294, CVE-2025-40301,\nCVE-2025-40303, CVE-2025-40304, CVE-2025-40305, CVE-2025-40306,\nCVE-2025-40307, CVE-2025-40308, CVE-2025-40309, CVE-2025-40310,\nCVE-2025-40311, CVE-2025-40312, CVE-2025-40313, CVE-2025-40314,\nCVE-2025-40315, CVE-2025-40317, CVE-2025-40318, CVE-2025-40319,\nCVE-2025-40320, CVE-2025-40321, CVE-2025-40322, CVE-2025-40323,\nCVE-2025-40324, CVE-2025-40328, CVE-2025-40329, CVE-2025-40331,\nCVE-2025-40333, CVE-2025-40337, CVE-2025-40339, CVE-2025-40341,\nCVE-2025-40342, CVE-2025-40343, CVE-2025-40345, CVE-2025-40346,\nCVE-2025-40347, CVE-2025-40349, CVE-2025-40350, CVE-2025-40351,\nCVE-2025-40353, CVE-2025-40358, CVE-2025-40360, CVE-2025-40363,\nCVE-2025-68168, CVE-2025-68171, CVE-2025-68172, CVE-2025-68173,\nCVE-2025-68176, CVE-2025-68177, CVE-2025-68178, CVE-2025-68179,\nCVE-2025-68180, CVE-2025-68183, CVE-2025-68184, CVE-2025-68185,\nCVE-2025-68190, CVE-2025-68191, CVE-2025-68192, CVE-2025-68194,\nCVE-2025-68198, CVE-2025-68200, CVE-2025-68201, CVE-2025-68204,\nCVE-2025-68208, CVE-2025-68213, CVE-2025-68214, CVE-2025-68217,\nCVE-2025-68218, CVE-2025-68219, CVE-2025-68220, CVE-2025-68222,\nCVE-2025-68223, CVE-2025-68227, CVE-2025-68229, CVE-2025-68231,\nCVE-2025-68233, CVE-2025-68235, CVE-2025-68237, CVE-2025-68238,\nCVE-2025-68241, CVE-2025-68244, CVE-2025-68245, CVE-2025-68246,\nCVE-2025-68249, CVE-2025-68282, CVE-2025-68283, CVE-2025-68284,\nCVE-2025-68285, CVE-2025-68286, CVE-2025-68287, CVE-2025-68288,\nCVE-2025-68289, CVE-2025-68290, CVE-2025-68295, CVE-2025-68297,\nCVE-2025-68301, CVE-2025-68302, CVE-2025-68303, CVE-2025-68305,\nCVE-2025-68307, CVE-2025-68308, CVE-2025-68310, CVE-2025-68311,\nCVE-2025-68312, CVE-2025-68313, CVE-2025-68315, CVE-2025-68320,\nCVE-2025-68321, CVE-2025-68322, CVE-2025-68327, CVE-2025-68328,\nCVE-2025-68330, CVE-2025-68331, CVE-2025-68339, CVE-2025-68340,\nCVE-2025-68342, CVE-2025-68343, CVE-2025-68734)\n","status":"published","published":"2026-03-23T14:01:42Z","modified":"2026-11-03T14:35:07.834088684Z","updated_at":"2026-11-03T15:16:36.034517Z"},{"id":"USN-8095-5","title":"linux-raspi, linux-raspi-realtime vulnerabilities","description":"Qualys discovered that several vulnerabilities existed in the AppArmor\nLinux kernel Security Module (LSM). An unprivileged local attacker could\nuse these issues to load, replace, and remove arbitrary AppArmor profiles\ncausing denial of service, exposure of sensitive information (kernel\nmemory), local privilege escalation, or possibly escape a container.\n(LP: #2143853)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - MIPS architecture;\n  - Nios II architecture;\n  - PA-RISC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - Sun Sparc architecture;\n  - User-Mode Linux (UML);\n  - x86 architecture;\n  - Xtensa architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - ATM drivers;\n  - Drivers core;\n  - Block device driver;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Hardware random number generator core;\n  - Character device driver;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - DMA engine subsystem;\n  - ARM SCMI message protocol;\n  - EFI core;\n  - Intel Stratix 10 firmware drivers;\n  - GPU drivers;\n  - HID subsystem;\n  - CoreSight HW tracing drivers;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - Input Device (Tablet) drivers;\n  - IOMMU subsystem;\n  - ISDN/mISDN subsystem;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - Fastrpc Driver;\n  - MOST (Media Oriented Systems Transport) drivers;\n  - MTD block device drivers;\n  - Ethernet bonding driver;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - Texas Instruments network drivers;\n  - Ethernet team driver;\n  - NVME drivers;\n  - PCI subsystem;\n  - PCCARD (PCMCIA/CardBus) bus subsystem;\n  - Performance monitor drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - ARM PM domains;\n  - PPS (Pulse Per Second) driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - Texas Instruments SoC drivers;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - TTY drivers;\n  - Userspace I/O drivers;\n  - Cadence USB3 driver;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Renesas USBHS Controller drivers;\n  - USB Mass Storage drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Framebuffer layer;\n  - Xen hypervisor drivers;\n  - AFS file system;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - File systems infrastructure;\n  - EFI Variable file system;\n  - exFAT file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - GFS2 file system;\n  - HFS file system;\n  - HFS+ file system;\n  - HugeTLB file system;\n  - JFS file system;\n  - KERNFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - OrangeFS file system;\n  - Proc file system;\n  - Diskquota system;\n  - SMB network file system;\n  - SquashFS file system;\n  - UDF file system;\n  - XFS file system;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - BPF subsystem;\n  - Mellanox drivers;\n  - NFS page cache wrapper;\n  - Memory management;\n  - Memory Management;\n  - Media input infrastructure;\n  - Bluetooth subsystem;\n  - IP tunnels definitions;\n  - Network traffic control;\n  - Rose network layer;\n  - Network sockets;\n  - io_uring subsystem;\n  - Control group (cgroup);\n  - Kernel crash support code;\n  - Kernel futex primitives;\n  - PID allocator;\n  - Scheduler infrastructure;\n  - Syscalls implementation;\n  - Timer subsystem;\n  - Tracing infrastructure;\n  - 9P file system network protocol;\n  - Amateur Radio drivers;\n  - B.A.T.M.A.N. meshing protocol;\n  - Ethernet bridge;\n  - Ceph Core library;\n  - Networking core;\n  - Devlink API;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - Open vSwitch;\n  - RF switch subsystem;\n  - SCTP protocol;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Intel ASoC drivers;\n  - QCOM ASoC drivers;\n  - USB sound devices;\n(CVE-2025-21833, CVE-2025-22103, CVE-2025-22105, CVE-2025-22106,\nCVE-2025-22107, CVE-2025-22113, CVE-2025-22121, CVE-2025-22124,\nCVE-2025-22125, CVE-2025-23129, CVE-2025-23130, CVE-2025-23133,\nCVE-2025-23143, CVE-2025-37860, CVE-2025-38105, CVE-2025-38502,\nCVE-2025-38556, CVE-2025-38627, CVE-2025-38643, CVE-2025-38709,\nCVE-2025-39678, CVE-2025-39697, CVE-2025-39805, CVE-2025-39806,\nCVE-2025-39807, CVE-2025-39808, CVE-2025-39810, CVE-2025-39811,\nCVE-2025-39812, CVE-2025-39813, CVE-2025-39815, CVE-2025-39817,\nCVE-2025-39819, CVE-2025-39823, CVE-2025-39824, CVE-2025-39825,\nCVE-2025-39826, CVE-2025-39827, CVE-2025-39828, CVE-2025-39829,\nCVE-2025-39832, CVE-2025-39835, CVE-2025-39836, CVE-2025-39838,\nCVE-2025-39839, CVE-2025-39841, CVE-2025-39842, CVE-2025-39843,\nCVE-2025-39844, CVE-2025-39845, CVE-2025-39846, CVE-2025-39847,\nCVE-2025-39848, CVE-2025-39849, CVE-2025-39850, CVE-2025-39851,\nCVE-2025-39852, CVE-2025-39853, CVE-2025-39854, CVE-2025-39857,\nCVE-2025-39860, CVE-2025-39861, CVE-2025-39863, CVE-2025-39864,\nCVE-2025-39865, CVE-2025-39866, CVE-2025-39869, CVE-2025-39870,\nCVE-2025-39871, CVE-2025-39873, CVE-2025-39876, CVE-2025-39877,\nCVE-2025-39880, CVE-2025-39881, CVE-2025-39883, CVE-2025-39885,\nCVE-2025-39886, CVE-2025-39891, CVE-2025-39894, CVE-2025-39895,\nCVE-2025-39897, CVE-2025-39899, CVE-2025-39901, CVE-2025-39902,\nCVE-2025-39907, CVE-2025-39909, CVE-2025-39911, CVE-2025-39913,\nCVE-2025-39914, CVE-2025-39916, CVE-2025-39920, CVE-2025-39923,\nCVE-2025-39927, CVE-2025-39929, CVE-2025-39931, CVE-2025-39932,\nCVE-2025-39934, CVE-2025-39937, CVE-2025-39938, CVE-2025-39940,\nCVE-2025-39942, CVE-2025-39943, CVE-2025-39944, CVE-2025-39945,\nCVE-2025-39947, CVE-2025-39948, CVE-2025-39949, CVE-2025-39950,\nCVE-2025-39951, CVE-2025-39952, CVE-2025-39953, CVE-2025-39955,\nCVE-2025-39957, CVE-2025-39961, CVE-2025-39965, CVE-2025-39967,\nCVE-2025-39968, CVE-2025-39969, CVE-2025-39970, CVE-2025-39971,\nCVE-2025-39972, CVE-2025-39973, CVE-2025-39977, CVE-2025-39978,\nCVE-2025-39980, CVE-2025-39981, CVE-2025-39982, CVE-2025-39985,\nCVE-2025-39986, CVE-2025-39987, CVE-2025-39988, CVE-2025-39991,\nCVE-2025-39992, CVE-2025-39994, CVE-2025-39995, CVE-2025-39996,\nCVE-2025-39998, CVE-2025-40000, CVE-2025-40001, CVE-2025-40006,\nCVE-2025-40008, CVE-2025-40009, CVE-2025-40010, CVE-2025-40011,\nCVE-2025-40013, CVE-2025-40016, CVE-2025-40020, CVE-2025-40021,\nCVE-2025-40024, CVE-2025-40026, CVE-2025-40027, CVE-2025-40029,\nCVE-2025-40030, CVE-2025-40031, CVE-2025-40032, CVE-2025-40033,\nCVE-2025-40035, CVE-2025-40036, CVE-2025-40037, CVE-2025-40038,\nCVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40047,\nCVE-2025-40048, CVE-2025-40049, CVE-2025-40051, CVE-2025-40052,\nCVE-2025-40053, CVE-2025-40055, CVE-2025-40056, CVE-2025-40057,\nCVE-2025-40058, CVE-2025-40059, CVE-2025-40060, CVE-2025-40061,\nCVE-2025-40062, CVE-2025-40067, CVE-2025-40068, CVE-2025-40070,\nCVE-2025-40071, CVE-2025-40077, CVE-2025-40078, CVE-2025-40079,\nCVE-2025-40080, CVE-2025-40081, CVE-2025-40083, CVE-2025-40084,\nCVE-2025-40085, CVE-2025-40087, CVE-2025-40088, CVE-2025-40092,\nCVE-2025-40093, CVE-2025-40094, CVE-2025-40095, CVE-2025-40096,\nCVE-2025-40099, CVE-2025-40100, CVE-2025-40101, CVE-2025-40103,\nCVE-2025-40104, CVE-2025-40105, CVE-2025-40106, CVE-2025-40107,\nCVE-2025-40109, CVE-2025-40110, CVE-2025-40111, CVE-2025-40112,\nCVE-2025-40115, CVE-2025-40116, CVE-2025-40118, CVE-2025-40120,\nCVE-2025-40121, CVE-2025-40123, CVE-2025-40124, CVE-2025-40125,\nCVE-2025-40126, CVE-2025-40127, CVE-2025-40129, CVE-2025-40134,\nCVE-2025-40137, CVE-2025-40140, CVE-2025-40141, CVE-2025-40153,\nCVE-2025-40154, CVE-2025-40155, CVE-2025-40156, CVE-2025-40159,\nCVE-2025-40160, CVE-2025-40165, CVE-2025-40166, CVE-2025-40167,\nCVE-2025-40169, CVE-2025-40171, CVE-2025-40172, CVE-2025-40173,\nCVE-2025-40176, CVE-2025-40178, CVE-2025-40179, CVE-2025-40180,\nCVE-2025-40183, CVE-2025-40187, CVE-2025-40188, CVE-2025-40192,\nCVE-2025-40193, CVE-2025-40194, CVE-2025-40196, CVE-2025-40198,\nCVE-2025-40200, CVE-2025-40201, CVE-2025-40204, CVE-2025-40205,\nCVE-2025-40206, CVE-2025-40207, CVE-2025-40211, CVE-2025-40218,\nCVE-2025-40219, CVE-2025-40220, CVE-2025-40221, CVE-2025-40223,\nCVE-2025-40226, CVE-2025-40231, CVE-2025-40233, CVE-2025-40235,\nCVE-2025-40237, CVE-2025-40238, CVE-2025-40240, CVE-2025-40242,\nCVE-2025-40243, CVE-2025-40244, CVE-2025-40245, CVE-2025-40248,\nCVE-2025-40250, CVE-2025-40251, CVE-2025-40252, CVE-2025-40253,\nCVE-2025-40254, CVE-2025-40257, CVE-2025-40258, CVE-2025-40259,\nCVE-2025-40261, CVE-2025-40262, CVE-2025-40263, CVE-2025-40264,\nCVE-2025-40266, CVE-2025-40268, CVE-2025-40269, CVE-2025-40271,\nCVE-2025-40272, CVE-2025-40273, CVE-2025-40275, CVE-2025-40277,\nCVE-2025-40278, CVE-2025-40279, CVE-2025-40280, CVE-2025-40281,\nCVE-2025-40282, CVE-2025-40283, CVE-2025-40284, CVE-2025-40285,\nCVE-2025-40286, CVE-2025-40287, CVE-2025-40288, CVE-2025-40289,\nCVE-2025-40292, CVE-2025-40293, CVE-2025-40294, CVE-2025-40301,\nCVE-2025-40303, CVE-2025-40304, CVE-2025-40305, CVE-2025-40306,\nCVE-2025-40307, CVE-2025-40308, CVE-2025-40309, CVE-2025-40310,\nCVE-2025-40311, CVE-2025-40312, CVE-2025-40313, CVE-2025-40314,\nCVE-2025-40315, CVE-2025-40317, CVE-2025-40318, CVE-2025-40319,\nCVE-2025-40320, CVE-2025-40321, CVE-2025-40322, CVE-2025-40323,\nCVE-2025-40324, CVE-2025-40328, CVE-2025-40329, CVE-2025-40331,\nCVE-2025-40333, CVE-2025-40337, CVE-2025-40339, CVE-2025-40341,\nCVE-2025-40342, CVE-2025-40343, CVE-2025-40345, CVE-2025-40346,\nCVE-2025-40347, CVE-2025-40349, CVE-2025-40350, CVE-2025-40351,\nCVE-2025-40353, CVE-2025-40358, CVE-2025-40360, CVE-2025-40363,\nCVE-2025-68168, CVE-2025-68171, CVE-2025-68172, CVE-2025-68173,\nCVE-2025-68176, CVE-2025-68177, CVE-2025-68178, CVE-2025-68179,\nCVE-2025-68180, CVE-2025-68183, CVE-2025-68184, CVE-2025-68185,\nCVE-2025-68190, CVE-2025-68191, CVE-2025-68192, CVE-2025-68194,\nCVE-2025-68198, CVE-2025-68200, CVE-2025-68201, CVE-2025-68204,\nCVE-2025-68208, CVE-2025-68213, CVE-2025-68214, CVE-2025-68217,\nCVE-2025-68218, CVE-2025-68219, CVE-2025-68220, CVE-2025-68222,\nCVE-2025-68223, CVE-2025-68227, CVE-2025-68229, CVE-2025-68231,\nCVE-2025-68233, CVE-2025-68235, CVE-2025-68237, CVE-2025-68238,\nCVE-2025-68241, CVE-2025-68244, CVE-2025-68245, CVE-2025-68246,\nCVE-2025-68249, CVE-2025-68282, CVE-2025-68283, CVE-2025-68284,\nCVE-2025-68285, CVE-2025-68286, CVE-2025-68287, CVE-2025-68288,\nCVE-2025-68289, CVE-2025-68290, CVE-2025-68295, CVE-2025-68297,\nCVE-2025-68301, CVE-2025-68302, CVE-2025-68303, CVE-2025-68305,\nCVE-2025-68307, CVE-2025-68308, CVE-2025-68310, CVE-2025-68311,\nCVE-2025-68312, CVE-2025-68313, CVE-2025-68315, CVE-2025-68320,\nCVE-2025-68321, CVE-2025-68322, CVE-2025-68327, CVE-2025-68328,\nCVE-2025-68330, CVE-2025-68331, CVE-2025-68339, CVE-2025-68340,\nCVE-2025-68342, CVE-2025-68343, CVE-2025-68734)\n","status":"published","published":"2026-04-01T18:04:35Z","modified":"2026-11-03T14:35:15.998762447Z","updated_at":"2026-11-03T15:16:22.507285Z"},{"id":"USN-8100-1","title":"linux-nvidia, linux-nvidia-6.8, linux-nvidia-lowlatency vulnerabilities","description":"Qualys discovered that several vulnerabilities existed in the AppArmor\nLinux kernel Security Module (LSM). An unprivileged local attacker could\nuse these issues to load, replace, and remove arbitrary AppArmor profiles\ncausing denial of service, exposure of sensitive information (kernel\nmemory), local privilege escalation, or possibly escape a container.\n(LP: #2143853)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - MIPS architecture;\n  - Nios II architecture;\n  - PA-RISC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - Sun Sparc architecture;\n  - User-Mode Linux (UML);\n  - x86 architecture;\n  - Xtensa architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - ATM drivers;\n  - Drivers core;\n  - Block device driver;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Hardware random number generator core;\n  - Character device driver;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - DMA engine subsystem;\n  - ARM SCMI message protocol;\n  - EFI core;\n  - Intel Stratix 10 firmware drivers;\n  - GPU drivers;\n  - HID subsystem;\n  - CoreSight HW tracing drivers;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - Input Device (Tablet) drivers;\n  - IOMMU subsystem;\n  - ISDN/mISDN subsystem;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - Fastrpc Driver;\n  - MOST (Media Oriented Systems Transport) drivers;\n  - MTD block device drivers;\n  - Ethernet bonding driver;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - Texas Instruments network drivers;\n  - Ethernet team driver;\n  - NVME drivers;\n  - PCI subsystem;\n  - PCCARD (PCMCIA/CardBus) bus subsystem;\n  - Performance monitor drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - ARM PM domains;\n  - PPS (Pulse Per Second) driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - Texas Instruments SoC drivers;\n  - SPI subsystem;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - TTY drivers;\n  - Userspace I/O drivers;\n  - Cadence USB3 driver;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Renesas USBHS Controller drivers;\n  - USB Mass Storage drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Framebuffer layer;\n  - Xen hypervisor drivers;\n  - AFS file system;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - File systems infrastructure;\n  - EFI Variable file system;\n  - exFAT file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - GFS2 file system;\n  - HFS file system;\n  - HFS+ file system;\n  - HugeTLB file system;\n  - JFS file system;\n  - KERNFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - OrangeFS file system;\n  - Proc file system;\n  - Diskquota system;\n  - SMB network file system;\n  - SquashFS file system;\n  - UDF file system;\n  - XFS file system;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - BPF subsystem;\n  - Mellanox drivers;\n  - NFS page cache wrapper;\n  - Memory management;\n  - Memory Management;\n  - Media input infrastructure;\n  - Bluetooth subsystem;\n  - IP tunnels definitions;\n  - Network traffic control;\n  - Rose network layer;\n  - Network sockets;\n  - io_uring subsystem;\n  - Control group (cgroup);\n  - Kernel crash support code;\n  - Kernel futex primitives;\n  - PID allocator;\n  - Scheduler infrastructure;\n  - Syscalls implementation;\n  - Timer subsystem;\n  - Tracing infrastructure;\n  - 9P file system network protocol;\n  - Amateur Radio drivers;\n  - B.A.T.M.A.N. meshing protocol;\n  - Ethernet bridge;\n  - Ceph Core library;\n  - Networking core;\n  - Devlink API;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - Open vSwitch;\n  - RF switch subsystem;\n  - SCTP protocol;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Intel ASoC drivers;\n  - QCOM ASoC drivers;\n  - USB sound devices;\n(CVE-2025-21833, CVE-2025-22103, CVE-2025-22105, CVE-2025-22106,\nCVE-2025-22107, CVE-2025-22113, CVE-2025-22121, CVE-2025-22124,\nCVE-2025-22125, CVE-2025-23129, CVE-2025-23130, CVE-2025-23133,\nCVE-2025-23143, CVE-2025-37860, CVE-2025-38105, CVE-2025-38502,\nCVE-2025-38556, CVE-2025-38627, CVE-2025-38643, CVE-2025-38709,\nCVE-2025-39678, CVE-2025-39697, CVE-2025-39805, CVE-2025-39806,\nCVE-2025-39807, CVE-2025-39808, CVE-2025-39810, CVE-2025-39811,\nCVE-2025-39812, CVE-2025-39813, CVE-2025-39815, CVE-2025-39817,\nCVE-2025-39819, CVE-2025-39823, CVE-2025-39824, CVE-2025-39825,\nCVE-2025-39826, CVE-2025-39827, CVE-2025-39828, CVE-2025-39829,\nCVE-2025-39832, CVE-2025-39835, CVE-2025-39836, CVE-2025-39838,\nCVE-2025-39839, CVE-2025-39841, CVE-2025-39842, CVE-2025-39843,\nCVE-2025-39844, CVE-2025-39845, CVE-2025-39846, CVE-2025-39847,\nCVE-2025-39848, CVE-2025-39849, CVE-2025-39850, CVE-2025-39851,\nCVE-2025-39852, CVE-2025-39853, CVE-2025-39854, CVE-2025-39857,\nCVE-2025-39860, CVE-2025-39861, CVE-2025-39863, CVE-2025-39864,\nCVE-2025-39865, CVE-2025-39866, CVE-2025-39869, CVE-2025-39870,\nCVE-2025-39871, CVE-2025-39873, CVE-2025-39876, CVE-2025-39877,\nCVE-2025-39880, CVE-2025-39881, CVE-2025-39883, CVE-2025-39885,\nCVE-2025-39886, CVE-2025-39891, CVE-2025-39894, CVE-2025-39895,\nCVE-2025-39897, CVE-2025-39899, CVE-2025-39901, CVE-2025-39902,\nCVE-2025-39907, CVE-2025-39909, CVE-2025-39911, CVE-2025-39913,\nCVE-2025-39914, CVE-2025-39916, CVE-2025-39920, CVE-2025-39923,\nCVE-2025-39927, CVE-2025-39929, CVE-2025-39931, CVE-2025-39932,\nCVE-2025-39934, CVE-2025-39937, CVE-2025-39938, CVE-2025-39940,\nCVE-2025-39942, CVE-2025-39943, CVE-2025-39944, CVE-2025-39945,\nCVE-2025-39947, CVE-2025-39948, CVE-2025-39949, CVE-2025-39950,\nCVE-2025-39951, CVE-2025-39952, CVE-2025-39953, CVE-2025-39955,\nCVE-2025-39957, CVE-2025-39961, CVE-2025-39965, CVE-2025-39967,\nCVE-2025-39968, CVE-2025-39969, CVE-2025-39970, CVE-2025-39971,\nCVE-2025-39972, CVE-2025-39973, CVE-2025-39977, CVE-2025-39978,\nCVE-2025-39980, CVE-2025-39981, CVE-2025-39982, CVE-2025-39985,\nCVE-2025-39986, CVE-2025-39987, CVE-2025-39988, CVE-2025-39991,\nCVE-2025-39992, CVE-2025-39994, CVE-2025-39995, CVE-2025-39996,\nCVE-2025-39998, CVE-2025-40000, CVE-2025-40001, CVE-2025-40006,\nCVE-2025-40008, CVE-2025-40009, CVE-2025-40010, CVE-2025-40011,\nCVE-2025-40013, CVE-2025-40016, CVE-2025-40020, CVE-2025-40021,\nCVE-2025-40024, CVE-2025-40026, CVE-2025-40027, CVE-2025-40029,\nCVE-2025-40030, CVE-2025-40031, CVE-2025-40032, CVE-2025-40033,\nCVE-2025-40035, CVE-2025-40036, CVE-2025-40037, CVE-2025-40038,\nCVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40047,\nCVE-2025-40048, CVE-2025-40049, CVE-2025-40051, CVE-2025-40052,\nCVE-2025-40053, CVE-2025-40055, CVE-2025-40056, CVE-2025-40057,\nCVE-2025-40058, CVE-2025-40059, CVE-2025-40060, CVE-2025-40061,\nCVE-2025-40062, CVE-2025-40067, CVE-2025-40068, CVE-2025-40070,\nCVE-2025-40071, CVE-2025-40077, CVE-2025-40078, CVE-2025-40079,\nCVE-2025-40080, CVE-2025-40081, CVE-2025-40083, CVE-2025-40084,\nCVE-2025-40085, CVE-2025-40087, CVE-2025-40088, CVE-2025-40092,\nCVE-2025-40093, CVE-2025-40094, CVE-2025-40095, CVE-2025-40096,\nCVE-2025-40099, CVE-2025-40100, CVE-2025-40101, CVE-2025-40103,\nCVE-2025-40104, CVE-2025-40105, CVE-2025-40106, CVE-2025-40107,\nCVE-2025-40109, CVE-2025-40110, CVE-2025-40111, CVE-2025-40112,\nCVE-2025-40115, CVE-2025-40116, CVE-2025-40118, CVE-2025-40120,\nCVE-2025-40121, CVE-2025-40123, CVE-2025-40124, CVE-2025-40125,\nCVE-2025-40126, CVE-2025-40127, CVE-2025-40129, CVE-2025-40134,\nCVE-2025-40137, CVE-2025-40140, CVE-2025-40141, CVE-2025-40153,\nCVE-2025-40154, CVE-2025-40155, CVE-2025-40156, CVE-2025-40159,\nCVE-2025-40160, CVE-2025-40165, CVE-2025-40166, CVE-2025-40167,\nCVE-2025-40169, CVE-2025-40171, CVE-2025-40172, CVE-2025-40173,\nCVE-2025-40176, CVE-2025-40178, CVE-2025-40179, CVE-2025-40180,\nCVE-2025-40183, CVE-2025-40187, CVE-2025-40188, CVE-2025-40192,\nCVE-2025-40193, CVE-2025-40194, CVE-2025-40196, CVE-2025-40198,\nCVE-2025-40200, CVE-2025-40201, CVE-2025-40204, CVE-2025-40205,\nCVE-2025-40206, CVE-2025-40207, CVE-2025-40211, CVE-2025-40218,\nCVE-2025-40219, CVE-2025-40220, CVE-2025-40221, CVE-2025-40223,\nCVE-2025-40226, CVE-2025-40231, CVE-2025-40233, CVE-2025-40235,\nCVE-2025-40237, CVE-2025-40238, CVE-2025-40240, CVE-2025-40242,\nCVE-2025-40243, CVE-2025-40244, CVE-2025-40245, CVE-2025-40248,\nCVE-2025-40250, CVE-2025-40251, CVE-2025-40252, CVE-2025-40253,\nCVE-2025-40254, CVE-2025-40257, CVE-2025-40258, CVE-2025-40259,\nCVE-2025-40261, CVE-2025-40262, CVE-2025-40263, CVE-2025-40264,\nCVE-2025-40266, CVE-2025-40268, CVE-2025-40269, CVE-2025-40271,\nCVE-2025-40272, CVE-2025-40273, CVE-2025-40275, CVE-2025-40277,\nCVE-2025-40278, CVE-2025-40279, CVE-2025-40280, CVE-2025-40281,\nCVE-2025-40282, CVE-2025-40283, CVE-2025-40284, CVE-2025-40285,\nCVE-2025-40286, CVE-2025-40287, CVE-2025-40288, CVE-2025-40289,\nCVE-2025-40292, CVE-2025-40293, CVE-2025-40294, CVE-2025-40301,\nCVE-2025-40303, CVE-2025-40304, CVE-2025-40305, CVE-2025-40306,\nCVE-2025-40307, CVE-2025-40308, CVE-2025-40309, CVE-2025-40310,\nCVE-2025-40311, CVE-2025-40312, CVE-2025-40313, CVE-2025-40314,\nCVE-2025-40315, CVE-2025-40317, CVE-2025-40318, CVE-2025-40319,\nCVE-2025-40320, CVE-2025-40321, CVE-2025-40322, CVE-2025-40323,\nCVE-2025-40324, CVE-2025-40328, CVE-2025-40329, CVE-2025-40331,\nCVE-2025-40333, CVE-2025-40337, CVE-2025-40339, CVE-2025-40341,\nCVE-2025-40342, CVE-2025-40343, CVE-2025-40345, CVE-2025-40346,\nCVE-2025-40347, CVE-2025-40349, CVE-2025-40350, CVE-2025-40351,\nCVE-2025-40353, CVE-2025-40358, CVE-2025-40360, CVE-2025-40363,\nCVE-2025-68168, CVE-2025-68171, CVE-2025-68172, CVE-2025-68173,\nCVE-2025-68176, CVE-2025-68177, CVE-2025-68178, CVE-2025-68179,\nCVE-2025-68180, CVE-2025-68183, CVE-2025-68184, CVE-2025-68185,\nCVE-2025-68190, CVE-2025-68191, CVE-2025-68192, CVE-2025-68194,\nCVE-2025-68198, CVE-2025-68200, CVE-2025-68201, CVE-2025-68204,\nCVE-2025-68208, CVE-2025-68213, CVE-2025-68214, CVE-2025-68217,\nCVE-2025-68218, CVE-2025-68219, CVE-2025-68220, CVE-2025-68222,\nCVE-2025-68223, CVE-2025-68227, CVE-2025-68229, CVE-2025-68231,\nCVE-2025-68233, CVE-2025-68235, CVE-2025-68237, CVE-2025-68238,\nCVE-2025-68241, CVE-2025-68244, CVE-2025-68245, CVE-2025-68246,\nCVE-2025-68249, CVE-2025-68282, CVE-2025-68283, CVE-2025-68284,\nCVE-2025-68285, CVE-2025-68286, CVE-2025-68287, CVE-2025-68288,\nCVE-2025-68289, CVE-2025-68290, CVE-2025-68295, CVE-2025-68297,\nCVE-2025-68301, CVE-2025-68302, CVE-2025-68303, CVE-2025-68305,\nCVE-2025-68307, CVE-2025-68308, CVE-2025-68310, CVE-2025-68311,\nCVE-2025-68312, CVE-2025-68313, CVE-2025-68315, CVE-2025-68320,\nCVE-2025-68321, CVE-2025-68322, CVE-2025-68327, CVE-2025-68328,\nCVE-2025-68330, CVE-2025-68331, CVE-2025-68339, CVE-2025-68340,\nCVE-2025-68342, CVE-2025-68343, CVE-2025-68734, CVE-2026-23202,\nCVE-2026-23207)\n","status":"published","published":"2026-03-16T20:48:11Z","modified":"2026-11-04T20:01:36.961728599Z","updated_at":"2026-11-04T20:16:32.566315Z"},{"id":"USN-8125-1","title":"linux-azure vulnerabilities","description":"Qualys discovered that several vulnerabilities existed in the AppArmor\nLinux kernel Security Module (LSM). An unprivileged local attacker could\nuse these issues to load, replace, and remove arbitrary AppArmor profiles\ncausing denial of service, exposure of sensitive information (kernel\nmemory), local privilege escalation, or possibly escape a container.\n(LP: #2143853)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - MIPS architecture;\n  - Nios II architecture;\n  - PA-RISC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - Sun Sparc architecture;\n  - User-Mode Linux (UML);\n  - x86 architecture;\n  - Xtensa architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - ATM drivers;\n  - Drivers core;\n  - Block device driver;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Hardware random number generator core;\n  - Character device driver;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - DMA engine subsystem;\n  - ARM SCMI message protocol;\n  - EFI core;\n  - Intel Stratix 10 firmware drivers;\n  - GPU drivers;\n  - HID subsystem;\n  - CoreSight HW tracing drivers;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - Input Device (Tablet) drivers;\n  - IOMMU subsystem;\n  - ISDN/mISDN subsystem;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - Fastrpc Driver;\n  - MOST (Media Oriented Systems Transport) drivers;\n  - MTD block device drivers;\n  - Ethernet bonding driver;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - Texas Instruments network drivers;\n  - Ethernet team driver;\n  - NVME drivers;\n  - PCI subsystem;\n  - PCCARD (PCMCIA/CardBus) bus subsystem;\n  - Performance monitor drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - ARM PM domains;\n  - PPS (Pulse Per Second) driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - Texas Instruments SoC drivers;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - TTY drivers;\n  - Userspace I/O drivers;\n  - Cadence USB3 driver;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Renesas USBHS Controller drivers;\n  - USB Mass Storage drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Framebuffer layer;\n  - Xen hypervisor drivers;\n  - AFS file system;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - File systems infrastructure;\n  - EFI Variable file system;\n  - exFAT file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - GFS2 file system;\n  - HFS file system;\n  - HFS+ file system;\n  - HugeTLB file system;\n  - JFS file system;\n  - KERNFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - OrangeFS file system;\n  - Proc file system;\n  - Diskquota system;\n  - SMB network file system;\n  - SquashFS file system;\n  - UDF file system;\n  - XFS file system;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - BPF subsystem;\n  - Mellanox drivers;\n  - NFS page cache wrapper;\n  - Memory management;\n  - Memory Management;\n  - Media input infrastructure;\n  - Bluetooth subsystem;\n  - IP tunnels definitions;\n  - Network traffic control;\n  - Rose network layer;\n  - Network sockets;\n  - io_uring subsystem;\n  - Control group (cgroup);\n  - Kernel crash support code;\n  - Kernel futex primitives;\n  - PID allocator;\n  - Scheduler infrastructure;\n  - Syscalls implementation;\n  - Timer subsystem;\n  - Tracing infrastructure;\n  - 9P file system network protocol;\n  - Amateur Radio drivers;\n  - B.A.T.M.A.N. meshing protocol;\n  - Ethernet bridge;\n  - Ceph Core library;\n  - Networking core;\n  - Devlink API;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - Open vSwitch;\n  - RF switch subsystem;\n  - SCTP protocol;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Intel ASoC drivers;\n  - QCOM ASoC drivers;\n  - USB sound devices;\n(CVE-2025-21833, CVE-2025-22037, CVE-2025-22103, CVE-2025-22105,\nCVE-2025-22106, CVE-2025-22107, CVE-2025-22113, CVE-2025-22121,\nCVE-2025-22124, CVE-2025-22125, CVE-2025-23129, CVE-2025-23130,\nCVE-2025-23133, CVE-2025-23143, CVE-2025-37860, CVE-2025-37899,\nCVE-2025-38105, CVE-2025-38502, CVE-2025-38556, CVE-2025-38627,\nCVE-2025-38643, CVE-2025-38709, CVE-2025-39678, CVE-2025-39697,\nCVE-2025-39805, CVE-2025-39806, CVE-2025-39807, CVE-2025-39808,\nCVE-2025-39810, CVE-2025-39811, CVE-2025-39812, CVE-2025-39813,\nCVE-2025-39815, CVE-2025-39817, CVE-2025-39819, CVE-2025-39823,\nCVE-2025-39824, CVE-2025-39825, CVE-2025-39826, CVE-2025-39827,\nCVE-2025-39828, CVE-2025-39829, CVE-2025-39832, CVE-2025-39835,\nCVE-2025-39836, CVE-2025-39838, CVE-2025-39839, CVE-2025-39841,\nCVE-2025-39842, CVE-2025-39843, CVE-2025-39844, CVE-2025-39845,\nCVE-2025-39846, CVE-2025-39847, CVE-2025-39848, CVE-2025-39849,\nCVE-2025-39850, CVE-2025-39851, CVE-2025-39852, CVE-2025-39853,\nCVE-2025-39854, CVE-2025-39857, CVE-2025-39860, CVE-2025-39861,\nCVE-2025-39863, CVE-2025-39864, CVE-2025-39865, CVE-2025-39866,\nCVE-2025-39869, CVE-2025-39870, CVE-2025-39871, CVE-2025-39873,\nCVE-2025-39876, CVE-2025-39877, CVE-2025-39880, CVE-2025-39881,\nCVE-2025-39883, CVE-2025-39885, CVE-2025-39886, CVE-2025-39891,\nCVE-2025-39894, CVE-2025-39895, CVE-2025-39897, CVE-2025-39899,\nCVE-2025-39901, CVE-2025-39902, CVE-2025-39907, CVE-2025-39909,\nCVE-2025-39911, CVE-2025-39913, CVE-2025-39914, CVE-2025-39916,\nCVE-2025-39920, CVE-2025-39923, CVE-2025-39927, CVE-2025-39929,\nCVE-2025-39931, CVE-2025-39932, CVE-2025-39934, CVE-2025-39937,\nCVE-2025-39938, CVE-2025-39940, CVE-2025-39942, CVE-2025-39943,\nCVE-2025-39944, CVE-2025-39945, CVE-2025-39947, CVE-2025-39948,\nCVE-2025-39949, CVE-2025-39950, CVE-2025-39951, CVE-2025-39952,\nCVE-2025-39953, CVE-2025-39955, CVE-2025-39957, CVE-2025-39961,\nCVE-2025-39965, CVE-2025-39967, CVE-2025-39968, CVE-2025-39969,\nCVE-2025-39970, CVE-2025-39971, CVE-2025-39972, CVE-2025-39973,\nCVE-2025-39977, CVE-2025-39978, CVE-2025-39980, CVE-2025-39981,\nCVE-2025-39982, CVE-2025-39985, CVE-2025-39986, CVE-2025-39987,\nCVE-2025-39988, CVE-2025-39991, CVE-2025-39992, CVE-2025-39994,\nCVE-2025-39995, CVE-2025-39996, CVE-2025-39998, CVE-2025-40000,\nCVE-2025-40001, CVE-2025-40006, CVE-2025-40008, CVE-2025-40009,\nCVE-2025-40010, CVE-2025-40011, CVE-2025-40013, CVE-2025-40016,\nCVE-2025-40020, CVE-2025-40021, CVE-2025-40024, CVE-2025-40026,\nCVE-2025-40027, CVE-2025-40029, CVE-2025-40030, CVE-2025-40031,\nCVE-2025-40032, CVE-2025-40033, CVE-2025-40035, CVE-2025-40036,\nCVE-2025-40037, CVE-2025-40038, CVE-2025-40042, CVE-2025-40043,\nCVE-2025-40044, CVE-2025-40047, CVE-2025-40048, CVE-2025-40049,\nCVE-2025-40051, CVE-2025-40052, CVE-2025-40053, CVE-2025-40055,\nCVE-2025-40056, CVE-2025-40057, CVE-2025-40058, CVE-2025-40059,\nCVE-2025-40060, CVE-2025-40061, CVE-2025-40062, CVE-2025-40067,\nCVE-2025-40068, CVE-2025-40070, CVE-2025-40071, CVE-2025-40077,\nCVE-2025-40078, CVE-2025-40079, CVE-2025-40080, CVE-2025-40081,\nCVE-2025-40083, CVE-2025-40084, CVE-2025-40085, CVE-2025-40087,\nCVE-2025-40088, CVE-2025-40092, CVE-2025-40093, CVE-2025-40094,\nCVE-2025-40095, CVE-2025-40096, CVE-2025-40099, CVE-2025-40100,\nCVE-2025-40101, CVE-2025-40103, CVE-2025-40104, CVE-2025-40105,\nCVE-2025-40106, CVE-2025-40107, CVE-2025-40109, CVE-2025-40110,\nCVE-2025-40111, CVE-2025-40112, CVE-2025-40115, CVE-2025-40116,\nCVE-2025-40118, CVE-2025-40120, CVE-2025-40121, CVE-2025-40123,\nCVE-2025-40124, CVE-2025-40125, CVE-2025-40126, CVE-2025-40127,\nCVE-2025-40129, CVE-2025-40134, CVE-2025-40137, CVE-2025-40140,\nCVE-2025-40141, CVE-2025-40153, CVE-2025-40154, CVE-2025-40155,\nCVE-2025-40156, CVE-2025-40159, CVE-2025-40160, CVE-2025-40165,\nCVE-2025-40166, CVE-2025-40167, CVE-2025-40169, CVE-2025-40171,\nCVE-2025-40172, CVE-2025-40173, CVE-2025-40176, CVE-2025-40178,\nCVE-2025-40179, CVE-2025-40180, CVE-2025-40183, CVE-2025-40187,\nCVE-2025-40188, CVE-2025-40192, CVE-2025-40193, CVE-2025-40194,\nCVE-2025-40196, CVE-2025-40198, CVE-2025-40200, CVE-2025-40201,\nCVE-2025-40202, CVE-2025-40204, CVE-2025-40205, CVE-2025-40206,\nCVE-2025-40207, CVE-2025-40211, CVE-2025-40218, CVE-2025-40219,\nCVE-2025-40220, CVE-2025-40221, CVE-2025-40223, CVE-2025-40226,\nCVE-2025-40231, CVE-2025-40233, CVE-2025-40235, CVE-2025-40237,\nCVE-2025-40238, CVE-2025-40240, CVE-2025-40242, CVE-2025-40243,\nCVE-2025-40244, CVE-2025-40245, CVE-2025-40248, CVE-2025-40250,\nCVE-2025-40251, CVE-2025-40252, CVE-2025-40253, CVE-2025-40254,\nCVE-2025-40257, CVE-2025-40258, CVE-2025-40259, CVE-2025-40261,\nCVE-2025-40262, CVE-2025-40263, CVE-2025-40264, CVE-2025-40266,\nCVE-2025-40268, CVE-2025-40269, CVE-2025-40271, CVE-2025-40272,\nCVE-2025-40273, CVE-2025-40275, CVE-2025-40277, CVE-2025-40278,\nCVE-2025-40279, CVE-2025-40280, CVE-2025-40281, CVE-2025-40282,\nCVE-2025-40283, CVE-2025-40284, CVE-2025-40285, CVE-2025-40286,\nCVE-2025-40287, CVE-2025-40288, CVE-2025-40289, CVE-2025-40292,\nCVE-2025-40293, CVE-2025-40294, CVE-2025-40301, CVE-2025-40303,\nCVE-2025-40304, CVE-2025-40305, CVE-2025-40306, CVE-2025-40307,\nCVE-2025-40308, CVE-2025-40309, CVE-2025-40310, CVE-2025-40311,\nCVE-2025-40312, CVE-2025-40313, CVE-2025-40314, CVE-2025-40315,\nCVE-2025-40317, CVE-2025-40318, CVE-2025-40319, CVE-2025-40320,\nCVE-2025-40321, CVE-2025-40322, CVE-2025-40323, CVE-2025-40324,\nCVE-2025-40328, CVE-2025-40329, CVE-2025-40331, CVE-2025-40333,\nCVE-2025-40337, CVE-2025-40339, CVE-2025-40341, CVE-2025-40342,\nCVE-2025-40343, CVE-2025-40345, CVE-2025-40346, CVE-2025-40347,\nCVE-2025-40349, CVE-2025-40350, CVE-2025-40351, CVE-2025-40353,\nCVE-2025-40358, CVE-2025-40360, CVE-2025-40363, CVE-2025-68168,\nCVE-2025-68171, CVE-2025-68172, CVE-2025-68173, CVE-2025-68176,\nCVE-2025-68177, CVE-2025-68178, CVE-2025-68179, CVE-2025-68180,\nCVE-2025-68183, CVE-2025-68184, CVE-2025-68185, CVE-2025-68190,\nCVE-2025-68191, CVE-2025-68192, CVE-2025-68194, CVE-2025-68198,\nCVE-2025-68200, CVE-2025-68201, CVE-2025-68204, CVE-2025-68208,\nCVE-2025-68213, CVE-2025-68214, CVE-2025-68217, CVE-2025-68218,\nCVE-2025-68219, CVE-2025-68220, CVE-2025-68222, CVE-2025-68223,\nCVE-2025-68227, CVE-2025-68229, CVE-2025-68231, CVE-2025-68233,\nCVE-2025-68235, CVE-2025-68237, CVE-2025-68238, CVE-2025-68241,\nCVE-2025-68244, CVE-2025-68245, CVE-2025-68246, CVE-2025-68249,\nCVE-2025-68282, CVE-2025-68283, CVE-2025-68284, CVE-2025-68285,\nCVE-2025-68286, CVE-2025-68287, CVE-2025-68288, CVE-2025-68289,\nCVE-2025-68290, CVE-2025-68295, CVE-2025-68297, CVE-2025-68301,\nCVE-2025-68302, CVE-2025-68303, CVE-2025-68305, CVE-2025-68307,\nCVE-2025-68308, CVE-2025-68310, CVE-2025-68311, CVE-2025-68312,\nCVE-2025-68313, CVE-2025-68315, CVE-2025-68320, CVE-2025-68321,\nCVE-2025-68322, CVE-2025-68327, CVE-2025-68328, CVE-2025-68330,\nCVE-2025-68331, CVE-2025-68339, CVE-2025-68340, CVE-2025-68342,\nCVE-2025-68343, CVE-2025-68734)\n","status":"published","published":"2026-03-25T19:11:40Z","modified":"2026-11-03T14:35:10.177253555Z","updated_at":"2026-11-03T15:16:30.201391Z"},{"id":"USN-8126-1","title":"linux-azure-6.8 vulnerabilities","description":"Qualys discovered that several vulnerabilities existed in the AppArmor\nLinux kernel Security Module (LSM). An unprivileged local attacker could\nuse these issues to load, replace, and remove arbitrary AppArmor profiles\ncausing denial of service, exposure of sensitive information (kernel\nmemory), local privilege escalation, or possibly escape a container.\n(LP: #2143853)\n\nIt was discovered that improper initialization of CPU cache memory could\nallow a local attacker with hypervisor access to overwrite SEV-SNP guest\nmemory resulting in loss of data integrity. (CVE-2024-36331)\n\nOleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos,\nand Flavien Solt discovered that some AMD processors may allow an attacker\nto infer data from previous stores, potentially resulting in the leakage of\nprivileged information. A local attacker could possibly use this to expose\nsensitive information. (CVE-2024-36350, CVE-2024-36357)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM32 architecture;\n  - ARM64 architecture;\n  - MIPS architecture;\n  - Nios II architecture;\n  - PA-RISC architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - Sun Sparc architecture;\n  - User-Mode Linux (UML);\n  - x86 architecture;\n  - Xtensa architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - Serial ATA and Parallel ATA drivers;\n  - ATM drivers;\n  - Drivers core;\n  - ATA over ethernet (AOE) driver;\n  - DRBD Distributed Replicated Block Device drivers;\n  - Block device driver;\n  - Network block device driver;\n  - Ublk userspace block driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Hardware random number generator core;\n  - Character device driver;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - Buffer Sharing and Synchronization framework;\n  - DMA engine subsystem;\n  - EDAC drivers;\n  - Arm Firmware Framework for ARMv8-A(FFA);\n  - ARM SCMI message protocol;\n  - EFI core;\n  - Intel Stratix 10 firmware drivers;\n  - FPGA Framework;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - CoreSight HW tracing drivers;\n  - I2C subsystem;\n  - I3C subsystem;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - Input Device (Tablet) drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - ISDN/mISDN subsystem;\n  - Mailbox framework;\n  - MCB driver;\n  - Multiple devices driver;\n  - Media drivers;\n  - Multifunction device drivers;\n  - Fastrpc Driver;\n  - Microchip PCI driver;\n  - Intel Management Engine Interface driver;\n  - PCI Endpoint Test driver;\n  - TI TPS6594 PFSM driver;\n  - VMware VMCI Driver;\n  - MMC subsystem;\n  - MOST (Media Oriented Systems Transport) drivers;\n  - MTD block device drivers;\n  - Ethernet bonding driver;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - Texas Instruments network drivers;\n  - Ethernet team driver;\n  - MediaTek network drivers;\n  - NVDIMM (Non-Volatile Memory Device) drivers;\n  - NVME drivers;\n  - PCI subsystem;\n  - PCCARD (PCMCIA/CardBus) bus subsystem;\n  - Amlogic Meson DDR PMU;\n  - Performance monitor drivers;\n  - PHY drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - ARM PM domains;\n  - Power supply drivers;\n  - Powercap sysfs driver;\n  - PPS (Pulse Per Second) driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - RapidIO drivers;\n  - Voltage and Current Regulator drivers;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - ASPEED SoC drivers;\n  - QCOM SoC drivers;\n  - Samsung SoC drivers;\n  - Texas Instruments SoC drivers;\n  - SPI subsystem;\n  - small TFT LCD display modules;\n  - Media staging drivers;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - Thunderbolt and USB4 drivers;\n  - TTY drivers;\n  - UFS subsystem;\n  - Userspace I/O drivers;\n  - Cadence USB3 driver;\n  - ChipIdea USB driver;\n  - USB Device Class drivers;\n  - USB core drivers;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Renesas USBHS Controller drivers;\n  - USB Mass Storage drivers;\n  - USB Type-C support driver;\n  - USB Type-C Connector System Software Interface driver;\n  - VFIO drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Backlight driver;\n  - Framebuffer layer;\n  - TSM Common Guest driver;\n  - Virtio drivers;\n  - Xen hypervisor drivers;\n  - AFS file system;\n  - File systems infrastructure;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EFI Variable file system;\n  - exFAT file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - GFS2 file system;\n  - HFS file system;\n  - HFS+ file system;\n  - HugeTLB file system;\n  - Journaling layer for block devices (JBD2);\n  - JFFS2 file system;\n  - JFS file system;\n  - KERNFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - NILFS2 file system;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - OrangeFS file system;\n  - Overlay file system;\n  - Proc file system;\n  - Diskquota system;\n  - SMB network file system;\n  - SquashFS file system;\n  - UDF file system;\n  - XFS file system;\n  - DRM display driver;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - BPF subsystem;\n  - Memory Management;\n  - Internal shared memory driver;\n  - LZO compression library;\n  - Mellanox drivers;\n  - NFS page cache wrapper;\n  - padata parallel execution mechanism;\n  - Memory management;\n  - Networking subsytem;\n  - Media input infrastructure;\n  - Bluetooth subsystem;\n  - IP tunnels definitions;\n  - Netfilter;\n  - Network traffic control;\n  - Rose network layer;\n  - SCTP protocol;\n  - Network sockets;\n  - UDP network protocol;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Digital Audio (PCM) driver;\n  - Universal MIDI packet (UMP) support module;\n  - Tracing infrastructure;\n  - User-space API (UAPI);\n  - io_uring subsystem;\n  - IPC subsystem;\n  - Control group (cgroup);\n  - Kernel crash support code;\n  - Perf events;\n  - Kernel exit() syscall;\n  - Kernel futex primitives;\n  - IRQ subsystem;\n  - Padata parallel execution mechanism;\n  - Kernel command line parsing driver;\n  - PID allocator;\n  - Hibernation control;\n  - RCU subsystem;\n  - Restartable seuqences system call mechanism;\n  - Scheduler infrastructure;\n  - Syscalls implementation;\n  - Timer subsystem;\n  - Maple Tree data structure library;\n  - KASAN memory debugging framework;\n  - 802.1Q VLAN protocol;\n  - 9P file system network protocol;\n  - Appletalk network protocol;\n  - Amateur Radio drivers;\n  - B.A.T.M.A.N. meshing protocol;\n  - Ethernet bridge;\n  - CAN network layer;\n  - Ceph Core library;\n  - Networking core;\n  - Devlink API;\n  - Distributed Switch Architecture;\n  - HSR network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Management Component Transport Protocol (MCTP);\n  - MultiProtocol Label Switching driver;\n  - Multipath TCP;\n  - NetLabel subsystem;\n  - Netlink;\n  - NFC subsystem;\n  - Open vSwitch;\n  - RDS protocol;\n  - RF switch subsystem;\n  - RxRPC session sockets;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - Unix domain sockets;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - Integrity Measurement Architecture(IMA) framework;\n  - ALSA framework;\n  - WCD audio codecs;\n  - Intel ASoC drivers;\n  - MediaTek ASoC drivers;\n  - QCOM ASoC drivers;\n  - SoC audio core drivers;\n  - USB sound devices;\n  - Virtio sound driver;\n  - CPU Power monitoring subsystem;\n  - KVM subsystem;\n(CVE-2025-21833, CVE-2025-21884, CVE-2025-21931, CVE-2025-22026,\nCVE-2025-22037, CVE-2025-22101, CVE-2025-22102, CVE-2025-22103,\nCVE-2025-22105, CVE-2025-22106, CVE-2025-22107, CVE-2025-22113,\nCVE-2025-22115, CVE-2025-22120, CVE-2025-22121, CVE-2025-22124,\nCVE-2025-22125, CVE-2025-22126, CVE-2025-22128, CVE-2025-23129,\nCVE-2025-23130, CVE-2025-23133, CVE-2025-23140, CVE-2025-23141,\nCVE-2025-23142, CVE-2025-23143, CVE-2025-23144, CVE-2025-23145,\nCVE-2025-23146, CVE-2025-23147, CVE-2025-23148, CVE-2025-23149,\nCVE-2025-23150, CVE-2025-23151, CVE-2025-23155, CVE-2025-23156,\nCVE-2025-23157, CVE-2025-23158, CVE-2025-23159, CVE-2025-23160,\nCVE-2025-23161, CVE-2025-23163, CVE-2025-37738, CVE-2025-37739,\nCVE-2025-37740, CVE-2025-37741, CVE-2025-37742, CVE-2025-37744,\nCVE-2025-37745, CVE-2025-37748, CVE-2025-37749, CVE-2025-37754,\nCVE-2025-37755, CVE-2025-37757, CVE-2025-37758, CVE-2025-37759,\nCVE-2025-37761, CVE-2025-37763, CVE-2025-37764, CVE-2025-37765,\nCVE-2025-37766, CVE-2025-37767, CVE-2025-37768, CVE-2025-37769,\nCVE-2025-37770, CVE-2025-37771, CVE-2025-37772, CVE-2025-37773,\nCVE-2025-37775, CVE-2025-37777, CVE-2025-37778, CVE-2025-37780,\nCVE-2025-37781, CVE-2025-37784, CVE-2025-37786, CVE-2025-37787,\nCVE-2025-37788, CVE-2025-37789, CVE-2025-37790, CVE-2025-37792,\nCVE-2025-37793, CVE-2025-37794, CVE-2025-37796, CVE-2025-37799,\nCVE-2025-37800, CVE-2025-37801, CVE-2025-37803, CVE-2025-37805,\nCVE-2025-37808, CVE-2025-37809, CVE-2025-37810, CVE-2025-37811,\nCVE-2025-37812, CVE-2025-37813, CVE-2025-37815, CVE-2025-37816,\nCVE-2025-37817, CVE-2025-37819, CVE-2025-37820, CVE-2025-37822,\nCVE-2025-37823, CVE-2025-37824, CVE-2025-37826, CVE-2025-37827,\nCVE-2025-37828, CVE-2025-37829, CVE-2025-37830, CVE-2025-37831,\nCVE-2025-37836, CVE-2025-37839, CVE-2025-37840, CVE-2025-37841,\nCVE-2025-37842, CVE-2025-37844, CVE-2025-37846, CVE-2025-37849,\nCVE-2025-37850, CVE-2025-37851, CVE-2025-37852, CVE-2025-37853,\nCVE-2025-37854, CVE-2025-37856, CVE-2025-37857, CVE-2025-37858,\nCVE-2025-37859, CVE-2025-37860, CVE-2025-37861, CVE-2025-37862,\nCVE-2025-37863, CVE-2025-37864, CVE-2025-37865, CVE-2025-37867,\nCVE-2025-37869, CVE-2025-37871, CVE-2025-37872, CVE-2025-37873,\nCVE-2025-37874, CVE-2025-37875, CVE-2025-37878, CVE-2025-37879,\nCVE-2025-37881, CVE-2025-37883, CVE-2025-37884, CVE-2025-37885,\nCVE-2025-37886, CVE-2025-37887, CVE-2025-37891, CVE-2025-37892,\nCVE-2025-37897, CVE-2025-37899, CVE-2025-37900, CVE-2025-37901,\nCVE-2025-37903, CVE-2025-37905, CVE-2025-37909, CVE-2025-37911,\nCVE-2025-37912, CVE-2025-37913, CVE-2025-37914, CVE-2025-37915,\nCVE-2025-37916, CVE-2025-37917, CVE-2025-37918, CVE-2025-37920,\nCVE-2025-37921, CVE-2025-37922, CVE-2025-37923, CVE-2025-37924,\nCVE-2025-37925, CVE-2025-37927, CVE-2025-37928, CVE-2025-37930,\nCVE-2025-37931, CVE-2025-37933, CVE-2025-37935, CVE-2025-37936,\nCVE-2025-37938, CVE-2025-37940, CVE-2025-37943, CVE-2025-37944,\nCVE-2025-37945, CVE-2025-37947, CVE-2025-37948, CVE-2025-37949,\nCVE-2025-37951, CVE-2025-37952, CVE-2025-37956, CVE-2025-37957,\nCVE-2025-37959, CVE-2025-37960, CVE-2025-37961, CVE-2025-37962,\nCVE-2025-37963, CVE-2025-37967, CVE-2025-37968, CVE-2025-37969,\nCVE-2025-37970, CVE-2025-37972, CVE-2025-37973, CVE-2025-37975,\nCVE-2025-37977, CVE-2025-37978, CVE-2025-37979, CVE-2025-37980,\nCVE-2025-37982, CVE-2025-37983, CVE-2025-37984, CVE-2025-37985,\nCVE-2025-37986, CVE-2025-37987, CVE-2025-37988, CVE-2025-37989,\nCVE-2025-37990, CVE-2025-37991, CVE-2025-37992, CVE-2025-37994,\nCVE-2025-37995, CVE-2025-37998, CVE-2025-38003, CVE-2025-38004,\nCVE-2025-38005, CVE-2025-38006, CVE-2025-38007, CVE-2025-38008,\nCVE-2025-38009, CVE-2025-38010, CVE-2025-38011, CVE-2025-38013,\nCVE-2025-38014, CVE-2025-38015, CVE-2025-38018, CVE-2025-38019,\nCVE-2025-38020, CVE-2025-38023, CVE-2025-38024, CVE-2025-38027,\nCVE-2025-38031, CVE-2025-38034, CVE-2025-38035, CVE-2025-38037,\nCVE-2025-38039, CVE-2025-38040, CVE-2025-38043, CVE-2025-38044,\nCVE-2025-38045, CVE-2025-38048, CVE-2025-38051, CVE-2025-38052,\nCVE-2025-38053, CVE-2025-38055, CVE-2025-38057, CVE-2025-38058,\nCVE-2025-38059, CVE-2025-38060, CVE-2025-38061, CVE-2025-38062,\nCVE-2025-38063, CVE-2025-38065, CVE-2025-38066, CVE-2025-38067,\nCVE-2025-38068, CVE-2025-38071, CVE-2025-38072, CVE-2025-38074,\nCVE-2025-38075, CVE-2025-38077, CVE-2025-38078, CVE-2025-38079,\nCVE-2025-38080, CVE-2025-38081, CVE-2025-38084, CVE-2025-38085,\nCVE-2025-38086, CVE-2025-38087, CVE-2025-38088, CVE-2025-38089,\nCVE-2025-38090, CVE-2025-38094, CVE-2025-38095, CVE-2025-38097,\nCVE-2025-38098, CVE-2025-38099, CVE-2025-38100, CVE-2025-38101,\nCVE-2025-38102, CVE-2025-38103, CVE-2025-38104, CVE-2025-38105,\nCVE-2025-38107, CVE-2025-38108, CVE-2025-38109, CVE-2025-38110,\nCVE-2025-38111, CVE-2025-38112, CVE-2025-38113, CVE-2025-38115,\nCVE-2025-38117, CVE-2025-38119, CVE-2025-38120, CVE-2025-38122,\nCVE-2025-38123, CVE-2025-38124, CVE-2025-38125, CVE-2025-38126,\nCVE-2025-38127, CVE-2025-38129, CVE-2025-38131, CVE-2025-38135,\nCVE-2025-38136, CVE-2025-38138, CVE-2025-38142, CVE-2025-38143,\nCVE-2025-38145, CVE-2025-38146, CVE-2025-38147, CVE-2025-38148,\nCVE-2025-38149, CVE-2025-38153, CVE-2025-38154, CVE-2025-38155,\nCVE-2025-38156, CVE-2025-38157, CVE-2025-38158, CVE-2025-38159,\nCVE-2025-38160, CVE-2025-38161, CVE-2025-38162, CVE-2025-38163,\nCVE-2025-38164, CVE-2025-38165, CVE-2025-38166, CVE-2025-38167,\nCVE-2025-38169, CVE-2025-38170, CVE-2025-38173, CVE-2025-38174,\nCVE-2025-38180, CVE-2025-38181, CVE-2025-38182, CVE-2025-38183,\nCVE-2025-38184, CVE-2025-38185, CVE-2025-38190, CVE-2025-38191,\nCVE-2025-38192, CVE-2025-38193, CVE-2025-38194, CVE-2025-38197,\nCVE-2025-38198, CVE-2025-38200, CVE-2025-38202, CVE-2025-38208,\nCVE-2025-38210, CVE-2025-38211, CVE-2025-38212, CVE-2025-38214,\nCVE-2025-38215, CVE-2025-38217, CVE-2025-38218, CVE-2025-38219,\nCVE-2025-38220, CVE-2025-38222, CVE-2025-38225, CVE-2025-38226,\nCVE-2025-38229, CVE-2025-38230, CVE-2025-38231, CVE-2025-38232,\nCVE-2025-38236, CVE-2025-38239, CVE-2025-38245, CVE-2025-38246,\nCVE-2025-38248, CVE-2025-38249, CVE-2025-38250, CVE-2025-38251,\nCVE-2025-38253, CVE-2025-38255, CVE-2025-38257, CVE-2025-38258,\nCVE-2025-38259, CVE-2025-38260, CVE-2025-38262, CVE-2025-38263,\nCVE-2025-38264, CVE-2025-38265, CVE-2025-38269, CVE-2025-38274,\nCVE-2025-38275, CVE-2025-38277, CVE-2025-38278, CVE-2025-38279,\nCVE-2025-38280, CVE-2025-38282, CVE-2025-38283, CVE-2025-38285,\nCVE-2025-38286, CVE-2025-38289, CVE-2025-38290, CVE-2025-38292,\nCVE-2025-38293, CVE-2025-38295, CVE-2025-38298, CVE-2025-38299,\nCVE-2025-38300, CVE-2025-38303, CVE-2025-38304, CVE-2025-38305,\nCVE-2025-38307, CVE-2025-38310, CVE-2025-38312, CVE-2025-38313,\nCVE-2025-38319, CVE-2025-38320, CVE-2025-38321, CVE-2025-38322,\nCVE-2025-38323, CVE-2025-38324, CVE-2025-38326, CVE-2025-38328,\nCVE-2025-38331, CVE-2025-38332, CVE-2025-38333, CVE-2025-38334,\nCVE-2025-38335, CVE-2025-38336, CVE-2025-38337, CVE-2025-38338,\nCVE-2025-38342, CVE-2025-38343, CVE-2025-38344, CVE-2025-38345,\nCVE-2025-38346, CVE-2025-38347, CVE-2025-38348, CVE-2025-38349,\nCVE-2025-38351, CVE-2025-38354, CVE-2025-38361, CVE-2025-38362,\nCVE-2025-38363, CVE-2025-38364, CVE-2025-38365, CVE-2025-38368,\nCVE-2025-38369, CVE-2025-38371, CVE-2025-38373, CVE-2025-38374,\nCVE-2025-38375, CVE-2025-38376, CVE-2025-38377, CVE-2025-38382,\nCVE-2025-38384, CVE-2025-38385, CVE-2025-38386, CVE-2025-38387,\nCVE-2025-38388, CVE-2025-38389, CVE-2025-38390, CVE-2025-38391,\nCVE-2025-38392, CVE-2025-38393, CVE-2025-38395, CVE-2025-38396,\nCVE-2025-38399, CVE-2025-38400, CVE-2025-38401, CVE-2025-38402,\nCVE-2025-38403, CVE-2025-38405, CVE-2025-38406, CVE-2025-38407,\nCVE-2025-38408, CVE-2025-38409, CVE-2025-38410, CVE-2025-38412,\nCVE-2025-38414, CVE-2025-38415, CVE-2025-38416, CVE-2025-38418,\nCVE-2025-38419, CVE-2025-38420, CVE-2025-38422, CVE-2025-38424,\nCVE-2025-38425, CVE-2025-38427, CVE-2025-38428, CVE-2025-38429,\nCVE-2025-38430, CVE-2025-38436, CVE-2025-38437, CVE-2025-38439,\nCVE-2025-38441, CVE-2025-38443, CVE-2025-38444, CVE-2025-38445,\nCVE-2025-38448, CVE-2025-38449, CVE-2025-38455, CVE-2025-38456,\nCVE-2025-38457, CVE-2025-38458, CVE-2025-38459, CVE-2025-38460,\nCVE-2025-38461, CVE-2025-38462, CVE-2025-38463, CVE-2025-38464,\nCVE-2025-38465, CVE-2025-38466, CVE-2025-38467, CVE-2025-38468,\nCVE-2025-38469, CVE-2025-38470, CVE-2025-38471, CVE-2025-38472,\nCVE-2025-38473, CVE-2025-38474, CVE-2025-38476, CVE-2025-38478,\nCVE-2025-38480, CVE-2025-38481, CVE-2025-38482, CVE-2025-38483,\nCVE-2025-38485, CVE-2025-38487, CVE-2025-38488, CVE-2025-38489,\nCVE-2025-38490, CVE-2025-38491, CVE-2025-38493, CVE-2025-38494,\nCVE-2025-38495, CVE-2025-38496, CVE-2025-38497, CVE-2025-38499,\nCVE-2025-38501, CVE-2025-38502, CVE-2025-38503, CVE-2025-38506,\nCVE-2025-38507, CVE-2025-38510, CVE-2025-38511, CVE-2025-38512,\nCVE-2025-38513, CVE-2025-38514, CVE-2025-38515, CVE-2025-38516,\nCVE-2025-38520, CVE-2025-38521, CVE-2025-38524, CVE-2025-38526,\nCVE-2025-38527, CVE-2025-38528, CVE-2025-38529, CVE-2025-38530,\nCVE-2025-38531, CVE-2025-38532, CVE-2025-38533, CVE-2025-38535,\nCVE-2025-38537, CVE-2025-38538, CVE-2025-38539, CVE-2025-38540,\nCVE-2025-38542, CVE-2025-38543, CVE-2025-38544, CVE-2025-38546,\nCVE-2025-38548, CVE-2025-38549, CVE-2025-38550, CVE-2025-38551,\nCVE-2025-38552, CVE-2025-38553, CVE-2025-38555, CVE-2025-38556,\nCVE-2025-38560, CVE-2025-38561, CVE-2025-38562, CVE-2025-38566,\nCVE-2025-38568, CVE-2025-38569, CVE-2025-38571, CVE-2025-38572,\nCVE-2025-38574, CVE-2025-38576, CVE-2025-38577, CVE-2025-38578,\nCVE-2025-38579, CVE-2025-38581, CVE-2025-38582, CVE-2025-38583,\nCVE-2025-38584, CVE-2025-38585, CVE-2025-38587, CVE-2025-38588,\nCVE-2025-38590, CVE-2025-38593, CVE-2025-38595, CVE-2025-38601,\nCVE-2025-38602, CVE-2025-38604, CVE-2025-38608, CVE-2025-38609,\nCVE-2025-38610, CVE-2025-38612, CVE-2025-38614, CVE-2025-38615,\nCVE-2025-38619, CVE-2025-38622, CVE-2025-38623, CVE-2025-38624,\nCVE-2025-38625, CVE-2025-38626, CVE-2025-38627, CVE-2025-38630,\nCVE-2025-38632, CVE-2025-38634, CVE-2025-38635, CVE-2025-38639,\nCVE-2025-38640, CVE-2025-38643, CVE-2025-38644, CVE-2025-38645,\nCVE-2025-38646, CVE-2025-38648, CVE-2025-38650, CVE-2025-38652,\nCVE-2025-38653, CVE-2025-38659, CVE-2025-38660, CVE-2025-38663,\nCVE-2025-38664, CVE-2025-38665, CVE-2025-38668, CVE-2025-38670,\nCVE-2025-38671, CVE-2025-38675, CVE-2025-38676, CVE-2025-38677,\nCVE-2025-38679, CVE-2025-38680, CVE-2025-38681, CVE-2025-38684,\nCVE-2025-38685, CVE-2025-38686, CVE-2025-38687, CVE-2025-38688,\nCVE-2025-38691, CVE-2025-38692, CVE-2025-38693, CVE-2025-38694,\nCVE-2025-38695, CVE-2025-38696, CVE-2025-38697, CVE-2025-38698,\nCVE-2025-38699, CVE-2025-38700, CVE-2025-38701, CVE-2025-38702,\nCVE-2025-38703, CVE-2025-38704, CVE-2025-38705, CVE-2025-38706,\nCVE-2025-38707, CVE-2025-38708, CVE-2025-38709, CVE-2025-38710,\nCVE-2025-38711, CVE-2025-38712, CVE-2025-38713, CVE-2025-38714,\nCVE-2025-38715, CVE-2025-38716, CVE-2025-38718, CVE-2025-38721,\nCVE-2025-38722, CVE-2025-38724, CVE-2025-38725, CVE-2025-38728,\nCVE-2025-38729, CVE-2025-38730, CVE-2025-38732, CVE-2025-38734,\nCVE-2025-38735, CVE-2025-39673, CVE-2025-39675, CVE-2025-39676,\nCVE-2025-39678, CVE-2025-39679, CVE-2025-39681, CVE-2025-39683,\nCVE-2025-39684, CVE-2025-39685, CVE-2025-39686, CVE-2025-39687,\nCVE-2025-39689, CVE-2025-39691, CVE-2025-39692, CVE-2025-39693,\nCVE-2025-39694, CVE-2025-39697, CVE-2025-39698, CVE-2025-39701,\nCVE-2025-39702, CVE-2025-39703, CVE-2025-39705, CVE-2025-39706,\nCVE-2025-39707, CVE-2025-39709, CVE-2025-39710, CVE-2025-39711,\nCVE-2025-39712, CVE-2025-39713, CVE-2025-39714, CVE-2025-39715,\nCVE-2025-39716, CVE-2025-39718, CVE-2025-39719, CVE-2025-39720,\nCVE-2025-39721, CVE-2025-39724, CVE-2025-39726, CVE-2025-39730,\nCVE-2025-39731, CVE-2025-39732, CVE-2025-39734, CVE-2025-39736,\nCVE-2025-39737, CVE-2025-39738, CVE-2025-39739, CVE-2025-39742,\nCVE-2025-39743, CVE-2025-39744, CVE-2025-39746, CVE-2025-39747,\nCVE-2025-39748, CVE-2025-39749, CVE-2025-39750, CVE-2025-39752,\nCVE-2025-39753, CVE-2025-39756, CVE-2025-39757, CVE-2025-39758,\nCVE-2025-39759, CVE-2025-39760, CVE-2025-39761, CVE-2025-39763,\nCVE-2025-39766, CVE-2025-39770, CVE-2025-39772, CVE-2025-39773,\nCVE-2025-39776, CVE-2025-39779, CVE-2025-39781, CVE-2025-39782,\nCVE-2025-39783, CVE-2025-39787, CVE-2025-39788, CVE-2025-39790,\nCVE-2025-39794, CVE-2025-39795, CVE-2025-39797, CVE-2025-39798,\nCVE-2025-39800, CVE-2025-39801, CVE-2025-39805, CVE-2025-39806,\nCVE-2025-39807, CVE-2025-39808, CVE-2025-39810, CVE-2025-39811,\nCVE-2025-39812, CVE-2025-39813, CVE-2025-39815, CVE-2025-39817,\nCVE-2025-39819, CVE-2025-39823, CVE-2025-39824, CVE-2025-39825,\nCVE-2025-39826, CVE-2025-39827, CVE-2025-39828, CVE-2025-39829,\nCVE-2025-39832, CVE-2025-39835, CVE-2025-39836, CVE-2025-39838,\nCVE-2025-39839, CVE-2025-39841, CVE-2025-39842, CVE-2025-39843,\nCVE-2025-39844, CVE-2025-39845, CVE-2025-39846, CVE-2025-39847,\nCVE-2025-39848, CVE-2025-39849, CVE-2025-39850, CVE-2025-39851,\nCVE-2025-39852, CVE-2025-39853, CVE-2025-39854, CVE-2025-39857,\nCVE-2025-39860, CVE-2025-39861, CVE-2025-39863, CVE-2025-39864,\nCVE-2025-39865, CVE-2025-39866, CVE-2025-39869, CVE-2025-39870,\nCVE-2025-39871, CVE-2025-39873, CVE-2025-39876, CVE-2025-39877,\nCVE-2025-39880, CVE-2025-39881, CVE-2025-39883, CVE-2025-39885,\nCVE-2025-39886, CVE-2025-39889, CVE-2025-39890, CVE-2025-39891,\nCVE-2025-39894, CVE-2025-39895, CVE-2025-39897, CVE-2025-39899,\nCVE-2025-39901, CVE-2025-39902, CVE-2025-39907, CVE-2025-39909,\nCVE-2025-39911, CVE-2025-39913, CVE-2025-39914, CVE-2025-39916,\nCVE-2025-39920, CVE-2025-39923, CVE-2025-39927, CVE-2025-39929,\nCVE-2025-39931, CVE-2025-39932, CVE-2025-39934, CVE-2025-39937,\nCVE-2025-39938, CVE-2025-39940, CVE-2025-39942, CVE-2025-39943,\nCVE-2025-39944, CVE-2025-39945, CVE-2025-39946, CVE-2025-39947,\nCVE-2025-39948, CVE-2025-39949, CVE-2025-39950, CVE-2025-39951,\nCVE-2025-39952, CVE-2025-39953, CVE-2025-39955, CVE-2025-39957,\nCVE-2025-39961, CVE-2025-39965, CVE-2025-39967, CVE-2025-39968,\nCVE-2025-39969, CVE-2025-39970, CVE-2025-39971, CVE-2025-39972,\nCVE-2025-39973, CVE-2025-39977, CVE-2025-39978, CVE-2025-39980,\nCVE-2025-39981, CVE-2025-39982, CVE-2025-39985, CVE-2025-39986,\nCVE-2025-39987, CVE-2025-39988, CVE-2025-39989, CVE-2025-39991,\nCVE-2025-39992, CVE-2025-39994, CVE-2025-39995, CVE-2025-39996,\nCVE-2025-39998, CVE-2025-40000, CVE-2025-40001, CVE-2025-40006,\nCVE-2025-40008, CVE-2025-40009, CVE-2025-40010, CVE-2025-40011,\nCVE-2025-40013, CVE-2025-40016, CVE-2025-40019, CVE-2025-40020,\nCVE-2025-40021, CVE-2025-40024, CVE-2025-40026, CVE-2025-40027,\nCVE-2025-40029, CVE-2025-40030, CVE-2025-40031, CVE-2025-40032,\nCVE-2025-40033, CVE-2025-40035, CVE-2025-40036, CVE-2025-40037,\nCVE-2025-40038, CVE-2025-40042, CVE-2025-40043, CVE-2025-40044,\nCVE-2025-40047, CVE-2025-40048, CVE-2025-40049, CVE-2025-40051,\nCVE-2025-40052, CVE-2025-40053, CVE-2025-40055, CVE-2025-40056,\nCVE-2025-40057, CVE-2025-40058, CVE-2025-40059, CVE-2025-40060,\nCVE-2025-40061, CVE-2025-40062, CVE-2025-40067, CVE-2025-40068,\nCVE-2025-40070, CVE-2025-40071, CVE-2025-40077, CVE-2025-40078,\nCVE-2025-40079, CVE-2025-40080, CVE-2025-40081, CVE-2025-40083,\nCVE-2025-40084, CVE-2025-40085, CVE-2025-40087, CVE-2025-40088,\nCVE-2025-40092, CVE-2025-40093, CVE-2025-40094, CVE-2025-40095,\nCVE-2025-40096, CVE-2025-40099, CVE-2025-40100, CVE-2025-40101,\nCVE-2025-40103, CVE-2025-40104, CVE-2025-40105, CVE-2025-40106,\nCVE-2025-40107, CVE-2025-40109, CVE-2025-40110, CVE-2025-40111,\nCVE-2025-40112, CVE-2025-40115, CVE-2025-40116, CVE-2025-40118,\nCVE-2025-40120, CVE-2025-40121, CVE-2025-40123, CVE-2025-40124,\nCVE-2025-40125, CVE-2025-40126, CVE-2025-40127, CVE-2025-40129,\nCVE-2025-40134, CVE-2025-40137, CVE-2025-40140, CVE-2025-40141,\nCVE-2025-40153, CVE-2025-40154, CVE-2025-40155, CVE-2025-40156,\nCVE-2025-40159, CVE-2025-40160, CVE-2025-40165, CVE-2025-40166,\nCVE-2025-40167, CVE-2025-40169, CVE-2025-40171, CVE-2025-40172,\nCVE-2025-40173, CVE-2025-40176, CVE-2025-40178, CVE-2025-40179,\nCVE-2025-40180, CVE-2025-40183, CVE-2025-40187, CVE-2025-40188,\nCVE-2025-40192, CVE-2025-40193, CVE-2025-40194, CVE-2025-40196,\nCVE-2025-40198, CVE-2025-40200, CVE-2025-40201, CVE-2025-40202,\nCVE-2025-40204, CVE-2025-40205, CVE-2025-40206, CVE-2025-40207,\nCVE-2025-40211, CVE-2025-40215, CVE-2025-40218, CVE-2025-40219,\nCVE-2025-40220, CVE-2025-40221, CVE-2025-40223, CVE-2025-40226,\nCVE-2025-40231, CVE-2025-40233, CVE-2025-40235, CVE-2025-40237,\nCVE-2025-40238, CVE-2025-40240, CVE-2025-40242, CVE-2025-40243,\nCVE-2025-40244, CVE-2025-40245, CVE-2025-40248, CVE-2025-40250,\nCVE-2025-40251, CVE-2025-40252, CVE-2025-40253, CVE-2025-40254,\nCVE-2025-40257, CVE-2025-40258, CVE-2025-40259, CVE-2025-40261,\nCVE-2025-40262, CVE-2025-40263, CVE-2025-40264, CVE-2025-40266,\nCVE-2025-40268, CVE-2025-40269, CVE-2025-40271, CVE-2025-40272,\nCVE-2025-40273, CVE-2025-40275, CVE-2025-40277, CVE-2025-40278,\nCVE-2025-40279, CVE-2025-40280, CVE-2025-40281, CVE-2025-40282,\nCVE-2025-40283, CVE-2025-40284, CVE-2025-40285, CVE-2025-40286,\nCVE-2025-40287, CVE-2025-40288, CVE-2025-40289, CVE-2025-40292,\nCVE-2025-40293, CVE-2025-40294, CVE-2025-40297, CVE-2025-40301,\nCVE-2025-40303, CVE-2025-40304, CVE-2025-40305, CVE-2025-40306,\nCVE-2025-40307, CVE-2025-40308, CVE-2025-40309, CVE-2025-40310,\nCVE-2025-40311, CVE-2025-40312, CVE-2025-40313, CVE-2025-40314,\nCVE-2025-40315, CVE-2025-40317, CVE-2025-40318, CVE-2025-40319,\nCVE-2025-40320, CVE-2025-40321, CVE-2025-40322, CVE-2025-40323,\nCVE-2025-40324, CVE-2025-40328, CVE-2025-40329, CVE-2025-40331,\nCVE-2025-40333, CVE-2025-40337, CVE-2025-40339, CVE-2025-40341,\nCVE-2025-40342, CVE-2025-40343, CVE-2025-40345, CVE-2025-40346,\nCVE-2025-40347, CVE-2025-40349, CVE-2025-40350, CVE-2025-40351,\nCVE-2025-40353, CVE-2025-40358, CVE-2025-40360, CVE-2025-40363,\nCVE-2025-68168, CVE-2025-68171, CVE-2025-68172, CVE-2025-68173,\nCVE-2025-68176, CVE-2025-68177, CVE-2025-68178, CVE-2025-68179,\nCVE-2025-68180, CVE-2025-68183, CVE-2025-68184, CVE-2025-68185,\nCVE-2025-68190, CVE-2025-68191, CVE-2025-68192, CVE-2025-68194,\nCVE-2025-68198, CVE-2025-68200, CVE-2025-68201, CVE-2025-68204,\nCVE-2025-68208, CVE-2025-68213, CVE-2025-68214, CVE-2025-68217,\nCVE-2025-68218, CVE-2025-68219, CVE-2025-68220, CVE-2025-68222,\nCVE-2025-68223, CVE-2025-68227, CVE-2025-68229, CVE-2025-68231,\nCVE-2025-68233, CVE-2025-68235, CVE-2025-68237, CVE-2025-68238,\nCVE-2025-68241, CVE-2025-68244, CVE-2025-68245, CVE-2025-68246,\nCVE-2025-68249, CVE-2025-68282, CVE-2025-68283, CVE-2025-68284,\nCVE-2025-68285, CVE-2025-68286, CVE-2025-68287, CVE-2025-68288,\nCVE-2025-68289, CVE-2025-68290, CVE-2025-68295, CVE-2025-68297,\nCVE-2025-68301, CVE-2025-68302, CVE-2025-68303, CVE-2025-68305,\nCVE-2025-68307, CVE-2025-68308, CVE-2025-68310, CVE-2025-68311,\nCVE-2025-68312, CVE-2025-68313, CVE-2025-68315, CVE-2025-68320,\nCVE-2025-68321, CVE-2025-68322, CVE-2025-68327, CVE-2025-68328,\nCVE-2025-68330, CVE-2025-68331, CVE-2025-68339, CVE-2025-68340,\nCVE-2025-68342, CVE-2025-68343, CVE-2025-68734, CVE-2025-68750)\n","status":"published","published":"2026-03-25T19:13:52Z","modified":"2026-11-03T14:35:29.863770912Z","updated_at":"2026-11-03T15:16:14.724953Z"},{"id":"USN-8165-1","title":"linux-azure-fips vulnerabilities","description":"Qualys discovered that several vulnerabilities existed in the AppArmor\nLinux kernel Security Module (LSM). An unprivileged local attacker could\nuse these issues to load, replace, and remove arbitrary AppArmor profiles\ncausing denial of service, exposure of sensitive information (kernel\nmemory), local privilege escalation, or possibly escape a container.\n(LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403,\nCVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407,\nCVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - MIPS architecture;\n  - Nios II architecture;\n  - PA-RISC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - Sun Sparc architecture;\n  - User-Mode Linux (UML);\n  - x86 architecture;\n  - Xtensa architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - ATM drivers;\n  - Drivers core;\n  - Block device driver;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Hardware random number generator core;\n  - Character device driver;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - DMA engine subsystem;\n  - ARM SCMI message protocol;\n  - EFI core;\n  - Intel Stratix 10 firmware drivers;\n  - GPU drivers;\n  - HID subsystem;\n  - CoreSight HW tracing drivers;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - Input Device (Tablet) drivers;\n  - IOMMU subsystem;\n  - ISDN/mISDN subsystem;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - Fastrpc Driver;\n  - MOST (Media Oriented Systems Transport) drivers;\n  - MTD block device drivers;\n  - Ethernet bonding driver;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - Texas Instruments network drivers;\n  - Ethernet team driver;\n  - NVME drivers;\n  - PCI subsystem;\n  - PCCARD (PCMCIA/CardBus) bus subsystem;\n  - Performance monitor drivers;\n  - Pin controllers subsystem;\n  - x86 platform drivers;\n  - ARM PM domains;\n  - PPS (Pulse Per Second) driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - Texas Instruments SoC drivers;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - TTY drivers;\n  - Userspace I/O drivers;\n  - Cadence USB3 driver;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Renesas USBHS Controller drivers;\n  - USB Mass Storage drivers;\n  - Virtio Host (VHOST) subsystem;\n  - Framebuffer layer;\n  - Xen hypervisor drivers;\n  - AFS file system;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - File systems infrastructure;\n  - EFI Variable file system;\n  - exFAT file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - GFS2 file system;\n  - HFS file system;\n  - HFS+ file system;\n  - HugeTLB file system;\n  - JFS file system;\n  - KERNFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - OrangeFS file system;\n  - Proc file system;\n  - Diskquota system;\n  - SMB network file system;\n  - SquashFS file system;\n  - UDF file system;\n  - XFS file system;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - BPF subsystem;\n  - Mellanox drivers;\n  - NFS page cache wrapper;\n  - Memory management;\n  - Memory Management;\n  - Media input infrastructure;\n  - Bluetooth subsystem;\n  - IP tunnels definitions;\n  - Network traffic control;\n  - Rose network layer;\n  - Network sockets;\n  - io_uring subsystem;\n  - Control group (cgroup);\n  - Kernel crash support code;\n  - Kernel futex primitives;\n  - PID allocator;\n  - Scheduler infrastructure;\n  - Syscalls implementation;\n  - Timer subsystem;\n  - Tracing infrastructure;\n  - 9P file system network protocol;\n  - Amateur Radio drivers;\n  - B.A.T.M.A.N. meshing protocol;\n  - Ethernet bridge;\n  - Ceph Core library;\n  - Networking core;\n  - Devlink API;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NFC subsystem;\n  - Open vSwitch;\n  - RF switch subsystem;\n  - SCTP protocol;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Intel ASoC drivers;\n  - QCOM ASoC drivers;\n  - USB sound devices;\n(CVE-2025-21833, CVE-2025-22103, CVE-2025-22105, CVE-2025-22106,\nCVE-2025-22107, CVE-2025-22113, CVE-2025-22121, CVE-2025-22124,\nCVE-2025-22125, CVE-2025-23129, CVE-2025-23130, CVE-2025-23133,\nCVE-2025-23143, CVE-2025-37860, CVE-2025-38105, CVE-2025-38502,\nCVE-2025-38556, CVE-2025-38627, CVE-2025-38643, CVE-2025-38709,\nCVE-2025-39678, CVE-2025-39697, CVE-2025-39805, CVE-2025-39806,\nCVE-2025-39807, CVE-2025-39808, CVE-2025-39810, CVE-2025-39811,\nCVE-2025-39812, CVE-2025-39813, CVE-2025-39815, CVE-2025-39817,\nCVE-2025-39819, CVE-2025-39823, CVE-2025-39824, CVE-2025-39825,\nCVE-2025-39826, CVE-2025-39827, CVE-2025-39828, CVE-2025-39829,\nCVE-2025-39832, CVE-2025-39835, CVE-2025-39836, CVE-2025-39838,\nCVE-2025-39839, CVE-2025-39841, CVE-2025-39842, CVE-2025-39843,\nCVE-2025-39844, CVE-2025-39845, CVE-2025-39846, CVE-2025-39847,\nCVE-2025-39848, CVE-2025-39849, CVE-2025-39850, CVE-2025-39851,\nCVE-2025-39852, CVE-2025-39853, CVE-2025-39854, CVE-2025-39857,\nCVE-2025-39860, CVE-2025-39861, CVE-2025-39863, CVE-2025-39864,\nCVE-2025-39865, CVE-2025-39866, CVE-2025-39869, CVE-2025-39870,\nCVE-2025-39871, CVE-2025-39873, CVE-2025-39876, CVE-2025-39877,\nCVE-2025-39880, CVE-2025-39881, CVE-2025-39883, CVE-2025-39885,\nCVE-2025-39886, CVE-2025-39891, CVE-2025-39894, CVE-2025-39895,\nCVE-2025-39897, CVE-2025-39899, CVE-2025-39901, CVE-2025-39902,\nCVE-2025-39907, CVE-2025-39909, CVE-2025-39911, CVE-2025-39913,\nCVE-2025-39914, CVE-2025-39916, CVE-2025-39920, CVE-2025-39923,\nCVE-2025-39927, CVE-2025-39929, CVE-2025-39931, CVE-2025-39932,\nCVE-2025-39934, CVE-2025-39937, CVE-2025-39938, CVE-2025-39940,\nCVE-2025-39942, CVE-2025-39943, CVE-2025-39944, CVE-2025-39945,\nCVE-2025-39947, CVE-2025-39948, CVE-2025-39949, CVE-2025-39950,\nCVE-2025-39951, CVE-2025-39952, CVE-2025-39953, CVE-2025-39955,\nCVE-2025-39957, CVE-2025-39961, CVE-2025-39965, CVE-2025-39967,\nCVE-2025-39968, CVE-2025-39969, CVE-2025-39970, CVE-2025-39971,\nCVE-2025-39972, CVE-2025-39973, CVE-2025-39977, CVE-2025-39978,\nCVE-2025-39980, CVE-2025-39981, CVE-2025-39982, CVE-2025-39985,\nCVE-2025-39986, CVE-2025-39987, CVE-2025-39988, CVE-2025-39991,\nCVE-2025-39992, CVE-2025-39994, CVE-2025-39995, CVE-2025-39996,\nCVE-2025-39998, CVE-2025-40000, CVE-2025-40001, CVE-2025-40006,\nCVE-2025-40008, CVE-2025-40009, CVE-2025-40010, CVE-2025-40011,\nCVE-2025-40013, CVE-2025-40016, CVE-2025-40020, CVE-2025-40021,\nCVE-2025-40024, CVE-2025-40026, CVE-2025-40027, CVE-2025-40029,\nCVE-2025-40030, CVE-2025-40031, CVE-2025-40032, CVE-2025-40033,\nCVE-2025-40035, CVE-2025-40036, CVE-2025-40037, CVE-2025-40038,\nCVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40047,\nCVE-2025-40048, CVE-2025-40049, CVE-2025-40051, CVE-2025-40052,\nCVE-2025-40053, CVE-2025-40055, CVE-2025-40056, CVE-2025-40057,\nCVE-2025-40058, CVE-2025-40059, CVE-2025-40060, CVE-2025-40061,\nCVE-2025-40062, CVE-2025-40067, CVE-2025-40068, CVE-2025-40070,\nCVE-2025-40071, CVE-2025-40077, CVE-2025-40078, CVE-2025-40079,\nCVE-2025-40080, CVE-2025-40081, CVE-2025-40083, CVE-2025-40084,\nCVE-2025-40085, CVE-2025-40087, CVE-2025-40088, CVE-2025-40092,\nCVE-2025-40093, CVE-2025-40094, CVE-2025-40095, CVE-2025-40096,\nCVE-2025-40099, CVE-2025-40100, CVE-2025-40101, CVE-2025-40103,\nCVE-2025-40104, CVE-2025-40105, CVE-2025-40106, CVE-2025-40107,\nCVE-2025-40109, CVE-2025-40110, CVE-2025-40111, CVE-2025-40112,\nCVE-2025-40115, CVE-2025-40116, CVE-2025-40118, CVE-2025-40120,\nCVE-2025-40121, CVE-2025-40123, CVE-2025-40124, CVE-2025-40125,\nCVE-2025-40126, CVE-2025-40127, CVE-2025-40129, CVE-2025-40134,\nCVE-2025-40137, CVE-2025-40140, CVE-2025-40141, CVE-2025-40153,\nCVE-2025-40154, CVE-2025-40155, CVE-2025-40156, CVE-2025-40159,\nCVE-2025-40160, CVE-2025-40165, CVE-2025-40166, CVE-2025-40167,\nCVE-2025-40169, CVE-2025-40171, CVE-2025-40172, CVE-2025-40173,\nCVE-2025-40176, CVE-2025-40178, CVE-2025-40179, CVE-2025-40180,\nCVE-2025-40183, CVE-2025-40187, CVE-2025-40188, CVE-2025-40192,\nCVE-2025-40193, CVE-2025-40194, CVE-2025-40196, CVE-2025-40198,\nCVE-2025-40200, CVE-2025-40201, CVE-2025-40202, CVE-2025-40204,\nCVE-2025-40205, CVE-2025-40206, CVE-2025-40207, CVE-2025-40211,\nCVE-2025-40218, CVE-2025-40219, CVE-2025-40220, CVE-2025-40221,\nCVE-2025-40223, CVE-2025-40226, CVE-2025-40231, CVE-2025-40233,\nCVE-2025-40235, CVE-2025-40237, CVE-2025-40238, CVE-2025-40240,\nCVE-2025-40242, CVE-2025-40243, CVE-2025-40244, CVE-2025-40245,\nCVE-2025-40248, CVE-2025-40250, CVE-2025-40251, CVE-2025-40252,\nCVE-2025-40253, CVE-2025-40254, CVE-2025-40257, CVE-2025-40258,\nCVE-2025-40259, CVE-2025-40261, CVE-2025-40262, CVE-2025-40263,\nCVE-2025-40264, CVE-2025-40266, CVE-2025-40268, CVE-2025-40269,\nCVE-2025-40271, CVE-2025-40272, CVE-2025-40273, CVE-2025-40275,\nCVE-2025-40277, CVE-2025-40278, CVE-2025-40279, CVE-2025-40280,\nCVE-2025-40281, CVE-2025-40282, CVE-2025-40283, CVE-2025-40284,\nCVE-2025-40285, CVE-2025-40286, CVE-2025-40287, CVE-2025-40288,\nCVE-2025-40289, CVE-2025-40292, CVE-2025-40293, CVE-2025-40294,\nCVE-2025-40301, CVE-2025-40303, CVE-2025-40304, CVE-2025-40305,\nCVE-2025-40306, CVE-2025-40307, CVE-2025-40308, CVE-2025-40309,\nCVE-2025-40310, CVE-2025-40311, CVE-2025-40312, CVE-2025-40313,\nCVE-2025-40314, CVE-2025-40315, CVE-2025-40317, CVE-2025-40318,\nCVE-2025-40319, CVE-2025-40320, CVE-2025-40321, CVE-2025-40322,\nCVE-2025-40323, CVE-2025-40324, CVE-2025-40328, CVE-2025-40329,\nCVE-2025-40331, CVE-2025-40333, CVE-2025-40337, CVE-2025-40339,\nCVE-2025-40341, CVE-2025-40342, CVE-2025-40343, CVE-2025-40345,\nCVE-2025-40346, CVE-2025-40347, CVE-2025-40349, CVE-2025-40350,\nCVE-2025-40351, CVE-2025-40353, CVE-2025-40358, CVE-2025-40360,\nCVE-2025-40363, CVE-2025-68168, CVE-2025-68171, CVE-2025-68172,\nCVE-2025-68173, CVE-2025-68176, CVE-2025-68177, CVE-2025-68178,\nCVE-2025-68179, CVE-2025-68180, CVE-2025-68183, CVE-2025-68184,\nCVE-2025-68185, CVE-2025-68190, CVE-2025-68191, CVE-2025-68192,\nCVE-2025-68194, CVE-2025-68198, CVE-2025-68200, CVE-2025-68201,\nCVE-2025-68204, CVE-2025-68208, CVE-2025-68213, CVE-2025-68214,\nCVE-2025-68217, CVE-2025-68218, CVE-2025-68219, CVE-2025-68220,\nCVE-2025-68222, CVE-2025-68223, CVE-2025-68227, CVE-2025-68229,\nCVE-2025-68231, CVE-2025-68233, CVE-2025-68235, CVE-2025-68237,\nCVE-2025-68238, CVE-2025-68241, CVE-2025-68244, CVE-2025-68245,\nCVE-2025-68246, CVE-2025-68249, CVE-2025-68282, CVE-2025-68283,\nCVE-2025-68284, CVE-2025-68285, CVE-2025-68286, CVE-2025-68287,\nCVE-2025-68288, CVE-2025-68289, CVE-2025-68290, CVE-2025-68295,\nCVE-2025-68297, CVE-2025-68301, CVE-2025-68302, CVE-2025-68303,\nCVE-2025-68305, CVE-2025-68307, CVE-2025-68308, CVE-2025-68310,\nCVE-2025-68311, CVE-2025-68312, CVE-2025-68313, CVE-2025-68315,\nCVE-2025-68320, CVE-2025-68321, CVE-2025-68322, CVE-2025-68327,\nCVE-2025-68328, CVE-2025-68330, CVE-2025-68331, CVE-2025-68339,\nCVE-2025-68340, CVE-2025-68342, CVE-2025-68343, CVE-2025-68734,\nCVE-2026-23060, CVE-2026-23074, CVE-2026-23111)\n","status":"published","published":"2026-04-09T23:38:24Z","modified":"2026-11-04T20:01:11.526209673Z","updated_at":"2026-11-04T20:16:32.566315Z"},{"id":"USN-8261-1","title":"linux-xilinx vulnerabilities","description":"Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo\nRizzo discovered that some AMD Zen processors did not properly verify the\nsignature of CPU microcode. This flaw is known as EntrySign. A privileged\nattacker could possibly use this issue to cause load malicious CPU\nmicrocode causing loss of integrity and confidentiality. (CVE-2024-36347)\n\nQualys discovered that several vulnerabilities existed in the AppArmor\nLinux kernel Security Module (LSM). An unprivileged local attacker could\nuse these issues to load, replace, and remove arbitrary AppArmor profiles\ncausing denial of service, exposure of sensitive information (kernel\nmemory), local privilege escalation, or possibly escape a container.\n(LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403,\nCVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407,\nCVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - MIPS architecture;\n  - Nios II architecture;\n  - PA-RISC architecture;\n  - PowerPC architecture;\n  - RISC-V architecture;\n  - S390 architecture;\n  - Sun Sparc architecture;\n  - User-Mode Linux (UML);\n  - x86 architecture;\n  - Xtensa architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Compute Acceleration Framework;\n  - ACPI drivers;\n  - ATM drivers;\n  - Drivers core;\n  - Block device driver;\n  - Network block device driver;\n  - Bluetooth drivers;\n  - Bus devices;\n  - Character device driver;\n  - Hardware random number generator core;\n  - TPM device driver;\n  - Clock framework and drivers;\n  - Data acquisition framework and drivers;\n  - CPU frequency scaling framework;\n  - Hardware crypto device drivers;\n  - Device frequency scaling framework;\n  - DMA engine subsystem;\n  - ARM SCMI message protocol;\n  - EFI core;\n  - Intel Stratix 10 firmware drivers;\n  - GPU drivers;\n  - HID subsystem;\n  - Hardware monitoring drivers;\n  - CoreSight HW tracing drivers;\n  - IIO subsystem;\n  - InfiniBand drivers;\n  - Input Device core drivers;\n  - Input Device (Miscellaneous) drivers;\n  - Input Device (Tablet) drivers;\n  - IOMMU subsystem;\n  - IRQ chip drivers;\n  - ISDN/mISDN subsystem;\n  - Macintosh device drivers;\n  - Mailbox framework;\n  - Multiple devices driver;\n  - Media drivers;\n  - Fastrpc Driver;\n  - MOST (Media Oriented Systems Transport) drivers;\n  - MTD block device drivers;\n  - Ethernet bonding driver;\n  - Network drivers;\n  - Mellanox network drivers;\n  - STMicroelectronics network drivers;\n  - Texas Instruments network drivers;\n  - Ethernet team driver;\n  - MediaTek network drivers;\n  - NVME drivers;\n  - PA-RISC drivers;\n  - PCI subsystem;\n  - PCCARD (PCMCIA/CardBus) bus subsystem;\n  - Performance monitor drivers;\n  - Pin controllers subsystem;\n  - Chrome hardware platform drivers;\n  - x86 platform drivers;\n  - ARM PM domains;\n  - PPS (Pulse Per Second) driver;\n  - PTP clock framework;\n  - PWM drivers;\n  - Voltage and Current Regulator drivers;\n  - Remote Processor subsystem;\n  - S/390 drivers;\n  - SCSI subsystem;\n  - Texas Instruments SoC drivers;\n  - SPI subsystem;\n  - Media Oriented Systems Transport (MOST) driver;\n  - Realtek RTL8723BS SDIO drivers;\n  - TCM subsystem;\n  - Trusted Execution Environment drivers;\n  - TTY drivers;\n  - Userspace I/O drivers;\n  - Cadence USB3 driver;\n  - DesignWare USB3 driver;\n  - USB Gadget drivers;\n  - USB Host Controller drivers;\n  - Renesas USBHS Controller drivers;\n  - USB Mass Storage drivers;\n  - USB Type-C Connector System Software Interface driver;\n  - Virtio Host (VHOST) subsystem;\n  - Backlight driver;\n  - Framebuffer layer;\n  - Watchdog drivers;\n  - Xen hypervisor drivers;\n  - AFS file system;\n  - BFS file system;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - File systems infrastructure;\n  - EFI Variable file system;\n  - exFAT file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - FUSE (File system in Userspace);\n  - GFS2 file system;\n  - HFS file system;\n  - HFS+ file system;\n  - HugeTLB file system;\n  - Journaling layer for block devices (JBD2);\n  - JFS file system;\n  - KERNFS file system;\n  - Network file system (NFS) client;\n  - Network file system (NFS) server daemon;\n  - File system notification infrastructure;\n  - NTFS3 file system;\n  - OCFS2 file system;\n  - OrangeFS file system;\n  - Proc file system;\n  - Diskquota system;\n  - SMB network file system;\n  - SquashFS file system;\n  - UDF file system;\n  - XFS file system;\n  - Asynchronous Transfer Mode (ATM) subsystem;\n  - BPF subsystem;\n  - Ethernet bridge;\n  - Mellanox drivers;\n  - NFS page cache wrapper;\n  - Memory management;\n  - Memory Management;\n  - Media input infrastructure;\n  - Bluetooth subsystem;\n  - IP tunnels definitions;\n  - Network traffic control;\n  - Rose network layer;\n  - Network sockets;\n  - io_uring subsystem;\n  - Control group (cgroup);\n  - Kernel crash support code;\n  - Kernel futex primitives;\n  - Locking primitives;\n  - PID allocator;\n  - Scheduler infrastructure;\n  - Shadow Call Stack mechanism;\n  - Syscalls implementation;\n  - Timer subsystem;\n  - Tracing infrastructure;\n  - 9P file system network protocol;\n  - Amateur Radio drivers;\n  - B.A.T.M.A.N. meshing protocol;\n  - CAIF protocol;\n  - Ceph Core library;\n  - Networking core;\n  - Devlink API;\n  - Ethtool driver;\n  - Handshake API;\n  - HSR network protocol;\n  - IPv4 networking;\n  - IPv6 networking;\n  - MAC80211 subsystem;\n  - Multipath TCP;\n  - Netfilter;\n  - NET/ROM layer;\n  - NFC subsystem;\n  - Open vSwitch;\n  - RF switch subsystem;\n  - SCTP protocol;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - TIPC protocol;\n  - TLS protocol;\n  - VMware vSockets driver;\n  - Wireless networking;\n  - eXpress Data Path;\n  - XFRM subsystem;\n  - Integrity Measurement Architecture(IMA) framework;\n  - Key management;\n  - Simplified Mandatory Access Control Kernel framework;\n  - FireWire sound drivers;\n  - HD-audio driver;\n  - Turtle Beach Wavefront ALSA driver;\n  - Intel ASoC drivers;\n  - QCOM ASoC drivers;\n  - STMicroelectronics SoC drivers;\n  - USB sound devices;\n  - KVM subsystem;\n(CVE-2024-57795, CVE-2025-21833, CVE-2025-22022, CVE-2025-22103,\nCVE-2025-22105, CVE-2025-22106, CVE-2025-22107, CVE-2025-22111,\nCVE-2025-22113, CVE-2025-22121, CVE-2025-22124, CVE-2025-22125,\nCVE-2025-23129, CVE-2025-23130, CVE-2025-23133, CVE-2025-23143,\nCVE-2025-37860, CVE-2025-38022, CVE-2025-38105, CVE-2025-38234,\nCVE-2025-38502, CVE-2025-38556, CVE-2025-38627, CVE-2025-38643,\nCVE-2025-38709, CVE-2025-39678, CVE-2025-39697, CVE-2025-39805,\nCVE-2025-39806, CVE-2025-39807, CVE-2025-39808, CVE-2025-39810,\nCVE-2025-39811, CVE-2025-39812, CVE-2025-39813, CVE-2025-39815,\nCVE-2025-39817, CVE-2025-39819, CVE-2025-39823, CVE-2025-39824,\nCVE-2025-39825, CVE-2025-39826, CVE-2025-39827, CVE-2025-39828,\nCVE-2025-39829, CVE-2025-39832, CVE-2025-39835, CVE-2025-39836,\nCVE-2025-39838, CVE-2025-39839, CVE-2025-39841, CVE-2025-39842,\nCVE-2025-39843, CVE-2025-39844, CVE-2025-39845, CVE-2025-39846,\nCVE-2025-39847, CVE-2025-39848, CVE-2025-39849, CVE-2025-39850,\nCVE-2025-39851, CVE-2025-39852, CVE-2025-39853, CVE-2025-39854,\nCVE-2025-39857, CVE-2025-39860, CVE-2025-39861, CVE-2025-39863,\nCVE-2025-39864, CVE-2025-39865, CVE-2025-39866, CVE-2025-39869,\nCVE-2025-39870, CVE-2025-39871, CVE-2025-39873, CVE-2025-39876,\nCVE-2025-39877, CVE-2025-39880, CVE-2025-39881, CVE-2025-39883,\nCVE-2025-39885, CVE-2025-39886, CVE-2025-39891, CVE-2025-39894,\nCVE-2025-39895, CVE-2025-39899, CVE-2025-39901, CVE-2025-39902,\nCVE-2025-39907, CVE-2025-39909, CVE-2025-39911, CVE-2025-39913,\nCVE-2025-39914, CVE-2025-39916, CVE-2025-39920, CVE-2025-39923,\nCVE-2025-39927, CVE-2025-39929, CVE-2025-39931, CVE-2025-39932,\nCVE-2025-39934, CVE-2025-39937, CVE-2025-39938, CVE-2025-39940,\nCVE-2025-39942, CVE-2025-39943, CVE-2025-39944, CVE-2025-39945,\nCVE-2025-39947, CVE-2025-39948, CVE-2025-39949, CVE-2025-39950,\nCVE-2025-39951, CVE-2025-39952, CVE-2025-39953, CVE-2025-39955,\nCVE-2025-39957, CVE-2025-39961, CVE-2025-39965, CVE-2025-39967,\nCVE-2025-39968, CVE-2025-39969, CVE-2025-39970, CVE-2025-39971,\nCVE-2025-39972, CVE-2025-39973, CVE-2025-39977, CVE-2025-39978,\nCVE-2025-39980, CVE-2025-39981, CVE-2025-39982, CVE-2025-39985,\nCVE-2025-39986, CVE-2025-39987, CVE-2025-39988, CVE-2025-39991,\nCVE-2025-39992, CVE-2025-39994, CVE-2025-39995, CVE-2025-39996,\nCVE-2025-39998, CVE-2025-40000, CVE-2025-40001, CVE-2025-40006,\nCVE-2025-40008, CVE-2025-40009, CVE-2025-40010, CVE-2025-40011,\nCVE-2025-40013, CVE-2025-40016, CVE-2025-40020, CVE-2025-40021,\nCVE-2025-40024, CVE-2025-40026, CVE-2025-40027, CVE-2025-40029,\nCVE-2025-40030, CVE-2025-40031, CVE-2025-40032, CVE-2025-40033,\nCVE-2025-40035, CVE-2025-40036, CVE-2025-40037, CVE-2025-40038,\nCVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40047,\nCVE-2025-40048, CVE-2025-40049, CVE-2025-40051, CVE-2025-40052,\nCVE-2025-40053, CVE-2025-40055, CVE-2025-40056, CVE-2025-40057,\nCVE-2025-40058, CVE-2025-40059, CVE-2025-40060, CVE-2025-40061,\nCVE-2025-40062, CVE-2025-40067, CVE-2025-40068, CVE-2025-40070,\nCVE-2025-40071, CVE-2025-40077, CVE-2025-40078, CVE-2025-40079,\nCVE-2025-40080, CVE-2025-40081, CVE-2025-40083, CVE-2025-40084,\nCVE-2025-40085, CVE-2025-40087, CVE-2025-40088, CVE-2025-40092,\nCVE-2025-40093, CVE-2025-40094, CVE-2025-40095, CVE-2025-40096,\nCVE-2025-40099, CVE-2025-40100, CVE-2025-40101, CVE-2025-40103,\nCVE-2025-40104, CVE-2025-40105, CVE-2025-40106, CVE-2025-40107,\nCVE-2025-40109, CVE-2025-40110, CVE-2025-40111, CVE-2025-40112,\nCVE-2025-40115, CVE-2025-40116, CVE-2025-40118, CVE-2025-40120,\nCVE-2025-40121, CVE-2025-40123, CVE-2025-40124, CVE-2025-40125,\nCVE-2025-40126, CVE-2025-40127, CVE-2025-40129, CVE-2025-40134,\nCVE-2025-40137, CVE-2025-40140, CVE-2025-40141, CVE-2025-40153,\nCVE-2025-40154, CVE-2025-40155, CVE-2025-40156, CVE-2025-40159,\nCVE-2025-40160, CVE-2025-40164, CVE-2025-40165, CVE-2025-40166,\nCVE-2025-40167, CVE-2025-40169, CVE-2025-40171, CVE-2025-40172,\nCVE-2025-40173, CVE-2025-40176, CVE-2025-40178, CVE-2025-40179,\nCVE-2025-40180, CVE-2025-40183, CVE-2025-40187, CVE-2025-40188,\nCVE-2025-40192, CVE-2025-40193, CVE-2025-40194, CVE-2025-40196,\nCVE-2025-40198, CVE-2025-40200, CVE-2025-40201, CVE-2025-40202,\nCVE-2025-40204, CVE-2025-40205, CVE-2025-40206, CVE-2025-40207,\nCVE-2025-40211, CVE-2025-40218, CVE-2025-40219, CVE-2025-40220,\nCVE-2025-40221, CVE-2025-40223, CVE-2025-40226, CVE-2025-40231,\nCVE-2025-40233, CVE-2025-40235, CVE-2025-40237, CVE-2025-40238,\nCVE-2025-40240, CVE-2025-40242, CVE-2025-40243, CVE-2025-40244,\nCVE-2025-40245, CVE-2025-40248, CVE-2025-40250, CVE-2025-40251,\nCVE-2025-40252, CVE-2025-40253, CVE-2025-40254, CVE-2025-40257,\nCVE-2025-40258, CVE-2025-40259, CVE-2025-40261, CVE-2025-40262,\nCVE-2025-40263, CVE-2025-40264, CVE-2025-40266, CVE-2025-40268,\nCVE-2025-40269, CVE-2025-40271, CVE-2025-40272, CVE-2025-40273,\nCVE-2025-40275, CVE-2025-40277, CVE-2025-40278, CVE-2025-40279,\nCVE-2025-40280, CVE-2025-40281, CVE-2025-40282, CVE-2025-40283,\nCVE-2025-40284, CVE-2025-40285, CVE-2025-40286, CVE-2025-40287,\nCVE-2025-40288, CVE-2025-40289, CVE-2025-40292, CVE-2025-40293,\nCVE-2025-40294, CVE-2025-40301, CVE-2025-40303, CVE-2025-40304,\nCVE-2025-40305, CVE-2025-40306, CVE-2025-40307, CVE-2025-40308,\nCVE-2025-40309, CVE-2025-40310, CVE-2025-40311, CVE-2025-40312,\nCVE-2025-40313, CVE-2025-40314, CVE-2025-40315, CVE-2025-40317,\nCVE-2025-40318, CVE-2025-40319, CVE-2025-40320, CVE-2025-40321,\nCVE-2025-40322, CVE-2025-40323, CVE-2025-40324, CVE-2025-40325,\nCVE-2025-40328, CVE-2025-40329, CVE-2025-40331, CVE-2025-40333,\nCVE-2025-40337, CVE-2025-40339, CVE-2025-40341, CVE-2025-40342,\nCVE-2025-40343, CVE-2025-40345, CVE-2025-40346, CVE-2025-40347,\nCVE-2025-40349, CVE-2025-40350, CVE-2025-40351, CVE-2025-40353,\nCVE-2025-40358, CVE-2025-40360, CVE-2025-40363, CVE-2025-68168,\nCVE-2025-68171, CVE-2025-68172, CVE-2025-68173, CVE-2025-68176,\nCVE-2025-68177, CVE-2025-68178, CVE-2025-68179, CVE-2025-68180,\nCVE-2025-68183, CVE-2025-68184, CVE-2025-68185, CVE-2025-68190,\nCVE-2025-68191, CVE-2025-68192, CVE-2025-68194, CVE-2025-68198,\nCVE-2025-68200, CVE-2025-68201, CVE-2025-68204, CVE-2025-68206,\nCVE-2025-68208, CVE-2025-68213, CVE-2025-68214, CVE-2025-68217,\nCVE-2025-68218, CVE-2025-68219, CVE-2025-68220, CVE-2025-68222,\nCVE-2025-68223, CVE-2025-68227, CVE-2025-68229, CVE-2025-68231,\nCVE-2025-68233, CVE-2025-68235, CVE-2025-68237, CVE-2025-68238,\nCVE-2025-68241, CVE-2025-68244, CVE-2025-68245, CVE-2025-68246,\nCVE-2025-68249, CVE-2025-68254, CVE-2025-68255, CVE-2025-68256,\nCVE-2025-68257, CVE-2025-68258, CVE-2025-68259, CVE-2025-68261,\nCVE-2025-68263, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266,\nCVE-2025-68282, CVE-2025-68283, CVE-2025-68284, CVE-2025-68285,\nCVE-2025-68286, CVE-2025-68287, CVE-2025-68288, CVE-2025-68289,\nCVE-2025-68290, CVE-2025-68295, CVE-2025-68297, CVE-2025-68301,\nCVE-2025-68302, CVE-2025-68303, CVE-2025-68305, CVE-2025-68307,\nCVE-2025-68308, CVE-2025-68310, CVE-2025-68311, CVE-2025-68312,\nCVE-2025-68313, CVE-2025-68315, CVE-2025-68320, CVE-2025-68321,\nCVE-2025-68322, CVE-2025-68325, CVE-2025-68327, CVE-2025-68328,\nCVE-2025-68330, CVE-2025-68331, CVE-2025-68332, CVE-2025-68335,\nCVE-2025-68336, CVE-2025-68337, CVE-2025-68339, CVE-2025-68340,\nCVE-2025-68342, CVE-2025-68343, CVE-2025-68344, CVE-2025-68345,\nCVE-2025-68346, CVE-2025-68347, CVE-2025-68349, CVE-2025-68354,\nCVE-2025-68362, CVE-2025-68363, CVE-2025-68364, CVE-2025-68366,\nCVE-2025-68367, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374,\nCVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724,\nCVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733,\nCVE-2025-68734, CVE-2025-68740, CVE-2025-68741, CVE-2025-68742,\nCVE-2025-68744, CVE-2025-68746, CVE-2025-68753, CVE-2025-68755,\nCVE-2025-68756, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759,\nCVE-2025-68763, CVE-2025-68764, CVE-2025-68765, CVE-2025-68766,\nCVE-2025-68767, CVE-2025-68769, CVE-2025-68770, CVE-2025-68771,\nCVE-2025-68772, CVE-2025-68773, CVE-2025-68774, CVE-2025-68775,\nCVE-2025-68776, CVE-2025-68777, CVE-2025-68778, CVE-2025-68780,\nCVE-2025-68782, CVE-2025-68783, CVE-2025-68785, CVE-2025-68786,\nCVE-2025-68787, CVE-2025-68788, CVE-2025-68794, CVE-2025-68795,\nCVE-2025-68796, CVE-2025-68797, CVE-2025-68798, CVE-2025-68799,\nCVE-2025-68800, CVE-2025-68801, CVE-2025-68804, CVE-2025-68806,\nCVE-2025-68808, CVE-2025-68809, CVE-2025-68810, CVE-2025-68811,\nCVE-2025-68813, CVE-2025-68814, CVE-2025-68815, CVE-2025-68816,\nCVE-2025-68817, CVE-2025-68818, CVE-2025-68819, CVE-2025-68820,\nCVE-2025-71064, CVE-2025-71065, CVE-2025-71066, CVE-2025-71067,\nCVE-2025-71068, CVE-2025-71069, CVE-2025-71071, CVE-2025-71072,\nCVE-2025-71075, CVE-2025-71077, CVE-2025-71078, CVE-2025-71079,\nCVE-2025-71081, CVE-2025-71082, CVE-2025-71083, CVE-2025-71084,\nCVE-2025-71085, CVE-2025-71086, CVE-2025-71087, CVE-2025-71088,\nCVE-2025-71089, CVE-2025-71091, CVE-2025-71093, CVE-2025-71094,\nCVE-2025-71095, CVE-2025-71096, CVE-2025-71097, CVE-2025-71098,\nCVE-2025-71101, CVE-2025-71102, CVE-2025-71104, CVE-2025-71105,\nCVE-2025-71107, CVE-2025-71108, CVE-2025-71109, CVE-2025-71111,\nCVE-2025-71112, CVE-2025-71113, CVE-2025-71114, CVE-2025-71116,\nCVE-2025-71118, CVE-2025-71119, CVE-2025-71120, CVE-2025-71121,\nCVE-2025-71122, CVE-2025-71125, CVE-2025-71126, CVE-2025-71127,\nCVE-2025-71130, CVE-2025-71131, CVE-2025-71132, CVE-2025-71133,\nCVE-2025-71135, CVE-2025-71136, CVE-2025-71137, CVE-2025-71138,\nCVE-2025-71140, CVE-2025-71141, CVE-2025-71143, CVE-2025-71147,\nCVE-2025-71148, CVE-2025-71150, CVE-2025-71151, CVE-2025-71153,\nCVE-2025-71154, CVE-2026-23060, CVE-2026-23074, CVE-2026-23111,\nCVE-2026-23112, CVE-2026-23209, CVE-2026-23231, CVE-2026-23273)\n","status":"published","published":"2026-05-07T15:54:20Z","modified":"2026-09-07T14:05:25.637433365Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}