{"id":"CVE-2026-31531","aliases":["AZL-83541","BELL-CVE-2026-31531","CLSA-2026-1782155469","CLSA-2026-1783791447","DEBIAN-CVE-2026-31531","EUVD-2026-25218","GHSA-8q42-qfhf-592h","OESA-2026-2582","OESA-2026-3157","ROOT-OS-DEBIAN-11-CVE-2026-31531","ROOT-OS-DEBIAN-12-CVE-2026-31531","ROOT-OS-UBUNTU-2204-CVE-2026-31531","ROOT-OS-UBUNTU-2404-CVE-2026-31531","SUSE-SU-2026:23477-1","SUSE-SU-2026:23481-1","SUSE-SU-2026:23528-1","SUSE-SU-2026:23529-1","SUSE-SU-2026:23881-1","SUSE-SU-2026:23887-1","SUSE-SU-2026:23897-1","SUSE-SU-2026:23902-1","SUSE-SU-2026:4120-1","SUSE-SU-2026:4254-1","UBUNTU-CVE-2026-31531","openSUSE-SU-2026:21910-1"],"status":"published","title":"ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()\n\nWhen querying a nexthop object via RTM_GETNEXTHOP, the kernel currently\nallocates a fixed-size skb using NLMSG_GOODSIZE. While sufficient for\nsingle nexthops and small Equal-Cost Multi-Path groups, this fixed\nallocation fails for large nexthop groups like 512 nexthops.\n\nThis results in the following warning splat:\n\n WARNING: net/ipv4/nexthop.c:3395 at rtm_get_nexthop+0x176/0x1c0, CPU#20: rep/4608\n [...]\n RIP: 0010:rtm_get_nexthop (net/ipv4/nexthop.c:3395)\n [...]\n Call Trace:\n  \u003cTASK\u003e\n  rtnetlink_rcv_msg (net/core/rtnetlink.c:6989)\n  netlink_rcv_skb (net/netlink/af_netlink.c:2550)\n  netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)\n  netlink_sendmsg (net/netlink/af_netlink.c:1894)\n  ____sys_sendmsg (net/socket.c:721 net/socket.c:736 net/socket.c:2585)\n  ___sys_sendmsg (net/socket.c:2641)\n  __sys_sendmsg (net/socket.c:2671)\n  do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)\n  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n  \u003c/TASK\u003e\n\nFix this by allocating the size dynamically using nh_nlmsg_size() and\nusing nlmsg_new(), this is consistent with nexthop_notify() behavior. In\naddition, adjust nh_nlmsg_size_grp() so it calculates the size needed\nbased on flags passed. While at it, also add the size of NHA_FDB for\nnexthop group size calculation as it was missing too.\n\nThis cannot be reproduced via iproute2 as the group size is currently\nlimited and the command fails as follows:\n\naddattr_l ERROR: message exceeded bound of 1048","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00165,"percentile":0.05772,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-04-23T11:12:44Z","modified":"2026-11-11T09:39:26Z","fixes":[{"ecosystem":"Alpaquita:23","package":"linux-lts","fixed_in":["6.1.191-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"linux-lts","fixed_in":["6.12.85-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"linux-lts","fixed_in":["6.18.35-r1"],"sources":["osv"]},{"ecosystem":"Linux","package":"Kernel","fixed_in":["6.1.191","6.6.160","6.12.83","6.18.24","6.19.14"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["6.12.85-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["6.19.14-1"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"linux","fixed_in":["5.10.262-1.aikido.113","5.10.262-1.aikido.114"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-linux","fixed_in":["5.10.262-1.aikido.113","5.10.262-1.aikido.114"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"linux","fixed_in":["6.1.190-1.aikido.167"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-linux","fixed_in":["6.1.190-1.aikido.167"],"sources":["osv"]},{"ecosystem":"Root:Ubuntu:22.04","package":"linux","fixed_in":["5.15.0-203.213.aikido.119"],"sources":["osv"]},{"ecosystem":"Root:Ubuntu:22.04","package":"rootio-linux","fixed_in":["5.15.0-203.213.aikido.119"],"sources":["osv"]},{"ecosystem":"Root:Ubuntu:24.04","package":"linux","fixed_in":["6.8.0-149.149.aikido.91"],"sources":["osv"]},{"ecosystem":"Root:Ubuntu:24.04","package":"rootio-linux","fixed_in":["6.8.0-149.149.aikido.91"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"linux-nvidia","fixed_in":["7.0.0-1006.6"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.161.1-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"linux-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.189-r0"},{"fixed":"6.1.191-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"linux-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.12.81-r0"},{"fixed":"6.12.85-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"linux-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.12.92-r1"},{"fixed":"6.18.35-r1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-64k","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-64k-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-64k-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-64k-debug-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-64k-debug-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-64k-debug-devel-matched","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-64k-debug-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-64k-debug-modules-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-64k-debug-modules-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-64k-debug-modules-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-64k-debug-modules-partner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-64k-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-64k-devel-matched","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-64k-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-64k-modules-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-64k-modules-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-64k-modules-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-64k-modules-partner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-abi-stablelists","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-cross-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-debug-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-debug-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-debug-devel-matched","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-debug-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-debug-modules-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-debug-modules-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-debug-modules-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-debug-modules-partner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-debug-uki-virt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-debug-uki-virt-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-devel-matched","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-ipaclones-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-modules-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-modules-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-modules-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-modules-partner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-64k","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-64k-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-64k-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-64k-debug-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-64k-debug-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-64k-debug-devel-matched","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-64k-debug-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-64k-debug-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-64k-debug-modules-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-64k-debug-modules-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-64k-debug-modules-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-64k-debug-modules-partner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-64k-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-64k-devel-matched","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-64k-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-64k-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-64k-modules-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-64k-modules-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-64k-modules-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-64k-modules-partner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-debug-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-debug-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-debug-devel-matched","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-debug-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-debug-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-debug-modules-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-debug-modules-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-debug-modules-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-debug-modules-partner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-devel-matched","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-modules-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-modules-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-modules-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-rt-modules-partner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-selftests-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-tools-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-tools-libs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-uki-virt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kernel-uki-virt-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libperf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libperf-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"python3-perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rtla","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-570.62.1.el9_6.tuxcare.5.els5"}]}],"bundled":141},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bpftool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-64k","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-64k-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-64k-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-64k-debug-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-64k-debug-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-64k-debug-devel-matched","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-64k-debug-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-64k-debug-modules-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-64k-debug-modules-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-64k-debug-modules-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-64k-debug-modules-partner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-64k-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-64k-devel-matched","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-64k-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-64k-modules-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-64k-modules-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-64k-modules-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-64k-modules-partner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-abi-stablelists","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-cross-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-debug-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-debug-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-debug-devel-matched","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-debug-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-debug-modules-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-debug-modules-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-debug-modules-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-debug-modules-partner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-debug-uki-virt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-devel-matched","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-ipaclones-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-modules-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-modules-extra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-modules-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-modules-partner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-selftests-internal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-tools-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-tools-libs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kernel-uki-virt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libbpf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.0.0-2.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libbpf-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.0.0-2.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libbpf-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.0.0-2.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3-perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rtla","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.0-284.1101.el9_2.tuxcare.11.els8"}]}],"bundled":305},{"source":"osv","ecosystem":"Linux","package":"Kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.0"},{"fixed":"6.1.191"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.160"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.83"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.24"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"6.19.14"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.112-1","6.1.115-1","6.1.119-1","6.1.123-1","6.1.124-1","6.1.128-1","6.1.129-1","6.1.133-1","6.1.135-1","6.1.137-1","6.1.139-1","6.1.140-1","6.1.147-1","6.1.148-1","6.1.153-1","6.1.158-1","6.1.159-1","6.1.162-1","6.1.164-1","6.1.170-1","6.1.170-2","6.1.170-3","6.1.172-1","6.1.174-1","6.1.176-1","6.1.177-1","6.1.180-1","6.1.187-1","6.1.190-1","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1","6.10-1~exp1","6.10.1-1~exp1","6.10.11-1","6.10.11-1~bpo12+1","6.10.12-1","6.10.3-1","6.10.4-1","6.10.6-1","6.10.6-1~bpo12+1","6.10.7-1","6.10.9-1","6.11-1~exp1","6.11.10-1","6.11.10-1~bpo12+1","6.11.2-1","6.11.4-1","6.11.5-1","6.11.5-1~bpo12+1","6.11.6-1","6.11.7-1","6.11.9-1","6.11~rc4-1~exp1","6.11~rc5-1~exp1","6.12.10-1","6.12.100-1","6.12.101-1","6.12.105-1","6.12.107-1","6.12.11-1","6.12.11-1+alpha","6.12.11-1+alpha.1","6.12.111-1","6.12.113-1","6.12.115-1","6.12.115-2","6.12.12-1","6.12.12-1~bpo12+1","6.12.13-1","6.12.15-1","6.12.16-1","6.12.17-1","6.12.19-1","6.12.20-1","6.12.21-1","6.12.22-1","6.12.22-1~bpo12+1","6.12.25-1","6.12.27-1","6.12.27-1~bpo12+1","6.12.29-1","6.12.3-1","6.12.30-1","6.12.30-1~bpo12+1","6.12.31-1","6.12.32-1","6.12.32-1~bpo12+1","6.12.33-1","6.12.33-1~bpo12+1","6.12.35-1","6.12.35-1~bpo12+1","6.12.37-1","6.12.38-1","6.12.38-1~bpo12+1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.5-1","6.12.57-1","6.12.57-1~bpo12+1","6.12.6-1","6.12.63-1","6.12.63-1~bpo12+1","6.12.69-1","6.12.69-1~bpo12+1","6.12.73-1","6.12.73-1~bpo12+1","6.12.74-1","6.12.74-2","6.12.74-2~bpo12+1","6.12.8-1","6.12.85-1","6.12.85-1~bpo12+1","6.12.86-1","6.12.86-1~bpo12+1","6.12.88-1","6.12.88-1~bpo12+1","6.12.9-1","6.12.9-1+alpha","6.12.9-1~bpo12+1","6.12.90-1","6.12.90-1~bpo12+1","6.12.90-2","6.12.90-2~bpo12+1","6.12.94-1","6.12.94-1~bpo12+1","6.12.95-1","6.12.95-1~bpo12+1","6.12.96-1","6.12~rc6-1~exp1","6.13.10-1~exp1","6.13.11-1~exp1","6.13.2-1~exp1","6.13.3-1~exp1","6.13.4-1~exp1","6.13.5-1~exp1","6.13.6-1~exp1","6.13.7-1~exp1","6.13.8-1~exp1","6.13.9-1~exp1","6.13~rc6-1~exp1","6.13~rc7-1~exp1","6.14.3-1~exp1","6.14.5-1~exp1","6.14.6-1~exp1","6.15-1~exp1","6.15.1-1~exp1","6.15.2-1~exp1","6.15.3-1~exp1","6.15.4-1~exp1","6.15.5-1~exp1","6.15.6-1~exp1","6.15~rc7-1~exp1","6.16-1~exp1","6.16.1-1~exp1","6.16.10-1","6.16.11-1","6.16.12-1","6.16.12-1~bpo13+1","6.16.12-2","6.16.3-1","6.16.3-1~bpo13+1","6.16.5-1","6.16.6-1","6.16.7-1","6.16.8-1","6.16.9-1","6.16~rc7-1~exp1","6.17.10-1","6.17.11-1","6.17.12-1","6.17.13-1","6.17.13-1~bpo13+1","6.17.2-1~exp1","6.17.5-1~exp1","6.17.6-1","6.17.7-1","6.17.7-2","6.17.8-1","6.17.8-1~bpo13+1","6.17.9-1","6.18.1-1~exp1","6.18.10-1","6.18.12-1","6.18.12-1~bpo13+1","6.18.13-1","6.18.14-1","6.18.15-1","6.18.15-1~bpo13+1","6.18.2-1~exp1","6.18.3-1","6.18.5-1","6.18.5-1~bpo13+1","6.18.8-1","6.18.9-1","6.18.9-1~bpo13+1","6.18~rc4-1~exp1","6.18~rc4-1~exp2","6.18~rc5-1~exp1","6.18~rc6-1~exp1","6.18~rc7-1~exp1","6.19-1~exp1","6.19.10-1","6.19.10-1~bpo13+1","6.19.11-1","6.19.11-1~bpo13+1","6.19.12-1","6.19.13-1","6.19.13-1~bpo13+1","6.19.14-1","6.19.14-1~bpo13+1","6.19.2-1~exp1","6.19.3-1~exp1","6.19.4-1~exp1","6.19.5-1~exp1","6.19.6-1","6.19.6-2","6.19.6-2~bpo13+1","6.19.8-1","6.19.8-1~bpo13+1","6.19~rc4-1~exp1","6.19~rc5-1~exp1","6.19~rc6-1~exp1","6.19~rc7-1~exp1","6.19~rc8-1~exp1","6.3.1-1~exp1","6.3.11-1","6.3.2-1~exp1","6.3.4-1~exp1","6.3.5-1~exp1","6.3.7-1","6.3.7-1~bpo12+1","6.4.1-1~exp1","6.4.11-1","6.4.13-1","6.4.4-1","6.4.4-1~bpo12+1","6.4.4-2","6.4.4-3","6.4.4-3~bpo12+1","6.4~rc6-1~exp1","6.4~rc7-1~exp1","6.5.1-1~exp1","6.5.10-1","6.5.10-1~bpo12+1","6.5.13-1","6.5.3-1","6.5.3-1~bpo12+1","6.5.6-1","6.5.8-1","6.5~rc4-1~exp1","6.5~rc6-1~exp1","6.5~rc7-1~exp1","6.6.11-1","6.6.13-1","6.6.13-1~bpo12+1","6.6.15-1","6.6.15-2","6.6.3-1~exp1","6.6.4-1~exp1","6.6.7-1~exp1","6.6.8-1","6.6.9-1","6.7-1~exp1","6.7.1-1~exp1","6.7.12-1","6.7.12-1~bpo12+1","6.7.4-1~exp1","6.7.7-1","6.7.9-1","6.7.9-2","6.8.11-1","6.8.12-1","6.8.12-1~bpo12+1","6.8.9-1","6.9.10-1","6.9.10-1~bpo12+1","6.9.11-1","6.9.12-1","6.9.2-1~exp1","6.9.7-1","6.9.7-1~bpo12+1","6.9.8-1","6.9.9-1","7.0-1~exp1","7.0.1-1~exp1","7.0.10-1","7.0.10-1~bpo13+1","7.0.12-1","7.0.12-2","7.0.12-2~bpo13+1","7.0.13-1","7.0.13-1~bpo13+1","7.0.14-1","7.0.3-1","7.0.4-1","7.0.4-1~bpo13+1","7.0.7-1","7.0.7-1~bpo13+1","7.0.9-1","7.0.9-1~bpo13+1","7.1.1-1~exp1","7.1.10-1","7.1.12-1","7.1.13-1","7.1.13-1~bpo13+1","7.1.2-1~exp1","7.1.3-1","7.1.3-1+sunvdc","7.1.3-1~bpo13+1","7.1.4-1","7.1.5-1","7.1.6-1","7.1.7-1","7.1.7-1~bpo13+1","7.1.8-1","7.1.8-1~bpo13+1","7.1.8-2","7.1.9-1","7.1.9-1+sparc64","7.1~rc2-1~exp1","7.1~rc3-1~exp1","7.1~rc4-1~exp1","7.1~rc4-1~exp2","7.1~rc5-1~exp1","7.1~rc7-1~exp1","7.2.10-1","7.2.11-1","7.2.11-1~bpo13+1","7.2.12-1","7.2.13-1","7.2.14-1","7.2.15-1","7.2.2-1~exp1","7.2.3-1~exp1","7.2.6-1","7.2.6-1~bpo13+1","7.2.7-1","7.2.8-1","7.2.9-1","7.2.9-1~bpo13+1","7.2~rc3-1~exp1","7.2~rc5-1~exp1","7.2~rc7-1~exp1","7.3.1-1~exp1","7.3~rc6-1~exp1","7.3~rc7-1~exp1"]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.85-1"}]}],"versions":["6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.57-1","6.12.57-1~bpo12+1","6.12.63-1","6.12.63-1~bpo12+1","6.12.69-1","6.12.69-1~bpo12+1","6.12.73-1","6.12.73-1~bpo12+1","6.12.74-1","6.12.74-2","6.12.74-2~bpo12+1","6.12.85-1~bpo12+1"]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.19.14-1"}]}],"versions":["6.12.100-1","6.12.101-1","6.12.105-1","6.12.107-1","6.12.111-1","6.12.113-1","6.12.115-1","6.12.115-2","6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.57-1","6.12.57-1~bpo12+1","6.12.63-1","6.12.63-1~bpo12+1","6.12.69-1","6.12.69-1~bpo12+1","6.12.73-1","6.12.73-1~bpo12+1","6.12.74-1","6.12.74-2","6.12.74-2~bpo12+1","6.12.85-1","6.12.85-1~bpo12+1","6.12.86-1","6.12.86-1~bpo12+1","6.12.88-1","6.12.88-1~bpo12+1","6.12.90-1","6.12.90-1~bpo12+1","6.12.90-2","6.12.90-2~bpo12+1","6.12.94-1","6.12.94-1~bpo12+1","6.12.95-1","6.12.95-1~bpo12+1","6.12.96-1","6.13.10-1~exp1","6.13.11-1~exp1","6.13.2-1~exp1","6.13.3-1~exp1","6.13.4-1~exp1","6.13.5-1~exp1","6.13.6-1~exp1","6.13.7-1~exp1","6.13.8-1~exp1","6.13.9-1~exp1","6.13~rc6-1~exp1","6.13~rc7-1~exp1","6.14.3-1~exp1","6.14.5-1~exp1","6.14.6-1~exp1","6.15-1~exp1","6.15.1-1~exp1","6.15.2-1~exp1","6.15.3-1~exp1","6.15.4-1~exp1","6.15.5-1~exp1","6.15.6-1~exp1","6.15~rc7-1~exp1","6.16-1~exp1","6.16.1-1~exp1","6.16.10-1","6.16.11-1","6.16.12-1","6.16.12-1~bpo13+1","6.16.12-2","6.16.3-1","6.16.3-1~bpo13+1","6.16.5-1","6.16.6-1","6.16.7-1","6.16.8-1","6.16.9-1","6.16~rc7-1~exp1","6.17.10-1","6.17.11-1","6.17.12-1","6.17.13-1","6.17.13-1~bpo13+1","6.17.2-1~exp1","6.17.5-1~exp1","6.17.6-1","6.17.7-1","6.17.7-2","6.17.8-1","6.17.8-1~bpo13+1","6.17.9-1","6.18.1-1~exp1","6.18.10-1","6.18.12-1","6.18.12-1~bpo13+1","6.18.13-1","6.18.14-1","6.18.15-1","6.18.15-1~bpo13+1","6.18.2-1~exp1","6.18.3-1","6.18.5-1","6.18.5-1~bpo13+1","6.18.8-1","6.18.9-1","6.18.9-1~bpo13+1","6.18~rc4-1~exp1","6.18~rc4-1~exp2","6.18~rc5-1~exp1","6.18~rc6-1~exp1","6.18~rc7-1~exp1","6.19-1~exp1","6.19.10-1","6.19.10-1~bpo13+1","6.19.11-1","6.19.11-1~bpo13+1","6.19.12-1","6.19.13-1","6.19.13-1~bpo13+1","6.19.14-1~bpo13+1","6.19.2-1~exp1","6.19.3-1~exp1","6.19.4-1~exp1","6.19.5-1~exp1","6.19.6-1","6.19.6-2","6.19.6-2~bpo13+1","6.19.8-1","6.19.8-1~bpo13+1","6.19~rc4-1~exp1","6.19~rc5-1~exp1","6.19~rc6-1~exp1","6.19~rc7-1~exp1","6.19~rc8-1~exp1"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.0-145.3.14.145.oe2403sp3"}]}],"bundled":150},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.0-145.1.19.156.oe2403sp1"}]}],"bundled":83},{"source":"osv","ecosystem":"Root:Debian:11","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.262-1.aikido.113"},{"fixed":"5.10.262-1.aikido.114"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.262-1.aikido.113"},{"fixed":"5.10.262-1.aikido.114"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.190-1.aikido.167"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.190-1.aikido.167"}]}]},{"source":"osv","ecosystem":"Root:Ubuntu:22.04","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-203.213.aikido.119"}]}]},{"source":"osv","ecosystem":"Root:Ubuntu:22.04","package":"rootio-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-203.213.aikido.119"}]}]},{"source":"osv","ecosystem":"Root:Ubuntu:24.04","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-149.149.aikido.91"}]}]},{"source":"osv","ecosystem":"Root:Ubuntu:24.04","package":"rootio-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0-149.149.aikido.91"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-52.1"}]}],"bundled":588},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-52.1"}]}],"bundled":588},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-52.1"}]}],"bundled":588},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-52.1.21.36"}]}],"bundled":588},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-52.1"}]}],"bundled":588},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-52.1"}]}],"bundled":588},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-52.1"}]}],"bundled":588},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-52.1"}]}],"bundled":588},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-52.1"}]}],"bundled":588},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-52.1.21.34"}]}],"bundled":588},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-52.1"}]}],"bundled":588},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-52.1"}]}],"bundled":588},{"source":"osv","ecosystem":"SUSE:Linux Micro Extras 6.2","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.38.1"}]}],"bundled":885},{"source":"osv","ecosystem":"SUSE:Linux Micro Extras 6.2","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.38.1"}]}],"bundled":885},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.38.1"}]}],"bundled":885},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.38.1"}]}],"bundled":885},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.38.1.160000.2.23"}]}],"bundled":885},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.38.1"}]}],"bundled":885},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.38.1"}]}],"bundled":885},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.38.1"}]}],"bundled":885},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.38.1"}]}],"bundled":885},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.38.1"}]}],"bundled":885},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.38.1"}]}],"bundled":885},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.38.1.160000.2.23"}]}],"bundled":885},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.38.1"}]}],"bundled":885},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.38.1"}]}],"bundled":885},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.38.1"}]}],"bundled":885},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.38.1"}]}],"bundled":885},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.38.1"}]}],"bundled":885},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.38.1"}]}],"bundled":885},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.38.1"}]}],"bundled":885},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.38.1"}]}],"bundled":885},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.38.1"}]}],"bundled":885},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.38.1.160000.2.23"}]}],"bundled":885},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.38.1"}]}],"bundled":885},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.38.1"}]}],"bundled":885},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.38.1"}]}],"bundled":885},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.38.1"}]}],"bundled":885},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.38.1"}]}],"bundled":885},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.38.1"}]}],"bundled":885},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"kernel-livepatch-SLE15-SP7-RT_Update_20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150700.1.3.1"}]}],"bundled":662},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP7","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.7.75.1"}]}],"bundled":662},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP7","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.7.75.1"}]}],"bundled":662},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP7","package":"kernel-syms-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.7.75.1"}]}],"bundled":662},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.81.1"}]}],"bundled":661},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.81.1"}]}],"bundled":661},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.81.1.150700.17.45.1"}]}],"bundled":661},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.81.1"}]}],"bundled":661},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.81.1"}]}],"bundled":661},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.81.1"}]}],"bundled":661},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.81.1"}]}],"bundled":661},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.81.1"}]}],"bundled":661},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.81.1"}]}],"bundled":661},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.81.1"}]}],"bundled":661},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.81.1"}]}],"bundled":661},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP7","package":"kernel-livepatch-SLE15-SP7_Update_21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150700.15.3.1"}]}],"bundled":661},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.81.1"}]}],"bundled":661},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.81.1"}]}],"bundled":661},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150700.53.81.1"}]}],"bundled":661},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.0-28.30~16.04.1","4.8.0-30.32~16.04.1","4.8.0-32.34~16.04.1","4.8.0-34.36~16.04.1","4.10.0-14.16~16.04.1","4.10.0-19.21~16.04.1","4.10.0-20.22~16.04.1","4.10.0-21.23~16.04.1","4.10.0-22.24~16.04.1","4.10.0-24.28~16.04.1","4.10.0-26.30~16.04.1","4.11.0-13.19~16.04.1","4.11.0-14.20~16.04.1","4.13.0-16.19~16.04.3","4.13.0-17.20~16.04.1","4.13.0-19.22~16.04.1","4.13.0-21.24~16.04.1","4.13.0-25.29~16.04.2","4.15.0-13.14~16.04.1","4.15.0-15.16~16.04.1","4.15.0-20.21~16.04.1","4.15.0-22.24~16.04.1","4.15.0-23.25~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1021.24~18.04.1","5.0.0-1022.25~18.04.1","5.0.0-1023.26~18.04.1","5.0.0-1024.27~18.04.1","5.0.0-1025.28","5.0.0-1027.30"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1019.21~18.04.1","5.3.0-1023.25~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.2","5.3.0-1033.35","5.3.0-1034.36","5.3.0-1035.37"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-aws-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1018.18~18.04.1","5.4.0-1020.20~18.04.2","5.4.0-1022.22~18.04.1","5.4.0-1024.24~18.04.1","5.4.0-1025.25~18.04.1","5.4.0-1028.29~18.04.1","5.4.0-1029.30~18.04.1","5.4.0-1030.31~18.04.1","5.4.0-1032.33~18.04.1","5.4.0-1034.35~18.04.1","5.4.0-1035.37~18.04.1","5.4.0-1037.39~18.04.1","5.4.0-1038.40~18.04.1","5.4.0-1039.41~18.04.1","5.4.0-1041.43~18.04.1","5.4.0-1043.45~18.04.1","5.4.0-1045.47~18.04.1","5.4.0-1047.49~18.04.1","5.4.0-1048.50~18.04.1","5.4.0-1049.51~18.04.1","5.4.0-1051.53~18.04.1","5.4.0-1054.57~18.04.1","5.4.0-1055.58~18.04.1","5.4.0-1056.59~18.04.1","5.4.0-1057.60~18.04.1","5.4.0-1058.61~18.04.3","5.4.0-1059.62~18.04.1","5.4.0-1060.63~18.04.1","5.4.0-1061.64~18.04.1","5.4.0-1063.66~18.04.1","5.4.0-1064.67~18.04.1","5.4.0-1065.68~18.04.1","5.4.0-1066.69~18.04.1","5.4.0-1068.72~18.04.1","5.4.0-1069.73~18.04.1","5.4.0-1071.76~18.04.1","5.4.0-1072.77~18.04.1","5.4.0-1075.80~18.04.1","5.4.0-1078.84~18.04.1","5.4.0-1080.87~18.04.1","5.4.0-1081.88~18.04.1","5.4.0-1083.90~18.04.1","5.4.0-1084.91~18.04.1","5.4.0-1085.92~18.04.1","5.4.0-1086.93~18.04.1","5.4.0-1088.96~18.04.1","5.4.0-1089.97~18.04.1","5.4.0-1090.98~18.04.1","5.4.0-1092.100~18.04.2","5.4.0-1093.102~18.04.2","5.4.0-1094.102~18.04.1","5.4.0-1096.104~18.04.1","5.4.0-1097.105~18.04.1","5.4.0-1099.107~18.04.1","5.4.0-1100.108~18.04.1","5.4.0-1101.109~18.04.1","5.4.0-1103.111~18.04.1","5.4.0-1104.112~18.04.1","5.4.0-1105.113~18.04.1","5.4.0-1106.114~18.04.1","5.4.0-1107.115~18.04.1","5.4.0-1108.116~18.04.1","5.4.0-1109.118~18.04.1","5.4.0-1110.119~18.04.1","5.4.0-1111.120~18.04.1","5.4.0-1112.121~18.04.2","5.4.0-1113.123~18.04.1","5.4.0-1114.124~18.04.1","5.4.0-1116.126~18.04.1","5.4.0-1117.127~18.04.1","5.4.0-1118.128~18.04.1","5.4.0-1119.129~18.04.1","5.4.0-1120.130~18.04.1","5.4.0-1121.131~18.04.1","5.4.0-1122.132~18.04.1","5.4.0-1123.133~18.04.1","5.4.0-1124.134~18.04.1","5.4.0-1125.135~18.04.1","5.4.0-1126.136~18.04.1","5.4.0-1127.137~18.04.2","5.4.0-1128.138~18.04.1","5.4.0-1129.139~18.04.1","5.4.0-1130.140~18.04.1","5.4.0-1131.141~18.04.1","5.4.0-1132.142~18.04.1","5.4.0-1133.143~18.04.1","5.4.0-1134.144~18.04.1","5.4.0-1135.145~18.04.1","5.4.0-1136.146~18.04.1","5.4.0-1137.147~18.04.1","5.4.0-1139.149~18.04.1","5.4.0-1142.152~18.04.1","5.4.0-1144.154~18.04.1","5.4.0-1145.155~18.04.1","5.4.0-1146.156~18.04.1","5.4.0-1147.157~18.04.1","5.4.0-1148.158~18.04.1","5.4.0-1149.159~18.04.1","5.4.0-1150.160~18.04.1","5.4.0-1151.161~18.04.1","5.4.0-1152.162~18.04.1","5.4.0-1153.163~18.04.1","5.4.0-1154.164~18.04.1","5.4.0-1156.166~18.04.1","5.4.0-1157.167~18.04.1","5.4.0-1158.168~18.04.1","5.4.0-1160.170~18.04.1","5.4.0-1161.172~18.04.1","5.4.0-1162.173~18.04.1","5.4.0-1163.174~18.04.1","5.4.0-1165.176~18.04.1","5.4.0-1167.178~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.2","4.15.0-1003.3","4.15.0-1004.4","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1012.12","4.15.0-1013.13","4.15.0-1014.14","4.15.0-1018.18","4.15.0-1019.19","4.15.0-1021.21","4.15.0-1022.23","4.15.0-1023.24","4.15.0-1025.26","4.15.0-1028.29","4.15.0-1030.31","4.15.0-1031.32","4.15.0-1032.33","4.15.0-1035.36","4.15.0-1036.38","4.15.0-1037.39","4.18.0-1011.11~18.04.1","4.18.0-1013.13~18.04.1","4.18.0-1014.14~18.04.1","4.18.0-1018.18~18.04.1","4.18.0-1019.19~18.04.1","4.18.0-1020.20~18.04.1","4.18.0-1023.24~18.04.1","4.18.0-1024.25~18.04.1","4.18.0-1025.27~18.04.1","5.0.0-1014.14~18.04.1","5.0.0-1016.17~18.04.1","5.0.0-1018.19~18.04.1","5.0.0-1020.21~18.04.1","5.0.0-1022.23~18.04.1","5.0.0-1023.24~18.04.1","5.0.0-1025.27~18.04.1","5.0.0-1027.29~18.04.1","5.0.0-1028.30~18.04.1","5.0.0-1029.31~18.04.1","5.0.0-1031.33","5.0.0-1032.34","5.0.0-1035.37","5.0.0-1036.38"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8~18.04.1","5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1019.20~18.04.1","5.3.0-1020.21~18.04.1","5.3.0-1022.23~18.04.1","5.3.0-1028.29~18.04.1","5.3.0-1031.32~18.04.1","5.3.0-1032.33~18.04.1","5.3.0-1034.35~18.04.1","5.3.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-azure-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1020.20~18.04.1","5.4.0-1022.22~18.04.1","5.4.0-1023.23~18.04.1","5.4.0-1025.25~18.04.1","5.4.0-1026.26~18.04.1","5.4.0-1031.32~18.04.1","5.4.0-1032.33~18.04.1","5.4.0-1034.35~18.04.1","5.4.0-1035.36~18.04.1","5.4.0-1036.38~18.04.1","5.4.0-1039.41~18.04.1","5.4.0-1040.42~18.04.1","5.4.0-1041.43~18.04.1","5.4.0-1043.45~18.04.1","5.4.0-1044.46~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1047.49~18.04.1","5.4.0-1048.50~18.04.1","5.4.0-1049.51~18.04.1","5.4.0-1051.53~18.04.1","5.4.0-1055.57~18.04.1","5.4.0-1056.58~18.04.1","5.4.0-1058.60~18.04.1","5.4.0-1059.62~18.04.1","5.4.0-1061.64~18.04.1","5.4.0-1062.65~18.04.1","5.4.0-1063.66~18.04.1","5.4.0-1064.67~18.04.1","5.4.0-1065.68~18.04.1","5.4.0-1067.70~18.04.1","5.4.0-1068.71~18.04.1","5.4.0-1069.72~18.04.1","5.4.0-1070.73~18.04.1","5.4.0-1072.75~18.04.1","5.4.0-1073.76~18.04.1","5.4.0-1074.77~18.04.1","5.4.0-1077.80~18.04.1","5.4.0-1078.81~18.04.1","5.4.0-1080.83~18.04.2","5.4.0-1083.87~18.04.1","5.4.0-1085.90~18.04.1","5.4.0-1086.91~18.04.1","5.4.0-1089.94~18.04.1","5.4.0-1090.95~18.04.1","5.4.0-1091.96~18.04.1","5.4.0-1094.100~18.04.1","5.4.0-1095.101~18.04.1","5.4.0-1098.104~18.04.2","5.4.0-1100.106~18.04.1","5.4.0-1101.107~18.04.1","5.4.0-1103.109~18.04.1","5.4.0-1104.110~18.04.1","5.4.0-1105.111~18.04.1","5.4.0-1106.112~18.04.1","5.4.0-1107.113~18.04.1","5.4.0-1108.114~18.04.1","5.4.0-1109.115~18.04.1","5.4.0-1110.116~18.04.1","5.4.0-1111.117~18.04.1","5.4.0-1112.118~18.04.1","5.4.0-1113.119~18.04.1","5.4.0-1115.122~18.04.1","5.4.0-1116.123~18.04.1","5.4.0-1117.124~18.04.1","5.4.0-1118.125~18.04.1","5.4.0-1119.126~18.04.2","5.4.0-1120.127~18.04.1","5.4.0-1121.128~18.04.1","5.4.0-1122.129~18.04.1","5.4.0-1123.130~18.04.1","5.4.0-1124.131~18.04.1","5.4.0-1126.133~18.04.1","5.4.0-1127.134~18.04.1","5.4.0-1128.135~18.04.1","5.4.0-1129.136~18.04.1","5.4.0-1130.137~18.04.1","5.4.0-1131.138~18.04.1","5.4.0-1132.139~18.04.1","5.4.0-1133.140~18.04.1","5.4.0-1134.141~18.04.1","5.4.0-1135.142~18.04.1","5.4.0-1136.143~18.04.1","5.4.0-1137.144~18.04.1","5.4.0-1138.145~18.04.1","5.4.0-1139.146~18.04.1","5.4.0-1140.147~18.04.1","5.4.0-1142.149~18.04.1","5.4.0-1143.150~18.04.1","5.4.0-1145.152~18.04.1","5.4.0-1147.154~18.04.1","5.4.0-1148.155~18.04.1","5.4.0-1149.156~18.04.1","5.4.0-1150.157~18.04.1","5.4.0-1151.158~18.04.1","5.4.0-1152.159~18.04.1","5.4.0-1153.160~18.04.1","5.4.0-1154.161~18.04.1","5.4.0-1156.163~18.04.1","5.4.0-1157.164~18.04.1","5.4.0-1161.167~18.04.1","5.4.0-1162.168~18.04.1","5.4.0-1163.169~18.04.1","5.4.0-1164.170~18.04.1","5.4.0-1166.172~18.04.1","5.4.0-1167.173~18.04.1","5.4.0-1168.174~18.04.1","5.4.0-1169.175~18.04.1","5.4.0-1170.176~18.04.1","5.4.0-1171.177~18.04.1","5.4.0-1172.178~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-1006.6~18.04.1","4.18.0-1007.7~18.04.1","4.18.0-1008.8~18.04.1","5.0.0-1012.12~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1001.1","4.15.0-1003.3","4.15.0-1005.5","4.15.0-1006.6","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1010.10","4.15.0-1014.14","4.15.0-1015.15","4.15.0-1017.18","4.15.0-1018.19","4.15.0-1019.20","4.15.0-1021.22","4.15.0-1023.24","4.15.0-1024.25","4.15.0-1025.26","4.15.0-1026.27","4.15.0-1027.28","4.15.0-1028.29","4.15.0-1029.31","4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1042.45","4.15.0-1044.70","5.0.0-1020.20~18.04.1","5.0.0-1021.21~18.04.1","5.0.0-1025.26~18.04.1","5.0.0-1026.27~18.04.1","5.0.0-1028.29~18.04.1","5.0.0-1029.30~18.04.1","5.0.0-1031.32","5.0.0-1033.34","5.0.0-1034.35"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1020.22~18.04.1","5.3.0-1026.28~18.04.1","5.3.0-1029.31~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-gcp-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1019.19~18.04.2","5.4.0-1021.21~18.04.1","5.4.0-1022.22~18.04.1","5.4.0-1024.24~18.04.1","5.4.0-1025.25~18.04.1","5.4.0-1028.29~18.04.1","5.4.0-1029.31~18.04.1","5.4.0-1030.32~18.04.1","5.4.0-1032.34~18.04.1","5.4.0-1033.35~18.04.1","5.4.0-1034.37~18.04.1","5.4.0-1036.39~18.04.1","5.4.0-1037.40~18.04.1","5.4.0-1038.41~18.04.1","5.4.0-1040.43~18.04.1","5.4.0-1041.44~18.04.1","5.4.0-1042.45~18.04.1","5.4.0-1043.46~18.04.1","5.4.0-1044.47~18.04.2","5.4.0-1046.49~18.04.1","5.4.0-1049.53~18.04.1","5.4.0-1051.55~18.04.1","5.4.0-1052.56~18.04.1","5.4.0-1053.57~18.04.1","5.4.0-1055.59~18.04.1","5.4.0-1056.60~18.04.1","5.4.0-1057.61~18.04.1","5.4.0-1058.62~18.04.1","5.4.0-1059.63~18.04.1","5.4.0-1060.64~18.04.1","5.4.0-1062.66~18.04.1","5.4.0-1063.67~18.04.1","5.4.0-1064.68~18.04.1","5.4.0-1065.69~18.04.1","5.4.0-1067.71~18.04.1","5.4.0-1068.72~18.04.1","5.4.0-1069.73~18.04.1","5.4.0-1072.77~18.04.1","5.4.0-1073.78~18.04.1","5.4.0-1075.80~18.04.1","5.4.0-1078.84~18.04.1","5.4.0-1080.87~18.04.1","5.4.0-1083.91~18.04.1","5.4.0-1084.92~18.04.1","5.4.0-1086.94~18.04.1","5.4.0-1087.95~18.04.1","5.4.0-1089.97~18.04.1","5.4.0-1092.101~18.04.1","5.4.0-1093.102~18.04.1","5.4.0-1096.105~18.04.2","5.4.0-1097.106~18.04.1","5.4.0-1098.107~18.04.1","5.4.0-1100.109~18.04.1","5.4.0-1101.110~18.04.1","5.4.0-1102.111~18.04.2","5.4.0-1103.112~18.04.1","5.4.0-1104.113~18.04.1","5.4.0-1105.114~18.04.1","5.4.0-1106.115~18.04.1","5.4.0-1107.116~18.04.1","5.4.0-1108.117~18.04.1","5.4.0-1109.118~18.04.1","5.4.0-1110.119~18.04.1","5.4.0-1111.120~18.04.1","5.4.0-1112.121~18.04.1","5.4.0-1113.122~18.04.1","5.4.0-1115.124~18.04.1","5.4.0-1116.125~18.04.1","5.4.0-1117.126~18.04.1","5.4.0-1118.127~18.04.1","5.4.0-1120.129~18.04.1","5.4.0-1121.130~18.04.1","5.4.0-1122.131~18.04.1","5.4.0-1123.132~18.04.1","5.4.0-1124.133~18.04.1","5.4.0-1125.134~18.04.1","5.4.0-1126.135~18.04.1","5.4.0-1127.136~18.04.1","5.4.0-1128.137~18.04.1","5.4.0-1129.138~18.04.1","5.4.0-1130.139~18.04.1","5.4.0-1132.141~18.04.1","5.4.0-1133.142~18.04.1","5.4.0-1134.143~18.04.1","5.4.0-1135.144~18.04.1","5.4.0-1136.145~18.04.1","5.4.0-1137.146~18.04.1","5.4.0-1138.147~18.04.1","5.4.0-1139.148~18.04.1","5.4.0-1140.149~18.04.1","5.4.0-1141.150~18.04.1","5.4.0-1142.151~18.04.1","5.4.0-1143.152~18.04.1","5.4.0-1145.154~18.04.1","5.4.0-1147.156~18.04.1","5.4.0-1148.157~18.04.1","5.4.0-1149.158~18.04.1","5.4.0-1150.159~18.04.1","5.4.0-1151.160~18.04.1","5.4.0-1152.161~18.04.1","5.4.0-1153.162~18.04.1","5.4.0-1154.163~18.04.1","5.4.0-1155.164~18.04.1","5.4.0-1156.165~18.04.1","5.4.0-1157.166~18.04.1","5.4.0-1159.168~18.04.1","5.4.0-1160.169~18.04.1","5.4.0-1161.170~18.04.1","5.4.0-1162.171~18.04.1","5.4.0-1163.172~18.04.1","5.4.0-1164.173~18.04.1","5.4.0-1165.174~18.04.1","5.4.0-1166.175~18.04.1","5.4.0-1167.176~18.04.1","5.4.0-1168.178~18.04.1","5.4.0-1169.179~18.04.1","5.4.0-1170.180~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-4.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1041.43","4.15.0-1042.44","4.15.0-1044.46","4.15.0-1045.48","4.15.0-1046.49","4.15.0-1048.51","4.15.0-1049.52","4.15.0-1050.53","4.15.0-1052.55","4.15.0-1055.58","4.15.0-1057.60","4.15.0-1058.61","4.15.0-1059.62","4.15.0-1063.66","4.15.0-1064.67","4.15.0-1066.69","4.15.0-1067.70","4.15.0-1069.72","4.15.0-1070.73","4.15.0-1072.76","4.15.0-1073.78","4.15.0-1074.79","4.15.0-1076.81","4.15.0-1077.82","4.15.0-1078.83","4.15.0-1079.84"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1025.25~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.31~18.04.1","5.4.0-1030.32~18.04.1","5.4.0-1032.34~18.04.1","5.4.0-1033.35~18.04.1","5.4.0-1035.37~18.04.1","5.4.0-1036.38~18.04.1","5.4.0-1037.39~18.04.1","5.4.0-1039.41~18.04.1","5.4.0-1040.42~18.04.1","5.4.0-1042.44~18.04.1","5.4.0-1043.45~18.04.1","5.4.0-1044.46~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1","5.4.0-1052.55~18.04.1","5.4.0-1053.56~18.04.1","5.4.0-1054.57~18.04.1","5.4.0-1055.58~18.04.1","5.4.0-1056.59~18.04.1","5.4.0-1057.60~18.04.1","5.4.0-1059.62~18.04.1","5.4.0-1061.64~18.04.1","5.4.0-1062.65~18.04.1","5.4.0-1063.66~18.04.1","5.4.0-1065.68~18.04.1","5.4.0-1066.69~18.04.1","5.4.0-1067.70~18.04.1","5.4.0-1068.71~18.04.1","5.4.0-1071.76~18.04.3","5.4.0-1072.77~18.04.1","5.4.0-1074.79~18.04.1","5.4.0-1076.82~18.04.1","5.4.0-1078.84~18.04.1","5.4.0-1080.86~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gkeop-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1001.1","5.4.0-1003.3","5.4.0-1004.5","5.4.0-1005.6","5.4.0-1007.8~18.04.1","5.4.0-1008.9~18.04.1","5.4.0-1009.10~18.04.1","5.4.0-1010.11~18.04.1","5.4.0-1011.12~18.04.2","5.4.0-1012.13~18.04.1","5.4.0-1013.14~18.04.1","5.4.0-1014.15~18.04.1","5.4.0-1015.16~18.04.1","5.4.0-1016.17~18.04.1","5.4.0-1018.19~18.04.1","5.4.0-1021.22~18.04.1","5.4.0-1022.23~18.04.1","5.4.0-1023.24~18.04.1","5.4.0-1024.25~18.04.1","5.4.0-1025.26~18.04.1","5.4.0-1026.27~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.30~18.04.2","5.4.0-1031.32~18.04.1","5.4.0-1032.33~18.04.1","5.4.0-1033.34~18.04.1","5.4.0-1034.35~18.04.1","5.4.0-1036.37~18.04.1","5.4.0-1037.38~18.04.1","5.4.0-1038.39~18.04.1","5.4.0-1039.40~18.04.1","5.4.0-1040.41~18.04.1","5.4.0-1043.44~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1048.51~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-13.14~18.04.1","4.18.0-14.15~18.04.1","4.18.0-15.16~18.04.1","4.18.0-16.17~18.04.1","4.18.0-17.18~18.04.1","4.18.0-18.19~18.04.1","4.18.0-20.21~18.04.1","4.18.0-21.22~18.04.1","4.18.0-22.23~18.04.1","4.18.0-24.25~18.04.1","4.18.0-25.26~18.04.1","5.0.0-23.24~18.04.1","5.0.0-25.26~18.04.1","5.0.0-27.28~18.04.1","5.0.0-29.31~18.04.1","5.0.0-31.33~18.04.1","5.0.0-32.34~18.04.2","5.0.0-35.38~18.04.1","5.0.0-36.39~18.04.1","5.0.0-37.40~18.04.1","5.3.0-26.28~18.04.1","5.3.0-28.30~18.04.1","5.3.0-40.32~18.04.1","5.3.0-42.34~18.04.1","5.3.0-45.37~18.04.1","5.3.0-46.38~18.04.1","5.3.0-51.44~18.04.2","5.3.0-53.47~18.04.1","5.3.0-59.53~18.04.1","5.3.0-61.55~18.04.1","5.3.0-62.56~18.04.1","5.3.0-64.58~18.04.1","5.3.0-65.59","5.3.0-66.60","5.3.0-67.61","5.3.0-68.63","5.3.0-69.65","5.3.0-70.66","5.3.0-72.68","5.3.0-73.69","5.3.0-74.70","5.3.0-75.71","5.3.0-76.72"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-hwe-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-37.41~18.04.1","5.4.0-39.43~18.04.1","5.4.0-40.44~18.04.1","5.4.0-42.46~18.04.1","5.4.0-45.49~18.04.2","5.4.0-47.51~18.04.1","5.4.0-48.52~18.04.1","5.4.0-51.56~18.04.1","5.4.0-52.57~18.04.1","5.4.0-53.59~18.04.1","5.4.0-54.60~18.04.1","5.4.0-56.62~18.04.1","5.4.0-58.64~18.04.1","5.4.0-59.65~18.04.1","5.4.0-60.67~18.04.1","5.4.0-62.70~18.04.1","5.4.0-64.72~18.04.1","5.4.0-65.73~18.04.1","5.4.0-66.74~18.04.2","5.4.0-67.75~18.04.1","5.4.0-70.78~18.04.1","5.4.0-71.79~18.04.1","5.4.0-72.80~18.04.1","5.4.0-73.82~18.04.1","5.4.0-74.83~18.04.1","5.4.0-77.86~18.04.1","5.4.0-80.90~18.04.1","5.4.0-81.91~18.04.1","5.4.0-84.94~18.04.1","5.4.0-86.97~18.04.1","5.4.0-87.98~18.04.1","5.4.0-89.100~18.04.1","5.4.0-90.101~18.04.1","5.4.0-91.102~18.04.1","5.4.0-92.103~18.04.2","5.4.0-94.106~18.04.1","5.4.0-96.109~18.04.1","5.4.0-97.110~18.04.1","5.4.0-99.112~18.04.1","5.4.0-100.113~18.04.1","5.4.0-104.118~18.04.1","5.4.0-105.119~18.04.1","5.4.0-107.121~18.04.1","5.4.0-109.123~18.04.1","5.4.0-110.124~18.04.1","5.4.0-113.127~18.04.1","5.4.0-117.132~18.04.1","5.4.0-120.136~18.04.1","5.4.0-121.137~18.04.1","5.4.0-122.138~18.04.1","5.4.0-124.140~18.04.1","5.4.0-125.141~18.04.1","5.4.0-126.142~18.04.1","5.4.0-128.144~18.04.1","5.4.0-131.147~18.04.1","5.4.0-132.148~18.04.1","5.4.0-133.149~18.04.1","5.4.0-135.152~18.04.2","5.4.0-136.153~18.04.1","5.4.0-137.154~18.04.1","5.4.0-139.156~18.04.1","5.4.0-144.161~18.04.1","5.4.0-146.163~18.04.1","5.4.0-147.164~18.04.1","5.4.0-148.165~18.04.1","5.4.0-149.166~18.04.1","5.4.0-150.167~18.04.1","5.4.0-152.169~18.04.1","5.4.0-153.170~18.04.1","5.4.0-155.172~18.04.1","5.4.0-156.173~18.04.1","5.4.0-159.176~18.04.1","5.4.0-162.179~18.04.1","5.4.0-163.180~18.04.1","5.4.0-164.181~18.04.1","5.4.0-165.182~18.04.1","5.4.0-166.183~18.04.2","5.4.0-167.184~18.04.1","5.4.0-169.187~18.04.1","5.4.0-170.188~18.04.1","5.4.0-171.189~18.04.1","5.4.0-172.190~18.04.1","5.4.0-173.191~18.04.1","5.4.0-174.193~18.04.1","5.4.0-175.195~18.04.1","5.4.0-177.197~18.04.1","5.4.0-181.201~18.04.1","5.4.0-182.202~18.04.1","5.4.0-186.206~18.04.1","5.4.0-187.207~18.04.1","5.4.0-189.209~18.04.1","5.4.0-190.210~18.04.1","5.4.0-192.212~18.04.1","5.4.0-193.213~18.04.1","5.4.0-195.215~18.04.1","5.4.0-196.216~18.04.1","5.4.0-198.218~18.04.1","5.4.0-200.220~18.04.1","5.4.0-202.222~18.04.1","5.4.0-204.224~18.04.1","5.4.0-205.225~18.04.1","5.4.0-208.228~18.04.1","5.4.0-211.231~18.04.1","5.4.0-212.232~18.04.1","5.4.0-214.234~18.04.1","5.4.0-215.235~18.04.1","5.4.0-216.236~18.04.1","5.4.0-218.238~18.04.1","5.4.0-219.239~18.04.1","5.4.0-220.240~18.04.1","5.4.0-221.241~18.04.1","5.4.0-222.242~18.04.1","5.4.0-223.243~18.04.1","5.4.0-224.244~18.04.1","5.4.0-225.245~18.04.1","5.4.0-227.247~18.04.1","5.4.0-228.248~18.04.1","5.4.0-229.249~18.04.1","5.4.0-231.251~18.04.1","5.4.0-233.253~18.04.1","5.4.0-234.254~18.04.1","5.4.0-238.258~18.04.1","5.4.0-241.261~18.04.1","5.4.0-242.262~18.04.1","5.4.0-244.264~18.04.1","5.4.0-245.265~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-15.16~18.04.1","5.0.0-16.17~18.04.1","5.0.0-17.18~18.04.1","5.0.0-19.20~18.04.1","5.0.0-20.21~18.04.1","5.3.0-19.20~18.04.2","5.3.0-22.24~18.04.1","5.3.0-23.25~18.04.1","5.3.0-23.25~18.04.2","5.3.0-24.26~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-ibm-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1010.11~18.04.2","5.4.0-1012.13~18.04.1","5.4.0-1014.15~18.04.1","5.4.0-1015.16~18.04.1","5.4.0-1017.19~18.04.1","5.4.0-1018.20~18.04.1","5.4.0-1019.21~18.04.1","5.4.0-1020.22~18.04.1","5.4.0-1021.23~18.04.1","5.4.0-1023.25~18.04.1","5.4.0-1026.29~18.04.1","5.4.0-1028.32~18.04.1","5.4.0-1029.33~18.04.1","5.4.0-1031.35~18.04.1","5.4.0-1032.36~18.04.1","5.4.0-1033.37~18.04.1","5.4.0-1034.38~18.04.1","5.4.0-1036.41~18.04.1","5.4.0-1037.42~18.04.1","5.4.0-1040.45~18.04.2","5.4.0-1041.46~18.04.1","5.4.0-1042.47~18.04.1","5.4.0-1044.49~18.04.1","5.4.0-1045.50~18.04.1","5.4.0-1046.51~18.04.1","5.4.0-1047.52~18.04.1","5.4.0-1048.53~18.04.1","5.4.0-1049.54~18.04.1","5.4.0-1050.55~18.04.1","5.4.0-1051.56~18.04.1","5.4.0-1052.57~18.04.1","5.4.0-1053.58~18.04.1","5.4.0-1054.59~18.04.1","5.4.0-1056.61~18.04.1","5.4.0-1057.62~18.04.1","5.4.0-1058.63~18.04.1","5.4.0-1059.64~18.04.1","5.4.0-1060.65~18.04.1","5.4.0-1061.66~18.04.1","5.4.0-1063.68~18.04.1","5.4.0-1064.69~18.04.1","5.4.0-1065.70~18.04.1","5.4.0-1066.71~18.04.1","5.4.0-1067.72~18.04.1","5.4.0-1068.73~18.04.1","5.4.0-1069.74~18.04.1","5.4.0-1070.75~18.04.1","5.4.0-1071.76~18.04.1","5.4.0-1072.77~18.04.1","5.4.0-1073.78~18.04.1","5.4.0-1074.79~18.04.1","5.4.0-1075.80~18.04.1","5.4.0-1076.81~18.04.1","5.4.0-1077.82~18.04.1","5.4.0-1078.83~18.04.1","5.4.0-1079.84~18.04.1","5.4.0-1080.85~18.04.1","5.4.0-1081.86~18.04.1","5.4.0-1082.87~18.04.1","5.4.0-1083.88~18.04.1","5.4.0-1084.89~18.04.1","5.4.0-1085.90~18.04.1","5.4.0-1086.91~18.04.1","5.4.0-1090.95~18.04.1","5.4.0-1092.97~18.04.1","5.4.0-1093.98~18.04.1","5.4.0-1094.99~18.04.1","5.4.0-1095.100~18.04.1","5.4.0-1096.101~18.04.1","5.4.0-1097.102~18.04.1","5.4.0-1098.103~18.04.1","5.4.0-1099.104~18.04.1","5.4.0-1100.105~18.04.1","5.4.0-1102.107~18.04.1","5.4.0-1103.108~18.04.1","5.4.0-1104.109~18.04.1","5.4.0-1105.110~18.04.1","5.4.0-1107.112~18.04.1","5.4.0-1108.113~18.04.1","5.4.0-1109.114~18.04.1","5.4.0-1111.116~18.04.1","5.4.0-1112.117~18.04.1","5.4.0-1113.118~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.3","4.15.0-1004.5","4.15.0-1006.9","4.15.0-1008.11","4.15.0-1009.12","4.15.0-1012.15","4.15.0-1013.16","4.15.0-1015.18","4.15.0-1017.20","4.15.0-1018.21","4.15.0-1021.24","4.15.0-1024.29","4.15.0-1026.31","4.15.0-1028.33","4.15.0-1030.35","4.15.0-1033.38","4.15.0-1034.39","4.15.0-1035.40","4.15.0-1036.41","4.15.0-1038.43","4.15.0-1039.44","4.15.0-1043.48","4.15.0-1045.50","4.15.0-1050.57","4.15.0-1056.65","4.15.0-1057.66","4.15.0-1059.68","4.15.0-1063.72","4.15.0-1064.73","4.15.0-1065.75","4.15.0-1066.76","4.15.0-1067.77","4.15.0-1069.79","4.15.0-1073.83","4.15.0-1076.86","4.15.0-1079.89","4.15.0-1080.90","4.15.0-1081.91","4.15.0-1087.97","4.15.0-1090.100","4.15.0-1091.101","4.15.0-1093.103","4.15.0-1094.104","4.15.0-1096.106","4.15.0-1097.107","4.15.0-1099.109","4.15.0-1100.110","4.15.0-1101.112","4.15.0-1102.113","4.15.0-1103.114"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1007.12~18.04.1","5.0.0-1008.13~18.04.1","5.0.0-1009.14~18.04.1","5.0.0-1010.15~18.04.1","5.0.0-1011.16","5.0.0-1013.18","5.0.0-1014.19"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1011.12~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.18~18.04.1","5.3.0-1018.20~18.04.1","5.3.0-1024.26~18.04.1","5.3.0-1027.29~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-oracle-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1019.19~18.04.1","5.4.0-1021.21~18.04.1","5.4.0-1022.22~18.04.1","5.4.0-1024.24~18.04.1","5.4.0-1025.25~18.04.1","5.4.0-1028.29~18.04.1","5.4.0-1029.31~18.04.1","5.4.0-1030.32~18.04.1","5.4.0-1033.35","5.4.0-1034.36~18.04.1","5.4.0-1035.38~18.04.1","5.4.0-1037.40~18.04.1","5.4.0-1038.41~18.04.1","5.4.0-1039.42~18.04.1","5.4.0-1041.44~18.04.1","5.4.0-1042.45~18.04.1","5.4.0-1043.46~18.04.1","5.4.0-1044.47~18.04.1","5.4.0-1046.50~18.04.2","5.4.0-1048.52~18.04.1","5.4.0-1049.53~18.04.1","5.4.0-1052.56~18.04.1","5.4.0-1053.57~18.04.1","5.4.0-1054.58~18.04.1","5.4.0-1055.59~18.04.1","5.4.0-1056.60~18.04.1","5.4.0-1057.61~18.04.1","5.4.0-1058.62~18.04.1","5.4.0-1059.63~18.04.1","5.4.0-1061.65~18.04.1","5.4.0-1062.66~18.04.1","5.4.0-1063.67~18.04.1","5.4.0-1064.68~18.04.1","5.4.0-1066.71~18.04.1","5.4.0-1067.72~18.04.1","5.4.0-1069.75~18.04.1","5.4.0-1070.76~18.04.1","5.4.0-1071.77~18.04.1","5.4.0-1073.79~18.04.1","5.4.0-1076.83~18.04.1","5.4.0-1078.86~18.04.1","5.4.0-1079.87~18.04.1","5.4.0-1081.89~18.04.1","5.4.0-1082.90~18.04.1","5.4.0-1083.91~18.04.1","5.4.0-1084.92~18.04.1","5.4.0-1086.95~18.04.1","5.4.0-1087.96~18.04.1","5.4.0-1090.99~18.04.2","5.4.0-1091.100~18.04.1","5.4.0-1092.101~18.04.1","5.4.0-1093.102~18.04.1","5.4.0-1094.103~18.04.1","5.4.0-1098.107~18.04.1","5.4.0-1099.108~18.04.1","5.4.0-1100.109~18.04.1","5.4.0-1101.110~18.04.1","5.4.0-1102.111~18.04.1","5.4.0-1103.112~18.04.1","5.4.0-1104.113~18.04.1","5.4.0-1105.114~18.04.1","5.4.0-1106.115~18.04.1","5.4.0-1107.116~18.04.1","5.4.0-1108.117~18.04.1","5.4.0-1109.118~18.04.1","5.4.0-1110.119~18.04.1","5.4.0-1111.120~18.04.1","5.4.0-1112.121~18.04.4","5.4.0-1113.122~18.04.1","5.4.0-1115.124~18.04.1","5.4.0-1116.125~18.04.1","5.4.0-1117.126~18.04.1","5.4.0-1118.127~18.04.1","5.4.0-1119.128~18.04.1","5.4.0-1120.129~18.04.1","5.4.0-1121.130~18.04.1","5.4.0-1122.131~18.04.1","5.4.0-1123.132~18.04.1","5.4.0-1124.133~18.04.1","5.4.0-1125.134~18.04.1","5.4.0-1126.135~18.04.1","5.4.0-1127.136~18.04.1","5.4.0-1129.138~18.04.1","5.4.0-1130.139~18.04.1","5.4.0-1131.140~18.04.1","5.4.0-1132.141~18.04.1","5.4.0-1133.142~18.04.1","5.4.0-1134.143~18.04.1","5.4.0-1135.144~18.04.1","5.4.0-1136.145~18.04.1","5.4.0-1137.146~18.04.1","5.4.0-1138.147~18.04.1","5.4.0-1140.149~18.04.1","5.4.0-1141.151~18.04.1","5.4.0-1142.152~18.04.1","5.4.0-1143.153~18.04.1","5.4.0-1144.154~18.04.1","5.4.0-1145.155~18.04.1","5.4.0-1146.156~18.04.1","5.4.0-1148.158~18.04.1","5.4.0-1149.159~18.04.1","5.4.0-1150.160~18.04.1","5.4.0-1151.161~18.04.1","5.4.0-1152.162~18.04.1","5.4.0-1154.164~18.04.1","5.4.0-1155.165~18.04.1","5.4.0-1156.166~18.04.2","5.4.0-1157.167~18.04.1","5.4.0-1158.168~18.04.1","5.4.0-1159.169~18.04.1","5.4.0-1161.171~18.04.1","5.4.0-1162.172~18.04.1","5.4.0-1163.173~18.04.1","5.4.0-1164.174~18.04.1","5.4.0-1165.175~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-raspi-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1013.13~18.04.1","5.4.0-1015.15~18.04.1","5.4.0-1016.17~18.04.1","5.4.0-1018.20~18.04.1","5.4.0-1019.21~18.04.1","5.4.0-1021.24~18.04.1","5.4.0-1022.25~18.04.1","5.4.0-1023.26~18.04.1","5.4.0-1025.28~18.04.1","5.4.0-1026.29~18.04.1","5.4.0-1028.31~18.04.1","5.4.0-1029.32~18.04.1","5.4.0-1030.33~18.04.1","5.4.0-1032.35~18.04.1","5.4.0-1033.36~18.04.1","5.4.0-1034.37~18.04.1","5.4.0-1035.38~18.04.1","5.4.0-1036.39~18.04.1","5.4.0-1038.41~18.04.1","5.4.0-1041.45~18.04.1","5.4.0-1042.46~18.04.3","5.4.0-1043.47~18.04.1","5.4.0-1044.48~18.04.1","5.4.0-1045.49~18.04.1","5.4.0-1046.50~18.04.1","5.4.0-1047.52~18.04.1","5.4.0-1048.53~18.04.1","5.4.0-1050.56~18.04.1","5.4.0-1052.58~18.04.1","5.4.0-1053.60~18.04.1","5.4.0-1055.62~18.04.1","5.4.0-1056.63~18.04.1","5.4.0-1058.65~18.04.1","5.4.0-1059.66~18.04.1","5.4.0-1060.68~18.04.1","5.4.0-1062.70~18.04.1","5.4.0-1065.75~18.04.1","5.4.0-1066.76~18.04.1","5.4.0-1068.78~18.04.1","5.4.0-1069.79~18.04.1","5.4.0-1070.80~18.04.1","5.4.0-1071.81~18.04.1","5.4.0-1073.84~18.04.1","5.4.0-1074.85~18.04.1","5.4.0-1077.88~18.04.2","5.4.0-1078.89~18.04.1","5.4.0-1079.90~18.04.1","5.4.0-1080.91~18.04.1","5.4.0-1081.92~18.04.1","5.4.0-1082.93~18.04.1","5.4.0-1083.94~18.04.1","5.4.0-1084.95~18.04.1","5.4.0-1085.96~18.04.1","5.4.0-1086.97~18.04.1","5.4.0-1088.99~18.04.1","5.4.0-1089.100~18.04.1","5.4.0-1090.101~18.04.1","5.4.0-1091.102~18.04.1","5.4.0-1092.103~18.04.1","5.4.0-1093.104~18.04.1","5.4.0-1094.105~18.04.1","5.4.0-1095.106~18.04.1","5.4.0-1096.107~18.04.1","5.4.0-1097.109~18.04.2","5.4.0-1098.110~18.04.2","5.4.0-1100.112~18.04.1","5.4.0-1101.113~18.04.1","5.4.0-1102.114~18.04.1","5.4.0-1103.115~18.04.1","5.4.0-1104.116~18.04.1","5.4.0-1105.117~18.04.1","5.4.0-1106.118~18.04.1","5.4.0-1107.119~18.04.1","5.4.0-1108.120~18.04.1","5.4.0-1109.121~18.04.1","5.4.0-1110.122~18.04.1","5.4.0-1111.123~18.04.1","5.4.0-1112.124~18.04.1","5.4.0-1114.126~18.04.1","5.4.0-1115.127~18.04.1","5.4.0-1116.128~18.04.1","5.4.0-1117.129~18.04.1","5.4.0-1118.130~18.04.1","5.4.0-1119.131~18.04.1","5.4.0-1120.132~18.04.1","5.4.0-1121.133~18.04.1","5.4.0-1122.134~18.04.1","5.4.0-1129.142~18.04.1","5.4.0-1130.143~18.04.1","5.4.0-1131.144~18.04.1","5.4.0-1132.145~18.04.1","5.4.0-1133.146~18.04.1","5.4.0-1134.147~18.04.1","5.4.0-1135.148~18.04.1","5.4.0-1136.149~18.04.1","5.4.0-1137.150~18.04.1","5.4.0-1139.152~18.04.1","5.4.0-1140.153~18.04.1","5.4.0-1143.156~18.04.1","5.4.0-1144.157~18.04.1","5.4.0-1145.158~18.04.1","5.4.0-1146.159~18.04.1","5.4.0-1147.160~18.04.1","5.4.0-1148.161~18.04.1","5.4.0-1149.162~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-18.19","5.3.0-24.26","5.4.0-9.12","5.4.0-18.22","5.4.0-21.25","5.4.0-24.28","5.4.0-25.29","5.4.0-26.30","5.4.0-28.32","5.4.0-29.33","5.4.0-31.35","5.4.0-33.37","5.4.0-37.41","5.4.0-39.43","5.4.0-40.44","5.4.0-42.46","5.4.0-45.49","5.4.0-47.51","5.4.0-48.52","5.4.0-51.56","5.4.0-52.57","5.4.0-53.59","5.4.0-54.60","5.4.0-56.62","5.4.0-58.64","5.4.0-59.65","5.4.0-60.67","5.4.0-62.70","5.4.0-64.72","5.4.0-65.73","5.4.0-66.74","5.4.0-67.75","5.4.0-70.78","5.4.0-71.79","5.4.0-72.80","5.4.0-73.82","5.4.0-74.83","5.4.0-77.86","5.4.0-80.90","5.4.0-81.91","5.4.0-84.94","5.4.0-86.97","5.4.0-88.99","5.4.0-89.100","5.4.0-90.101","5.4.0-91.102","5.4.0-92.103","5.4.0-94.106","5.4.0-96.109","5.4.0-97.110","5.4.0-99.112","5.4.0-100.113","5.4.0-104.118","5.4.0-105.119","5.4.0-107.121","5.4.0-109.123","5.4.0-110.124","5.4.0-113.127","5.4.0-117.132","5.4.0-120.136","5.4.0-121.137","5.4.0-122.138","5.4.0-124.140","5.4.0-125.141","5.4.0-126.142","5.4.0-128.144","5.4.0-131.147","5.4.0-132.148","5.4.0-135.152","5.4.0-136.153","5.4.0-137.154","5.4.0-139.156","5.4.0-144.161","5.4.0-146.163","5.4.0-147.164","5.4.0-148.165","5.4.0-149.166","5.4.0-150.167","5.4.0-152.169","5.4.0-153.170","5.4.0-155.172","5.4.0-156.173","5.4.0-159.176","5.4.0-162.179","5.4.0-163.180","5.4.0-164.181","5.4.0-165.182","5.4.0-166.183","5.4.0-167.184","5.4.0-169.187","5.4.0-170.188","5.4.0-171.189","5.4.0-172.190","5.4.0-173.191","5.4.0-174.193","5.4.0-176.196","5.4.0-177.197","5.4.0-181.201","5.4.0-182.202","5.4.0-186.206","5.4.0-187.207","5.4.0-189.209","5.4.0-190.210","5.4.0-192.212","5.4.0-193.213","5.4.0-195.215","5.4.0-196.216","5.4.0-198.218","5.4.0-200.220","5.4.0-202.222","5.4.0-204.224","5.4.0-205.225","5.4.0-208.228","5.4.0-211.231","5.4.0-212.232","5.4.0-214.234","5.4.0-215.235","5.4.0-216.236","5.4.0-218.238","5.4.0-219.239","5.4.0-220.240","5.4.0-221.241","5.4.0-222.242","5.4.0-223.243","5.4.0-224.244","5.4.0-225.245","5.4.0-227.247","5.4.0-228.248","5.4.0-229.249","5.4.0-230.250","5.4.0-231.251","5.4.0-233.253","5.4.0-234.254","5.4.0-238.258","5.4.0-241.261","5.4.0-242.262","5.4.0-244.264","5.4.0-245.265"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1003.3","5.3.0-1008.9","5.3.0-1009.10","5.3.0-1010.11","5.4.0-1005.5","5.4.0-1007.7","5.4.0-1008.8","5.4.0-1009.9","5.4.0-1011.11","5.4.0-1015.15","5.4.0-1017.17","5.4.0-1018.18","5.4.0-1020.20","5.4.0-1021.21","5.4.0-1022.22","5.4.0-1024.24","5.4.0-1025.25","5.4.0-1028.29","5.4.0-1029.30","5.4.0-1030.31","5.4.0-1032.33","5.4.0-1034.35","5.4.0-1035.37","5.4.0-1037.39","5.4.0-1038.40","5.4.0-1039.41","5.4.0-1041.43","5.4.0-1043.45","5.4.0-1045.47","5.4.0-1047.49","5.4.0-1048.50","5.4.0-1049.51","5.4.0-1051.53","5.4.0-1054.57","5.4.0-1055.58","5.4.0-1056.59","5.4.0-1057.60","5.4.0-1058.61","5.4.0-1059.62","5.4.0-1060.63","5.4.0-1061.64","5.4.0-1063.66","5.4.0-1064.67","5.4.0-1065.68","5.4.0-1066.69","5.4.0-1068.72","5.4.0-1069.73","5.4.0-1071.76","5.4.0-1072.77","5.4.0-1073.78","5.4.0-1075.80","5.4.0-1078.84","5.4.0-1080.87","5.4.0-1081.88","5.4.0-1083.90","5.4.0-1084.91","5.4.0-1085.92","5.4.0-1086.93","5.4.0-1088.96","5.4.0-1089.97","5.4.0-1092.100","5.4.0-1093.101","5.4.0-1094.102","5.4.0-1096.104","5.4.0-1097.105","5.4.0-1099.107","5.4.0-1100.108","5.4.0-1101.109","5.4.0-1102.110","5.4.0-1103.111","5.4.0-1104.112","5.4.0-1105.113","5.4.0-1106.114","5.4.0-1107.115","5.4.0-1108.116","5.4.0-1109.118","5.4.0-1110.119","5.4.0-1111.120","5.4.0-1112.121","5.4.0-1113.123","5.4.0-1114.124","5.4.0-1116.126","5.4.0-1117.127","5.4.0-1118.128","5.4.0-1119.129","5.4.0-1120.130","5.4.0-1121.131","5.4.0-1122.132","5.4.0-1123.133","5.4.0-1124.134","5.4.0-1125.135","5.4.0-1126.136","5.4.0-1127.137","5.4.0-1128.138","5.4.0-1129.139","5.4.0-1130.140","5.4.0-1131.141","5.4.0-1132.142","5.4.0-1133.143","5.4.0-1134.144","5.4.0-1135.145","5.4.0-1136.146","5.4.0-1137.147","5.4.0-1139.149","5.4.0-1140.150","5.4.0-1142.152","5.4.0-1144.154","5.4.0-1145.155","5.4.0-1146.156","5.4.0-1147.157","5.4.0-1148.158","5.4.0-1149.159","5.4.0-1150.160","5.4.0-1151.161","5.4.0-1152.162","5.4.0-1153.163","5.4.0-1154.164","5.4.0-1156.166","5.4.0-1157.167","5.4.0-1158.168","5.4.0-1159.169","5.4.0-1160.170","5.4.0-1161.172","5.4.0-1162.173","5.4.0-1163.174","5.4.0-1164.175","5.4.0-1165.176","5.4.0-1166.177","5.4.0-1167.178"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.9~20.04.2","5.11.0-1014.15~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.2","5.11.0-1021.22~20.04.2","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.2","5.13.0-1011.12~20.04.1","5.13.0-1012.13~20.04.1","5.13.0-1014.15~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1019.21~20.04.1","5.13.0-1021.23~20.04.2","5.13.0-1022.24~20.04.1","5.13.0-1023.25~20.04.1","5.13.0-1025.27~20.04.1","5.13.0-1028.31~20.04.1","5.13.0-1029.32~20.04.1","5.13.0-1031.35~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-aws-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1014.18~20.04.1","5.15.0-1015.19~20.04.1","5.15.0-1017.21~20.04.1","5.15.0-1019.23~20.04.1","5.15.0-1020.24~20.04.1","5.15.0-1021.25~20.04.1","5.15.0-1022.26~20.04.1","5.15.0-1023.27~20.04.1","5.15.0-1026.30~20.04.2","5.15.0-1027.31~20.04.1","5.15.0-1028.32~20.04.1","5.15.0-1030.34~20.04.1","5.15.0-1031.35~20.04.1","5.15.0-1033.37~20.04.1","5.15.0-1034.38~20.04.1","5.15.0-1035.39~20.04.1","5.15.0-1036.40~20.04.1","5.15.0-1037.41~20.04.1","5.15.0-1038.43~20.04.1","5.15.0-1039.44~20.04.1","5.15.0-1040.45~20.04.1","5.15.0-1041.46~20.04.1","5.15.0-1043.48~20.04.1","5.15.0-1044.49~20.04.1","5.15.0-1045.50~20.04.1","5.15.0-1047.52~20.04.1","5.15.0-1048.53~20.04.1","5.15.0-1049.54~20.04.1","5.15.0-1050.55~20.04.1","5.15.0-1051.56~20.04.1","5.15.0-1052.57~20.04.1","5.15.0-1053.58~20.04.1","5.15.0-1055.60~20.04.1","5.15.0-1056.61~20.04.1","5.15.0-1057.63~20.04.1","5.15.0-1058.64~20.04.1","5.15.0-1061.67~20.04.1","5.15.0-1062.68~20.04.1","5.15.0-1063.69~20.04.1","5.15.0-1064.70~20.04.1","5.15.0-1065.71~20.04.1","5.15.0-1066.72~20.04.1","5.15.0-1067.73~20.04.1","5.15.0-1068.74~20.04.1","5.15.0-1069.75~20.04.1","5.15.0-1070.76~20.04.1","5.15.0-1071.77~20.04.1","5.15.0-1072.78~20.04.1","5.15.0-1073.79~20.04.1","5.15.0-1075.82~20.04.1","5.15.0-1077.84~20.04.1","5.15.0-1080.87~20.04.1","5.15.0-1081.88~20.04.1","5.15.0-1082.89~20.04.1","5.15.0-1083.90~20.04.1","5.15.0-1084.91~20.04.1","5.15.0-1086.93~20.04.1","5.15.0-1087.94~20.04.1","5.15.0-1088.95~20.04.1","5.15.0-1089.96~20.04.1","5.15.0-1090.97~20.04.1","5.15.0-1091.98~20.04.1","5.15.0-1092.99~20.04.1","5.15.0-1093.100~20.04.1","5.15.0-1095.102~20.04.1","5.15.0-1096.103~20.04.1","5.15.0-1097.104~20.04.1","5.15.0-1098.105~20.04.1","5.15.0-1099.106~20.04.1","5.15.0-1100.107~20.04.2","5.15.0-1101.108~20.04.1","5.15.0-1103.110~20.04.1","5.15.0-1104.111~20.04.1","5.15.0-1105.112~20.04.1","5.15.0-1106.113~20.04.1","5.15.0-1108.115~20.04.1","5.15.0-1109.116~20.04.1","5.15.0-1111.118~20.04.1","5.15.0-1112.119~20.04.1","5.15.0-1114.121~20.04.1","5.15.0-1115.122~20.04.1","5.15.0-1116.123~20.04.1","5.15.0-1117.124~20.04.1","5.15.0-1119.126~20.04.1","5.15.0-1120.127~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1041.43~20.04.1","5.8.0-1042.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1003.3","5.3.0-1008.9","5.3.0-1009.10","5.4.0-1006.6","5.4.0-1008.8","5.4.0-1009.9","5.4.0-1010.10","5.4.0-1012.12","5.4.0-1016.16","5.4.0-1019.19","5.4.0-1020.20","5.4.0-1022.22","5.4.0-1023.23","5.4.0-1025.25","5.4.0-1026.26","5.4.0-1031.32","5.4.0-1032.33","5.4.0-1034.35","5.4.0-1035.36","5.4.0-1036.38","5.4.0-1039.41","5.4.0-1040.42","5.4.0-1041.43","5.4.0-1043.45","5.4.0-1044.46","5.4.0-1046.48","5.4.0-1047.49","5.4.0-1048.50","5.4.0-1049.51","5.4.0-1051.53","5.4.0-1055.57","5.4.0-1056.58","5.4.0-1058.60","5.4.0-1059.62","5.4.0-1061.64","5.4.0-1062.65","5.4.0-1063.66","5.4.0-1064.67","5.4.0-1065.68","5.4.0-1067.70","5.4.0-1068.71","5.4.0-1069.72","5.4.0-1070.73","5.4.0-1072.75","5.4.0-1073.76","5.4.0-1074.77","5.4.0-1077.80","5.4.0-1078.81","5.4.0-1080.83","5.4.0-1083.87","5.4.0-1085.90","5.4.0-1086.91","5.4.0-1089.94","5.4.0-1090.95","5.4.0-1091.96","5.4.0-1094.100","5.4.0-1095.101","5.4.0-1098.104","5.4.0-1100.106","5.4.0-1101.107","5.4.0-1103.109","5.4.0-1104.110","5.4.0-1105.111","5.4.0-1106.112","5.4.0-1107.113","5.4.0-1108.114","5.4.0-1109.115","5.4.0-1110.116","5.4.0-1111.117","5.4.0-1112.118","5.4.0-1113.119","5.4.0-1114.120","5.4.0-1115.122","5.4.0-1116.123","5.4.0-1117.124","5.4.0-1118.125","5.4.0-1119.126","5.4.0-1120.127","5.4.0-1121.128","5.4.0-1122.129","5.4.0-1123.130","5.4.0-1124.131","5.4.0-1126.133","5.4.0-1127.134","5.4.0-1128.135","5.4.0-1129.136","5.4.0-1130.137","5.4.0-1131.138","5.4.0-1132.139","5.4.0-1133.140","5.4.0-1134.141","5.4.0-1135.142","5.4.0-1136.143","5.4.0-1137.144","5.4.0-1138.145","5.4.0-1139.146","5.4.0-1140.147","5.4.0-1142.149","5.4.0-1143.150","5.4.0-1145.152","5.4.0-1147.154","5.4.0-1148.155","5.4.0-1149.156","5.4.0-1150.157","5.4.0-1151.158","5.4.0-1152.159","5.4.0-1153.160","5.4.0-1154.161","5.4.0-1156.163","5.4.0-1157.164","5.4.0-1160.166","5.4.0-1161.167","5.4.0-1162.168","5.4.0-1163.169","5.4.0-1164.170","5.4.0-1166.172","5.4.0-1167.173","5.4.0-1168.174","5.4.0-1169.175","5.4.0-1170.176","5.4.0-1171.177","5.4.0-1172.178"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1007.7~20.04.2","5.11.0-1012.13~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10~20.04.2","5.13.0-1012.14~20.04.1","5.13.0-1013.15~20.04.1","5.13.0-1014.16~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1021.24~20.04.1","5.13.0-1022.26~20.04.1","5.13.0-1023.27~20.04.1","5.13.0-1025.29~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1029.34~20.04.1","5.13.0-1031.37~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-azure-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1007.8~20.04.1","5.15.0-1008.9~20.04.1","5.15.0-1013.16~20.04.1","5.15.0-1014.17~20.04.1","5.15.0-1017.20~20.04.1","5.15.0-1019.24~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1021.26~20.04.1","5.15.0-1022.27~20.04.1","5.15.0-1023.29~20.04.1","5.15.0-1029.36~20.04.1","5.15.0-1030.37~20.04.1","5.15.0-1031.38~20.04.1","5.15.0-1033.40~20.04.1","5.15.0-1034.41~20.04.1","5.15.0-1035.42~20.04.1","5.15.0-1036.43~20.04.1","5.15.0-1037.44~20.04.1","5.15.0-1038.45~20.04.1","5.15.0-1039.46~20.04.1","5.15.0-1040.47~20.04.1","5.15.0-1041.48~20.04.1","5.15.0-1042.49~20.04.1","5.15.0-1043.50~20.04.1","5.15.0-1045.52~20.04.1","5.15.0-1046.53~20.04.1","5.15.0-1047.54~20.04.1","5.15.0-1049.56~20.04.1","5.15.0-1050.57~20.04.1","5.15.0-1051.59~20.04.1","5.15.0-1052.60~20.04.1","5.15.0-1053.61~20.04.1","5.15.0-1054.62~20.04.1","5.15.0-1056.64~20.04.1","5.15.0-1057.65~20.04.1","5.15.0-1058.66~20.04.2","5.15.0-1059.67~20.04.1","5.15.0-1060.69~20.04.1","5.15.0-1061.70~20.04.1","5.15.0-1063.72~20.04.1","5.15.0-1064.73~20.04.1","5.15.0-1065.74~20.04.1","5.15.0-1067.76~20.04.1","5.15.0-1068.77~20.04.1","5.15.0-1070.79~20.04.1","5.15.0-1071.80~20.04.1","5.15.0-1072.81~20.04.1","5.15.0-1073.82~20.04.1","5.15.0-1074.83~20.04.1","5.15.0-1075.84~20.04.1","5.15.0-1078.87~20.04.1","5.15.0-1079.88~20.04.1","5.15.0-1081.90~20.04.1","5.15.0-1082.91~20.04.1","5.15.0-1086.95~20.04.1","5.15.0-1087.96~20.04.1","5.15.0-1088.97~20.04.1","5.15.0-1089.98~20.04.1","5.15.0-1091.100~20.04.1","5.15.0-1094.103~20.04.1","5.15.0-1095.104~20.04.1","5.15.0-1096.105~20.04.1","5.15.0-1097.106~20.04.1","5.15.0-1098.107~20.04.1","5.15.0-1102.111~20.04.1","5.15.0-1103.112~20.04.1","5.15.0-1110.119~20.04.1","5.15.0-1111.120~20.04.1","5.15.0-1114.123~20.04.1","5.15.0-1116.125~20.04.1","5.15.0-1117.126~20.04.1","5.15.0-1119.128~20.04.1","5.15.0-1121.130~20.04.1","5.15.0-1122.131~20.04.1","5.15.0-1123.132~20.04.1","5.15.0-1125.134~20.04.1","5.15.0-1126.135~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1033.35~20.04.1","5.8.0-1036.38~20.04.1","5.8.0-1039.42~20.04.1","5.8.0-1040.43~20.04.1","5.8.0-1041.44~20.04.1","5.8.0-1042.45~20.04.1","5.8.0-1043.46~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1063.66+cvm2.2","5.4.0-1063.66+cvm3.2","5.4.0-1064.67+cvm1.1","5.4.0-1065.68+cvm2.1","5.4.0-1067.70+cvm1.1","5.4.0-1068.71+cvm1.1","5.4.0-1069.72+cvm1.1","5.4.0-1070.73+cvm1.1","5.4.0-1072.75+cvm1.1","5.4.0-1073.76+cvm1.1","5.4.0-1074.77+cvm1.1","5.4.0-1076.79+cvm1.1","5.4.0-1078.81+cvm1.1","5.4.0-1080.83+cvm1.1","5.4.0-1083.87+cvm1.1","5.4.0-1085.90+cvm1.1","5.4.0-1085.90+cvm2.1","5.4.0-1086.91+cvm1.1","5.4.0-1089.94+cvm1.2","5.4.0-1090.95+cvm1.1","5.4.0-1091.96+cvm1.1","5.4.0-1092.97+cvm1.1","5.4.0-1095.101+cvm1.1","5.4.0-1098.104+cvm1.1","5.4.0-1100.106+cvm1.1","5.4.0-1103.109+cvm1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-azure-fde-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1019.24~20.04.1.1","5.15.0-1020.25~20.04.1.1","5.15.0-1021.26~20.04.1.1","5.15.0-1029.36~20.04.1.1","5.15.0-1030.37~20.04.1.1","5.15.0-1031.38~20.04.1.1","5.15.0-1033.40~20.04.1.1","5.15.0-1034.41~20.04.1.2","5.15.0-1035.42~20.04.1.1","5.15.0-1036.43~20.04.1.1","5.15.0-1037.44~20.04.1.1","5.15.0-1038.45~20.04.1.1","5.15.0-1039.46~20.04.1.1","5.15.0-1040.47~20.04.1.1","5.15.0-1041.48~20.04.1.1","5.15.0-1042.49~20.04.1.1","5.15.0-1043.50~20.04.1.1","5.15.0-1046.53~20.04.1.1","5.15.0-1047.54~20.04.1.1","5.15.0-1049.56~20.04.1.1","5.15.0-1050.57~20.04.1.1","5.15.0-1051.59~20.04.1.1","5.15.0-1052.60~20.04.1.1","5.15.0-1053.61~20.04.1.1","5.15.0-1054.62~20.04.1.1","5.15.0-1056.64~20.04.1.1","5.15.0-1057.65~20.04.1.1","5.15.0-1058.66~20.04.2.1","5.15.0-1059.67~20.04.1.1","5.15.0-1060.69~20.04.1.1","5.15.0-1061.70~20.04.1.1","5.15.0-1063.72~20.04.1.1","5.15.0-1064.73~20.04.1.1","5.15.0-1065.74~20.04.1.1","5.15.0-1067.76~20.04.1.1","5.15.0-1068.77~20.04.1.1","5.15.0-1070.79~20.04.1.1","5.15.0-1071.80~20.04.1.1","5.15.0-1072.81~20.04.1.1","5.15.0-1073.82~20.04.1.1","5.15.0-1074.83~20.04.1.1","5.15.0-1076.85~20.04.1.1","5.15.0-1078.87~20.04.1.1","5.15.0-1081.90~20.04.1.1","5.15.0-1082.91~20.04.1.1","5.15.0-1086.95~20.04.1.1","5.15.0-1087.96~20.04.1.1","5.15.0-1088.97~20.04.1.1","5.15.0-1089.98~20.04.1.1","5.15.0-1091.100~20.04.1.1","5.15.0-1094.103~20.04.1.1","5.15.0-1096.105~20.04.1.1","5.15.0-1097.106~20.04.1.1","5.15.0-1098.107~20.04.1.1","5.15.0-1102.111~20.04.1.1","5.15.0-1103.112~20.04.1.1","5.15.0-1111.120~20.04.1.1","5.15.0-1114.123~20.04.1","5.15.0-1116.125~20.04.1","5.15.0-1117.126~20.04.2","5.15.0-1118.127~20.04.1","5.15.0-1119.128~20.04.1","5.15.0-1120.129~20.04.1","5.15.0-1121.130~20.04.1","5.15.0-1122.131~20.04.1","5.15.0-1124.133~20.04.1","5.15.0-1125.134~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-bluefield","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1007.10","5.4.0-1011.14","5.4.0-1012.15","5.4.0-1013.16","5.4.0-1016.19","5.4.0-1019.22","5.4.0-1020.23","5.4.0-1021.24","5.4.0-1022.25","5.4.0-1023.26","5.4.0-1025.28","5.4.0-1026.29","5.4.0-1028.31","5.4.0-1030.33","5.4.0-1032.35","5.4.0-1035.38","5.4.0-1036.39","5.4.0-1040.44","5.4.0-1042.47","5.4.0-1044.49","5.4.0-1045.50","5.4.0-1046.51","5.4.0-1047.52","5.4.0-1049.55","5.4.0-1050.56","5.4.0-1054.60","5.4.0-1058.64","5.4.0-1059.65","5.4.0-1060.66","5.4.0-1062.68","5.4.0-1064.70","5.4.0-1065.71","5.4.0-1066.72","5.4.0-1068.74","5.4.0-1070.76","5.4.0-1071.77","5.4.0-1072.78","5.4.0-1073.79","5.4.0-1074.80","5.4.0-1075.81","5.4.0-1076.82","5.4.0-1077.83","5.4.0-1078.84","5.4.0-1079.85","5.4.0-1080.87","5.4.0-1081.88","5.4.0-1082.89","5.4.0-1083.90","5.4.0-1084.91","5.4.0-1085.92","5.4.0-1086.93","5.4.0-1087.94","5.4.0-1088.95","5.4.0-1089.96","5.4.0-1090.97","5.4.0-1091.98","5.4.0-1092.99","5.4.0-1093.100","5.4.0-1094.101","5.4.0-1095.102","5.4.0-1096.103","5.4.0-1097.104","5.4.0-1098.105","5.4.0-1099.106","5.4.0-1101.108","5.4.0-1102.109","5.4.0-1103.110","5.4.0-1105.112","5.4.0-1106.113","5.4.0-1107.114","5.4.0-1108.115","5.4.0-1109.116","5.4.0-1110.117","5.4.0-1111.118","5.4.0-1112.119","5.4.0-1116.123","5.4.0-1117.124","5.4.0-1118.125","5.4.0-1119.126","5.4.0-1120.127","5.4.0-1121.128","5.4.0-1123.130","5.4.0-1125.132","5.4.0-1126.133"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1004.4","5.3.0-1009.10","5.3.0-1011.12","5.4.0-1005.5","5.4.0-1007.7","5.4.0-1008.8","5.4.0-1009.9","5.4.0-1011.11","5.4.0-1015.15","5.4.0-1018.18","5.4.0-1019.19","5.4.0-1021.21","5.4.0-1022.22","5.4.0-1024.24","5.4.0-1025.25","5.4.0-1028.29","5.4.0-1029.31","5.4.0-1030.32","5.4.0-1032.34","5.4.0-1033.35","5.4.0-1034.37","5.4.0-1036.39","5.4.0-1037.40","5.4.0-1038.41","5.4.0-1040.43","5.4.0-1041.44","5.4.0-1042.45","5.4.0-1043.46","5.4.0-1044.47","5.4.0-1046.49","5.4.0-1049.53","5.4.0-1051.55","5.4.0-1052.56","5.4.0-1053.57","5.4.0-1055.59","5.4.0-1056.60","5.4.0-1057.61","5.4.0-1058.62","5.4.0-1059.63","5.4.0-1060.64","5.4.0-1062.66","5.4.0-1063.67","5.4.0-1064.68","5.4.0-1065.69","5.4.0-1067.71","5.4.0-1068.72","5.4.0-1069.73","5.4.0-1072.77","5.4.0-1073.78","5.4.0-1075.80","5.4.0-1078.84","5.4.0-1080.87","5.4.0-1083.91","5.4.0-1084.92","5.4.0-1086.94","5.4.0-1087.95","5.4.0-1089.97","5.4.0-1090.98","5.4.0-1092.101","5.4.0-1093.102","5.4.0-1096.105","5.4.0-1097.106","5.4.0-1098.107","5.4.0-1100.109","5.4.0-1101.110","5.4.0-1102.111","5.4.0-1103.112","5.4.0-1104.113","5.4.0-1105.114","5.4.0-1106.115","5.4.0-1107.116","5.4.0-1108.117","5.4.0-1109.118","5.4.0-1110.119","5.4.0-1111.120","5.4.0-1112.121","5.4.0-1113.122","5.4.0-1115.124","5.4.0-1116.125","5.4.0-1117.126","5.4.0-1118.127","5.4.0-1120.129","5.4.0-1121.130","5.4.0-1122.131","5.4.0-1123.132","5.4.0-1124.133","5.4.0-1125.134","5.4.0-1126.135","5.4.0-1127.136","5.4.0-1128.137","5.4.0-1129.138","5.4.0-1130.139","5.4.0-1131.140","5.4.0-1132.141","5.4.0-1133.142","5.4.0-1134.143","5.4.0-1135.144","5.4.0-1136.145","5.4.0-1137.146","5.4.0-1138.147","5.4.0-1139.148","5.4.0-1140.149","5.4.0-1141.150","5.4.0-1142.151","5.4.0-1143.152","5.4.0-1145.154","5.4.0-1146.155","5.4.0-1147.156","5.4.0-1148.157","5.4.0-1149.158","5.4.0-1150.159","5.4.0-1151.160","5.4.0-1152.161","5.4.0-1153.162","5.4.0-1154.163","5.4.0-1155.164","5.4.0-1156.165","5.4.0-1157.166","5.4.0-1159.168","5.4.0-1160.169","5.4.0-1161.170","5.4.0-1162.171","5.4.0-1163.172","5.4.0-1164.173","5.4.0-1165.174","5.4.0-1166.175","5.4.0-1167.177","5.4.0-1168.178","5.4.0-1169.179","5.4.0-1170.180"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.10~20.04.1","5.11.0-1014.16~20.04.1","5.11.0-1017.19~20.04.1","5.11.0-1018.20~20.04.2","5.11.0-1020.22~20.04.1","5.11.0-1021.23~20.04.1","5.11.0-1022.24~20.04.1","5.11.0-1023.25~20.04.1","5.11.0-1024.26~20.04.1","5.11.0-1026.29~20.04.1","5.11.0-1028.32~20.04.1","5.11.0-1029.33~20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.3","5.13.0-1012.15~20.04.1","5.13.0-1013.16~20.04.1","5.13.0-1015.18~20.04.1","5.13.0-1019.23~20.04.1","5.13.0-1021.25~20.04.1","5.13.0-1023.28~20.04.1","5.13.0-1024.29~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1030.36~20.04.1","5.13.0-1031.37~20.04.1","5.13.0-1033.40~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-gcp-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1006.9~20.04.1","5.15.0-1012.17~20.04.1","5.15.0-1013.18~20.04.1","5.15.0-1016.21~20.04.1","5.15.0-1017.23~20.04.2","5.15.0-1018.24~20.04.1","5.15.0-1021.28~20.04.1","5.15.0-1022.29~20.04.1","5.15.0-1025.32~20.04.2","5.15.0-1026.33~20.04.1","5.15.0-1027.34~20.04.1","5.15.0-1029.36~20.04.1","5.15.0-1030.37~20.04.1","5.15.0-1031.38~20.04.1","5.15.0-1032.40~20.04.1","5.15.0-1033.41~20.04.1","5.15.0-1034.42~20.04.1","5.15.0-1035.43~20.04.1","5.15.0-1036.44~20.04.1","5.15.0-1037.45~20.04.1","5.15.0-1038.46~20.04.1","5.15.0-1039.47~20.04.1","5.15.0-1040.48~20.04.1","5.15.0-1041.49~20.04.1","5.15.0-1042.50~20.04.1","5.15.0-1044.52~20.04.1","5.15.0-1045.53~20.04.2","5.15.0-1046.54~20.04.1","5.15.0-1047.55~20.04.1","5.15.0-1048.56~20.04.1","5.15.0-1049.57~20.04.1","5.15.0-1051.59~20.04.1","5.15.0-1052.60~20.04.1","5.15.0-1053.61~20.04.1","5.15.0-1054.62~20.04.1","5.15.0-1055.63~20.04.1","5.15.0-1058.66~20.04.1","5.15.0-1059.67~20.04.1","5.15.0-1060.68~20.04.1","5.15.0-1062.70~20.04.1","5.15.0-1065.73~20.04.1","5.15.0-1066.74~20.04.1","5.15.0-1067.75~20.04.1","5.15.0-1068.76~20.04.1","5.15.0-1069.77~20.04.1","5.15.0-1070.78~20.04.1","5.15.0-1071.79~20.04.1","5.15.0-1072.80~20.04.1","5.15.0-1073.81~20.04.1","5.15.0-1074.83~20.04.1","5.15.0-1075.84~20.04.1","5.15.0-1077.86~20.04.1","5.15.0-1078.87~20.04.1","5.15.0-1081.90~20.04.1","5.15.0-1083.92~20.04.1","5.15.0-1085.94~20.04.1","5.15.0-1086.95~20.04.1","5.15.0-1087.96~20.04.2","5.15.0-1088.97~20.04.1","5.15.0-1090.99~20.04.1","5.15.0-1091.100~20.04.1","5.15.0-1092.101~20.04.1","5.15.0-1093.102~20.04.1","5.15.0-1095.104~20.04.1","5.15.0-1096.105~20.04.1","5.15.0-1097.106~20.04.1","5.15.0-1098.107~20.04.1","5.15.0-1099.108~20.04.1","5.15.0-1100.109~20.04.1","5.15.0-1101.110~20.04.1","5.15.0-1103.112~20.04.1","5.15.0-1104.113~20.04.1","5.15.0-1106.115~20.04.1","5.15.0-1108.117~20.04.1","5.15.0-1109.118~20.04.1","5.15.0-1111.121~20.04.1","5.15.0-1112.122~20.04.1","5.15.0-1114.124~20.04.1","5.15.0-1118.128~20.04.1","5.15.0-1120.130~20.04.1","5.15.0-1121.131~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1032.34~20.04.1","5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1039.41"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1033.35","5.4.0-1035.37","5.4.0-1036.38","5.4.0-1037.39","5.4.0-1039.41","5.4.0-1041.43","5.4.0-1042.44","5.4.0-1043.45","5.4.0-1044.46","5.4.0-1046.48","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1055.58","5.4.0-1056.59","5.4.0-1057.60","5.4.0-1059.62","5.4.0-1061.64","5.4.0-1062.65","5.4.0-1063.66","5.4.0-1065.68","5.4.0-1066.69","5.4.0-1067.70","5.4.0-1068.71","5.4.0-1071.76","5.4.0-1072.77","5.4.0-1074.79","5.4.0-1076.82","5.4.0-1078.84","5.4.0-1080.86","5.4.0-1081.87","5.4.0-1083.89","5.4.0-1084.90","5.4.0-1086.93","5.4.0-1087.94","5.4.0-1090.97","5.4.0-1091.98","5.4.0-1094.101","5.4.0-1095.102","5.4.0-1096.103","5.4.0-1097.104","5.4.0-1098.105","5.4.0-1099.106","5.4.0-1100.107","5.4.0-1101.108","5.4.0-1102.109","5.4.0-1103.110","5.4.0-1104.111","5.4.0-1105.112"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1011.14~20.04.1","5.15.0-1014.17~20.04.1","5.15.0-1015.18~20.04.1","5.15.0-1016.19~20.04.1","5.15.0-1019.23~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1023.28~20.04.2","5.15.0-1027.32~20.04.1","5.15.0-1028.33~20.04.1","5.15.0-1029.34~20.04.1","5.15.0-1031.36~20.04.1","5.15.0-1032.37~20.04.1","5.15.0-1033.38~20.04.1","5.15.0-1034.39~20.04.1","5.15.0-1036.41~20.04.1","5.15.0-1037.42~20.04.1","5.15.0-1038.43~20.04.1","5.15.0-1039.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1008.9","5.4.0-1009.10","5.4.0-1010.11","5.4.0-1011.12","5.4.0-1012.13","5.4.0-1013.14","5.4.0-1014.15","5.4.0-1015.16","5.4.0-1016.17","5.4.0-1018.19","5.4.0-1021.22","5.4.0-1022.23","5.4.0-1023.24","5.4.0-1024.25","5.4.0-1025.26","5.4.0-1026.27","5.4.0-1027.28","5.4.0-1029.30","5.4.0-1031.32","5.4.0-1032.33","5.4.0-1033.34","5.4.0-1034.35","5.4.0-1036.37","5.4.0-1037.38","5.4.0-1038.39","5.4.0-1039.40","5.4.0-1040.41","5.4.0-1043.44","5.4.0-1046.48","5.4.0-1048.51","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1056.60","5.4.0-1057.61","5.4.0-1060.64","5.4.0-1061.65","5.4.0-1062.66","5.4.0-1064.68","5.4.0-1065.69","5.4.0-1066.70","5.4.0-1067.71","5.4.0-1068.72","5.4.0-1069.73","5.4.0-1070.74","5.4.0-1071.75","5.4.0-1072.76","5.4.0-1073.77","5.4.0-1074.78","5.4.0-1075.79","5.4.0-1076.80","5.4.0-1077.81","5.4.0-1078.82","5.4.0-1079.83","5.4.0-1080.84","5.4.0-1081.85","5.4.0-1083.87","5.4.0-1084.88","5.4.0-1085.89","5.4.0-1086.90","5.4.0-1087.91","5.4.0-1088.92","5.4.0-1089.93","5.4.0-1090.94","5.4.0-1091.95","5.4.0-1092.96","5.4.0-1093.97","5.4.0-1094.98","5.4.0-1095.99","5.4.0-1096.100","5.4.0-1097.101","5.4.0-1098.102","5.4.0-1099.103","5.4.0-1100.104","5.4.0-1101.105","5.4.0-1102.106"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gkeop-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1003.5~20.04.2","5.15.0-1005.7~20.04.1","5.15.0-1007.10~20.04.1","5.15.0-1008.12~20.04.1","5.15.0-1011.15~20.04.2","5.15.0-1012.16~20.04.1","5.15.0-1013.17~20.04.1","5.15.0-1015.19~20.04.1","5.15.0-1016.21~20.04.1","5.15.0-1017.22~20.04.1","5.15.0-1018.23~20.04.1","5.15.0-1019.24~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1021.26~20.04.1","5.15.0-1022.27~20.04.1","5.15.0-1023.28~20.04.1","5.15.0-1024.29~20.04.1","5.15.0-1025.30~20.04.1","5.15.0-1026.31~20.04.1","5.15.0-1027.32~20.04.1","5.15.0-1028.33~20.04.1","5.15.0-1030.35~20.04.1","5.15.0-1031.37~20.04.1","5.15.0-1032.38~20.04.1","5.15.0-1033.39~20.04.1","5.15.0-1034.40~20.04.1","5.15.0-1035.41~20.04.1","5.15.0-1036.42~20.04.1","5.15.0-1037.43~20.04.1","5.15.0-1038.44~20.04.1","5.15.0-1039.45~20.04.1","5.15.0-1040.46~20.04.1","5.15.0-1043.50~20.04.1","5.15.0-1044.51~20.04.1","5.15.0-1045.52~20.04.1","5.15.0-1046.53~20.04.1","5.15.0-1047.54~20.04.1","5.15.0-1048.55~20.04.1","5.15.0-1049.56~20.04.1","5.15.0-1050.57~20.04.1","5.15.0-1051.58~20.04.1","5.15.0-1052.59~20.04.1","5.15.0-1053.60~20.04.1","5.15.0-1054.61~20.04.1","5.15.0-1055.62~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-22.23~20.04.1","5.11.0-25.27~20.04.1","5.11.0-27.29~20.04.1","5.11.0-34.36~20.04.1","5.11.0-36.40~20.04.1","5.11.0-37.41~20.04.2","5.11.0-38.42~20.04.1","5.11.0-40.44~20.04.2","5.11.0-41.45~20.04.1","5.11.0-43.47~20.04.2","5.11.0-44.48~20.04.2","5.11.0-46.51~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-21.21~20.04.1","5.13.0-22.22~20.04.1","5.13.0-23.23~20.04.2","5.13.0-25.26~20.04.1","5.13.0-27.29~20.04.1","5.13.0-28.31~20.04.1","5.13.0-30.33~20.04.1","5.13.0-35.40~20.04.1","5.13.0-37.42~20.04.1","5.13.0-39.44~20.04.1","5.13.0-40.45~20.04.1","5.13.0-41.46~20.04.1","5.13.0-44.49~20.04.1","5.13.0-48.54~20.04.1","5.13.0-51.58~20.04.1","5.13.0-52.59~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-hwe-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-33.34~20.04.1","5.15.0-41.44~20.04.1","5.15.0-43.46~20.04.1","5.15.0-46.49~20.04.1","5.15.0-48.54~20.04.1","5.15.0-50.56~20.04.1","5.15.0-52.58~20.04.1","5.15.0-53.59~20.04.1","5.15.0-56.62~20.04.1","5.15.0-57.63~20.04.1","5.15.0-58.64~20.04.1","5.15.0-60.66~20.04.1","5.15.0-67.74~20.04.1","5.15.0-69.76~20.04.1","5.15.0-70.77~20.04.1","5.15.0-71.78~20.04.1","5.15.0-72.79~20.04.1","5.15.0-73.80~20.04.1","5.15.0-75.82~20.04.1","5.15.0-76.83~20.04.1","5.15.0-78.85~20.04.1","5.15.0-79.86~20.04.2","5.15.0-82.91~20.04.1","5.15.0-83.92~20.04.1","5.15.0-84.93~20.04.1","5.15.0-86.96~20.04.1","5.15.0-87.97~20.04.1","5.15.0-88.98~20.04.1","5.15.0-89.99~20.04.1","5.15.0-91.101~20.04.1","5.15.0-92.102~20.04.1","5.15.0-94.104~20.04.1","5.15.0-97.107~20.04.1","5.15.0-100.110~20.04.1","5.15.0-101.111~20.04.1","5.15.0-102.112~20.04.1","5.15.0-105.115~20.04.1","5.15.0-106.116~20.04.1","5.15.0-107.117~20.04.1","5.15.0-113.123~20.04.1","5.15.0-116.126~20.04.1","5.15.0-117.127~20.04.1","5.15.0-118.128~20.04.1","5.15.0-119.129~20.04.1","5.15.0-121.131~20.04.1","5.15.0-122.132~20.04.1","5.15.0-124.134~20.04.1","5.15.0-125.135~20.04.1","5.15.0-126.136~20.04.1","5.15.0-127.137~20.04.1","5.15.0-130.140~20.04.1","5.15.0-131.141~20.04.1","5.15.0-134.145~20.04.1","5.15.0-136.147~20.04.1","5.15.0-138.148~20.04.1","5.15.0-139.149~20.04.1","5.15.0-142.152~20.04.1","5.15.0-143.153~20.04.1","5.15.0-144.157~20.04.1","5.15.0-145.158~20.04.1","5.15.0-151.161~20.04.1","5.15.0-152.162~20.04.1","5.15.0-153.163~20.04.1","5.15.0-156.166~20.04.1","5.15.0-157.167~20.04.1","5.15.0-160.170~20.04.1","5.15.0-161.171~20.04.1","5.15.0-163.173~20.04.1","5.15.0-164.174~20.04.1","5.15.0-168.178~20.04.1","5.15.0-170.180~20.04.3","5.15.0-171.181~20.04.1","5.15.0-173.183~20.04.1","5.15.0-176.186~20.04.1","5.15.0-177.187~20.04.1","5.15.0-179.189~20.04.1","5.15.0-181.191~20.04.1","5.15.0-185.195~20.04.1","5.15.0-186.196~20.04.1","5.15.0-190.200~20.04.1","5.15.0-191.201~20.04.1","5.15.0-194.204~20.04.1","5.15.0-198.208~20.04.1","5.15.0-202.212~20.04.1","5.15.0-203.213~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-23.24~20.04.1","5.8.0-25.26~20.04.1","5.8.0-28.30~20.04.1","5.8.0-29.31~20.04.1","5.8.0-31.33~20.04.1","5.8.0-33.36~20.04.1","5.8.0-34.37~20.04.2","5.8.0-36.40~20.04.1","5.8.0-38.43~20.04.1","5.8.0-40.45~20.04.1","5.8.0-41.46~20.04.1","5.8.0-43.49~20.04.1","5.8.0-44.50~20.04.1","5.8.0-45.51~20.04.1","5.8.0-48.54~20.04.1","5.8.0-49.55~20.04.1","5.8.0-50.56~20.04.1","5.8.0-53.60~20.04.1","5.8.0-55.62~20.04.1","5.8.0-59.66~20.04.1","5.8.0-63.71~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1003.4","5.4.0-1004.5","5.4.0-1005.6","5.4.0-1006.7","5.4.0-1007.8","5.4.0-1008.9","5.4.0-1010.11","5.4.0-1012.13","5.4.0-1013.14","5.4.0-1014.15","5.4.0-1015.16","5.4.0-1017.19","5.4.0-1018.20","5.4.0-1019.21","5.4.0-1020.22","5.4.0-1021.23","5.4.0-1023.25","5.4.0-1026.29","5.4.0-1028.32","5.4.0-1029.33","5.4.0-1031.35","5.4.0-1032.36","5.4.0-1033.37","5.4.0-1034.38","5.4.0-1036.41","5.4.0-1037.42","5.4.0-1040.45","5.4.0-1041.46","5.4.0-1042.47","5.4.0-1044.49","5.4.0-1045.50","5.4.0-1046.51","5.4.0-1047.52","5.4.0-1048.53","5.4.0-1049.54","5.4.0-1050.55","5.4.0-1051.56","5.4.0-1052.57","5.4.0-1053.58","5.4.0-1054.59","5.4.0-1056.61","5.4.0-1057.62","5.4.0-1058.63","5.4.0-1059.64","5.4.0-1060.65","5.4.0-1061.66","5.4.0-1063.68","5.4.0-1064.69","5.4.0-1065.70","5.4.0-1066.71","5.4.0-1067.72","5.4.0-1068.73","5.4.0-1069.74","5.4.0-1070.75","5.4.0-1071.76","5.4.0-1072.77","5.4.0-1073.78","5.4.0-1074.79","5.4.0-1075.80","5.4.0-1076.81","5.4.0-1077.82","5.4.0-1078.83","5.4.0-1079.84","5.4.0-1080.85","5.4.0-1081.86","5.4.0-1082.87","5.4.0-1083.88","5.4.0-1084.89","5.4.0-1085.90","5.4.0-1086.91","5.4.0-1088.93","5.4.0-1089.94","5.4.0-1090.95","5.4.0-1091.96","5.4.0-1092.97","5.4.0-1093.98","5.4.0-1094.99","5.4.0-1095.100","5.4.0-1096.101","5.4.0-1097.102","5.4.0-1098.103","5.4.0-1099.104","5.4.0-1100.105","5.4.0-1102.107","5.4.0-1103.108","5.4.0-1104.109","5.4.0-1105.110","5.4.0-1107.112","5.4.0-1108.113","5.4.0-1109.114","5.4.0-1111.116","5.4.0-1112.117","5.4.0-1113.118"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-ibm-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1033.36~20.04.1","5.15.0-1034.37~20.04.1","5.15.0-1035.38~20.04.1","5.15.0-1036.39~20.04.1","5.15.0-1037.40~20.04.1","5.15.0-1038.41~20.04.1","5.15.0-1040.43~20.04.1","5.15.0-1041.44~20.04.1","5.15.0-1042.45~20.04.1","5.15.0-1043.46~20.04.1","5.15.0-1044.47~20.04.1","5.15.0-1045.48~20.04.1","5.15.0-1046.49~20.04.1","5.15.0-1047.50~20.04.1","5.15.0-1048.51~20.04.1","5.15.0-1049.52~20.04.1","5.15.0-1050.53~20.04.1","5.15.0-1053.56~20.04.1","5.15.0-1054.57~20.04.1","5.15.0-1055.58~20.04.1","5.15.0-1057.60~20.04.1","5.15.0-1058.61~20.04.1","5.15.0-1059.62~20.04.1","5.15.0-1060.63~20.04.1","5.15.0-1061.64~20.04.1","5.15.0-1062.65~20.04.1","5.15.0-1063.66~20.04.1","5.15.0-1064.67~20.04.1","5.15.0-1065.68~20.04.1","5.15.0-1066.69~20.04.1","5.15.0-1067.70~20.04.1","5.15.0-1068.71~20.04.1","5.15.0-1069.72~20.04.1","5.15.0-1074.77~20.04.1","5.15.0-1075.78~20.04.1","5.15.0-1076.79~20.04.1","5.15.0-1078.81~20.04.1","5.15.0-1079.82~20.04.1","5.15.0-1080.83~20.04.1","5.15.0-1081.84~20.04.1","5.15.0-1083.86~20.04.1","5.15.0-1085.88~20.04.1","5.15.0-1086.89~20.04.1","5.15.0-1087.90~20.04.1","5.15.0-1089.92~20.04.1","5.15.0-1090.93~20.04.1","5.15.0-1091.94~20.04.1","5.15.0-1092.95~20.04.1","5.15.0-1093.96~20.04.1","5.15.0-1094.97~20.04.1","5.15.0-1095.98~20.04.1","5.15.0-1097.100~20.04.1","5.15.0-1098.101~20.04.1","5.15.0-1099.102~20.04.1","5.15.0-1100.103~20.04.1","5.15.0-1102.105~20.04.1","5.15.0-1103.106~20.04.1","5.15.0-1105.109~20.04.1","5.15.0-1106.110~20.04.1","5.15.0-1107.111~20.04.1","5.15.0-1108.112~20.04.1","5.15.0-1109.113~20.04.1","5.15.0-1110.114~20.04.1","5.15.0-1111.115~20.04.1","5.15.0-1113.117~20.04.1","5.15.0-1114.118~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-intel-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1007.7","5.13.0-1008.8","5.13.0-1009.9","5.13.0-1010.10","5.13.0-1011.11","5.13.0-1014.15","5.13.0-1017.19"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-intel-iotg-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1003.5~20.04.1","5.15.0-1008.11~20.04.1","5.15.0-1010.14~20.04.1","5.15.0-1015.20~20.04.2","5.15.0-1016.21~20.04.1","5.15.0-1017.22~20.04.1","5.15.0-1018.23~20.04.1","5.15.0-1021.26~20.04.1","5.15.0-1023.28~20.04.1","5.15.0-1025.30~20.04.1","5.15.0-1026.31~20.04.1","5.15.0-1027.32~20.04.1","5.15.0-1030.35~20.04.1","5.15.0-1031.36~20.04.1","5.15.0-1033.38~20.04.1","5.15.0-1034.39~20.04.1","5.15.0-1036.41~20.04.1","5.15.0-1037.42~20.04.1","5.15.0-1038.43~20.04.1","5.15.0-1040.46~20.04.1","5.15.0-1043.49~20.04.1","5.15.0-1045.51~20.04.1","5.15.0-1046.52~20.04.1","5.15.0-1048.54~20.04.1","5.15.0-1049.55~20.04.1","5.15.0-1050.56~20.04.1","5.15.0-1051.57~20.04.1","5.15.0-1052.58~20.04.1","5.15.0-1055.61~20.04.1","5.15.0-1058.64~20.04.1","5.15.0-1059.65~20.04.1","5.15.0-1060.66~20.04.1","5.15.0-1061.67~20.04.1","5.15.0-1062.68~20.04.1","5.15.0-1063.69~20.04.1","5.15.0-1064.70~20.04.1","5.15.0-1065.71~20.04.1","5.15.0-1066.72~20.04.1","5.15.0-1067.73~20.04.1","5.15.0-1071.77~20.04.1","5.15.0-1072.78~20.04.1","5.15.0-1073.79~20.04.2","5.15.0-1074.80~20.04.1","5.15.0-1077.83~20.04.1","5.15.0-1078.84~20.04.1","5.15.0-1079.85~20.04.1","5.15.0-1083.89~20.04.1","5.15.0-1084.90~20.04.1","5.15.0-1085.91~20.04.1","5.15.0-1086.92~20.04.1","5.15.0-1087.93~20.04.1","5.15.0-1088.94~20.04.1","5.15.0-1090.96~20.04.1","5.15.0-1091.97~20.04.1","5.15.0-1092.98~20.04.1","5.15.0-1093.99~20.04.1","5.15.0-1094.100~20.04.1","5.15.0-1095.101~20.04.1","5.15.0-1096.102~20.04.1","5.15.0-1098.104~20.04.1","5.15.0-1099.105~20.04.1","5.15.0-1100.106~20.04.1","5.15.0-1101.107~20.04.1","5.15.0-1103.109~20.04.1","5.15.0-1104.110~20.04.1","5.15.0-1106.112~20.04.1","5.15.0-1107.113~20.04.1","5.15.0-1108.114~20.04.1","5.15.0-1109.115~20.04.1","5.15.0-1110.116~20.04.1","5.15.0-1111.117~20.04.1","5.15.0-1112.118~20.04.1","5.15.0-1114.120~20.04.1","5.15.0-1115.121~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-iot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1001.3","5.4.0-1004.6","5.4.0-1005.7","5.4.0-1006.8","5.4.0-1009.11","5.4.0-1010.12","5.4.0-1011.13","5.4.0-1012.14","5.4.0-1013.15","5.4.0-1014.16","5.4.0-1017.18","5.4.0-1018.19","5.4.0-1019.20","5.4.0-1021.22","5.4.0-1022.23","5.4.0-1023.24","5.4.0-1024.25","5.4.0-1025.26","5.4.0-1026.27","5.4.0-1028.29","5.4.0-1029.30","5.4.0-1030.31","5.4.0-1031.32","5.4.0-1032.33","5.4.0-1033.34","5.4.0-1034.35","5.4.0-1035.36","5.4.0-1036.37","5.4.0-1037.38","5.4.0-1038.39","5.4.0-1039.40","5.4.0-1040.41","5.4.0-1041.42","5.4.0-1042.43","5.4.0-1043.44","5.4.0-1044.45","5.4.0-1045.46","5.4.0-1048.51","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1055.58","5.4.0-1056.59","5.4.0-1057.60","5.4.0-1058.61","5.4.0-1060.63","5.4.0-1061.64","5.4.0-1062.65","5.4.0-1063.66","5.4.0-1064.67","5.4.0-1065.68","5.4.0-1066.69","5.4.0-1067.70","5.4.0-1068.71","5.4.0-1069.72","5.4.0-1070.73","5.4.0-1071.74"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1003.3","5.3.0-1008.9","5.3.0-1009.10","5.4.0-1004.4","5.4.0-1006.6","5.4.0-1007.7","5.4.0-1008.8","5.4.0-1009.9","5.4.0-1011.11","5.4.0-1015.15","5.4.0-1018.18","5.4.0-1020.20","5.4.0-1021.21","5.4.0-1023.23","5.4.0-1024.24","5.4.0-1026.27","5.4.0-1028.29","5.4.0-1030.31","5.4.0-1031.32","5.4.0-1032.33","5.4.0-1033.34","5.4.0-1034.35","5.4.0-1036.37","5.4.0-1037.38","5.4.0-1038.39","5.4.0-1039.40","5.4.0-1040.41","5.4.0-1041.42","5.4.0-1044.46","5.4.0-1045.47","5.4.0-1046.48","5.4.0-1047.49","5.4.0-1048.50","5.4.0-1049.51","5.4.0-1050.52","5.4.0-1051.53","5.4.0-1053.55","5.4.0-1054.56","5.4.0-1055.57","5.4.0-1056.58","5.4.0-1058.61","5.4.0-1059.62","5.4.0-1061.64","5.4.0-1062.65","5.4.0-1063.66","5.4.0-1065.68","5.4.0-1068.72","5.4.0-1070.75","5.4.0-1071.76","5.4.0-1073.78","5.4.0-1074.79","5.4.0-1075.80","5.4.0-1076.81","5.4.0-1078.84","5.4.0-1079.85","5.4.0-1082.88","5.4.0-1083.89","5.4.0-1084.90","5.4.0-1086.92","5.4.0-1087.93","5.4.0-1088.94","5.4.0-1089.95","5.4.0-1090.96","5.4.0-1091.97","5.4.0-1092.98","5.4.0-1093.99","5.4.0-1094.100","5.4.0-1095.101","5.4.0-1096.102","5.4.0-1097.103","5.4.0-1098.104","5.4.0-1099.105","5.4.0-1100.106","5.4.0-1101.107","5.4.0-1102.108","5.4.0-1103.110","5.4.0-1104.111","5.4.0-1105.112","5.4.0-1106.113","5.4.0-1107.114","5.4.0-1108.115","5.4.0-1109.116","5.4.0-1110.117","5.4.0-1111.118","5.4.0-1112.119","5.4.0-1113.120","5.4.0-1114.121","5.4.0-1115.122","5.4.0-1116.123","5.4.0-1117.124","5.4.0-1118.125","5.4.0-1119.127","5.4.0-1120.128","5.4.0-1121.129","5.4.0-1122.130","5.4.0-1123.131","5.4.0-1124.132","5.4.0-1125.133","5.4.0-1126.134","5.4.0-1127.136","5.4.0-1129.138","5.4.0-1130.139","5.4.0-1131.140","5.4.0-1132.141","5.4.0-1133.142","5.4.0-1134.143","5.4.0-1135.144","5.4.0-1136.145","5.4.0-1137.146","5.4.0-1138.147","5.4.0-1139.148","5.4.0-1140.149","5.4.0-1141.150","5.4.0-1143.152","5.4.0-1144.153","5.4.0-1145.154","5.4.0-1146.155","5.4.0-1147.156","5.4.0-1148.157","5.4.0-1149.158","5.4.0-1150.159","5.4.0-1151.160","5.4.0-1152.161","5.4.0-1153.162","5.4.0-1154.163"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-lowlatency-hwe-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-33.34~20.04.1","5.15.0-42.45~20.04.1","5.15.0-43.46~20.04.1","5.15.0-46.49~20.04.1","5.15.0-48.54~20.04.1","5.15.0-50.56~20.04.1","5.15.0-52.58~20.04.1","5.15.0-53.59~20.04.1","5.15.0-56.62~20.04.1","5.15.0-58.64~20.04.1","5.15.0-60.66~20.04.1","5.15.0-67.74~20.04.1","5.15.0-69.76~20.04.1","5.15.0-70.77~20.04.1","5.15.0-71.78~20.04.1","5.15.0-72.79~20.04.1","5.15.0-73.80~20.04.1","5.15.0-75.82~20.04.1","5.15.0-76.83~20.04.1","5.15.0-78.85~20.04.1","5.15.0-79.88~20.04.1","5.15.0-82.91~20.04.1","5.15.0-83.92~20.04.1","5.15.0-84.93~20.04.1","5.15.0-86.95~20.04.1","5.15.0-87.96~20.04.1","5.15.0-88.98~20.04.1","5.15.0-89.99~20.04.1","5.15.0-91.101~20.04.1","5.15.0-92.102~20.04.1","5.15.0-94.104~20.04.1","5.15.0-97.107~20.04.1","5.15.0-100.110~20.04.1","5.15.0-101.111~20.04.1","5.15.0-102.112~20.04.1","5.15.0-105.115~20.04.1","5.15.0-106.116~20.04.1","5.15.0-107.117~20.04.1","5.15.0-110.120~20.04.1","5.15.0-113.123~20.04.1","5.15.0-116.126~20.04.1","5.15.0-117.127~20.04.1","5.15.0-118.128~20.04.1","5.15.0-119.129~20.04.1","5.15.0-121.131~20.04.1","5.15.0-122.132~20.04.1","5.15.0-124.134~20.04.1","5.15.0-125.135~20.04.1","5.15.0-126.136~20.04.1","5.15.0-127.137~20.04.1","5.15.0-128.138~20.04.1","5.15.0-129.139~20.04.1","5.15.0-131.141~20.04.1","5.15.0-133.143~20.04.1","5.15.0-134.145~20.04.1","5.15.0-135.146~20.04.1","5.15.0-136.147~20.04.1","5.15.0-138.148~20.04.1","5.15.0-139.149~20.04.1","5.15.0-140.150~20.04.1","5.15.0-142.152~20.04.1","5.15.0-143.153~20.04.1","5.15.0-144.157~20.04.1","5.15.0-145.158~20.04.1","5.15.0-152.162~20.04.1","5.15.0-153.163~20.04.1","5.15.0-156.166~20.04.1","5.15.0-157.167~20.04.1","5.15.0-160.170~20.04.1","5.15.0-161.171~20.04.1","5.15.0-163.173~20.04.1","5.15.0-164.174~20.04.1","5.15.0-168.178~20.04.1","5.15.0-170.180~20.04.1","5.15.0-171.181~20.04.1","5.15.0-173.183~20.04.1","5.15.0-174.184~20.04.1","5.15.0-175.185~20.04.1","5.15.0-177.187~20.04.1","5.15.0-178.188~20.04.1","5.15.0-179.189~20.04.1","5.15.0-181.191~20.04.1","5.15.0-183.193~20.04.1","5.15.0-184.194~20.04.1","5.15.0-190.200~20.04.1","5.15.0-191.201~20.04.1","5.15.0-194.204~20.04.1","5.15.0-195.205~20.04.1","5.15.0-197.207~20.04.1","5.15.0-198.208~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-nvidia-tegra-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1009.9~20.04.1","5.15.0-1010.10~20.04.1","5.15.0-1012.12~20.04.1","5.15.0-1014.14~20.04.1","5.15.0-1015.15~20.04.1","5.15.0-1016.16~20.04.1","5.15.0-1017.17~20.04.1","5.15.0-1018.18~20.04.1","5.15.0-1019.19~20.04.1","5.15.0-1020.20~20.04.1","5.15.0-1022.22~20.04.1","5.15.0-1025.25~20.04.1","5.15.0-1027.27~20.04.1","5.15.0-1030.30~20.04.1","5.15.0-1032.32~20.04.1","5.15.0-1039.39~20.04.1","5.15.0-1040.40~20.04.1","5.15.0-1041.41~20.04.1","5.15.0-1042.42~20.04.1","5.15.0-1043.43~20.04.1","5.15.0-1044.44~20.04.1","5.15.0-1045.45~20.04.1","5.15.0-1046.46~20.04.1","5.15.0-1047.47~20.04.1","5.15.0-1048.48~20.04.1","5.15.0-1049.49~20.04.1","5.15.0-1050.50~20.04.1","5.15.0-1051.51~20.04.1","5.15.0-1052.52~20.04.2","5.15.0-1053.53~20.04.1","5.15.0-1055.55~20.04.1","5.15.0-1057.57~20.04.1","5.15.0-1058.58~20.04.1","5.15.0-1060.60~20.04.1","5.15.0-1061.61~20.04.1","5.15.0-1063.63~20.04.1","5.15.0-1064.66~20.04.1","5.15.0-1065.67~20.04.1","5.15.0-1066.68~20.04.1","5.15.0-1067.69~20.04.1","5.15.0-1068.70~20.04.1","5.15.0-1070.72~20.04.1","5.15.0-1071.73~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.10.0-1008.9","5.10.0-1011.12","5.10.0-1013.14","5.10.0-1014.15","5.10.0-1016.17","5.10.0-1017.18","5.10.0-1019.20","5.10.0-1021.22","5.10.0-1022.23","5.10.0-1023.24","5.10.0-1025.26","5.10.0-1026.27","5.10.0-1029.30","5.10.0-1032.33","5.10.0-1033.34","5.10.0-1034.35","5.10.0-1038.40","5.10.0-1044.46","5.10.0-1045.47","5.10.0-1049.51","5.10.0-1050.52","5.10.0-1051.53","5.10.0-1052.54","5.10.0-1053.55","5.10.0-1055.58","5.10.0-1057.61"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10","5.13.0-1010.11","5.13.0-1012.16","5.13.0-1014.18","5.13.0-1017.21","5.13.0-1019.23","5.13.0-1020.24","5.13.0-1021.25","5.13.0-1022.26","5.13.0-1026.32","5.13.0-1028.35","5.13.0-1029.36"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.14.0-1004.4","5.14.0-1005.5","5.14.0-1007.7","5.14.0-1008.8","5.14.0-1010.10","5.14.0-1011.11","5.14.0-1013.13","5.14.0-1018.19","5.14.0-1020.22","5.14.0-1022.24","5.14.0-1024.26","5.14.0-1027.30","5.14.0-1029.32","5.14.0-1031.34","5.14.0-1032.35","5.14.0-1033.36","5.14.0-1034.37","5.14.0-1036.40","5.14.0-1038.42","5.14.0-1042.47","5.14.0-1044.49","5.14.0-1045.51","5.14.0-1046.53","5.14.0-1047.54","5.14.0-1048.55","5.14.0-1049.56","5.14.0-1050.57","5.14.0-1051.58","5.14.0-1052.59","5.14.0-1054.61","5.14.0-1055.62","5.14.0-1056.63","5.14.0-1057.64","5.14.0-1058.66","5.14.0-1059.67"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.6.0-1007.7","5.6.0-1008.8","5.6.0-1010.10","5.6.0-1011.11","5.6.0-1013.13","5.6.0-1017.17","5.6.0-1018.18","5.6.0-1020.20","5.6.0-1021.21","5.6.0-1023.23","5.6.0-1026.26","5.6.0-1027.27","5.6.0-1028.28","5.6.0-1031.32","5.6.0-1032.33","5.6.0-1033.35","5.6.0-1034.36","5.6.0-1035.37","5.6.0-1036.39","5.6.0-1039.43","5.6.0-1042.46","5.6.0-1047.51","5.6.0-1048.52","5.6.0-1050.54","5.6.0-1052.56","5.6.0-1053.57","5.6.0-1054.58","5.6.0-1055.59","5.6.0-1056.60"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1002.2","5.3.0-1007.8","5.3.0-1008.9","5.4.0-1005.5","5.4.0-1007.7","5.4.0-1008.8","5.4.0-1009.9","5.4.0-1011.11","5.4.0-1015.15","5.4.0-1018.18","5.4.0-1019.19","5.4.0-1021.21","5.4.0-1022.22","5.4.0-1024.24","5.4.0-1025.25","5.4.0-1028.29","5.4.0-1029.31","5.4.0-1030.32","5.4.0-1032.34","5.4.0-1034.36","5.4.0-1035.38","5.4.0-1037.40","5.4.0-1038.41","5.4.0-1039.42","5.4.0-1041.44","5.4.0-1042.45","5.4.0-1043.46","5.4.0-1045.49","5.4.0-1046.50","5.4.0-1048.52","5.4.0-1049.53","5.4.0-1052.56","5.4.0-1053.57","5.4.0-1054.58","5.4.0-1055.59","5.4.0-1056.60","5.4.0-1057.61","5.4.0-1058.62","5.4.0-1059.63","5.4.0-1061.65","5.4.0-1062.66","5.4.0-1063.67","5.4.0-1064.68","5.4.0-1066.71","5.4.0-1067.72","5.4.0-1069.75","5.4.0-1070.76","5.4.0-1071.77","5.4.0-1073.79","5.4.0-1076.83","5.4.0-1078.86","5.4.0-1079.87","5.4.0-1081.89","5.4.0-1082.90","5.4.0-1083.91","5.4.0-1084.92","5.4.0-1086.95","5.4.0-1087.96","5.4.0-1090.99","5.4.0-1091.100","5.4.0-1092.101","5.4.0-1093.102","5.4.0-1094.103","5.4.0-1097.106","5.4.0-1098.107","5.4.0-1099.108","5.4.0-1100.109","5.4.0-1101.110","5.4.0-1102.111","5.4.0-1103.112","5.4.0-1104.113","5.4.0-1105.114","5.4.0-1106.115","5.4.0-1107.116","5.4.0-1108.117","5.4.0-1109.118","5.4.0-1110.119","5.4.0-1111.120","5.4.0-1112.121","5.4.0-1113.122","5.4.0-1115.124","5.4.0-1116.125","5.4.0-1117.126","5.4.0-1118.127","5.4.0-1119.128","5.4.0-1120.129","5.4.0-1121.130","5.4.0-1122.131","5.4.0-1123.132","5.4.0-1124.133","5.4.0-1125.134","5.4.0-1126.135","5.4.0-1127.136","5.4.0-1129.138","5.4.0-1130.139","5.4.0-1131.140","5.4.0-1132.141","5.4.0-1133.142","5.4.0-1134.143","5.4.0-1135.144","5.4.0-1136.145","5.4.0-1137.146","5.4.0-1138.147","5.4.0-1140.150","5.4.0-1141.151","5.4.0-1142.152","5.4.0-1143.153","5.4.0-1144.154","5.4.0-1145.155","5.4.0-1146.156","5.4.0-1147.157","5.4.0-1149.159","5.4.0-1150.160","5.4.0-1151.161","5.4.0-1152.162","5.4.0-1154.164","5.4.0-1155.165","5.4.0-1156.166","5.4.0-1157.167","5.4.0-1158.168","5.4.0-1159.169","5.4.0-1160.170","5.4.0-1161.171","5.4.0-1162.172","5.4.0-1163.173","5.4.0-1164.174","5.4.0-1165.175"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1008.8~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1011.13~20.04.2","5.13.0-1015.19~20.04.1","5.13.0-1016.20~20.04.1","5.13.0-1018.22~20.04.1","5.13.0-1021.26~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1030.35~20.04.1","5.13.0-1033.39~20.04.1","5.13.0-1034.40~20.04.1","5.13.0-1036.43~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-oracle-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1007.9~20.04.1","5.15.0-1013.17~20.04.1","5.15.0-1016.20~20.04.1","5.15.0-1017.22~20.04.1","5.15.0-1018.23~20.04.1","5.15.0-1019.24~20.04.1","5.15.0-1021.27~20.04.1","5.15.0-1022.28~20.04.1","5.15.0-1025.31~20.04.2","5.15.0-1027.33~20.04.1","5.15.0-1029.35~20.04.1","5.15.0-1030.36~20.04.1","5.15.0-1032.38~20.04.1","5.15.0-1033.39~20.04.1","5.15.0-1034.40~20.04.1","5.15.0-1035.41~20.04.1","5.15.0-1036.42~20.04.1","5.15.0-1037.43~20.04.1","5.15.0-1038.44~20.04.1","5.15.0-1039.45~20.04.1","5.15.0-1040.46~20.04.1","5.15.0-1041.47~20.04.1","5.15.0-1042.48~20.04.1","5.15.0-1044.50~20.04.1","5.15.0-1045.51~20.04.1","5.15.0-1046.52~20.04.1","5.15.0-1047.53~20.04.1","5.15.0-1048.54~20.04.1","5.15.0-1049.55~20.04.1","5.15.0-1050.56~20.04.1","5.15.0-1051.57~20.04.1","5.15.0-1052.58~20.04.1","5.15.0-1053.59~20.04.1","5.15.0-1054.60~20.04.1","5.15.0-1055.61~20.04.1","5.15.0-1058.64~20.04.1","5.15.0-1059.65~20.04.1","5.15.0-1061.67~20.04.1","5.15.0-1062.68~20.04.1","5.15.0-1063.69~20.04.1","5.15.0-1065.71~20.04.1","5.15.0-1066.72~20.04.1","5.15.0-1067.73~20.04.1","5.15.0-1068.74~20.04.1","5.15.0-1069.75~20.04.1","5.15.0-1070.76~20.04.1","5.15.0-1071.77~20.04.1","5.15.0-1072.78~20.04.1","5.15.0-1073.79~20.04.1","5.15.0-1074.80~20.04.1","5.15.0-1075.81~20.04.1","5.15.0-1076.82~20.04.1","5.15.0-1077.83~20.04.1","5.15.0-1078.84~20.04.1","5.15.0-1079.85~20.04.1","5.15.0-1080.86~20.04.1","5.15.0-1081.87~20.04.1","5.15.0-1083.89~20.04.1","5.15.0-1084.90~20.04.1","5.15.0-1085.91~20.04.3","5.15.0-1086.92~20.04.1","5.15.0-1088.94~20.04.1","5.15.0-1090.96~20.04.1","5.15.0-1091.97~20.04.1","5.15.0-1092.98~20.04.1","5.15.0-1093.99~20.04.1","5.15.0-1094.100~20.04.1","5.15.0-1095.101~20.04.1","5.15.0-1096.102~20.04.1","5.15.0-1097.103~20.04.1","5.15.0-1098.104~20.04.1","5.15.0-1100.106~20.04.1","5.15.0-1101.107~20.04.1","5.15.0-1102.108~20.04.1","5.15.0-1104.110~20.04.1","5.15.0-1106.112~20.04.1","5.15.0-1108.114~20.04.1","5.15.0-1109.115~20.04.1","5.15.0-1110.116~20.04.1","5.15.0-1111.117~20.04.1","5.15.0-1114.120~20.04.1","5.15.0-1116.122~20.04.1","5.15.0-1117.123~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1031.32~20.04.2","5.8.0-1033.34~20.04.1","5.8.0-1034.35~20.04.2","5.8.0-1037.38~20.04.1","5.8.0-1038.39~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-raspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1007.7","5.4.0-1008.8","5.4.0-1011.11","5.4.0-1012.12","5.4.0-1013.13","5.4.0-1015.15","5.4.0-1016.17","5.4.0-1018.20","5.4.0-1019.21","5.4.0-1021.24","5.4.0-1022.25","5.4.0-1023.26","5.4.0-1025.28","5.4.0-1026.29","5.4.0-1028.31","5.4.0-1029.32","5.4.0-1030.33","5.4.0-1032.35","5.4.0-1033.36","5.4.0-1034.37","5.4.0-1035.38","5.4.0-1036.39","5.4.0-1038.41","5.4.0-1041.45","5.4.0-1042.46","5.4.0-1043.47","5.4.0-1044.48","5.4.0-1045.49","5.4.0-1046.50","5.4.0-1047.52","5.4.0-1048.53","5.4.0-1050.56","5.4.0-1052.58","5.4.0-1053.60","5.4.0-1055.62","5.4.0-1056.63","5.4.0-1058.65","5.4.0-1059.67","5.4.0-1060.68","5.4.0-1062.70","5.4.0-1065.75","5.4.0-1066.76","5.4.0-1068.78","5.4.0-1069.79","5.4.0-1070.80","5.4.0-1071.81","5.4.0-1073.84","5.4.0-1074.85","5.4.0-1077.88","5.4.0-1078.89","5.4.0-1079.90","5.4.0-1080.91","5.4.0-1081.92","5.4.0-1082.93","5.4.0-1083.94","5.4.0-1084.95","5.4.0-1085.96","5.4.0-1086.97","5.4.0-1088.99","5.4.0-1089.100","5.4.0-1090.101","5.4.0-1091.102","5.4.0-1092.103","5.4.0-1093.104","5.4.0-1094.105","5.4.0-1095.106","5.4.0-1096.107","5.4.0-1097.109","5.4.0-1098.110","5.4.0-1100.112","5.4.0-1101.113","5.4.0-1102.114","5.4.0-1103.115","5.4.0-1104.116","5.4.0-1105.117","5.4.0-1106.118","5.4.0-1107.119","5.4.0-1108.120","5.4.0-1109.121","5.4.0-1110.122","5.4.0-1111.123","5.4.0-1112.124","5.4.0-1113.125","5.4.0-1114.126","5.4.0-1115.127","5.4.0-1116.128","5.4.0-1117.129","5.4.0-1118.130","5.4.0-1119.131","5.4.0-1120.132","5.4.0-1121.133","5.4.0-1122.134","5.4.0-1129.142","5.4.0-1130.143","5.4.0-1131.144","5.4.0-1132.145","5.4.0-1133.146","5.4.0-1134.147","5.4.0-1135.148","5.4.0-1136.149","5.4.0-1137.150","5.4.0-1139.152","5.4.0-1140.153","5.4.0-1143.156","5.4.0-1144.157","5.4.0-1145.158","5.4.0-1146.159","5.4.0-1147.160","5.4.0-1148.161","5.4.0-1149.162"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8","5.3.0-1014.16","5.3.0-1015.17","5.3.0-1017.19","5.4.0-1004.4","5.4.0-1006.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-24.28","5.4.0-26.30","5.4.0-27.31","5.4.0-28.32","5.4.0-30.34","5.4.0-31.35","5.4.0-33.37","5.4.0-34.38","5.4.0-36.41","5.4.0-37.42","5.4.0-39.44","5.4.0-40.45"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1018.19~20.04.2","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1024.25~20.04.1","5.11.0-1026.28~20.04.1","5.11.0-1028.31~20.04.1","5.11.0-1029.32~20.04.1","5.11.0-1030.34","5.11.0-1031.35"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-riscv-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1015.17~20.04.1","5.15.0-1017.19~20.04.1","5.15.0-1018.21~20.04.1","5.15.0-1019.22~20.04.1","5.15.0-1022.26~20.04.1","5.15.0-1023.27~20.04.1","5.15.0-1026.30~20.04.2","5.15.0-1027.31~20.04.1","5.15.0-1028.32~20.04.1","5.15.0-1029.33~20.04.1","5.15.0-1030.34~20.04.1","5.15.0-1031.35~20.04.1","5.15.0-1032.36~20.04.1","5.15.0-1033.37~20.04.1","5.15.0-1034.38~20.04.1","5.15.0-1035.39~20.04.1","5.15.0-1036.40~20.04.2","5.15.0-1037.41~20.04.2","5.15.0-1038.42~20.04.2","5.15.0-1039.43~20.04.2","5.15.0-1040.44~20.04.3","5.15.0-1041.45~20.04.1","5.15.0-1043.47~20.04.1","5.15.0-1044.48~20.04.1","5.15.0-1045.49~20.04.1","5.15.0-1046.50~20.04.1","5.15.0-1047.51~20.04.1","5.15.0-1048.52~20.04.1","5.15.0-1049.53~20.04.2","5.15.0-1050.54~20.04.1","5.15.0-1051.55~20.04.1","5.15.0-1052.56~20.04.1","5.15.0-1053.57~20.04.1","5.15.0-1056.60~20.04.1","5.15.0-1057.61~20.04.1","5.15.0-1058.62~20.04.1","5.15.0-1059.63~20.04.1","5.15.0-1060.64~20.04.1","5.15.0-1061.65~20.04.1","5.15.0-1062.66~20.04.1","5.15.0-1063.67~20.04.1","5.15.0-1064.68~20.04.1","5.15.0-1065.69~20.04.1","5.15.0-1066.70~20.04.1","5.15.0-1067.71~20.04.1","5.15.0-1068.72~20.04.1","5.15.0-1069.73~20.04.1","5.15.0-1070.74~20.04.1","5.15.0-1071.75~20.04.1","5.15.0-1072.76~20.04.1","5.15.0-1073.77~20.04.1","5.15.0-1074.78~20.04.1","5.15.0-1075.79~20.04.1","5.15.0-1076.80~20.04.1","5.15.0-1077.81~20.04.1","5.15.0-1078.82~20.04.1","5.15.0-1079.83~20.04.1","5.15.0-1081.85~20.04.1","5.15.0-1082.86~20.04.1","5.15.0-1083.87~20.04.1","5.15.0-1084.88~20.04.1","5.15.0-1085.89~20.04.1","5.15.0-1086.90~20.04.1","5.15.0-1087.91~20.04.1","5.15.0-1088.92~20.04.1","5.15.0-1090.94~20.04.1","5.15.0-1091.95~20.04.1","5.15.0-1092.96~20.04.1","5.15.0-1093.97~20.04.2","5.15.0-1094.98~20.04.1","5.15.0-1095.99~20.04.1","5.15.0-1096.100~20.04.1","5.15.0-1097.101~20.04.1","5.15.0-1098.102~20.04.1","5.15.0-1099.103~20.04.1","5.15.0-1100.104~20.04.1","5.15.0-1102.106~20.04.1","5.15.0-1103.107~20.04.1","5.15.0-1105.109~20.04.1","5.15.0-1106.110~20.04.1","5.15.0-1107.111~20.04.1","5.15.0-1108.112~20.04.1","5.15.0-1109.113~20.04.1","5.15.0-1110.114~20.04.1","5.15.0-1111.115~20.04.1","5.15.0-1113.117~20.04.2","5.15.0-1114.118~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-14.16~20.04.1","5.8.0-14.16~20.04.3","5.8.0-16.18~20.04.1","5.8.0-17.19~20.04.1","5.8.0-18.20~20.04.1","5.8.0-20.22~20.04.1","5.8.0-22.24~20.04.1","5.8.0-25.27~20.04.1","5.8.0-26.28~20.04.1","5.8.0-29.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-xilinx-zynqmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1020.24","5.4.0-1021.25","5.4.0-1022.26","5.4.0-1023.27","5.4.0-1024.28","5.4.0-1025.29","5.4.0-1026.30","5.4.0-1027.31","5.4.0-1028.32","5.4.0-1029.33","5.4.0-1030.34","5.4.0-1031.35","5.4.0-1032.36","5.4.0-1033.37","5.4.0-1034.38","5.4.0-1035.39","5.4.0-1036.40","5.4.0-1037.41","5.4.0-1038.42","5.4.0-1039.43","5.4.0-1040.44","5.4.0-1041.45","5.4.0-1042.46","5.4.0-1043.47","5.4.0-1044.48","5.4.0-1045.49","5.4.0-1046.50","5.4.0-1047.51","5.4.0-1048.52","5.4.0-1049.53","5.4.0-1050.54","5.4.0-1051.55","5.4.0-1052.56","5.4.0-1053.57","5.4.0-1054.58","5.4.0-1055.59","5.4.0-1056.60","5.4.0-1058.62","5.4.0-1060.64","5.4.0-1061.65","5.4.0-1062.66","5.4.0-1064.68","5.4.0-1065.69","5.4.0-1066.70","5.4.0-1067.71","5.4.0-1068.72","5.4.0-1069.73","5.4.0-1070.74","5.4.0-1071.75","5.4.0-1072.76","5.4.0-1074.78","5.4.0-1075.79","5.4.0-1076.80","5.4.0-1077.81","5.4.0-1078.82","5.4.0-1079.83","5.4.0-1080.84","5.4.0-1081.85","5.4.0-1082.86","5.4.0-1083.87","5.4.0-1084.88","5.4.0-1085.89"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:20.04:LTS","package":"linux-aws-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1021.21+fips2","5.4.0-1069.73+fips2","5.4.0-1071.76+fips1","5.4.0-1072.77+fips1","5.4.0-1073.78+fips1","5.4.0-1078.84+fips1","5.4.0-1080.87+fips1","5.4.0-1081.88+fips1","5.4.0-1083.90+fips1","5.4.0-1085.92+fips1","5.4.0-1086.93+fips1","5.4.0-1088.96+fips1","5.4.0-1089.97+fips1","5.4.0-1092.100+fips1","5.4.0-1093.101+fips1","5.4.0-1094.102+fips1","5.4.0-1096.104+fips1","5.4.0-1099.107+fips1","5.4.0-1100.108+fips1","5.4.0-1101.109+fips1","5.4.0-1102.110+fips1","5.4.0-1103.111+fips1","5.4.0-1104.112+fips1","5.4.0-1105.113+fips1","5.4.0-1106.114+fips1","5.4.0-1107.115+fips1","5.4.0-1108.116+fips1","5.4.0-1109.118+fips1","5.4.0-1110.119+fips1","5.4.0-1111.120+fips1","5.4.0-1112.121+fips1","5.4.0-1113.123+fips1","5.4.0-1114.124+fips1","5.4.0-1116.126+fips1","5.4.0-1117.127+fips1","5.4.0-1118.128+fips1","5.4.0-1119.129+fips1","5.4.0-1120.130+fips1","5.4.0-1121.131+fips1","5.4.0-1122.132+fips1","5.4.0-1123.133+fips1","5.4.0-1124.134+fips1","5.4.0-1125.135+fips1","5.4.0-1126.136+fips2","5.4.0-1127.137+fips1","5.4.0-1128.138+fips1","5.4.0-1129.139+fips1","5.4.0-1130.140+fips1","5.4.0-1131.141+fips1","5.4.0-1132.142+fips1","5.4.0-1133.143+fips1","5.4.0-1134.144+fips1","5.4.0-1135.145+fips1","5.4.0-1136.146+fips1","5.4.0-1137.147+fips1","5.4.0-1139.149+fips1","5.4.0-1140.151+fips1","5.4.0-1142.153+fips1","5.4.0-1144.155+fips1","5.4.0-1145.156+fips1","5.4.0-1146.156+fips1","5.4.0-1147.157+fips1","5.4.0-1148.158+fips1","5.4.0-1149.159+fips1","5.4.0-1150.160+fips1","5.4.0-1151.161+fips1","5.4.0-1152.162+fips1","5.4.0-1153.163+fips1","5.4.0-1154.164+fips1","5.4.0-1155.165+fips1","5.4.0-1156.166+fips1","5.4.0-1157.167+fips1","5.4.0-1158.168+fips1","5.4.0-1159.169+fips1","5.4.0-1160.170+fips1","5.4.0-1161.172+fips1","5.4.0-1163.174+fips1","5.4.0-1165.176+fips1","5.4.0-1166.177+fips1","5.4.0-1167.178+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:20.04:LTS","package":"linux-azure-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1022.22+fips1","5.4.0-1073.76+fips1","5.4.0-1074.77+fips1","5.4.0-1076.79+fips1","5.4.0-1078.81+fips1","5.4.0-1080.83+fips1","5.4.0-1083.87+fips1","5.4.0-1085.90+fips1","5.4.0-1086.91+fips1","5.4.0-1089.94+fips1","5.4.0-1090.95+fips1","5.4.0-1091.96+fips1","5.4.0-1094.100+fips1","5.4.0-1095.101+fips1","5.4.0-1098.104+fips1","5.4.0-1100.106+fips1","5.4.0-1101.107+fips1","5.4.0-1103.109+fips1","5.4.0-1104.110+fips1","5.4.0-1105.111+fips1","5.4.0-1106.112+fips1","5.4.0-1107.113+fips1","5.4.0-1108.114+fips1","5.4.0-1109.115+fips1","5.4.0-1110.116+fips1","5.4.0-1111.117+fips1","5.4.0-1112.118+fips1","5.4.0-1113.119+fips1","5.4.0-1114.120+fips1","5.4.0-1115.122+fips1","5.4.0-1116.123+fips1","5.4.0-1117.124+fips1","5.4.0-1118.125+fips1","5.4.0-1119.126+fips1","5.4.0-1121.128+fips1","5.4.0-1122.129+fips1","5.4.0-1123.130+fips1","5.4.0-1124.131+fips1","5.4.0-1126.133+fips1","5.4.0-1127.134+fips1","5.4.0-1128.135+fips1","5.4.0-1129.136+fips1","5.4.0-1130.137+fips1","5.4.0-1131.138+fips1","5.4.0-1132.139+fips1","5.4.0-1133.140+fips1","5.4.0-1134.141+fips1","5.4.0-1135.142+fips1","5.4.0-1136.143+fips1","5.4.0-1137.144+fips1","5.4.0-1138.145+fips1","5.4.0-1139.146+fips1","5.4.0-1140.147+fips1","5.4.0-1142.149+fips1","5.4.0-1143.150+fips1","5.4.0-1145.152+fips1","5.4.0-1147.154+fips1","5.4.0-1148.156+fips1","5.4.0-1149.157+fips1","5.4.0-1151.158+fips1","5.4.0-1152.159+fips1","5.4.0-1153.160+fips1","5.4.0-1154.161+fips1","5.4.0-1155.162+fips1","5.4.0-1157.164+fips1","5.4.0-1158.165+fips1","5.4.0-1160.166+fips1","5.4.0-1161.167+fips1","5.4.0-1162.168+fips1","5.4.0-1163.169+fips1","5.4.0-1164.170+fips1","5.4.0-1166.172+fips1","5.4.0-1167.173+fips1","5.4.0-1168.174+fips1","5.4.0-1170.176+fips1","5.4.0-1171.177+fips1","5.4.0-1172.178+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:20.04:LTS","package":"linux-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1026.30","5.4.0-1028.32","5.4.0-1031.36","5.4.0-1032.37","5.4.0-1033.38","5.4.0-1034.40","5.4.0-1035.41","5.4.0-1036.42","5.4.0-1037.43","5.4.0-1038.44","5.4.0-1040.46","5.4.0-1041.47","5.4.0-1042.48","5.4.0-1043.49","5.4.0-1045.51","5.4.0-1046.52","5.4.0-1047.53","5.4.0-1048.54","5.4.0-1049.55","5.4.0-1051.57","5.4.0-1054.61","5.4.0-1056.64","5.4.0-1057.65","5.4.0-1059.67","5.4.0-1060.68","5.4.0-1061.69","5.4.0-1062.70","5.4.0-1064.73","5.4.0-1065.74","5.4.0-1068.77","5.4.0-1069.78","5.4.0-1070.79","5.4.0-1072.81","5.4.0-1073.82","5.4.0-1074.83","5.4.0-1075.84","5.4.0-1076.85","5.4.0-1077.86","5.4.0-1078.87","5.4.0-1079.88","5.4.0-1080.89","5.4.0-1081.90","5.4.0-1082.91","5.4.0-1083.92","5.4.0-1084.93","5.4.0-1085.94","5.4.0-1086.95","5.4.0-1087.96","5.4.0-1088.97","5.4.0-1089.98","5.4.0-1090.100","5.4.0-1091.101","5.4.0-1092.102","5.4.0-1094.104","5.4.0-1095.105","5.4.0-1096.106","5.4.0-1097.107","5.4.0-1098.108","5.4.0-1099.109","5.4.0-1100.110","5.4.0-1101.111","5.4.0-1102.112","5.4.0-1103.113","5.4.0-1104.114","5.4.0-1105.115","5.4.0-1106.116","5.4.0-1107.117","5.4.0-1108.118","5.4.0-1109.119","5.4.0-1110.120","5.4.0-1111.121","5.4.0-1112.122","5.4.0-1116.126","5.4.0-1117.127","5.4.0-1118.128","5.4.0-1119.129","5.4.0-1120.130","5.4.0-1121.131","5.4.0-1122.132","5.4.0-1123.133","5.4.0-1124.134","5.4.0-1125.135","5.4.0-1126.136","5.4.0-1127.137","5.4.0-1128.138","5.4.0-1130.140","5.4.0-1131.141","5.4.0-1132.142","5.4.0-1133.143","5.4.0-1134.144","5.4.0-1135.145","5.4.0-1136.146","5.4.0-1137.147","5.4.0-1138.148","5.4.0-1139.149","5.4.0-1140.150","5.4.0-1141.151"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:20.04:LTS","package":"linux-gcp-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1021.21+fips1","5.4.0-1067.71~20.04.1","5.4.0-1069.73+fips2","5.4.0-1071.75+fips1","5.4.0-1073.78+fips1","5.4.0-1075.80+fips1","5.4.0-1078.84+fips1","5.4.0-1080.87+fips1","5.4.0-1081.88+fips1","5.4.0-1086.94+fips1","5.4.0-1087.95+fips1","5.4.0-1089.97+fips1","5.4.0-1092.101+fips1","5.4.0-1093.102+fips1","5.4.0-1096.105+fips1","5.4.0-1097.106+fips1","5.4.0-1098.107+fips1","5.4.0-1100.109+fips1","5.4.0-1101.110+fips1","5.4.0-1102.111+fips1","5.4.0-1103.112+fips1","5.4.0-1104.113+fips1","5.4.0-1105.114+fips1","5.4.0-1106.115+fips1","5.4.0-1107.116+fips1","5.4.0-1108.117+fips1","5.4.0-1109.118+fips1","5.4.0-1110.119+fips1","5.4.0-1111.120+fips1","5.4.0-1112.121+fips1","5.4.0-1113.122+fips1","5.4.0-1115.124+fips1","5.4.0-1116.125+fips1","5.4.0-1117.126+fips1","5.4.0-1118.127+fips1","5.4.0-1120.129+fips1","5.4.0-1121.130+fips1","5.4.0-1122.131+fips1","5.4.0-1124.133+fips1","5.4.0-1125.134+fips1","5.4.0-1126.135+fips1","5.4.0-1127.136+fips1","5.4.0-1128.137+fips1","5.4.0-1129.138+fips1","5.4.0-1130.139+fips1","5.4.0-1131.140+fips1","5.4.0-1132.141+fips1","5.4.0-1133.142+fips1","5.4.0-1134.143+fips1","5.4.0-1135.144+fips1","5.4.0-1136.145+fips1","5.4.0-1137.146+fips1","5.4.0-1138.147+fips1","5.4.0-1139.148+fips1","5.4.0-1140.149+fips1","5.4.0-1141.150+fips1","5.4.0-1142.151+fips1","5.4.0-1143.152+fips1","5.4.0-1145.154+fips1","5.4.0-1146.155+fips1","5.4.0-1147.156+fips1","5.4.0-1148.157+fips1","5.4.0-1149.158+fips1","5.4.0-1150.159+fips1","5.4.0-1151.160+fips1","5.4.0-1152.161+fips1","5.4.0-1153.162+fips1","5.4.0-1154.163+fips1","5.4.0-1155.164+fips1","5.4.0-1156.165+fips1","5.4.0-1157.166+fips1","5.4.0-1159.168+fips1","5.4.0-1160.169+fips1","5.4.0-1161.170+fips1","5.4.0-1162.171+fips1","5.4.0-1163.172+fips1","5.4.0-1164.173+fips1","5.4.0-1165.174+fips1","5.4.0-1166.175+fips1","5.4.0-1167.176+fips1","5.4.0-1168.178+fips1","5.4.0-1169.179+fips1","5.4.0-1170.180+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:20.04:LTS","package":"linux-aws-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1021.21+fips2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:20.04:LTS","package":"linux-azure-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1022.22+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:20.04:LTS","package":"linux-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1007.8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:20.04:LTS","package":"linux-gcp-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1021.21+fips1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-19.19","5.15.0-17.17","5.15.0-18.18","5.15.0-22.22","5.15.0-23.23","5.15.0-25.25","5.15.0-27.28","5.15.0-30.31","5.15.0-33.34","5.15.0-35.36","5.15.0-37.39","5.15.0-39.42","5.15.0-40.43","5.15.0-41.44","5.15.0-43.46","5.15.0-46.49","5.15.0-47.51","5.15.0-48.54","5.15.0-50.56","5.15.0-52.58","5.15.0-53.59","5.15.0-56.62","5.15.0-57.63","5.15.0-58.64","5.15.0-60.66","5.15.0-67.74","5.15.0-69.76","5.15.0-70.77","5.15.0-71.78","5.15.0-72.79","5.15.0-73.80","5.15.0-75.82","5.15.0-76.83","5.15.0-78.85","5.15.0-79.86","5.15.0-82.91","5.15.0-83.92","5.15.0-84.93","5.15.0-86.96","5.15.0-87.97","5.15.0-88.98","5.15.0-89.99","5.15.0-91.101","5.15.0-92.102","5.15.0-94.104","5.15.0-97.107","5.15.0-100.110","5.15.0-101.111","5.15.0-102.112","5.15.0-105.115","5.15.0-106.116","5.15.0-107.117","5.15.0-112.122","5.15.0-113.123","5.15.0-116.126","5.15.0-117.127","5.15.0-118.128","5.15.0-119.129","5.15.0-121.131","5.15.0-122.132","5.15.0-124.134","5.15.0-125.135","5.15.0-126.136","5.15.0-127.137","5.15.0-128.138","5.15.0-130.140","5.15.0-131.141","5.15.0-133.144","5.15.0-134.145","5.15.0-135.146","5.15.0-136.147","5.15.0-138.148","5.15.0-139.149","5.15.0-140.150","5.15.0-141.151","5.15.0-142.152","5.15.0-143.153","5.15.0-144.157","5.15.0-151.161","5.15.0-152.162","5.15.0-153.163","5.15.0-156.166","5.15.0-157.167","5.15.0-160.170","5.15.0-161.171","5.15.0-163.173","5.15.0-164.174","5.15.0-168.178","5.15.0-170.180","5.15.0-171.181","5.15.0-173.183","5.15.0-174.184","5.15.0-176.186","5.15.0-177.187","5.15.0-179.189","5.15.0-181.191","5.15.0-185.195","5.15.0-186.196","5.15.0-187.197","5.15.0-190.200","5.15.0-191.201","5.15.0-194.204","5.15.0-198.208","5.15.0-202.212","5.15.0-203.213"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-allwinner-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1007.7~22.04.1","5.19.0-1009.9~22.04.1","5.19.0-1010.10~22.04.1","5.19.0-1011.11~22.04.1","5.19.0-1012.12~22.04.1","5.19.0-1013.13~22.04.1","5.19.0-1014.14~22.04.1","5.19.0-1015.15~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1005.6","5.15.0-1002.4","5.15.0-1003.5","5.15.0-1004.6","5.15.0-1005.7","5.15.0-1008.10","5.15.0-1009.11","5.15.0-1011.14","5.15.0-1013.17","5.15.0-1014.18","5.15.0-1015.19","5.15.0-1017.21","5.15.0-1019.23","5.15.0-1020.24","5.15.0-1021.25","5.15.0-1022.26","5.15.0-1023.27","5.15.0-1026.30","5.15.0-1027.31","5.15.0-1028.32","5.15.0-1030.34","5.15.0-1031.35","5.15.0-1033.37","5.15.0-1034.38","5.15.0-1035.39","5.15.0-1036.40","5.15.0-1037.41","5.15.0-1038.43","5.15.0-1039.44","5.15.0-1040.45","5.15.0-1042.47","5.15.0-1043.48","5.15.0-1044.49","5.15.0-1045.50","5.15.0-1047.52","5.15.0-1048.53","5.15.0-1049.54","5.15.0-1050.55","5.15.0-1051.56","5.15.0-1052.57","5.15.0-1053.58","5.15.0-1055.60","5.15.0-1056.61","5.15.0-1057.63","5.15.0-1060.66","5.15.0-1061.67","5.15.0-1062.68","5.15.0-1063.69","5.15.0-1064.70","5.15.0-1065.71","5.15.0-1066.72","5.15.0-1067.73","5.15.0-1068.74","5.15.0-1069.75","5.15.0-1070.76","5.15.0-1071.77","5.15.0-1072.78","5.15.0-1073.79","5.15.0-1076.83","5.15.0-1078.85","5.15.0-1079.86","5.15.0-1080.87","5.15.0-1081.88","5.15.0-1082.89","5.15.0-1083.90","5.15.0-1084.91","5.15.0-1085.92","5.15.0-1086.93","5.15.0-1087.94","5.15.0-1088.95","5.15.0-1089.96","5.15.0-1090.97","5.15.0-1091.98","5.15.0-1092.99","5.15.0-1093.100","5.15.0-1095.102","5.15.0-1096.103","5.15.0-1097.104","5.15.0-1098.105","5.15.0-1099.106","5.15.0-1100.107","5.15.0-1101.108","5.15.0-1103.110","5.15.0-1104.111","5.15.0-1105.112","5.15.0-1106.113","5.15.0-1108.115","5.15.0-1109.116","5.15.0-1111.118","5.15.0-1112.119","5.15.0-1113.120","5.15.0-1114.121","5.15.0-1115.122","5.15.0-1116.123","5.15.0-1117.124","5.15.0-1119.126","5.15.0-1120.127"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1019.20~22.04.1","5.19.0-1020.21~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1026.27~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1029.30~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1008.8~22.04.1","6.5.0-1010.10~22.04.1","6.5.0-1011.11~22.04.1","6.5.0-1012.12~22.04.1","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.2","6.5.0-1018.18~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1021.21~22.04.1","6.5.0-1022.22~22.04.1","6.5.0-1023.23~22.04.1","6.5.0-1024.24~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1009.9~22.04.2","6.8.0-1010.10~22.04.2","6.8.0-1011.12~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.15~22.04.1","6.8.0-1015.16~22.04.1","6.8.0-1016.17~22.04.2","6.8.0-1017.18~22.04.1","6.8.0-1018.19~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1023.25~22.04.1","6.8.0-1024.26~22.04.1","6.8.0-1027.29~22.04.1","6.8.0-1028.30~22.04.1","6.8.0-1029.31~22.04.1","6.8.0-1030.32~22.04.1","6.8.0-1031.33~22.04.1","6.8.0-1032.34~22.04.1","6.8.0-1033.35~22.04.1","6.8.0-1035.37~22.04.1","6.8.0-1036.38~22.04.1","6.8.0-1039.41~22.04.1","6.8.0-1040.42~22.04.1","6.8.0-1041.43~22.04.1","6.8.0-1042.44~22.04.1","6.8.0-1043.45~22.04.1","6.8.0-1044.46~22.04.1","6.8.0-1045.47~22.04.1","6.8.0-1046.49~22.04.1","6.8.0-1047.50~22.04.1","6.8.0-1050.53~22.04.1","6.8.0-1051.54~22.04.1","6.8.0-1052.55~22.04.1","6.8.0-1053.56~22.04.1","6.8.0-1055.58~22.04.1","6.8.0-1057.60~22.04.1","6.8.0-1060.63~22.04.1","6.8.0-1061.64~22.04.1","6.8.0-1062.65~22.04.2","6.8.0-1063.66~22.04.1","6.8.0-1064.67~22.04.1","6.8.0-1065.68~22.04.1","6.8.0-1066.69~22.04.1","6.8.0-1069.74~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1006.7","5.15.0-1001.2","5.15.0-1002.3","5.15.0-1003.4","5.15.0-1005.6","5.15.0-1007.8","5.15.0-1008.9","5.15.0-1010.12","5.15.0-1012.15","5.15.0-1013.16","5.15.0-1014.17","5.15.0-1017.20","5.15.0-1019.24","5.15.0-1020.25","5.15.0-1021.26","5.15.0-1022.27","5.15.0-1023.29","5.15.0-1024.30","5.15.0-1029.36","5.15.0-1030.37","5.15.0-1031.38","5.15.0-1033.40","5.15.0-1034.41","5.15.0-1035.42","5.15.0-1036.43","5.15.0-1037.44","5.15.0-1038.45","5.15.0-1039.46","5.15.0-1040.47","5.15.0-1041.48","5.15.0-1042.49","5.15.0-1044.51","5.15.0-1045.52","5.15.0-1046.53","5.15.0-1047.54","5.15.0-1049.56","5.15.0-1050.57","5.15.0-1051.59","5.15.0-1052.60","5.15.0-1053.61","5.15.0-1054.62","5.15.0-1056.64","5.15.0-1057.65","5.15.0-1058.66","5.15.0-1059.67","5.15.0-1060.69","5.15.0-1061.70","5.15.0-1063.72","5.15.0-1064.73","5.15.0-1066.75","5.15.0-1067.76","5.15.0-1068.77","5.15.0-1070.79","5.15.0-1071.80","5.15.0-1072.81","5.15.0-1073.82","5.15.0-1074.83","5.15.0-1075.84","5.15.0-1078.87","5.15.0-1079.88","5.15.0-1081.90","5.15.0-1082.91","5.15.0-1084.93","5.15.0-1086.95","5.15.0-1087.96","5.15.0-1088.97","5.15.0-1089.98","5.15.0-1090.99","5.15.0-1091.100","5.15.0-1092.101","5.15.0-1094.103","5.15.0-1095.104","5.15.0-1096.105","5.15.0-1097.106","5.15.0-1098.107","5.15.0-1099.108","5.15.0-1101.110","5.15.0-1102.111","5.15.0-1103.112","5.15.0-1109.118","5.15.0-1110.119","5.15.0-1111.120","5.15.0-1114.123","5.15.0-1116.125","5.15.0-1117.126","5.15.0-1118.127","5.15.0-1119.128","5.15.0-1121.130","5.15.0-1122.131","5.15.0-1123.132","5.15.0-1125.134","5.15.0-1126.135"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.21~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1025.28~22.04.1","5.19.0-1026.29~22.04.1","5.19.0-1027.30~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1","6.2.0-1019.19~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.7~22.04.1","6.5.0-1009.9~22.04.1","6.5.0-1010.10~22.04.1","6.5.0-1011.11~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.1","6.5.0-1018.19~22.04.2","6.5.0-1019.20~22.04.1","6.5.0-1021.22~22.04.1","6.5.0-1022.23~22.04.1","6.5.0-1023.24~22.04.1","6.5.0-1024.25~22.04.1","6.5.0-1025.26~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1009.9~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1012.14~22.04.1","6.8.0-1013.15~22.04.1","6.8.0-1014.16~22.04.1","6.8.0-1015.17~22.04.2","6.8.0-1017.20~22.04.1","6.8.0-1018.21~22.04.1","6.8.0-1020.23~22.04.1","6.8.0-1021.25~22.04.1","6.8.0-1025.30~22.04.1","6.8.0-1026.31~22.04.1","6.8.0-1027.32~22.04.1","6.8.0-1028.33~22.04.1","6.8.0-1029.34~22.04.1","6.8.0-1030.35~22.04.1","6.8.0-1031.36~22.04.1","6.8.0-1034.39~22.04.1","6.8.0-1036.42~22.04.1","6.8.0-1040.46~22.04.1","6.8.0-1041.47~22.04.1","6.8.0-1044.50~22.04.1","6.8.0-1051.57~22.04.1","6.8.0-1052.58~22.04.1","6.8.0-1059.65~22.04.1","6.8.0-1062.69~22.04.1","6.8.0-1063.71~22.04.1","6.8.0-1064.72~22.04.1","6.8.0-1065.73~22.04.1","6.8.0-1067.75~22.04.1","6.8.0-1068.76~22.04.1","6.8.0-1070.78~22.04.1","6.8.0-1073.82~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1019.24.1","5.15.0-1024.30.1","5.15.0-1029.36.1","5.15.0-1030.37.1","5.15.0-1031.38.1","5.15.0-1033.40.1","5.15.0-1034.41.1","5.15.0-1035.42.1","5.15.0-1036.43.1","5.15.0-1037.44.1","5.15.0-1038.45.1","5.15.0-1039.46.1","5.15.0-1041.48.1","5.15.0-1042.49.1","5.15.0-1044.51.1","5.15.0-1045.52.1","5.15.0-1046.53.1","5.15.0-1047.54.1","5.15.0-1049.56.1","5.15.0-1050.57.1","5.15.0-1051.59.1","5.15.0-1052.60.1","5.15.0-1053.61.1","5.15.0-1054.62.1","5.15.0-1056.64.1","5.15.0-1057.65.1","5.15.0-1058.66.1","5.15.0-1059.67.1","5.15.0-1060.69.1","5.15.0-1061.70.1","5.15.0-1063.72.1","5.15.0-1064.73.1","5.15.0-1065.74.1","5.15.0-1067.76.1","5.15.0-1068.77.1","5.15.0-1070.79.1","5.15.0-1071.80.1","5.15.0-1072.81.1","5.15.0-1073.82.1","5.15.0-1076.85.1","5.15.0-1078.87.1","5.15.0-1081.90.1","5.15.0-1082.91.1","5.15.0-1084.93.1","5.15.0-1086.95.1","5.15.0-1087.96.1","5.15.0-1088.97.1","5.15.0-1089.98.1","5.15.0-1090.99.1","5.15.0-1091.100.1","5.15.0-1092.101.1","5.15.0-1094.103.1","5.15.0-1095.104.1","5.15.0-1096.105.1","5.15.0-1097.106.1","5.15.0-1098.107.1","5.15.0-1102.111.1","5.15.0-1109.118.1","5.15.0-1110.119.1","5.15.0-1111.120.1","5.15.0-1114.123","5.15.0-1116.125","5.15.0-1117.126","5.15.0-1118.127","5.15.0-1119.128","5.15.0-1120.129","5.15.0-1121.130","5.15.0-1122.131","5.15.0-1124.133","5.15.0-1125.134"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1025.28~22.04.1.1","5.19.0-1026.29~22.04.1.1","5.19.0-1027.30~22.04.2.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1.1","6.2.0-1009.9~22.04.3.1","6.2.0-1011.11~22.04.1.1","6.2.0-1012.12~22.04.1.1","6.2.0-1014.14~22.04.1.1","6.2.0-1015.15~22.04.1.1","6.2.0-1016.16~22.04.1.1","6.2.0-1017.17~22.04.1.1","6.2.0-1018.18~22.04.1.1","6.2.0-1019.19~22.04.1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1041.48~22.04.1","6.8.0-1042.49~22.04.1","6.8.0-1044.51~22.04.1","6.8.0-1046.53~22.04.1","6.8.0-1053.60~22.04.1","6.8.0-1058.65~22.04.1","6.8.0-1061.68~22.04.1","6.8.0-1062.69~22.04.1","6.8.0-1063.70~22.04.1","6.8.0-1064.71~22.04.1","6.8.0-1065.72~22.04.1","6.8.0-1066.73~22.04.1","6.8.0-1068.75~22.04.1","6.8.0-1071.78~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1005.6","5.15.0-1001.3","5.15.0-1002.5","5.15.0-1003.6","5.15.0-1004.7","5.15.0-1005.8","5.15.0-1006.9","5.15.0-1008.12","5.15.0-1010.15","5.15.0-1013.18","5.15.0-1016.21","5.15.0-1017.23","5.15.0-1018.24","5.15.0-1019.25","5.15.0-1021.28","5.15.0-1022.29","5.15.0-1025.32","5.15.0-1026.33","5.15.0-1027.34","5.15.0-1029.36","5.15.0-1030.37","5.15.0-1031.38","5.15.0-1032.40","5.15.0-1034.42","5.15.0-1035.43","5.15.0-1036.44","5.15.0-1037.45","5.15.0-1038.46","5.15.0-1039.47","5.15.0-1040.48","5.15.0-1041.49","5.15.0-1042.50","5.15.0-1044.52","5.15.0-1045.53","5.15.0-1046.54","5.15.0-1047.55","5.15.0-1048.56","5.15.0-1049.57","5.15.0-1051.59","5.15.0-1052.60","5.15.0-1053.61","5.15.0-1054.62","5.15.0-1055.63","5.15.0-1058.66","5.15.0-1059.67","5.15.0-1060.68","5.15.0-1062.70","5.15.0-1063.71","5.15.0-1064.72","5.15.0-1065.73","5.15.0-1066.74","5.15.0-1067.75","5.15.0-1068.76","5.15.0-1069.77","5.15.0-1070.78","5.15.0-1071.79","5.15.0-1072.80","5.15.0-1073.81","5.15.0-1074.83","5.15.0-1075.84","5.15.0-1077.86","5.15.0-1078.87","5.15.0-1079.88","5.15.0-1080.89","5.15.0-1081.90","5.15.0-1082.91","5.15.0-1083.92","5.15.0-1084.93","5.15.0-1085.94","5.15.0-1086.95","5.15.0-1087.96","5.15.0-1088.97","5.15.0-1090.99","5.15.0-1091.100","5.15.0-1092.101","5.15.0-1093.102","5.15.0-1095.104","5.15.0-1096.105","5.15.0-1097.106","5.15.0-1098.107","5.15.0-1099.108","5.15.0-1100.109","5.15.0-1101.110","5.15.0-1103.112","5.15.0-1104.113","5.15.0-1105.114","5.15.0-1106.115","5.15.0-1108.117","5.15.0-1109.118","5.15.0-1111.121","5.15.0-1112.122","5.15.0-1114.124","5.15.0-1115.125","5.15.0-1117.127","5.15.0-1118.128","5.15.0-1120.130","5.15.0-1121.131"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.22~22.04.2","5.19.0-1021.23~22.04.1","5.19.0-1022.24~22.04.1","5.19.0-1024.26~22.04.1","5.19.0-1025.27~22.04.1","5.19.0-1026.28~22.04.1","5.19.0-1027.29~22.04.1","5.19.0-1030.32~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1011.11~22.04.3","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1016.18~22.04.1","6.2.0-1017.19~22.04.1","6.2.0-1018.20~22.04.1","6.2.0-1019.21~22.04.1","6.2.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1010.10~22.04.3","6.5.0-1011.11~22.04.1","6.5.0-1013.13~22.04.1","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.1","6.5.0-1018.18~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1022.24~22.04.1","6.5.0-1023.25~22.04.1","6.5.0-1024.26~22.04.1","6.5.0-1025.27~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1010.11~22.04.1","6.8.0-1011.12~22.04.1","6.8.0-1012.13~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.16~22.04.1","6.8.0-1015.17~22.04.1","6.8.0-1016.18~22.04.1","6.8.0-1017.19~22.04.1","6.8.0-1018.20~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1024.26~22.04.1","6.8.0-1025.27~22.04.1","6.8.0-1026.28~22.04.1","6.8.0-1027.29~22.04.1","6.8.0-1028.30~22.04.1","6.8.0-1029.31~22.04.1","6.8.0-1030.32~22.04.1","6.8.0-1031.33~22.04.1","6.8.0-1032.34~22.04.1","6.8.0-1033.35~22.04.1","6.8.0-1034.36~22.04.2","6.8.0-1036.38~22.04.1","6.8.0-1037.39~22.04.1","6.8.0-1040.42~22.04.1","6.8.0-1041.43~22.04.1","6.8.0-1042.45~22.04.1","6.8.0-1043.46~22.04.1","6.8.0-1044.47~22.04.1","6.8.0-1045.48~22.04.1","6.8.0-1046.49~22.04.1","6.8.0-1047.50~22.04.2","6.8.0-1048.51~22.04.1","6.8.0-1052.55~22.04.1","6.8.0-1053.56~22.04.1","6.8.0-1054.57~22.04.1","6.8.0-1058.61~22.04.1","6.8.0-1060.63~22.04.1","6.8.0-1063.69~22.04.1","6.8.0-1064.72~22.04.1","6.8.0-1065.73~22.04.1","6.8.0-1066.74~22.04.1","6.8.0-1067.75~22.04.1","6.8.0-1069.77~22.04.1","6.8.0-1070.78~22.04.1","6.8.0-1073.81~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1002.2","5.15.0-1003.3","5.15.0-1004.5","5.15.0-1005.6","5.15.0-1006.7","5.15.0-1008.10","5.15.0-1010.13","5.15.0-1011.14","5.15.0-1014.17","5.15.0-1015.18","5.15.0-1016.19","5.15.0-1017.20","5.15.0-1019.23","5.15.0-1020.25","5.15.0-1023.28","5.15.0-1024.29","5.15.0-1027.32","5.15.0-1028.33","5.15.0-1030.35","5.15.0-1031.36","5.15.0-1032.37","5.15.0-1033.38","5.15.0-1034.39","5.15.0-1035.40","5.15.0-1036.41","5.15.0-1037.42","5.15.0-1038.43","5.15.0-1039.44","5.15.0-1040.45","5.15.0-1041.46","5.15.0-1042.47","5.15.0-1044.49","5.15.0-1045.50","5.15.0-1046.51","5.15.0-1047.52","5.15.0-1048.53","5.15.0-1049.54","5.15.0-1050.55","5.15.0-1051.56","5.15.0-1052.57","5.15.0-1053.58","5.15.0-1054.59","5.15.0-1057.62","5.15.0-1058.63","5.15.0-1059.64","5.15.0-1060.66","5.15.0-1061.67","5.15.0-1062.68","5.15.0-1063.69","5.15.0-1064.70","5.15.0-1065.71","5.15.0-1066.72","5.15.0-1067.73","5.15.0-1068.74","5.15.0-1069.75","5.15.0-1070.76","5.15.0-1071.77","5.15.0-1072.78","5.15.0-1073.79","5.15.0-1075.81","5.15.0-1076.82","5.15.0-1077.83","5.15.0-1078.84","5.15.0-1079.85","5.15.0-1080.86","5.15.0-1081.87","5.15.0-1082.88","5.15.0-1083.89","5.15.0-1084.90","5.15.0-1085.91","5.15.0-1086.92","5.15.0-1087.93","5.15.0-1088.94","5.15.0-1089.95","5.15.0-1090.96","5.15.0-1091.97","5.15.0-1092.98","5.15.0-1093.99","5.15.0-1094.100","5.15.0-1095.101","5.15.0-1096.102","5.15.0-1097.103","5.15.0-1099.105","5.15.0-1100.106","5.15.0-1101.107","5.15.0-1102.108","5.15.0-1104.110","5.15.0-1105.111","5.15.0-1107.113","5.15.0-1108.114","5.15.0-1110.116","5.15.0-1111.117","5.15.0-1112.118","5.15.0-1113.119","5.15.0-1115.121","5.15.0-1116.122"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1001.2","5.15.0-1002.4","5.15.0-1003.5","5.15.0-1004.6","5.15.0-1005.7","5.15.0-1007.10","5.15.0-1008.12","5.15.0-1011.15","5.15.0-1012.16","5.15.0-1013.17","5.15.0-1015.19","5.15.0-1016.21","5.15.0-1017.22","5.15.0-1018.23","5.15.0-1019.24","5.15.0-1020.25","5.15.0-1021.26","5.15.0-1022.27","5.15.0-1023.28","5.15.0-1024.29","5.15.0-1025.30","5.15.0-1026.31","5.15.0-1027.32","5.15.0-1028.33","5.15.0-1030.35","5.15.0-1031.37","5.15.0-1032.38","5.15.0-1033.39","5.15.0-1034.40","5.15.0-1035.41","5.15.0-1036.42","5.15.0-1037.43","5.15.0-1038.44","5.15.0-1039.45","5.15.0-1040.46","5.15.0-1043.50","5.15.0-1044.51","5.15.0-1045.52","5.15.0-1046.53","5.15.0-1047.54","5.15.0-1048.55","5.15.0-1049.56","5.15.0-1050.57","5.15.0-1051.58","5.15.0-1052.59","5.15.0-1053.60","5.15.0-1054.61","5.15.0-1055.62","5.15.0-1056.63","5.15.0-1057.64","5.15.0-1058.66","5.15.0-1059.67","5.15.0-1060.68","5.15.0-1061.69","5.15.0-1062.70","5.15.0-1063.71","5.15.0-1064.72","5.15.0-1065.73","5.15.0-1066.74","5.15.0-1067.75","5.15.0-1068.76","5.15.0-1069.77","5.15.0-1070.78","5.15.0-1071.79","5.15.0-1073.81","5.15.0-1074.82","5.15.0-1075.83","5.15.0-1076.84","5.15.0-1078.86","5.15.0-1079.87","5.15.0-1080.88","5.15.0-1081.89","5.15.0-1082.90","5.15.0-1083.91","5.15.0-1084.92","5.15.0-1086.94","5.15.0-1087.95","5.15.0-1088.96","5.15.0-1089.97","5.15.0-1091.99","5.15.0-1092.100","5.15.0-1094.102","5.15.0-1095.103","5.15.0-1096.104","5.15.0-1097.105","5.15.0-1098.106","5.15.0-1099.107","5.15.0-1100.108","5.15.0-1102.110","5.15.0-1103.111"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-28.29~22.04.1","5.19.0-32.33~22.04.1","5.19.0-35.36~22.04.1","5.19.0-38.39~22.04.1","5.19.0-40.41~22.04.1","5.19.0-41.42~22.04.1","5.19.0-42.43~22.04.1","5.19.0-43.44~22.04.1","5.19.0-45.46~22.04.1","5.19.0-46.47~22.04.1","5.19.0-50.50"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-25.25~22.04.2","6.2.0-26.26~22.04.1","6.2.0-31.31~22.04.1","6.2.0-32.32~22.04.1","6.2.0-33.33~22.04.1","6.2.0-34.34~22.04.1","6.2.0-35.35~22.04.1","6.2.0-36.37~22.04.1","6.2.0-37.38~22.04.1","6.2.0-39.40~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-14.14~22.04.1","6.5.0-15.15~22.04.1","6.5.0-17.17~22.04.1","6.5.0-18.18~22.04.1","6.5.0-21.21~22.04.1","6.5.0-25.25~22.04.1","6.5.0-26.26~22.04.1","6.5.0-27.28~22.04.1","6.5.0-28.29~22.04.1","6.5.0-35.35~22.04.1","6.5.0-41.41~22.04.2","6.5.0-44.44~22.04.1","6.5.0-45.45~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-38.38~22.04.1","6.8.0-39.39~22.04.1","6.8.0-40.40~22.04.3","6.8.0-45.45~22.04.1","6.8.0-47.47~22.04.1","6.8.0-48.48~22.04.1","6.8.0-49.49~22.04.1","6.8.0-50.51~22.04.1","6.8.0-51.52~22.04.1","6.8.0-52.53~22.04.1","6.8.0-57.59~22.04.1","6.8.0-58.60~22.04.1","6.8.0-59.61~22.04.1","6.8.0-60.63~22.04.1","6.8.0-64.67~22.04.1","6.8.0-65.68~22.04.1","6.8.0-78.78~22.04.1","6.8.0-79.79~22.04.1","6.8.0-83.83~22.04.1","6.8.0-84.84~22.04.1","6.8.0-85.85~22.04.1","6.8.0-86.87~22.04.1","6.8.0-87.88~22.04.1","6.8.0-88.89~22.04.2","6.8.0-90.91~22.04.1","6.8.0-94.96~22.04.1","6.8.0-100.100~22.04.1","6.8.0-101.101~22.04.1","6.8.0-106.106~22.04.1","6.8.0-107.107~22.04.1","6.8.0-110.110~22.04.1","6.8.0-111.111~22.04.1","6.8.0-117.117~22.04.1","6.8.0-124.124~22.04.1","6.8.0-134.134~22.04.1","6.8.0-136.136~22.04.1","6.8.0-138.138~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1002.2","5.15.0-1003.3","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1007.8","5.15.0-1009.11","5.15.0-1010.12","5.15.0-1012.14","5.15.0-1013.15","5.15.0-1015.17","5.15.0-1017.20","5.15.0-1018.21","5.15.0-1021.24","5.15.0-1022.25","5.15.0-1023.26","5.15.0-1025.28","5.15.0-1026.29","5.15.0-1027.30","5.15.0-1028.31","5.15.0-1029.32","5.15.0-1030.33","5.15.0-1031.34","5.15.0-1032.35","5.15.0-1033.36","5.15.0-1034.37","5.15.0-1035.38","5.15.0-1036.39","5.15.0-1037.40","5.15.0-1038.41","5.15.0-1040.43","5.15.0-1041.44","5.15.0-1042.45","5.15.0-1043.46","5.15.0-1044.47","5.15.0-1045.48","5.15.0-1046.49","5.15.0-1047.50","5.15.0-1048.51","5.15.0-1049.52","5.15.0-1050.53","5.15.0-1053.56","5.15.0-1054.57","5.15.0-1055.58","5.15.0-1056.59","5.15.0-1057.60","5.15.0-1058.61","5.15.0-1059.62","5.15.0-1060.63","5.15.0-1061.64","5.15.0-1062.65","5.15.0-1063.66","5.15.0-1064.67","5.15.0-1065.68","5.15.0-1066.69","5.15.0-1067.70","5.15.0-1068.71","5.15.0-1069.72","5.15.0-1070.73","5.15.0-1071.74","5.15.0-1072.75","5.15.0-1073.76","5.15.0-1074.77","5.15.0-1075.78","5.15.0-1076.79","5.15.0-1077.80","5.15.0-1078.81","5.15.0-1079.82","5.15.0-1080.83","5.15.0-1081.84","5.15.0-1084.87","5.15.0-1085.88","5.15.0-1086.89","5.15.0-1087.90","5.15.0-1089.92","5.15.0-1090.93","5.15.0-1091.94","5.15.0-1092.95","5.15.0-1093.96","5.15.0-1094.97","5.15.0-1095.98","5.15.0-1097.100","5.15.0-1098.101","5.15.0-1099.102","5.15.0-1100.103","5.15.0-1102.105","5.15.0-1103.106","5.15.0-1105.109","5.15.0-1106.110","5.15.0-1107.111","5.15.0-1108.112","5.15.0-1109.113","5.15.0-1110.114","5.15.0-1111.115","5.15.0-1113.117","5.15.0-1114.118"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-ibm-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.13~22.04.1","6.8.0-1014.14~22.04.1","6.8.0-1015.15~22.04.1","6.8.0-1016.16~22.04.1","6.8.0-1017.17~22.04.1","6.8.0-1018.18~22.04.1","6.8.0-1019.19~22.04.1","6.8.0-1023.23~22.04.1","6.8.0-1024.24~22.04.1","6.8.0-1025.25~22.04.1","6.8.0-1026.26~22.04.1","6.8.0-1027.27~22.04.1","6.8.0-1028.28~22.04.1","6.8.0-1029.29~22.04.1","6.8.0-1030.30~22.04.1","6.8.0-1033.33~22.04.1","6.8.0-1036.36~22.04.1","6.8.0-1037.37~22.04.1","6.8.0-1038.38~22.04.1","6.8.0-1039.39~22.04.1","6.8.0-1040.40~22.04.1","6.8.0-1041.41~22.04.1","6.8.0-1042.42~22.04.1","6.8.0-1043.43~22.04.1","6.8.0-1044.44~22.04.1","6.8.0-1045.45~22.04.1","6.8.0-1049.49~22.04.1","6.8.0-1050.50~22.04.1","6.8.0-1051.51~22.04.1","6.8.0-1052.52~22.04.1","6.8.0-1055.56~22.04.1","6.8.0-1057.58~22.04.1","6.8.0-1060.61~22.04.1","6.8.0-1061.62~22.04.1","6.8.0-1062.63~22.04.1","6.8.0-1063.64~22.04.1","6.8.0-1066.67~22.04.1","6.8.0-1069.70~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-intel-iot-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1073.75"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-intel-iotg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1004.6","5.15.0-1008.11","5.15.0-1010.14","5.15.0-1013.17","5.15.0-1015.20","5.15.0-1016.21","5.15.0-1017.22","5.15.0-1018.23","5.15.0-1021.26","5.15.0-1023.28","5.15.0-1025.30","5.15.0-1026.31","5.15.0-1027.32","5.15.0-1028.33","5.15.0-1030.35","5.15.0-1031.36","5.15.0-1033.38","5.15.0-1034.39","5.15.0-1035.40","5.15.0-1036.41","5.15.0-1037.42","5.15.0-1038.43","5.15.0-1039.45","5.15.0-1040.46","5.15.0-1043.49","5.15.0-1045.51","5.15.0-1046.52","5.15.0-1047.53","5.15.0-1048.54","5.15.0-1049.55","5.15.0-1050.56","5.15.0-1051.57","5.15.0-1052.58","5.15.0-1055.61","5.15.0-1057.63","5.15.0-1058.64","5.15.0-1059.65","5.15.0-1060.66","5.15.0-1061.67","5.15.0-1062.68","5.15.0-1063.69","5.15.0-1064.70","5.15.0-1065.71","5.15.0-1066.72","5.15.0-1067.73","5.15.0-1071.77","5.15.0-1072.78","5.15.0-1073.79","5.15.0-1074.80","5.15.0-1075.81","5.15.0-1076.82","5.15.0-1077.83","5.15.0-1078.84","5.15.0-1079.85","5.15.0-1080.86","5.15.0-1081.87","5.15.0-1082.88","5.15.0-1083.89","5.15.0-1084.90","5.15.0-1085.91","5.15.0-1086.92","5.15.0-1087.93","5.15.0-1088.94","5.15.0-1090.96","5.15.0-1091.97","5.15.0-1092.98","5.15.0-1093.99","5.15.0-1094.100","5.15.0-1095.101","5.15.0-1096.102","5.15.0-1098.104","5.15.0-1099.105","5.15.0-1100.106","5.15.0-1101.107","5.15.0-1103.109","5.15.0-1104.110","5.15.0-1106.112","5.15.0-1107.113","5.15.0-1108.114","5.15.0-1109.115","5.15.0-1110.116","5.15.0-1111.117","5.15.0-1112.118","5.15.0-1114.120","5.15.0-1115.121"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1004.4","5.13.0-1006.6+22.04.1","5.13.0-1007.7+22.04.1","5.13.0-1010.11+22.04.1","5.15.0-1002.2","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1007.7","5.15.0-1008.8","5.15.0-1010.11","5.15.0-1012.14","5.15.0-1013.16","5.15.0-1016.19","5.15.0-1017.21","5.15.0-1018.22","5.15.0-1019.23","5.15.0-1020.24","5.15.0-1021.26","5.15.0-1024.29","5.15.0-1025.30","5.15.0-1026.31","5.15.0-1028.33","5.15.0-1029.34","5.15.0-1030.35","5.15.0-1031.36","5.15.0-1032.37","5.15.0-1033.38","5.15.0-1034.39","5.15.0-1035.40","5.15.0-1037.42","5.15.0-1038.43","5.15.0-1039.44","5.15.0-1040.45","5.15.0-1041.46","5.15.0-1042.47","5.15.0-1044.49","5.15.0-1045.50","5.15.0-1046.51","5.15.0-1047.52","5.15.0-1048.53","5.15.0-1049.54","5.15.0-1050.55","5.15.0-1051.56","5.15.0-1052.57","5.15.0-1053.58","5.15.0-1054.59","5.15.0-1057.62","5.15.0-1058.63","5.15.0-1059.64","5.15.0-1060.65","5.15.0-1061.66","5.15.0-1062.67","5.15.0-1063.68","5.15.0-1064.69","5.15.0-1065.70","5.15.0-1066.71","5.15.0-1067.72","5.15.0-1068.73","5.15.0-1069.74","5.15.0-1070.75","5.15.0-1071.76","5.15.0-1072.77","5.15.0-1073.78","5.15.0-1076.81","5.15.0-1077.82","5.15.0-1078.83","5.15.0-1079.84","5.15.0-1080.85","5.15.0-1081.86","5.15.0-1082.87","5.15.0-1083.88","5.15.0-1084.89","5.15.0-1085.90","5.15.0-1086.91","5.15.0-1087.92","5.15.0-1088.93","5.15.0-1089.94","5.15.0-1090.95","5.15.0-1091.96","5.15.0-1092.97","5.15.0-1093.98","5.15.0-1095.100","5.15.0-1096.101","5.15.0-1097.102","5.15.0-1098.103","5.15.0-1100.105","5.15.0-1101.106","5.15.0-1103.108","5.15.0-1104.109","5.15.0-1105.110","5.15.0-1106.111","5.15.0-1107.112","5.15.0-1108.113","5.15.0-1109.114","5.15.0-1111.116","5.15.0-1112.117"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-22.22","5.15.0-23.23","5.15.0-24.24","5.15.0-27.28","5.15.0-30.31","5.15.0-33.34","5.15.0-35.36","5.15.0-37.39","5.15.0-39.42","5.15.0-40.43","5.15.0-41.44","5.15.0-43.46","5.15.0-46.49","5.15.0-47.53","5.15.0-48.54","5.15.0-50.56","5.15.0-52.58","5.15.0-53.59","5.15.0-56.62","5.15.0-57.63","5.15.0-58.64","5.15.0-60.66","5.15.0-67.74","5.15.0-69.76","5.15.0-70.77","5.15.0-71.78","5.15.0-72.79","5.15.0-73.80","5.15.0-75.82","5.15.0-76.83","5.15.0-78.85","5.15.0-79.88","5.15.0-82.91","5.15.0-83.92","5.15.0-84.93","5.15.0-86.95","5.15.0-87.96","5.15.0-88.98","5.15.0-89.99","5.15.0-91.101","5.15.0-92.102","5.15.0-94.104","5.15.0-97.107","5.15.0-100.110","5.15.0-101.111","5.15.0-102.112","5.15.0-105.115","5.15.0-106.116","5.15.0-107.117","5.15.0-110.120","5.15.0-113.123","5.15.0-116.126","5.15.0-117.127","5.15.0-118.128","5.15.0-119.129","5.15.0-121.131","5.15.0-122.132","5.15.0-124.134","5.15.0-125.135","5.15.0-126.136","5.15.0-127.137","5.15.0-128.138","5.15.0-129.139","5.15.0-131.141","5.15.0-133.143","5.15.0-134.145","5.15.0-135.146","5.15.0-136.147","5.15.0-138.148","5.15.0-139.149","5.15.0-140.150","5.15.0-141.151","5.15.0-142.152","5.15.0-143.153","5.15.0-144.157","5.15.0-145.158","5.15.0-152.162","5.15.0-153.163","5.15.0-156.166","5.15.0-157.167","5.15.0-160.170","5.15.0-161.171","5.15.0-163.173","5.15.0-164.174","5.15.0-168.178","5.15.0-170.180","5.15.0-171.181","5.15.0-173.183","5.15.0-174.184","5.15.0-175.185","5.15.0-177.187","5.15.0-178.188","5.15.0-179.189","5.15.0-181.191","5.15.0-183.193","5.15.0-184.194","5.15.0-190.200","5.15.0-191.201","5.15.0-194.204","5.15.0-195.205","5.15.0-197.207","5.15.0-198.208"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1030.30"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-14.14.1~22.04.1","6.5.0-15.15.1.1~22.04.1","6.5.0-17.17.1.1.1~22.04.1","6.5.0-21.21.1~22.04.1","6.5.0-25.25.1~22.04.1","6.5.0-26.26.1~22.04.1","6.5.0-27.28.1~22.04.1","6.5.0-28.29.1~22.04.1","6.5.0-35.35.1~22.04.1","6.5.0-41.41.1~22.04.1","6.5.0-42.42.1~22.04.1","6.5.0-44.44.1~22.04.1","6.5.0-45.45.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-38.38.1~22.04.2","6.8.0-40.40.1~22.04.1","6.8.0-44.44.1~22.04.1","6.8.0-45.45.1~22.04.1","6.8.0-47.47.1~22.04.1","6.8.0-48.48.3~22.04.1","6.8.0-49.49.1~22.04.1","6.8.0-50.51.1~22.04.1","6.8.0-51.52.1~22.04.1","6.8.0-52.53.1~22.04.1","6.8.0-54.56.1~22.04.1","6.8.0-55.57.1~22.04.1","6.8.0-56.58.1~22.04.1","6.8.0-57.59.1~22.04.1","6.8.0-58.60.1~22.04.1","6.8.0-59.61.1~22.04.1","6.8.0-60.63.1~22.04.1","6.8.0-62.65.1~22.04.1","6.8.0-63.66.1~22.04.1","6.8.0-64.67.1~22.04.1","6.8.0-65.68.1~22.04.1","6.8.0-78.78.1~22.04.1","6.8.0-79.79.1~22.04.1","6.8.0-83.83.1~22.04.1","6.8.0-84.84.1~22.04.1","6.8.0-85.85.1~22.04.1","6.8.0-86.87.1~22.04.1","6.8.0-87.88.1~22.04.1","6.8.0-88.89.1~22.04.1","6.8.0-90.91.1~22.04.1","6.8.0-94.96.1~22.04.1","6.8.0-100.100.1~22.04.1","6.8.0-101.101.1~22.04.1","6.8.0-106.106.1~22.04.1","6.8.0-107.107.1~22.04.1","6.8.0-110.110.1~22.04.1","6.8.0-111.111.1~22.04.1","6.8.0-117.117.1~22.04.1","6.8.0-134.134.1~22.04.1","6.8.0-136.136.2~22.04.1","6.8.0-137.137.1~22.04.1","6.8.0-138.138.1~22.04.1","6.8.0-139.139.1~22.04.1","6.8.0-142.142.1~22.04.1","6.8.0-146.146.1~22.04.1","6.8.0-149.149.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1005.5","5.15.0-1007.7","5.15.0-1010.10","5.15.0-1015.15","5.15.0-1017.17","5.15.0-1018.18","5.15.0-1023.23","5.15.0-1025.25","5.15.0-1026.26","5.15.0-1027.27","5.15.0-1028.28","5.15.0-1029.29","5.15.0-1030.30","5.15.0-1031.31","5.15.0-1032.32","5.15.0-1033.33","5.15.0-1037.37","5.15.0-1039.39","5.15.0-1040.40","5.15.0-1041.41","5.15.0-1042.42","5.15.0-1043.43","5.15.0-1044.44","5.15.0-1045.45","5.15.0-1046.46","5.15.0-1047.47","5.15.0-1048.48","5.15.0-1053.54","5.15.0-1054.55","5.15.0-1055.56","5.15.0-1058.59","5.15.0-1059.60","5.15.0-1060.61","5.15.0-1061.62","5.15.0-1062.63","5.15.0-1063.64","5.15.0-1064.65","5.15.0-1065.66","5.15.0-1066.67","5.15.0-1067.68","5.15.0-1068.69","5.15.0-1069.70","5.15.0-1070.71","5.15.0-1071.72","5.15.0-1072.73","5.15.0-1073.74","5.15.0-1074.75","5.15.0-1075.76","5.15.0-1076.77","5.15.0-1077.78","5.15.0-1078.79","5.15.0-1079.80","5.15.0-1080.81","5.15.0-1081.82","5.15.0-1082.83","5.15.0-1083.84","5.15.0-1085.86","5.15.0-1086.87","5.15.0-1087.88","5.15.0-1088.89","5.15.0-1090.91","5.15.0-1091.92","5.15.0-1092.93","5.15.0-1093.94","5.15.0-1094.95","5.15.0-1095.96","5.15.0-1096.97","5.15.0-1098.99","5.15.0-1099.100","5.15.0-1100.101","5.15.0-1101.102","5.15.0-1103.104","5.15.0-1104.105","5.15.0-1106.107","5.15.0-1107.108","5.15.0-1108.109","5.15.0-1109.110","5.15.0-1110.111","5.15.0-1111.112","5.15.0-1112.113","5.15.0-1114.115","5.15.0-1115.116"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1003.3~22.04.1","6.2.0-1009.9","6.2.0-1010.10","6.2.0-1011.11","6.2.0-1012.12","6.2.0-1013.13","6.2.0-1015.15"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1004.4","6.5.0-1007.7","6.5.0-1013.13","6.5.0-1014.14","6.5.0-1015.15","6.5.0-1018.18","6.5.0-1019.19","6.5.0-1021.22","6.5.0-1022.23","6.5.0-1023.24","6.5.0-1024.25"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1008.8~22.04.1","6.8.0-1009.9~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.14~22.04.1","6.8.0-1014.15~22.04.1","6.8.0-1015.16~22.04.1","6.8.0-1017.19~22.04.1","6.8.0-1018.20~22.04.1","6.8.0-1019.21~22.04.1","6.8.0-1020.22~22.04.1","6.8.0-1021.23~22.04.1","6.8.0-1022.25~22.04.2","6.8.0-1023.26~22.04.1","6.8.0-1024.27~22.04.1","6.8.0-1025.28~22.04.1","6.8.0-1026.29~22.04.1","6.8.0-1027.30~22.04.1","6.8.0-1028.31~22.04.1","6.8.0-1029.32~22.04.1","6.8.0-1030.33~22.04.1","6.8.0-1031.34~22.04.1","6.8.0-1032.35~22.04.1","6.8.0-1035.38~22.04.1","6.8.0-1036.39~22.04.1","6.8.0-1038.41~22.04.1","6.8.0-1039.42~22.04.1","6.8.0-1040.43~22.04.1","6.8.0-1041.44~22.04.2","6.8.0-1042.45~22.04.1","6.8.0-1043.46~22.04.1","6.8.0-1044.47~22.04.1","6.8.0-1045.48~22.04.1","6.8.0-1046.49~22.04.1","6.8.0-1047.50~22.04.1","6.8.0-1049.52~22.04.1","6.8.0-1050.53~22.04.1","6.8.0-1051.54~22.04.1","6.8.0-1052.55~22.04.1","6.8.0-1054.57~22.04.1","6.8.0-1055.58~22.04.1","6.8.0-1058.61~22.04.1","6.8.0-1059.62~22.04.1","6.8.0-1060.63~22.04.1","6.8.0-1061.64~22.04.1","6.8.0-1062.65~22.04.1","6.8.0-1063.66~22.04.1","6.8.0-1064.67~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-tegra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1009.9","5.15.0-1010.10","5.15.0-1012.12","5.15.0-1013.13","5.15.0-1014.14","5.15.0-1015.15","5.15.0-1016.16","5.15.0-1017.17","5.15.0-1018.18","5.15.0-1019.19","5.15.0-1020.20","5.15.0-1021.21","5.15.0-1022.22","5.15.0-1025.25","5.15.0-1026.26","5.15.0-1027.27","5.15.0-1028.28","5.15.0-1030.30","5.15.0-1032.32","5.15.0-1033.33","5.15.0-1034.34","5.15.0-1035.35","5.15.0-1036.36","5.15.0-1037.37","5.15.0-1038.38","5.15.0-1039.39","5.15.0-1040.40","5.15.0-1041.41","5.15.0-1042.42","5.15.0-1043.43","5.15.0-1044.44","5.15.0-1045.45","5.15.0-1046.46","5.15.0-1047.47","5.15.0-1048.48","5.15.0-1049.49","5.15.0-1050.50","5.15.0-1051.51","5.15.0-1052.52","5.15.0-1053.53","5.15.0-1055.55","5.15.0-1056.56","5.15.0-1057.57","5.15.0-1058.58","5.15.0-1060.60","5.15.0-1061.61","5.15.0-1063.63","5.15.0-1064.66","5.15.0-1065.67","5.15.0-1066.68","5.15.0-1067.69","5.15.0-1068.70","5.15.0-1070.72","5.15.0-1071.73"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-tegra-igx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1001.1","5.15.0-1002.2","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1006.6","5.15.0-1007.7","5.15.0-1008.8","5.15.0-1009.9","5.15.0-1012.12","5.15.0-1013.13","5.15.0-1015.15","5.15.0-1016.16","5.15.0-1018.18","5.15.0-1019.19","5.15.0-1020.20","5.15.0-1021.21","5.15.0-1022.22","5.15.0-1023.23","5.15.0-1024.24","5.15.0-1026.26","5.15.0-1027.27","5.15.0-1028.28","5.15.0-1029.29","5.15.0-1030.30","5.15.0-1031.31","5.15.0-1032.32","5.15.0-1033.33","5.15.0-1034.34","5.15.0-1035.35","5.15.0-1036.36","5.15.0-1037.37","5.15.0-1038.38","5.15.0-1039.39","5.15.0-1040.40","5.15.0-1041.41","5.15.0-1042.42","5.15.0-1044.44","5.15.0-1045.45","5.15.0-1046.46","5.15.0-1047.47","5.15.0-1049.49","5.15.0-1050.50","5.15.0-1052.52","5.15.0-1053.53","5.15.0-1054.54","5.15.0-1055.55","5.15.0-1056.56","5.15.0-1057.57","5.15.0-1059.59"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-5.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.17.0-1003.3","5.17.0-1004.4","5.17.0-1006.6","5.17.0-1011.12","5.17.0-1012.13","5.17.0-1013.14","5.17.0-1014.15","5.17.0-1015.16","5.17.0-1016.17","5.17.0-1017.18","5.17.0-1018.19","5.17.0-1019.20","5.17.0-1020.21","5.17.0-1021.22","5.17.0-1024.25","5.17.0-1025.26","5.17.0-1026.27","5.17.0-1027.28","5.17.0-1028.29","5.17.0-1029.30","5.17.0-1030.31","5.17.0-1031.32","5.17.0-1032.33","5.17.0-1033.34","5.17.0-1034.35","5.17.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.0-1006.6","6.0.0-1007.7","6.0.0-1008.8","6.0.0-1009.9","6.0.0-1010.10","6.0.0-1011.11","6.0.0-1012.12","6.0.0-1013.13","6.0.0-1014.14","6.0.0-1015.15","6.0.0-1016.16","6.0.0-1017.17","6.0.0-1018.18","6.0.0-1019.19","6.0.0-1020.20","6.0.0-1021.21"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.0-1004.4","6.1.0-1006.6","6.1.0-1007.7","6.1.0-1008.8","6.1.0-1009.9","6.1.0-1010.10","6.1.0-1012.12","6.1.0-1013.13","6.1.0-1014.14","6.1.0-1015.15","6.1.0-1016.16","6.1.0-1017.17","6.1.0-1019.19","6.1.0-1020.20","6.1.0-1021.21","6.1.0-1022.22","6.1.0-1023.23","6.1.0-1024.24","6.1.0-1025.25","6.1.0-1026.26","6.1.0-1027.27","6.1.0-1028.28","6.1.0-1029.29","6.1.0-1033.33","6.1.0-1034.34","6.1.0-1035.35","6.1.0-1036.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1003.3","6.5.0-1004.4","6.5.0-1006.6","6.5.0-1007.7","6.5.0-1008.8","6.5.0-1009.10","6.5.0-1011.12","6.5.0-1013.14","6.5.0-1014.15","6.5.0-1015.16","6.5.0-1016.17","6.5.0-1018.19","6.5.0-1019.20","6.5.0-1020.21","6.5.0-1022.23","6.5.0-1023.24","6.5.0-1024.25","6.5.0-1025.26","6.5.0-1027.28"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.10","5.15.0-1001.3","5.15.0-1002.4","5.15.0-1003.5","5.15.0-1006.8","5.15.0-1007.9","5.15.0-1009.12","5.15.0-1011.15","5.15.0-1013.17","5.15.0-1016.20","5.15.0-1017.22","5.15.0-1018.23","5.15.0-1019.24","5.15.0-1021.27","5.15.0-1022.28","5.15.0-1025.31","5.15.0-1026.32","5.15.0-1027.33","5.15.0-1029.35","5.15.0-1030.36","5.15.0-1032.38","5.15.0-1033.39","5.15.0-1034.40","5.15.0-1035.41","5.15.0-1036.42","5.15.0-1037.43","5.15.0-1038.44","5.15.0-1039.45","5.15.0-1040.46","5.15.0-1041.47","5.15.0-1042.48","5.15.0-1044.50","5.15.0-1045.51","5.15.0-1046.52","5.15.0-1047.53","5.15.0-1048.54","5.15.0-1049.55","5.15.0-1050.56","5.15.0-1051.57","5.15.0-1052.58","5.15.0-1053.59","5.15.0-1054.60","5.15.0-1055.61","5.15.0-1058.64","5.15.0-1059.65","5.15.0-1060.66","5.15.0-1061.67","5.15.0-1062.68","5.15.0-1063.69","5.15.0-1064.70","5.15.0-1065.71","5.15.0-1066.72","5.15.0-1067.73","5.15.0-1068.74","5.15.0-1069.75","5.15.0-1070.76","5.15.0-1071.77","5.15.0-1072.78","5.15.0-1073.79","5.15.0-1074.80","5.15.0-1075.81","5.15.0-1076.82","5.15.0-1077.83","5.15.0-1078.84","5.15.0-1079.85","5.15.0-1080.86","5.15.0-1081.87","5.15.0-1082.88","5.15.0-1083.89","5.15.0-1084.90","5.15.0-1085.91","5.15.0-1086.92","5.15.0-1088.94","5.15.0-1089.95","5.15.0-1090.96","5.15.0-1091.97","5.15.0-1092.98","5.15.0-1093.99","5.15.0-1094.100","5.15.0-1095.101","5.15.0-1096.102","5.15.0-1097.103","5.15.0-1098.104","5.15.0-1100.106","5.15.0-1101.107","5.15.0-1102.108","5.15.0-1103.109","5.15.0-1105.111","5.15.0-1106.112","5.15.0-1108.114","5.15.0-1109.115","5.15.0-1110.116","5.15.0-1111.117","5.15.0-1112.118","5.15.0-1113.119","5.15.0-1114.120","5.15.0-1116.122","5.15.0-1117.123"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1013.13~22.04.4","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1018.18~22.04.1","6.5.0-1019.19~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1021.21~22.04.1","6.5.0-1023.23~22.04.1","6.5.0-1024.24~22.04.1","6.5.0-1025.25~22.04.1","6.5.0-1026.26~22.04.1","6.5.0-1027.27~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1006.6~22.04.3","6.8.0-1008.8~22.04.1","6.8.0-1010.10~22.04.1","6.8.0-1011.11~22.04.1","6.8.0-1012.12~22.04.1","6.8.0-1013.13~22.04.1","6.8.0-1014.14~22.04.1","6.8.0-1015.15~22.04.1","6.8.0-1016.17~22.04.1","6.8.0-1017.18~22.04.1","6.8.0-1018.19~22.04.1","6.8.0-1019.20~22.04.1","6.8.0-1020.21~22.04.1","6.8.0-1021.22~22.04.1","6.8.0-1022.23~22.04.1","6.8.0-1023.24~22.04.1","6.8.0-1024.25~22.04.1","6.8.0-1025.26~22.04.1","6.8.0-1026.27~22.04.1","6.8.0-1027.28~22.04.1","6.8.0-1028.29~22.04.1","6.8.0-1029.30~22.04.1","6.8.0-1030.31~22.04.1","6.8.0-1032.33~22.04.1","6.8.0-1033.34~22.04.1","6.8.0-1035.36~22.04.1","6.8.0-1037.38~22.04.1","6.8.0-1038.39~22.04.1","6.8.0-1039.40~22.04.1","6.8.0-1040.41~22.04.1","6.8.0-1041.42~22.04.1","6.8.0-1042.43~22.04.1","6.8.0-1043.44~22.04.1","6.8.0-1044.45~22.04.1","6.8.0-1047.48~22.04.1","6.8.0-1049.50~22.04.1","6.8.0-1050.51~22.04.1","6.8.0-1052.53~22.04.1","6.8.0-1054.55~22.04.1","6.8.0-1057.58~22.04.1","6.8.0-1058.61~22.04.1","6.8.0-1059.62~22.04.1","6.8.0-1060.63~22.04.1","6.8.0-1061.64~22.04.1","6.8.0-1062.65~22.04.1","6.8.0-1067.71~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-raspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9","5.15.0-1002.2","5.15.0-1003.3","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1006.6","5.15.0-1008.8","5.15.0-1011.13","5.15.0-1012.14","5.15.0-1013.15","5.15.0-1014.16","5.15.0-1015.17","5.15.0-1016.18","5.15.0-1017.19","5.15.0-1018.20","5.15.0-1021.23","5.15.0-1022.24","5.15.0-1023.25","5.15.0-1024.26","5.15.0-1025.27","5.15.0-1026.28","5.15.0-1027.29","5.15.0-1028.30","5.15.0-1029.31","5.15.0-1030.32","5.15.0-1032.35","5.15.0-1033.36","5.15.0-1034.37","5.15.0-1035.38","5.15.0-1036.39","5.15.0-1037.40","5.15.0-1038.41","5.15.0-1040.43","5.15.0-1041.44","5.15.0-1042.45","5.15.0-1043.46","5.15.0-1044.47","5.15.0-1045.48","5.15.0-1046.49","5.15.0-1047.50","5.15.0-1048.51","5.15.0-1049.52","5.15.0-1050.53","5.15.0-1053.56","5.15.0-1054.57","5.15.0-1055.58","5.15.0-1058.61","5.15.0-1059.62","5.15.0-1060.63","5.15.0-1061.64","5.15.0-1062.65","5.15.0-1063.66","5.15.0-1064.67","5.15.0-1065.68","5.15.0-1066.69","5.15.0-1067.70","5.15.0-1070.73","5.15.0-1071.74","5.15.0-1072.75","5.15.0-1073.76","5.15.0-1074.77","5.15.0-1075.78","5.15.0-1076.79","5.15.0-1077.80","5.15.0-1078.81","5.15.0-1079.82","5.15.0-1080.83","5.15.0-1083.86","5.15.0-1084.87","5.15.0-1085.88","5.15.0-1086.89","5.15.0-1087.90","5.15.0-1089.92","5.15.0-1090.93","5.15.0-1091.94","5.15.0-1092.95","5.15.0-1093.96","5.15.0-1097.100","5.15.0-1098.101","5.15.0-1099.102","5.15.0-1100.103","5.15.0-1102.105","5.15.0-1103.106","5.15.0-1105.108","5.15.0-1106.109","5.15.0-1108.111","5.15.0-1110.113","5.15.0-1113.116"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1032.35"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1004.4","5.13.0-1006.6+22.04.1","5.13.0-1007.7+22.04.1","5.13.0-1010.11+22.04.1","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1006.6","5.15.0-1007.7","5.15.0-1008.8","5.15.0-1011.12","5.15.0-1012.13","5.15.0-1014.16","5.15.0-1015.17","5.15.0-1016.18","5.15.0-1017.19","5.15.0-1018.21","5.15.0-1019.22","5.15.0-1020.23","5.15.0-1022.26","5.15.0-1023.27","5.15.0-1026.30","5.15.0-1027.31","5.15.0-1028.32"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1012.13~22.04.1","5.19.0-1015.16~22.04.1","5.19.0-1016.17~22.04.1","5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1","5.19.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-17.17.1.1~22.04.1","6.5.0-21.21.1~22.04.1","6.5.0-25.25.1~22.04.1","6.5.0-26.26.1~22.04.1","6.5.0-27.28.1~22.04.1","6.5.0-28.29.1~22.04.1","6.5.0-35.35.1~22.04.1","6.5.0-40.40.1~22.04.1","6.5.0-42.42.1~22.04.1","6.5.0-45.45.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-38.38.1~22.04.1","6.8.0-39.39.1~22.04.1","6.8.0-40.40.1~22.04.1","6.8.0-41.41.1~22.04.1","6.8.0-44.44.1~22.04.1","6.8.0-47.47.1~22.04.1","6.8.0-48.48.1~22.04.2","6.8.0-49.49.1~22.04.1","6.8.0-50.51.1~22.04.1","6.8.0-51.52.1~22.04.1","6.8.0-52.53.1~22.04.1","6.8.0-53.55.1~22.04.1","6.8.0-55.57.1~22.04.1","6.8.0-56.58.1~22.04.1","6.8.0-57.59.1~22.04.1","6.8.0-58.60.1~22.04.1","6.8.0-59.61.1~22.04.1","6.8.0-62.65~22.04.1","6.8.0-63.66~22.04.1","6.8.0-64.67~22.04.1","6.8.0-71.71~22.04.1","6.8.0-78.78~22.04.1","6.8.0-79.79~22.04.1","6.8.0-83.83~22.04.1","6.8.0-84.84~22.04.1","6.8.0-86.87~22.04.1","6.8.0-87.88~22.04.1","6.8.0-88.89~22.04.1","6.8.0-90.91~22.04.1","6.8.0-94.96~22.04.1","6.8.0-100.100~22.04.1","6.8.0-101.101~22.04.1","6.8.0-106.106~22.04.1","6.8.0-107.107~22.04.1","6.8.0-110.110~22.04.1","6.8.0-111.111~22.04.1","6.8.0-117.117~22.04.1","6.8.0-124.124~22.04.1","6.8.0-134.134~22.04.1","6.8.0-136.136~22.04.3","6.8.0-137.137~22.04.1","6.8.0-138.138~22.04.1","6.8.0-139.139~22.04.1","6.8.0-142.142~22.04.1","6.8.0-146.146~22.04.1","6.8.0-149.149~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1014.16~22.04.1","5.19.0-1015.17~22.04.1","5.19.0-1016.18~22.04.1","5.19.0-1017.19~22.04.1","5.19.0-1018.20~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1006.7~22.04.1","6.2.0-1007.8~22.04.1","6.2.0-1009.10~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.8~22.04.1","6.5.0-1008.9~22.04.1","6.5.0-1009.10~22.04.1","6.5.0-1010.11~22.04.1","6.5.0-1011.12~22.04.1","6.5.0-1012.13~22.04.1","6.5.0-1014.15~22.04.1","6.5.0-1015.16~22.04.1","6.5.0-1016.17~22.04.1","6.5.0-1017.18~22.04.1","6.5.0-1018.19~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-xilinx-zynqmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1022.26","5.15.0-1023.27","5.15.0-1025.29","5.15.0-1027.31","5.15.0-1030.34","5.15.0-1031.35","5.15.0-1035.39","5.15.0-1036.40","5.15.0-1037.41","5.15.0-1038.42","5.15.0-1039.43","5.15.0-1041.45","5.15.0-1044.48","5.15.0-1046.50","5.15.0-1050.54","5.15.0-1051.55","5.15.0-1052.56","5.15.0-1053.57","5.15.0-1054.58","5.15.0-1055.59","5.15.0-1056.60","5.15.0-1057.61","5.15.0-1059.63","5.15.0-1060.64","5.15.0-1061.65","5.15.0-1062.66","5.15.0-1063.67","5.15.0-1064.68","5.15.0-1065.69","5.15.0-1067.71","5.15.0-1068.72","5.15.0-1069.73","5.15.0-1070.74","5.15.0-1074.78","5.15.0-1075.79","5.15.0-1076.80","5.15.0-1077.81","5.15.0-1078.82","5.15.0-1079.83","5.15.0-1080.84"]},{"source":"osv","ecosystem":"Ubuntu:Nvidia-BlueField:22.04:LTS","package":"linux-bluefield","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1011.13","5.15.0-1014.16","5.15.0-1015.17","5.15.0-1017.19","5.15.0-1019.21","5.15.0-1021.23","5.15.0-1022.24","5.15.0-1023.25","5.15.0-1024.26","5.15.0-1027.29","5.15.0-1028.30","5.15.0-1031.33","5.15.0-1032.34","5.15.0-1033.35","5.15.0-1035.37","5.15.0-1036.38","5.15.0-1037.39","5.15.0-1038.40","5.15.0-1040.42","5.15.0-1042.44","5.15.0-1043.45","5.15.0-1044.46","5.15.0-1045.47","5.15.0-1047.49","5.15.0-1048.50","5.15.0-1050.52","5.15.0-1051.53","5.15.0-1052.54","5.15.0-1053.55","5.15.0-1054.56","5.15.0-1056.58","5.15.0-1057.59","5.15.0-1058.60","5.15.0-1059.61","5.15.0-1060.62","5.15.0-1061.63","5.15.0-1062.64","5.15.0-1063.65","5.15.0-1064.66","5.15.0-1065.67","5.15.0-1066.68","5.15.0-1067.69","5.15.0-1069.71","5.15.0-1070.72","5.15.0-1072.74","5.15.0-1074.76","5.15.0-1075.77","5.15.0-1076.78","5.15.0-1077.79","5.15.0-1079.81","5.15.0-1080.82","5.15.0-1081.83","5.15.0-1082.84","5.15.0-1083.85","5.15.0-1084.86","5.15.0-1085.87","5.15.0-1086.88","5.15.0-1087.89","5.15.0-1089.91","5.15.0-1090.92","5.15.0-1092.94","5.15.0-1093.95","5.15.0-1095.97","5.15.0-1096.98","5.15.0-1097.99","5.15.0-1098.100","5.15.0-1099.101","5.15.0-1100.102","5.15.0-1101.103","5.15.0-1103.105","5.15.0-1104.106"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:22.04:LTS","package":"linux-intel-iot-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1021.26","5.15.0-1022.27","5.15.0-1023.28","5.15.0-1024.29","5.15.0-1028.33","5.15.0-1033.35","5.15.0-1034.36","5.15.0-1035.37","5.15.0-1036.38","5.15.0-1037.39","5.15.0-1038.40","5.15.0-1039.41","5.15.0-1040.42","5.15.0-1041.43","5.15.0-1042.44","5.15.0-1043.45","5.15.0-1044.46","5.15.0-1046.48","5.15.0-1047.49","5.15.0-1048.50","5.15.0-1049.51","5.15.0-1050.52","5.15.0-1053.55","5.15.0-1054.56","5.15.0-1055.57","5.15.0-1056.58","5.15.0-1057.59","5.15.0-1058.60","5.15.0-1059.61","5.15.0-1060.62","5.15.0-1061.63","5.15.0-1063.65","5.15.0-1064.66","5.15.0-1066.68","5.15.0-1071.73","5.15.0-1072.74","5.15.0-1073.75","5.15.0-1074.76","5.15.0-1075.77","5.15.0-1076.78","5.15.0-1077.79","5.15.0-1078.80","5.15.0-1079.81","5.15.0-1080.82","5.15.0-1081.83","5.15.0-1082.84","5.15.0-1083.85","5.15.0-1084.86","5.15.0-1085.87","5.15.0-1086.88","5.15.0-1087.89","5.15.0-1088.90","5.15.0-1089.91","5.15.0-1090.92","5.15.0-1091.93","5.15.0-1092.94","5.15.0-1093.95","5.15.0-1094.96","5.15.0-1096.98","5.15.0-1097.99","5.15.0-1098.100","5.15.0-1099.101","5.15.0-1100.102","5.15.0-1101.103","5.15.0-1103.105","5.15.0-1104.106","5.15.0-1105.107","5.15.0-1106.108","5.15.0-1107.109","5.15.0-1108.110","5.15.0-1109.111","5.15.0-1111.115","5.15.0-1112.116"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:22.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1006.6","5.15.0-1007.7","5.15.0-1009.9","5.15.0-1011.11","5.15.0-1014.14","5.15.0-1015.15","5.15.0-1016.16","5.15.0-1019.19","5.15.0-1020.20","5.15.0-1021.21","5.15.0-1022.22","5.15.0-1024.25","5.15.0-1025.28","5.15.0-1028.31","5.15.0-1029.32","5.15.0-1030.33","5.15.0-1032.35","5.15.0-1033.36","5.15.0-1034.37","5.15.0-1036.39","5.15.0-1037.40","5.15.0-1038.41","5.15.0-1039.42","5.15.0-1040.45","5.15.0-1041.46","5.15.0-1042.47","5.15.0-1043.48","5.15.0-1044.49","5.15.0-1045.50","5.15.0-1046.52","5.15.0-1048.54","5.15.0-1049.55","5.15.0-1050.56","5.15.0-1051.57","5.15.0-1052.58","5.15.0-1053.59","5.15.0-1054.60","5.15.0-1055.62","5.15.0-1056.63","5.15.0-1057.64","5.15.0-1058.66","5.15.0-1061.69","5.15.0-1062.70","5.15.0-1063.71","5.15.0-1064.72","5.15.0-1065.73","5.15.0-1066.74","5.15.0-1067.75","5.15.0-1068.76","5.15.0-1069.77","5.15.0-1070.78","5.15.0-1071.79","5.15.0-1072.80","5.15.0-1073.81","5.15.0-1074.82","5.15.0-1075.83","5.15.0-1076.84","5.15.0-1077.85","5.15.0-1078.86","5.15.0-1079.87","5.15.0-1080.88","5.15.0-1081.89","5.15.0-1082.91","5.15.0-1083.92","5.15.0-1084.93","5.15.0-1085.94","5.15.0-1086.95","5.15.0-1087.96","5.15.0-1088.97","5.15.0-1089.98","5.15.0-1090.99","5.15.0-1091.100","5.15.0-1092.101","5.15.0-1093.102","5.15.0-1094.103","5.15.0-1095.104","5.15.0-1096.105","5.15.0-1097.106","5.15.0-1098.107","5.15.0-1099.108","5.15.0-1100.109","5.15.0-1102.111","5.15.0-1103.112","5.15.0-1104.113","5.15.0-1105.114","5.15.0-1107.116","5.15.0-1108.117","5.15.0-1110.119","5.15.0-1111.120","5.15.0-1112.121","5.15.0-1113.122","5.15.0-1114.123","5.15.0-1115.124","5.15.0-1116.125","5.15.0-1118.127","5.15.0-1119.128"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:22.04:LTS","package":"linux-realtime-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.1-1004.4~22.04.1","6.8.1-1005.5~22.04.2","6.8.1-1006.6~22.04.1","6.8.1-1007.7~22.04.1","6.8.1-1008.8~22.04.1","6.8.1-1009.9~22.04.1","6.8.1-1010.10~22.04.1","6.8.1-1011.11~22.04.1","6.8.1-1012.12~22.04.1","6.8.1-1013.14~22.04.1","6.8.1-1014.15~22.04.1","6.8.1-1015.16~22.04.1","6.8.1-1016.17~22.04.1","6.8.1-1017.18~22.04.1","6.8.1-1018.19~22.04.1","6.8.1-1019.20~22.04.1","6.8.1-1020.21~22.04.1","6.8.1-1021.22~22.04.1","6.8.1-1022.23~22.04.1","6.8.1-1023.24~22.04.1","6.8.1-1024.25~22.04.1","6.8.1-1025.26~22.04.1","6.8.1-1026.27~22.04.1","6.8.1-1030.31~22.04.1","6.8.1-1031.32~22.04.1","6.8.1-1034.35~22.04.1","6.8.1-1035.36~22.04.1","6.8.1-1036.37~22.04.1","6.8.1-1037.38~22.04.1","6.8.1-1038.39~22.04.1","6.8.1-1039.40~22.04.1","6.8.1-1040.41~22.04.1","6.8.1-1041.42~22.04.1","6.8.1-1042.43~22.04.1","6.8.1-1045.46~22.04.1","6.8.1-1046.47~22.04.2","6.8.1-1047.48~22.04.1","6.8.1-1048.49~22.04.1","6.8.1-1051.52~22.04.1","6.8.1-1052.53~22.04.1","6.8.1-1055.56~22.04.1","6.8.1-1056.57~22.04.2","6.8.1-1057.58~22.04.1","6.8.1-1058.59~22.04.1","6.8.1-1059.60~22.04.1","6.8.1-1060.61~22.04.1","6.8.1-1061.62~22.04.1","6.8.1-1064.65~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-preview:22.04:LTS","package":"linux-aws-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1042.47+fips1","5.15.0-1051.56+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-preview:22.04:LTS","package":"linux-azure-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1053.61+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-preview:22.04:LTS","package":"linux-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-73.80+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-preview:22.04:LTS","package":"linux-gcp-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1048.56+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"linux-aws-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1051.56+fips1","5.15.0-1052.57+fips1","5.15.0-1053.58+fips1","5.15.0-1055.60+fips1","5.15.0-1056.61+fips1","5.15.0-1057.63+fips1","5.15.0-1060.66+fips1","5.15.0-1061.67+fips1","5.15.0-1062.68+fips1","5.15.0-1063.69+fips1","5.15.0-1064.70+fips1","5.15.0-1065.71+fips1","5.15.0-1066.72+fips1","5.15.0-1067.73+fips1","5.15.0-1068.74+fips1","5.15.0-1069.75+fips1","5.15.0-1070.76+fips1","5.15.0-1071.77+fips1","5.15.0-1072.78+fips1","5.15.0-1073.79+fips1","5.15.0-1076.83+fips1","5.15.0-1077.84+fips1","5.15.0-1078.85+fips1","5.15.0-1079.86+fips1","5.15.0-1080.87+fips1","5.15.0-1081.88+fips1","5.15.0-1082.89+fips1","5.15.0-1083.90+fips1","5.15.0-1084.91+fips1","5.15.0-1085.92+fips1","5.15.0-1086.93+fips1","5.15.0-1087.94+fips1","5.15.0-1088.95+fips1","5.15.0-1089.96+fips1","5.15.0-1090.97+fips1","5.15.0-1091.98+fips1","5.15.0-1092.99+fips1","5.15.0-1093.100+fips1","5.15.0-1095.102+fips1","5.15.0-1096.103+fips1","5.15.0-1097.104+fips1","5.15.0-1098.105+fips1","5.15.0-1099.106+fips1","5.15.0-1100.107+fips1","5.15.0-1101.108+fips1","5.15.0-1103.110+fips1","5.15.0-1104.111+fips1","5.15.0-1105.112+fips1","5.15.0-1106.113+fips1","5.15.0-1108.115+fips1","5.15.0-1109.116+fips1","5.15.0-1111.118+fips1","5.15.0-1112.119+fips1","5.15.0-1113.120+fips1","5.15.0-1114.121+fips1","5.15.0-1115.122+fips1","5.15.0-1116.123+fips1","5.15.0-1117.124+fips1","5.15.0-1119.126+fips1","5.15.0-1120.127+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"linux-azure-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1053.61+fips1","5.15.0-1058.66+fips1","5.15.0-1059.67+fips1","5.15.0-1060.69+fips1","5.15.0-1061.70+fips1","5.15.0-1063.72+fips1","5.15.0-1064.73+fips1","5.15.0-1065.74+fips1","5.15.0-1067.76+fips1","5.15.0-1068.77+fips1","5.15.0-1070.79+fips1","5.15.0-1071.80+fips1","5.15.0-1072.81+fips1","5.15.0-1073.82+fips1","5.15.0-1074.83+fips1","5.15.0-1075.84+fips1","5.15.0-1078.87+fips1","5.15.0-1079.88+fips1","5.15.0-1080.89+fips1","5.15.0-1082.91+fips1","5.15.0-1083.92+fips1","5.15.0-1085.94+fips1","5.15.0-1087.96+fips1","5.15.0-1088.97+fips1","5.15.0-1089.98+fips1","5.15.0-1090.99+fips1","5.15.0-1091.100+fips1","5.15.0-1094.103+fips1","5.15.0-1095.104+fips1","5.15.0-1096.105+fips1","5.15.0-1097.106+fips1","5.15.0-1098.107+fips1","5.15.0-1101.110+fips1","5.15.0-1102.111+fips1","5.15.0-1103.112+fips1","5.15.0-1109.118+fips1","5.15.0-1110.119+fips1","5.15.0-1111.120+fips1","5.15.0-1114.123+fips1","5.15.0-1116.125+fips1","5.15.0-1117.126+fips1","5.15.0-1118.127+fips1","5.15.0-1119.128+fips1","5.15.0-1121.130+fips1","5.15.0-1122.131+fips1","5.15.0-1123.132+fips1","5.15.0-1125.134+fips1","5.15.0-1126.135+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"linux-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-73.80+fips1","5.15.0-92.102+fips1","5.15.0-94.104+fips1","5.15.0-97.107+fips1","5.15.0-100.110+fips1","5.15.0-101.111+fips1","5.15.0-102.112+fips1","5.15.0-105.115+fips1","5.15.0-106.116+fips1","5.15.0-107.117+fips1","5.15.0-111.121+fips1","5.15.0-113.123+fips1","5.15.0-115.125+fips1","5.15.0-117.127+fips1","5.15.0-118.128+fips1","5.15.0-119.129+fips1","5.15.0-121.131+fips1","5.15.0-122.132+fips1","5.15.0-124.134+fips1","5.15.0-125.135+fips1","5.15.0-127.137+fips1","5.15.0-128.138+fips1","5.15.0-130.140+fips1","5.15.0-131.141+fips1","5.15.0-133.144+fips1","5.15.0-134.145+fips1","5.15.0-135.146+fips1","5.15.0-136.147+fips1","5.15.0-138.148+fips1","5.15.0-139.149+fips1","5.15.0-140.150+fips1","5.15.0-141.151+fips1","5.15.0-142.152+fips1","5.15.0-143.153+fips1","5.15.0-144.157+fips1","5.15.0-145.158+fips1","5.15.0-152.162+fips1","5.15.0-153.163+fips1","5.15.0-156.166+fips1","5.15.0-157.167+fips1","5.15.0-160.170+fips1","5.15.0-161.171+fips1","5.15.0-163.173+fips1","5.15.0-164.174+fips1","5.15.0-168.178+fips1","5.15.0-170.180+fips1","5.15.0-171.181+fips1","5.15.0-173.183+fips1","5.15.0-174.184+fips1","5.15.0-176.186+fips1","5.15.0-177.187+fips1","5.15.0-179.189+fips1","5.15.0-181.191+fips1","5.15.0-185.195+fips1","5.15.0-186.196+fips1","5.15.0-190.200+fips1","5.15.0-191.201+fips1","5.15.0-194.204+fips1","5.15.0-198.208+fips1","5.15.0-202.212+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"linux-gcp-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1048.56+fips1","5.15.0-1055.63+fips2","5.15.0-1058.66+fips1","5.15.0-1059.67+fips1","5.15.0-1060.68+fips1","5.15.0-1062.70+fips1","5.15.0-1063.71+fips1","5.15.0-1064.72+fips1","5.15.0-1065.73+fips1","5.15.0-1066.74+fips1","5.15.0-1067.75+fips1","5.15.0-1068.76+fips1","5.15.0-1069.77+fips1","5.15.0-1070.78+fips1","5.15.0-1071.79+fips1","5.15.0-1072.80+fips1","5.15.0-1073.81+fips1","5.15.0-1074.83+fips1","5.15.0-1075.84+fips1","5.15.0-1077.86+fips1","5.15.0-1078.87+fips1","5.15.0-1079.88+fips1","5.15.0-1080.89+fips1","5.15.0-1081.90+fips1","5.15.0-1082.91+fips1","5.15.0-1083.92+fips1","5.15.0-1084.93+fips1","5.15.0-1085.94+fips1","5.15.0-1086.95+fips1","5.15.0-1087.96+fips1","5.15.0-1088.97+fips1","5.15.0-1090.99+fips1","5.15.0-1091.100+fips1","5.15.0-1092.101+fips1","5.15.0-1093.102+fips1","5.15.0-1095.104+fips1","5.15.0-1096.105+fips1","5.15.0-1097.106+fips1","5.15.0-1098.107+fips1","5.15.0-1099.108+fips1","5.15.0-1100.109+fips1","5.15.0-1101.110+fips1","5.15.0-1103.112+fips1","5.15.0-1104.113+fips1","5.15.0-1105.114+fips1","5.15.0-1106.115+fips1","5.15.0-1108.117+fips1","5.15.0-1109.118+fips1","5.15.0-1111.121+fips1","5.15.0-1112.122+fips1","5.15.0-1114.124+fips1","5.15.0-1115.125+fips1","5.15.0-1116.126+fips1","5.15.0-1118.128+fips1","5.15.0-1120.130+fips1","5.15.0-1121.131+fips1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-9.9","6.6.0-14.14","6.8.0-11.11","6.8.0-20.20","6.8.0-22.22","6.8.0-28.28","6.8.0-31.31","6.8.0-35.35","6.8.0-36.36","6.8.0-38.38","6.8.0-39.39","6.8.0-40.40","6.8.0-41.41","6.8.0-44.44","6.8.0-45.45","6.8.0-47.47","6.8.0-48.48","6.8.0-49.49","6.8.0-50.51","6.8.0-51.52","6.8.0-52.53","6.8.0-53.55","6.8.0-54.56","6.8.0-55.57","6.8.0-56.58","6.8.0-57.59","6.8.0-58.60","6.8.0-59.61","6.8.0-60.63","6.8.0-62.65","6.8.0-63.66","6.8.0-64.67","6.8.0-71.71","6.8.0-78.78","6.8.0-79.79","6.8.0-83.83","6.8.0-84.84","6.8.0-85.85","6.8.0-86.87","6.8.0-87.88","6.8.0-88.89","6.8.0-90.91","6.8.0-94.96","6.8.0-100.100","6.8.0-101.101","6.8.0-106.106","6.8.0-107.107","6.8.0-110.110","6.8.0-111.111","6.8.0-117.117","6.8.0-124.124","6.8.0-134.134","6.8.0-136.136","6.8.0-137.137","6.8.0-138.138","6.8.0-139.139","6.8.0-142.142","6.8.0-146.146","6.8.0-147.147","6.8.0-149.149"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1008.8","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1006.6","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1016.17","6.8.0-1017.18","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1023.25","6.8.0-1024.26","6.8.0-1025.27","6.8.0-1026.28","6.8.0-1027.29","6.8.0-1028.30","6.8.0-1029.31","6.8.0-1030.32","6.8.0-1031.33","6.8.0-1032.34","6.8.0-1033.35","6.8.0-1035.37","6.8.0-1036.38","6.8.0-1038.40","6.8.0-1039.41","6.8.0-1040.42","6.8.0-1041.43","6.8.0-1042.44","6.8.0-1043.45","6.8.0-1044.46","6.8.0-1045.47","6.8.0-1046.49","6.8.0-1047.50","6.8.0-1050.53","6.8.0-1051.54","6.8.0-1052.55","6.8.0-1053.56","6.8.0-1055.58","6.8.0-1057.60","6.8.0-1060.63","6.8.0-1061.64","6.8.0-1062.65","6.8.0-1063.66","6.8.0-1064.67","6.8.0-1065.68","6.8.0-1066.69","6.8.0-1067.70","6.8.0-1069.74"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1009.9~24.04.1","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1016.16~24.04.1","6.14.0-1017.17~24.04.1","6.14.0-1018.18~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1005.5~24.04.2","6.17.0-1007.7~24.04.1","6.17.0-1009.9~24.04.2","6.17.0-1010.10~24.04.1","6.17.0-1012.12~24.04.1","6.17.0-1013.13~24.04.1","6.17.0-1015.15~24.04.1","6.17.0-1017.17~24.04.1","6.17.0-1019.19~24.04.1","6.17.0-1020.20~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.7","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1012.14","6.8.0-1013.15","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.20","6.8.0-1018.21","6.8.0-1020.23","6.8.0-1021.25","6.8.0-1025.30","6.8.0-1026.31","6.8.0-1027.32","6.8.0-1028.33","6.8.0-1029.34","6.8.0-1030.35","6.8.0-1031.36","6.8.0-1034.39","6.8.0-1038.44","6.8.0-1040.46","6.8.0-1041.47","6.8.0-1042.48","6.8.0-1044.50","6.8.0-1046.52","6.8.0-1051.57","6.8.0-1052.58","6.8.0-1054.60","6.8.0-1056.62","6.8.0-1058.64","6.8.0-1059.65","6.8.0-1062.69","6.8.0-1063.71","6.8.0-1064.72","6.8.0-1065.73","6.8.0-1067.75","6.8.0-1068.76","6.8.0-1070.78","6.8.0-1071.79","6.8.0-1073.82"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1008.8~24.04.1","6.11.0-1012.12~24.04.1","6.11.0-1013.13~24.04.1","6.11.0-1014.14~24.04.1","6.11.0-1015.15~24.04.1","6.11.0-1017.17~24.04.1","6.11.0-1018.18~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1010.10~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1008.8~24.04.1","6.17.0-1010.10~24.04.1","6.17.0-1011.11~24.04.2","6.17.0-1013.13~24.04.1","6.17.0-1015.15~24.04.1","6.17.0-1017.17~24.04.1","6.17.0-1018.18~24.04.1","6.17.0-1020.20~24.04.1","6.17.0-1021.21~24.04.1","6.17.0-1022.22"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1041.48","6.8.0-1044.51","6.8.0-1046.53","6.8.0-1053.60","6.8.0-1058.65","6.8.0-1061.68","6.8.0-1062.69","6.8.0-1063.70","6.8.0-1064.71","6.8.0-1065.72","6.8.0-1066.73","6.8.0-1068.75","6.8.0-1069.76","6.8.0-1071.78"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-fde-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-fde-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1005.5~24.04.1","6.17.0-1010.10~24.04.1","6.17.0-1015.15~24.04.1","6.17.0-1017.17~24.04.1","6.17.0-1018.18~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-nvidia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1013.14","6.8.0-1014.15","6.8.0-1016.17","6.8.0-1018.19","6.8.0-1019.20","6.8.0-1022.23","6.8.0-1025.27","6.8.0-1027.30","6.8.0-1029.32","6.8.0-1039.42"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-nvidia-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1003.3","6.14.0-1006.6","6.14.0-1007.7"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.7","6.6.0-1001.1","6.8.0-1002.2","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.9","6.8.0-1009.10","6.8.0-1010.11","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1024.26","6.8.0-1025.27","6.8.0-1026.28","6.8.0-1027.29","6.8.0-1028.30","6.8.0-1029.31","6.8.0-1030.32","6.8.0-1031.33","6.8.0-1032.34","6.8.0-1033.35","6.8.0-1034.36","6.8.0-1036.38","6.8.0-1037.39","6.8.0-1039.41","6.8.0-1040.42","6.8.0-1041.43","6.8.0-1042.45","6.8.0-1043.46","6.8.0-1044.47","6.8.0-1045.48","6.8.0-1046.49","6.8.0-1047.50","6.8.0-1048.51","6.8.0-1052.55","6.8.0-1053.56","6.8.0-1054.57","6.8.0-1055.58","6.8.0-1058.61","6.8.0-1060.63","6.8.0-1063.69","6.8.0-1064.72","6.8.0-1065.73","6.8.0-1066.74","6.8.0-1067.75","6.8.0-1069.77","6.8.0-1070.78","6.8.0-1071.79","6.8.0-1073.81"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1006.6~24.04.2","6.11.0-1011.11~24.04.1","6.11.0-1013.13~24.04.1","6.11.0-1014.14~24.04.1","6.11.0-1015.15~24.04.1","6.11.0-1016.16~24.04.1","6.11.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1014.15~24.04.1","6.14.0-1015.16~24.04.1","6.14.0-1016.17~24.04.1","6.14.0-1017.18~24.04.1","6.14.0-1018.19~24.04.1","6.14.0-1019.20~24.04.1","6.14.0-1020.21~24.04.1","6.14.0-1021.22~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1004.4~24.04.3","6.17.0-1008.8~24.04.1","6.17.0-1009.9~24.04.3","6.17.0-1010.10~24.04.1","6.17.0-1012.12~24.04.1","6.17.0-1013.13~24.04.1","6.17.0-1016.17~24.04.1","6.17.0-1018.19~24.04.1","6.17.0-1020.22~24.04.1","6.17.0-1021.24~24.04.1","6.17.0-1022.25"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1003.5","6.8.0-1004.7","6.8.0-1005.8","6.8.0-1006.9","6.8.0-1007.10","6.8.0-1008.11","6.8.0-1009.12","6.8.0-1010.13","6.8.0-1011.14","6.8.0-1012.15","6.8.0-1013.17","6.8.0-1014.18","6.8.0-1015.19","6.8.0-1016.20","6.8.0-1017.21","6.8.0-1019.23","6.8.0-1020.24","6.8.0-1021.25","6.8.0-1022.26","6.8.0-1023.27","6.8.0-1024.28","6.8.0-1025.29","6.8.0-1026.30","6.8.0-1027.31","6.8.0-1028.32","6.8.0-1029.33","6.8.0-1032.36","6.8.0-1033.37","6.8.0-1035.39","6.8.0-1036.40","6.8.0-1037.41","6.8.0-1038.43","6.8.0-1039.44","6.8.0-1040.45","6.8.0-1041.46","6.8.0-1042.47","6.8.0-1043.48","6.8.0-1044.49","6.8.0-1048.53","6.8.0-1049.54","6.8.0-1050.56","6.8.0-1051.57","6.8.0-1054.60","6.8.0-1055.61","6.8.0-1058.64","6.8.0-1059.67","6.8.0-1060.68","6.8.0-1061.69","6.8.0-1062.70","6.8.0-1064.72","6.8.0-1065.73","6.8.0-1066.74","6.8.0-1068.77"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1001.3","6.8.0-1002.4","6.8.0-1003.5","6.8.0-1004.6","6.8.0-1006.8","6.8.0-1007.9","6.8.0-1008.10","6.8.0-1009.11","6.8.0-1010.12","6.8.0-1011.13","6.8.0-1012.14","6.8.0-1013.15","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1022.24","6.8.0-1023.25","6.8.0-1024.26","6.8.0-1025.28","6.8.0-1026.29","6.8.0-1027.30","6.8.0-1028.31","6.8.0-1029.32","6.8.0-1030.33","6.8.0-1031.34","6.8.0-1035.38","6.8.0-1036.39","6.8.0-1037.40","6.8.0-1038.41","6.8.0-1041.44","6.8.0-1042.45","6.8.0-1045.48","6.8.0-1046.50","6.8.0-1047.51","6.8.0-1048.52","6.8.0-1049.53","6.8.0-1050.54","6.8.0-1051.55","6.8.0-1052.56","6.8.0-1053.57"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-hwe-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-17.17~24.04.2","6.11.0-19.19~24.04.1","6.11.0-21.21~24.04.1","6.11.0-24.24~24.04.1","6.11.0-25.25~24.04.1","6.11.0-26.26~24.04.1","6.11.0-28.28~24.04.1","6.11.0-29.29~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-hwe-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-24.24~24.04.3","6.14.0-27.27~24.04.1","6.14.0-28.28~24.04.1","6.14.0-29.29~24.04.1","6.14.0-32.32~24.04.1","6.14.0-33.33~24.04.1","6.14.0-34.34~24.04.1","6.14.0-35.35~24.04.1","6.14.0-36.36~24.04.1","6.14.0-37.37~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-hwe-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-14.14~24.04.1","6.17.0-19.19~24.04.2","6.17.0-20.20~24.04.1","6.17.0-22.22~24.04.1","6.17.0-23.23~24.04.1","6.17.0-29.29~24.04.1","6.17.0-35.35~24.04.1","6.17.0-40.40~24.04.1","6.17.0-41.41~24.04.1","6.17.0-42.42"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1009.9","6.8.0-1001.1","6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1015.15","6.8.0-1016.16","6.8.0-1017.17","6.8.0-1018.18","6.8.0-1019.19","6.8.0-1022.22","6.8.0-1023.23","6.8.0-1024.24","6.8.0-1025.25","6.8.0-1026.26","6.8.0-1027.27","6.8.0-1028.28","6.8.0-1029.29","6.8.0-1030.30","6.8.0-1033.33","6.8.0-1036.36","6.8.0-1037.37","6.8.0-1038.38","6.8.0-1039.39","6.8.0-1040.40","6.8.0-1041.41","6.8.0-1042.42","6.8.0-1043.43","6.8.0-1044.44","6.8.0-1045.45","6.8.0-1049.49","6.8.0-1050.50","6.8.0-1051.51","6.8.0-1052.52","6.8.0-1055.56","6.8.0-1057.58","6.8.0-1060.61","6.8.0-1061.62","6.8.0-1062.63","6.8.0-1063.64","6.8.0-1064.65","6.8.0-1065.66","6.8.0-1066.67","6.8.0-1067.68","6.8.0-1069.70"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-9.9.1","6.6.0-14.14.1","6.8.0-7.7.1","6.8.0-25.25.3","6.8.0-28.28.1","6.8.0-31.31.1","6.8.0-35.35.1","6.8.0-36.36.1","6.8.0-38.38.1","6.8.0-39.39.1","6.8.0-40.40.1","6.8.0-41.41.1","6.8.0-44.44.1","6.8.0-45.45.1","6.8.0-47.47.1","6.8.0-48.48.3","6.8.0-49.49.1","6.8.0-50.51.1","6.8.0-51.52.1","6.8.0-52.53.1","6.8.0-53.55.2","6.8.0-54.56.1","6.8.0-55.57.1","6.8.0-56.58.1","6.8.0-57.59.1","6.8.0-58.60.1","6.8.0-59.61.1","6.8.0-60.63.1","6.8.0-62.65.1","6.8.0-63.66.1","6.8.0-64.67.1","6.8.0-65.68.1","6.8.0-78.78.1","6.8.0-79.79.1","6.8.0-83.83.1","6.8.0-84.84.1","6.8.0-85.85.1","6.8.0-86.87.1","6.8.0-87.88.1","6.8.0-88.89.1","6.8.0-90.91.1","6.8.0-94.96.1","6.8.0-100.100.1","6.8.0-101.101.1","6.8.0-106.106.1","6.8.0-107.107.1","6.8.0-110.110.1","6.8.0-111.111.1","6.8.0-117.117.1","6.8.0-134.134.1","6.8.0-136.136.2","6.8.0-137.137.1","6.8.0-138.138.1","6.8.0-139.139.1","6.8.0-142.142.1","6.8.0-146.146.1","6.8.0-147.147.1","6.8.0-149.149.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency-hwe-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1009.10~24.04.1","6.11.0-1011.12~24.04.1","6.11.0-1012.13~24.04.1","6.11.0-1013.14~24.04.1","6.11.0-1014.15~24.04.1","6.11.0-1015.16~24.04.2","6.11.0-1016.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.21","6.8.0-1020.22","6.8.0-1021.23","6.8.0-1022.25","6.8.0-1023.26","6.8.0-1024.27","6.8.0-1025.28","6.8.0-1026.29","6.8.0-1027.30","6.8.0-1028.31","6.8.0-1029.32","6.8.0-1030.33","6.8.0-1031.34","6.8.0-1032.35","6.8.0-1035.38","6.8.0-1036.39","6.8.0-1038.41","6.8.0-1039.42","6.8.0-1040.43","6.8.0-1041.44","6.8.0-1042.45","6.8.0-1043.46","6.8.0-1044.47","6.8.0-1045.48","6.8.0-1046.49","6.8.0-1047.50","6.8.0-1049.52","6.8.0-1050.53","6.8.0-1051.54","6.8.0-1052.55","6.8.0-1054.57","6.8.0-1055.58","6.8.0-1058.61","6.8.0-1059.62","6.8.0-1060.63","6.8.0-1061.64","6.8.0-1062.65","6.8.0-1063.66","6.8.0-1064.67","6.8.0-1067.70"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1002.2","6.11.0-1003.3","6.11.0-1007.7","6.11.0-1010.10","6.11.0-1011.11","6.11.0-1012.12","6.11.0-1013.13","6.11.0-1016.16"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1004.4","6.17.0-1008.8","6.17.0-1014.14","6.17.0-1018.18","6.17.0-1021.21","6.17.0-1026.26","6.17.0-1029.29","6.17.0-1031.31","6.17.0-1032.32"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-lowlatency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1009.9.1","6.8.0-1011.11.1","6.8.0-1012.12.1","6.8.0-1013.14.1","6.8.0-1014.15.1","6.8.0-1015.16.1","6.8.0-1017.19.1","6.8.0-1018.20.1","6.8.0-1019.21.1","6.8.0-1020.22.1","6.8.0-1021.23.1","6.8.0-1022.25.2","6.8.0-1023.26.1","6.8.0-1024.27.1","6.8.0-1025.28.1","6.8.0-1026.29.1","6.8.0-1027.30.1","6.8.0-1028.31.1","6.8.0-1029.32.1","6.8.0-1030.33.1","6.8.0-1031.34.1","6.8.0-1032.35.1","6.8.0-1035.38.1","6.8.0-1036.39.1","6.8.0-1038.41.1","6.8.0-1039.42.1","6.8.0-1040.43.1","6.8.0-1041.44.1","6.8.0-1042.45.1","6.8.0-1043.46.1","6.8.0-1044.47.1","6.8.0-1045.48.1","6.8.0-1046.49.1","6.8.0-1047.50.1","6.8.0-1049.52.1","6.8.0-1050.53.1","6.8.0-1051.54.1","6.8.0-1052.55.1","6.8.0-1054.57.1","6.8.0-1055.58.1","6.8.0-1058.61.1","6.8.0-1059.62.1","6.8.0-1060.63.1","6.8.0-1061.64.1","6.8.0-1062.65.1","6.8.0-1063.66.1","6.8.0-1064.67.1","6.8.0-1067.70.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-tegra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1003.3","6.8.0-1004.4","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1016.16","6.8.0-1019.19","6.8.0-1020.20","6.8.0-1021.21","6.8.0-1022.22","6.8.0-1023.23","6.8.0-1024.24","6.8.0-1025.25","6.8.0-1026.26","6.8.0-1029.30","6.8.0-1030.31","6.8.0-1031.32","6.8.0-1032.34","6.8.0-1035.38","6.8.0-1036.39","6.8.0-1038.42"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1007.7","6.11.0-1008.8","6.11.0-1009.9","6.11.0-1010.10","6.11.0-1011.11","6.11.0-1012.12","6.11.0-1013.13","6.11.0-1015.15","6.11.0-1016.16","6.11.0-1017.17","6.11.0-1018.18","6.11.0-1020.20","6.11.0-1021.21","6.11.0-1022.22","6.11.0-1023.23","6.11.0-1024.24","6.11.0-1025.25","6.11.0-1027.27"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1004.4","6.14.0-1005.5","6.14.0-1006.6","6.14.0-1007.7","6.14.0-1008.8","6.14.0-1010.10","6.14.0-1011.11","6.14.0-1012.12","6.14.0-1013.13","6.14.0-1014.14","6.14.0-1015.15","6.14.0-1016.16","6.14.0-1017.17","6.14.0-1018.18","6.14.0-1019.19","6.14.0-1020.20"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1005.5","6.17.0-1006.6","6.17.0-1007.7","6.17.0-1008.8","6.17.0-1009.9","6.17.0-1010.10","6.17.0-1011.11","6.17.0-1012.12","6.17.0-1017.17","6.17.0-1020.20","6.17.0-1023.23","6.17.0-1024.24","6.17.0-1025.25","6.17.0-1028.28","6.17.0-1030.30","6.17.0-1032.32","6.17.0-1033.33"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1016.16","6.8.0-1017.17","6.8.0-1018.18","6.8.0-1019.19","6.8.0-1020.20","6.8.0-1024.24","6.8.0-1025.25","6.8.0-1026.26","6.8.0-1027.27","6.8.0-1028.28","6.8.0-1029.29","6.8.0-1030.30","6.8.0-1031.31","6.8.0-1032.32"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1010.10","6.6.0-1001.1","6.8.0-1001.1","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1008.8","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1015.16","6.8.0-1016.17","6.8.0-1017.18","6.8.0-1018.19","6.8.0-1019.20","6.8.0-1020.21","6.8.0-1021.22","6.8.0-1022.23","6.8.0-1023.24","6.8.0-1024.25","6.8.0-1025.26","6.8.0-1026.27","6.8.0-1027.28","6.8.0-1028.29","6.8.0-1029.30","6.8.0-1030.31","6.8.0-1032.33","6.8.0-1033.34","6.8.0-1035.36","6.8.0-1037.38","6.8.0-1038.39","6.8.0-1039.40","6.8.0-1040.41","6.8.0-1041.42","6.8.0-1042.43","6.8.0-1043.44","6.8.0-1044.45","6.8.0-1047.48","6.8.0-1049.50","6.8.0-1050.51","6.8.0-1052.53","6.8.0-1054.55","6.8.0-1057.58","6.8.0-1058.61","6.8.0-1059.62","6.8.0-1060.63","6.8.0-1061.64","6.8.0-1062.65","6.8.0-1063.66","6.8.0-1064.67","6.8.0-1067.71"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1009.9~24.04.1","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1016.16~24.04.1","6.14.0-1017.17~24.04.1","6.14.0-1018.18~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1004.4~24.04.2","6.17.0-1007.7~24.04.1","6.17.0-1009.9~24.04.1","6.17.0-1010.10~24.04.1","6.17.0-1011.11~24.04.1","6.17.0-1014.14~24.04.1","6.17.0-1016.16~24.04.1","6.17.0-1018.18~24.04.1","6.17.0-1019.19~24.04.3","6.17.0-1020.20"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1005.7","6.7.0-1001.1","6.8.0-1001.1","6.8.0-1002.2","6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.10","6.8.0-1010.11","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.16","6.8.0-1015.17","6.8.0-1016.18","6.8.0-1017.19","6.8.0-1018.20","6.8.0-1019.23","6.8.0-1020.24","6.8.0-1024.28","6.8.0-1028.32","6.8.0-1029.33","6.8.0-1030.34","6.8.0-1031.35","6.8.0-1032.36","6.8.0-1035.39","6.8.0-1036.40","6.8.0-1038.42","6.8.0-1039.43","6.8.0-1040.44","6.8.0-1041.45","6.8.0-1042.46","6.8.0-1043.47","6.8.0-1044.48","6.8.0-1045.49","6.8.0-1047.51","6.8.0-1048.52","6.8.0-1050.54","6.8.0-1051.55","6.8.0-1052.56","6.8.0-1053.57","6.8.0-1056.60","6.8.0-1057.61","6.8.0-1060.64","6.8.0-1061.65","6.8.0-1062.66","6.8.0-1063.67","6.8.0-1064.68","6.8.0-1065.69","6.8.0-1068.72"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-2019.20"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.1-1015.16"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-9.9.1","6.8.0-20.20.1","6.8.0-28.28.1","6.8.0-31.31.1","6.8.0-35.35.1","6.8.0-36.36.1","6.8.0-38.38.1","6.8.0-39.39.1","6.8.0-40.40.1","6.8.0-41.41.1","6.8.0-44.44.1","6.8.0-47.47.1","6.8.0-48.48.1","6.8.0-49.49.1","6.8.0-50.51.1","6.8.0-51.52.1","6.8.0-52.53.1","6.8.0-53.55.1","6.8.0-55.57.1","6.8.0-56.58.1","6.8.0-57.59.1","6.8.0-58.60.1","6.8.0-59.61.1","6.8.0-60.63.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-22.22.1~24.04.1","6.14.0-23.23.1~24.04.1","6.14.0-24.24.1~24.04.1","6.14.0-27.27.1~24.04.1","6.14.0-28.28.1~24.04.1","6.14.0-29.29.1~24.04.1","6.14.0-32.32.1~24.04.1","6.14.0-33.33.1~24.04.1","6.14.0-34.34.1~24.04.1","6.14.0-35.35.1~24.04.1","6.14.0-36.36.1~24.04.1","6.14.0-37.37.1~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-14.14.1~24.04.1","6.17.0-19.19.1~24.04.1","6.17.0-20.20.1~24.04.1","6.17.0-22.22.1~24.04.1","6.17.0-23.23.1~24.04.1","6.17.0-29.29.1~24.04.1","6.17.0-35.35.1~24.04.1","6.17.0-38.38.1~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1005.5","6.8.0-1008.8","6.8.0-1010.10"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-xilinx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1008.9","6.8.0-1009.10","6.8.0-1011.12","6.8.0-1012.13","6.8.0-1013.14","6.8.0-1014.15","6.8.0-1015.16","6.8.0-1017.18","6.8.0-1018.19","6.8.0-1019.20","6.8.0-1020.21","6.8.0-1021.22","6.8.0-1022.23","6.8.0-1023.24","6.8.0-1024.25","6.8.0-1028.29","6.8.0-1029.30","6.8.0-1032.33","6.8.0-1033.34","6.8.0-1034.35","6.8.0-1035.36","6.8.0-1036.37"]},{"source":"osv","ecosystem":"Ubuntu:Nvidia-BlueField:24.04:LTS","package":"linux-bluefield","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1011.15","6.8.0-1012.16","6.8.0-1013.17","6.8.0-1014.18","6.8.0-1016.20","6.8.0-1017.21","6.8.0-1022.26","6.8.0-1023.27","6.8.0-1026.30","6.8.0-1028.33","6.8.0-1029.34","6.8.0-1030.35","6.8.0-1031.36","6.8.0-1032.37","6.8.0-1033.38","6.8.0-1036.41"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-raspi-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.7.0-2001.1","6.8.0-2001.1","6.8.0-2002.2","6.8.0-2004.4","6.8.0-2005.5","6.8.0-2006.6","6.8.0-2007.7","6.8.0-2008.8","6.8.0-2009.9","6.8.0-2010.10","6.8.0-2011.11","6.8.0-2012.12","6.8.0-2013.14","6.8.0-2014.15","6.8.0-2015.16","6.8.0-2016.17","6.8.0-2017.18","6.8.0-2018.19","6.8.0-2019.20","6.8.0-2022.23","6.8.0-2023.24","6.8.0-2024.25","6.8.0-2025.26","6.8.0-2026.27","6.8.0-2028.29","6.8.0-2029.30","6.8.0-2030.31","6.8.0-2031.32","6.8.0-2032.33","6.8.0-2033.34","6.8.0-2034.35","6.8.0-2035.36","6.8.0-2036.37","6.8.0-2037.38","6.8.0-2038.39","6.8.0-2040.41","6.8.0-2041.42","6.8.0-2042.43","6.8.0-2043.44","6.8.0-2045.46","6.8.0-2046.47","6.8.0-2049.50","6.8.0-2050.52","6.8.0-2051.53","6.8.0-2052.54","6.8.0-2053.55","6.8.0-2054.56","6.8.0-2056.58"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1008.19","6.8.1-1001.1","6.8.1-1002.2","6.8.1-1003.3","6.8.1-1004.4","6.8.1-1005.5","6.8.1-1006.6","6.8.1-1007.7","6.8.1-1008.8","6.8.1-1009.9","6.8.1-1010.10","6.8.1-1011.11","6.8.1-1012.12","6.8.1-1013.14","6.8.1-1014.15","6.8.1-1015.16","6.8.1-1016.17","6.8.1-1017.18","6.8.1-1018.19","6.8.1-1019.20","6.8.1-1020.21","6.8.1-1021.22","6.8.1-1022.23","6.8.1-1023.24","6.8.1-1024.25","6.8.1-1025.26","6.8.1-1026.27","6.8.1-1030.31","6.8.1-1031.32","6.8.1-1033.34","6.8.1-1034.35","6.8.1-1035.36","6.8.1-1036.37","6.8.1-1037.38","6.8.1-1038.39","6.8.1-1039.40","6.8.1-1040.41","6.8.1-1041.42","6.8.1-1042.43","6.8.1-1045.46","6.8.1-1046.47","6.8.1-1047.48","6.8.1-1048.49","6.8.1-1051.52","6.8.1-1052.53","6.8.1-1055.56","6.8.1-1056.57","6.8.1-1057.58","6.8.1-1058.59","6.8.1-1059.60","6.8.1-1060.61","6.8.1-1061.62","6.8.1-1062.63","6.8.1-1064.65"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1003.3~24.04.3","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1016.16~24.04.1","6.14.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1004.5~24.04.2","6.17.0-1006.7~24.04.1","6.17.0-1008.9~24.04.1","6.17.0-1009.10~24.04.1","6.17.0-1010.11~24.04.1","6.17.0-1011.12~24.04.1","6.17.0-1013.15~24.04.1","6.17.0-1014.16~24.04.1","6.17.0-1017.19~24.04.1","6.17.0-1018.20~24.04.1","6.17.0-1019.22"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-aws-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1035.37+fips1","6.8.0-1036.38+fips1","6.8.0-1038.40+fips1","6.8.0-1039.41+fips1","6.8.0-1040.42+fips1","6.8.0-1041.43+fips1","6.8.0-1042.44+fips1","6.8.0-1043.45+fips1","6.8.0-1044.46+fips1","6.8.0-1045.47+fips1","6.8.0-1046.49+fips1","6.8.0-1047.50+fips1","6.8.0-1050.53+fips1","6.8.0-1051.54+fips1","6.8.0-1052.55+fips1","6.8.0-1053.56+fips1","6.8.0-1055.58+fips1","6.8.0-1057.60+fips1","6.8.0-1060.63+fips1","6.8.0-1061.64+fips1","6.8.0-1062.65+fips1","6.8.0-1063.66+fips1","6.8.0-1064.67+fips1","6.8.0-1065.68+fips1","6.8.0-1066.69+fips1","6.8.0-1067.70+fips1","6.8.0-1069.74+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-azure-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1034.39+fips1","6.8.0-1040.46+fips1","6.8.0-1044.50+fips1","6.8.0-1046.52+fips1","6.8.0-1047.53+fips1","6.8.0-1052.58+fips1","6.8.0-1053.59+fips1","6.8.0-1054.60+fips1","6.8.0-1059.65+fips1","6.8.0-1062.69+fips1","6.8.0-1063.71+fips2","6.8.0-1064.72+fips1","6.8.0-1065.73+fips1","6.8.0-1067.75+fips1","6.8.0-1068.76+fips1","6.8.0-1069.77+fips1","6.8.0-1071.79+fips1","6.8.0-1073.82+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-38.38+fips4","6.8.0-78.78+fips1","6.8.0-79.79+fips1","6.8.0-83.83+fips1","6.8.0-84.84+fips1","6.8.0-85.85+fips1","6.8.0-86.87+fips1","6.8.0-87.88+fips1","6.8.0-88.89+fips1","6.8.0-90.91+fips1","6.8.0-94.96+fips1","6.8.0-100.100+fips1","6.8.0-101.101+fips1","6.8.0-106.106+fips1","6.8.0-107.107+fips1","6.8.0-110.110+fips2","6.8.0-111.111+fips1","6.8.0-116.116+fips1","6.8.0-124.124+fips1","6.8.0-134.134+fips1","6.8.0-136.136+fips2","6.8.0-137.137+fips1","6.8.0-138.138+fips1","6.8.0-139.139+fips1","6.8.0-142.142+fips1","6.8.0-146.146+fips1","6.8.0-147.147+fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"linux-gcp-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1036.38+fips1","6.8.0-1037.39+fips1","6.8.0-1039.41+fips1","6.8.0-1040.42+fips1","6.8.0-1041.43+fips1","6.8.0-1042.45+fips1","6.8.0-1043.46+fips1","6.8.0-1044.47+fips1","6.8.0-1045.48+fips1","6.8.0-1046.49+fips1","6.8.0-1047.50+fips1","6.8.0-1048.51+fips1","6.8.0-1052.55+fips1","6.8.0-1053.56+fips1","6.8.0-1054.57+fips1","6.8.0-1055.58+fips1","6.8.0-1058.61+fips1","6.8.0-1060.63+fips1","6.8.0-1063.69+fips1","6.8.0-1064.72+fips1","6.8.0-1065.73+fips1","6.8.0-1066.74+fips1","6.8.0-1067.75+fips1","6.8.0-1068.76+fips1","6.8.0-1070.78+fips1","6.8.0-1071.79+fips1","6.8.0-1073.81+fips1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-15.15","6.15.0-3.3","6.15.0-4.4","6.16.0-13.13","6.16.0-16.16","6.17.0-3.3","6.17.0-4.4","6.17.0-5.5","6.17.0-6.6","6.17.0-7.7","6.17.0-8.8","6.17.0-12.12","6.17.0-14.14","6.17.0-19.19","6.17.0-20.20","6.17.0-22.22","6.17.0-23.23","6.17.0-29.29","6.17.0-35.35","6.17.0-40.40"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1005.5","6.14.0-1007.7+25.10.2","6.16.0-1001.1","6.17.0-1001.1","6.17.0-1002.2","6.17.0-1003.3","6.17.0-1004.4","6.17.0-1005.5","6.17.0-1006.6","6.17.0-1007.7","6.17.0-1009.9","6.17.0-1010.10","6.17.0-1012.12","6.17.0-1013.13","6.17.0-1015.15","6.17.0-1017.17","6.17.0-1019.19"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1004.4","6.14.0-1007.7+25.10.1","6.16.0-1001.1","6.17.0-1002.2","6.17.0-1003.3","6.17.0-1004.4","6.17.0-1006.6","6.17.0-1007.7","6.17.0-1008.8","6.17.0-1010.10","6.17.0-1011.11","6.17.0-1013.13","6.17.0-1015.15","6.17.0-1017.17","6.17.0-1018.18","6.17.0-1020.20"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1003.3","6.17.0-1004.4","6.17.0-1005.5","6.17.0-1007.7","6.17.0-1008.8","6.17.0-1010.10","6.17.0-1012.12","6.17.0-1014.14","6.17.0-1015.15","6.17.0-1017.17"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1006.6","6.14.0-1009.9+25.10.1","6.16.0-1001.1","6.17.0-1001.1","6.17.0-1002.2","6.17.0-1003.3","6.17.0-1004.4","6.17.0-1005.5","6.17.0-1006.6","6.17.0-1007.7","6.17.0-1009.9","6.17.0-1010.10","6.17.0-1012.12","6.17.0-1013.13","6.17.0-1016.17","6.17.0-1018.19","6.17.0-1020.22"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1005.5","6.14.0-1007.7+25.10.1","6.16.0-1001.1","6.17.0-1001.1","6.17.0-1002.2","6.17.0-1003.3","6.17.0-1005.5","6.17.0-1006.6","6.17.0-1007.7","6.17.0-1009.9","6.17.0-1010.10","6.17.0-1011.11","6.17.0-1012.12","6.17.0-1014.14","6.17.0-1016.16","6.17.0-1018.18"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-raspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1005.5","6.17.0-1003.3","6.17.0-1004.4","6.17.0-1005.5","6.17.0-1006.6","6.17.0-1007.7","6.17.0-1008.8","6.17.0-1010.10","6.17.0-1011.11","6.17.0-1013.13","6.17.0-1014.14","6.17.0-1017.17","6.17.0-1018.18","6.17.0-1021.21"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1002.2","6.17.0-1001.2","6.17.0-1002.3","6.17.0-1003.4","6.17.0-1004.5","6.17.0-1005.6","6.17.0-1006.7","6.17.0-1008.9","6.17.0-1009.10","6.17.0-1010.11","6.17.0-1011.12","6.17.0-1013.15","6.17.0-1014.16","6.17.0-1017.19"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-13.13.2","6.17.0-4.4.1","6.17.0-5.5.1","6.17.0-6.6.1","6.17.0-7.7.1","6.17.0-8.8.1","6.17.0-12.12.1","6.17.0-14.14.1","6.17.0-19.19.1","6.17.0-20.20.1","6.17.0-22.22.1","6.17.0-23.23.1","6.17.0-29.29.1","6.17.0-35.35.1","6.17.0-40.40.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"linux-nvidia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.0-1006.6"}]}],"versions":["7.0.0-1005.5"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"linux-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.0-1006.6"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"dtb-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.38.1"}]}],"bundled":885},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.38.1"}]}],"bundled":885},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.38.1"}]}],"bundled":885},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.38.1"}]}],"bundled":885},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.38.1.160000.2.22"}]}],"bundled":885},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.38.1"}]}],"bundled":885},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.38.1"}]}],"bundled":885},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.38.1"}]}],"bundled":885},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.38.1"}]}],"bundled":885},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.38.1"}]}],"bundled":885},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.38.1"}]}],"bundled":885},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.38.1"}]}],"bundled":885},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.38.1"}]}],"bundled":885}],"products":[{"vendor":"linux","product":"linux"},{"vendor":"linux","product":"linux_kernel"}],"references":[{"url":"https://git.kernel.org/stable/c/5f479aac1262959e54cdd978d873be5f202e2a40","tags":["web"]},{"url":"https://git.kernel.org/stable/c/18a4543c1750f96be63e349936d2dfdcb360b2dc","tags":["web"]},{"url":"https://git.kernel.org/stable/c/615517f3f8d53b0cf41507c7599971e17adfdfa5","tags":["Patch","web"]},{"url":"https://git.kernel.org/stable/c/40bd39e383a0478fd5c221f393df05fd9d70cfbc","tags":["Patch","web"]},{"url":"https://git.kernel.org/stable/c/635038fe19db391117e66b46bdc2b6e447ac801d","tags":["Patch","web"]},{"url":"https://git.kernel.org/stable/c/14cf0cd35361f4e94824bf8a42f72713d7702a73","tags":["Patch","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31531","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-8q42-qfhf-592h"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-31531","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1782155469.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3633","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48946","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48972","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-49779","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-49989","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-50365","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-50521","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52742","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52808","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53007","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53548","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35803","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36286","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41088","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42232","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42290","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43835","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47809","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50012","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50060","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53172","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56645","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56739","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56770","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57948","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58096","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58097","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21681","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21731","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21817","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21857","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21870","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22090","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37761","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37808","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37914","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38048","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38053","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38064","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38105","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38154","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38161","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38264","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38385","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38460","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38653","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38665","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38681","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38710","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39721","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39925","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39947","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39964","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40167","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40186","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40194","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40259","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40308","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40331","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54505","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68366","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68724","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68803","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68813","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68814","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68815","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68820","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71077","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71083","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71084","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71087","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71095","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71096","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71097","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71099","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71122","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71132","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71137","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71142","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71182","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71227","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71235","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71236","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71273","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22979","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22989","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22994","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23002","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23003","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23007","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23013","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23017","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23023","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23038","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23058","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23066","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23070","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23103","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23110","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23113","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23126","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23138","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23154","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23169","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23198","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23210","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23357","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23367","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23379","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23381","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23382","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23389","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23392","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23442","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23444","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23455","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31408","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31488","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31497","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31498","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31510","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31512","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31515","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31521","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31540","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31546","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31586","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31602","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31613","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31625","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31628","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31634","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31656","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31664","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31671","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31672","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31685","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31694","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43051","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43158","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43332","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46317","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1783791447.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-4454","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47416","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1462","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48660","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48961","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48971","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48975","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-49269","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-49390","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-49441","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-49443","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-49728","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-49749","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-49764","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-49766","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-49796","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-49797","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-49824","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-49825","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-49873","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-49891","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-50498","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52523","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52582","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52672","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52738","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52786","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52845","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52877","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52898","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52932","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52937","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52977","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52981","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52991","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53002","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53013","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53015","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53018","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53026","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53093","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53109","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53240","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53245","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53291","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53332","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53438","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53475","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53491","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53499","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53517","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53635","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53667","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53685","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53792","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53852","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53857","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53999","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54019","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54057","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54160","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54254","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54271","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54276","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54323","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26631","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26645","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26663","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26671","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26675","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26698","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26719","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26733","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26760","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26837","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26840","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26851","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26861","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26862","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26878","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26906","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26953","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26987","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35904","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35922","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36008","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36478","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36882","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36975","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38598","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38600","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38612","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-40904","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-40924","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-40980","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41009","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41027","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41038","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41063","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41089","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42107","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42114","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42129","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42241","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42244","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42246","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42259","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42286","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43834","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43908","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-44958","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45000","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45009","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45010","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45016","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46715","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46755","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46770","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46787","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47660","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47679","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47693","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47703","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47705","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47720","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47739","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49934","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49935","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49955","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49968","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50000","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50014","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50028","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50041","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50045","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50046","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50058","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50077","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50110","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50160","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50185","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50251","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50256","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50271","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53051","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53055","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53091","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53119","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53125","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53224","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53680","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56544","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56569","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56611","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56657","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56712","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57974","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57981","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57993","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57996","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58005","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58012","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58079","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21638","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21640","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21649","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21682","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21683","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21694","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21732","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21806","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21831","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21838","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21846","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21853","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21861","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21877","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21881","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21888","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21891","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21931","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21959","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21961","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22025","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22057","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22089","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22111","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-23131","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-23143","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-23144","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-23145","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37800","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37807","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37834","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37853","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37867","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37884","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37920","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37938","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37959","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37961","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37967","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37980","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38039","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38040","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38067","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38097","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38148","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38162","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38192","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38193","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38232","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38234","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38426","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38436","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38524","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38591","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38643","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38659","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38676","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38709","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39705","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39754","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39843","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39851","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39927","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39937","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39940","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39961","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40121","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40321","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68211","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68223","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71094","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71127","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71147","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71160","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71161","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71225","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71297","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22997","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23000","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23004","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23069","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23086","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23247","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23255","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23302","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23374","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23401","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23468","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23472","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31480","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31495","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31518","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31551","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31555","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31677","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31692","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31752","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31777","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43038","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43053","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43234","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43266","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43273","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43277","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43329","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43439","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43493","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43499","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31531.json","tags":["advisory"]},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-31531","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2582","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39833","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68334","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68340","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68801","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71068","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71130","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71152","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71194","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23001","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23011","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23025","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23054","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23074","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23100","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23269","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23272","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23312","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23340","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23378","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23406","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23407","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23410","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23411","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23439","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23440","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23441","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23448","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23450","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23452","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23461","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23473","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23475","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31392","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31398","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31399","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31400","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31403","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31421","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31422","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31426","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31429","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31430","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31441","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31442","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31446","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31449","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31450","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31451","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31452","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31467","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31469","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31487","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31496","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31499","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31505","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31511","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31516","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31525","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31528","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31532","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31533","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31542","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31566","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31570","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31590","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31595","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31630","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31651","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31665","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31667","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31675","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31678","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31684","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31689","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31697","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31698","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31699","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31708","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31738","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31755","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31771","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31773","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31779","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31781","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43020","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43036","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43040","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43043","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43061","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43064","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43079","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43099","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43148","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43156","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43163","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43186","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43212","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43240","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43262","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43288","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43292","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43345","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43366","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43406","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43419","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43427","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43428","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43468","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43503","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45834","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45861","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45911","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45943","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45947","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45961","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45982","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45999","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46044","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46051","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46076","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46078","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46082","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46093","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46121","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46138","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46165","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46171","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46178","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46190","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3157","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-10263","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39932","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71109","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71203","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23213","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23214","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23261","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31414","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31432","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31440","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31443","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31453","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31557","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31580","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31588","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31662","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31681","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31717","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31725","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31759","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43022","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43025","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43026","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43028","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43083","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43091","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43101","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43116","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43125","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43127","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43180","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43194","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43197","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43220","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43239","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43309","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43319","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43334","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43350","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43445","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43466","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45859","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45886","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45984","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46006","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46014","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46052","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46174","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46244","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46320","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46321","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46322","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46323","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46330","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623477-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1230238","tags":["report"]},{"url":"https://bugzilla.suse.com/1235944","tags":["report"]},{"url":"https://bugzilla.suse.com/1247455","tags":["report"]},{"url":"https://bugzilla.suse.com/1250748","tags":["report"]},{"url":"https://bugzilla.suse.com/1251966","tags":["report"]},{"url":"https://bugzilla.suse.com/1252682","tags":["report"]},{"url":"https://bugzilla.suse.com/1254306","tags":["report"]},{"url":"https://bugzilla.suse.com/1255225","tags":["report"]},{"url":"https://bugzilla.suse.com/1255250","tags":["report"]},{"url":"https://bugzilla.suse.com/1256629","tags":["report"]},{"url":"https://bugzilla.suse.com/1256708","tags":["report"]},{"url":"https://bugzilla.suse.com/1257154","tags":["report"]},{"url":"https://bugzilla.suse.com/1258430","tags":["report"]},{"url":"https://bugzilla.suse.com/1258517","tags":["report"]},{"url":"https://bugzilla.suse.com/1260522","tags":["report"]},{"url":"https://bugzilla.suse.com/1261780","tags":["report"]},{"url":"https://bugzilla.suse.com/1261788","tags":["report"]},{"url":"https://bugzilla.suse.com/1262073","tags":["report"]},{"url":"https://bugzilla.suse.com/1263004","tags":["report"]},{"url":"https://bugzilla.suse.com/1263061","tags":["report"]},{"url":"https://bugzilla.suse.com/1263133","tags":["report"]},{"url":"https://bugzilla.suse.com/1264335","tags":["report"]},{"url":"https://bugzilla.suse.com/1264446","tags":["report"]},{"url":"https://bugzilla.suse.com/1264541","tags":["report"]},{"url":"https://bugzilla.suse.com/1264584","tags":["report"]},{"url":"https://bugzilla.suse.com/1264587","tags":["report"]},{"url":"https://bugzilla.suse.com/1264619","tags":["report"]},{"url":"https://bugzilla.suse.com/1264788","tags":["report"]},{"url":"https://bugzilla.suse.com/1265068","tags":["report"]},{"url":"https://bugzilla.suse.com/1265121","tags":["report"]},{"url":"https://bugzilla.suse.com/1265449","tags":["report"]},{"url":"https://bugzilla.suse.com/1265928","tags":["report"]},{"url":"https://bugzilla.suse.com/1266402","tags":["report"]},{"url":"https://bugzilla.suse.com/1266860","tags":["report"]},{"url":"https://bugzilla.suse.com/1266874","tags":["report"]},{"url":"https://bugzilla.suse.com/1266897","tags":["report"]},{"url":"https://bugzilla.suse.com/1267023","tags":["report"]},{"url":"https://bugzilla.suse.com/1267238","tags":["report"]},{"url":"https://bugzilla.suse.com/1267501","tags":["report"]},{"url":"https://bugzilla.suse.com/1267612","tags":["report"]},{"url":"https://bugzilla.suse.com/1268276","tags":["report"]},{"url":"https://bugzilla.suse.com/1268972","tags":["report"]},{"url":"https://bugzilla.suse.com/1268979","tags":["report"]},{"url":"https://bugzilla.suse.com/1268987","tags":["report"]},{"url":"https://bugzilla.suse.com/1269004","tags":["report"]},{"url":"https://bugzilla.suse.com/1269013","tags":["report"]},{"url":"https://bugzilla.suse.com/1269108","tags":["report"]},{"url":"https://bugzilla.suse.com/1269113","tags":["report"]},{"url":"https://bugzilla.suse.com/1269114","tags":["report"]},{"url":"https://bugzilla.suse.com/1269126","tags":["report"]},{"url":"https://bugzilla.suse.com/1269167","tags":["report"]},{"url":"https://bugzilla.suse.com/1269234","tags":["report"]},{"url":"https://bugzilla.suse.com/1269238","tags":["report"]},{"url":"https://bugzilla.suse.com/1269242","tags":["report"]},{"url":"https://bugzilla.suse.com/1269256","tags":["report"]},{"url":"https://bugzilla.suse.com/1269301","tags":["report"]},{"url":"https://bugzilla.suse.com/1269306","tags":["report"]},{"url":"https://bugzilla.suse.com/1269381","tags":["report"]},{"url":"https://bugzilla.suse.com/1269388","tags":["report"]},{"url":"https://bugzilla.suse.com/1269412","tags":["report"]},{"url":"https://bugzilla.suse.com/1269530","tags":["report"]},{"url":"https://bugzilla.suse.com/1269579","tags":["report"]},{"url":"https://bugzilla.suse.com/1269590","tags":["report"]},{"url":"https://bugzilla.suse.com/1269635","tags":["report"]},{"url":"https://bugzilla.suse.com/1269655","tags":["report"]},{"url":"https://bugzilla.suse.com/1269665","tags":["report"]},{"url":"https://bugzilla.suse.com/1269686","tags":["report"]},{"url":"https://bugzilla.suse.com/1269695","tags":["report"]},{"url":"https://bugzilla.suse.com/1269713","tags":["report"]},{"url":"https://bugzilla.suse.com/1269731","tags":["report"]},{"url":"https://bugzilla.suse.com/1269774","tags":["report"]},{"url":"https://bugzilla.suse.com/1269783","tags":["report"]},{"url":"https://bugzilla.suse.com/1269792","tags":["report"]},{"url":"https://bugzilla.suse.com/1269815","tags":["report"]},{"url":"https://bugzilla.suse.com/1269965","tags":["report"]},{"url":"https://bugzilla.suse.com/1269969","tags":["report"]},{"url":"https://bugzilla.suse.com/1269981","tags":["report"]},{"url":"https://bugzilla.suse.com/1269985","tags":["report"]},{"url":"https://bugzilla.suse.com/1270090","tags":["report"]},{"url":"https://bugzilla.suse.com/1270108","tags":["report"]},{"url":"https://bugzilla.suse.com/1270111","tags":["report"]},{"url":"https://bugzilla.suse.com/1270251","tags":["report"]},{"url":"https://bugzilla.suse.com/1271256","tags":["report"]},{"url":"https://bugzilla.suse.com/1271365","tags":["report"]},{"url":"https://bugzilla.suse.com/1271366","tags":["report"]},{"url":"https://bugzilla.suse.com/1271825","tags":["report"]},{"url":"https://bugzilla.suse.com/1271830","tags":["report"]},{"url":"https://bugzilla.suse.com/1272150","tags":["report"]},{"url":"https://bugzilla.suse.com/1272175","tags":["report"]},{"url":"https://bugzilla.suse.com/1272179","tags":["report"]},{"url":"https://bugzilla.suse.com/1272182","tags":["report"]},{"url":"https://bugzilla.suse.com/1272200","tags":["report"]},{"url":"https://bugzilla.suse.com/1272210","tags":["report"]},{"url":"https://bugzilla.suse.com/1272213","tags":["report"]},{"url":"https://bugzilla.suse.com/1272230","tags":["report"]},{"url":"https://bugzilla.suse.com/1272260","tags":["report"]},{"url":"https://bugzilla.suse.com/1272261","tags":["report"]},{"url":"https://bugzilla.suse.com/1272262","tags":["report"]},{"url":"https://bugzilla.suse.com/1272297","tags":["report"]},{"url":"https://bugzilla.suse.com/1272346","tags":["report"]},{"url":"https://bugzilla.suse.com/1272381","tags":["report"]},{"url":"https://bugzilla.suse.com/1272385","tags":["report"]},{"url":"https://bugzilla.suse.com/1272390","tags":["report"]},{"url":"https://bugzilla.suse.com/1272423","tags":["report"]},{"url":"https://bugzilla.suse.com/1272429","tags":["report"]},{"url":"https://bugzilla.suse.com/1272484","tags":["report"]},{"url":"https://bugzilla.suse.com/1272486","tags":["report"]},{"url":"https://bugzilla.suse.com/1272497","tags":["report"]},{"url":"https://bugzilla.suse.com/1272516","tags":["report"]},{"url":"https://bugzilla.suse.com/1272569","tags":["report"]},{"url":"https://bugzilla.suse.com/1272571","tags":["report"]},{"url":"https://bugzilla.suse.com/1272641","tags":["report"]},{"url":"https://bugzilla.suse.com/1272643","tags":["report"]},{"url":"https://bugzilla.suse.com/1272662","tags":["report"]},{"url":"https://bugzilla.suse.com/1272673","tags":["report"]},{"url":"https://bugzilla.suse.com/1272680","tags":["report"]},{"url":"https://bugzilla.suse.com/1272682","tags":["report"]},{"url":"https://bugzilla.suse.com/1272756","tags":["report"]},{"url":"https://bugzilla.suse.com/1272786","tags":["report"]},{"url":"https://bugzilla.suse.com/1272788","tags":["report"]},{"url":"https://bugzilla.suse.com/1272798","tags":["report"]},{"url":"https://bugzilla.suse.com/1272799","tags":["report"]},{"url":"https://bugzilla.suse.com/1272868","tags":["report"]},{"url":"https://bugzilla.suse.com/1272877","tags":["report"]},{"url":"https://bugzilla.suse.com/1272891","tags":["report"]},{"url":"https://bugzilla.suse.com/1272963","tags":["report"]},{"url":"https://bugzilla.suse.com/1272983","tags":["report"]},{"url":"https://bugzilla.suse.com/1273008","tags":["report"]},{"url":"https://bugzilla.suse.com/1273019","tags":["report"]},{"url":"https://bugzilla.suse.com/1273027","tags":["report"]},{"url":"https://bugzilla.suse.com/1273028","tags":["report"]},{"url":"https://bugzilla.suse.com/1273030","tags":["report"]},{"url":"https://bugzilla.suse.com/1273038","tags":["report"]},{"url":"https://bugzilla.suse.com/1273053","tags":["report"]},{"url":"https://bugzilla.suse.com/1273054","tags":["report"]},{"url":"https://bugzilla.suse.com/1273060","tags":["report"]},{"url":"https://bugzilla.suse.com/1273105","tags":["report"]},{"url":"https://bugzilla.suse.com/1273249","tags":["report"]},{"url":"https://bugzilla.suse.com/1273250","tags":["report"]},{"url":"https://bugzilla.suse.com/1273260","tags":["report"]},{"url":"https://bugzilla.suse.com/1273273","tags":["report"]},{"url":"https://bugzilla.suse.com/1273274","tags":["report"]},{"url":"https://bugzilla.suse.com/1273276","tags":["report"]},{"url":"https://bugzilla.suse.com/1273281","tags":["report"]},{"url":"https://bugzilla.suse.com/1273284","tags":["report"]},{"url":"https://bugzilla.suse.com/1273285","tags":["report"]},{"url":"https://bugzilla.suse.com/1273289","tags":["report"]},{"url":"https://bugzilla.suse.com/1273291","tags":["report"]},{"url":"https://bugzilla.suse.com/1273294","tags":["report"]},{"url":"https://bugzilla.suse.com/1273302","tags":["report"]},{"url":"https://bugzilla.suse.com/1273303","tags":["report"]},{"url":"https://bugzilla.suse.com/1273305","tags":["report"]},{"url":"https://bugzilla.suse.com/1273310","tags":["report"]},{"url":"https://bugzilla.suse.com/1273311","tags":["report"]},{"url":"https://bugzilla.suse.com/1273316","tags":["report"]},{"url":"https://bugzilla.suse.com/1273318","tags":["report"]},{"url":"https://bugzilla.suse.com/1273319","tags":["report"]},{"url":"https://bugzilla.suse.com/1273323","tags":["report"]},{"url":"https://bugzilla.suse.com/1273325","tags":["report"]},{"url":"https://bugzilla.suse.com/1273327","tags":["report"]},{"url":"https://bugzilla.suse.com/1273334","tags":["report"]},{"url":"https://bugzilla.suse.com/1273335","tags":["report"]},{"url":"https://bugzilla.suse.com/1273336","tags":["report"]},{"url":"https://bugzilla.suse.com/1273337","tags":["report"]},{"url":"https://bugzilla.suse.com/1273338","tags":["report"]},{"url":"https://bugzilla.suse.com/1273340","tags":["report"]},{"url":"https://bugzilla.suse.com/1273341","tags":["report"]},{"url":"https://bugzilla.suse.com/1273346","tags":["report"]},{"url":"https://bugzilla.suse.com/1273422","tags":["report"]},{"url":"https://bugzilla.suse.com/1273426","tags":["report"]},{"url":"https://bugzilla.suse.com/1273443","tags":["report"]},{"url":"https://bugzilla.suse.com/1273463","tags":["report"]},{"url":"https://bugzilla.suse.com/1273468","tags":["report"]},{"url":"https://bugzilla.suse.com/1273469","tags":["report"]},{"url":"https://bugzilla.suse.com/1273471","tags":["report"]},{"url":"https://bugzilla.suse.com/1273479","tags":["report"]},{"url":"https://bugzilla.suse.com/1273480","tags":["report"]},{"url":"https://bugzilla.suse.com/1273482","tags":["report"]},{"url":"https://bugzilla.suse.com/1273484","tags":["report"]},{"url":"https://bugzilla.suse.com/1273488","tags":["report"]},{"url":"https://bugzilla.suse.com/1273490","tags":["report"]},{"url":"https://bugzilla.suse.com/1273501","tags":["report"]},{"url":"https://bugzilla.suse.com/1273503","tags":["report"]},{"url":"https://bugzilla.suse.com/1273504","tags":["report"]},{"url":"https://bugzilla.suse.com/1273506","tags":["report"]},{"url":"https://bugzilla.suse.com/1273523","tags":["report"]},{"url":"https://bugzilla.suse.com/1273525","tags":["report"]},{"url":"https://bugzilla.suse.com/1273533","tags":["report"]},{"url":"https://bugzilla.suse.com/1273536","tags":["report"]},{"url":"https://bugzilla.suse.com/1273542","tags":["report"]},{"url":"https://bugzilla.suse.com/1273555","tags":["report"]},{"url":"https://bugzilla.suse.com/1273578","tags":["report"]},{"url":"https://bugzilla.suse.com/1273579","tags":["report"]},{"url":"https://bugzilla.suse.com/1273582","tags":["report"]},{"url":"https://bugzilla.suse.com/1273596","tags":["report"]},{"url":"https://bugzilla.suse.com/1273597","tags":["report"]},{"url":"https://bugzilla.suse.com/1273598","tags":["report"]},{"url":"https://bugzilla.suse.com/1273600","tags":["report"]},{"url":"https://bugzilla.suse.com/1273601","tags":["report"]},{"url":"https://bugzilla.suse.com/1273602","tags":["report"]},{"url":"https://bugzilla.suse.com/1273603","tags":["report"]},{"url":"https://bugzilla.suse.com/1273682","tags":["report"]},{"url":"https://bugzilla.suse.com/1273734","tags":["report"]},{"url":"https://bugzilla.suse.com/1273738","tags":["report"]},{"url":"https://bugzilla.suse.com/1273739","tags":["report"]},{"url":"https://bugzilla.suse.com/1273741","tags":["report"]},{"url":"https://bugzilla.suse.com/1273742","tags":["report"]},{"url":"https://bugzilla.suse.com/1273743","tags":["report"]},{"url":"https://bugzilla.suse.com/1273745","tags":["report"]},{"url":"https://bugzilla.suse.com/1273748","tags":["report"]},{"url":"https://bugzilla.suse.com/1273749","tags":["report"]},{"url":"https://bugzilla.suse.com/1273755","tags":["report"]},{"url":"https://bugzilla.suse.com/1273762","tags":["report"]},{"url":"https://bugzilla.suse.com/1273765","tags":["report"]},{"url":"https://bugzilla.suse.com/1273766","tags":["report"]},{"url":"https://bugzilla.suse.com/1273769","tags":["report"]},{"url":"https://bugzilla.suse.com/1273774","tags":["report"]},{"url":"https://bugzilla.suse.com/1273778","tags":["report"]},{"url":"https://bugzilla.suse.com/1273780","tags":["report"]},{"url":"https://bugzilla.suse.com/1273790","tags":["report"]},{"url":"https://bugzilla.suse.com/1273796","tags":["report"]},{"url":"https://bugzilla.suse.com/1273804","tags":["report"]},{"url":"https://bugzilla.suse.com/1273810","tags":["report"]},{"url":"https://bugzilla.suse.com/1273811","tags":["report"]},{"url":"https://bugzilla.suse.com/1273813","tags":["report"]},{"url":"https://bugzilla.suse.com/1273817","tags":["report"]},{"url":"https://bugzilla.suse.com/1273822","tags":["report"]},{"url":"https://bugzilla.suse.com/1273824","tags":["report"]},{"url":"https://bugzilla.suse.com/1273831","tags":["report"]},{"url":"https://bugzilla.suse.com/1273832","tags":["report"]},{"url":"https://bugzilla.suse.com/1273834","tags":["report"]},{"url":"https://bugzilla.suse.com/1273838","tags":["report"]},{"url":"https://bugzilla.suse.com/1273844","tags":["report"]},{"url":"https://bugzilla.suse.com/1273849","tags":["report"]},{"url":"https://bugzilla.suse.com/1273860","tags":["report"]},{"url":"https://bugzilla.suse.com/1273862","tags":["report"]},{"url":"https://bugzilla.suse.com/1273867","tags":["report"]},{"url":"https://bugzilla.suse.com/1273868","tags":["report"]},{"url":"https://bugzilla.suse.com/1273869","tags":["report"]},{"url":"https://bugzilla.suse.com/1273872","tags":["report"]},{"url":"https://bugzilla.suse.com/1273876","tags":["report"]},{"url":"https://bugzilla.suse.com/1273877","tags":["report"]},{"url":"https://bugzilla.suse.com/1273880","tags":["report"]},{"url":"https://bugzilla.suse.com/1273882","tags":["report"]},{"url":"https://bugzilla.suse.com/1273890","tags":["report"]},{"url":"https://bugzilla.suse.com/1273891","tags":["report"]},{"url":"https://bugzilla.suse.com/1273892","tags":["report"]},{"url":"https://bugzilla.suse.com/1273895","tags":["report"]},{"url":"https://bugzilla.suse.com/1273896","tags":["report"]},{"url":"https://bugzilla.suse.com/1273903","tags":["report"]},{"url":"https://bugzilla.suse.com/1273905","tags":["report"]},{"url":"https://bugzilla.suse.com/1273930","tags":["report"]},{"url":"https://bugzilla.suse.com/1273933","tags":["report"]},{"url":"https://bugzilla.suse.com/1273934","tags":["report"]},{"url":"https://bugzilla.suse.com/1273935","tags":["report"]},{"url":"https://bugzilla.suse.com/1273936","tags":["report"]},{"url":"https://bugzilla.suse.com/1273939","tags":["report"]},{"url":"https://bugzilla.suse.com/1273940","tags":["report"]},{"url":"https://bugzilla.suse.com/1273941","tags":["report"]},{"url":"https://bugzilla.suse.com/1273942","tags":["report"]},{"url":"https://bugzilla.suse.com/1273944","tags":["report"]},{"url":"https://bugzilla.suse.com/1273945","tags":["report"]},{"url":"https://bugzilla.suse.com/1273946","tags":["report"]},{"url":"https://bugzilla.suse.com/1273956","tags":["report"]},{"url":"https://bugzilla.suse.com/1273957","tags":["report"]},{"url":"https://bugzilla.suse.com/1273958","tags":["report"]},{"url":"https://bugzilla.suse.com/1273966","tags":["report"]},{"url":"https://bugzilla.suse.com/1273967","tags":["report"]},{"url":"https://bugzilla.suse.com/1273968","tags":["report"]},{"url":"https://bugzilla.suse.com/1273972","tags":["report"]},{"url":"https://bugzilla.suse.com/1273974","tags":["report"]},{"url":"https://bugzilla.suse.com/1273975","tags":["report"]},{"url":"https://bugzilla.suse.com/1273977","tags":["report"]},{"url":"https://bugzilla.suse.com/1273982","tags":["report"]},{"url":"https://bugzilla.suse.com/1273988","tags":["report"]},{"url":"https://bugzilla.suse.com/1273990","tags":["report"]},{"url":"https://bugzilla.suse.com/1273991","tags":["report"]},{"url":"https://bugzilla.suse.com/1273995","tags":["report"]},{"url":"https://bugzilla.suse.com/1274001","tags":["report"]},{"url":"https://bugzilla.suse.com/1274003","tags":["report"]},{"url":"https://bugzilla.suse.com/1274006","tags":["report"]},{"url":"https://bugzilla.suse.com/1274011","tags":["report"]},{"url":"https://bugzilla.suse.com/1274012","tags":["report"]},{"url":"https://bugzilla.suse.com/1274014","tags":["report"]},{"url":"https://bugzilla.suse.com/1274017","tags":["report"]},{"url":"https://bugzilla.suse.com/1274019","tags":["report"]},{"url":"https://bugzilla.suse.com/1274020","tags":["report"]},{"url":"https://bugzilla.suse.com/1274026","tags":["report"]},{"url":"https://bugzilla.suse.com/1274028","tags":["report"]},{"url":"https://bugzilla.suse.com/1274030","tags":["report"]},{"url":"https://bugzilla.suse.com/1274031","tags":["report"]},{"url":"https://bugzilla.suse.com/1274035","tags":["report"]},{"url":"https://bugzilla.suse.com/1274040","tags":["report"]},{"url":"https://bugzilla.suse.com/1274041","tags":["report"]},{"url":"https://bugzilla.suse.com/1274057","tags":["report"]},{"url":"https://bugzilla.suse.com/1274058","tags":["report"]},{"url":"https://bugzilla.suse.com/1274061","tags":["report"]},{"url":"https://bugzilla.suse.com/1274063","tags":["report"]},{"url":"https://bugzilla.suse.com/1274065","tags":["report"]},{"url":"https://bugzilla.suse.com/1274067","tags":["report"]},{"url":"https://bugzilla.suse.com/1274075","tags":["report"]},{"url":"https://bugzilla.suse.com/1274076","tags":["report"]},{"url":"https://bugzilla.suse.com/1274077","tags":["report"]},{"url":"https://bugzilla.suse.com/1274078","tags":["report"]},{"url":"https://bugzilla.suse.com/1274208","tags":["report"]},{"url":"https://bugzilla.suse.com/1274226","tags":["report"]},{"url":"https://bugzilla.suse.com/1274239","tags":["report"]},{"url":"https://bugzilla.suse.com/1274243","tags":["report"]},{"url":"https://bugzilla.suse.com/1274258","tags":["report"]},{"url":"https://bugzilla.suse.com/1274265","tags":["report"]},{"url":"https://bugzilla.suse.com/1274274","tags":["report"]},{"url":"https://bugzilla.suse.com/1274277","tags":["report"]},{"url":"https://bugzilla.suse.com/1274278","tags":["report"]},{"url":"https://bugzilla.suse.com/1274281","tags":["report"]},{"url":"https://bugzilla.suse.com/1274283","tags":["report"]},{"url":"https://bugzilla.suse.com/1274286","tags":["report"]},{"url":"https://bugzilla.suse.com/1274290","tags":["report"]},{"url":"https://bugzilla.suse.com/1274294","tags":["report"]},{"url":"https://bugzilla.suse.com/1274296","tags":["report"]},{"url":"https://bugzilla.suse.com/1274297","tags":["report"]},{"url":"https://bugzilla.suse.com/1274298","tags":["report"]},{"url":"https://bugzilla.suse.com/1274314","tags":["report"]},{"url":"https://bugzilla.suse.com/1274321","tags":["report"]},{"url":"https://bugzilla.suse.com/1274491","tags":["report"]},{"url":"https://bugzilla.suse.com/1274497","tags":["report"]},{"url":"https://bugzilla.suse.com/1274539","tags":["report"]},{"url":"https://bugzilla.suse.com/1274541","tags":["report"]},{"url":"https://bugzilla.suse.com/1274543","tags":["report"]},{"url":"https://bugzilla.suse.com/1274545","tags":["report"]},{"url":"https://bugzilla.suse.com/1274547","tags":["report"]},{"url":"https://bugzilla.suse.com/1274550","tags":["report"]},{"url":"https://bugzilla.suse.com/1274573","tags":["report"]},{"url":"https://bugzilla.suse.com/1274578","tags":["report"]},{"url":"https://bugzilla.suse.com/1274580","tags":["report"]},{"url":"https://bugzilla.suse.com/1274581","tags":["report"]},{"url":"https://bugzilla.suse.com/1274620","tags":["report"]},{"url":"https://bugzilla.suse.com/1274622","tags":["report"]},{"url":"https://bugzilla.suse.com/1274624","tags":["report"]},{"url":"https://bugzilla.suse.com/1274629","tags":["report"]},{"url":"https://bugzilla.suse.com/1274632","tags":["report"]},{"url":"https://bugzilla.suse.com/1274636","tags":["report"]},{"url":"https://bugzilla.suse.com/1274639","tags":["report"]},{"url":"https://bugzilla.suse.com/1274640","tags":["report"]},{"url":"https://bugzilla.suse.com/1274642","tags":["report"]},{"url":"https://bugzilla.suse.com/1274644","tags":["report"]},{"url":"https://bugzilla.suse.com/1274645","tags":["report"]},{"url":"https://bugzilla.suse.com/1274646","tags":["report"]},{"url":"https://bugzilla.suse.com/1274649","tags":["report"]},{"url":"https://bugzilla.suse.com/1274650","tags":["report"]},{"url":"https://bugzilla.suse.com/1274651","tags":["report"]},{"url":"https://bugzilla.suse.com/1274656","tags":["report"]},{"url":"https://bugzilla.suse.com/1274659","tags":["report"]},{"url":"https://bugzilla.suse.com/1274662","tags":["report"]},{"url":"https://bugzilla.suse.com/1274663","tags":["report"]},{"url":"https://bugzilla.suse.com/1274665","tags":["report"]},{"url":"https://bugzilla.suse.com/1274667","tags":["report"]},{"url":"https://bugzilla.suse.com/1274670","tags":["report"]},{"url":"https://bugzilla.suse.com/1274675","tags":["report"]},{"url":"https://bugzilla.suse.com/1274677","tags":["report"]},{"url":"https://bugzilla.suse.com/1274678","tags":["report"]},{"url":"https://bugzilla.suse.com/1274679","tags":["report"]},{"url":"https://bugzilla.suse.com/1274681","tags":["report"]},{"url":"https://bugzilla.suse.com/1274682","tags":["report"]},{"url":"https://bugzilla.suse.com/1274690","tags":["report"]},{"url":"https://bugzilla.suse.com/1274694","tags":["report"]},{"url":"https://bugzilla.suse.com/1274696","tags":["report"]},{"url":"https://bugzilla.suse.com/1274698","tags":["report"]},{"url":"https://bugzilla.suse.com/1274699","tags":["report"]},{"url":"https://bugzilla.suse.com/1274700","tags":["report"]},{"url":"https://bugzilla.suse.com/1274702","tags":["report"]},{"url":"https://bugzilla.suse.com/1274703","tags":["report"]},{"url":"https://bugzilla.suse.com/1274705","tags":["report"]},{"url":"https://bugzilla.suse.com/1274706","tags":["report"]},{"url":"https://bugzilla.suse.com/1274709","tags":["report"]},{"url":"https://bugzilla.suse.com/1274710","tags":["report"]},{"url":"https://bugzilla.suse.com/1274713","tags":["report"]},{"url":"https://bugzilla.suse.com/1274716","tags":["report"]},{"url":"https://bugzilla.suse.com/1274721","tags":["report"]},{"url":"https://bugzilla.suse.com/1274725","tags":["report"]},{"url":"https://bugzilla.suse.com/1274737","tags":["report"]},{"url":"https://bugzilla.suse.com/1274738","tags":["report"]},{"url":"https://bugzilla.suse.com/1274749","tags":["report"]},{"url":"https://bugzilla.suse.com/1274752","tags":["report"]},{"url":"https://bugzilla.suse.com/1274753","tags":["report"]},{"url":"https://bugzilla.suse.com/1274754","tags":["report"]},{"url":"https://bugzilla.suse.com/1274755","tags":["report"]},{"url":"https://bugzilla.suse.com/1274756","tags":["report"]},{"url":"https://bugzilla.suse.com/1274764","tags":["report"]},{"url":"https://bugzilla.suse.com/1274768","tags":["report"]},{"url":"https://bugzilla.suse.com/1274770","tags":["report"]},{"url":"https://bugzilla.suse.com/1274787","tags":["report"]},{"url":"https://bugzilla.suse.com/1274800","tags":["report"]},{"url":"https://bugzilla.suse.com/1274801","tags":["report"]},{"url":"https://bugzilla.suse.com/1274802","tags":["report"]},{"url":"https://bugzilla.suse.com/1274804","tags":["report"]},{"url":"https://bugzilla.suse.com/1274805","tags":["report"]},{"url":"https://bugzilla.suse.com/1274807","tags":["report"]},{"url":"https://bugzilla.suse.com/1274808","tags":["report"]},{"url":"https://bugzilla.suse.com/1274811","tags":["report"]},{"url":"https://bugzilla.suse.com/1274813","tags":["report"]},{"url":"https://bugzilla.suse.com/1274814","tags":["report"]},{"url":"https://bugzilla.suse.com/1274831","tags":["report"]},{"url":"https://bugzilla.suse.com/1274834","tags":["report"]},{"url":"https://bugzilla.suse.com/1274847","tags":["report"]},{"url":"https://bugzilla.suse.com/1274853","tags":["report"]},{"url":"https://bugzilla.suse.com/1274868","tags":["report"]},{"url":"https://bugzilla.suse.com/1274869","tags":["report"]},{"url":"https://bugzilla.suse.com/1274872","tags":["report"]},{"url":"https://bugzilla.suse.com/1274873","tags":["report"]},{"url":"https://bugzilla.suse.com/1274874","tags":["report"]},{"url":"https://bugzilla.suse.com/1274876","tags":["report"]},{"url":"https://bugzilla.suse.com/1274879","tags":["report"]},{"url":"https://bugzilla.suse.com/1274881","tags":["report"]},{"url":"https://bugzilla.suse.com/1274883","tags":["report"]},{"url":"https://bugzilla.suse.com/1274886","tags":["report"]},{"url":"https://bugzilla.suse.com/1274888","tags":["report"]},{"url":"https://bugzilla.suse.com/1274891","tags":["report"]},{"url":"https://bugzilla.suse.com/1274892","tags":["report"]},{"url":"https://bugzilla.suse.com/1274893","tags":["report"]},{"url":"https://bugzilla.suse.com/1274894","tags":["report"]},{"url":"https://bugzilla.suse.com/1274896","tags":["report"]},{"url":"https://bugzilla.suse.com/1274897","tags":["report"]},{"url":"https://bugzilla.suse.com/1274898","tags":["report"]},{"url":"https://bugzilla.suse.com/1274899","tags":["report"]},{"url":"https://bugzilla.suse.com/1274901","tags":["report"]},{"url":"https://bugzilla.suse.com/1274902","tags":["report"]},{"url":"https://bugzilla.suse.com/1274905","tags":["report"]},{"url":"https://bugzilla.suse.com/1274907","tags":["report"]},{"url":"https://bugzilla.suse.com/1274908","tags":["report"]},{"url":"https://bugzilla.suse.com/1274913","tags":["report"]},{"url":"https://bugzilla.suse.com/1274914","tags":["report"]},{"url":"https://bugzilla.suse.com/1274920","tags":["report"]},{"url":"https://bugzilla.suse.com/1274921","tags":["report"]},{"url":"https://bugzilla.suse.com/1274924","tags":["report"]},{"url":"https://bugzilla.suse.com/1274925","tags":["report"]},{"url":"https://bugzilla.suse.com/1274929","tags":["report"]},{"url":"https://bugzilla.suse.com/1274930","tags":["report"]},{"url":"https://bugzilla.suse.com/1274933","tags":["report"]},{"url":"https://bugzilla.suse.com/1274934","tags":["report"]},{"url":"https://bugzilla.suse.com/1274935","tags":["report"]},{"url":"https://bugzilla.suse.com/1274941","tags":["report"]},{"url":"https://bugzilla.suse.com/1274945","tags":["report"]},{"url":"https://bugzilla.suse.com/1274947","tags":["report"]},{"url":"https://bugzilla.suse.com/1274951","tags":["report"]},{"url":"https://bugzilla.suse.com/1274953","tags":["report"]},{"url":"https://bugzilla.suse.com/1274958","tags":["report"]},{"url":"https://bugzilla.suse.com/1274968","tags":["report"]},{"url":"https://bugzilla.suse.com/1274981","tags":["report"]},{"url":"https://bugzilla.suse.com/1275040","tags":["report"]},{"url":"https://bugzilla.suse.com/1275069","tags":["report"]},{"url":"https://bugzilla.suse.com/1275071","tags":["report"]},{"url":"https://bugzilla.suse.com/1275073","tags":["report"]},{"url":"https://bugzilla.suse.com/1275076","tags":["report"]},{"url":"https://bugzilla.suse.com/1275080","tags":["report"]},{"url":"https://bugzilla.suse.com/1275083","tags":["report"]},{"url":"https://bugzilla.suse.com/1275088","tags":["report"]},{"url":"https://bugzilla.suse.com/1275091","tags":["report"]},{"url":"https://bugzilla.suse.com/1275125","tags":["report"]},{"url":"https://bugzilla.suse.com/1275126","tags":["report"]},{"url":"https://bugzilla.suse.com/1275131","tags":["report"]},{"url":"https://bugzilla.suse.com/1275132","tags":["report"]},{"url":"https://bugzilla.suse.com/1275150","tags":["report"]},{"url":"https://bugzilla.suse.com/1275152","tags":["report"]},{"url":"https://bugzilla.suse.com/1275154","tags":["report"]},{"url":"https://bugzilla.suse.com/1275155","tags":["report"]},{"url":"https://bugzilla.suse.com/1275157","tags":["report"]},{"url":"https://bugzilla.suse.com/1275158","tags":["report"]},{"url":"https://bugzilla.suse.com/1275161","tags":["report"]},{"url":"https://bugzilla.suse.com/1275163","tags":["report"]},{"url":"https://bugzilla.suse.com/1275164","tags":["report"]},{"url":"https://bugzilla.suse.com/1275169","tags":["report"]},{"url":"https://bugzilla.suse.com/1275173","tags":["report"]},{"url":"https://bugzilla.suse.com/1275176","tags":["report"]},{"url":"https://bugzilla.suse.com/1275185","tags":["report"]},{"url":"https://bugzilla.suse.com/1275190","tags":["report"]},{"url":"https://bugzilla.suse.com/1275236","tags":["report"]},{"url":"https://bugzilla.suse.com/1275237","tags":["report"]},{"url":"https://bugzilla.suse.com/1275239","tags":["report"]},{"url":"https://bugzilla.suse.com/1275294","tags":["report"]},{"url":"https://bugzilla.suse.com/1275301","tags":["report"]},{"url":"https://bugzilla.suse.com/1275303","tags":["report"]},{"url":"https://bugzilla.suse.com/1275304","tags":["report"]},{"url":"https://bugzilla.suse.com/1275305","tags":["report"]},{"url":"https://bugzilla.suse.com/1275306","tags":["report"]},{"url":"https://bugzilla.suse.com/1275307","tags":["report"]},{"url":"https://bugzilla.suse.com/1275470","tags":["report"]},{"url":"https://bugzilla.suse.com/1275472","tags":["report"]},{"url":"https://bugzilla.suse.com/1275474","tags":["report"]},{"url":"https://bugzilla.suse.com/1275479","tags":["report"]},{"url":"https://bugzilla.suse.com/1275483","tags":["report"]},{"url":"https://bugzilla.suse.com/1275486","tags":["report"]},{"url":"https://bugzilla.suse.com/1275487","tags":["report"]},{"url":"https://bugzilla.suse.com/1275506","tags":["report"]},{"url":"https://bugzilla.suse.com/1275509","tags":["report"]},{"url":"https://bugzilla.suse.com/1275511","tags":["report"]},{"url":"https://bugzilla.suse.com/1275517","tags":["report"]},{"url":"https://bugzilla.suse.com/1275528","tags":["report"]},{"url":"https://bugzilla.suse.com/1275535","tags":["report"]},{"url":"https://bugzilla.suse.com/1275540","tags":["report"]},{"url":"https://bugzilla.suse.com/1275553","tags":["report"]},{"url":"https://bugzilla.suse.com/1275555","tags":["report"]},{"url":"https://bugzilla.suse.com/1275561","tags":["report"]},{"url":"https://bugzilla.suse.com/1275566","tags":["report"]},{"url":"https://bugzilla.suse.com/1275569","tags":["report"]},{"url":"https://bugzilla.suse.com/1275574","tags":["report"]},{"url":"https://bugzilla.suse.com/1275578","tags":["report"]},{"url":"https://bugzilla.suse.com/1275582","tags":["report"]},{"url":"https://bugzilla.suse.com/1275583","tags":["report"]},{"url":"https://bugzilla.suse.com/1275584","tags":["report"]},{"url":"https://bugzilla.suse.com/1275591","tags":["report"]},{"url":"https://bugzilla.suse.com/1275595","tags":["report"]},{"url":"https://bugzilla.suse.com/1275633","tags":["report"]},{"url":"https://bugzilla.suse.com/1275636","tags":["report"]},{"url":"https://bugzilla.suse.com/1275650","tags":["report"]},{"url":"https://bugzilla.suse.com/1275659","tags":["report"]},{"url":"https://bugzilla.suse.com/1275665","tags":["report"]},{"url":"https://bugzilla.suse.com/1275669","tags":["report"]},{"url":"https://bugzilla.suse.com/1275687","tags":["report"]},{"url":"https://bugzilla.suse.com/1275688","tags":["report"]},{"url":"https://bugzilla.suse.com/1275695","tags":["report"]},{"url":"https://bugzilla.suse.com/1275696","tags":["report"]},{"url":"https://bugzilla.suse.com/1275704","tags":["report"]},{"url":"https://bugzilla.suse.com/1275782","tags":["report"]},{"url":"https://bugzilla.suse.com/1275784","tags":["report"]},{"url":"https://bugzilla.suse.com/1275787","tags":["report"]},{"url":"https://bugzilla.suse.com/1275788","tags":["report"]},{"url":"https://bugzilla.suse.com/1275790","tags":["report"]},{"url":"https://bugzilla.suse.com/1275797","tags":["report"]},{"url":"https://bugzilla.suse.com/1275798","tags":["report"]},{"url":"https://bugzilla.suse.com/1275805","tags":["report"]},{"url":"https://bugzilla.suse.com/1275817","tags":["report"]},{"url":"https://bugzilla.suse.com/1275818","tags":["report"]},{"url":"https://bugzilla.suse.com/1275819","tags":["report"]},{"url":"https://bugzilla.suse.com/1275820","tags":["report"]},{"url":"https://bugzilla.suse.com/1275821","tags":["report"]},{"url":"https://bugzilla.suse.com/1275827","tags":["report"]},{"url":"https://bugzilla.suse.com/1275864","tags":["report"]},{"url":"https://bugzilla.suse.com/1275867","tags":["report"]},{"url":"https://bugzilla.suse.com/1275869","tags":["report"]},{"url":"https://bugzilla.suse.com/1275870","tags":["report"]},{"url":"https://bugzilla.suse.com/1275871","tags":["report"]},{"url":"https://bugzilla.suse.com/1275872","tags":["report"]},{"url":"https://bugzilla.suse.com/1275886","tags":["report"]},{"url":"https://bugzilla.suse.com/1275905","tags":["report"]},{"url":"https://bugzilla.suse.com/1275923","tags":["report"]},{"url":"https://bugzilla.suse.com/1275925","tags":["report"]},{"url":"https://bugzilla.suse.com/1275946","tags":["report"]},{"url":"https://bugzilla.suse.com/1275950","tags":["report"]},{"url":"https://bugzilla.suse.com/1275954","tags":["report"]},{"url":"https://bugzilla.suse.com/1275970","tags":["report"]},{"url":"https://bugzilla.suse.com/1275973","tags":["report"]},{"url":"https://bugzilla.suse.com/1275975","tags":["report"]},{"url":"https://bugzilla.suse.com/1275976","tags":["report"]},{"url":"https://bugzilla.suse.com/1276029","tags":["report"]},{"url":"https://bugzilla.suse.com/1276257","tags":["report"]},{"url":"https://bugzilla.suse.com/1276263","tags":["report"]},{"url":"https://bugzilla.suse.com/1276270","tags":["report"]},{"url":"https://bugzilla.suse.com/1276273","tags":["report"]},{"url":"https://bugzilla.suse.com/1276277","tags":["report"]},{"url":"https://bugzilla.suse.com/1276335","tags":["report"]},{"url":"https://bugzilla.suse.com/1276346","tags":["report"]},{"url":"https://bugzilla.suse.com/1276350","tags":["report"]},{"url":"https://bugzilla.suse.com/1276355","tags":["report"]},{"url":"https://bugzilla.suse.com/1276446","tags":["report"]},{"url":"https://bugzilla.suse.com/1276452","tags":["report"]},{"url":"https://bugzilla.suse.com/1276500","tags":["report"]},{"url":"https://bugzilla.suse.com/1276507","tags":["report"]},{"url":"https://bugzilla.suse.com/1276542","tags":["report"]},{"url":"https://bugzilla.suse.com/1276546","tags":["report"]},{"url":"https://bugzilla.suse.com/1276551","tags":["report"]},{"url":"https://bugzilla.suse.com/1276561","tags":["report"]},{"url":"https://bugzilla.suse.com/1276569","tags":["report"]},{"url":"https://bugzilla.suse.com/1276665","tags":["report"]},{"url":"https://bugzilla.suse.com/1276864","tags":["report"]},{"url":"https://bugzilla.suse.com/1276927","tags":["report"]},{"url":"https://bugzilla.suse.com/1276931","tags":["report"]},{"url":"https://bugzilla.suse.com/1276937","tags":["report"]},{"url":"https://bugzilla.suse.com/1276941","tags":["report"]},{"url":"https://bugzilla.suse.com/1276943","tags":["report"]},{"url":"https://bugzilla.suse.com/1276961","tags":["report"]},{"url":"https://bugzilla.suse.com/1277022","tags":["report"]},{"url":"https://bugzilla.suse.com/1277034","tags":["report"]},{"url":"https://bugzilla.suse.com/1277037","tags":["report"]},{"url":"https://bugzilla.suse.com/1277047","tags":["report"]},{"url":"https://bugzilla.suse.com/1277054","tags":["report"]},{"url":"https://bugzilla.suse.com/1277057","tags":["report"]},{"url":"https://bugzilla.suse.com/1277059","tags":["report"]},{"url":"https://bugzilla.suse.com/1277064","tags":["report"]},{"url":"https://bugzilla.suse.com/1277066","tags":["report"]},{"url":"https://bugzilla.suse.com/1277069","tags":["report"]},{"url":"https://bugzilla.suse.com/1277073","tags":["report"]},{"url":"https://bugzilla.suse.com/1277077","tags":["report"]},{"url":"https://bugzilla.suse.com/1277095","tags":["report"]},{"url":"https://bugzilla.suse.com/1277155","tags":["report"]},{"url":"https://bugzilla.suse.com/1277159","tags":["report"]},{"url":"https://bugzilla.suse.com/1277160","tags":["report"]},{"url":"https://bugzilla.suse.com/1277202","tags":["report"]},{"url":"https://bugzilla.suse.com/1277204","tags":["report"]},{"url":"https://bugzilla.suse.com/1277275","tags":["report"]},{"url":"https://bugzilla.suse.com/1277285","tags":["report"]},{"url":"https://bugzilla.suse.com/1277391","tags":["report"]},{"url":"https://bugzilla.suse.com/1277408","tags":["report"]},{"url":"https://bugzilla.suse.com/1277516","tags":["report"]},{"url":"https://bugzilla.suse.com/1277523","tags":["report"]},{"url":"https://bugzilla.suse.com/1277551","tags":["report"]},{"url":"https://bugzilla.suse.com/1277625","tags":["report"]},{"url":"https://bugzilla.suse.com/1277660","tags":["report"]},{"url":"https://bugzilla.suse.com/1277678","tags":["report"]},{"url":"https://bugzilla.suse.com/1277688","tags":["report"]},{"url":"https://bugzilla.suse.com/1277775","tags":["report"]},{"url":"https://bugzilla.suse.com/1277776","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57841","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-38469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-71104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23230","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31531","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43116","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43125","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43273","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43278","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43319","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43363","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45968","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46070","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52920","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52925","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52929","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52939","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52977","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52994","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53001","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53076","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53077","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53094","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53096","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53110","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53220","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53223","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53228","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53260","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53269","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53273","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53309","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53353","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53365","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53366","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63801","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63808","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63810","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63827","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63881","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63886","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63887","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63920","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63925","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63926","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63985","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63992","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64001","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64002","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64006","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64007","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64010","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64048","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64083","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64084","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64087","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64102","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64109","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64114","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64118","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64121","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64125","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64155","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64164","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64192","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64249","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64266","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64273","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64274","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64275","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64294","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64305","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64317","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64322","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64331","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64332","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64333","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64334","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64335","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64342","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64343","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64344","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64355","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64365","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64378","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64411","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64420","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64423","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64433","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64440","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64442","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64443","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64444","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64450","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64455","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64463","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64472","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64478","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64480","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64482","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64483","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64484","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64486","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64489","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64503","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64504","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64540","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64541","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64543","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64544","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64546","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64548","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64549","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64552","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64554","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64562","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64565","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64573","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64574","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64576","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64577","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64581","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64582","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64583","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64584","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64585","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64593","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64598","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64599","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64604","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68081","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68082","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68102","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68110","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68116","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68121","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68125","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68127","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68129","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68155","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68159","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68192","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68194","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68202","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68212","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68213","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68215","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68220","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68223","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68226","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68248","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68249","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68250","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68251","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68255","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68256","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68269","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68272","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68278","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68279","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68280","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68293","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68299","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68309","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68310","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68320","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68322","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68324","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68326","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68331","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68333","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68335","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68343","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68352","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68353","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68355","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68361","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68363","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68365","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68366","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68368","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68369","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68370","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68372","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68373","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68397","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68413","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68414","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68417","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68419","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68422","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68428","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68430","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68433","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68444","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68450","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68480","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72035","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72069","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72072","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72083","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72084","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72251","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72288","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72307","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72317","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72342","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72343","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72389","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72463","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72464","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72467","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72501","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74269","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74321","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74334","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74394","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74395","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74474","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74482","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74488","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74509","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74510","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74516","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74548","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74581","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74582","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74584","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74610","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74692","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74694","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74695","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80529","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80534","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80590","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80654","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623481-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623528-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623529-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623881-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1236344","tags":["report"]},{"url":"https://bugzilla.suse.com/1240890","tags":["report"]},{"url":"https://bugzilla.suse.com/1240957","tags":["report"]},{"url":"https://bugzilla.suse.com/1249104","tags":["report"]},{"url":"https://bugzilla.suse.com/1255531","tags":["report"]},{"url":"https://bugzilla.suse.com/1256671","tags":["report"]},{"url":"https://bugzilla.suse.com/1258278","tags":["report"]},{"url":"https://bugzilla.suse.com/1260501","tags":["report"]},{"url":"https://bugzilla.suse.com/1260577","tags":["report"]},{"url":"https://bugzilla.suse.com/1262756","tags":["report"]},{"url":"https://bugzilla.suse.com/1263864","tags":["report"]},{"url":"https://bugzilla.suse.com/1263865","tags":["report"]},{"url":"https://bugzilla.suse.com/1264267","tags":["report"]},{"url":"https://bugzilla.suse.com/1264444","tags":["report"]},{"url":"https://bugzilla.suse.com/1264807","tags":["report"]},{"url":"https://bugzilla.suse.com/1264851","tags":["report"]},{"url":"https://bugzilla.suse.com/1265036","tags":["report"]},{"url":"https://bugzilla.suse.com/1265132","tags":["report"]},{"url":"https://bugzilla.suse.com/1265141","tags":["report"]},{"url":"https://bugzilla.suse.com/1265220","tags":["report"]},{"url":"https://bugzilla.suse.com/1266710","tags":["report"]},{"url":"https://bugzilla.suse.com/1266928","tags":["report"]},{"url":"https://bugzilla.suse.com/1267373","tags":["report"]},{"url":"https://bugzilla.suse.com/1267586","tags":["report"]},{"url":"https://bugzilla.suse.com/1267882","tags":["report"]},{"url":"https://bugzilla.suse.com/1267985","tags":["report"]},{"url":"https://bugzilla.suse.com/1269000","tags":["report"]},{"url":"https://bugzilla.suse.com/1269010","tags":["report"]},{"url":"https://bugzilla.suse.com/1269134","tags":["report"]},{"url":"https://bugzilla.suse.com/1269140","tags":["report"]},{"url":"https://bugzilla.suse.com/1269162","tags":["report"]},{"url":"https://bugzilla.suse.com/1269380","tags":["report"]},{"url":"https://bugzilla.suse.com/1269402","tags":["report"]},{"url":"https://bugzilla.suse.com/1269417","tags":["report"]},{"url":"https://bugzilla.suse.com/1269528","tags":["report"]},{"url":"https://bugzilla.suse.com/1269633","tags":["report"]},{"url":"https://bugzilla.suse.com/1269685","tags":["report"]},{"url":"https://bugzilla.suse.com/1269697","tags":["report"]},{"url":"https://bugzilla.suse.com/1269816","tags":["report"]},{"url":"https://bugzilla.suse.com/1269888","tags":["report"]},{"url":"https://bugzilla.suse.com/1269999","tags":["report"]},{"url":"https://bugzilla.suse.com/1270139","tags":["report"]},{"url":"https://bugzilla.suse.com/1270266","tags":["report"]},{"url":"https://bugzilla.suse.com/1270267","tags":["report"]},{"url":"https://bugzilla.suse.com/1271050","tags":["report"]},{"url":"https://bugzilla.suse.com/1272148","tags":["report"]},{"url":"https://bugzilla.suse.com/1272149","tags":["report"]},{"url":"https://bugzilla.suse.com/1272199","tags":["report"]},{"url":"https://bugzilla.suse.com/1272284","tags":["report"]},{"url":"https://bugzilla.suse.com/1272287","tags":["report"]},{"url":"https://bugzilla.suse.com/1272366","tags":["report"]},{"url":"https://bugzilla.suse.com/1272426","tags":["report"]},{"url":"https://bugzilla.suse.com/1272501","tags":["report"]},{"url":"https://bugzilla.suse.com/1272502","tags":["report"]},{"url":"https://bugzilla.suse.com/1272513","tags":["report"]},{"url":"https://bugzilla.suse.com/1272568","tags":["report"]},{"url":"https://bugzilla.suse.com/1272584","tags":["report"]},{"url":"https://bugzilla.suse.com/1272791","tags":["report"]},{"url":"https://bugzilla.suse.com/1272804","tags":["report"]},{"url":"https://bugzilla.suse.com/1272855","tags":["report"]},{"url":"https://bugzilla.suse.com/1272865","tags":["report"]},{"url":"https://bugzilla.suse.com/1272869","tags":["report"]},{"url":"https://bugzilla.suse.com/1272893","tags":["report"]},{"url":"https://bugzilla.suse.com/1272894","tags":["report"]},{"url":"https://bugzilla.suse.com/1272904","tags":["report"]},{"url":"https://bugzilla.suse.com/1272905","tags":["report"]},{"url":"https://bugzilla.suse.com/1272918","tags":["report"]},{"url":"https://bugzilla.suse.com/1272969","tags":["report"]},{"url":"https://bugzilla.suse.com/1272971","tags":["report"]},{"url":"https://bugzilla.suse.com/1272985","tags":["report"]},{"url":"https://bugzilla.suse.com/1273032","tags":["report"]},{"url":"https://bugzilla.suse.com/1273033","tags":["report"]},{"url":"https://bugzilla.suse.com/1273036","tags":["report"]},{"url":"https://bugzilla.suse.com/1273037","tags":["report"]},{"url":"https://bugzilla.suse.com/1273107","tags":["report"]},{"url":"https://bugzilla.suse.com/1273119","tags":["report"]},{"url":"https://bugzilla.suse.com/1273134","tags":["report"]},{"url":"https://bugzilla.suse.com/1273231","tags":["report"]},{"url":"https://bugzilla.suse.com/1273251","tags":["report"]},{"url":"https://bugzilla.suse.com/1273271","tags":["report"]},{"url":"https://bugzilla.suse.com/1273277","tags":["report"]},{"url":"https://bugzilla.suse.com/1273280","tags":["report"]},{"url":"https://bugzilla.suse.com/1273283","tags":["report"]},{"url":"https://bugzilla.suse.com/1273286","tags":["report"]},{"url":"https://bugzilla.suse.com/1273288","tags":["report"]},{"url":"https://bugzilla.suse.com/1273309","tags":["report"]},{"url":"https://bugzilla.suse.com/1273312","tags":["report"]},{"url":"https://bugzilla.suse.com/1273314","tags":["report"]},{"url":"https://bugzilla.suse.com/1273317","tags":["report"]},{"url":"https://bugzilla.suse.com/1273331","tags":["report"]},{"url":"https://bugzilla.suse.com/1273339","tags":["report"]},{"url":"https://bugzilla.suse.com/1273420","tags":["report"]},{"url":"https://bugzilla.suse.com/1273460","tags":["report"]},{"url":"https://bugzilla.suse.com/1273461","tags":["report"]},{"url":"https://bugzilla.suse.com/1273465","tags":["report"]},{"url":"https://bugzilla.suse.com/1273486","tags":["report"]},{"url":"https://bugzilla.suse.com/1273495","tags":["report"]},{"url":"https://bugzilla.suse.com/1273507","tags":["report"]},{"url":"https://bugzilla.suse.com/1273509","tags":["report"]},{"url":"https://bugzilla.suse.com/1273511","tags":["report"]},{"url":"https://bugzilla.suse.com/1273520","tags":["report"]},{"url":"https://bugzilla.suse.com/1273524","tags":["report"]},{"url":"https://bugzilla.suse.com/1273538","tags":["report"]},{"url":"https://bugzilla.suse.com/1273550","tags":["report"]},{"url":"https://bugzilla.suse.com/1273557","tags":["report"]},{"url":"https://bugzilla.suse.com/1273567","tags":["report"]},{"url":"https://bugzilla.suse.com/1273581","tags":["report"]},{"url":"https://bugzilla.suse.com/1273679","tags":["report"]},{"url":"https://bugzilla.suse.com/1273681","tags":["report"]},{"url":"https://bugzilla.suse.com/1273737","tags":["report"]},{"url":"https://bugzilla.suse.com/1273740","tags":["report"]},{"url":"https://bugzilla.suse.com/1273744","tags":["report"]},{"url":"https://bugzilla.suse.com/1273746","tags":["report"]},{"url":"https://bugzilla.suse.com/1273759","tags":["report"]},{"url":"https://bugzilla.suse.com/1273770","tags":["report"]},{"url":"https://bugzilla.suse.com/1273776","tags":["report"]},{"url":"https://bugzilla.suse.com/1273782","tags":["report"]},{"url":"https://bugzilla.suse.com/1273788","tags":["report"]},{"url":"https://bugzilla.suse.com/1273797","tags":["report"]},{"url":"https://bugzilla.suse.com/1273801","tags":["report"]},{"url":"https://bugzilla.suse.com/1273803","tags":["report"]},{"url":"https://bugzilla.suse.com/1273809","tags":["report"]},{"url":"https://bugzilla.suse.com/1273812","tags":["report"]},{"url":"https://bugzilla.suse.com/1273839","tags":["report"]},{"url":"https://bugzilla.suse.com/1273842","tags":["report"]},{"url":"https://bugzilla.suse.com/1273848","tags":["report"]},{"url":"https://bugzilla.suse.com/1273852","tags":["report"]},{"url":"https://bugzilla.suse.com/1273855","tags":["report"]},{"url":"https://bugzilla.suse.com/1273859","tags":["report"]},{"url":"https://bugzilla.suse.com/1273864","tags":["report"]},{"url":"https://bugzilla.suse.com/1273866","tags":["report"]},{"url":"https://bugzilla.suse.com/1273870","tags":["report"]},{"url":"https://bugzilla.suse.com/1273898","tags":["report"]},{"url":"https://bugzilla.suse.com/1273899","tags":["report"]},{"url":"https://bugzilla.suse.com/1273904","tags":["report"]},{"url":"https://bugzilla.suse.com/1273947","tags":["report"]},{"url":"https://bugzilla.suse.com/1273949","tags":["report"]},{"url":"https://bugzilla.suse.com/1273953","tags":["report"]},{"url":"https://bugzilla.suse.com/1273954","tags":["report"]},{"url":"https://bugzilla.suse.com/1273959","tags":["report"]},{"url":"https://bugzilla.suse.com/1273963","tags":["report"]},{"url":"https://bugzilla.suse.com/1273997","tags":["report"]},{"url":"https://bugzilla.suse.com/1273999","tags":["report"]},{"url":"https://bugzilla.suse.com/1274008","tags":["report"]},{"url":"https://bugzilla.suse.com/1274009","tags":["report"]},{"url":"https://bugzilla.suse.com/1274010","tags":["report"]},{"url":"https://bugzilla.suse.com/1274036","tags":["report"]},{"url":"https://bugzilla.suse.com/1274052","tags":["report"]},{"url":"https://bugzilla.suse.com/1274055","tags":["report"]},{"url":"https://bugzilla.suse.com/1274060","tags":["report"]},{"url":"https://bugzilla.suse.com/1274071","tags":["report"]},{"url":"https://bugzilla.suse.com/1274252","tags":["report"]},{"url":"https://bugzilla.suse.com/1274253","tags":["report"]},{"url":"https://bugzilla.suse.com/1274264","tags":["report"]},{"url":"https://bugzilla.suse.com/1274267","tags":["report"]},{"url":"https://bugzilla.suse.com/1274292","tags":["report"]},{"url":"https://bugzilla.suse.com/1274295","tags":["report"]},{"url":"https://bugzilla.suse.com/1274492","tags":["report"]},{"url":"https://bugzilla.suse.com/1274494","tags":["report"]},{"url":"https://bugzilla.suse.com/1274556","tags":["report"]},{"url":"https://bugzilla.suse.com/1274628","tags":["report"]},{"url":"https://bugzilla.suse.com/1274637","tags":["report"]},{"url":"https://bugzilla.suse.com/1274652","tags":["report"]},{"url":"https://bugzilla.suse.com/1274657","tags":["report"]},{"url":"https://bugzilla.suse.com/1274669","tags":["report"]},{"url":"https://bugzilla.suse.com/1274671","tags":["report"]},{"url":"https://bugzilla.suse.com/1274707","tags":["report"]},{"url":"https://bugzilla.suse.com/1274727","tags":["report"]},{"url":"https://bugzilla.suse.com/1274730","tags":["report"]},{"url":"https://bugzilla.suse.com/1274750","tags":["report"]},{"url":"https://bugzilla.suse.com/1274751","tags":["report"]},{"url":"https://bugzilla.suse.com/1274771","tags":["report"]},{"url":"https://bugzilla.suse.com/1274773","tags":["report"]},{"url":"https://bugzilla.suse.com/1274782","tags":["report"]},{"url":"https://bugzilla.suse.com/1274783","tags":["report"]},{"url":"https://bugzilla.suse.com/1274803","tags":["report"]},{"url":"https://bugzilla.suse.com/1274835","tags":["report"]},{"url":"https://bugzilla.suse.com/1274838","tags":["report"]},{"url":"https://bugzilla.suse.com/1274849","tags":["report"]},{"url":"https://bugzilla.suse.com/1274877","tags":["report"]},{"url":"https://bugzilla.suse.com/1274887","tags":["report"]},{"url":"https://bugzilla.suse.com/1274895","tags":["report"]},{"url":"https://bugzilla.suse.com/1274900","tags":["report"]},{"url":"https://bugzilla.suse.com/1274904","tags":["report"]},{"url":"https://bugzilla.suse.com/1274906","tags":["report"]},{"url":"https://bugzilla.suse.com/1274927","tags":["report"]},{"url":"https://bugzilla.suse.com/1274938","tags":["report"]},{"url":"https://bugzilla.suse.com/1274939","tags":["report"]},{"url":"https://bugzilla.suse.com/1274940","tags":["report"]},{"url":"https://bugzilla.suse.com/1274952","tags":["report"]},{"url":"https://bugzilla.suse.com/1274955","tags":["report"]},{"url":"https://bugzilla.suse.com/1274957","tags":["report"]},{"url":"https://bugzilla.suse.com/1274965","tags":["report"]},{"url":"https://bugzilla.suse.com/1274978","tags":["report"]},{"url":"https://bugzilla.suse.com/1275045","tags":["report"]},{"url":"https://bugzilla.suse.com/1275072","tags":["report"]},{"url":"https://bugzilla.suse.com/1275081","tags":["report"]},{"url":"https://bugzilla.suse.com/1275092","tags":["report"]},{"url":"https://bugzilla.suse.com/1275094","tags":["report"]},{"url":"https://bugzilla.suse.com/1275129","tags":["report"]},{"url":"https://bugzilla.suse.com/1275139","tags":["report"]},{"url":"https://bugzilla.suse.com/1275141","tags":["report"]},{"url":"https://bugzilla.suse.com/1275146","tags":["report"]},{"url":"https://bugzilla.suse.com/1275148","tags":["report"]},{"url":"https://bugzilla.suse.com/1275149","tags":["report"]},{"url":"https://bugzilla.suse.com/1275156","tags":["report"]},{"url":"https://bugzilla.suse.com/1275160","tags":["report"]},{"url":"https://bugzilla.suse.com/1275192","tags":["report"]},{"url":"https://bugzilla.suse.com/1275229","tags":["report"]},{"url":"https://bugzilla.suse.com/1275238","tags":["report"]},{"url":"https://bugzilla.suse.com/1275300","tags":["report"]},{"url":"https://bugzilla.suse.com/1275481","tags":["report"]},{"url":"https://bugzilla.suse.com/1275496","tags":["report"]},{"url":"https://bugzilla.suse.com/1275514","tags":["report"]},{"url":"https://bugzilla.suse.com/1275519","tags":["report"]},{"url":"https://bugzilla.suse.com/1275557","tags":["report"]},{"url":"https://bugzilla.suse.com/1275572","tags":["report"]},{"url":"https://bugzilla.suse.com/1275587","tags":["report"]},{"url":"https://bugzilla.suse.com/1275588","tags":["report"]},{"url":"https://bugzilla.suse.com/1275596","tags":["report"]},{"url":"https://bugzilla.suse.com/1275655","tags":["report"]},{"url":"https://bugzilla.suse.com/1275656","tags":["report"]},{"url":"https://bugzilla.suse.com/1275672","tags":["report"]},{"url":"https://bugzilla.suse.com/1275679","tags":["report"]},{"url":"https://bugzilla.suse.com/1275685","tags":["report"]},{"url":"https://bugzilla.suse.com/1275690","tags":["report"]},{"url":"https://bugzilla.suse.com/1275737","tags":["report"]},{"url":"https://bugzilla.suse.com/1275789","tags":["report"]},{"url":"https://bugzilla.suse.com/1275799","tags":["report"]},{"url":"https://bugzilla.suse.com/1275801","tags":["report"]},{"url":"https://bugzilla.suse.com/1275802","tags":["report"]},{"url":"https://bugzilla.suse.com/1275804","tags":["report"]},{"url":"https://bugzilla.suse.com/1275812","tags":["report"]},{"url":"https://bugzilla.suse.com/1275822","tags":["report"]},{"url":"https://bugzilla.suse.com/1275823","tags":["report"]},{"url":"https://bugzilla.suse.com/1275866","tags":["report"]},{"url":"https://bugzilla.suse.com/1275928","tags":["report"]},{"url":"https://bugzilla.suse.com/1275956","tags":["report"]},{"url":"https://bugzilla.suse.com/1275985","tags":["report"]},{"url":"https://bugzilla.suse.com/1276006","tags":["report"]},{"url":"https://bugzilla.suse.com/1276258","tags":["report"]},{"url":"https://bugzilla.suse.com/1276265","tags":["report"]},{"url":"https://bugzilla.suse.com/1276267","tags":["report"]},{"url":"https://bugzilla.suse.com/1276333","tags":["report"]},{"url":"https://bugzilla.suse.com/1276339","tags":["report"]},{"url":"https://bugzilla.suse.com/1276341","tags":["report"]},{"url":"https://bugzilla.suse.com/1276354","tags":["report"]},{"url":"https://bugzilla.suse.com/1276381","tags":["report"]},{"url":"https://bugzilla.suse.com/1276395","tags":["report"]},{"url":"https://bugzilla.suse.com/1276468","tags":["report"]},{"url":"https://bugzilla.suse.com/1276471","tags":["report"]},{"url":"https://bugzilla.suse.com/1276473","tags":["report"]},{"url":"https://bugzilla.suse.com/1276512","tags":["report"]},{"url":"https://bugzilla.suse.com/1276528","tags":["report"]},{"url":"https://bugzilla.suse.com/1276547","tags":["report"]},{"url":"https://bugzilla.suse.com/1276552","tags":["report"]},{"url":"https://bugzilla.suse.com/1276553","tags":["report"]},{"url":"https://bugzilla.suse.com/1276562","tags":["report"]},{"url":"https://bugzilla.suse.com/1276566","tags":["report"]},{"url":"https://bugzilla.suse.com/1276572","tags":["report"]},{"url":"https://bugzilla.suse.com/1276577","tags":["report"]},{"url":"https://bugzilla.suse.com/1276586","tags":["report"]},{"url":"https://bugzilla.suse.com/1276766","tags":["report"]},{"url":"https://bugzilla.suse.com/1276767","tags":["report"]},{"url":"https://bugzilla.suse.com/1276771","tags":["report"]},{"url":"https://bugzilla.suse.com/1276785","tags":["report"]},{"url":"https://bugzilla.suse.com/1276793","tags":["report"]},{"url":"https://bugzilla.suse.com/1276801","tags":["report"]},{"url":"https://bugzilla.suse.com/1276803","tags":["report"]},{"url":"https://bugzilla.suse.com/1276814","tags":["report"]},{"url":"https://bugzilla.suse.com/1276818","tags":["report"]},{"url":"https://bugzilla.suse.com/1276821","tags":["report"]},{"url":"https://bugzilla.suse.com/1276831","tags":["report"]},{"url":"https://bugzilla.suse.com/1276840","tags":["report"]},{"url":"https://bugzilla.suse.com/1276865","tags":["report"]},{"url":"https://bugzilla.suse.com/1276866","tags":["report"]},{"url":"https://bugzilla.suse.com/1276870","tags":["report"]},{"url":"https://bugzilla.suse.com/1276876","tags":["report"]},{"url":"https://bugzilla.suse.com/1276880","tags":["report"]},{"url":"https://bugzilla.suse.com/1276905","tags":["report"]},{"url":"https://bugzilla.suse.com/1276913","tags":["report"]},{"url":"https://bugzilla.suse.com/1276922","tags":["report"]},{"url":"https://bugzilla.suse.com/1276955","tags":["report"]},{"url":"https://bugzilla.suse.com/1276957","tags":["report"]},{"url":"https://bugzilla.suse.com/1277023","tags":["report"]},{"url":"https://bugzilla.suse.com/1277033","tags":["report"]},{"url":"https://bugzilla.suse.com/1277062","tags":["report"]},{"url":"https://bugzilla.suse.com/1277070","tags":["report"]},{"url":"https://bugzilla.suse.com/1277078","tags":["report"]},{"url":"https://bugzilla.suse.com/1277092","tags":["report"]},{"url":"https://bugzilla.suse.com/1277108","tags":["report"]},{"url":"https://bugzilla.suse.com/1277114","tags":["report"]},{"url":"https://bugzilla.suse.com/1277115","tags":["report"]},{"url":"https://bugzilla.suse.com/1277118","tags":["report"]},{"url":"https://bugzilla.suse.com/1277120","tags":["report"]},{"url":"https://bugzilla.suse.com/1277227","tags":["report"]},{"url":"https://bugzilla.suse.com/1277229","tags":["report"]},{"url":"https://bugzilla.suse.com/1277230","tags":["report"]},{"url":"https://bugzilla.suse.com/1277231","tags":["report"]},{"url":"https://bugzilla.suse.com/1277233","tags":["report"]},{"url":"https://bugzilla.suse.com/1277249","tags":["report"]},{"url":"https://bugzilla.suse.com/1277254","tags":["report"]},{"url":"https://bugzilla.suse.com/1277265","tags":["report"]},{"url":"https://bugzilla.suse.com/1277268","tags":["report"]},{"url":"https://bugzilla.suse.com/1277308","tags":["report"]},{"url":"https://bugzilla.suse.com/1277311","tags":["report"]},{"url":"https://bugzilla.suse.com/1277315","tags":["report"]},{"url":"https://bugzilla.suse.com/1277321","tags":["report"]},{"url":"https://bugzilla.suse.com/1277328","tags":["report"]},{"url":"https://bugzilla.suse.com/1277335","tags":["report"]},{"url":"https://bugzilla.suse.com/1277349","tags":["report"]},{"url":"https://bugzilla.suse.com/1277350","tags":["report"]},{"url":"https://bugzilla.suse.com/1277407","tags":["report"]},{"url":"https://bugzilla.suse.com/1277485","tags":["report"]},{"url":"https://bugzilla.suse.com/1277505","tags":["report"]},{"url":"https://bugzilla.suse.com/1277513","tags":["report"]},{"url":"https://bugzilla.suse.com/1277553","tags":["report"]},{"url":"https://bugzilla.suse.com/1277561","tags":["report"]},{"url":"https://bugzilla.suse.com/1277574","tags":["report"]},{"url":"https://bugzilla.suse.com/1277636","tags":["report"]},{"url":"https://bugzilla.suse.com/1277641","tags":["report"]},{"url":"https://bugzilla.suse.com/1277649","tags":["report"]},{"url":"https://bugzilla.suse.com/1277655","tags":["report"]},{"url":"https://bugzilla.suse.com/1277656","tags":["report"]},{"url":"https://bugzilla.suse.com/1277668","tags":["report"]},{"url":"https://bugzilla.suse.com/1277680","tags":["report"]},{"url":"https://bugzilla.suse.com/1277726","tags":["report"]},{"url":"https://bugzilla.suse.com/1277728","tags":["report"]},{"url":"https://bugzilla.suse.com/1277738","tags":["report"]},{"url":"https://bugzilla.suse.com/1277748","tags":["report"]},{"url":"https://bugzilla.suse.com/1277761","tags":["report"]},{"url":"https://bugzilla.suse.com/1277764","tags":["report"]},{"url":"https://bugzilla.suse.com/1277773","tags":["report"]},{"url":"https://bugzilla.suse.com/1277782","tags":["report"]},{"url":"https://bugzilla.suse.com/1277783","tags":["report"]},{"url":"https://bugzilla.suse.com/1277813","tags":["report"]},{"url":"https://bugzilla.suse.com/1277818","tags":["report"]},{"url":"https://bugzilla.suse.com/1277822","tags":["report"]},{"url":"https://bugzilla.suse.com/1277845","tags":["report"]},{"url":"https://bugzilla.suse.com/1277862","tags":["report"]},{"url":"https://bugzilla.suse.com/1277874","tags":["report"]},{"url":"https://bugzilla.suse.com/1277876","tags":["report"]},{"url":"https://bugzilla.suse.com/1277898","tags":["report"]},{"url":"https://bugzilla.suse.com/1277901","tags":["report"]},{"url":"https://bugzilla.suse.com/1277908","tags":["report"]},{"url":"https://bugzilla.suse.com/1277918","tags":["report"]},{"url":"https://bugzilla.suse.com/1278039","tags":["report"]},{"url":"https://bugzilla.suse.com/1278070","tags":["report"]},{"url":"https://bugzilla.suse.com/1278088","tags":["report"]},{"url":"https://bugzilla.suse.com/1278094","tags":["report"]},{"url":"https://bugzilla.suse.com/1278098","tags":["report"]},{"url":"https://bugzilla.suse.com/1278113","tags":["report"]},{"url":"https://bugzilla.suse.com/1278155","tags":["report"]},{"url":"https://bugzilla.suse.com/1278180","tags":["report"]},{"url":"https://bugzilla.suse.com/1278233","tags":["report"]},{"url":"https://bugzilla.suse.com/1278236","tags":["report"]},{"url":"https://bugzilla.suse.com/1278240","tags":["report"]},{"url":"https://bugzilla.suse.com/1278253","tags":["report"]},{"url":"https://bugzilla.suse.com/1278293","tags":["report"]},{"url":"https://bugzilla.suse.com/1278324","tags":["report"]},{"url":"https://bugzilla.suse.com/1278331","tags":["report"]},{"url":"https://bugzilla.suse.com/1278334","tags":["report"]},{"url":"https://bugzilla.suse.com/1278395","tags":["report"]},{"url":"https://bugzilla.suse.com/1278416","tags":["report"]},{"url":"https://bugzilla.suse.com/1278703","tags":["report"]},{"url":"https://bugzilla.suse.com/1278716","tags":["report"]},{"url":"https://bugzilla.suse.com/1278733","tags":["report"]},{"url":"https://bugzilla.suse.com/1279487","tags":["report"]},{"url":"https://bugzilla.suse.com/1279537","tags":["report"]},{"url":"https://bugzilla.suse.com/1279580","tags":["report"]},{"url":"https://bugzilla.suse.com/1279813","tags":["report"]},{"url":"https://bugzilla.suse.com/1279842","tags":["report"]},{"url":"https://bugzilla.suse.com/1279847","tags":["report"]},{"url":"https://bugzilla.suse.com/1279887","tags":["report"]},{"url":"https://bugzilla.suse.com/1280139","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68780","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31530","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43299","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43331","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43355","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46007","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53048","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53109","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53114","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53129","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63804","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63906","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63917","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63924","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63993","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64054","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64055","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64071","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64119","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64127","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64134","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64147","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64169","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64170","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64240","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64256","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64269","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64272","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64278","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64279","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64298","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64301","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64307","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64309","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64310","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64319","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64320","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64321","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64326","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64364","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64367","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64368","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64373","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64415","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64458","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64477","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64490","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64515","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64519","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64534","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64559","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64561","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64568","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64570","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64579","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64589","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68096","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68120","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68124","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68152","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68164","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68165","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68169","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68198","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68200","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68201","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68228","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68235","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68258","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68260","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68261","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68267","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68273","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68294","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68302","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68307","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68311","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68319","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68321","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68344","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68371","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68389","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68394","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68395","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68437","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68442","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68443","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72023","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72054","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72055","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72164","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72242","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72280","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72282","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72347","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72366","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72414","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72430","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72437","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72438","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72440","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72450","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72485","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72488","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74255","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74261","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74282","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74307","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74317","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74363","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74378","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74390","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74397","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74464","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74533","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74534","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74577","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74598","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74612","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74644","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74730","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74737","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80530","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80531","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80533","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80561","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80589","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80609","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80629","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80646","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80647","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80693","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80731","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80737","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80805","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-80838","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623887-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623897-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623902-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264120-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1241363","tags":["report"]},{"url":"https://bugzilla.suse.com/1247180","tags":["report"]},{"url":"https://bugzilla.suse.com/1251130","tags":["report"]},{"url":"https://bugzilla.suse.com/1253454","tags":["report"]},{"url":"https://bugzilla.suse.com/1258472","tags":["report"]},{"url":"https://bugzilla.suse.com/1261562","tags":["report"]},{"url":"https://bugzilla.suse.com/1263052","tags":["report"]},{"url":"https://bugzilla.suse.com/1264010","tags":["report"]},{"url":"https://bugzilla.suse.com/1264012","tags":["report"]},{"url":"https://bugzilla.suse.com/1264643","tags":["report"]},{"url":"https://bugzilla.suse.com/1264740","tags":["report"]},{"url":"https://bugzilla.suse.com/1267236","tags":["report"]},{"url":"https://bugzilla.suse.com/1267505","tags":["report"]},{"url":"https://bugzilla.suse.com/1269313","tags":["report"]},{"url":"https://bugzilla.suse.com/1269647","tags":["report"]},{"url":"https://bugzilla.suse.com/1270263","tags":["report"]},{"url":"https://bugzilla.suse.com/1270268","tags":["report"]},{"url":"https://bugzilla.suse.com/1272351","tags":["report"]},{"url":"https://bugzilla.suse.com/1272359","tags":["report"]},{"url":"https://bugzilla.suse.com/1272383","tags":["report"]},{"url":"https://bugzilla.suse.com/1272618","tags":["report"]},{"url":"https://bugzilla.suse.com/1272993","tags":["report"]},{"url":"https://bugzilla.suse.com/1273005","tags":["report"]},{"url":"https://bugzilla.suse.com/1276912","tags":["report"]},{"url":"https://bugzilla.suse.com/1276944","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-39939","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31658","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43213","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46078","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46127","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63850","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63923","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64021","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72498","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264254-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1281691","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90082","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-31531","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-31531","tags":["report"]},{"url":"https://git.kernel.org/linus/14cf0cd35361f4e94824bf8a42f72713d7702a73","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-31531","title":"ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()\n\nWhen querying a nexthop object via RTM_GETNEXTHOP, the kernel currently\nallocates a fixed-size skb using NLMSG_GOODSIZE. While sufficient for\nsingle nexthops and small Equal-Cost Multi-Path groups, this fixed\nallocation fails for large nexthop groups like 512 nexthops.\n\nThis results in the following warning splat:\n\n WARNING: net/ipv4/nexthop.c:3395 at rtm_get_nexthop+0x176/0x1c0, CPU#20: rep/4608\n [...]\n RIP: 0010:rtm_get_nexthop (net/ipv4/nexthop.c:3395)\n [...]\n Call Trace:\n  \u003cTASK\u003e\n  rtnetlink_rcv_msg (net/core/rtnetlink.c:6989)\n  netlink_rcv_skb (net/netlink/af_netlink.c:2550)\n  netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)\n  netlink_sendmsg (net/netlink/af_netlink.c:1894)\n  ____sys_sendmsg (net/socket.c:721 net/socket.c:736 net/socket.c:2585)\n  ___sys_sendmsg (net/socket.c:2641)\n  __sys_sendmsg (net/socket.c:2671)\n  do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)\n  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n  \u003c/TASK\u003e\n\nFix this by allocating the size dynamically using nh_nlmsg_size() and\nusing nlmsg_new(), this is consistent with nexthop_notify() behavior. In\naddition, adjust nh_nlmsg_size_grp() so it calculates the size needed\nbased on flags passed. While at it, also add the size of NHA_FDB for\nnexthop group size calculation as it was missing too.\n\nThis cannot be reproduced via iproute2 as the group size is currently\nlimited and the command fails as follows:\n\naddattr_l ERROR: message exceeded bound of 1048","status":"published","published":"2026-04-23T11:12:44.143Z","modified":"2026-11-05T21:45:06.641Z","updated_at":"2026-11-05T22:55:19.586268Z"}],"euvd":[{"id":"EUVD-2026-25218","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()\n\nWhen querying a nexthop object via RTM_GETNEXTHOP, the kernel currently\nallocates a fixed-size skb using NLMSG_GOODSIZE. While sufficient for\nsingle nexthops and small Equal-Cost Multi-Path groups, this fixed\nallocation fails for large nexthop groups like 512 nexthops.\n\nThis results in the following warning splat:\n\n WARNING: net/ipv4/nexthop.c:3395 at rtm_get_nexthop+0x176/0x1c0, CPU#20: rep/4608\n [...]\n RIP: 0010:rtm_get_nexthop (net/ipv4/nexthop.c:3395)\n [...]\n Call Trace:\n  \u003cTASK\u003e\n  rtnetlink_rcv_msg (net/core/rtnetlink.c:6989)\n  netlink_rcv_skb (net/netlink/af_netlink.c:2550)\n  netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)\n  netlink_sendmsg (net/netlink/af_netlink.c:1894)\n  ____sys_sendmsg (net/socket.c:721 net/socket.c:736 net/socket.c:2585)\n  ___sys_sendmsg (net/socket.c:2641)\n  __sys_sendmsg (net/socket.c:2671)\n  do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)\n  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n  \u003c/TASK\u003e\n\nFix this by allocating the size dynamically using nh_nlmsg_size() and\nusing nlmsg_new(), this is consistent with nexthop_notify() behavior. In\naddition, adjust nh_nlmsg_size_grp() so it calculates the size needed\nbased on flags passed. While at it, also add the size of NHA_FDB for\nnexthop group size calculation as it was missing too.\n\nThis cannot be reproduced via iproute2 as the group size is currently\nlimited and the command fails as follows:\n\naddattr_l ERROR: message exceeded bound of 1048","status":"published","published":"2026-04-23T11:12:44Z","modified":"2026-11-05T21:45:06Z","updated_at":"2026-11-05T23:02:19.769742Z"}],"ghsa":[{"id":"GHSA-8q42-qfhf-592h","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: nexthop: allocate skb...","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()\n\nWhen querying a nexthop object via RTM_GETNEXTHOP, the kernel currently\nallocates a fixed-size skb using NLMSG_GOODSIZE. While sufficient for\nsingle nexthops and small Equal-Cost Multi-Path groups, this fixed\nallocation fails for large nexthop groups like 512 nexthops.\n\nThis results in the following warning splat:\n\n WARNING: net/ipv4/nexthop.c:3395 at rtm_get_nexthop+0x176/0x1c0, CPU#20: rep/4608\n [...]\n RIP: 0010:rtm_get_nexthop (net/ipv4/nexthop.c:3395)\n [...]\n Call Trace:\n  \u003cTASK\u003e\n  rtnetlink_rcv_msg (net/core/rtnetlink.c:6989)\n  netlink_rcv_skb (net/netlink/af_netlink.c:2550)\n  netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)\n  netlink_sendmsg (net/netlink/af_netlink.c:1894)\n  ____sys_sendmsg (net/socket.c:721 net/socket.c:736 net/socket.c:2585)\n  ___sys_sendmsg (net/socket.c:2641)\n  __sys_sendmsg (net/socket.c:2671)\n  do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)\n  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n  \u003c/TASK\u003e\n\nFix this by allocating the size dynamically using nh_nlmsg_size() and\nusing nlmsg_new(), this is consistent with nexthop_notify() behavior. In\naddition, adjust nh_nlmsg_size_grp() so it calculates the size needed\nbased on flags passed. While at it, also add the size of NHA_FDB for\nnexthop group size calculation as it was missing too.\n\nThis cannot be reproduced via iproute2 as the group size is currently\nlimited and the command fails as follows:\n\naddattr_l ERROR: message exceeded bound of 1048","status":"published","published":"2026-04-23T12:31:34Z","modified":"2026-10-30T15:32:28Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:14:44.028009Z"}],"nvd":[{"id":"CVE-2026-31531","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()\n\nWhen querying a nexthop object via RTM_GETNEXTHOP, the kernel currently\nallocates a fixed-size skb using NLMSG_GOODSIZE. While sufficient for\nsingle nexthops and small Equal-Cost Multi-Path groups, this fixed\nallocation fails for large nexthop groups like 512 nexthops.\n\nThis results in the following warning splat:\n\n WARNING: net/ipv4/nexthop.c:3395 at rtm_get_nexthop+0x176/0x1c0, CPU#20: rep/4608\n [...]\n RIP: 0010:rtm_get_nexthop (net/ipv4/nexthop.c:3395)\n [...]\n Call Trace:\n  \u003cTASK\u003e\n  rtnetlink_rcv_msg (net/core/rtnetlink.c:6989)\n  netlink_rcv_skb (net/netlink/af_netlink.c:2550)\n  netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)\n  netlink_sendmsg (net/netlink/af_netlink.c:1894)\n  ____sys_sendmsg (net/socket.c:721 net/socket.c:736 net/socket.c:2585)\n  ___sys_sendmsg (net/socket.c:2641)\n  __sys_sendmsg (net/socket.c:2671)\n  do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)\n  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n  \u003c/TASK\u003e\n\nFix this by allocating the size dynamically using nh_nlmsg_size() and\nusing nlmsg_new(), this is consistent with nexthop_notify() behavior. In\naddition, adjust nh_nlmsg_size_grp() so it calculates the size needed\nbased on flags passed. While at it, also add the size of NHA_FDB for\nnexthop group size calculation as it was missing too.\n\nThis cannot be reproduced via iproute2 as the group size is currently\nlimited and the command fails as follows:\n\naddattr_l ERROR: message exceeded bound of 1048","status":"published","published":"2026-04-23T12:17:01.82Z","modified":"2026-11-05T22:18:38.863Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"updated_at":"2026-11-05T23:57:17.922269Z"}],"osv":[{"id":"BELL-CVE-2026-31531","status":"published","published":"2026-04-24T06:08:40.260036Z","modified":"2026-11-04T07:15:47.661077511Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-04T07:32:10.855619Z"},{"id":"DEBIAN-CVE-2026-31531","description":"In the Linux kernel, the following vulnerability has been resolved:  ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()  When querying a nexthop object via RTM_GETNEXTHOP, the kernel currently allocates a fixed-size skb using NLMSG_GOODSIZE. While sufficient for single nexthops and small Equal-Cost Multi-Path groups, this fixed allocation fails for large nexthop groups like 512 nexthops.  This results in the following warning splat:   WARNING: net/ipv4/nexthop.c:3395 at rtm_get_nexthop+0x176/0x1c0, CPU#20: rep/4608  [...]  RIP: 0010:rtm_get_nexthop (net/ipv4/nexthop.c:3395)  [...]  Call Trace:   \u003cTASK\u003e   rtnetlink_rcv_msg (net/core/rtnetlink.c:6989)   netlink_rcv_skb (net/netlink/af_netlink.c:2550)   netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)   netlink_sendmsg (net/netlink/af_netlink.c:1894)   ____sys_sendmsg (net/socket.c:721 net/socket.c:736 net/socket.c:2585)   ___sys_sendmsg (net/socket.c:2641)   __sys_sendmsg (net/socket.c:2671)   do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)   \u003c/TASK\u003e  Fix this by allocating the size dynamically using nh_nlmsg_size() and using nlmsg_new(), this is consistent with nexthop_notify() behavior. In addition, adjust nh_nlmsg_size_grp() so it calculates the size needed based on flags passed. While at it, also add the size of NHA_FDB for nexthop group size calculation as it was missing too.  This cannot be reproduced via iproute2 as the group size is currently limited and the command fails as follows:  addattr_l ERROR: message exceeded bound of 1048","status":"published","published":"2026-04-23T12:17:01.82Z","modified":"2026-11-06T10:04:05.668040112Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-06T10:38:22.758306Z"},{"id":"OESA-2026-2582","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmISDN: hfcpci: Fix warning when deleting uninitialized timer\n\nWith CONFIG_DEBUG_OBJECTS_TIMERS unloading hfcpci module leads\nto the following splat:\n\n[  250.215892] ODEBUG: assert_init not available (active state 0) object: ffffffffc01a3dc0 object type: timer_list hint: 0x0\n[  250.217520] WARNING: CPU: 0 PID: 233 at lib/debugobjects.c:612 debug_print_object+0x1b6/0x2c0\n[  250.218775] Modules linked in: hfcpci(-) mISDN_core\n[  250.219537] CPU: 0 UID: 0 PID: 233 Comm: rmmod Not tainted 6.17.0-rc2-g6f713187ac98 #2 PREEMPT(voluntary)\n[  250.220940] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[  250.222377] RIP: 0010:debug_print_object+0x1b6/0x2c0\n[  250.223131] Code: fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 4f 41 56 48 8b 14 dd a0 4e 01 9f 48 89 ee 48 c7 c7 20 46 01 9f e8 cb 84d\n[  250.225805] RSP: 0018:ffff888015ea7c08 EFLAGS: 00010286\n[  250.226608] RAX: 0000000000000000 RBX: 0000000000000005 RCX: ffffffff9be93a95\n[  250.227708] RDX: 1ffff1100d945138 RSI: 0000000000000008 RDI: ffff88806ca289c0\n[  250.228993] RBP: ffffffff9f014a00 R08: 0000000000000001 R09: ffffed1002bd4f39\n[  250.230043] R10: ffff888015ea79cf R11: 0000000000000001 R12: 0000000000000001\n[  250.231185] R13: ffffffff9eea0520 R14: 0000000000000000 R15: ffff888015ea7cc8\n[  250.232454] FS:  00007f3208f01540(0000) GS:ffff8880caf5a000(0000) knlGS:0000000000000000\n[  250.233851] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  250.234856] CR2: 00007f32090a7421 CR3: 0000000004d63000 CR4: 00000000000006f0\n[  250.236117] Call Trace:\n[  250.236599]  \u0026lt;TASK\u0026gt;\n[  250.236967]  ? trace_irq_enable.constprop.0+0xd4/0x130\n[  250.237920]  debug_object_assert_init+0x1f6/0x310\n[  250.238762]  ? __pfx_debug_object_assert_init+0x10/0x10\n[  250.239658]  ? __lock_acquire+0xdea/0x1c70\n[  250.240369]  __try_to_del_timer_sync+0x69/0x140\n[  250.241172]  ? __pfx___try_to_del_timer_sync+0x10/0x10\n[  250.242058]  ? __timer_delete_sync+0xc6/0x120\n[  250.242842]  ? lock_acquire+0x30/0x80\n[  250.243474]  ? __timer_delete_sync+0xc6/0x120\n[  250.244262]  __timer_delete_sync+0x98/0x120\n[  250.245015]  HFC_cleanup+0x10/0x20 [hfcpci]\n[  250.245704]  __do_sys_delete_module+0x348/0x510\n[  250.246461]  ? __pfx___do_sys_delete_module+0x10/0x10\n[  250.247338]  do_syscall_64+0xc1/0x360\n[  250.247924]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFix this by initializing hfc_tl timer with DEFINE_TIMER macro.\nAlso, use mod_timer instead of manual timeout update.(CVE-2025-39833)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86/amd/pmc: Add support for Van Gogh SoC\n\nThe ROG Xbox Ally (non-X) SoC features a similar architecture to the\nSteam Deck. While the Steam Deck supports S3 (s2idle causes a crash),\nthis support was dropped by the Xbox Ally which only S0ix suspend.\n\nSince the handler is missing here, this causes the device to not suspend\nand the AMD GPU driver to crash while trying to resume afterwards due to\na power hang.(CVE-2025-68334)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nteam: Move team device type change at the end of team_port_add\n\nAttempting to add a port device that is already up will expectedly fail,\nbut not before modifying the team device header_ops.\n\nIn the case of the syzbot reproducer the gre0 device is\nalready in state UP when it attempts to add it as a\nport device of team0, this fails but before that\nheader_ops-\u0026gt;create of team0 is changed from eth_header to ipgre_header\nin the call to team_dev_type_check_change.\n\nLater when we end up in ipgre_header() struct ip_tunnel* points to nonsense\nas the private data of the device still holds a struct team.\n\nExample sequence of iproute2 commands to reproduce the hang/BUG():\nip link add dev team0 type team\nip link add dev gre0 type gre\nip link set dev gre0 up\nip link set dev gre0 master team0\nip link set dev team0 up\nping -I team0 1.1.1.1\n\nMove team_dev_type_check_change down where all other checks have passed\nas it changes the dev type with no way to restore it in case\none of the checks that follow it fail.\n\nAlso make sure to preserve the origial mtu assignment:\n  - If port_dev is not the same type as dev, dev takes mtu from port_dev\n  - If port_dev is the same type as dev, port_dev takes mtu from dev\n\nThis is done by adding a conditional before the call to dev_set_mtu\nto prevent it from assigning port_dev-\u0026gt;mtu = dev-\u0026gt;mtu and instead\nletting team_dev_type_check_change assign dev-\u0026gt;mtu = port_dev-\u0026gt;mtu.\nThe conditional is needed because the patch moves the call to\nteam_dev_type_check_change past dev_set_mtu.\n\nTesting:\n  - team device driver in-tree selftests\n  - Add/remove various devices as slaves of team device\n  - syzbot(CVE-2025-68340)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_router: Fix neighbour use-after-free\n\nWe sometimes observe use-after-free when dereferencing a neighbour [1].\nThe problem seems to be that the driver stores a pointer to the\nneighbour, but without holding a reference on it. A reference is only\ntaken when the neighbour is used by a nexthop.\n\nFix by simplifying the reference counting scheme. Always take a\nreference when storing a neighbour pointer in a neighbour entry. Avoid\ntaking a referencing when the neighbour is used by a nexthop as the\nneighbour entry associated with the nexthop already holds a reference.\n\nTested by running the test that uncovered the problem over 300 times.\nWithout this patch the problem was reproduced after a handful of\niterations.\n\n[1]\nBUG: KASAN: slab-use-after-free in mlxsw_sp_neigh_entry_update+0x2d4/0x310\nRead of size 8 at addr ffff88817f8e3420 by task ip/3929\n\nCPU: 3 UID: 0 PID: 3929 Comm: ip Not tainted 6.18.0-rc4-virtme-g36b21a067510 #3 PREEMPT(full)\nHardware name: Nvidia SN5600/VMOD0013, BIOS 5.13 05/31/2023\nCall Trace:\n \u0026lt;TASK\u0026gt;\n dump_stack_lvl+0x6f/0xa0\n print_address_description.constprop.0+0x6e/0x300\n print_report+0xfc/0x1fb\n kasan_report+0xe4/0x110\n mlxsw_sp_neigh_entry_update+0x2d4/0x310\n mlxsw_sp_router_rif_gone_sync+0x35f/0x510\n mlxsw_sp_rif_destroy+0x1ea/0x730\n mlxsw_sp_inetaddr_port_vlan_event+0xa1/0x1b0\n __mlxsw_sp_inetaddr_lag_event+0xcc/0x130\n __mlxsw_sp_inetaddr_event+0xf5/0x3c0\n mlxsw_sp_router_netdevice_event+0x1015/0x1580\n notifier_call_chain+0xcc/0x150\n call_netdevice_notifiers_info+0x7e/0x100\n __netdev_upper_dev_unlink+0x10b/0x210\n netdev_upper_dev_unlink+0x79/0xa0\n vrf_del_slave+0x18/0x50\n do_set_master+0x146/0x7d0\n do_setlink.isra.0+0x9a0/0x2880\n rtnl_newlink+0x637/0xb20\n rtnetlink_rcv_msg+0x6fe/0xb90\n netlink_rcv_skb+0x123/0x380\n netlink_unicast+0x4a3/0x770\n netlink_sendmsg+0x75b/0xc90\n __sock_sendmsg+0xbe/0x160\n ____sys_sendmsg+0x5b2/0x7d0\n ___sys_sendmsg+0xfd/0x180\n __sys_sendmsg+0x124/0x1c0\n do_syscall_64+0xbb/0xfd0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n[...]\n\nAllocated by task 109:\n kasan_save_stack+0x30/0x50\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0x7b/0x90\n __kmalloc_noprof+0x2c1/0x790\n neigh_alloc+0x6af/0x8f0\n ___neigh_create+0x63/0xe90\n mlxsw_sp_nexthop_neigh_init+0x430/0x7e0\n mlxsw_sp_nexthop_type_init+0x212/0x960\n mlxsw_sp_nexthop6_group_info_init.constprop.0+0x81f/0x1280\n mlxsw_sp_nexthop6_group_get+0x392/0x6a0\n mlxsw_sp_fib6_entry_create+0x46a/0xfd0\n mlxsw_sp_router_fib6_replace+0x1ed/0x5f0\n mlxsw_sp_router_fib6_event_work+0x10a/0x2a0\n process_one_work+0xd57/0x1390\n worker_thread+0x4d6/0xd40\n kthread+0x355/0x5b0\n ret_from_fork+0x1d4/0x270\n ret_from_fork_asm+0x11/0x20\n\nFreed by task 154:\n kasan_save_stack+0x30/0x50\n kasan_save_track+0x14/0x30\n __kasan_save_free_info+0x3b/0x60\n __kasan_slab_free+0x43/0x70\n kmem_cache_free_bulk.part.0+0x1eb/0x5e0\n kvfree_rcu_bulk+0x1f2/0x260\n kfree_rcu_work+0x130/0x1b0\n process_one_work+0xd57/0x1390\n worker_thread+0x4d6/0xd40\n kthread+0x355/0x5b0\n ret_from_fork+0x1d4/0x270\n ret_from_fork_asm+0x11/0x20\n\nLast potentially related work creation:\n kasan_save_stack+0x30/0x50\n kasan_record_aux_stack+0x8c/0xa0\n kvfree_call_rcu+0x93/0x5b0\n mlxsw_sp_router_neigh_event_work+0x67d/0x860\n process_one_work+0xd57/0x1390\n worker_thread+0x4d6/0xd40\n kthread+0x355/0x5b0\n ret_from_fork+0x1d4/0x270\n ret_from_fork_asm+0x11/0x20(CVE-2025-68801)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: bound check rq_pages index in inline path\n\nsvc_rdma_copy_inline_range indexed rqstp-\u0026gt;rq_pages[rc_curpage] without\nverifying rc_curpage stays within the allocated page array. Add guards\nbefore the first use and after advancing to a new page.(CVE-2025-71068)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niavf: fix off-by-one issues in iavf_config_rss_reg()\n\nThere are off-by-one bugs when configuring RSS hash key and lookup\ntable, causing out-of-bounds reads to memory [1] and out-of-bounds\nwrites to device registers.\n\nBefore commit 43a3d9ba34c9 (\u0026quot;i40evf: Allow PF driver to configure RSS\u0026quot;),\nthe loop upper bounds were:\n    i \u0026lt;= I40E_VFQF_{HKEY,HLUT}_MAX_INDEX\nwhich is safe since the value is the last valid index.\n\nThat commit changed the bounds to:\n    i \u0026lt;= adapter-\u0026gt;rss_{key,lut}_size / 4\nwhere `rss_{key,lut}_size / 4` is the number of dwords, so the last\nvalid index is `(rss_{key,lut}_size / 4) - 1`. Therefore, using `\u0026lt;=`\naccesses one element past the end.\n\nFix the issues by using `\u0026lt;` instead of `\u0026lt;=`, ensuring we do not exceed\nthe bounds.\n\n[1] KASAN splat about rss_key_size off-by-one\n  BUG: KASAN: slab-out-of-bounds in iavf_config_rss+0x619/0x800\n  Read of size 4 at addr ffff888102c50134 by task kworker/u8:6/63\n\n  CPU: 0 UID: 0 PID: 63 Comm: kworker/u8:6 Not tainted 6.18.0-rc2-enjuk-tnguy-00378-g3005f5b77652-dirty #156 PREEMPT(voluntary)\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n  Workqueue: iavf iavf_watchdog_task\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   dump_stack_lvl+0x6f/0xb0\n   print_report+0x170/0x4f3\n   kasan_report+0xe1/0x1a0\n   iavf_config_rss+0x619/0x800\n   iavf_watchdog_task+0x2be7/0x3230\n   process_one_work+0x7fd/0x1420\n   worker_thread+0x4d1/0xd40\n   kthread+0x344/0x660\n   ret_from_fork+0x249/0x320\n   ret_from_fork_asm+0x1a/0x30\n   \u0026lt;/TASK\u0026gt;\n\n  Allocated by task 63:\n   kasan_save_stack+0x30/0x50\n   kasan_save_track+0x14/0x30\n   __kasan_kmalloc+0x7f/0x90\n   __kmalloc_noprof+0x246/0x6f0\n   iavf_watchdog_task+0x28fc/0x3230\n   process_one_work+0x7fd/0x1420\n   worker_thread+0x4d1/0xd40\n   kthread+0x344/0x660\n   ret_from_fork+0x249/0x320\n   ret_from_fork_asm+0x1a/0x30\n\n  The buggy address belongs to the object at ffff888102c50100\n   which belongs to the cache kmalloc-64 of size 64\n  The buggy address is located 0 bytes to the right of\n   allocated 52-byte region [ffff888102c50100, ffff888102c50134)\n\n  The buggy address belongs to the physical page:\n  page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102c50\n  flags: 0x200000000000000(node=0|zone=2)\n  page_type: f5(slab)\n  raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000\n  raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000\n  page dumped because: kasan: bad access detected\n\n  Memory state around the buggy address:\n   ffff888102c50000: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc\n   ffff888102c50080: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc\n  \u0026gt;ffff888102c50100: 00 00 00 00 00 00 04 fc fc fc fc fc fc fc fc fc\n                                       ^\n   ffff888102c50180: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc\n   ffff888102c50200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc(CVE-2025-71087)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer\n\nInitialize the eb.vma array with values of 0 when the eb structure is\nfirst set up. In particular, this sets the eb-\u0026gt;vma[i].vma pointers to\nNULL, simplifying cleanup and getting rid of the bug described below.\n\nDuring the execution of eb_lookup_vmas(), the eb-\u0026gt;vma array is\nsuccessively filled up with struct eb_vma objects. This process includes\ncalling eb_add_vma(), which might fail; however, even in the event of\nfailure, eb-\u0026gt;vma[i].vma is set for the currently processed buffer.\n\nIf eb_add_vma() fails, eb_lookup_vmas() returns with an error, which\nprompts a call to eb_release_vmas() to clean up the mess. Since\neb_lookup_vmas() might fail during processing any (possibly not first)\nbuffer, eb_release_vmas() checks whether a buffer\u0026apos;s vma is NULL to know\nat what point did the lookup function fail.\n\nIn eb_lookup_vmas(), eb-\u0026gt;vma[i].vma is set to NULL if either the helper\nfunction eb_lookup_vma() or eb_validate_vma() fails. eb-\u0026gt;vma[i+1].vma is\nset to NULL in case i915_gem_object_userptr_submit_init() fails; the\ncurrent one needs to be cleaned up by eb_release_vmas() at this point,\nso the next one is set. If eb_add_vma() fails, neither the current nor\nthe next vma is set to NULL, which is a source of a NULL deref bug\ndescribed in the issue linked in the Closes tag.\n\nWhen entering eb_lookup_vmas(), the vma pointers are set to the slab\npoison value, instead of NULL. This doesn\u0026apos;t matter for the actual\nlookup, since it gets overwritten anyway, however the eb_release_vmas()\nfunction only recognizes NULL as the stopping value, hence the pointers\nare being set to NULL as they go in case of intermediate failure. This\npatch changes the approach to filling them all with NULL at the start\ninstead, rather than handling that manually during failure.\n\n(cherry picked from commit 08889b706d4f0b8d2352b7ca29c2d8df4d0787cd)(CVE-2025-71130)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: properly keep track of conduit reference\n\nProblem description\n-------------------\n\nDSA has a mumbo-jumbo of reference handling of the conduit net device\nand its kobject which, sadly, is just wrong and doesn\u0026apos;t make sense.\n\nThere are two distinct problems.\n\n1. The OF path, which uses of_find_net_device_by_node(), never releases\n   the elevated refcount on the conduit\u0026apos;s kobject. Nominally, the OF and\n   non-OF paths should result in objects having identical reference\n   counts taken, and it is already suspicious that\n   dsa_dev_to_net_device() has a put_device() call which is missing in\n   dsa_port_parse_of(), but we can actually even verify that an issue\n   exists. With CONFIG_DEBUG_KOBJECT_RELEASE=y, if we run this command\n   \u0026quot;before\u0026quot; and \u0026quot;after\u0026quot; applying this patch:\n\n(unbind the conduit driver for net device eno2)\necho 0000:00:00.2 \u0026gt; /sys/bus/pci/drivers/fsl_enetc/unbind\n\nwe see these lines in the output diff which appear only with the patch\napplied:\n\nkobject: \u0026apos;eno2\u0026apos; (ffff002009a3a6b8): kobject_release, parent 0000000000000000 (delayed 1000)\nkobject: \u0026apos;109\u0026apos; (ffff0020099d59a0): kobject_release, parent 0000000000000000 (delayed 1000)\n\n2. After we find the conduit interface one way (OF) or another (non-OF),\n   it can get unregistered at any time, and DSA remains with a long-lived,\n   but in this case stale, cpu_dp-\u0026gt;conduit pointer. Holding the net\n   device\u0026apos;s underlying kobject isn\u0026apos;t actually of much help, it just\n   prevents it from being freed (but we never need that kobject\n   directly). What helps us to prevent the net device from being\n   unregistered is the parallel netdev reference mechanism (dev_hold()\n   and dev_put()).\n\nActually we actually use that netdev tracker mechanism implicitly on\nuser ports since commit 2f1e8ea726e9 (\u0026quot;net: dsa: link interfaces with\nthe DSA master to get rid of lockdep warnings\u0026quot;), via netdev_upper_dev_link().\nBut time still passes at DSA switch probe time between the initial\nof_find_net_device_by_node() code and the user port creation time, time\nduring which the conduit could unregister itself and DSA wouldn\u0026apos;t know\nabout it.\n\nSo we have to run of_find_net_device_by_node() under rtnl_lock() to\nprevent that from happening, and release the lock only with the netdev\ntracker having acquired the reference.\n\nDo we need to keep the reference until dsa_unregister_switch() /\ndsa_switch_shutdown()?\n1: Maybe yes. A switch device will still be registered even if all user\n   ports failed to probe, see commit 86f8b1c01a0a (\u0026quot;net: dsa: Do not\n   make user port errors fatal\u0026quot;), and the cpu_dp-\u0026gt;conduit pointers\n   remain valid.  I haven\u0026apos;t audited all call paths to see whether they\n   will actually use the conduit in lack of any user port, but if they\n   do, it seems safer to not rely on user ports for that reference.\n2. Definitely yes. We support changing the conduit which a user port is\n   associated to, and we can get into a situation where we\u0026apos;ve moved all\n   user ports away from a conduit, thus no longer hold any reference to\n   it via the net device tracker. But we shouldn\u0026apos;t let it go nonetheless\n   - see the next change in relation to dsa_tree_find_first_conduit()\n   and LAG conduits which disappear.\n   We have to be prepared to return to the physical conduit, so the CPU\n   port must explicitly keep another reference to it. This is also to\n   say: the user ports and their CPU ports may not always keep a\n   reference to the same conduit net device, and both are needed.\n\nAs for the conduit\u0026apos;s kobject for the /sys/class/net/ entry, we don\u0026apos;t\ncare about it, we can release it as soon as we hold the net device\nobject itself.\n\nHistory and blame attribution\n-----------------------------\n\nThe code has been refactored so many times, it is very difficult to\nfollow and properly attribute a blame, but I\u0026apos;ll try to make a short\nhistory which I hope to be correct.\n\nWe have two distinct probing paths:\n- one for OF, introduced in 2016 i\n---truncated---(CVE-2025-71152)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix deadlock in wait_current_trans() due to ignored transaction type\n\nWhen wait_current_trans() is called during start_transaction(), it\ncurrently waits for a blocked transaction without considering whether\nthe given transaction type actually needs to wait for that particular\ntransaction state. The btrfs_blocked_trans_types[] array already defines\nwhich transaction types should wait for which transaction states, but\nthis check was missing in wait_current_trans().\n\nThis can lead to a deadlock scenario involving two transactions and\npending ordered extents:\n\n  1. Transaction A is in TRANS_STATE_COMMIT_DOING state\n\n  2. A worker processing an ordered extent calls start_transaction()\n     with TRANS_JOIN\n\n  3. join_transaction() returns -EBUSY because Transaction A is in\n     TRANS_STATE_COMMIT_DOING\n\n  4. Transaction A moves to TRANS_STATE_UNBLOCKED and completes\n\n  5. A new Transaction B is created (TRANS_STATE_RUNNING)\n\n  6. The ordered extent from step 2 is added to Transaction B\u0026apos;s\n     pending ordered extents\n\n  7. Transaction B immediately starts commit by another task and\n     enters TRANS_STATE_COMMIT_START\n\n  8. The worker finally reaches wait_current_trans(), sees Transaction B\n     in TRANS_STATE_COMMIT_START (a blocked state), and waits\n     unconditionally\n\n  9. However, TRANS_JOIN should NOT wait for TRANS_STATE_COMMIT_START\n     according to btrfs_blocked_trans_types[]\n\n  10. Transaction B is waiting for pending ordered extents to complete\n\n  11. Deadlock: Transaction B waits for ordered extent, ordered extent\n      waits for Transaction B\n\nThis can be illustrated by the following call stacks:\n  CPU0                              CPU1\n                                    btrfs_finish_ordered_io()\n                                      start_transaction(TRANS_JOIN)\n                                        join_transaction()\n                                          # -EBUSY (Transaction A is\n                                          # TRANS_STATE_COMMIT_DOING)\n  # Transaction A completes\n  # Transaction B created\n  # ordered extent added to\n  # Transaction B\u0026apos;s pending list\n  btrfs_commit_transaction()\n    # Transaction B enters\n    # TRANS_STATE_COMMIT_START\n    # waiting for pending ordered\n    # extents\n                                        wait_current_trans()\n                                          # waits for Transaction B\n                                          # (should not wait!)\n\nTask bstore_kv_sync in btrfs_commit_transaction waiting for ordered\nextents:\n\n  __schedule+0x2e7/0x8a0\n  schedule+0x64/0xe0\n  btrfs_commit_transaction+0xbf7/0xda0 [btrfs]\n  btrfs_sync_file+0x342/0x4d0 [btrfs]\n  __x64_sys_fdatasync+0x4b/0x80\n  do_syscall_64+0x33/0x40\n  entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\nTask kworker in wait_current_trans waiting for transaction commit:\n\n  Workqueue: btrfs-syno_nocow btrfs_work_helper [btrfs]\n  __schedule+0x2e7/0x8a0\n  schedule+0x64/0xe0\n  wait_current_trans+0xb0/0x110 [btrfs]\n  start_transaction+0x346/0x5b0 [btrfs]\n  btrfs_finish_ordered_io.isra.0+0x49b/0x9c0 [btrfs]\n  btrfs_work_helper+0xe8/0x350 [btrfs]\n  process_one_work+0x1d3/0x3c0\n  worker_thread+0x4d/0x3e0\n  kthread+0x12d/0x150\n  ret_from_fork+0x1f/0x30\n\nFix this by passing the transaction type to wait_current_trans() and\nchecking btrfs_blocked_trans_types[cur_trans-\u0026gt;state] against the given\ntype before deciding to wait. This ensures that transaction types which\nare allowed to join during certain blocked states will not unnecessarily\nwait and cause deadlocks.(CVE-2025-71194)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmacvlan: fix possible UAF in macvlan_forward_source()\n\nAdd RCU protection on (struct macvlan_source_entry)-\u0026gt;vlan.\n\nWhenever macvlan_hash_del_source() is called, we must clear\nentry-\u0026gt;vlan pointer before RCU grace period starts.\n\nThis allows macvlan_forward_source() to skip over\nentries queued for freeing.\n\nNote that macvlan_dev are already RCU protected, as they\nare embedded in a standard netdev (netdev_priv(ndev)).\n\nhttps: //lore.kernel.org/netdev/(CVE-2026-23001)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv4: ip_gre: make ipgre_header() robust\n\nAnalog to commit db5b4e39c4e6 (\u0026quot;ip6_gre: make ip6gre_header() robust\u0026quot;)\n\nOver the years, syzbot found many ways to crash the kernel\nin ipgre_header() [1].\n\nThis involves team or bonding drivers ability to dynamically\nchange their dev-\u0026gt;needed_headroom and/or dev-\u0026gt;hard_header_len\n\nIn this particular crash mld_newpack() allocated an skb\nwith a too small reserve/headroom, and by the time mld_sendpack()\nwas called, syzbot managed to attach an ipgre device.\n\n[1]\nskbuff: skb_under_panic: text:ffffffff89ea3cb7 len:2030915468 put:2030915372 head:ffff888058b43000 data:ffff887fdfa6e194 tail:0x120 end:0x6c0 dev:team0\n kernel BUG at net/core/skbuff.c:213 !\nOops: invalid opcode: 0000 [#1] SMP KASAN PTI\nCPU: 1 UID: 0 PID: 1322 Comm: kworker/1:9 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025\nWorkqueue: mld mld_ifc_work\n RIP: 0010:skb_panic+0x157/0x160 net/core/skbuff.c:213\nCall Trace:\n \u0026lt;TASK\u0026gt;\n  skb_under_panic net/core/skbuff.c:223 [inline]\n  skb_push+0xc3/0xe0 net/core/skbuff.c:2641\n  ipgre_header+0x67/0x290 net/ipv4/ip_gre.c:897\n  dev_hard_header include/linux/netdevice.h:3436 [inline]\n  neigh_connected_output+0x286/0x460 net/core/neighbour.c:1618\n  NF_HOOK_COND include/linux/netfilter.h:307 [inline]\n  ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247\n  NF_HOOK+0x9e/0x380 include/linux/netfilter.h:318\n  mld_sendpack+0x8d4/0xe60 net/ipv6/mcast.c:1855\n  mld_send_cr net/ipv6/mcast.c:2154 [inline]\n  mld_ifc_work+0x83e/0xd60 net/ipv6/mcast.c:2693\n  process_one_work kernel/workqueue.c:3257 [inline]\n  process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340\n  worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421\n  kthread+0x711/0x8a0 kernel/kthread.c:463\n  ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158\n  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246(CVE-2026-23011)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/page_alloc: prevent pcp corruption with SMP=n\n\nThe kernel test robot has reported:\n\n BUG: spinlock trylock failure on UP on CPU#0, kcompactd0/28\n  lock: 0xffff888807e35ef0, .magic: dead4ead, .owner: kcompactd0/28, .owner_cpu: 0\n CPU: 0 UID: 0 PID: 28 Comm: kcompactd0 Not tainted 6.18.0-rc5-00127-ga06157804399 #1 PREEMPT  8cc09ef94dcec767faa911515ce9e609c45db470\n Call Trace:\n  \u0026lt;IRQ\u0026gt;\n  __dump_stack (lib/dump_stack.c:95)\n  dump_stack_lvl (lib/dump_stack.c:123)\n  dump_stack (lib/dump_stack.c:130)\n  spin_dump (kernel/locking/spinlock_debug.c:71)\n  do_raw_spin_trylock (kernel/locking/spinlock_debug.c:?)\n  _raw_spin_trylock (include/linux/spinlock_api_smp.h:89 kernel/locking/spinlock.c:138)\n  __free_frozen_pages (mm/page_alloc.c:2973)\n  ___free_pages (mm/page_alloc.c:5295)\n  __free_pages (mm/page_alloc.c:5334)\n  tlb_remove_table_rcu (include/linux/mm.h:? include/linux/mm.h:3122 include/asm-generic/tlb.h:220 mm/mmu_gather.c:227 mm/mmu_gather.c:290)\n  ? __cfi_tlb_remove_table_rcu (mm/mmu_gather.c:289)\n  ? rcu_core (kernel/rcu/tree.c:?)\n  rcu_core (include/linux/rcupdate.h:341 kernel/rcu/tree.c:2607 kernel/rcu/tree.c:2861)\n  rcu_core_si (kernel/rcu/tree.c:2879)\n  handle_softirqs (arch/x86/include/asm/jump_label.h:36 include/trace/events/irq.h:142 kernel/softirq.c:623)\n  __irq_exit_rcu (arch/x86/include/asm/jump_label.h:36 kernel/softirq.c:725)\n  irq_exit_rcu (kernel/softirq.c:741)\n  sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1052)\n  \u0026lt;/IRQ\u0026gt;\n  \u0026lt;TASK\u0026gt;\n RIP: 0010:_raw_spin_unlock_irqrestore (arch/x86/include/asm/preempt.h:95 include/linux/spinlock_api_smp.h:152 kernel/locking/spinlock.c:194)\n  free_pcppages_bulk (mm/page_alloc.c:1494)\n  drain_pages_zone (include/linux/spinlock.h:391 mm/page_alloc.c:2632)\n  __drain_all_pages (mm/page_alloc.c:2731)\n  drain_all_pages (mm/page_alloc.c:2747)\n  kcompactd (mm/compaction.c:3115)\n  kthread (kernel/kthread.c:465)\n  ? __cfi_kcompactd (mm/compaction.c:3166)\n  ? __cfi_kthread (kernel/kthread.c:412)\n  ret_from_fork (arch/x86/kernel/process.c:164)\n  ? __cfi_kthread (kernel/kthread.c:412)\n  ret_from_fork_asm (arch/x86/entry/entry_64.S:255)\n  \u0026lt;/TASK\u0026gt;\n\nMatthew has analyzed the report and identified that in drain_page_zone()\nwe are in a section protected by spin_lock(\u0026amp;pcp-\u0026gt;lock) and then get an\ninterrupt that attempts spin_trylock() on the same lock.  The code is\ndesigned to work this way without disabling IRQs and occasionally fail the\ntrylock with a fallback.  However, the SMP=n spinlock implementation\nassumes spin_trylock() will always succeed, and thus it\u0026apos;s normally a\nno-op.  Here the enabled lock debugging catches the problem, but otherwise\nit could cause a corruption of the pcp structure.\n\nThe problem has been introduced by commit 574907741599 (\u0026quot;mm/page_alloc:\nleave IRQs enabled for per-cpu page allocations\u0026quot;).  The pcp locking scheme\nrecognizes the need for disabling IRQs to prevent nesting spin_trylock()\nsections on SMP=n, but the need to prevent the nesting in spin_lock() has\nnot been recognized.  Fix it by introducing local wrappers that change the\nspin_lock() to spin_lock_iqsave() with SMP=n and use them in all places\nthat do spin_lock(\u0026amp;pcp-\u0026gt;lock).\n\n[(CVE-2026-23025)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: hv_netvsc: reject RSS hash key programming without RX indirection table\n\nRSS configuration requires a valid RX indirection table. When the device\nreports a single receive queue, rndis_filter_device_add() does not\nallocate an indirection table, accepting RSS hash key updates in this\nstate leads to a hang.\n\nFix this by gating netvsc_set_rxfh() on ndc-\u0026gt;rx_table_sz and return\n-EOPNOTSUPP when the table is absent. This aligns set_rxfh with the device\ncapabilities and prevents incorrect behavior.(CVE-2026-23054)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: Enforce that teql can only be used as root qdisc\n\nDesign intent of teql is that it is only supposed to be used as root qdisc.\nWe need to check for that constraint.\n\nAlthough not important, I will describe the scenario that unearthed this\nissue for the curious.\n\nGangMin Kim \u0026lt;(CVE-2026-23074)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb: fix hugetlb_pmd_shared()\n\nPatch series \u0026quot;mm/hugetlb: fixes for PMD table sharing (incl.  using\nmmu_gather)\u0026quot;, v3.\n\nOne functional fix, one performance regression fix, and two related\ncomment fixes.\n\nI cleaned up my prototype I recently shared [1] for the performance fix,\ndeferring most of the cleanups I had in the prototype to a later point. \nWhile doing that I identified the other things.\n\nThe goal of this patch set is to be backported to stable trees \u0026quot;fairly\u0026quot;\neasily. At least patch #1 and #4.\n\nPatch #1 fixes hugetlb_pmd_shared() not detecting any sharing\nPatch #2 + #3 are simple comment fixes that patch #4 interacts with.\nPatch #4 is a fix for the reported performance regression due to excessive\nIPI broadcasts during fork()+exit().\n\nThe last patch is all about TLB flushes, IPIs and mmu_gather.\nRead: complicated\n\nThere are plenty of cleanups in the future to be had + one reasonable\noptimization on x86. But that\u0026apos;s all out of scope for this series.\n\nRuntime tested, with a focus on fixing the performance regression using\nthe original reproducer [2] on x86.\n\n\nThis patch (of 4):\n\nWe switched from (wrongly) using the page count to an independent shared\ncount.  Now, shared page tables have a refcount of 1 (excluding\nspeculative references) and instead use ptdesc-\u0026gt;pt_share_count to identify\nsharing.\n\nWe didn\u0026apos;t convert hugetlb_pmd_shared(), so right now, we would never\ndetect a shared PMD table as such, because sharing/unsharing no longer\ntouches the refcount of a PMD table.\n\nPage migration, like mbind() or migrate_pages() would allow for migrating\nfolios mapped into such shared PMD tables, even though the folios are not\nexclusive.  In smaps we would account them as \u0026quot;private\u0026quot; although they are\n\u0026quot;shared\u0026quot;, and we would be wrongly setting the PM_MMAP_EXCLUSIVE in the\npagemap interface.\n\nFix it by properly using ptdesc_pmd_is_shared() in hugetlb_pmd_shared().(CVE-2026-23100)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Add recursion protection in kernel stack trace recording\n\nA bug was reported about an infinite recursion caused by tracing the rcu\nevents with the kernel stack trace trigger enabled. The stack trace code\ncalled back into RCU which then called the stack trace again.\n\nExpand the ftrace recursion protection to add a set of bits to protect\nevents from recursion. Each bit represents the context that the event is\nin (normal, softirq, interrupt and NMI).\n\nHave the stack trace code use the interrupt context to protect against\nrecursion.\n\nNote, the bug showed an issue in both the RCU code as well as the tracing\nstacktrace code. This only handles the tracing stack trace side of the\nbug. The RCU fix will be handled separately.(CVE-2026-23138)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntcp: secure_seq: add back ports to TS offset\n\nThis reverts 28ee1b746f49 (\u0026quot;secure_seq: downgrade to per-host timestamp offsets\u0026quot;)\n\ntcp_tw_recycle went away in 2017.\n\nZhouyan Deng reported off-path TCP source port leakage via\nSYN cookie side-channel that can be fixed in multiple ways.\n\nOne of them is to bring back TCP ports in TS offset randomization.\n\nAs a bonus, we perform a single siphash() computation\nto provide both an ISN and a TS offset.(CVE-2026-23247)\n\nIn the Linux kernel, a vulnerability exists in the AppArmor module\u0026apos;s unpack_pdb function. The vulnerability occurs due to failure to validate that DFA start states are within bounds, which can lead to out-of-bound reads. An attacker can exploit this vulnerability through specially crafted policy files, potentially leading to information disclosure or system crashes.(CVE-2026-23269)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: unconditionally bump set-\u0026gt;nelems before insertion\n\nIn case that the set is full, a new element gets published then removed\nwithout waiting for the RCU grace period, while RCU reader can be\nwalking over it already.\n\nTo address this issue, add the element transaction even if set is full,\nbut toggle the set_full flag to report -ENFILE so the abort path safely\nunwinds the set to its previous state.\n\nAs for element updates, decrement set-\u0026gt;nelems to restore it.\n\nA simpler fix is to call synchronize_rcu() in the error path.\nHowever, with a large batch adding elements to already maxed-out set,\nthis could cause noticeable slowdown of such batches.(CVE-2026-23272)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: kaweth: validate USB endpoints\n\nThe kaweth driver should validate that the device it is probing has the\nproper number and types of USB endpoints it is expecting before it binds\nto it.  If a malicious device were to not have the same urbs the driver\nwill crash later on when it blindly accesses these endpoints.(CVE-2026-23312)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs\n\nWhen shrinking the number of real tx queues,\nnetif_set_real_num_tx_queues() calls qdisc_reset_all_tx_gt() to flush\nqdiscs for queues which will no longer be used.\n\nqdisc_reset_all_tx_gt() currently serializes qdisc_reset() with\nqdisc_lock(). However, for lockless qdiscs, the dequeue path is\nserialized by qdisc_run_begin/end() using qdisc-\u0026gt;seqlock instead, so\nqdisc_reset() can run concurrently with __qdisc_run() and free skbs\nwhile they are still being dequeued, leading to UAF.\n\nThis can easily be reproduced on e.g. virtio-net by imposing heavy\ntraffic while frequently changing the number of queue pairs:\n\n  iperf3 -ub0 -c $peer -t 0 \u0026amp;\n  while :; do\n    ethtool -L eth0 combined 1\n    ethtool -L eth0 combined 2\n  done\n\nWith KASAN enabled, this leads to reports like:\n\n  BUG: KASAN: slab-use-after-free in __qdisc_run+0x133f/0x1760\n  ...\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   ...\n   __qdisc_run+0x133f/0x1760\n   __dev_queue_xmit+0x248f/0x3550\n   ip_finish_output2+0xa42/0x2110\n   ip_output+0x1a7/0x410\n   ip_send_skb+0x2e6/0x480\n   udp_send_skb+0xb0a/0x1590\n   udp_sendmsg+0x13c9/0x1fc0\n   ...\n   \u0026lt;/TASK\u0026gt;\n\n  Allocated by task 1270 on cpu 5 at 44.558414s:\n   ...\n   alloc_skb_with_frags+0x84/0x7c0\n   sock_alloc_send_pskb+0x69a/0x830\n   __ip_append_data+0x1b86/0x48c0\n   ip_make_skb+0x1e8/0x2b0\n   udp_sendmsg+0x13a6/0x1fc0\n   ...\n\n  Freed by task 1306 on cpu 3 at 44.558445s:\n   ...\n   kmem_cache_free+0x117/0x5e0\n   pfifo_fast_reset+0x14d/0x580\n   qdisc_reset+0x9e/0x5f0\n   netif_set_real_num_tx_queues+0x303/0x840\n   virtnet_set_channels+0x1bf/0x260 [virtio_net]\n   ethnl_set_channels+0x684/0xae0\n   ethnl_default_set_doit+0x31a/0x890\n   ...\n\nSerialize qdisc_reset_all_tx_gt() against the lockless dequeue path by\ntaking qdisc-\u0026gt;seqlock for TCQ_F_NOLOCK qdiscs, matching the\nserialization model already used by dev_reset_queue().\n\nAdditionally clear QDISC_STATE_NON_EMPTY after reset so the qdisc state\nreflects an empty queue, avoiding needless re-scheduling.(CVE-2026-23340)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_ife: Fix metalist update behavior\n\nWhenever an ife action replace changes the metalist, instead of\nreplacing the old data on the metalist, the current ife code is appending\nthe new metadata. Aside from being innapropriate behavior, this may lead\nto an unbounded addition of metadata to the metalist which might cause an\nout of bounds error when running the encode op:\n\n[  138.423369][    C1] ==================================================================\n[  138.424317][    C1] BUG: KASAN: slab-out-of-bounds in ife_tlv_meta_encode (net/ife/ife.c:168)\n[  138.424906][    C1] Write of size 4 at addr ffff8880077f4ffe by task ife_out_out_bou/255\n[  138.425778][    C1] CPU: 1 UID: 0 PID: 255 Comm: ife_out_out_bou Not tainted 7.0.0-rc1-00169-gfbdfa8da05b6 #624 PREEMPT(full)\n[  138.425795][    C1] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011\n[  138.425800][    C1] Call Trace:\n[  138.425804][    C1]  \u0026lt;IRQ\u0026gt;\n[  138.425808][    C1]  dump_stack_lvl (lib/dump_stack.c:122)\n[  138.425828][    C1]  print_report (mm/kasan/report.c:379 mm/kasan/report.c:482)\n[  138.425839][    C1]  ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)\n[  138.425844][    C1]  ? __virt_addr_valid (./arch/x86/include/asm/preempt.h:95 (discriminator 1) ./include/linux/rcupdate.h:975 (discriminator 1) ./include/linux/mmzone.h:2207 (discriminator 1) arch/x86/mm/physaddr.c:54 (discriminator 1))\n[  138.425853][    C1]  ? ife_tlv_meta_encode (net/ife/ife.c:168)\n[  138.425859][    C1]  kasan_report (mm/kasan/report.c:221 mm/kasan/report.c:597)\n[  138.425868][    C1]  ? ife_tlv_meta_encode (net/ife/ife.c:168)\n[  138.425878][    C1]  kasan_check_range (mm/kasan/generic.c:186 (discriminator 1) mm/kasan/generic.c:200 (discriminator 1))\n[  138.425884][    C1]  __asan_memset (mm/kasan/shadow.c:84 (discriminator 2))\n[  138.425889][    C1]  ife_tlv_meta_encode (net/ife/ife.c:168)\n[  138.425893][    C1]  ? ife_tlv_meta_encode (net/ife/ife.c:171)\n[  138.425898][    C1]  ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)\n[  138.425903][    C1]  ife_encode_meta_u16 (net/sched/act_ife.c:57)\n[  138.425910][    C1]  ? __pfx_do_raw_spin_lock (kernel/locking/spinlock_debug.c:114)\n[  138.425916][    C1]  ? __asan_memcpy (mm/kasan/shadow.c:105 (discriminator 3))\n[  138.425921][    C1]  ? __pfx_ife_encode_meta_u16 (net/sched/act_ife.c:45)\n[  138.425927][    C1]  ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)\n[  138.425931][    C1]  tcf_ife_act (net/sched/act_ife.c:847 net/sched/act_ife.c:879)\n\nTo solve this issue, fix the replace behavior by adding the metalist to\nthe ife rcu data structure.(CVE-2026-23378)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nice: Fix memory leak in ice_set_ringparam()\n\nIn ice_set_ringparam, tx_rings and xdp_rings are allocated before\nrx_rings. If the allocation of rx_rings fails, the code jumps to\nthe done label leaking both tx_rings and xdp_rings. Furthermore, if\nthe setup of an individual Rx ring fails during the loop, the code jumps\nto the free_tx label which releases tx_rings but leaks xdp_rings.\n\nFix this by introducing a free_xdp label and updating the error paths to\nensure both xdp_rings and tx_rings are properly freed if rx_rings\nallocation or setup fails.\n\nCompile tested only. Issue found using a prototype static analysis tool\nand code review.(CVE-2026-23389)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix side-effect bug in match_char() macro usage\n\nThe match_char() macro evaluates its character parameter multiple\ntimes when traversing differential encoding chains. When invoked\nwith *str++, the string pointer advances on each iteration of the\ninner do-while loop, causing the DFA to check different characters\nat each iteration and therefore skip input characters.\nThis results in out-of-bounds reads when the pointer advances past\nthe input buffer boundary.\n\n[   94.984676] ==================================================================\n[   94.985301] BUG: KASAN: slab-out-of-bounds in aa_dfa_match+0x5ae/0x760\n[   94.985655] Read of size 1 at addr ffff888100342000 by task file/976\n\n[   94.986319] CPU: 7 UID: 1000 PID: 976 Comm: file Not tainted 6.19.0-rc7-next-20260127 #1 PREEMPT(lazy)\n[   94.986322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[   94.986329] Call Trace:\n[   94.986341]  \u0026lt;TASK\u0026gt;\n[   94.986347]  dump_stack_lvl+0x5e/0x80\n[   94.986374]  print_report+0xc8/0x270\n[   94.986384]  ? aa_dfa_match+0x5ae/0x760\n[   94.986388]  kasan_report+0x118/0x150\n[   94.986401]  ? aa_dfa_match+0x5ae/0x760\n[   94.986405]  aa_dfa_match+0x5ae/0x760\n[   94.986408]  __aa_path_perm+0x131/0x400\n[   94.986418]  aa_path_perm+0x219/0x2f0\n[   94.986424]  apparmor_file_open+0x345/0x570\n[   94.986431]  security_file_open+0x5c/0x140\n[   94.986442]  do_dentry_open+0x2f6/0x1120\n[   94.986450]  vfs_open+0x38/0x2b0\n[   94.986453]  ? may_open+0x1e2/0x2b0\n[   94.986466]  path_openat+0x231b/0x2b30\n[   94.986469]  ? __x64_sys_openat+0xf8/0x130\n[   94.986477]  do_file_open+0x19d/0x360\n[   94.986487]  do_sys_openat2+0x98/0x100\n[   94.986491]  __x64_sys_openat+0xf8/0x130\n[   94.986499]  do_syscall_64+0x8e/0x660\n[   94.986515]  ? count_memcg_events+0x15f/0x3c0\n[   94.986526]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   94.986540]  ? handle_mm_fault+0x1639/0x1ef0\n[   94.986551]  ? vma_start_read+0xf0/0x320\n[   94.986558]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   94.986561]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   94.986563]  ? fpregs_assert_state_consistent+0x50/0xe0\n[   94.986572]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   94.986574]  ? arch_exit_to_user_mode_prepare+0x9/0xb0\n[   94.986587]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   94.986588]  ? irqentry_exit+0x3c/0x590\n[   94.986595]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[   94.986597] RIP: 0033:0x7fda4a79c3ea\n\nFix by extracting the character value before invoking match_char,\nensuring single evaluation per outer loop.(CVE-2026-23406)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix missing bounds check on DEFAULT table in verify_dfa()\n\nThe verify_dfa() function only checks DEFAULT_TABLE bounds when the state\nis not differentially encoded.\n\nWhen the verification loop traverses the differential encoding chain,\nit reads k = DEFAULT_TABLE[j] and uses k as an array index without\nvalidation. A malformed DFA with DEFAULT_TABLE[j] \u0026gt;= state_count,\ntherefore, causes both out-of-bounds reads and writes.\n\n[   57.179855] ==================================================================\n[   57.180549] BUG: KASAN: slab-out-of-bounds in verify_dfa+0x59a/0x660\n[   57.180904] Read of size 4 at addr ffff888100eadec4 by task su/993\n\n[   57.181554] CPU: 1 UID: 0 PID: 993 Comm: su Not tainted 6.19.0-rc7-next-20260127 #1 PREEMPT(lazy)\n[   57.181558] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[   57.181563] Call Trace:\n[   57.181572]  \u0026lt;TASK\u0026gt;\n[   57.181577]  dump_stack_lvl+0x5e/0x80\n[   57.181596]  print_report+0xc8/0x270\n[   57.181605]  ? verify_dfa+0x59a/0x660\n[   57.181608]  kasan_report+0x118/0x150\n[   57.181620]  ? verify_dfa+0x59a/0x660\n[   57.181623]  verify_dfa+0x59a/0x660\n[   57.181627]  aa_dfa_unpack+0x1610/0x1740\n[   57.181629]  ? __kmalloc_cache_noprof+0x1d0/0x470\n[   57.181640]  unpack_pdb+0x86d/0x46b0\n[   57.181647]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   57.181653]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   57.181656]  ? aa_unpack_nameX+0x1a8/0x300\n[   57.181659]  aa_unpack+0x20b0/0x4c30\n[   57.181662]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   57.181664]  ? stack_depot_save_flags+0x33/0x700\n[   57.181681]  ? kasan_save_track+0x4f/0x80\n[   57.181683]  ? kasan_save_track+0x3e/0x80\n[   57.181686]  ? __kasan_kmalloc+0x93/0xb0\n[   57.181688]  ? __kvmalloc_node_noprof+0x44a/0x780\n[   57.181693]  ? aa_simple_write_to_buffer+0x54/0x130\n[   57.181697]  ? policy_update+0x154/0x330\n[   57.181704]  aa_replace_profiles+0x15a/0x1dd0\n[   57.181707]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   57.181710]  ? __kvmalloc_node_noprof+0x44a/0x780\n[   57.181712]  ? aa_loaddata_alloc+0x77/0x140\n[   57.181715]  ? srso_alias_return_thunk+0x5/0xfbef5\n[   57.181717]  ? _copy_from_user+0x2a/0x70\n[   57.181730]  policy_update+0x17a/0x330\n[   57.181733]  profile_replace+0x153/0x1a0\n[   57.181735]  ? rw_verify_area+0x93/0x2d0\n[   57.181740]  vfs_write+0x235/0xab0\n[   57.181745]  ksys_write+0xb0/0x170\n[   57.181748]  do_syscall_64+0x8e/0x660\n[   57.181762]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[   57.181765] RIP: 0033:0x7f6192792eb2\n\nRemove the MATCH_FLAG_DIFF_ENCODE condition to validate all DEFAULT_TABLE\nentries unconditionally.(CVE-2026-23407)\n\nA race condition vulnerability exists in the AppArmor security module of the Linux kernel, leading to a use-after-free issue. This vulnerability can be triggered when an attacker simultaneously opens rawdata files and removes an associated AppArmor profile. Since rawdata inodes are not refcounted, there is a time window during profile removal where the i_private pointer may reference freed memory, causing the system to access freed memory regions. This can result in program crashes, unexpected value usage, or arbitrary code execution, threatening the confidentiality, integrity, and availability of the system.(CVE-2026-23410)\n\nA vulnerability exists in the AppArmor security module of the Linux kernel when handling the i_private field of the inode structure. AppArmor was putting the reference to i_private data on its end after removing the original entry from the file system. However the inode can and does live beyond that point and it is possible that some of the fs callback functions will be invoked after the reference has been put, which results in a race between freeing the data and accessing it through the fs. While the rawdata/loaddata is the most likely candidate to fail the race, as it has the fewest references. If properly crafted it might be possible to trigger a race for the other types stored in i_private. This vulnerability could allow a local attacker to bypass AppArmor\u0026apos;s access control policies through a specially crafted request, leading to privilege escalation and impacting system confidentiality, integrity, and availability.(CVE-2026-23411)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nudp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n\n\nWhen CONFIG_IPV6 is disabled, the udp_sock_create6() function returns 0\n(success) without actually creating a socket. Callers such as\nfou_create() then proceed to dereference the uninitialized socket\npointer, resulting in a NULL pointer dereference.\n\nThe captured NULL deref crash:\n  BUG: kernel NULL pointer dereference, address: 0000000000000018\n  RIP: 0010:fou_nl_add_doit (net/ipv4/fou_core.c:590 net/ipv4/fou_core.c:764)\n  [...]\n  Call Trace:\n    \u0026lt;TASK\u0026gt;\n    genl_family_rcv_msg_doit.constprop.0 (net/netlink/genetlink.c:1114)\n    genl_rcv_msg (net/netlink/genetlink.c:1194 net/netlink/genetlink.c:1209)\n    [...]\n    netlink_rcv_skb (net/netlink/af_netlink.c:2550)\n    genl_rcv (net/netlink/genetlink.c:1219)\n    netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)\n    netlink_sendmsg (net/netlink/af_netlink.c:1894)\n    __sock_sendmsg (net/socket.c:727 (discriminator 1) net/socket.c:742 (discriminator 1))\n    __sys_sendto (./include/linux/file.h:62 (discriminator 1) ./include/linux/file.h:83 (discriminator 1) net/socket.c:2183 (discriminator 1))\n    __x64_sys_sendto (net/socket.c:2213 (discriminator 1) net/socket.c:2209 (discriminator 1) net/socket.c:2209 (discriminator 1))\n    do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1))\n    entry_SYSCALL_64_after_hwframe (net/arch/x86/entry/entry_64.S:130)\n\nThis patch makes udp_sock_create6 return -EPFNOSUPPORT instead, so\ncallers correctly take their error paths. There is only one caller of\nthe vulnerable function and only privileged users can trigger it.(CVE-2026-23439)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix race condition during IPSec ESN update\n\nIn IPSec full offload mode, the device reports an ESN (Extended\nSequence Number) wrap event to the driver. The driver validates this\nevent by querying the IPSec ASO and checking that the esn_event_arm\nfield is 0x0, which indicates an event has occurred. After handling\nthe event, the driver must re-arm the context by setting esn_event_arm\nback to 0x1.\n\nA race condition exists in this handling path. After validating the\nevent, the driver calls mlx5_accel_esp_modify_xfrm() to update the\nkernel\u0026apos;s xfrm state. This function temporarily releases and\nre-acquires the xfrm state lock.\n\nSo, need to acknowledge the event first by setting esn_event_arm to\n0x1. This prevents the driver from reprocessing the same ESN update if\nthe hardware sends events for other reason. Since the next ESN update\nonly occurs after nearly 2^31 packets are received, there\u0026apos;s no risk of\nmissing an update, as it will happen long after this handling has\nfinished.\n\nProcessing the event twice causes the ESN high-order bits (esn_msb) to\nbe incremented incorrectly. The driver then programs the hardware with\nthis invalid ESN state, which leads to anti-replay failures and a\ncomplete halt of IPSec traffic.\n\nFix this by re-arming the ESN event immediately after it is validated,\nbefore calling mlx5_accel_esp_modify_xfrm(). This ensures that any\nspurious, duplicate events are correctly ignored, closing the race\nwindow.(CVE-2026-23440)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Prevent concurrent access to IPSec ASO context\n\nThe query or updating IPSec offload object is through Access ASO WQE.\nThe driver uses a single mlx5e_ipsec_aso struct for each PF, which\ncontains a shared DMA-mapped context for all ASO operations.\n\nA race condition exists because the ASO spinlock is released before\nthe hardware has finished processing WQE. If a second operation is\ninitiated immediately after, it overwrites the shared context in the\nDMA area.\n\nWhen the first operation\u0026apos;s completion is processed later, it reads\nthis corrupted context, leading to unexpected behavior and incorrect\nresults.\n\nThis commit fixes the race by introducing a private context within\neach IPSec offload object. The shared ASO context is now copied to\nthis private context while the ASO spinlock is held. Subsequent\nprocessing uses this saved, per-object context, ensuring its integrity\nis maintained.(CVE-2026-23441)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure\n\nieee80211_tx_prepare_skb() has three error paths, but only two of them\nfree the skb. The first error path (ieee80211_tx_prepare() returning\nTX_DROP) does not free it, while invoke_tx_handlers() failure and the\nfragmentation check both do.\n\nAdd kfree_skb() to the first error path so all three are consistent,\nand remove the now-redundant frees in callers (ath9k, mt76,\nmac80211_hwsim) to avoid double-free.\n\nDocument the skb ownership guarantee in the function\u0026apos;s kdoc.(CVE-2026-23444)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check\n\ncdc_ncm_rx_verify_ndp16() validates that the NDP header and its DPE\nentries fit within the skb. The first check correctly accounts for\nndpoffset:\n\n  if ((ndpoffset + sizeof(struct usb_cdc_ncm_ndp16)) \u0026gt; skb_in-\u0026gt;len)\n\nbut the second check omits it:\n\n  if ((sizeof(struct usb_cdc_ncm_ndp16) +\n       ret * (sizeof(struct usb_cdc_ncm_dpe16))) \u0026gt; skb_in-\u0026gt;len)\n\nThis validates the DPE array size against the total skb length as if\nthe NDP were at offset 0, rather than at ndpoffset. When the NDP is\nplaced near the end of the NTB (large wNdpIndex), the DPE entries can\nextend past the skb data buffer even though the check passes.\ncdc_ncm_rx_fixup() then reads out-of-bounds memory when iterating\nthe DPE array.\n\nAdd ndpoffset to the nframes bounds check and use struct_size_t() to\nexpress the NDP-plus-DPE-array size more clearly.(CVE-2026-23448)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()\n\nSyzkaller reported a panic in smc_tcp_syn_recv_sock() [1].\n\nsmc_tcp_syn_recv_sock() is called in the TCP receive path\n(softirq) via icsk_af_ops-\u0026gt;syn_recv_sock on the clcsock (TCP\nlistening socket). It reads sk_user_data to get the smc_sock\npointer. However, when the SMC listen socket is being closed\nconcurrently, smc_close_active() sets clcsock-\u0026gt;sk_user_data\nto NULL under sk_callback_lock, and then the smc_sock itself\ncan be freed via sock_put() in smc_release().\n\nThis leads to two issues:\n\n1) NULL pointer dereference: sk_user_data is NULL when\n   accessed.\n2) Use-after-free: sk_user_data is read as non-NULL, but the\n   smc_sock is freed before its fields (e.g., queued_smc_hs,\n   ori_af_ops) are accessed.\n\nThe race window looks like this (the syzkaller crash [1]\ntriggers via the SYN cookie path: tcp_get_cookie_sock() -\u0026gt;\nsmc_tcp_syn_recv_sock(), but the normal tcp_check_req() path\nhas the same race):\n\n  CPU A (softirq)              CPU B (process ctx)\n\n  tcp_v4_rcv()\n    TCP_NEW_SYN_RECV:\n    sk = req-\u0026gt;rsk_listener\n    sock_hold(sk)\n    /* No lock on listener */\n                               smc_close_active():\n                                 write_lock_bh(cb_lock)\n                                 sk_user_data = NULL\n                                 write_unlock_bh(cb_lock)\n                                 ...\n                                 smc_clcsock_release()\n                                 sock_put(smc-\u0026gt;sk) x2\n                                   -\u0026gt; smc_sock freed!\n    tcp_check_req()\n      smc_tcp_syn_recv_sock():\n        smc = user_data(sk)\n          -\u0026gt; NULL or dangling\n        smc-\u0026gt;queued_smc_hs\n          -\u0026gt; crash!\n\nNote that the clcsock and smc_sock are two independent objects\nwith separate refcounts. TCP stack holds a reference on the\nclcsock, which keeps it alive, but this does NOT prevent the\nsmc_sock from being freed.\n\nFix this by using RCU and refcount_inc_not_zero() to safely\naccess smc_sock. Since smc_tcp_syn_recv_sock() is called in\nthe TCP three-way handshake path, taking read_lock_bh on\nsk_callback_lock is too heavy and would not survive a SYN\nflood attack. Using rcu_read_lock() is much more lightweight.\n\n- Set SOCK_RCU_FREE on the SMC listen socket so that\n  smc_sock freeing is deferred until after the RCU grace\n  period. This guarantees the memory is still valid when\n  accessed inside rcu_read_lock().\n- Use rcu_read_lock() to protect reading sk_user_data.\n- Use refcount_inc_not_zero(\u0026amp;smc-\u0026gt;sk.sk_refcnt) to pin the\n  smc_sock. If the refcount has already reached zero (close\n  path completed), it returns false and we bail out safely.\n\nNote: smc_hs_congested() has a similar lockless read of\nsk_user_data without rcu_read_lock(), but it only checks for\nNULL and accesses the global smc_hs_wq, never dereferencing\nany smc_sock field, so it is not affected.\n\nReproducer was verified with mdelay injection and smc_run,\nthe issue no longer occurs with this patch applied.\n\n[1] https://syzkaller.appspot.com/bug?extid=827ae2bfb3a3529333e9(CVE-2026-23450)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nPM: runtime: Fix a race condition related to device removal\n\nThe following code in pm_runtime_work() may dereference the dev-\u0026gt;parent\npointer after the parent device has been freed:\n\n\t/* Maybe the parent is now able to suspend. */\n\tif (parent \u0026amp;\u0026amp; !parent-\u0026gt;power.ignore_children) {\n\t\tspin_unlock(\u0026amp;dev-\u0026gt;power.lock);\n\n\t\tspin_lock(\u0026amp;parent-\u0026gt;power.lock);\n\t\trpm_idle(parent, RPM_ASYNC);\n\t\tspin_unlock(\u0026amp;parent-\u0026gt;power.lock);\n\n\t\tspin_lock(\u0026amp;dev-\u0026gt;power.lock);\n\t}\n\nFix this by inserting a flush_work() call in pm_runtime_remove().\n\nWithout this patch blktest block/001 triggers the following complaint\nsporadically:\n\nBUG: KASAN: slab-use-after-free in lock_acquire+0x70/0x160\nRead of size 1 at addr ffff88812bef7198 by task kworker/u553:1/3081\nWorkqueue: pm pm_runtime_work\nCall Trace:\n \u0026lt;TASK\u0026gt;\n dump_stack_lvl+0x61/0x80\n print_address_description.constprop.0+0x8b/0x310\n print_report+0xfd/0x1d7\n kasan_report+0xd8/0x1d0\n __kasan_check_byte+0x42/0x60\n lock_acquire.part.0+0x38/0x230\n lock_acquire+0x70/0x160\n _raw_spin_lock+0x36/0x50\n rpm_suspend+0xc6a/0xfe0\n rpm_idle+0x578/0x770\n pm_runtime_work+0xee/0x120\n process_one_work+0xde3/0x1410\n worker_thread+0x5eb/0xfe0\n kthread+0x37b/0x480\n ret_from_fork+0x6cb/0x920\n ret_from_fork_asm+0x11/0x20\n \u0026lt;/TASK\u0026gt;\n\nAllocated by task 4314:\n kasan_save_stack+0x2a/0x50\n kasan_save_track+0x18/0x40\n kasan_save_alloc_info+0x3d/0x50\n __kasan_kmalloc+0xa0/0xb0\n __kmalloc_noprof+0x311/0x990\n scsi_alloc_target+0x122/0xb60 [scsi_mod]\n __scsi_scan_target+0x101/0x460 [scsi_mod]\n scsi_scan_channel+0x179/0x1c0 [scsi_mod]\n scsi_scan_host_selected+0x259/0x2d0 [scsi_mod]\n store_scan+0x2d2/0x390 [scsi_mod]\n dev_attr_store+0x43/0x80\n sysfs_kf_write+0xde/0x140\n kernfs_fop_write_iter+0x3ef/0x670\n vfs_write+0x506/0x1470\n ksys_write+0xfd/0x230\n __x64_sys_write+0x76/0xc0\n x64_sys_call+0x213/0x1810\n do_syscall_64+0xee/0xfc0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\nFreed by task 4314:\n kasan_save_stack+0x2a/0x50\n kasan_save_track+0x18/0x40\n kasan_save_free_info+0x3f/0x50\n __kasan_slab_free+0x67/0x80\n kfree+0x225/0x6c0\n scsi_target_dev_release+0x3d/0x60 [scsi_mod]\n device_release+0xa3/0x220\n kobject_cleanup+0x105/0x3a0\n kobject_put+0x72/0xd0\n put_device+0x17/0x20\n scsi_device_dev_release+0xacf/0x12c0 [scsi_mod]\n device_release+0xa3/0x220\n kobject_cleanup+0x105/0x3a0\n kobject_put+0x72/0xd0\n put_device+0x17/0x20\n scsi_device_put+0x7f/0xc0 [scsi_mod]\n sdev_store_delete+0xa5/0x120 [scsi_mod]\n dev_attr_store+0x43/0x80\n sysfs_kf_write+0xde/0x140\n kernfs_fop_write_iter+0x3ef/0x670\n vfs_write+0x506/0x1470\n ksys_write+0xfd/0x230\n __x64_sys_write+0x76/0xc0\n x64_sys_call+0x213/0x1810(CVE-2026-23452)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user\n\nAfter commit ab4eedb790ca (\u0026quot;Bluetooth: L2CAP: Fix corrupted list in\nhci_chan_del\u0026quot;), l2cap_conn_del() uses conn-\u0026gt;lock to protect access to\nconn-\u0026gt;users. However, l2cap_register_user() and l2cap_unregister_user()\ndon\u0026apos;t use conn-\u0026gt;lock, creating a race condition where these functions can\naccess conn-\u0026gt;users and conn-\u0026gt;hchan concurrently with l2cap_conn_del().\n\nThis can lead to use-after-free and list corruption bugs, as reported\nby syzbot.\n\nFix this by changing l2cap_register_user() and l2cap_unregister_user()\nto use conn-\u0026gt;lock instead of hci_dev_lock(), ensuring consistent locking\nfor the l2cap_conn structure.(CVE-2026-23461)\n\nRejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.(CVE-2026-23473)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nspi: fix statistics allocation\n\nThe controller per-cpu statistics is not allocated until after the\ncontroller has been registered with driver core, which leaves a window\nwhere accessing the sysfs attributes can trigger a NULL-pointer\ndereference.\n\nFix this by moving the statistics allocation to controller allocation\nwhile tying its lifetime to that of the controller (rather than using\nimplicit devres).(CVE-2026-23475)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix krb5 mount with username option\n\nCustomer reported that some of their krb5 mounts were failing against\na single server as the client was trying to mount the shares with\nwrong credentials.  It turned out the client was reusing SMB session\nfrom first mount to try mounting the other shares, even though a\ndifferent username= option had been specified to the other mounts.\n\nBy using username mount option along with sec=krb5 to search for\nprincipals from keytab is supported by cifs.upcall(8) since\ncifs-utils-4.8.  So fix this by matching username mount option in\nmatch_session() even with Kerberos.\n\nFor example, the second mount below should fail with -ENOKEY as there\nis no \u0026apos;foobar\u0026apos; principal in keytab (/etc/krb5.keytab).  The client\nends up reusing SMB session from first mount to perform the second\none, which is wrong.\n\n```\n$ ktutil\nktutil:  add_entry -password -p testuser -k 1 -e aes256-cts\nPassword for (CVE-2026-31392)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/rmap: fix incorrect pte restoration for lazyfree folios\n\nWe batch unmap anonymous lazyfree folios by folio_unmap_pte_batch.  If the\nbatch has a mix of writable and non-writable bits, we may end up setting\nthe entire batch writable.  Fix this by respecting writable bit during\nbatching.\n\nAlthough on a successful unmap of a lazyfree folio, the soft-dirty bit is\nlost, preserve it on pte restoration by respecting the bit during\nbatching, to make the fix consistent w.r.t both writable bit and\nsoft-dirty bit.\n\nI was able to write the below reproducer and crash the kernel. \nExplanation of reproducer (set 64K mTHP to always):\n\nFault in a 64K large folio.  Split the VMA at mid-point with\nMADV_DONTFORK.  fork() - parent points to the folio with 8 writable ptes\nand 8 non-writable ptes.  Merge the VMAs with MADV_DOFORK so that\nfolio_unmap_pte_batch() can determine all the 16 ptes as a batch.  Do\nMADV_FREE on the range to mark the folio as lazyfree.  Write to the memory\nto dirty the pte, eventually rmap will dirty the folio.  Then trigger\nreclaim, we will hit the pte restoration path, and the kernel will crash\nwith the trace given below.\n\nThe BUG happens at:\n\n\tBUG_ON(atomic_inc_return(\u0026amp;ptc-\u0026gt;anon_map_count) \u0026gt; 1 \u0026amp;\u0026amp; rw);\n\nThe code path is asking for anonymous page to be mapped writable into the\npagetable.  The BUG_ON() firing implies that such a writable page has been\nmapped into the pagetables of more than one process, which breaks\nanonymous memory/CoW semantics.\n\n[   21.134473] kernel BUG at mm/page_table_check.c:118!\n[   21.134497] Internal error: Oops - BUG: 00000000f2000800 [#1]  SMP\n[   21.135917] Modules linked in:\n[   21.136085] CPU: 1 UID: 0 PID: 1735 Comm: dup-lazyfree Not tainted 7.0.0-rc1-00116-g018018a17770 #1028 PREEMPT\n[   21.136858] Hardware name: linux,dummy-virt (DT)\n[   21.137019] pstate: 21400005 (nzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\n[   21.137308] pc : page_table_check_set+0x28c/0x2a8\n[   21.137607] lr : page_table_check_set+0x134/0x2a8\n[   21.137885] sp : ffff80008a3b3340\n[   21.138124] x29: ffff80008a3b3340 x28: fffffdffc3d14400 x27: ffffd1a55e03d000\n[   21.138623] x26: 0040000000000040 x25: ffffd1a55f7dd000 x24: 0000000000000001\n[   21.139045] x23: 0000000000000001 x22: 0000000000000001 x21: ffffd1a55f217f30\n[   21.139629] x20: 0000000000134521 x19: 0000000000134519 x18: 005c43e000040000\n[   21.140027] x17: 0001400000000000 x16: 0001700000000000 x15: 000000000000ffff\n[   21.140578] x14: 000000000000000c x13: 005c006000000000 x12: 0000000000000020\n[   21.140828] x11: 0000000000000000 x10: 005c000000000000 x9 : ffffd1a55c079ee0\n[   21.141077] x8 : 0000000000000001 x7 : 005c03e000040000 x6 : 000000004000ffff\n[   21.141490] x5 : ffff00017fffce00 x4 : 0000000000000001 x3 : 0000000000000002\n[   21.141741] x2 : 0000000000134510 x1 : 0000000000000000 x0 : ffff0000c08228c0\n[   21.141991] Call trace:\n[   21.142093]  page_table_check_set+0x28c/0x2a8 (P)\n[   21.142265]  __page_table_check_ptes_set+0x144/0x1e8\n[   21.142441]  __set_ptes_anysz.constprop.0+0x160/0x1a8\n[   21.142766]  contpte_set_ptes+0xe8/0x140\n[   21.142907]  try_to_unmap_one+0x10c4/0x10d0\n[   21.143177]  rmap_walk_anon+0x100/0x250\n[   21.143315]  try_to_unmap+0xa0/0xc8\n[   21.143441]  shrink_folio_list+0x59c/0x18a8\n[   21.143759]  shrink_lruvec+0x664/0xbf0\n[   21.144043]  shrink_node+0x218/0x878\n[   21.144285]  __node_reclaim.constprop.0+0x98/0x338\n[   21.144763]  user_proactive_reclaim+0x2a4/0x340\n[   21.145056]  reclaim_store+0x3c/0x60\n[   21.145216]  dev_attr_store+0x20/0x40\n[   21.145585]  sysfs_kf_write+0x84/0xa8\n[   21.145835]  kernfs_fop_write_iter+0x130/0x1c8\n[   21.145994]  vfs_write+0x2b8/0x368\n[   21.146119]  ksys_write+0x70/0x110\n[   21.146240]  __arm64_sys_write+0x24/0x38\n[   21.146380]  invoke_syscall+0x50/0x120\n[   21.146513]  el0_svc_common.constprop.0+0x48/0xf8\n[   21.146679]  do_el0_svc+0x28/0x40\n[   21.146798]  el0_svc+0x34/0x110\n[   21.146926]  el0t\n---truncated---(CVE-2026-31398)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvdimm/bus: Fix potential use after free in asynchronous initialization\n\nDingisoul with KASAN reports a use after free if device_add() fails in\nnd_async_device_register().\n\nCommit b6eae0f61db2 (\u0026quot;libnvdimm: Hold reference on parent while\nscheduling async init\u0026quot;) correctly added a reference on the parent device\nto be held until asynchronous initialization was complete.  However, if\ndevice_add() results in an allocation failure the ref count of the\ndevice drops to 0 prior to the parent pointer being accessed.  Thus\nresulting in use after free.\n\nThe bug bot AI correctly identified the fix.  Save a reference to the\nparent pointer to be used to drop the parent reference regardless of the\noutcome of device_add().(CVE-2026-31399)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: fix cache_request leak in cache_release\n\nWhen a reader\u0026apos;s file descriptor is closed while in the middle of reading\na cache_request (rp-\u0026gt;offset != 0), cache_release() decrements the\nrequest\u0026apos;s readers count but never checks whether it should free the\nrequest.\n\nIn cache_read(), when readers drops to 0 and CACHE_PENDING is clear, the\ncache_request is removed from the queue and freed along with its buffer\nand cache_head reference. cache_release() lacks this cleanup.\n\nThe only other path that frees requests with readers == 0 is\ncache_dequeue(), but it runs only when CACHE_PENDING transitions from\nset to clear. If that transition already happened while readers was\nstill non-zero, cache_dequeue() will have skipped the request, and no\nsubsequent call will clean it up.\n\nAdd the same cleanup logic from cache_read() to cache_release(): after\ndecrementing readers, check if it reached 0 with CACHE_PENDING clear,\nand if so, dequeue and free the cache_request.(CVE-2026-31400)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd\n\nThe /proc/fs/nfs/exports proc entry is created at module init\nand persists for the module\u0026apos;s lifetime. exports_proc_open()\ncaptures the caller\u0026apos;s current network namespace and stores\nits svc_export_cache in seq-\u0026gt;private, but takes no reference\non the namespace. If the namespace is subsequently torn down\n(e.g. container destruction after the opener does setns() to a\ndifferent namespace), nfsd_net_exit() calls nfsd_export_shutdown()\nwhich frees the cache. Subsequent reads on the still-open fd\ndereference the freed cache_detail, walking a freed hash table.\n\nHold a reference on the struct net for the lifetime of the open\nfile descriptor. This prevents nfsd_net_exit() from running --\nand thus prevents nfsd_export_shutdown() from freeing the cache\n-- while any exports fd is open. cache_detail already stores\nits net pointer (cd-\u0026gt;net, set by cache_create_net()), so\nexports_release() can retrieve it without additional per-file\nstorage.(CVE-2026-31403)\n\nIn the Linux kernel, the Bluetooth SCO module\u0026apos;s sco_recv_frame() function contains a use-after-free vulnerability. The function reads conn-\u0026gt;sk under sco_conn_lock() but immediately releases the lock without holding a reference to the socket. A concurrent close() operation can free the socket between the lock release and the subsequent sk-\u0026gt;sk_state access, resulting in a use-after-free vulnerability. Other functions in the same file (sco_sock_timeout(), sco_conn_del()) correctly use sco_sock_hold() to safely hold references under the lock. The vulnerability is fixed by using sco_sock_hold() to acquire a reference before releasing the lock and adding sock_put() on all exit paths.(CVE-2026-31408)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_fw: fix NULL pointer dereference on shared blocks\n\nThe old-method path in fw_classify() calls tcf_block_q() and\ndereferences q-\u0026gt;handle.  Shared blocks leave block-\u0026gt;q NULL, causing a\nNULL deref when an empty cls_fw filter is attached to a shared block\nand a packet with a nonzero major skb mark is classified.\n\nReject the configuration in fw_change() when the old method (no\nTCA_OPTIONS) is used on a shared block, since fw_classify()\u0026apos;s\nold-method path needs block-\u0026gt;q which is NULL for shared blocks.\n\nThe fixed null-ptr-deref calling stack:\n KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f]\n RIP: 0010:fw_classify (net/sched/cls_fw.c:81)\n Call Trace:\n  tcf_classify (./include/net/tc_wrapper.h:197 net/sched/cls_api.c:1764 net/sched/cls_api.c:1860)\n  tc_run (net/core/dev.c:4401)\n  __dev_queue_xmit (net/core/dev.c:4535 net/core/dev.c:4790)(CVE-2026-31421)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_flow: fix NULL pointer dereference on shared blocks\n\nflow_change() calls tcf_block_q() and dereferences q-\u0026gt;handle to derive\na default baseclass.  Shared blocks leave block-\u0026gt;q NULL, causing a NULL\nderef when a flow filter without a fully qualified baseclass is created\non a shared block.\n\nCheck tcf_block_shared() before accessing block-\u0026gt;q and return -EINVAL\nfor shared blocks.  This avoids the null-deref shown below:\n\n=======================================================================\nKASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f]\nRIP: 0010:flow_change (net/sched/cls_flow.c:508)\nCall Trace:\n tc_new_tfilter (net/sched/cls_api.c:2432)\n rtnetlink_rcv_msg (net/core/rtnetlink.c:6980)\n [...]\n=======================================================================(CVE-2026-31422)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nACPI: EC: clean up handlers on probe failure in acpi_ec_setup()\n\nWhen ec_install_handlers() returns -EPROBE_DEFER on reduced-hardware\nplatforms, it has already started the EC and installed the address\nspace handler with the struct acpi_ec pointer as handler context.\nHowever, acpi_ec_setup() propagates the error without any cleanup.\n\nThe caller acpi_ec_add() then frees the struct acpi_ec for non-boot\ninstances, leaving a dangling handler context in ACPICA.\n\nAny subsequent AML evaluation that accesses an EC OpRegion field\ndispatches into acpi_ec_space_handler() with the freed pointer,\ncausing a use-after-free:\n\n BUG: KASAN: slab-use-after-free in mutex_lock (kernel/locking/mutex.c:289)\n Write of size 8 at addr ffff88800721de38 by task init/1\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  mutex_lock (kernel/locking/mutex.c:289)\n  acpi_ec_space_handler (drivers/acpi/ec.c:1362)\n  acpi_ev_address_space_dispatch (drivers/acpi/acpica/evregion.c:293)\n  acpi_ex_access_region (drivers/acpi/acpica/exfldio.c:246)\n  acpi_ex_field_datum_io (drivers/acpi/acpica/exfldio.c:509)\n  acpi_ex_extract_from_field (drivers/acpi/acpica/exfldio.c:700)\n  acpi_ex_read_data_from_field (drivers/acpi/acpica/exfield.c:327)\n  acpi_ex_resolve_node_to_value (drivers/acpi/acpica/exresolv.c:392)\n  \u0026lt;/TASK\u0026gt;\n\n Allocated by task 1:\n  acpi_ec_alloc (drivers/acpi/ec.c:1424)\n  acpi_ec_add (drivers/acpi/ec.c:1692)\n\n Freed by task 1:\n  kfree (mm/slub.c:6876)\n  acpi_ec_add (drivers/acpi/ec.c:1751)\n\nThe bug triggers on reduced-hardware EC platforms (ec-\u0026gt;gpe \u0026lt; 0)\nwhen the GPIO IRQ provider defers probing. Once the stale handler\nexists, any unprivileged sysfs read that causes AML to touch an\nEC OpRegion (battery, thermal, backlight) exercises the dangling\npointer.\n\nFix this by calling ec_remove_handlers() in the error path of\nacpi_ec_setup() before clearing first_ec. ec_remove_handlers()\nchecks each EC_FLAGS_* bit before acting, so it is safe to call\nregardless of how far ec_install_handlers() progressed:\n\n  -ENODEV  (handler not installed): only calls acpi_ec_stop()\n  -EPROBE_DEFER (handler installed): removes handler, stops EC(CVE-2026-31426)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: skb: fix cross-cache free of KFENCE-allocated skb head\n\nSKB_SMALL_HEAD_CACHE_SIZE is intentionally set to a non-power-of-2\nvalue (e.g. 704 on x86_64) to avoid collisions with generic kmalloc\nbucket sizes. This ensures that skb_kfree_head() can reliably use\nskb_end_offset to distinguish skb heads allocated from\nskb_small_head_cache vs. generic kmalloc caches.\n\nHowever, when KFENCE is enabled, kfence_ksize() returns the exact\nrequested allocation size instead of the slab bucket size. If a caller\n(e.g. bpf_test_init) allocates skb head data via kzalloc() and the\nrequested size happens to equal SKB_SMALL_HEAD_CACHE_SIZE, then\nslab_build_skb() -\u0026gt; ksize() returns that exact value. After subtracting\nskb_shared_info overhead, skb_end_offset ends up matching\nSKB_SMALL_HEAD_HEADROOM, causing skb_kfree_head() to incorrectly free\nthe object to skb_small_head_cache instead of back to the original\nkmalloc cache, resulting in a slab cross-cache free:\n\n  kmem_cache_free(skbuff_small_head): Wrong slab cache. Expected\n  skbuff_small_head but got kmalloc-1k\n\nFix this by always calling kfree(head) in skb_kfree_head(). This keeps\nthe free path generic and avoids allocator-specific misclassification\nfor KFENCE objects.(CVE-2026-31429)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nX.509: Fix out-of-bounds access when parsing extensions\n\nLeo reports an out-of-bounds access when parsing a certificate with\nempty Basic Constraints or Key Usage extension because the first byte of\nthe extension is read before checking its length.  Fix it.\n\nThe bug can be triggered by an unprivileged user by submitting a\nspecially crafted certificate to the kernel through the keyrings(7) API.\nLeo has demonstrated this with a proof-of-concept program responsibly\ndisclosed off-list.(CVE-2026-31430)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: Fix memory leak when a wq is reset\n\nidxd_wq_disable_cleanup() which is called from the reset path for a\nworkqueue, sets the wq type to NONE, which for other parts of the\ndriver mean that the wq is empty (all its resources were released).\n\nOnly set the wq type to NONE after its resources are released.(CVE-2026-31441)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: Fix possible invalid memory access after FLR\n\nIn the case that the first Function Level Reset (FLR) concludes\ncorrectly, but in the second FLR the scratch area for the saved\nconfiguration cannot be allocated, it\u0026apos;s possible for a invalid memory\naccess to happen.\n\nAlways set the deallocated scratch area to NULL after FLR completes.(CVE-2026-31442)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\next4: fix use-after-free in update_super_work when racing with umount\n\nCommit b98535d09179 (\u0026quot;ext4: fix bug_on in start_this_handle during umount\nfilesystem\u0026quot;) moved ext4_unregister_sysfs() before flushing s_sb_upd_work\nto prevent new error work from being queued via /proc/fs/ext4/xx/mb_groups\nreads during unmount. However, this introduced a use-after-free because\nupdate_super_work calls ext4_notify_error_sysfs() -\u0026gt; sysfs_notify() which\naccesses the kobject\u0026apos;s kernfs_node after it has been freed by kobject_del()\nin ext4_unregister_sysfs():\n\n  update_super_work                ext4_put_super\n  -----------------                --------------\n                                   ext4_unregister_sysfs(sb)\n                                     kobject_del(\u0026amp;sbi-\u0026gt;s_kobj)\n                                       __kobject_del()\n                                         sysfs_remove_dir()\n                                           kobj-\u0026gt;sd = NULL\n                                         sysfs_put(sd)\n                                           kernfs_put()  // RCU free\n  ext4_notify_error_sysfs(sbi)\n    sysfs_notify(\u0026amp;sbi-\u0026gt;s_kobj)\n      kn = kobj-\u0026gt;sd              // stale pointer\n      kernfs_get(kn)             // UAF on freed kernfs_node\n                                   ext4_journal_destroy()\n                                     flush_work(\u0026amp;sbi-\u0026gt;s_sb_upd_work)\n\nInstead of reordering the teardown sequence, fix this by making\next4_notify_error_sysfs() detect that sysfs has already been torn down\nby checking s_kobj.state_in_sysfs, and skipping the sysfs_notify() call\nin that case. A dedicated mutex (s_error_notify_mutex) serializes\next4_notify_error_sysfs() against kobject_del() in ext4_unregister_sysfs()\nto prevent TOCTOU races where the kobject could be deleted between the\nstate_in_sysfs check and the sysfs_notify() call.(CVE-2026-31446)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\next4: validate p_idx bounds in ext4_ext_correct_indexes\n\next4_ext_correct_indexes() walks up the extent tree correcting\nindex entries when the first extent in a leaf is modified. Before\naccessing path[k].p_idx-\u0026gt;ei_block, there is no validation that\np_idx falls within the valid range of index entries for that\nlevel.\n\nIf the on-disk extent header contains a corrupted or crafted\neh_entries value, p_idx can point past the end of the allocated\nbuffer, causing a slab-out-of-bounds read.\n\nFix this by validating path[k].p_idx against EXT_LAST_INDEX() at\nboth access sites: before the while loop and inside it. Return\n-EFSCORRUPTED if the index pointer is out of range, consistent\nwith how other bounds violations are handled in the ext4 extent\ntree code.(CVE-2026-31449)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\next4: publish jinode after initialization\n\next4_inode_attach_jinode() publishes ei-\u0026gt;jinode to concurrent users.\nIt used to set ei-\u0026gt;jinode before jbd2_journal_init_jbd_inode(),\nallowing a reader to observe a non-NULL jinode with i_vfs_inode\nstill unset.\n\nThe fast commit flush path can then pass this jinode to\njbd2_wait_inode_data(), which dereferences i_vfs_inode-\u0026gt;i_mapping and\nmay crash.\n\nBelow is the crash I observe:\n```\nBUG: unable to handle page fault for address: 000000010beb47f4\nPGD 110e51067 P4D 110e51067 PUD 0\nOops: Oops: 0000 [#1] SMP NOPTI\nCPU: 1 UID: 0 PID: 4850 Comm: fc_fsync_bench_ Not tainted 6.18.0-00764-g795a690c06a5 #1 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.17.0-2-2 04/01/2014\nRIP: 0010:xas_find_marked+0x3d/0x2e0\nCode: e0 03 48 83 f8 02 0f 84 f0 01 00 00 48 8b 47 08 48 89 c3 48 39 c6 0f 82 fd 01 00 00 48 85 c9 74 3d 48 83 f9 03 77 63 4c 8b 0f \u0026lt;49\u0026gt; 8b 71 08 48 c7 47 18 00 00 00 00 48 89 f1 83 e1 03 48 83 f9 02\nRSP: 0018:ffffbbee806e7bf0 EFLAGS: 00010246\nRAX: 000000000010beb4 RBX: 000000000010beb4 RCX: 0000000000000003\nRDX: 0000000000000001 RSI: 0000002000300000 RDI: ffffbbee806e7c10\nRBP: 0000000000000001 R08: 0000002000300000 R09: 000000010beb47ec\nR10: ffff9ea494590090 R11: 0000000000000000 R12: 0000002000300000\nR13: ffffbbee806e7c90 R14: ffff9ea494513788 R15: ffffbbee806e7c88\nFS: 00007fc2f9e3e6c0(0000) GS:ffff9ea6b1444000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000000010beb47f4 CR3: 0000000119ac5000 CR4: 0000000000750ef0\nPKRU: 55555554\nCall Trace:\n\u0026lt;TASK\u0026gt;\nfilemap_get_folios_tag+0x87/0x2a0\n__filemap_fdatawait_range+0x5f/0xd0\n? srso_alias_return_thunk+0x5/0xfbef5\n? __schedule+0x3e7/0x10c0\n? srso_alias_return_thunk+0x5/0xfbef5\n? srso_alias_return_thunk+0x5/0xfbef5\n? srso_alias_return_thunk+0x5/0xfbef5\n? preempt_count_sub+0x5f/0x80\n? srso_alias_return_thunk+0x5/0xfbef5\n? cap_safe_nice+0x37/0x70\n? srso_alias_return_thunk+0x5/0xfbef5\n? preempt_count_sub+0x5f/0x80\n? srso_alias_return_thunk+0x5/0xfbef5\nfilemap_fdatawait_range_keep_errors+0x12/0x40\next4_fc_commit+0x697/0x8b0\n? ext4_file_write_iter+0x64b/0x950\n? srso_alias_return_thunk+0x5/0xfbef5\n? preempt_count_sub+0x5f/0x80\n? srso_alias_return_thunk+0x5/0xfbef5\n? vfs_write+0x356/0x480\n? srso_alias_return_thunk+0x5/0xfbef5\n? preempt_count_sub+0x5f/0x80\next4_sync_file+0xf7/0x370\ndo_fsync+0x3b/0x80\n? syscall_trace_enter+0x108/0x1d0\n__x64_sys_fdatasync+0x16/0x20\ndo_syscall_64+0x62/0x2c0\nentry_SYSCALL_64_after_hwframe+0x76/0x7e\n...\n```\n\nFix this by initializing the jbd2_inode first.\nUse smp_wmb() and WRITE_ONCE() to publish ei-\u0026gt;jinode after\ninitialization. Readers use READ_ONCE() to fetch the pointer.(CVE-2026-31450)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\next4: replace BUG_ON with proper error handling in ext4_read_inline_folio\n\nReplace BUG_ON() with proper error handling when inline data size\nexceeds PAGE_SIZE. This prevents kernel panic and allows the system to\ncontinue running while properly reporting the filesystem corruption.\n\nThe error is logged via ext4_error_inode(), the buffer head is released\nto prevent memory leak, and -EFSCORRUPTED is returned to indicate\nfilesystem corruption.(CVE-2026-31451)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\next4: convert inline data to extents when truncate exceeds inline size\n\nAdd a check in ext4_setattr() to convert files from inline data storage\nto extent-based storage when truncate() grows the file size beyond the\ninline capacity. This prevents the filesystem from entering an\ninconsistent state where the inline data flag is set but the file size\nexceeds what can be stored inline.\n\nWithout this fix, the following sequence causes a kernel BUG_ON():\n\n1. Mount filesystem with inode that has inline flag set and small size\n2. truncate(file, 50MB) - grows size but inline flag remains set\n3. sendfile() attempts to write data\n4. ext4_write_inline_data() hits BUG_ON(write_size \u0026gt; inline_capacity)\n\nThe crash occurs because ext4_write_inline_data() expects inline storage\nto accommodate the write, but the actual inline capacity (~60 bytes for\ni_block + ~96 bytes for xattrs) is far smaller than the file size and\nwrite request.\n\nThe fix checks if the new size from setattr exceeds the inode\u0026apos;s actual\ninline capacity (EXT4_I(inode)-\u0026gt;i_inline_size) and converts the file to\nextent-based storage before proceeding with the size change.\n\nThis addresses the root cause by ensuring the inline data flag and file\nsize remain consistent during truncate operations.(CVE-2026-31452)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nerofs: add GFP_NOIO in the bio completion if needed\n\nThe bio completion path in the process context (e.g. dm-verity)\nwill directly call into decompression rather than trigger another\nworkqueue context for minimal scheduling latencies, which can\nthen call vm_map_ram() with GFP_KERNEL.\n\nDue to insufficient memory, vm_map_ram() may generate memory\nswapping I/O, which can cause submit_bio_wait to deadlock\nin some scenarios.\n\nTrimmed down the call stack, as follows:\n\nf2fs_submit_read_io\n  submit_bio                      //bio_list is initialized.\n    mmc_blk_mq_recovery\n      z_erofs_endio\n        vm_map_ram\n          __pte_alloc_kernel\n            __alloc_pages_direct_reclaim\n              shrink_folio_list\n                __swap_writepage\n                  submit_bio_wait  //bio_list is non-NULL, hang!!!\n\nUse memalloc_noio_{save,restore}() to wrap up this path.(CVE-2026-31467)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false\n\nA UAF issue occurs when the virtio_net driver is configured with napi_tx=N\nand the device\u0026apos;s IFF_XMIT_DST_RELEASE flag is cleared\n(e.g., during the configuration of tc route filter rules).\n\nWhen IFF_XMIT_DST_RELEASE is removed from the net_device, the network stack\nexpects the driver to hold the reference to skb-\u0026gt;dst until the packet\nis fully transmitted and freed. In virtio_net with napi_tx=N,\nskbs may remain in the virtio transmit ring for an extended period.\n\nIf the network namespace is destroyed while these skbs are still pending,\nthe corresponding dst_ops structure has freed. When a subsequent packet\nis transmitted, free_old_xmit() is triggered to clean up old skbs.\nIt then calls dst_release() on the skb associated with the stale dst_entry.\nSince the dst_ops (referenced by the dst_entry) has already been freed,\na UAF kernel paging request occurs.\n\nfix it by adds skb_dst_drop(skb) in start_xmit to explicitly release\nthe dst reference before the skb is queued in virtio_net.\n\nCall Trace:\n Unable to handle kernel paging request at virtual address ffff80007e150000\n CPU: 2 UID: 0 PID: 6236 Comm: ping Kdump: loaded Not tainted 7.0.0-rc1+ #6 PREEMPT\n  ...\n  percpu_counter_add_batch+0x3c/0x158 lib/percpu_counter.c:98 (P)\n  dst_release+0xe0/0x110  net/core/dst.c:177\n  skb_release_head_state+0xe8/0x108 net/core/skbuff.c:1177\n  sk_skb_reason_drop+0x54/0x2d8 net/core/skbuff.c:1255\n  dev_kfree_skb_any_reason+0x64/0x78 net/core/dev.c:3469\n  napi_consume_skb+0x1c4/0x3a0 net/core/skbuff.c:1527\n  __free_old_xmit+0x164/0x230  drivers/net/virtio_net.c:611 [virtio_net]\n  free_old_xmit drivers/net/virtio_net.c:1081 [virtio_net]\n  start_xmit+0x7c/0x530 drivers/net/virtio_net.c:3329 [virtio_net]\n  ...\n\nReproduction Steps:\nNETDEV=\u0026quot;enp3s0\u0026quot;\n\nconfig_qdisc_route_filter() {\n    tc qdisc del dev $NETDEV root\n    tc qdisc add dev $NETDEV root handle 1: prio\n    tc filter add dev $NETDEV parent 1:0 \\\n\tprotocol ip prio 100 route to 100 flowid 1:1\n    ip route add 192.168.1.100/32 dev $NETDEV realm 100\n}\n\ntest_ns() {\n    ip netns add testns\n    ip link set $NETDEV netns testns\n    ip netns exec testns ifconfig $NETDEV  10.0.32.46/24\n    ip netns exec testns ping -c 1 10.0.32.1\n    ip netns del testns\n}\n\nconfig_qdisc_route_filter\n\ntest_ns\nsleep 2\ntest_ns(CVE-2026-31469)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nspi: use generic driver_override infrastructure\n\nWhen a driver is probed through __driver_attach(), the bus\u0026apos; match()\ncallback is called without the device lock held, thus accessing the\ndriver_override field without a lock, which can cause a UAF.\n\nFix this by using the driver-core driver_override infrastructure taking\ncare of proper locking internally.\n\nNote that calling match() from __driver_attach() without the device lock\nheld is intentional. [1]\n\nAlso note that we do not enable the driver_override feature of struct\nbus_type, as SPI - in contrast to most other buses - passes \u0026quot;\u0026quot; to\nsysfs_emit() when the driver_override pointer is NULL. Thus, printing\n\u0026quot;\\n\u0026quot; instead of \u0026quot;(null)\\n\u0026quot;.(CVE-2026-31487)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ctnetlink: use netlink policy range checks\n\nReplace manual range and mask validations with netlink policy\nannotations in ctnetlink code paths, so that the netlink core rejects\ninvalid values early and can generate extack errors.\n\n- CTA_PROTOINFO_TCP_STATE: reject values \u0026gt; TCP_CONNTRACK_SYN_SENT2 at\n  policy level, removing the manual \u0026gt;= TCP_CONNTRACK_MAX check.\n- CTA_PROTOINFO_TCP_WSCALE_ORIGINAL/REPLY: reject values \u0026gt; TCP_MAX_WSCALE\n  (14). The normal TCP option parsing path already clamps to this value,\n  but the ctnetlink path accepted 0-255, causing undefined behavior when\n  used as a u32 shift count.\n- CTA_FILTER_ORIG_FLAGS/REPLY_FLAGS: use NLA_POLICY_MASK with\n  CTA_FILTER_F_ALL, removing the manual mask checks.\n- CTA_EXPECT_FLAGS: use NLA_POLICY_MASK with NF_CT_EXPECT_MASK, adding\n  a new mask define grouping all valid expect flags.\n\nExtracted from a broader nf-next patch by Florian Westphal, scoped to\nctnetlink for the fixes tree.(CVE-2026-31495)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_expect: skip expectations in other netns via proc\n\nSkip expectations that do not reside in this netns.\n\nSimilar to e77e6ff502ea (\u0026quot;netfilter: conntrack: do not dump other netns\u0026apos;s\nconntrack entries via proc\u0026quot;).(CVE-2026-31496)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop\n\nl2cap_config_req() processes CONFIG_REQ for channels in BT_CONNECTED\nstate to support L2CAP reconfiguration (e.g. MTU changes). However,\nsince both CONF_INPUT_DONE and CONF_OUTPUT_DONE are already set from\nthe initial configuration, the reconfiguration path falls through to\nl2cap_ertm_init(), which re-initializes tx_q, srej_q, srej_list, and\nretrans_list without freeing the previous allocations and sets\nchan-\u0026gt;sdu to NULL without freeing the existing skb. This leaks all\npreviously allocated ERTM resources.\n\nAdditionally, l2cap_parse_conf_req() does not validate the minimum\nvalue of remote_mps derived from the RFC max_pdu_size option. A zero\nvalue propagates to l2cap_segment_sdu() where pdu_len becomes zero,\ncausing the while loop to never terminate since len is never\ndecremented, exhausting all available memory.\n\nFix the double-init by skipping l2cap_ertm_init() and\nl2cap_chan_ready() when the channel is already in BT_CONNECTED state,\nwhile still allowing the reconfiguration parameters to be updated\nthrough l2cap_parse_conf_req(). Also add a pdu_len zero check in\nl2cap_segment_sdu() as a safeguard.(CVE-2026-31498)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix deadlock in l2cap_conn_del()\n\nl2cap_conn_del() calls cancel_delayed_work_sync() for both info_timer\nand id_addr_timer while holding conn-\u0026gt;lock. However, the work functions\nl2cap_info_timeout() and l2cap_conn_update_id_addr() both acquire\nconn-\u0026gt;lock, creating a potential AB-BA deadlock if the work is already\nexecuting when l2cap_conn_del() takes the lock.\n\nMove the work cancellations before acquiring conn-\u0026gt;lock and use\ndisable_delayed_work_sync() to additionally prevent the works from\nbeing rearmed after cancellation, consistent with the pattern used in\nhci_conn_del().(CVE-2026-31499)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niavf: fix out-of-bounds writes in iavf_get_ethtool_stats()\n\niavf incorrectly uses real_num_tx_queues for ETH_SS_STATS. Since the\nvalue could change in runtime, we should use num_tx_queues instead.\n\nMoreover iavf_get_ethtool_stats() uses num_active_queues while\niavf_get_sset_count() and iavf_get_stat_strings() use\nreal_num_tx_queues, which triggers out-of-bounds writes when we do\n\u0026quot;ethtool -L\u0026quot; and \u0026quot;ethtool -S\u0026quot; simultaneously [1].\n\nFor example when we change channels from 1 to 8, Thread 3 could be\nscheduled before Thread 2, and out-of-bounds writes could be triggered\nin Thread 3:\n\nThread 1 (ethtool -L)       Thread 2 (work)        Thread 3 (ethtool -S)\niavf_set_channels()\n...\niavf_alloc_queues()\n-\u0026gt; num_active_queues = 8\niavf_schedule_finish_config()\n                                                   iavf_get_sset_count()\n                                                   real_num_tx_queues: 1\n                                                   -\u0026gt; buffer for 1 queue\n                                                   iavf_get_ethtool_stats()\n                                                   num_active_queues: 8\n                                                   -\u0026gt; out-of-bounds!\n                            iavf_finish_config()\n                            -\u0026gt; real_num_tx_queues = 8\n\nUse immutable num_tx_queues in all related functions to avoid the issue.\n\n[1]\n BUG: KASAN: vmalloc-out-of-bounds in iavf_add_one_ethtool_stat+0x200/0x270\n Write of size 8 at addr ffffc900031c9080 by task ethtool/5800\n\n CPU: 1 UID: 0 PID: 5800 Comm: ethtool Not tainted 6.19.0-enjuk-08403-g8137e3db7f1c #241 PREEMPT(full)\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  dump_stack_lvl+0x6f/0xb0\n  print_report+0x170/0x4f3\n  kasan_report+0xe1/0x180\n  iavf_add_one_ethtool_stat+0x200/0x270\n  iavf_get_ethtool_stats+0x14c/0x2e0\n  __dev_ethtool+0x3d0c/0x5830\n  dev_ethtool+0x12d/0x270\n  dev_ioctl+0x53c/0xe30\n  sock_do_ioctl+0x1a9/0x270\n  sock_ioctl+0x3d4/0x5e0\n  __x64_sys_ioctl+0x137/0x1c0\n  do_syscall_64+0xf3/0x690\n  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n RIP: 0033:0x7f7da0e6e36d\n ...\n  \u0026lt;/TASK\u0026gt;\n\n The buggy address belongs to a 1-page vmalloc region starting at 0xffffc900031c9000 allocated at __dev_ethtool+0x3cc9/0x5830\n The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000\n index:0xffff88813a013de0 pfn:0x13a013\n flags: 0x200000000000000(node=0|zone=2)\n raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000\n raw: ffff88813a013de0 0000000000000000 00000001ffffffff 0000000000000000\n page dumped because: kasan: bad access detected\n\n Memory state around the buggy address:\n  ffffc900031c8f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n  ffffc900031c9000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n \u0026gt;ffffc900031c9080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n                    ^\n  ffffc900031c9100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n  ffffc900031c9180: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8(CVE-2026-31505)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb\n\nBefore using sk pointer, check if it is null.\n\nFix the following:\n\n KASAN: null-ptr-deref in range [0x0000000000000260-0x0000000000000267]\n CPU: 0 UID: 0 PID: 5985 Comm: kworker/0:5 Not tainted 7.0.0-rc4-00029-ga989fde763f4 #1 PREEMPT(full)\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-9.fc43 06/10/2025\n Workqueue: events l2cap_info_timeout\n RIP: 0010:kasan_byte_accessible+0x12/0x30\n Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df \u0026lt;0f\u0026gt; b6 04 07 3c 08 0f 92 c0 c3 cc cce\n veth0_macvtap: entered promiscuous mode\n RSP: 0018:ffffc90006e0f808 EFLAGS: 00010202\n RAX: dffffc0000000000 RBX: ffffffff89746018 RCX: 0000000080000001\n RDX: 0000000000000000 RSI: ffffffff89746018 RDI: 000000000000004c\n RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000\n R10: dffffc0000000000 R11: ffffffff8aae3e70 R12: 0000000000000000\n R13: 0000000000000260 R14: 0000000000000260 R15: 0000000000000001\n FS:  0000000000000000(0000) GS:ffff8880983c2000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00005582615a5008 CR3: 000000007007e000 CR4: 0000000000752ef0\n PKRU: 55555554\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  __kasan_check_byte+0x12/0x40\n  lock_acquire+0x79/0x2e0\n  lock_sock_nested+0x48/0x100\n  ? l2cap_sock_ready_cb+0x46/0x160\n  l2cap_sock_ready_cb+0x46/0x160\n  l2cap_conn_start+0x779/0xff0\n  ? __pfx_l2cap_conn_start+0x10/0x10\n  ? l2cap_info_timeout+0x60/0xa0\n  ? __pfx___mutex_lock+0x10/0x10\n  l2cap_info_timeout+0x68/0xa0\n  ? process_scheduled_works+0xa8d/0x18c0\n  process_scheduled_works+0xb6e/0x18c0\n  ? __pfx_process_scheduled_works+0x10/0x10\n  ? assign_work+0x3d5/0x5e0\n  worker_thread+0xa53/0xfc0\n  kthread+0x388/0x470\n  ? __pfx_worker_thread+0x10/0x10\n  ? __pfx_kthread+0x10/0x10\n  ret_from_fork+0x51e/0xb90\n  ? __pfx_ret_from_fork+0x10/0x10\n veth1_macvtap: entered promiscuous mode\n  ? __switch_to+0xc7d/0x1450\n  ? __pfx_kthread+0x10/0x10\n  ret_from_fork_asm+0x1a/0x30\n  \u0026lt;/TASK\u0026gt;\n Modules linked in:\n ---[ end trace 0000000000000000 ]---\n batman_adv: batadv0: Interface activated: batadv_slave_0\n batman_adv: batadv0: Interface activated: batadv_slave_1\n netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0\n netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0\n netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0\n netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0\n RIP: 0010:kasan_byte_accessible+0x12/0x30\n Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df \u0026lt;0f\u0026gt; b6 04 07 3c 08 0f 92 c0 c3 cc cce\n ieee80211 phy39: Selected rate control algorithm \u0026apos;minstrel_ht\u0026apos;\n RSP: 0018:ffffc90006e0f808 EFLAGS: 00010202\n RAX: dffffc0000000000 RBX: ffffffff89746018 RCX: 0000000080000001\n RDX: 0000000000000000 RSI: ffffffff89746018 RDI: 000000000000004c\n RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000\n R10: dffffc0000000000 R11: ffffffff8aae3e70 R12: 0000000000000000\n R13: 0000000000000260 R14: 0000000000000260 R15: 0000000000000001\n FS:  0000000000000000(0000) GS:ffff8880983c2000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007f7e16139e9c CR3: 000000000e74e000 CR4: 0000000000752ef0\n PKRU: 55555554\n Kernel panic - not syncing: Fatal exception(CVE-2026-31510)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete\n\nThis fixes the condition checking so mgmt_pending_valid is executed\nwhenever status != -ECANCELED otherwise calling mgmt_pending_free(cmd)\nwould kfree(cmd) without unlinking it from the list first, leaving a\ndangling pointer. Any subsequent list traversal (e.g.,\nmgmt_pending_foreach during __mgmt_power_off, or another\nmgmt_pending_valid call) would dereference freed memory.(CVE-2026-31511)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()\n\nl2cap_ecred_data_rcv() reads the SDU length field from skb-\u0026gt;data using\nget_unaligned_le16() without first verifying that skb contains at least\nL2CAP_SDULEN_SIZE (2) bytes. When skb-\u0026gt;len is less than 2, this reads\npast the valid data in the skb.\n\nThe ERTM reassembly path correctly calls pskb_may_pull() before reading\nthe SDU length (l2cap_reassemble_sdu, L2CAP_SAR_START case). Apply the\nsame validation to the Enhanced Credit Based Flow Control data path.(CVE-2026-31512)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: prevent policy_hthresh.work from racing with netns teardown\n\nA XFRM_MSG_NEWSPDINFO request can queue the per-net work item\npolicy_hthresh.work onto the system workqueue.\n\nThe queued callback, xfrm_hash_rebuild(), retrieves the enclosing\nstruct net via container_of(). If the net namespace is torn down\nbefore that work runs, the associated struct net may already have\nbeen freed, and xfrm_hash_rebuild() may then dereference stale memory.\n\nxfrm_policy_fini() already flushes policy_hash_work during teardown,\nbut it does not synchronize policy_hthresh.work.\n\nSynchronize policy_hthresh.work in xfrm_policy_fini() as well, so the\nqueued work cannot outlive the net namespace teardown and access a\nfreed struct net.(CVE-2026-31516)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nesp: fix skb leak with espintcp and async crypto\n\nWhen the TX queue for espintcp is full, esp_output_tail_tcp will\nreturn an error and not free the skb, because with synchronous crypto,\nthe common xfrm output code will drop the packet for us.\n\nWith async crypto (esp_output_done), we need to drop the skb when\nesp_output_tail_tcp returns an error.(CVE-2026-31518)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN\n\nThe BPF interpreter\u0026apos;s signed 32-bit division and modulo handlers use\nthe kernel abs() macro on s32 operands. The abs() macro documentation\n(include/linux/math.h) explicitly states the result is undefined when\nthe input is the type minimum. When DST contains S32_MIN (0x80000000),\nabs((s32)DST) triggers undefined behavior and returns S32_MIN unchanged\non arm64/x86. This value is then sign-extended to u64 as\n0xFFFFFFFF80000000, causing do_div() to compute the wrong result.\n\nThe verifier\u0026apos;s abstract interpretation (scalar32_min_max_sdiv) computes\nthe mathematically correct result for range tracking, creating a\nverifier/interpreter mismatch that can be exploited for out-of-bounds\nmap value access.\n\nIntroduce abs_s32() which handles S32_MIN correctly by casting to u32\nbefore negating, avoiding signed overflow entirely. Replace all 8\nabs((s32)...) call sites in the interpreter\u0026apos;s sdiv32/smod32 handlers.\n\ns32 is the only affected case -- the s64 division/modulo handlers do\nnot use abs().(CVE-2026-31525)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nperf: Make sure to use pmu_ctx-\u0026gt;pmu for groups\n\nOliver reported that x86_pmu_del() ended up doing an out-of-bound memory access\nwhen group_sched_in() fails and needs to roll back.\n\nThis *should* be handled by the transaction callbacks, but he found that when\nthe group leader is a software event, the transaction handlers of the wrong PMU\nare used. Despite the move_group case in perf_event_open() and group_sched_in()\nusing pmu_ctx-\u0026gt;pmu.\n\nTurns out, inherit uses event-\u0026gt;pmu to clone the events, effectively undoing the\nmove_group case for all inherited contexts. Fix this by also making inherit use\npmu_ctx-\u0026gt;pmu, ensuring all inherited counters end up in the same pmu context.\n\nSimilarly, __perf_event_read() should use equally use pmu_ctx-\u0026gt;pmu for the\ngroup case.(CVE-2026-31528)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()\n\nWhen querying a nexthop object via RTM_GETNEXTHOP, the kernel currently\nallocates a fixed-size skb using NLMSG_GOODSIZE. While sufficient for\nsingle nexthops and small Equal-Cost Multi-Path groups, this fixed\nallocation fails for large nexthop groups like 512 nexthops.\n\nThis results in the following warning splat:\n\n WARNING: net/ipv4/nexthop.c:3395 at rtm_get_nexthop+0x176/0x1c0, CPU#20: rep/4608\n [...]\n RIP: 0010:rtm_get_nexthop (net/ipv4/nexthop.c:3395)\n [...]\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  rtnetlink_rcv_msg (net/core/rtnetlink.c:6989)\n  netlink_rcv_skb (net/netlink/af_netlink.c:2550)\n  netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)\n  netlink_sendmsg (net/netlink/af_netlink.c:1894)\n  ____sys_sendmsg (net/socket.c:721 net/socket.c:736 net/socket.c:2585)\n  ___sys_sendmsg (net/socket.c:2641)\n  __sys_sendmsg (net/socket.c:2671)\n  do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)\n  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n  \u0026lt;/TASK\u0026gt;\n\nFix this by allocating the size dynamically using nh_nlmsg_size() and\nusing nlmsg_new(), this is consistent with nexthop_notify() behavior. In\naddition, adjust nh_nlmsg_size_grp() so it calculates the size needed\nbased on flags passed. While at it, also add the size of NHA_FDB for\nnexthop group size calculation as it was missing too.\n\nThis cannot be reproduced via iproute2 as the group size is currently\nlimited and the command fails as follows:\n\naddattr_l ERROR: message exceeded bound of 1048(CVE-2026-31531)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncan: raw: fix ro-\u0026gt;uniq use-after-free in raw_rcv()\n\nraw_release() unregisters raw CAN receive filters via can_rx_unregister(),\nbut receiver deletion is deferred with call_rcu(). This leaves a window\nwhere raw_rcv() may still be running in an RCU read-side critical section\nafter raw_release() frees ro-\u0026gt;uniq, leading to a use-after-free of the\npercpu uniq storage.\n\nMove free_percpu(ro-\u0026gt;uniq) out of raw_release() and into a raw-specific\nsocket destructor. can_rx_unregister() takes an extra reference to the\nsocket and only drops it from the RCU callback, so freeing uniq from\nsk_destruct ensures the percpu area is not released until the relevant\ncallbacks have drained.\n\n[mkl: applied manually](CVE-2026-31532)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/tls: fix use-after-free in -EBUSY error path of tls_do_encryption\n\nThe -EBUSY handling in tls_do_encryption(), introduced by commit\n859054147318 (\u0026quot;net: tls: handle backlogging of crypto requests\u0026quot;), has\na use-after-free due to double cleanup of encrypt_pending and the\nscatterlist entry.\n\nWhen crypto_aead_encrypt() returns -EBUSY, the request is enqueued to\nthe cryptd backlog and the async callback tls_encrypt_done() will be\ninvoked upon completion. That callback unconditionally restores the\nscatterlist entry (sge-\u0026gt;offset, sge-\u0026gt;length) and decrements\nctx-\u0026gt;encrypt_pending. However, if tls_encrypt_async_wait() returns an\nerror, the synchronous error path in tls_do_encryption() performs the\nsame cleanup again, double-decrementing encrypt_pending and\ndouble-restoring the scatterlist.\n\nThe double-decrement corrupts the encrypt_pending sentinel (initialized\nto 1), making tls_encrypt_async_wait() permanently skip the wait for\npending async callbacks. A subsequent sendmsg can then free the\ntls_rec via bpf_exec_tx_verdict() while a cryptd callback is still\npending, resulting in a use-after-free when the callback fires on the\nfreed record.\n\nFix this by skipping the synchronous cleanup when the -EBUSY async\nwait returns an error, since the callback has already handled\nencrypt_pending and sge restoration.(CVE-2026-31533)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gt: Check set_default_submission() before deferencing\n\nWhen the i915 driver firmware binaries are not present, the\nset_default_submission pointer is not set. This pointer is\ndereferenced during suspend anyways.\n\nAdd a check to make sure it is set before dereferencing.\n\n[   23.289926] PM: suspend entry (deep)\n[   23.293558] Filesystems sync: 0.000 seconds\n[   23.298010] Freezing user space processes\n[   23.302771] Freezing user space processes completed (elapsed 0.000 seconds)\n[   23.309766] OOM killer disabled.\n[   23.313027] Freezing remaining freezable tasks\n[   23.318540] Freezing remaining freezable tasks completed (elapsed 0.001 seconds)\n[   23.342038] serial 00:05: disabled\n[   23.345719] serial 00:02: disabled\n[   23.349342] serial 00:01: disabled\n[   23.353782] sd 0:0:0:0: [sda] Synchronizing SCSI cache\n[   23.358993] sd 1:0:0:0: [sdb] Synchronizing SCSI cache\n[   23.361635] ata1.00: Entering standby power mode\n[   23.368863] ata2.00: Entering standby power mode\n[   23.445187] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[   23.452194] #PF: supervisor instruction fetch in kernel mode\n[   23.457896] #PF: error_code(0x0010) - not-present page\n[   23.463065] PGD 0 P4D 0\n[   23.465640] Oops: Oops: 0010 [#1] SMP NOPTI\n[   23.469869] CPU: 8 UID: 0 PID: 211 Comm: kworker/u48:18 Tainted: G S      W           6.19.0-rc4-00020-gf0b9d8eb98df #10 PREEMPT(voluntary)\n[   23.482512] Tainted: [S]=CPU_OUT_OF_SPEC, [W]=WARN\n[   23.496511] Workqueue: async async_run_entry_fn\n[   23.501087] RIP: 0010:0x0\n[   23.503755] Code: Unable to access opcode bytes at 0xffffffffffffffd6.\n[   23.510324] RSP: 0018:ffffb4a60065fca8 EFLAGS: 00010246\n[   23.515592] RAX: 0000000000000000 RBX: ffff9f428290e000 RCX: 000000000000000f\n[   23.522765] RDX: 0000000000000000 RSI: 0000000000000282 RDI: ffff9f428290e000\n[   23.529937] RBP: ffff9f4282907070 R08: ffff9f4281130428 R09: 00000000ffffffff\n[   23.537111] R10: 0000000000000000 R11: 0000000000000001 R12: ffff9f42829070f8\n[   23.544284] R13: ffff9f4282906028 R14: ffff9f4282900000 R15: ffff9f4282906b68\n[   23.551457] FS:  0000000000000000(0000) GS:ffff9f466b2cf000(0000) knlGS:0000000000000000\n[   23.559588] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   23.565365] CR2: ffffffffffffffd6 CR3: 000000031c230001 CR4: 0000000000f70ef0\n[   23.572539] PKRU: 55555554\n[   23.575281] Call Trace:\n[   23.577770]  \u0026lt;TASK\u0026gt;\n[   23.579905]  intel_engines_reset_default_submission+0x42/0x60\n[   23.585695]  __intel_gt_unset_wedged+0x191/0x200\n[   23.590360]  intel_gt_unset_wedged+0x20/0x40\n[   23.594675]  gt_sanitize+0x15e/0x170\n[   23.598290]  i915_gem_suspend_late+0x6b/0x180\n[   23.602692]  i915_drm_suspend_late+0x35/0xf0\n[   23.607008]  ? __pfx_pci_pm_suspend_late+0x10/0x10\n[   23.611843]  dpm_run_callback+0x78/0x1c0\n[   23.615817]  device_suspend_late+0xde/0x2e0\n[   23.620037]  async_suspend_late+0x18/0x30\n[   23.624082]  async_run_entry_fn+0x25/0xa0\n[   23.628129]  process_one_work+0x15b/0x380\n[   23.632182]  worker_thread+0x2a5/0x3c0\n[   23.635973]  ? __pfx_worker_thread+0x10/0x10\n[   23.640279]  kthread+0xf6/0x1f0\n[   23.643464]  ? __pfx_kthread+0x10/0x10\n[   23.647263]  ? __pfx_kthread+0x10/0x10\n[   23.651045]  ret_from_fork+0x131/0x190\n[   23.654837]  ? __pfx_kthread+0x10/0x10\n[   23.658634]  ret_from_fork_asm+0x1a/0x30\n[   23.662597]  \u0026lt;/TASK\u0026gt;\n[   23.664826] Modules linked in:\n[   23.667914] CR2: 0000000000000000\n[   23.671271] ------------[ cut here ]------------\n\n(cherry picked from commit daa199abc3d3d1740c9e3a2c3e9216ae5b447cad)(CVE-2026-31540)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nx86/platform/uv: Handle deconfigured sockets\n\nWhen a socket is deconfigured, it\u0026apos;s mapped to SOCK_EMPTY (0xffff). This causes\na panic while allocating UV hub info structures.\n\nFix this by using NUMA_NO_NODE, allowing UV hub info structures to be\nallocated on valid nodes.(CVE-2026-31542)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: bonding: fix NULL deref in bond_debug_rlb_hash_show\n\nrlb_clear_slave intentionally keeps RLB hash-table entries on\nthe rx_hashtbl_used_head list with slave set to NULL when no\nreplacement slave is available. However, bond_debug_rlb_hash_show\nvisites client_info-\u0026gt;slave without checking if it\u0026apos;s NULL.\n\nOther used-list iterators in bond_alb.c already handle this NULL-slave\nstate safely:\n\n- rlb_update_client returns early on !client_info-\u0026gt;slave\n- rlb_req_update_slave_clients, rlb_clear_slave, and rlb_rebalance\ncompare slave values before visiting\n- lb_req_update_subnet_clients continues if slave is NULL\n\nThe following NULL deref crash can be trigger in\nbond_debug_rlb_hash_show:\n\n[    1.289791] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[    1.292058] RIP: 0010:bond_debug_rlb_hash_show (drivers/net/bonding/bond_debugfs.c:41)\n[    1.293101] RSP: 0018:ffffc900004a7d00 EFLAGS: 00010286\n[    1.293333] RAX: 0000000000000000 RBX: ffff888102b48200 RCX: ffff888102b48204\n[    1.293631] RDX: ffff888102b48200 RSI: ffffffff839daad5 RDI: ffff888102815078\n[    1.293924] RBP: ffff888102815078 R08: ffff888102b4820e R09: 0000000000000000\n[    1.294267] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888100f929c0\n[    1.294564] R13: ffff888100f92a00 R14: 0000000000000001 R15: ffffc900004a7ed8\n[    1.294864] FS:  0000000001395380(0000) GS:ffff888196e75000(0000) knlGS:0000000000000000\n[    1.295239] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[    1.295480] CR2: 0000000000000000 CR3: 0000000102adc004 CR4: 0000000000772ef0\n[    1.295897] Call Trace:\n[    1.296134]  seq_read_iter (fs/seq_file.c:231)\n[    1.296341]  seq_read (fs/seq_file.c:164)\n[    1.296493]  full_proxy_read (fs/debugfs/file.c:378 (discriminator 1))\n[    1.296658]  vfs_read (fs/read_write.c:572)\n[    1.296981]  ksys_read (fs/read_write.c:717)\n[    1.297132]  do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1))\n[    1.297325]  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n\nAdd a NULL check and print \u0026quot;(none)\u0026quot; for entries with no assigned slave.(CVE-2026-31546)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Clear stale exiting pointer in futex_lock_pi() retry path\n\nFuzzying/stressing futexes triggered:\n\n    WARNING: kernel/futex/core.c:825 at wait_for_owner_exiting+0x7a/0x80, CPU#11: futex_lock_pi_s/524\n\nWhen futex_lock_pi_atomic() sees the owner is exiting, it returns -EBUSY\nand stores a refcounted task pointer in \u0026apos;exiting\u0026apos;.\n\nAfter wait_for_owner_exiting() consumes that reference, the local pointer\nis never reset to nil. Upon a retry, if futex_lock_pi_atomic() returns a\ndifferent error, the bogus pointer is passed to wait_for_owner_exiting().\n\n  CPU0\t\t\t     CPU1\t\t       CPU2\n  futex_lock_pi(uaddr)\n  // acquires the PI futex\n  exit()\n    futex_cleanup_begin()\n      futex_state = EXITING;\n\t\t\t     futex_lock_pi(uaddr)\n\t\t\t       futex_lock_pi_atomic()\n\t\t\t\t attach_to_pi_owner()\n\t\t\t\t   // observes EXITING\n\t\t\t\t   *exiting = owner;  // takes ref\n\t\t\t\t   return -EBUSY\n\t\t\t       wait_for_owner_exiting(-EBUSY, owner)\n\t\t\t\t put_task_struct();   // drops ref\n\t\t\t       // exiting still points to owner\n\t\t\t       goto retry;\n\t\t\t       futex_lock_pi_atomic()\n\t\t\t\t lock_pi_update_atomic()\n\t\t\t\t   cmpxchg(uaddr)\n\t\t\t\t\t*uaddr ^= WAITERS // whatever\n\t\t\t\t   // value changed\n\t\t\t\t return -EAGAIN;\n\t\t\t       wait_for_owner_exiting(-EAGAIN, exiting) // stale\n\t\t\t\t WARN_ON_ONCE(exiting)\n\nFix this by resetting upon retry, essentially aligning it with requeue_pi.(CVE-2026-31555)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib\n\namdgpu_amdkfd_submit_ib() submits a GPU job and gets a fence\nfrom amdgpu_ib_schedule(). This fence is used to wait for job\ncompletion.\n\nCurrently, the code drops the fence reference using dma_fence_put()\nbefore calling dma_fence_wait().\n\nIf dma_fence_put() releases the last reference, the fence may be\nfreed before dma_fence_wait() is called. This can lead to a\nuse-after-free.\n\nFix this by waiting on the fence first and releasing the reference\nonly after dma_fence_wait() completes.\n\nFixes the below:\ndrivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c:697 amdgpu_amdkfd_submit_ib() warn: passing freed memory \u0026apos;f\u0026apos; (line 696)\n\n(cherry picked from commit 8b9e5259adc385b61a6590a13b82ae0ac2bd3482)(CVE-2026-31566)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncan: gw: fix OOB heap access in cgw_csum_crc8_rel()\n\ncgw_csum_crc8_rel() correctly computes bounds-safe indices via calc_idx():\n\n    int from = calc_idx(crc8-\u0026gt;from_idx, cf-\u0026gt;len);\n    int to   = calc_idx(crc8-\u0026gt;to_idx,   cf-\u0026gt;len);\n    int res  = calc_idx(crc8-\u0026gt;result_idx, cf-\u0026gt;len);\n\n    if (from \u0026lt; 0 || to \u0026lt; 0 || res \u0026lt; 0)\n        return;\n\nHowever, the loop and the result write then use the raw s8 fields directly\ninstead of the computed variables:\n\n    for (i = crc8-\u0026gt;from_idx; ...)        /* BUG: raw negative index */\n    cf-\u0026gt;data[crc8-\u0026gt;result_idx] = ...;    /* BUG: raw negative index */\n\nWith from_idx = to_idx = result_idx = -64 on a 64-byte CAN FD frame,\ncalc_idx(-64, 64) = 0 so the guard passes, but the loop iterates with\ni = -64, reading cf-\u0026gt;data[-64], and the write goes to cf-\u0026gt;data[-64].\nThis write might end up to 56 (7.0-rc) or 40 (\u0026lt;= 6.19) bytes before the\nstart of the canfd_frame on the heap.\n\nThe companion function cgw_csum_xor_rel() uses `from`/`to`/`res`\ncorrectly throughout; fix cgw_csum_crc8_rel() to match.\n\nConfirmed with KASAN on linux-7.0-rc2:\n  BUG: KASAN: slab-out-of-bounds in cgw_csum_crc8_rel+0x515/0x5b0\n  Read of size 1 at addr ffff8880076619c8 by task poc_cgw_oob/62\n\nTo configure the can-gw crc8 checksums CAP_NET_ADMIN is needed.(CVE-2026-31570)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION\n\nDrop the WARN in sev_pin_memory() on npages overflowing an int, as the\nWARN is comically trivially to trigger from userspace, e.g. by doing:\n\n  struct kvm_enc_region range = {\n          .addr = 0,\n          .size = -1ul,\n  };\n\n  __vm_ioctl(vm, KVM_MEMORY_ENCRYPT_REG_REGION, \u0026amp;range);\n\nNote, the checks in sev_mem_enc_register_region() that presumably exist to\nverify the incoming address+size are completely worthless, as both \u0026quot;addr\u0026quot;\nand \u0026quot;size\u0026quot; are u64s and SEV is 64-bit only, i.e. they _can\u0026apos;t_ be greater\nthan ULONG_MAX.  That wart will be cleaned up in the near future.\n\n\tif (range-\u0026gt;addr \u0026gt; ULONG_MAX || range-\u0026gt;size \u0026gt; ULONG_MAX)\n\t\treturn -EINVAL;\n\nOpportunistically add a comment to explain why the code calculates the\nnumber of pages the \u0026quot;hard\u0026quot; way, e.g. instead of just shifting @ulen.(CVE-2026-31590)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nPCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup\n\nDisable the delayed work before clearing BAR mappings and doorbells to\navoid running the handler after resources have been torn down.\n\n  Unable to handle kernel paging request at virtual address ffff800083f46004\n  [...]\n  Internal error: Oops: 0000000096000007 [#1]  SMP\n  [...]\n  Call trace:\n   epf_ntb_cmd_handler+0x54/0x200 [pci_epf_vntb] (P)\n   process_one_work+0x154/0x3b0\n   worker_thread+0x2c8/0x400\n   kthread+0x148/0x210\n   ret_from_fork+0x10/0x20(CVE-2026-31595)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nx86/CPU: Fix FPDSS on Zen1\n\nZen1\u0026apos;s hardware divider can leave, under certain circumstances, partial\nresults from previous operations.  Those results can be leaked by\nanother, attacker thread.\n\nFix that with a chicken bit.(CVE-2026-31628)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: proc: size address buffers for %pISpc output\n\nThe AF_RXRPC procfs helpers format local and remote socket addresses into\nfixed 50-byte stack buffers with \u0026quot;%pISpc\u0026quot;.\n\nThat is too small for the longest current-tree IPv6-with-port form the\nformatter can produce. In lib/vsprintf.c, the compressed IPv6 path uses a\ndotted-quad tail not only for v4mapped addresses, but also for ISATAP\naddresses via ipv6_addr_is_isatap().\n\nAs a result, a case such as\n\n  [ffff:ffff:ffff:ffff:0:5efe:255.255.255.255]:65535\n\nis possible with the current formatter. That is 50 visible characters, so\n51 bytes including the trailing NUL, which does not fit in the existing\nchar[50] buffers used by net/rxrpc/proc.c.\n\nSize the buffers from the formatter\u0026apos;s maximum textual form and switch the\ncall sites to scnprintf().\n\nChanges since v1:\n- correct the changelog to cite the actual maximum current-tree case\n  explicitly\n- frame the proof around the ISATAP formatting path instead of the earlier\n  mapped-v4 example(CVE-2026-31630)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmmc: vub300: fix NULL-deref on disconnect\n\nMake sure to deregister the controller before dropping the reference to\nthe driver data on disconnect to avoid NULL-pointer dereferences or\nuse-after-free.(CVE-2026-31651)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_ct: fix use-after-free in timeout object destroy\n\nnft_ct_timeout_obj_destroy() frees the timeout object with kfree()\nimmediately after nf_ct_untimeout(), without waiting for an RCU grace\nperiod. Concurrent packet processing on other CPUs may still hold\nRCU-protected references to the timeout object obtained via\nrcu_dereference() in nf_ct_timeout_data().\n\nAdd an rcu_head to struct nf_ct_timeout and use kfree_rcu() to defer\nfreeing until after an RCU grace period, matching the approach already\nused in nfnetlink_cttimeout.c.\n\nKASAN report:\n BUG: KASAN: slab-use-after-free in nf_conntrack_tcp_packet+0x1381/0x29d0\n Read of size 4 at addr ffff8881035fe19c by task exploit/80\n\n Call Trace:\n  nf_conntrack_tcp_packet+0x1381/0x29d0\n  nf_conntrack_in+0x612/0x8b0\n  nf_hook_slow+0x70/0x100\n  __ip_local_out+0x1b2/0x210\n  tcp_sendmsg_locked+0x722/0x1580\n  __sys_sendto+0x2d8/0x320\n\n Allocated by task 75:\n  nft_ct_timeout_obj_init+0xf6/0x290\n  nft_obj_init+0x107/0x1b0\n  nf_tables_newobj+0x680/0x9c0\n  nfnetlink_rcv_batch+0xc29/0xe00\n\n Freed by task 26:\n  nft_obj_destroy+0x3f/0xa0\n  nf_tables_trans_destroy_work+0x51c/0x5c0\n  process_one_work+0x2c4/0x5a0(CVE-2026-31665)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nInput: uinput - fix circular locking dependency with ff-core\n\nA lockdep circular locking dependency warning can be triggered\nreproducibly when using a force-feedback gamepad with uinput (for\nexample, playing ELDEN RING under Wine with a Flydigi Vader 5\ncontroller):\n\n  ff-\u0026gt;mutex -\u0026gt; udev-\u0026gt;mutex -\u0026gt; input_mutex -\u0026gt; dev-\u0026gt;mutex -\u0026gt; ff-\u0026gt;mutex\n\nThe cycle is caused by four lock acquisition paths:\n\n1. ff upload: input_ff_upload() holds ff-\u0026gt;mutex and calls\n   uinput_dev_upload_effect() -\u0026gt; uinput_request_submit() -\u0026gt;\n   uinput_request_send(), which acquires udev-\u0026gt;mutex.\n\n2. device create: uinput_ioctl_handler() holds udev-\u0026gt;mutex and calls\n   uinput_create_device() -\u0026gt; input_register_device(), which acquires\n   input_mutex.\n\n3. device register: input_register_device() holds input_mutex and\n   calls kbd_connect() -\u0026gt; input_register_handle(), which acquires\n   dev-\u0026gt;mutex.\n\n4. evdev release: evdev_release() calls input_flush_device() under\n   dev-\u0026gt;mutex, which calls input_ff_flush() acquiring ff-\u0026gt;mutex.\n\nFix this by introducing a new state_lock spinlock to protect\nudev-\u0026gt;state and udev-\u0026gt;dev access in uinput_request_send() instead of\nacquiring udev-\u0026gt;mutex.  The function only needs to atomically check\ndevice state and queue an input event into the ring buffer via\nuinput_dev_event() -- both operations are safe under a spinlock\n(ktime_get_ts64() and wake_up_interruptible() do not sleep).  This\nbreaks the ff-\u0026gt;mutex -\u0026gt; udev-\u0026gt;mutex link since a spinlock is a leaf in\nthe lock ordering and cannot form cycles with mutexes.\n\nTo keep state transitions visible to uinput_request_send(), protect\nwrites to udev-\u0026gt;state in uinput_create_device() and\nuinput_destroy_device() with the same state_lock spinlock.\n\nAdditionally, move init_completion(\u0026amp;request-\u0026gt;done) from\nuinput_request_send() to uinput_request_submit() before\nuinput_request_reserve_slot().  Once the slot is allocated,\nuinput_flush_requests() may call complete() on it at any time from\nthe destroy path, so the completion must be initialised before the\nrequest becomes visible.\n\nLock ordering after the fix:\n\n  ff-\u0026gt;mutex -\u0026gt; state_lock (spinlock, leaf)\n  udev-\u0026gt;mutex -\u0026gt; state_lock (spinlock, leaf)\n  udev-\u0026gt;mutex -\u0026gt; input_mutex -\u0026gt; dev-\u0026gt;mutex -\u0026gt; ff-\u0026gt;mutex (no back-edge)(CVE-2026-31667)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_netem: fix out-of-bounds access in packet corruption\n\nIn netem_enqueue(), the packet corruption logic uses\nget_random_u32_below(skb_headlen(skb)) to select an index for\nmodifying skb-\u0026gt;data. When an AF_PACKET TX_RING sends fully non-linear\npackets over an IPIP tunnel, skb_headlen(skb) evaluates to 0.\n\nPassing 0 to get_random_u32_below() takes the variable-ceil slow path\nwhich returns an unconstrained 32-bit random integer. Using this\nunconstrained value as an offset into skb-\u0026gt;data results in an\nout-of-bounds memory access.\n\nFix this by verifying skb_headlen(skb) is non-zero before attempting\nto corrupt the linear data area. Fully non-linear packets will silently\nbypass the corruption logic.(CVE-2026-31675)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - limit RX SG extraction by receive buffer budget\n\nMake af_alg_get_rsgl() limit each RX scatterlist extraction to the\nremaining receive buffer budget.\n\naf_alg_get_rsgl() currently uses af_alg_readable() only as a gate\nbefore extracting data into the RX scatterlist. Limit each extraction\nto the remaining af_alg_rcvbuf(sk) budget so that receive-side\naccounting matches the amount of data attached to the request.\n\nIf skcipher cannot obtain enough RX space for at least one chunk while\nmore data remains to be processed, reject the recvmsg call instead of\nrounding the request length down to zero.(CVE-2026-31677)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: defer tunnel netdev_put to RCU release\n\novs_netdev_tunnel_destroy() may run after NETDEV_UNREGISTER already\ndetached the device. Dropping the netdev reference in destroy can race\nwith concurrent readers that still observe vport-\u0026gt;dev.\n\nDo not release vport-\u0026gt;dev in ovs_netdev_tunnel_destroy(). Instead, let\nvport_netdev_free() drop the reference from the RCU callback, matching\nthe non-tunnel destroy path and avoiding additional synchronization\nunder RTNL.(CVE-2026-31678)\n\nIn the Linux kernel, a memory out-of-bounds access vulnerability exists in the act_csum module\u0026apos;s tcf_csum_act() function when processing nested VLAN headers. When an skb still carries in-payload VLAN tags, the function walks nested VLAN headers directly from skb-\u0026gt;data. The current code reads vlan-\u0026gt;h_vlan_encapsulated_proto and then pulls VLAN_HLEN bytes without first ensuring that the full VLAN header is present in the linear area. If only part of an inner VLAN header is linearized, accessing h_vlan_encapsulated_proto reads past the linear area, and the following skb_pull(VLAN_HLEN) may violate skb invariants.(CVE-2026-31684)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ip6t_eui64: reject invalid MAC header for all packets\n\n`eui64_mt6()` derives a modified EUI-64 from the Ethernet source address\nand compares it with the low 64 bits of the IPv6 source address.\n\nThe existing guard only rejects an invalid MAC header when\n`par-\u0026gt;fragoff != 0`. For packets with `par-\u0026gt;fragoff == 0`, `eui64_mt6()`\ncan still reach `eth_hdr(skb)` even when the MAC header is not valid.\n\nFix this by removing the `par-\u0026gt;fragoff != 0` condition so that packets\nwith an invalid MAC header are rejected before accessing `eth_hdr(skb)`.(CVE-2026-31685)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nEDAC/mc: Fix error path ordering in edac_mc_alloc()\n\nWhen the mci-\u0026gt;pvt_info allocation in edac_mc_alloc() fails, the error path\nwill call put_device() which will end up calling the device\u0026apos;s release\nfunction.\n\nHowever, the init ordering is wrong such that device_initialize() happens\n*after* the failed allocation and thus the device itself and the release\nfunction pointer are not initialized yet when they\u0026apos;re called:\n\n  MCE: In-kernel MCE decoding enabled.\n  ------------[ cut here ]------------\n  kobject: \u0026apos;(null)\u0026apos;: is not initialized, yet kobject_put() is being called.\n  WARNING: lib/kobject.c:734 at kobject_put, CPU#22: systemd-udevd\n  CPU: 22 UID: 0 PID: 538 Comm: systemd-udevd Not tainted 7.0.0-rc1+ #2 PREEMPT(full)\n  RIP: 0010:kobject_put\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   edac_mc_alloc+0xbe/0xe0 [edac_core]\n   amd64_edac_init+0x7a4/0xff0 [amd64_edac]\n   ? __pfx_amd64_edac_init+0x10/0x10 [amd64_edac]\n   do_one_initcall\n   ...\n\nReorder the calling sequence so that the device is initialized and thus the\nrelease function pointer is properly set before it can be used.\n\nThis was found by Claude while reviewing another EDAC patch.(CVE-2026-31689)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp: Don\u0026apos;t attempt to copy ID to userspace if PSP command failed\n\nWhen retrieving the ID for the CPU, don\u0026apos;t attempt to copy the ID blob to\nuserspace if the firmware command failed.  If the failure was due to an\ninvalid length, i.e. the userspace buffer+length was too small, copying\nthe number of bytes _firmware_ requires will overflow the kernel-allocated\nbuffer and leak data to userspace.\n\n  BUG: KASAN: slab-out-of-bounds in instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\n  BUG: KASAN: slab-out-of-bounds in _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\n  BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\n  Read of size 64 at addr ffff8881867f5960 by task syz.0.906/24388\n\n  CPU: 130 UID: 0 PID: 24388 Comm: syz.0.906 Tainted: G     U     O        7.0.0-smp-DEV #28 PREEMPTLAZY\n  Tainted: [U]=USER, [O]=OOT_MODULE\n  Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.62.0-0 11/19/2025\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   dump_stack_lvl+0xc5/0x110 ../lib/dump_stack.c:120\n   print_address_description ../mm/kasan/report.c:378 [inline]\n   print_report+0xbc/0x260 ../mm/kasan/report.c:482\n   kasan_report+0xa2/0xe0 ../mm/kasan/report.c:595\n   check_region_inline ../mm/kasan/generic.c:-1 [inline]\n   kasan_check_range+0x264/0x2c0 ../mm/kasan/generic.c:200\n   instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\n   _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\n   _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\n   copy_to_user ../include/linux/uaccess.h:236 [inline]\n   sev_ioctl_do_get_id2+0x361/0x490 ../drivers/crypto/ccp/sev-dev.c:2222\n   sev_ioctl+0x25f/0x490 ../drivers/crypto/ccp/sev-dev.c:2575\n   vfs_ioctl ../fs/ioctl.c:51 [inline]\n   __do_sys_ioctl ../fs/ioctl.c:597 [inline]\n   __se_sys_ioctl+0x11d/0x1b0 ../fs/ioctl.c:583\n   do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline]\n   do_syscall_64+0xe0/0x800 ../arch/x86/entry/syscall_64.c:94\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n   \u0026lt;/TASK\u0026gt;\n\nWARN if the driver says the command succeeded, but the firmware error code\nsays otherwise, as __sev_do_cmd_locked() is expected to return -EIO on any\nfirwmware error.(CVE-2026-31697)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp: Don\u0026apos;t attempt to copy PDH cert to userspace if PSP command failed\n\nWhen retrieving the PDH cert, don\u0026apos;t attempt to copy the blobs to userspace\nif the firmware command failed.  If the failure was due to an invalid\nlength, i.e. the userspace buffer+length was too small, copying the number\nof bytes _firmware_ requires will overflow the kernel-allocated buffer and\nleak data to userspace.\n\n  BUG: KASAN: slab-out-of-bounds in instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\n  BUG: KASAN: slab-out-of-bounds in _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\n  BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\n  Read of size 2084 at addr ffff8885c4ab8aa0 by task syz.0.186/21033\n\n  CPU: 51 UID: 0 PID: 21033 Comm: syz.0.186 Tainted: G     U     O        7.0.0-smp-DEV #28 PREEMPTLAZY\n  Tainted: [U]=USER, [O]=OOT_MODULE\n  Hardware name: Google, Inc.                                                       Arcadia_IT_80/Arcadia_IT_80, BIOS 34.84.12-0 11/17/2025\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   dump_stack_lvl+0xc5/0x110 ../lib/dump_stack.c:120\n   print_address_description ../mm/kasan/report.c:378 [inline]\n   print_report+0xbc/0x260 ../mm/kasan/report.c:482\n   kasan_report+0xa2/0xe0 ../mm/kasan/report.c:595\n   check_region_inline ../mm/kasan/generic.c:-1 [inline]\n   kasan_check_range+0x264/0x2c0 ../mm/kasan/generic.c:200\n   instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\n   _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\n   _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\n   copy_to_user ../include/linux/uaccess.h:236 [inline]\n   sev_ioctl_do_pdh_export+0x3d3/0x7c0 ../drivers/crypto/ccp/sev-dev.c:2347\n   sev_ioctl+0x2a2/0x490 ../drivers/crypto/ccp/sev-dev.c:2568\n   vfs_ioctl ../fs/ioctl.c:51 [inline]\n   __do_sys_ioctl ../fs/ioctl.c:597 [inline]\n   __se_sys_ioctl+0x11d/0x1b0 ../fs/ioctl.c:583\n   do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline]\n   do_syscall_64+0xe0/0x800 ../arch/x86/entry/syscall_64.c:94\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n   \u0026lt;/TASK\u0026gt;\n\nWARN if the driver says the command succeeded, but the firmware error code\nsays otherwise, as __sev_do_cmd_locked() is expected to return -EIO on any\nfirwmware error.(CVE-2026-31698)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp: Don\u0026apos;t attempt to copy CSR to userspace if PSP command failed\n\nWhen retrieving the PEK CSR, don\u0026apos;t attempt to copy the blob to userspace\nif the firmware command failed.  If the failure was due to an invalid\nlength, i.e. the userspace buffer+length was too small, copying the number\nof bytes _firmware_ requires will overflow the kernel-allocated buffer and\nleak data to userspace.\n\n  BUG: KASAN: slab-out-of-bounds in instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\n  BUG: KASAN: slab-out-of-bounds in _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\n  BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\n  Read of size 2084 at addr ffff898144612e20 by task syz.9.219/21405\n\n  CPU: 14 UID: 0 PID: 21405 Comm: syz.9.219 Tainted: G     U     O        7.0.0-smp-DEV #28 PREEMPTLAZY\n  Tainted: [U]=USER, [O]=OOT_MODULE\n  Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.62.0-0 11/19/2025\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   dump_stack_lvl+0xc5/0x110 ../lib/dump_stack.c:120\n   print_address_description ../mm/kasan/report.c:378 [inline]\n   print_report+0xbc/0x260 ../mm/kasan/report.c:482\n   kasan_report+0xa2/0xe0 ../mm/kasan/report.c:595\n   check_region_inline ../mm/kasan/generic.c:-1 [inline]\n   kasan_check_range+0x264/0x2c0 ../mm/kasan/generic.c:200\n   instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\n   _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\n   _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\n   copy_to_user ../include/linux/uaccess.h:236 [inline]\n   sev_ioctl_do_pek_csr+0x31f/0x590 ../drivers/crypto/ccp/sev-dev.c:1872\n   sev_ioctl+0x3a4/0x490 ../drivers/crypto/ccp/sev-dev.c:2562\n   vfs_ioctl ../fs/ioctl.c:51 [inline]\n   __do_sys_ioctl ../fs/ioctl.c:597 [inline]\n   __se_sys_ioctl+0x11d/0x1b0 ../fs/ioctl.c:583\n   do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline]\n   do_syscall_64+0xe0/0x800 ../arch/x86/entry/syscall_64.c:94\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n   \u0026lt;/TASK\u0026gt;\n\nWARN if the driver says the command succeeded, but the firmware error code\nsays otherwise, as __sev_do_cmd_locked() is expected to return -EIO on any\nfirwmware error.(CVE-2026-31699)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path\n\nsmb2_ioctl_query_info() has two response-copy branches: PASSTHRU_FSCTL\nand the default QUERY_INFO path.  The QUERY_INFO branch clamps\nqi.input_buffer_length to the server-reported OutputBufferLength and then\ncopies qi.input_buffer_length bytes from qi_rsp-\u0026gt;Buffer to userspace, but\nit never verifies that the flexible-array payload actually fits within\nrsp_iov[1].iov_len.\n\nA malicious server can return OutputBufferLength larger than the actual\nQUERY_INFO response, causing copy_to_user() to walk past the response\nbuffer and expose adjacent kernel heap to userspace.\n\nGuard the QUERY_INFO copy with a bounds check on the actual Buffer\npayload.  Use struct_size(qi_rsp, Buffer, qi.input_buffer_length)\nrather than an open-coded addition so the guard cannot overflow on\n32-bit builds.(CVE-2026-31708)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: validate ND option lengths in vxlan_na_create\n\nvxlan_na_create() walks ND options according to option-provided\nlengths. A malformed option can make the parser advance beyond the\ncomputed option span or use a too-short source LLADDR option payload.\n\nValidate option lengths against the remaining NS option area before\nadvancing, and only read source LLADDR when the option is large enough\nfor an Ethernet address.(CVE-2026-31738)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbridge: br_nd_send: validate ND option lengths\n\nbr_nd_send() walks ND options according to option-provided lengths.\nA malformed option can make the parser advance beyond the computed\noption span or use a too-short source LLADDR option payload.\n\nValidate option lengths against the remaining NS option area before\nadvancing, and only read source LLADDR when the option is large enough\nfor an Ethernet address.(CVE-2026-31752)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: cdns3: gadget: fix NULL pointer dereference in ep_queue\n\nWhen the gadget endpoint is disabled or not yet configured, the ep-\u0026gt;desc\npointer can be NULL. This leads to a NULL pointer dereference when\n__cdns3_gadget_ep_queue() is called, causing a kernel crash.\n\nAdd a check to return -ESHUTDOWN if ep-\u0026gt;desc is NULL, which is the\nstandard return code for unconfigured endpoints.\n\nThis prevents potential crashes when ep_queue is called on endpoints\nthat are not ready.(CVE-2026-31755)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: move wake reason storage into validated event handlers\n\nhci_store_wake_reason() is called from hci_event_packet() immediately\nafter stripping the HCI event header but before hci_event_func()\nenforces the per-event minimum payload length from hci_ev_table.\nThis means a short HCI event frame can reach bacpy() before any bounds\ncheck runs.\n\nRather than duplicating skb parsing and per-event length checks inside\nhci_store_wake_reason(), move wake-address storage into the individual\nevent handlers after their existing event-length validation has\nsucceeded. Convert hci_store_wake_reason() into a small helper that only\nstores an already-validated bdaddr while the caller holds hci_dev_lock().\nUse the same helper after hci_event_func() with a NULL address to\npreserve the existing unexpected-wake fallback semantics when no\nvalidated event handler records a wake address.\n\nAnnotate the helper with __must_hold(\u0026amp;hdev-\u0026gt;lock) and add\nlockdep_assert_held(\u0026amp;hdev-\u0026gt;lock) so future call paths keep the lock\ncontract explicit.\n\nCall the helper from hci_conn_request_evt(), hci_conn_complete_evt(),\nhci_sync_conn_complete_evt(), le_conn_complete_evt(),\nhci_le_adv_report_evt(), hci_le_ext_adv_report_evt(),\nhci_le_direct_adv_report_evt(), hci_le_pa_sync_established_evt(), and\nhci_le_past_received_evt().(CVE-2026-31771)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: SMP: derive legacy responder STK authentication from MITM state\n\nThe legacy responder path in smp_random() currently labels the stored\nSTK as authenticated whenever pending_sec_level is BT_SECURITY_HIGH.\nThat reflects what the local service requested, not what the pairing\nflow actually achieved.\n\nFor Just Works/Confirm legacy pairing, SMP_FLAG_MITM_AUTH stays clear\nand the resulting STK should remain unauthenticated even if the local\nside requested HIGH security. Use the established MITM state when\nstoring the responder STK so the key metadata matches the pairing result.\n\nThis also keeps the legacy path aligned with the Secure Connections code,\nwhich already treats JUST_WORKS/JUST_CFM as unauthenticated.(CVE-2026-31773)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler()\n\nThe memcpy function assumes the dynamic array notif-\u0026gt;matches is at least\nas large as the number of bytes to copy. Otherwise, results-\u0026gt;matches may\ncontain unwanted data. To guarantee safety, extend the validation in one\nof the checks to ensure sufficient packet length.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2026-31779)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/ioc32: stop speculation on the drm_compat_ioctl path\n\nThe drm compat ioctl path takes a user controlled pointer, and then\ndereferences it into a table of function pointers, the signature method\nof spectre problems.  Fix this up by calling array_index_nospec() on the\nindex to the function pointer list.(CVE-2026-31781)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: validate LTK enc_size on load\n\nLoad Long Term Keys stores the user-provided enc_size and later uses\nit to size fixed-size stack operations when replying to LE LTK\nrequests. An enc_size larger than the 16-byte key buffer can therefore\noverflow the reply stack buffer.\n\nReject oversized enc_size values while validating the management LTK\nrecord so invalid keys never reach the stored key state.(CVE-2026-43020)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: use skb_header_pointer() for TCPv4 GSO frag_off check\n\nSyzbot reported a KMSAN uninit-value warning in gso_features_check()\ncalled from netif_skb_features() [1].\n\ngso_features_check() reads iph-\u0026gt;frag_off to decide whether to clear\nmangleid_features. Accessing the IPv4 header via ip_hdr()/inner_ip_hdr()\ncan rely on skb header offsets that are not always safe for direct\ndereference on packets injected from PF_PACKET paths.\n\nUse skb_header_pointer() for the TCPv4 frag_off check so the header read\nis robust whether data is already linear or needs copying.\n\n[1] https://syzkaller.appspot.com/bug?extid=1543a7d954d9c6d00407(CVE-2026-43036)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak\n\nWhen processing Router Advertisements with user options the kernel\nbuilds an RTM_NEWNDUSEROPT netlink message. The nduseroptmsg struct\nhas three padding fields that are never zeroed and can leak kernel data\n\nThe fix is simple, just zeroes the padding fields.(CVE-2026-43040)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af-alg - fix NULL pointer dereference in scatterwalk\n\nThe AF_ALG interface fails to unmark the end of a Scatter/Gather List (SGL)\nwhen chaining a new af_alg_tsgl structure. If a sendmsg() fills an SGL\nexactly to MAX_SGL_ENTS, the last entry is marked as the end. A subsequent\nsendmsg() allocates a new SGL and chains it, but fails to clear the end\nmarker on the previous SGL\u0026apos;s last data entry.\n\nThis causes the crypto scatterwalk to hit a premature end, returning NULL\non sg_next() and leading to a kernel panic during dereference.\n\nFix this by explicitly unmarking the end of the previous SGL when\nperforming sg_chain() in af_alg_alloc_tsgl().(CVE-2026-43043)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nserial: 8250: Fix TX deadlock when using DMA\n\n`dmaengine_terminate_async` does not guarantee that the\n`__dma_tx_complete` callback will run. The callback is currently the\nonly place where `dma-\u0026gt;tx_running` gets cleared. If the transaction is\ncanceled and the callback never runs, then `dma-\u0026gt;tx_running` will never\nget cleared and we will never schedule new TX DMA transactions again.\n\nThis change makes it so we clear `dma-\u0026gt;tx_running` after we terminate\nthe DMA transaction. This is \u0026quot;safe\u0026quot; because `serial8250_tx_dma_flush`\nis holding the UART port lock. The first thing the callback does is also\ngrab the UART port lock, so access to `dma-\u0026gt;tx_running` is serialized.(CVE-2026-43061)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: Fix not releasing workqueue on .release()\n\nThe workqueue associated with an DSA/IAA device is not released when\nthe object is freed.(CVE-2026-43064)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/intel/uncore: Skip discovery table for offline dies\n\nThis warning can be triggered if NUMA is disabled and the system\nboots with fewer CPUs than the number of CPUs in die 0.\n\nWARNING: CPU: 9 PID: 7257 at uncore.c:1157 uncore_pci_pmu_register+0x136/0x160 [intel_uncore]\n\nCurrently, the discovery table continues to be parsed even if all CPUs\nin the associated die are offline.  This can lead to an array overflow\nat \u0026quot;pmu-\u0026gt;boxes[die] = box\u0026quot; in uncore_pci_pmu_register(), which may\ntrigger the warning above or cause other issues.(CVE-2026-43079)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv4: icmp: fix null-ptr-deref in icmp_build_probe()\n\nipv6_stub-\u0026gt;ipv6_dev_find() may return ERR_PTR(-EAFNOSUPPORT) when the\nIPv6 stack is not active (CONFIG_IPV6=m and not loaded), and passing\nthis error pointer to dev_hold() will cause a kernel crash with\nnull-ptr-deref.\n\nInstead, silently discard the request. RFC 8335 does not appear to\ndefine a specific response for the case where an IPv6 interface\nidentifier is syntactically valid but the implementation cannot perform\nthe lookup at runtime, and silently dropping the request may safer than\nmisreporting \u0026quot;No Such Interface\u0026quot;.(CVE-2026-43099)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/smp: Add check for kcalloc() failure in parse_thread_groups()\n\nAs kcalloc() may fail, check its return value to avoid a NULL pointer\ndereference when passing it to of_property_read_u32_array().(CVE-2026-43148)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: pegasus: enable basic endpoint checking\n\npegasus_probe() fills URBs with hardcoded endpoint pipes without\nverifying the endpoint descriptors:\n\n  - usb_rcvbulkpipe(dev, 1) for RX data\n  - usb_sndbulkpipe(dev, 2) for TX data\n  - usb_rcvintpipe(dev, 3)  for status interrupts\n\nA malformed USB device can present these endpoints with transfer types\nthat differ from what the driver assumes.\n\nAdd a pegasus_usb_ep enum for endpoint numbers, replacing magic\nconstants throughout. Add usb_check_bulk_endpoints() and\nusb_check_int_endpoints() calls before any resource allocation to\nverify endpoint types before use, rejecting devices with mismatched\ndescriptors at probe time, and avoid triggering assertion.\n\nSimilar fix to\n- commit 90b7f2961798 (\u0026quot;net: usb: rtl8150: enable basic endpoint checking\u0026quot;)\n- commit 9e7021d2aeae (\u0026quot;net: usb: catc: enable basic endpoint checking\u0026quot;)(CVE-2026-43156)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmd/bitmap: fix GPF in write_page caused by resize race\n\nA General Protection Fault occurs in write_page() during array resize:\nRIP: 0010:write_page+0x22b/0x3c0 [md_mod]\n\nThis is a use-after-free race between bitmap_daemon_work() and\n__bitmap_resize(). The daemon iterates over `bitmap-\u0026gt;storage.filemap`\nwithout locking, while the resize path frees that storage via\nmd_bitmap_file_unmap(). `quiesce()` does not stop the md thread,\nallowing concurrent access to freed pages.\n\nFix by holding `mddev-\u0026gt;bitmap_info.mutex` during the bitmap update.(CVE-2026-43163)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()\n\nOn the receive path, __ioam6_fill_trace_data() uses trace-\u0026gt;nodelen\nto decide how much data to write for each node. It trusts this field\nas-is from the incoming packet, with no consistency check against\ntrace-\u0026gt;type (the 24-bit field that tells which data items are\npresent). A crafted packet can set nodelen=0 while setting type bits\n0-21, causing the function to write ~100 bytes past the allocated\nregion (into skb_shared_info), which corrupts adjacent heap memory\nand leads to a kernel panic.\n\nAdd a shared helper ioam6_trace_compute_nodelen() in ioam6.c to\nderive the expected nodelen from the type field, and use it:\n\n  - in ioam6_iptunnel.c (send path, existing validation) to replace\n    the open-coded computation;\n  - in exthdrs.c (receive path, ipv6_hop_ioam) to drop packets whose\n    nodelen is inconsistent with the type field, before any data is\n    written.\n\nPer RFC 9197, bits 12-21 are each short (4-octet) fields, so they\nare included in IOAM6_MASK_SHORT_FIELDS (changed from 0xff100000 to\n0xff1ffc00).(CVE-2026-43186)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE\n\nThe arch definition of cpumask_of_node() cannot handle NUMA_NO_NODE -\nwhich is a valid index - so add a check for this.(CVE-2026-43212)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nx86/kexec: add a sanity check on previous kernel\u0026apos;s ima kexec buffer\n\nWhen the second-stage kernel is booted via kexec with a limiting command\nline such as \u0026quot;mem=\u0026lt;size\u0026gt;\u0026quot;, the physical range that contains the carried\nover IMA measurement list may fall outside the truncated RAM leading to a\nkernel panic.\n\n    BUG: unable to handle page fault for address: ffff97793ff47000\n    RIP: ima_restore_measurement_list+0xdc/0x45a\n    #PF: error_code(0x0000) – not-present page\n\nOther architectures already validate the range with page_is_ram(), as done\nin commit cbf9c4b9617b (\u0026quot;of: check previous kernel\u0026apos;s ima-kexec-buffer\nagainst memory bounds\u0026quot;) do a similar check on x86.\n\nWithout carrying the measurement list across kexec, the attestation\nwould fail.(CVE-2026-43240)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: fiemap page fault fix\n\nIn gfs2_fiemap(), we are calling iomap_fiemap() while holding the inode\nglock.  This can lead to recursive glock taking if the fiemap buffer is\nmemory mapped to the same inode and accessing it triggers a page fault.\n\nFix by disabling page faults for iomap_fiemap() and faulting in the\nbuffer by hand if necessary.\n\nFixes xfstest generic/742.(CVE-2026-43262)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nceph: supply snapshot context in ceph_zero_partial_object()\n\nThe ceph_zero_partial_object function was missing proper snapshot\ncontext for its OSD write operations, which could lead to data\ninconsistencies in snapshots.\n\nReproducer:\n../src/vstart.sh --new -x --localhost --bluestore\n./bin/ceph auth caps client.fs_a mds \u0026apos;allow rwps fsname=a\u0026apos; mon \u0026apos;allow r fsname=a\u0026apos; osd \u0026apos;allow rw tag cephfs data=a\u0026apos;\nmount -t ceph (CVE-2026-43273)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\next4: move ext4_percpu_param_init() before ext4_mb_init()\n\nWhen running `kvm-xfstests -c ext4/1k -C 1 generic/383` with the\n`DOUBLE_CHECK` macro defined, the following panic is triggered:\n\n==================================================================\nEXT4-fs error (device vdc): ext4_validate_block_bitmap:423:\n                        comm mount: bg 0: bad block bitmap checksum\nBUG: unable to handle page fault for address: ff110000fa2cc000\nPGD 3e01067 P4D 3e02067 PUD 0\nOops: Oops: 0000 [#1] SMP NOPTI\nCPU: 0 UID: 0 PID: 2386 Comm: mount Tainted: G W\n                        6.18.0-gba65a4e7120a-dirty #1152 PREEMPT(none)\nRIP: 0010:percpu_counter_add_batch+0x13/0xa0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n ext4_mark_group_bitmap_corrupted+0xcb/0xe0\n ext4_validate_block_bitmap+0x2a1/0x2f0\n ext4_read_block_bitmap+0x33/0x50\n mb_group_bb_bitmap_alloc+0x33/0x80\n ext4_mb_add_groupinfo+0x190/0x250\n ext4_mb_init_backend+0x87/0x290\n ext4_mb_init+0x456/0x640\n __ext4_fill_super+0x1072/0x1680\n ext4_fill_super+0xd3/0x280\n get_tree_bdev_flags+0x132/0x1d0\n vfs_get_tree+0x29/0xd0\n vfs_cmd_create+0x59/0xe0\n __do_sys_fsconfig+0x4f6/0x6b0\n do_syscall_64+0x50/0x1f0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n==================================================================\n\nThis issue can be reproduced using the following commands:\n        mkfs.ext4 -F -q -b 1024 /dev/sda 5G\n        tune2fs -O quota,project /dev/sda\n        mount /dev/sda /tmp/test\n\nWith DOUBLE_CHECK defined, mb_group_bb_bitmap_alloc() reads\nand validates the block bitmap. When the validation fails,\next4_mark_group_bitmap_corrupted() attempts to update\nsbi-\u0026gt;s_freeclusters_counter. However, this percpu_counter has not been\ninitialized yet at this point, which leads to the panic described above.\n\nFix this by moving the execution of ext4_percpu_param_init() to occur\nbefore ext4_mb_init(), ensuring the per-CPU counters are initialized\nbefore they are used.(CVE-2026-43288)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node\n\nWhen CONFIG_PAGE_OWNER is enabled, freeing KASAN shadow pages during\nvmalloc cleanup triggers expensive stack unwinding that acquires RCU read\nlocks.  Processing a large purge_list without rescheduling can cause the\ntask to hold CPU for extended periods (10+ seconds), leading to RCU stalls\nand potential OOM conditions.\n\nThe issue manifests in purge_vmap_node() -\u0026gt; kasan_release_vmalloc_node()\nwhere iterating through hundreds or thousands of vmap_area entries and\nfreeing their associated shadow pages causes:\n\n  rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:\n  rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P6229/1:b..l\n  ...\n  task:kworker/0:17 state:R running task stack:28840 pid:6229\n  ...\n  kasan_release_vmalloc_node+0x1ba/0xad0 mm/vmalloc.c:2299\n  purge_vmap_node+0x1ba/0xad0 mm/vmalloc.c:2299\n\nEach call to kasan_release_vmalloc() can free many pages, and with\npage_owner tracking, each free triggers save_stack() which performs stack\nunwinding under RCU read lock.  Without yielding, this creates an\nunbounded RCU critical section.\n\nAdd periodic cond_resched() calls within the loop to allow:\n- RCU grace periods to complete\n- Other tasks to run\n- Scheduler to preempt when needed\n\nThe fix uses need_resched() for immediate response under load, with a\nbatch count of 32 as a guaranteed upper bound to prevent worst-case stalls\neven under light load.(CVE-2026-43292)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipa: fix event ring index not programmed for IPA v5.0+\n\nFor IPA v5.0+, the event ring index field moved from CH_C_CNTXT_0 to\nCH_C_CNTXT_1. The v5.0 register definition intended to define this\nfield in the CH_C_CNTXT_1 fmask array but used the old identifier of\nERINDEX instead of CH_ERINDEX.\n\nWithout a valid event ring, GSI channels could never signal transfer\ncompletions. This caused gsi_channel_trans_quiesce() to block\nforever in wait_for_completion().\n\nAt least for IPA v5.2 this resolves an issue seen where runtime\nsuspend, system suspend, and remoteproc stop all hanged forever. It\nalso meant the IPA data path was completely non functional.(CVE-2026-43345)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/kbuf: check if target buffer list is still legacy on recycle\n\nThere\u0026apos;s a gap between when the buffer was grabbed and when it\npotentially gets recycled, where if the list is empty, someone could\u0026apos;ve\nupgraded it to a ring provided type. This can happen if the request\nis forced via io-wq. The legacy recycling is missing checking if the\nbuffer_list still exists, and if it\u0026apos;s of the correct type. Add those\nchecks.(CVE-2026-43366)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: prevent potential out-of-bounds reads in process_message_header()\n\nIf the message frame is (maliciously) corrupted in a way that the\nlength of the control segment ends up being less than the size of the\nmessage header or a different frame is made to look like a message\nframe, out-of-bounds reads may ensue in process_message_header().\n\nPerform an explicit bounds check before decoding the message header.(CVE-2026-43406)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix memory leaks in ceph_mdsc_build_path()\n\nAdd __putname() calls to error code paths that did not free the \u0026quot;path\u0026quot;\npointer obtained by __getname().  If ownership of this pointer is not\npassed to the caller via path_info.path, the function must free it\nbefore returning.(CVE-2026-43419)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: class: cdc-wdm: fix reordering issue in read code path\n\nQuoting the bug report:\n\nDue to compiler optimization or CPU out-of-order execution, the\ndesc-\u0026gt;length update can be reordered before the memmove. If this\nhappens, wdm_read() can see the new length and call copy_to_user() on\nuninitialized memory. This also violates LKMM data race rules [1].\n\nFix it by using WRITE_ONCE and memory barriers.(CVE-2026-43427)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nUSB: core: Limit the length of unkillable synchronous timeouts\n\nThe usb_control_msg(), usb_bulk_msg(), and usb_interrupt_msg() APIs in\nusbcore allow unlimited timeout durations.  And since they use\nuninterruptible waits, this leaves open the possibility of hanging a\ntask for an indefinitely long time, with no way to kill it short of\nunplugging the target device.\n\nTo prevent this sort of problem, enforce a maximum limit on the length\nof these unkillable timeouts.  The limit chosen here, somewhat\narbitrarily, is 60 seconds.  On many systems (although not all) this\nis short enough to avoid triggering the kernel\u0026apos;s hung-task detector.\n\nIn addition, clear up the ambiguity of negative timeout values by\ntreating them the same as 0, i.e., using the maximum allowed timeout.(CVE-2026-43428)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Fix deadlock between devlink lock and esw-\u0026gt;wq\n\nesw-\u0026gt;work_queue executes esw_functions_changed_event_handler -\u0026gt;\nesw_vfs_changed_event_handler and acquires the devlink lock.\n\n.eswitch_mode_set (acquires devlink lock in devlink_nl_pre_doit) -\u0026gt;\nmlx5_devlink_eswitch_mode_set -\u0026gt; mlx5_eswitch_disable_locked -\u0026gt;\nmlx5_eswitch_event_handler_unregister -\u0026gt; flush_workqueue deadlocks\nwhen esw_vfs_changed_event_handler executes.\n\nFix that by no longer flushing the work to avoid the deadlock, and using\na generation counter to keep track of work relevance. This avoids an old\nhandler manipulating an esw that has undergone one or more mode changes:\n- the counter is incremented in mlx5_eswitch_event_handler_unregister.\n- the counter is read and passed to the ephemeral mlx5_host_work struct.\n- the work handler takes the devlink lock and bails out if the current\n  generation is different than the one it was scheduled to operate on.\n- mlx5_eswitch_cleanup does the final draining before destroying the wq.\n\nNo longer flushing the workqueue has the side effect of maybe no longer\ncancelling pending vport_change_handler work items, but that\u0026apos;s ok since\nthose are disabled elsewhere:\n- mlx5_eswitch_disable_locked disables the vport eq notifier.\n- mlx5_esw_vport_disable disarms the HW EQ notification and marks\n  vport-\u0026gt;enabled under state_lock to false to prevent pending vport\n  handler from doing anything.\n- mlx5_eswitch_cleanup destroys the workqueue and makes sure all events\n  are disabled/finished.(CVE-2026-43468)\n\nIn the Linux kernel, the following vulnerability has been resolved:  crypto: pcrypt - Fix handling of MAY_BACKLOG requests  MAY_BACKLOG requests can return EBUSY.  Handle them by checking for that value and filtering out EINPROGRESS notifications.  The Linux kernel CVE team has assigned CVE-2026-43493 to this issue.(CVE-2026-43493)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: propagate shared-frag marker through frag-transfer helpers\n\nTwo frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail\nto propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()-\u0026gt;flags when\nmoving frags from source to destination.  __pskb_copy_fclone() defers\nthe rest of the shinfo metadata to skb_copy_header() after copying\nfrag descriptors, but that helper only carries over gso_{size,segs,\ntype} and never touches skb_shinfo()-\u0026gt;flags; skb_shift() moves frag\ndescriptors directly and leaves flags untouched.  As a result, the\ndestination skb keeps a reference to the same externally-owned or\npage-cache-backed pages while reporting skb_has_shared_frag() as\nfalse.\n\nThe mismatch is harmful in any in-place writer that uses\nskb_has_shared_frag() to decide whether shared pages must be detoured\nthrough skb_cow_data().  ESP input is one such writer (esp4.c,\nesp6.c), and a single nft \u0026apos;dup to \u0026lt;local\u0026gt;\u0026apos; rule -- or any other\nnf_dup_ipv4() / xt_TEE caller -- is enough to land a pskb_copy()\u0026apos;d\nskb in esp_input() with the marker stripped, letting an unprivileged\nuser write into the page cache of a root-owned read-only file via\nauthencesn-ESN stray writes.\n\nSet SKBFL_SHARED_FRAG on the destination whenever frag descriptors\nwere actually moved from the source.  skb_copy() and skb_copy_expand()\nshare skb_copy_header() too but linearize all paged data into freshly\nallocated head storage and emerge with nr_frags == 0, so\nskb_has_shared_frag() returns false on its own; they need no change.\n\nThe same omission exists in skb_gro_receive() and skb_gro_receive_list().\nThe former moves the incoming skb\u0026apos;s frag descriptors into the\naccumulator\u0026apos;s last sub-skb via two paths (a direct frag-move loop and\nthe head_frag + memcpy path); the latter chains the incoming skb whole\nonto p\u0026apos;s frag_list.  Downstream skb_segment() reads only\nskb_shinfo(p)-\u0026gt;flags, and skb_segment_list() reuses each sub-skb\u0026apos;s\nshinfo as the nskb -- both p and lp must carry the marker.\n\nThe same omission also exists in tcp_clone_payload(), which builds an\nMTU probe skb by moving frag descriptors from skbs on sk_write_queue\ninto a freshly allocated nskb.  The helper falls into the same family\nand warrants the same fix for consistency; no TCP TX-side in-place\nwriter is currently known to reach a user page through this gap, but\na future consumer depending on the marker would regress silently.\n\nThe same omission exists in skb_segment(): the per-iteration flag\nmerge takes only head_skb\u0026apos;s flag, and the inner switch that rebinds\nfrag_skb to list_skb on head_skb-frags exhaustion does not fold the\nnew frag_skb\u0026apos;s flag into nskb.  Fold frag_skb\u0026apos;s flag at both sites\nso segments drawing frags from frag_list members carry the marker.(CVE-2026-43503)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()\n\nAdd the same NULL guard already present in\nl2cap_sock_resume_cb() and l2cap_sock_ready_cb().(CVE-2026-45834)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Fix slab-use-after-free in qd_put\n\nCommit a475c5dd16e5 (\u0026quot;gfs2: Free quota data objects synchronously\u0026quot;)\nstarted freeing quota data objects during filesystem shutdown instead of\nputting them back onto the LRU list, but it failed to remove these\nobjects from the LRU list, causing LRU list corruption.  This caused\nuse-after-free when the shrinker (gfs2_qd_shrink_scan) tried to access\nalready-freed objects on the LRU list.\n\nFix this by removing qd objects from the LRU list before freeing them in\nqd_put().\n\nInitial fix from Deepanshu Kartikey \u0026lt;(CVE-2026-45861)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: cdns3: fix role switching during resume\n\nIf the role change while we are suspended, the cdns3 driver switches to the\nnew mode during resume. However, switching to host mode in this context\ncauses a NULL pointer dereference.\n\nThe host role\u0026apos;s start() operation registers a xhci-hcd device, but its\nprobe is deferred while we are in the resume path. The host role\u0026apos;s resume()\noperation assumes the xhci-hcd device is already probed, which is not the\ncase, leading to the dereference. Since the start() operation of the new\nrole is already called, the resume operation can be skipped.\n\nSo skip the resume operation for the new role if a role switch occurs\nduring resume. Once the resume sequence is complete, the xhci-hcd device\ncan be probed in case of host mode.\n\nUnable to handle kernel NULL pointer dereference at virtual address 0000000000000208\nMem abort info:\n...\nData abort info:\n...\n[0000000000000208] pgd=0000000000000000, p4d=0000000000000000\nInternal error: Oops: 0000000096000004 [#1]  SMP\nModules linked in:\nCPU: 0 UID: 0 PID: 146 Comm: sh Not tainted\n6.19.0-rc7-00013-g6e64f4aabfae-dirty #135 PREEMPT\nHardware name: Texas Instruments J7200 EVM (DT)\npstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : usb_hcd_is_primary_hcd+0x0/0x1c\nlr : cdns_host_resume+0x24/0x5c\n...\nCall trace:\n usb_hcd_is_primary_hcd+0x0/0x1c (P)\n cdns_resume+0x6c/0xbc\n cdns3_controller_resume.isra.0+0xe8/0x17c\n cdns3_plat_resume+0x18/0x24\n platform_pm_resume+0x2c/0x68\n dpm_run_callback+0x90/0x248\n device_resume+0x100/0x24c\n dpm_resume+0x190/0x2ec\n dpm_resume_end+0x18/0x34\n suspend_devices_and_enter+0x2b0/0xa44\n pm_suspend+0x16c/0x5fc\n state_store+0x80/0xec\n kobj_attr_store+0x18/0x2c\n sysfs_kf_write+0x7c/0x94\n kernfs_fop_write_iter+0x130/0x1dc\n vfs_write+0x240/0x370\n ksys_write+0x70/0x108\n __arm64_sys_write+0x1c/0x28\n invoke_syscall+0x48/0x10c\n el0_svc_common.constprop.0+0x40/0xe0\n do_el0_svc+0x1c/0x28\n el0_svc+0x34/0x108\n el0t_64_sync_handler+0xa0/0xe4\n el0t_64_sync+0x198/0x19c\nCode: 52800003 f9407ca5 d63f00a0 17ffffe4 (f9410401)\n---[ end trace 0000000000000000 ]---(CVE-2026-45911)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix inline data read failure for ztailpacking pclusters\n\nCompressed folios for ztailpacking pclusters must be valid before adding\nthese pclusters to I/O chains. Otherwise, z_erofs_decompress_pcluster()\nmay assume they are already valid and then trigger a NULL pointer\ndereference.\n\nIt is somewhat hard to reproduce because the inline data is in the same\nblock as the tail of the compressed indexes, which are usually read just\nbefore. However, it may still happen if a fatal signal arrives while\nread_mapping_folio() is running, as shown below:\n\n erofs: (device dm-1): z_erofs_pcluster_begin: failed to get inline data -4\n Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008\n\n ...\n\n pc : z_erofs_decompress_queue+0x4c8/0xa14\n lr : z_erofs_decompress_queue+0x160/0xa14\n sp : ffffffc08b3eb3a0\n x29: ffffffc08b3eb570 x28: ffffffc08b3eb418 x27: 0000000000001000\n x26: ffffff8086ebdbb8 x25: ffffff8086ebdbb8 x24: 0000000000000001\n x23: 0000000000000008 x22: 00000000fffffffb x21: dead000000000700\n x20: 00000000000015e7 x19: ffffff808babb400 x18: ffffffc089edc098\n x17: 00000000c006287d x16: 00000000c006287d x15: 0000000000000004\n x14: ffffff80ba8f8000 x13: 0000000000000004 x12: 00000006589a77c9\n x11: 0000000000000015 x10: 0000000000000000 x9 : 0000000000000000\n x8 : 0000000000000000 x7 : 0000000000000000 x6 : 000000000000003f\n x5 : 0000000000000040 x4 : ffffffffffffffe0 x3 : 0000000000000020\n x2 : 0000000000000008 x1 : 0000000000000000 x0 : 0000000000000000\n Call trace:\n  z_erofs_decompress_queue+0x4c8/0xa14\n  z_erofs_runqueue+0x908/0x97c\n  z_erofs_read_folio+0x128/0x228\n  filemap_read_folio+0x68/0x128\n  filemap_get_pages+0x44c/0x8b4\n  filemap_read+0x12c/0x5b8\n  generic_file_read_iter+0x4c/0x15c\n  do_iter_readv_writev+0x188/0x1e0\n  vfs_iter_read+0xac/0x1a4\n  backing_file_read_iter+0x170/0x34c\n  ovl_read_iter+0xf0/0x140\n  vfs_read+0x28c/0x344\n  ksys_read+0x80/0xf0\n  __arm64_sys_read+0x24/0x34\n  invoke_syscall+0x60/0x114\n  el0_svc_common+0x88/0xe4\n  do_el0_svc+0x24/0x30\n  el0_svc+0x40/0xa8\n  el0t_64_sync_handler+0x70/0xbc\n  el0t_64_sync+0x1bc/0x1c0\n\nFix this by reading the inline data before allocating and adding\nthe pclusters to the I/O chains.(CVE-2026-45943)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc()\n\nIn amdgpu_acpi_enumerate_xcc(), if amdgpu_acpi_dev_init() returns -ENOMEM,\nthe function returns directly without releasing the allocated xcc_info,\nresulting in a memory leak.\n\nFix this by ensuring that xcc_info is properly freed in the error paths.\n\nCompile tested only. Issue found using a prototype static analysis tool\nand code review.(CVE-2026-45947)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: fix memory leaks in gfs2_fill_super error path\n\nFix two memory leaks in the gfs2_fill_super() error handling path when\ntransitioning a filesystem to read-write mode fails.\n\nFirst leak: kthread objects (thread_struct, task_struct, etc.)\nWhen gfs2_freeze_lock_shared() fails after init_threads() succeeds, the\ncreated kernel threads (logd and quotad) are never destroyed. This\noccurs because the fail_per_node label doesn\u0026apos;t call\ngfs2_destroy_threads().\n\nSecond leak: quota bitmap buffer (8192 bytes)\nWhen gfs2_make_fs_rw() fails after gfs2_quota_init() succeeds but\nbefore other operations complete, the allocated quota bitmap is never\nfreed.\n\nThe fix moves thread cleanup to the fail_per_node label to handle all\nerror paths uniformly. gfs2_destroy_threads() is safe to call\nunconditionally as it checks for NULL pointers. Quota cleanup is added\nin gfs2_make_fs_rw() to properly handle the withdrawal case where\nquota initialization succeeds but the filesystem is then withdrawn.\n\nThread leak backtrace (gfs2_freeze_lock_shared failure):\n  unreferenced object 0xffff88801d7bca80 (size 4480):\n    copy_process+0x3a1/0x4670 kernel/fork.c:2422\n    kernel_clone+0xf3/0x6e0 kernel/fork.c:2779\n    kthread_create_on_node+0x100/0x150 kernel/kthread.c:478\n    init_threads+0xab/0x350 fs/gfs2/ops_fstype.c:611\n    gfs2_fill_super+0xe5c/0x1240 fs/gfs2/ops_fstype.c:1265\n\nQuota leak backtrace (gfs2_make_fs_rw failure):\n  unreferenced object 0xffff88812de7c000 (size 8192):\n    gfs2_quota_init+0xe5/0x820 fs/gfs2/quota.c:1409\n    gfs2_make_fs_rw+0x7a/0xe0 fs/gfs2/super.c:149\n    gfs2_fill_super+0xfbb/0x1240 fs/gfs2/ops_fstype.c:1275(CVE-2026-45961)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch()\n\nCover a missed execution path with a new check.(CVE-2026-45982)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix unsigned underflow in z_erofs_lz4_handle_overlap()\n\nSome crafted images can have illegal (!partial_decoding \u0026amp;\u0026amp;\nm_llen \u0026lt; m_plen) extents, and the LZ4 inplace decompression path\ncan be wrongly hit, but it cannot handle (outpages \u0026lt; inpages)\nproperly: \u0026quot;outpages - inpages\u0026quot; wraps to a large value and\nthe subsequent rq-\u0026gt;out[] access reads past the decompressed_pages\narray.\n\nHowever, such crafted cases can correctly result in a corruption\nreport in the normal LZ4 non-inplace path.\n\nLet\u0026apos;s add an additional check to fix this for backporting.\n\nReproducible image (base64-encoded gzipped blob):\n\nH4sIAJGR12kCA+3SPUoDQRgG4MkmkkZk8QRbRFIIi9hbpEjrHQI5ghfwCN5BLCzTGtLbBI+g\ndilSJo1CnIm7GEXFxhT6PDDwfrs73/ywIQD/1ePD4r7Ou6ETsrq4mu7XcWfj++Pb58nJU/9i\nPNtbjhan04/9GtX4qVYc814WDqt6FaX5s+ZwXXeq52lndT6IuVvlblytLMvh4Gzwaf90nsvz\n2DF/21+20T/ldgp5s1jXRaN4t/8izsy/OUB6e/Qa79r+JwAAAAAAAL52vQVuGQAAAP6+my1w\nywAAAAAAAADwu14ATsEYtgBQAAA=\n\n$ mount -t erofs -o cache_strategy=disabled foo.erofs /mnt\n$ dd if=/mnt/data of=/dev/null bs=4096 count=1(CVE-2026-45999)\n\nIn the Linux kernel, the following vulnerability has been resolved:  ipmi:ssif: Clean up kthread on errors  If an error occurs after the ssif kthread is created, but before the main IPMI code starts the ssif interface, the ssif kthread will not be stopped.  So make sure the kthread is stopped on an error condition if it is running.  The Linux kernel CVE team has assigned CVE-2026-46044 to this issue.(CVE-2026-46044)\n\nIn the Linux kernel, the following vulnerability has been resolved:  md/raid5: fix soft lockup in retry_aligned_read()  When retry_aligned_read() encounters an overlapped stripe, it releases the stripe via raid5_release_stripe() which puts it on the lockless released_stripes llist. In the next raid5d loop iteration, release_stripe_list() drains the stripe onto handle_list (since STRIPE_HANDLE is set by the original IO), but retry_aligned_read() runs before handle_active_stripes() and removes the stripe from handle_list via find_get_stripe() -\u0026gt; list_del_init(). This prevents handle_stripe() from ever processing the stripe to resolve the overlap, causing an infinite loop and soft lockup.  Fix this by using __release_stripe() with temp_inactive_list instead of raid5_release_stripe() in the failure path, so the stripe does not go through the released_stripes llist. This allows raid5d to break out of its loop, and the overlap will be resolved when the stripe is eventually processed by handle_stripe().  The Linux kernel CVE team has assigned CVE-2026-46051 to this issue.(CVE-2026-46051)\n\nIn the Linux kernel, the following vulnerability has been resolved:  KVM: nSVM: Raise #UD if unhandled VMMCALL isn\u0026apos;t intercepted by L1  Explicitly synthesize a #UD for VMMCALL if L2 is active, L1 does NOT want to intercept VMMCALL, nested_svm_l2_tlb_flush_enabled() is true, and the hypercall is something other than one of the supported Hyper-V hypercalls. When all of the above conditions are met, KVM will intercept VMMCALL but never forward it to L1, i.e. will let L2 make hypercalls as if it were L1.  The TLFS says a whole lot of nothing about this scenario, so go with the architectural behavior, which says that VMMCALL #UDs if it\u0026apos;s not intercepted.  Opportunistically do a 2-for-1 stub trade by stub-ifying the new API instead of the helpers it uses.  The last remaining \u0026quot;single\u0026quot; stub will soon be dropped as well.  [sean: rewrite changelog and comment, tag for stable, remove defunct stubs]  The Linux kernel CVE team has assigned CVE-2026-46076 to this issue.(CVE-2026-46076)\n\nIn the Linux kernel, the following vulnerability has been resolved:  erofs: fix the out-of-bounds nameoff handling for trailing dirents  Currently we already have boundary-checks for nameoffs, but the trailing dirents are special since the namelens are calculated with strnlen() with unchecked nameoffs.  If a crafted EROFS has a trailing dirent with nameoff \u0026gt;= maxsize, maxsize - nameoff can underflow, causing strnlen() to read past the directory block.  nameoff0 should also be verified to be a multiple of `sizeof(struct erofs_dirent)` as well [1].  [1] https://sashiko.dev/#/patchset/20260416063511.3173774-1-hsiangkao%40linux.alibaba.com  The Linux kernel CVE team has assigned CVE-2026-46078 to this issue.(CVE-2026-46078)\n\nIn the Linux kernel, the following vulnerability has been resolved:  KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0  INVLPGA should cause a #UD when EFER.SVME is not set. Add a check to properly inject #UD when EFER.SVME=0.  [sean: tag for stable@]  The Linux kernel CVE team has assigned CVE-2026-46082 to this issue.(CVE-2026-46082)\n\nIn the Linux kernel, the following vulnerability has been resolved:  mm/vmalloc: take vmap_purge_lock in shrinker  decay_va_pool_node() can be invoked concurrently from two paths: __purge_vmap_area_lazy() when pools are being purged, and the shrinker via vmap_node_shrink_scan().  However, decay_va_pool_node() is not safe to run concurrently, and the shrinker path currently lacks serialization, leading to races and possible leaks.  Protect decay_va_pool_node() by taking vmap_purge_lock in the shrinker path to ensure serialization with purge users.  The Linux kernel CVE team has assigned CVE-2026-46093 to this issue.(CVE-2026-46093)\n\nIn the Linux kernel, the following vulnerability has been resolved:mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lockPatch series \u0026quot;mm/damon/sysfs-schemes: fix use-after-free for [memcg_]path\u0026quot;.Reads of \u0026apos;memcg_path\u0026apos; and \u0026apos;path\u0026apos; files in DAMON sysfs interface could racewith their writes, results in use-after-free.  Fix those.This patch (of 2):damon_sysfs_scheme_filter-\u0026gt;mmecg_path can be read and written by users,via DAMON sysfs memcg_path file.  It can also be indirectly read, for theparameters {on,off}line committing to DAMON.  The reads for parameterscommitting are protected by damon_sysfs_lock to avoid the sysfs filesbeing destroyed while any of the parameters are being read.  But theuser-driven direct reads and writes are not protected by any lock, whilethe write is deallocating the memcg_path-pointing buffer.  As a result,the readers could read the already freed buffer (user-after-free).  Notethat the user-reads don\u0026apos;t race when the same open file is used by thewriter, due to kernfs\u0026apos;s open file locking.  Nonetheless, doing the readsand writes with separate open files would be common.  Fix it by protectingboth the user-direct reads and writes with damon_sysfs_lock.(CVE-2026-46121)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt\n\nhci_le_create_big_complete_evt() iterates over BT_BOUND connections for\na BIG handle using a while loop, accessing ev-\u0026gt;bis_handle[i++] on each\niteration.  However, there is no check that i stays within ev-\u0026gt;num_bis\nbefore the array access.\n\nWhen a controller sends a LE_Create_BIG_Complete event with fewer\nbis_handle entries than there are BT_BOUND connections for that BIG,\nor with num_bis=0, the loop reads beyond the valid bis_handle[] flex\narray into adjacent heap memory.  Since the out-of-bounds values\ntypically exceed HCI_CONN_HANDLE_MAX (0x0EFF), hci_conn_set_handle()\nrejects them and the connection remains in BT_BOUND state.  The same\nconnection is then found again by hci_conn_hash_lookup_big_state(),\ncreating an infinite loop with hci_dev_lock held.\n\nFix this by terminating the BIG if in case not all BIS could be setup\nproperly.(CVE-2026-46138)\n\nIn the Linux kernel, vports are used concurrently and protected by RCU, so netdev_put() must happen after the RCU grace period. The rtnl_delete_link() must happen under RTNL and cannot be executed in RCU context. Calling synchronize_net() while holding RTNL is not good for performance and system stability, so calling netdev_put() in RCU call is the right solution. However, when the device is deleted, rtnl_unlock() calls netdev_run_todo() and blocks until all references are gone. In the current code, this means that call_rcu() is never reached, the vport is never freed, and the reference is never released, causing a self-deadlock on device removal. The fix moves the rcu_call() before rtnl_unlock(), so the scheduled RCU callback will be executed when synchronize_net() is called from rtnl_unlock()-\u0026gt;netdev_run_todo() while RTNL itself is already released.(CVE-2026-46165)\n\nIn the Linux kernel\u0026apos;s RISC-V KVM subsystem, when the second kzalloc (host_context.vector.datap) fails in kvm_riscv_vcpu_alloc_vector_context, the first allocation (guest_context.vector.datap) is not freed, causing a memory leak. An attacker can trigger this via ioctl(vm_fd, KVM_CREATE_VCPU), potentially leading to resource exhaustion.(CVE-2026-46171)\n\nIn the Linux kernel, the mlx4_ib_create_srq() function fails to release resources allocated by mlx4_srq_alloc() in error handling paths, leading to a resource leak. An attacker could exploit this vulnerability to cause resource exhaustion or denial of service.(CVE-2026-46178)\n\nIn the Linux kernel, the spi_nor_params_show() function uses sizeof(snor_f_names) to calculate the array length. Since snor_f_names is an array of pointers, sizeof returns the total byte size of the pointer array (element_count  sizeof(void )), which on 64-bit systems is 8 times larger than intended. This causes an out-of-bounds read when a flag bit is set that exceeds the actual element count but falls within the inflated byte-size count. The fix replaces sizeof with ARRAY_SIZE to pass the actual number of elements.(CVE-2026-46190)","status":"published","published":"2026-06-05T11:11:31Z","modified":"2026-08-18T01:20:04.171596141Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-3157","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\n\nArm C1-Ultra, C1-Premium, Neoverse V3 \u0026amp; V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 \u0026amp; X1C, Cortex-A710, Cortex-A78, A78AE \u0026amp; A78C, Cortex-A77, Cortex-A76 \u0026amp; A76A may allow writes to resources owned by a higher exception level.(CVE-2025-10263)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: let smbd_destroy() call disable_work_sync(\u0026amp;info-\u0026gt;post_send_credits_work)\n\nIn smbd_destroy() we may destroy the memory so we better\nwait until post_send_credits_work is no longer pending\nand will never be started again.\n\nI actually just hit the case using rxe:\n\nWARNING: CPU: 0 PID: 138 at drivers/infiniband/sw/rxe/rxe_verbs.c:1032 rxe_post_recv+0x1ee/0x480 [rdma_rxe]\n...\n[ 5305.686979] [    T138]  smbd_post_recv+0x445/0xc10 [cifs]\n[ 5305.687135] [    T138]  ? srso_alias_return_thunk+0x5/0xfbef5\n[ 5305.687149] [    T138]  ? __kasan_check_write+0x14/0x30\n[ 5305.687185] [    T138]  ? __pfx_smbd_post_recv+0x10/0x10 [cifs]\n[ 5305.687329] [    T138]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n[ 5305.687356] [    T138]  ? srso_alias_return_thunk+0x5/0xfbef5\n[ 5305.687368] [    T138]  ? srso_alias_return_thunk+0x5/0xfbef5\n[ 5305.687378] [    T138]  ? _raw_spin_unlock_irqrestore+0x11/0x60\n[ 5305.687389] [    T138]  ? srso_alias_return_thunk+0x5/0xfbef5\n[ 5305.687399] [    T138]  ? get_receive_buffer+0x168/0x210 [cifs]\n[ 5305.687555] [    T138]  smbd_post_send_credits+0x382/0x4b0 [cifs]\n[ 5305.687701] [    T138]  ? __pfx_smbd_post_send_credits+0x10/0x10 [cifs]\n[ 5305.687855] [    T138]  ? __pfx___schedule+0x10/0x10\n[ 5305.687865] [    T138]  ? __pfx__raw_spin_lock_irq+0x10/0x10\n[ 5305.687875] [    T138]  ? queue_delayed_work_on+0x8e/0xa0\n[ 5305.687889] [    T138]  process_one_work+0x629/0xf80\n[ 5305.687908] [    T138]  ? srso_alias_return_thunk+0x5/0xfbef5\n[ 5305.687917] [    T138]  ? __kasan_check_write+0x14/0x30\n[ 5305.687933] [    T138]  worker_thread+0x87f/0x1570\n...\n\nIt means rxe_post_recv was called after rdma_destroy_qp().\nThis happened because put_receive_buffer() was triggered\nby ib_drain_qp() and called:\nqueue_work(info-\u0026gt;workqueue, \u0026amp;info-\u0026gt;post_send_credits_work);(CVE-2025-39932)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nMIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits\n\nSince commit e424054000878 (\u0026quot;MIPS: Tracing: Reduce the overhead of\ndynamic Function Tracer\u0026quot;), the macro UASM_i_LA_mostly has been used,\nand this macro can generate more than 2 instructions. At the same\ntime, the code in ftrace assumes that no more than 2 instructions can\nbe generated, which is why it stores them in an int[2] array. However,\nas previously noted, the macro UASM_i_LA_mostly (and now UASM_i_LA)\ncauses a buffer overflow when _mcount is beyond 32 bits. This leads to\ncorruption of the variables located in the __read_mostly section.\n\nThis corruption was observed because the variable\n__cpu_primary_thread_mask was corrupted, causing a hang very early\nduring boot.\n\nThis fix prevents the corruption by avoiding the generation of\ninstructions if they could exceed 2 instructions in\nlength. Fortunately, insn_la_mcount is only used if the instrumented\ncode is located outside the kernel code section, so dynamic ftrace can\nstill be used, albeit in a more limited scope. This is still\npreferable to corrupting memory and/or crashing the kernel.(CVE-2025-71109)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nriscv: Sanitize syscall table indexing under speculation\n\nThe syscall number is a user-controlled value used to index into the\nsyscall table. Use array_index_nospec() to clamp this value after the\nbounds check to prevent speculative out-of-bounds access and subsequent\ndata leakage via cache side channels.(CVE-2025-71203)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: Disable MMIO access during SMU Mode 1 reset\n\nDuring Mode 1 reset, the ASIC undergoes a reset cycle and becomes\ntemporarily inaccessible via PCIe. Any attempt to access MMIO registers\nduring this window (e.g., from interrupt handlers or other driver threads)\ncan result in uncompleted PCIe transactions, leading to NMI panics or\nsystem hangs.\n\nTo prevent this, set the `no_hw_access` flag to true immediately after\ntriggering the reset. This signals other driver components to skip\nregister accesses while the device is offline.\n\nA memory barrier `smp_mb()` is added to ensure the flag update is\nglobally visible to all cores before the driver enters the sleep/wait\nstate.\n\n(cherry picked from commit 7edb503fe4b6d67f47d8bb0dfafb8e699bb0f8a4)(CVE-2026-23213)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: reject new transactions if the fs is fully read-only\n\n[BUG]\nThere is a bug report where a heavily fuzzed fs is mounted with all\nrescue mount options, which leads to the following warnings during\nunmount:\n\n  BTRFS: Transaction aborted (error -22)\n  Modules linked in:\n  CPU: 0 UID: 0 PID: 9758 Comm: repro.out Not tainted\n  6.19.0-rc5-00002-gb71e635feefc #7 PREEMPT(full)\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\n  RIP: 0010:find_free_extent_update_loop fs/btrfs/extent-tree.c:4208 [inline]\n  RIP: 0010:find_free_extent+0x52f0/0x5d20 fs/btrfs/extent-tree.c:4611\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   btrfs_reserve_extent+0x2cd/0x790 fs/btrfs/extent-tree.c:4705\n   btrfs_alloc_tree_block+0x1e1/0x10e0 fs/btrfs/extent-tree.c:5157\n   btrfs_force_cow_block+0x578/0x2410 fs/btrfs/ctree.c:517\n   btrfs_cow_block+0x3c4/0xa80 fs/btrfs/ctree.c:708\n   btrfs_search_slot+0xcad/0x2b50 fs/btrfs/ctree.c:2130\n   btrfs_truncate_inode_items+0x45d/0x2350 fs/btrfs/inode-item.c:499\n   btrfs_evict_inode+0x923/0xe70 fs/btrfs/inode.c:5628\n   evict+0x5f4/0xae0 fs/inode.c:837\n   __dentry_kill+0x209/0x660 fs/dcache.c:670\n   finish_dput+0xc9/0x480 fs/dcache.c:879\n   shrink_dcache_for_umount+0xa0/0x170 fs/dcache.c:1661\n   generic_shutdown_super+0x67/0x2c0 fs/super.c:621\n   kill_anon_super+0x3b/0x70 fs/super.c:1289\n   btrfs_kill_super+0x41/0x50 fs/btrfs/super.c:2127\n   deactivate_locked_super+0xbc/0x130 fs/super.c:474\n   cleanup_mnt+0x425/0x4c0 fs/namespace.c:1318\n   task_work_run+0x1d4/0x260 kernel/task_work.c:233\n   exit_task_work include/linux/task_work.h:40 [inline]\n   do_exit+0x694/0x22f0 kernel/exit.c:971\n   do_group_exit+0x21c/0x2d0 kernel/exit.c:1112\n   __do_sys_exit_group kernel/exit.c:1123 [inline]\n   __se_sys_exit_group kernel/exit.c:1121 [inline]\n   __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1121\n   x64_sys_call+0x2210/0x2210 arch/x86/include/generated/asm/syscalls_64.h:232\n   do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n   do_syscall_64+0xe8/0xf80 arch/x86/entry/syscall_64.c:94\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n  RIP: 0033:0x44f639\n  Code: Unable to access opcode bytes at 0x44f60f.\n  RSP: 002b:00007ffc15c4e088 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7\n  RAX: ffffffffffffffda RBX: 00000000004c32f0 RCX: 000000000044f639\n  RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001\n  RBP: 0000000000000001 R08: ffffffffffffffc0 R09: 0000000000000000\n  R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004c32f0\n  R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001\n   \u0026lt;/TASK\u0026gt;\n\nSince rescue mount options will mark the full fs read-only, there should\nbe no new transaction triggered.\n\nBut during unmount we will evict all inodes, which can trigger a new\ntransaction, and triggers warnings on a heavily corrupted fs.\n\n[CAUSE]\nBtrfs allows new transaction even on a read-only fs, this is to allow\nlog replay happen even on read-only mounts, just like what ext4/xfs do.\n\nHowever with rescue mount options, the fs is fully read-only and cannot\nbe remounted read-write, thus in that case we should also reject any new\ntransactions.\n\n[FIX]\nIf we find the fs has rescue mount options, we should treat the fs as\nerror, so that no new transaction can be started.(CVE-2026-23214)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvme-fc: release admin tagset if init fails\n\nnvme_fabrics creates an NVMe/FC controller in following path:\n\n    nvmf_dev_write()\n      -\u0026gt; nvmf_create_ctrl()\n        -\u0026gt; nvme_fc_create_ctrl()\n          -\u0026gt; nvme_fc_init_ctrl()\n\nnvme_fc_init_ctrl() allocates the admin blk-mq resources right after\nnvme_add_ctrl() succeeds.  If any of the subsequent steps fail (changing\nthe controller state, scheduling connect work, etc.), we jump to the\nfail_ctrl path, which tears down the controller references but never\nfrees the admin queue/tag set.  The leaked blk-mq allocations match the\nkmemleak report seen during blktests nvme/fc.\n\nCheck ctrl-\u0026gt;ctrl.admin_tagset in the fail_ctrl path and call\nnvme_remove_admin_tag_set() when it is set so that all admin queue\nallocations are reclaimed whenever controller setup aborts.(CVE-2026-23261)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_expect: use expect-\u0026gt;helper\n\nUse expect-\u0026gt;helper in ctnetlink and /proc to dump the helper name.\nUsing nfct_help() without holding a reference to the master conntrack\nis unsafe.\n\nUse exp-\u0026gt;master-\u0026gt;helper in ctnetlink path if userspace does not provide\nan explicit helper when creating an expectation to retain the existing\nbehaviour. The ctnetlink expectation path holds the reference on the\nmaster conntrack and nf_conntrack_expect lock and the nfnetlink glue\npath refers to the master ct that is attached to the skb.(CVE-2026-31414)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix OOB write in QUERY_INFO for compound requests\n\nWhen a compound request such as READ + QUERY_INFO(Security) is received,\nand the first command (READ) consumes most of the response buffer,\nksmbd could write beyond the allocated buffer while building a security\ndescriptor.\n\nThe root cause was that smb2_get_info_sec() checked buffer space using\nppntsd_size from xattr, while build_sec_desc() often synthesized a\nsignificantly larger descriptor from POSIX ACLs.\n\nThis patch introduces smb_acl_sec_desc_scratch_len() to accurately\ncompute the final descriptor size beforehand, performs proper buffer\nchecking with smb2_calc_max_out_buf_len(), and uses exact-sized\nallocation + iov pinning.(CVE-2026-31432)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: Fix leaking event log memory\n\nDuring the device remove process, the device is reset, causing the\nconfiguration registers to go back to their default state, which is\nzero. As the driver is checking if the event log support was enabled\nbefore deallocating, it will fail if a reset happened before.\n\nDo not check if the support was enabled, the check for \u0026apos;idxd-\u0026gt;evl\u0026apos;\nbeing valid (only allocated if the HW capability is available) is\nenough.(CVE-2026-31440)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: Fix crash when the event log is disabled\n\nIf reporting errors to the event log is not supported by the hardware,\nand an error that causes Function Level Reset (FLR) is received, the\ndriver will try to restore the event log even if it was not allocated.\n\nAlso, only try to free the event log if it was properly allocated.(CVE-2026-31443)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nxfs: avoid dereferencing log items after push callbacks\n\nAfter xfsaild_push_item() calls iop_push(), the log item may have been\nfreed if the AIL lock was dropped during the push. Background inode\nreclaim or the dquot shrinker can free the log item while the AIL lock\nis not held, and the tracepoints in the switch statement dereference\nthe log item after iop_push() returns.\n\nFix this by capturing the log item type, flags, and LSN before calling\nxfsaild_push_item(), and introducing a new xfs_ail_push_class trace\nevent class that takes these pre-captured values and the ailp pointer\ninstead of the log item pointer.(CVE-2026-31453)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()\n\nWhen querying a nexthop object via RTM_GETNEXTHOP, the kernel currently\nallocates a fixed-size skb using NLMSG_GOODSIZE. While sufficient for\nsingle nexthops and small Equal-Cost Multi-Path groups, this fixed\nallocation fails for large nexthop groups like 512 nexthops.\n\nThis results in the following warning splat:\n\n WARNING: net/ipv4/nexthop.c:3395 at rtm_get_nexthop+0x176/0x1c0, CPU#20: rep/4608\n [...]\n RIP: 0010:rtm_get_nexthop (net/ipv4/nexthop.c:3395)\n [...]\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  rtnetlink_rcv_msg (net/core/rtnetlink.c:6989)\n  netlink_rcv_skb (net/netlink/af_netlink.c:2550)\n  netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)\n  netlink_sendmsg (net/netlink/af_netlink.c:1894)\n  ____sys_sendmsg (net/socket.c:721 net/socket.c:736 net/socket.c:2585)\n  ___sys_sendmsg (net/socket.c:2641)\n  __sys_sendmsg (net/socket.c:2671)\n  do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)\n  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n  \u0026lt;/TASK\u0026gt;\n\nFix this by allocating the size dynamically using nh_nlmsg_size() and\nusing nlmsg_new(), this is consistent with nexthop_notify() behavior. In\naddition, adjust nh_nlmsg_size_grp() so it calculates the size needed\nbased on flags passed. While at it, also add the size of NHA_FDB for\nnexthop group size calculation as it was missing too.\n\nThis cannot be reproduced via iproute2 as the group size is currently\nlimited and the command fails as follows:\n\naddattr_l ERROR: message exceeded bound of 1048(CVE-2026-31531)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: Fix static_branch_dec() underflow for aql_disable.\n\nsyzbot reported static_branch_dec() underflow in aql_enable_write(). [0]\n\nThe problem is that aql_enable_write() does not serialise concurrent\nwrite()s to the debugfs.\n\naql_enable_write() checks static_key_false(\u0026amp;aql_disable.key) and\nlater calls static_branch_inc() or static_branch_dec(), but the\nstate may change between the two calls.\n\naql_disable does not need to track inc/dec.\n\nLet\u0026apos;s use static_branch_enable() and static_branch_disable().\n\n[0]:\nval == 0\nWARNING: kernel/jump_label.c:311 at __static_key_slow_dec_cpuslocked.part.0+0x107/0x120 kernel/jump_label.c:311, CPU#0: syz.1.3155/20288\nModules linked in:\nCPU: 0 UID: 0 PID: 20288 Comm: syz.1.3155 Tainted: G     U       L      syzkaller #0 PREEMPT(full)\nTainted: [U]=USER, [L]=SOFTLOCKUP\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026\nRIP: 0010:__static_key_slow_dec_cpuslocked.part.0+0x107/0x120 kernel/jump_label.c:311\nCode: f2 c9 ff 5b 5d c3 cc cc cc cc e8 54 f2 c9 ff 48 89 df e8 ac f9 ff ff eb ad e8 45 f2 c9 ff 90 0f 0b 90 eb a2 e8 3a f2 c9 ff 90 \u0026lt;0f\u0026gt; 0b 90 eb 97 48 89 df e8 5c 4b 33 00 e9 36 ff ff ff 0f 1f 80 00\nRSP: 0018:ffffc9000b9f7c10 EFLAGS: 00010293\nRAX: 0000000000000000 RBX: ffffffff9b3e5d40 RCX: ffffffff823c57b4\nRDX: ffff8880285a0000 RSI: ffffffff823c5846 RDI: ffff8880285a0000\nRBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: 000000000000000a\nR13: 1ffff9200173ef88 R14: 0000000000000001 R15: ffffc9000b9f7e98\nFS:  00007f530dd726c0(0000) GS:ffff8881245e3000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000200000001140 CR3: 000000007cc4a000 CR4: 00000000003526f0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n __static_key_slow_dec_cpuslocked kernel/jump_label.c:297 [inline]\n __static_key_slow_dec kernel/jump_label.c:321 [inline]\n static_key_slow_dec+0x7c/0xc0 kernel/jump_label.c:336\n aql_enable_write+0x2b2/0x310 net/mac80211/debugfs.c:343\n short_proxy_write+0x133/0x1a0 fs/debugfs/file.c:383\n vfs_write+0x2aa/0x1070 fs/read_write.c:684\n ksys_pwrite64 fs/read_write.c:793 [inline]\n __do_sys_pwrite64 fs/read_write.c:801 [inline]\n __se_sys_pwrite64 fs/read_write.c:798 [inline]\n __x64_sys_pwrite64+0x1eb/0x250 fs/read_write.c:798\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f530cf9aeb9\nCode: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f530dd72028 EFLAGS: 00000246 ORIG_RAX: 0000000000000012\nRAX: ffffffffffffffda RBX: 00007f530d215fa0 RCX: 00007f530cf9aeb9\nRDX: 0000000000000003 RSI: 0000000000000000 RDI: 0000000000000010\nRBP: 00007f530d008c1f R08: 0000000000000000 R09: 0000000000000000\nR10: 4200000000000005 R11: 0000000000000246 R12: 0000000000000000\nR13: 00007f530d216038 R14: 00007f530d215fa0 R15: 00007ffde89fb978\n \u0026lt;/TASK\u0026gt;(CVE-2026-31551)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: move async event work off nvmet-wq\n\nFor target nvmet_ctrl_free() flushes ctrl-\u0026gt;async_event_work.\nIf nvmet_ctrl_free() runs on nvmet-wq, the flush re-enters workqueue\ncompletion for the same worker:-\n\nA. Async event work queued on nvmet-wq (prior to disconnect):\n  nvmet_execute_async_event()\n     queue_work(nvmet_wq, \u0026amp;ctrl-\u0026gt;async_event_work)\n\n  nvmet_add_async_event()\n     queue_work(nvmet_wq, \u0026amp;ctrl-\u0026gt;async_event_work)\n\nB. Full pre-work chain (RDMA CM path):\n  nvmet_rdma_cm_handler()\n     nvmet_rdma_queue_disconnect()\n       __nvmet_rdma_queue_disconnect()\n         queue_work(nvmet_wq, \u0026amp;queue-\u0026gt;release_work)\n           process_one_work()\n             lock((wq_completion)nvmet-wq)  \u0026lt;--------- 1st\n             nvmet_rdma_release_queue_work()\n\nC. Recursive path (same worker):\n  nvmet_rdma_release_queue_work()\n     nvmet_rdma_free_queue()\n       nvmet_sq_destroy()\n         nvmet_ctrl_put()\n           nvmet_ctrl_free()\n             flush_work(\u0026amp;ctrl-\u0026gt;async_event_work)\n               __flush_work()\n                 touch_wq_lockdep_map()\n                 lock((wq_completion)nvmet-wq) \u0026lt;--------- 2nd\n\nLockdep splat:\n\n  ============================================\n  WARNING: possible recursive locking detected\n  6.19.0-rc3nvme+ #14 Tainted: G                 N\n  --------------------------------------------\n  kworker/u192:42/44933 is trying to acquire lock:\n  ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: touch_wq_lockdep_map+0x26/0x90\n\n  but task is already holding lock:\n  ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: process_one_work+0x53e/0x660\n\n  3 locks held by kworker/u192:42/44933:\n   #0: ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: process_one_work+0x53e/0x660\n   #1: ffffc9000e6cbe28 ((work_completion)(\u0026amp;queue-\u0026gt;release_work)){+.+.}-{0:0}, at: process_one_work+0x1c5/0x660\n   #2: ffffffff82d4db60 (rcu_read_lock){....}-{1:3}, at: __flush_work+0x62/0x530\n\n  Workqueue: nvmet-wq nvmet_rdma_release_queue_work [nvmet_rdma]\n  Call Trace:\n   __flush_work+0x268/0x530\n   nvmet_ctrl_free+0x140/0x310 [nvmet]\n   nvmet_cq_put+0x74/0x90 [nvmet]\n   nvmet_rdma_free_queue+0x23/0xe0 [nvmet_rdma]\n   nvmet_rdma_release_queue_work+0x19/0x50 [nvmet_rdma]\n   process_one_work+0x206/0x660\n   worker_thread+0x184/0x320\n   kthread+0x10c/0x240\n   ret_from_fork+0x319/0x390\n\nMove async event work to a dedicated nvmet-aen-wq to avoid reentrant\nflush on nvmet-wq.(CVE-2026-31557)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbcache: fix cached_dev.sb_bio use-after-free and crash\n\nIn our production environment, we have received multiple crash reports\nregarding libceph, which have caught our attention:\n\n```\n[6888366.280350] Call Trace:\n[6888366.280452]  blk_update_request+0x14e/0x370\n[6888366.280561]  blk_mq_end_request+0x1a/0x130\n[6888366.280671]  rbd_img_handle_request+0x1a0/0x1b0 [rbd]\n[6888366.280792]  rbd_obj_handle_request+0x32/0x40 [rbd]\n[6888366.280903]  __complete_request+0x22/0x70 [libceph]\n[6888366.281032]  osd_dispatch+0x15e/0xb40 [libceph]\n[6888366.281164]  ? inet_recvmsg+0x5b/0xd0\n[6888366.281272]  ? ceph_tcp_recvmsg+0x6f/0xa0 [libceph]\n[6888366.281405]  ceph_con_process_message+0x79/0x140 [libceph]\n[6888366.281534]  ceph_con_v1_try_read+0x5d7/0xf30 [libceph]\n[6888366.281661]  ceph_con_workfn+0x329/0x680 [libceph]\n```\n\nAfter analyzing the coredump file, we found that the address of\ndc-\u0026gt;sb_bio has been freed. We know that cached_dev is only freed when it\nis stopped.\n\nSince sb_bio is a part of struct cached_dev, rather than an alloc every\ntime.  If the device is stopped while writing to the superblock, the\nreleased address will be accessed at endio.\n\nThis patch hopes to wait for sb_write to complete in cached_dev_free.\n\nIt should be noted that we analyzed the cause of the problem, then tell\nall details to the QWEN and adopted the modifications it made.(CVE-2026-31580)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Use scratch field in MMIO fragment to hold small write values\n\nWhen exiting to userspace to service an emulated MMIO write, copy the\nto-be-written value to a scratch field in the MMIO fragment if the size\nof the data payload is 8 bytes or less, i.e. can fit in a single chunk,\ninstead of pointing the fragment directly at the source value.\n\nThis fixes a class of use-after-free bugs that occur when the emulator\ninitiates a write using an on-stack, local variable as the source, the\nwrite splits a page boundary, *and* both pages are MMIO pages.  Because\nKVM\u0026apos;s ABI only allows for physically contiguous MMIO requests, accesses\nthat split MMIO pages are separated into two fragments, and are sent to\nuserspace one at a time.  When KVM attempts to complete userspace MMIO in\nresponse to KVM_RUN after the first fragment, KVM will detect the second\nfragment and generate a second userspace exit, and reference the on-stack\nvariable.\n\nThe issue is most visible if the second KVM_RUN is performed by a separate\ntask, in which case the stack of the initiating task can show up as truly\nfreed data.\n\n  ==================================================================\n  BUG: KASAN: use-after-free in complete_emulated_mmio+0x305/0x420\n  Read of size 1 at addr ffff888009c378d1 by task syz-executor417/984\n\n  CPU: 1 PID: 984 Comm: syz-executor417 Not tainted 5.10.0-182.0.0.95.h2627.eulerosv2r13.x86_64 #3\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 Call Trace:\n  dump_stack+0xbe/0xfd\n  print_address_description.constprop.0+0x19/0x170\n  __kasan_report.cold+0x6c/0x84\n  kasan_report+0x3a/0x50\n  check_memory_region+0xfd/0x1f0\n  memcpy+0x20/0x60\n  complete_emulated_mmio+0x305/0x420\n  kvm_arch_vcpu_ioctl_run+0x63f/0x6d0\n  kvm_vcpu_ioctl+0x413/0xb20\n  __se_sys_ioctl+0x111/0x160\n  do_syscall_64+0x30/0x40\n  entry_SYSCALL_64_after_hwframe+0x67/0xd1\n  RIP: 0033:0x42477d\n  Code: \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\n  RSP: 002b:00007faa8e6890e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\n  RAX: ffffffffffffffda RBX: 00000000004d7338 RCX: 000000000042477d\n  RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005\n  RBP: 00000000004d7330 R08: 00007fff28d546df R09: 0000000000000000\n  R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004d733c\n  R13: 0000000000000000 R14: 000000000040a200 R15: 00007fff28d54720\n\n  The buggy address belongs to the page:\n  page:0000000029f6a428 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x9c37\n  flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff)\n  raw: 000fffffc0000000 0000000000000000 ffffea0000270dc8 0000000000000000\n  raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected\n\n  Memory state around the buggy address:\n  ffff888009c37780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n  ffff888009c37800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n  \u0026gt;ffff888009c37880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n                                                   ^\n  ffff888009c37900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n  ffff888009c37980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n  ==================================================================\n\nThe bug can also be reproduced with a targeted KVM-Unit-Test by hacking\nKVM to fill a large on-stack variable in complete_emulated_mmio(), i.e. by\noverwrite the data value with garbage.\n\nLimit the use of the scratch fields to 8-byte or smaller accesses, and to\njust writes, as larger accesses and reads are not affected thanks to\nimplementation details in the emulator, but add a sanity check to ensure\nthose details don\u0026apos;t change in the future.  Specifically, KVM never uses\non-stack variables for accesses larger that 8 bytes, e.g. uses an operand\nin the emulator context, and *al\n---truncated---(CVE-2026-31588)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG\n\nThe GRP_ACK_MSG handler in tipc_group_proto_rcv() currently decrements\nbc_ackers on every inbound group ACK, even when the same member has\nalready acknowledged the current broadcast round.\n\nBecause bc_ackers is a u16, a duplicate ACK received after the last\nlegitimate ACK wraps the counter to 65535. Once wrapped,\ntipc_group_bc_cong() keeps reporting congestion and later group\nbroadcasts on the affected socket stay blocked until the group is\nrecreated.\n\nFix this by ignoring duplicate or stale ACKs before touching bc_acked or\nbc_ackers. This makes repeated GRP_ACK_MSG handling idempotent and\nprevents the underflow path.(CVE-2026-31662)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: clear trailing padding in build_polexpire()\n\nbuild_expire() clears the trailing padding bytes of struct\nxfrm_user_expire after setting the hard field via memset_after(),\nbut the analogous function build_polexpire() does not do this for\nstruct xfrm_user_polexpire.\n\nThe padding bytes after the __u8 hard field are left\nuninitialized from the heap allocation, and are then sent to\nuserspace via netlink multicast to XFRMNLGRP_EXPIRE listeners,\nleaking kernel heap memory contents.\n\nAdd the missing memset_after() call, matching build_expire().(CVE-2026-31664)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: xt_multiport: validate range encoding in checkentry\n\nports_match_v1() treats any non-zero pflags entry as the start of a\nport range and unconditionally consumes the next ports[] element as\nthe range end.\n\nThe checkentry path currently validates protocol, flags and count, but\nit does not validate the range encoding itself. As a result, malformed\nrules can mark the last slot as a range start or place two range starts\nback to back, leaving ports_match_v1() to step past the last valid\nports[] element while interpreting the rule.\n\nReject malformed multiport v1 rules in checkentry by validating that\neach range start has a following element and that the following element\nis not itself marked as another range start.(CVE-2026-31681)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate owner of durable handle on reconnect\n\nCurrently, ksmbd does not verify if the user attempting to reconnect\nto a durable handle is the same user who originally opened the file.\nThis allows any authenticated user to hijack an orphaned durable handle\nby predicting or brute-forcing the persistent ID.\n\nAccording to MS-SMB2, the server MUST verify that the SecurityContext\nof the reconnect request matches the SecurityContext associated with\nthe existing open.\nAdd a durable_owner structure to ksmbd_file to store the original opener\u0026apos;s\nUID, GID, and account name. and catpure the owner information when a file\nhandle becomes orphaned. and implementing ksmbd_vfs_compare_durable_owner()\nto validate the identity of the requester during SMB2_CREATE (DHnC).(CVE-2026-31717)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_ecm: Fix net_device lifecycle with device_move\n\nThe net_device is allocated during function instance creation and\nregistered during the bind phase with the gadget device as its sysfs\nparent. When the function unbinds, the parent device is destroyed, but\nthe net_device survives, resulting in dangling sysfs symlinks:\n\n  console:/ # ls -l /sys/class/net/usb0\n  lrwxrwxrwx ... /sys/class/net/usb0 -\u0026gt;\n  /sys/devices/platform/.../gadget.0/net/usb0\n  console:/ # ls -l /sys/devices/platform/.../gadget.0/net/usb0\n  ls: .../gadget.0/net/usb0: No such file or directory\n\nUse device_move() to reparent the net_device between the gadget device\ntree and /sys/devices/virtual across bind and unbind cycles. During the\nfinal unbind, calling device_move(NULL) moves the net_device to the\nvirtual device tree before the gadget device is destroyed. On rebinding,\ndevice_move() reparents the device back under the new gadget, ensuring\nproper sysfs topology and power management ordering.\n\nTo maintain compatibility with legacy composite drivers (e.g., multi.c),\nthe bound flag is used to indicate whether the network device is shared\nand pre-registered during the legacy driver\u0026apos;s bind phase.(CVE-2026-31725)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: ulpi: fix double free in ulpi_register_interface() error path\n\nWhen device_register() fails, ulpi_register() calls put_device() on\nulpi-\u0026gt;dev.\n\nThe device release callback ulpi_dev_release() drops the OF node\nreference and frees ulpi, but the current error path in\nulpi_register_interface() then calls kfree(ulpi) again, causing a\ndouble free.\n\nLet put_device() handle the cleanup through ulpi_dev_release() and\navoid freeing ulpi again in ulpi_register_interface().(CVE-2026-31759)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists\n\nhci_cmd_sync_queue_once() needs to indicate whether a queue item was\nadded, so caller can know if callbacks are called, so it can avoid\nleaking resources.\n\nChange the function to return -EEXIST if queue item already exists.\n\nModify all callsites to handle that.(CVE-2026-43022)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ctnetlink: ignore explicit helper on new expectations\n\nUse the existing master conntrack helper, anything else is not really\nsupported and it just makes validation more complicated, so just ignore\nwhat helper userspace suggests for this expectation.\n\nThis was uncovered when validating CTA_EXPECT_CLASS via different helper\nprovided by userspace than the existing master conntrack helper:\n\n  BUG: KASAN: slab-out-of-bounds in nf_ct_expect_related_report+0x2479/0x27c0\n  Read of size 4 at addr ffff8880043fe408 by task poc/102\n  Call Trace:\n   nf_ct_expect_related_report+0x2479/0x27c0\n   ctnetlink_create_expect+0x22b/0x3b0\n   ctnetlink_new_expect+0x4bd/0x5c0\n   nfnetlink_rcv_msg+0x67a/0x950\n   netlink_rcv_skb+0x120/0x350\n\nAllowing to read kernel memory bytes off the expectation boundary.\n\nCTA_EXPECT_HELP_NAME is still used to offer the helper name to userspace\nvia netlink dump.(CVE-2026-43025)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent\n\nctnetlink_alloc_expect() allocates expectations from a non-zeroing\nslab cache via nf_ct_expect_alloc().  When CTA_EXPECT_NAT is not\npresent in the netlink message, saved_addr and saved_proto are\nnever initialized.  Stale data from a previous slab occupant can\nthen be dumped to userspace by ctnetlink_exp_dump_expect(), which\nchecks these fields to decide whether to emit CTA_EXPECT_NAT.\n\nThe safe sibling nf_ct_expect_init(), used by the packet path,\nexplicitly zeroes these fields.\n\nZero saved_addr, saved_proto and dir in the else branch, guarded\nby IS_ENABLED(CONFIG_NF_NAT) since these fields only exist when\nNAT is enabled.\n\nConfirmed by priming the expect slab with NAT-bearing expectations,\nfreeing them, creating a new expectation without CTA_EXPECT_NAT,\nand observing that the ctnetlink dump emits a spurious\nCTA_EXPECT_NAT containing stale data from the prior allocation.(CVE-2026-43026)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: x_tables: ensure names are nul-terminated\n\nReject names that lack a \\0 character before feeding them\nto functions that expect c-strings.\n\nFixes tag is the most recent commit that needs this change.(CVE-2026-43028)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: ioam6: fix OOB and missing lock\n\nWhen trace-\u0026gt;type.bit6 is set:\n\n    if (trace-\u0026gt;type.bit6) {\n        ...\n        queue = skb_get_tx_queue(dev, skb);\n        qdisc = rcu_dereference(queue-\u0026gt;qdisc);\n\nThis code can lead to an out-of-bounds access of the dev-\u0026gt;_tx[] array\nwhen is_input is true. In such a case, the packet is on the RX path and\nskb-\u0026gt;queue_mapping contains the RX queue index of the ingress device. If\nthe ingress device has more RX queues than the egress device (dev) has\nTX queues, skb_get_queue_mapping(skb) will exceed dev-\u0026gt;num_tx_queues.\nAdd a check to avoid this situation since skb_get_tx_queue() does not\nclamp the index. This issue has also revealed that per queue visibility\ncannot be accurate and will be replaced later as a new feature.\n\nWhile at it, add missing lock around qdisc_qstats_qlen_backlog(). The\nfunction __ioam6_fill_trace_data() is called from both softirq and\nprocess contexts, hence the use of spin_lock_bh() here.(CVE-2026-43083)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: Wait for RCU readers during policy netns exit\n\nxfrm_policy_fini() frees the policy_bydst hash tables after flushing the\npolicy work items and deleting all policies, but it does not wait for\nconcurrent RCU readers to leave their read-side critical sections first.\n\nThe policy_bydst tables are published via rcu_assign_pointer() and are\nlooked up through rcu_dereference_check(), so netns teardown must also\nwait for an RCU grace period before freeing the table memory.\n\nFix this by adding synchronize_rcu() before freeing the policy hash tables.(CVE-2026-43091)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv4: icmp: fix null-ptr-deref in icmp_build_probe()\n\nipv6_stub-\u0026gt;ipv6_dev_find() may return ERR_PTR(-EAFNOSUPPORT) when the\nIPv6 stack is not active (CONFIG_IPV6=m and not loaded), and passing\nthis error pointer to dev_hold() will cause a kernel crash with\nnull-ptr-deref.\n\nInstead, silently discard the request. RFC 8335 does not appear to\ndefine a specific response for the case where an IPv6 interface\nidentifier is syntactically valid but the implementation cannot perform\nthe lookup at runtime, and silently dropping the request may safer than\nmisreporting \u0026quot;No Such Interface\u0026quot;.(CVE-2026-43099)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()\n\nWe need to check __in6_dev_get() for possible NULL value, as\nsuggested by Yiming Qian.\n\nAlso add skb_dst_dev_rcu() instead of skb_dst_dev(),\nand two missing READ_ONCE().\n\nNote that @dev can\u0026apos;t be NULL.(CVE-2026-43101)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ctnetlink: ensure safe access to master conntrack\n\nHolding reference on the expectation is not sufficient, the master\nconntrack object can just go away, making exp-\u0026gt;master invalid.\n\nTo access exp-\u0026gt;master safely:\n\n- Grab the nf_conntrack_expect_lock, this gets serialized with\n  clean_from_lists() which also holds this lock when the master\n  conntrack goes away.\n\n- Hold reference on master conntrack via nf_conntrack_find_get().\n  Not so easy since the master tuple to look up for the master conntrack\n  is not available in the existing problematic paths.\n\nThis patch goes for extending the nf_conntrack_expect_lock section\nto address this issue for simplicity, in the cases that are described\nbelow this is just slightly extending the lock section.\n\nThe add expectation command already holds a reference to the master\nconntrack from ctnetlink_create_expect().\n\nHowever, the delete expectation command needs to grab the spinlock\nbefore looking up for the expectation. Expand the existing spinlock\nsection to address this to cover the expectation lookup. Note that,\nthe nf_ct_expect_iterate_net() calls already grabs the spinlock while\niterating over the expectation table, which is correct.\n\nThe get expectation command needs to grab the spinlock to ensure master\nconntrack does not go away. This also expands the existing spinlock\nsection to cover the expectation lookup too. I needed to move the\nnetlink skb allocation out of the spinlock to keep it GFP_KERNEL.\n\nFor the expectation events, the IPEXP_DESTROY event is already delivered\nunder the spinlock, just move the delivery of IPEXP_NEW under the\nspinlock too because the master conntrack event cache is reached through\nexp-\u0026gt;master.\n\nWhile at it, add lockdep notations to help identify what codepaths need\nto grab the spinlock.(CVE-2026-43116)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndlm: validate length in dlm_search_rsb_tree\n\nThe len parameter in dlm_dump_rsb_name() is not validated and comes\nfrom network messages. When it exceeds DLM_RESNAME_MAXLEN, it can\ncause out-of-bounds write in dlm_search_rsb_tree().\n\nAdd length validation to prevent potential buffer overflow.(CVE-2026-43125)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nntfs3: fix circular locking dependency in run_unpack_ex\n\nSyzbot reported a circular locking dependency between wnd-\u0026gt;rw_lock\n(sbi-\u0026gt;used.bitmap) and ni-\u0026gt;file.run_lock.\n\nThe deadlock scenario:\n1. ntfs_extend_mft() takes ni-\u0026gt;file.run_lock then wnd-\u0026gt;rw_lock.\n2. run_unpack_ex() takes wnd-\u0026gt;rw_lock then tries to acquire\n   ni-\u0026gt;file.run_lock inside ntfs_refresh_zone().\n\nThis creates an AB-BA deadlock.\n\nFix this by using down_read_trylock() instead of down_read() when\nacquiring run_lock in run_unpack_ex(). If the lock is contended,\nskip ntfs_refresh_zone() - the MFT zone will be refreshed on the\nnext MFT operation. This breaks the circular dependency since we\nnever block waiting for run_lock while holding wnd-\u0026gt;rw_lock.(CVE-2026-43127)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: pegasus: enable basic endpoint checking\n\npegasus_probe() fills URBs with hardcoded endpoint pipes without\nverifying the endpoint descriptors:\n\n  - usb_rcvbulkpipe(dev, 1) for RX data\n  - usb_sndbulkpipe(dev, 2) for TX data\n  - usb_rcvintpipe(dev, 3)  for status interrupts\n\nA malformed USB device can present these endpoints with transfer types\nthat differ from what the driver assumes.\n\nAdd a pegasus_usb_ep enum for endpoint numbers, replacing magic\nconstants throughout. Add usb_check_bulk_endpoints() and\nusb_check_int_endpoints() calls before any resource allocation to\nverify endpoint types before use, rejecting devices with mismatched\ndescriptors at probe time, and avoid triggering assertion.\n\nSimilar fix to\n- commit 90b7f2961798 (\u0026quot;net: usb: rtl8150: enable basic endpoint checking\u0026quot;)\n- commit 9e7021d2aeae (\u0026quot;net: usb: catc: enable basic endpoint checking\u0026quot;)(CVE-2026-43156)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmd/bitmap: fix GPF in write_page caused by resize race\n\nA General Protection Fault occurs in write_page() during array resize:\nRIP: 0010:write_page+0x22b/0x3c0 [md_mod]\n\nThis is a use-after-free race between bitmap_daemon_work() and\n__bitmap_resize(). The daemon iterates over `bitmap-\u0026gt;storage.filemap`\nwithout locking, while the resize path frees that storage via\nmd_bitmap_file_unmap(). `quiesce()` does not stop the md thread,\nallowing concurrent access to freed pages.\n\nFix by holding `mddev-\u0026gt;bitmap_info.mutex` during the bitmap update.(CVE-2026-43163)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode\n\nkaweth_set_rx_mode(), the ndo_set_rx_mode callback, calls\nnetif_stop_queue() and netif_wake_queue(). These are TX queue flow\ncontrol functions unrelated to RX multicast configuration.\n\nThe premature netif_wake_queue() can re-enable TX while tx_urb is still\nin-flight, leading to a double usb_submit_urb() on the same URB:\n\nkaweth_start_xmit() {\n    netif_stop_queue();\n    usb_submit_urb(kaweth-\u0026gt;tx_urb);\n}\n\nkaweth_set_rx_mode() {\n    netif_stop_queue();\n    netif_wake_queue();             // wakes TX queue before URB is done\n}\n\nkaweth_start_xmit() {\n    netif_stop_queue();\n    usb_submit_urb(kaweth-\u0026gt;tx_urb); // URB submitted while active\n}\n\nThis triggers the WARN in usb_submit_urb():\n\n  \u0026quot;URB submitted while active\u0026quot;\n\nThis is a similar class of bug fixed in rtl8150 by\n\n- commit 958baf5eaee3 (\u0026quot;net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast\u0026quot;).\n\nAlso kaweth_set_rx_mode() is already functionally broken, the\nreal set_rx_mode action is performed by kaweth_async_set_rx_mode(),\nwhich in turn is not a no-op only at ndo_open() time.(CVE-2026-43180)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()\n\nOn the receive path, __ioam6_fill_trace_data() uses trace-\u0026gt;nodelen\nto decide how much data to write for each node. It trusts this field\nas-is from the incoming packet, with no consistency check against\ntrace-\u0026gt;type (the 24-bit field that tells which data items are\npresent). A crafted packet can set nodelen=0 while setting type bits\n0-21, causing the function to write ~100 bytes past the allocated\nregion (into skb_shared_info), which corrupts adjacent heap memory\nand leads to a kernel panic.\n\nAdd a shared helper ioam6_trace_compute_nodelen() in ioam6.c to\nderive the expected nodelen from the type field, and use it:\n\n  - in ioam6_iptunnel.c (send path, existing validation) to replace\n    the open-coded computation;\n  - in exthdrs.c (receive path, ipv6_hop_ioam) to drop packets whose\n    nodelen is inconsistent with the type field, before any data is\n    written.\n\nPer RFC 9197, bits 12-21 are each short (4-octet) fields, so they\nare included in IOAM6_MASK_SHORT_FIELDS (changed from 0xff100000 to\n0xff1ffc00).(CVE-2026-43186)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: consume xmit errors of GSO frames\n\nudpgro_frglist.sh and udpgro_bench.sh are the flakiest tests\ncurrently in NIPA. They fail in the same exact way, TCP GRO\ntest stalls occasionally and the test gets killed after 10min.\n\nThese tests use veth to simulate GRO. They attach a trivial\n(\u0026quot;return XDP_PASS;\u0026quot;) XDP program to the veth to force TSO off\nand NAPI on.\n\nDigging into the failure mode we can see that the connection\nis completely stuck after a burst of drops. The sender\u0026apos;s snd_nxt\nis at sequence number N [1], but the receiver claims to have\nreceived (rcv_nxt) up to N + 3 * MSS [2]. Last piece of the puzzle\nis that senders rtx queue is not empty (let\u0026apos;s say the block in\nthe rtx queue is at sequence number N - 4 * MSS [3]).\n\nIn this state, sender sends a retransmission from the rtx queue\nwith a single segment, and sequence numbers N-4*MSS:N-3*MSS [3].\nReceiver sees it and responds with an ACK all the way up to\nN + 3 * MSS [2]. But sender will reject this ack as TCP_ACK_UNSENT_DATA\nbecause it has no recollection of ever sending data that far out [1].\nAnd we are stuck.\n\nThe root cause is the mess of the xmit return codes. veth returns\nan error when it can\u0026apos;t xmit a frame. We end up with a loss event\nlike this:\n\n  -------------------------------------------------\n  |   GSO super frame 1   |   GSO super frame 2   |\n  |-----------------------------------------------|\n  | seg | seg | seg | seg | seg | seg | seg | seg |\n  |  1  |  2  |  3  |  4  |  5  |  6  |  7  |  8  |\n  -------------------------------------------------\n     x    ok    ok    \u0026lt;ok\u0026gt;|  ok    ok    ok   \u0026lt;x\u0026gt;\n                          \\\\\n\t\t\t   snd_nxt\n\n\u0026quot;x\u0026quot; means packet lost by veth, and \u0026quot;ok\u0026quot; means it went thru.\nSince veth has TSO disabled in this test it sees individual segments.\nSegment 1 is on the retransmit queue and will be resent.\n\nSo why did the sender not advance snd_nxt even tho it clearly did\nsend up to seg 8? tcp_write_xmit() interprets the return code\nfrom the core to mean that data has not been sent at all. Since\nTCP deals with GSO super frames, not individual segment the crux\nof the problem is that loss of a single segment can be interpreted\nas loss of all. TCP only sees the last return code for the last\nsegment of the GSO frame (in \u0026lt;\u0026gt; brackets in the diagram above).\n\nOf course for the problem to occur we need a setup or a device\nwithout a Qdisc. Otherwise Qdisc layer disconnects the protocol\nlayer from the device errors completely.\n\nWe have multiple ways to fix this.\n\n 1) make veth not return an error when it lost a packet.\n    While this is what I think we did in the past, the issue keeps\n    reappearing and it\u0026apos;s annoying to debug. The game of whack\n    a mole is not great.\n\n 2) fix the damn return codes\n    We only talk about NETDEV_TX_OK and NETDEV_TX_BUSY in the\n    documentation, so maybe we should make the return code from\n    ndo_start_xmit() a boolean. I like that the most, but perhaps\n    some ancient, not-really-networking protocol would suffer.\n\n 3) make TCP ignore the errors\n    It is not entirely clear to me what benefit TCP gets from\n    interpreting the result of ip_queue_xmit()? Specifically once\n    the connection is established and we\u0026apos;re pushing data - packet\n    loss is just packet loss?\n\n 4) this fix\n    Ignore the rc in the Qdisc-less+GSO case, since it\u0026apos;s unreliable.\n    We already always return OK in the TCQ_F_CAN_BYPASS case.\n    In the Qdisc-less case let\u0026apos;s be a bit more conservative and only\n    mask the GSO errors. This path is taken by non-IP-\u0026quot;networks\u0026quot;\n    like CAN, MCTP etc, so we could regress some ancient thing.\n    This is the simplest, but also maybe the hackiest fix?\n\nSimilar fix has been proposed by Eric in the past but never committed\nbecause original reporter was working with an OOT driver and wasn\u0026apos;t\nproviding feedback (see Link).(CVE-2026-43194)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetconsole: avoid OOB reads, msg is not nul-terminated\n\nmsg passed to netconsole from the console subsystem is not guaranteed\nto be nul-terminated. Before recent\ncommit 7eab73b18630 (\u0026quot;netconsole: convert to NBCON console infrastructure\u0026quot;)\nthe message would be placed in printk_shared_pbufs, a static global\nbuffer, so KASAN had harder time catching OOB accesses. Now we see:\n\n    printk: console [netcon_ext0] enabled\n    BUG: KASAN: slab-out-of-bounds in string+0x1f7/0x240\n    Read of size 1 at addr ffff88813b6d4c00 by task pr/netcon_ext0/594\n\n    CPU: 65 UID: 0 PID: 594 Comm: pr/netcon_ext0 Not tainted 6.19.0-11754-g4246fd6547c9\n    Call Trace:\n     kasan_report+0xe4/0x120\n     string+0x1f7/0x240\n     vsnprintf+0x655/0xba0\n     scnprintf+0xba/0x120\n     netconsole_write+0x3fe/0xa10\n     nbcon_emit_next_record+0x46e/0x860\n     nbcon_kthread_func+0x623/0x750\n\n    Allocated by task 1:\n     nbcon_alloc+0x1ea/0x450\n     register_console+0x26b/0xe10\n     init_netconsole+0xbb0/0xda0\n\n    The buggy address belongs to the object at ffff88813b6d4000\n                which belongs to the cache kmalloc-4k of size 4096\n    The buggy address is located 0 bytes to the right of\n                allocated 3072-byte region [ffff88813b6d4000, ffff88813b6d4c00)(CVE-2026-43197)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niommu/amd: serialize sequence allocation under concurrent TLB invalidations\n\nWith concurrent TLB invalidations, completion wait randomly gets timed out\nbecause cmd_sem_val was incremented outside the IOMMU spinlock, allowing\nCMD_COMPL_WAIT commands to be queued out of sequence and breaking the\nordering assumption in wait_on_sem().\nMove the cmd_sem_val increment under iommu-\u0026gt;lock so completion sequence\nallocation is serialized with command queuing.\nAnd remove the unnecessary return.(CVE-2026-43220)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: prevent races in -\u0026gt;query_interfaces()\n\nIt was possible for two query interface works to be concurrently trying\nto update the interfaces.\n\nPrevent this by checking and updating iface_last_update under\niface_lock.(CVE-2026-43239)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nx86/kexec: add a sanity check on previous kernel\u0026apos;s ima kexec buffer\n\nWhen the second-stage kernel is booted via kexec with a limiting command\nline such as \u0026quot;mem=\u0026lt;size\u0026gt;\u0026quot;, the physical range that contains the carried\nover IMA measurement list may fall outside the truncated RAM leading to a\nkernel panic.\n\n    BUG: unable to handle page fault for address: ffff97793ff47000\n    RIP: ima_restore_measurement_list+0xdc/0x45a\n    #PF: error_code(0x0000) – not-present page\n\nOther architectures already validate the range with page_is_ram(), as done\nin commit cbf9c4b9617b (\u0026quot;of: check previous kernel\u0026apos;s ima-kexec-buffer\nagainst memory bounds\u0026quot;) do a similar check on x86.\n\nWithout carrying the measurement list across kexec, the attestation\nwould fail.(CVE-2026-43240)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\next4: move ext4_percpu_param_init() before ext4_mb_init()\n\nWhen running `kvm-xfstests -c ext4/1k -C 1 generic/383` with the\n`DOUBLE_CHECK` macro defined, the following panic is triggered:\n\n==================================================================\nEXT4-fs error (device vdc): ext4_validate_block_bitmap:423:\n                        comm mount: bg 0: bad block bitmap checksum\nBUG: unable to handle page fault for address: ff110000fa2cc000\nPGD 3e01067 P4D 3e02067 PUD 0\nOops: Oops: 0000 [#1] SMP NOPTI\nCPU: 0 UID: 0 PID: 2386 Comm: mount Tainted: G W\n                        6.18.0-gba65a4e7120a-dirty #1152 PREEMPT(none)\nRIP: 0010:percpu_counter_add_batch+0x13/0xa0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n ext4_mark_group_bitmap_corrupted+0xcb/0xe0\n ext4_validate_block_bitmap+0x2a1/0x2f0\n ext4_read_block_bitmap+0x33/0x50\n mb_group_bb_bitmap_alloc+0x33/0x80\n ext4_mb_add_groupinfo+0x190/0x250\n ext4_mb_init_backend+0x87/0x290\n ext4_mb_init+0x456/0x640\n __ext4_fill_super+0x1072/0x1680\n ext4_fill_super+0xd3/0x280\n get_tree_bdev_flags+0x132/0x1d0\n vfs_get_tree+0x29/0xd0\n vfs_cmd_create+0x59/0xe0\n __do_sys_fsconfig+0x4f6/0x6b0\n do_syscall_64+0x50/0x1f0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n==================================================================\n\nThis issue can be reproduced using the following commands:\n        mkfs.ext4 -F -q -b 1024 /dev/sda 5G\n        tune2fs -O quota,project /dev/sda\n        mount /dev/sda /tmp/test\n\nWith DOUBLE_CHECK defined, mb_group_bb_bitmap_alloc() reads\nand validates the block bitmap. When the validation fails,\next4_mark_group_bitmap_corrupted() attempts to update\nsbi-\u0026gt;s_freeclusters_counter. However, this percpu_counter has not been\ninitialized yet at this point, which leads to the panic described above.\n\nFix this by moving the execution of ext4_percpu_param_init() to occur\nbefore ext4_mb_init(), ensuring the per-CPU counters are initialized\nbefore they are used.(CVE-2026-43288)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmd raid: fix hang when stopping arrays with metadata through dm-raid\n\nWhen using device-mapper\u0026apos;s dm-raid target, stopping a RAID array can cause\nthe system to hang under specific conditions.\n\nThis occurs when:\n\n- A dm-raid managed device tree is suspended from top to bottom\n   (the top-level RAID device is suspended first, followed by its\n    underlying metadata and data devices)\n\n- The top-level RAID device is then removed\n\nRemoving the top-level device triggers a hang in the following sequence:\nthe dm-raid destructor calls md_stop(), which tries to flush the\nwrite-intent bitmap by writing to the metadata sub-devices. However, these\ndevices are already suspended, making them unable to complete the write-intent\noperations and causing an indefinite block.\n\nFix:\n\n- Prevent bitmap flushing when md_stop() is called from dm-raid\ndestructor context\n  and avoid a quiescing/unquescing cycle which could also cause I/O\n\n- Still allow write-intent bitmap flushing when called from dm-raid\nsuspend context\n\nThis ensures that RAID array teardown can complete successfully even when the\nunderlying devices are in a suspended state.\n\nThis second patch uses md_is_rdwr() to distinguish between suspend and\ndestructor paths as elaborated on above.(CVE-2026-43309)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nspi: spidev: fix lock inversion between spi_lock and buf_lock\n\nThe spidev driver previously used two mutexes, spi_lock and buf_lock,\nbut acquired them in different orders depending on the code path:\n\n  write()/read(): buf_lock -\u0026gt; spi_lock\n  ioctl():       spi_lock -\u0026gt; buf_lock\n\nThis AB-BA locking pattern triggers lockdep warnings and can\ncause real deadlocks:\n\n  WARNING: possible circular locking dependency detected\n  spidev_ioctl() -\u0026gt; mutex_lock(\u0026amp;spidev-\u0026gt;buf_lock)\n  spidev_sync_write() -\u0026gt; mutex_lock(\u0026amp;spidev-\u0026gt;spi_lock)\n  *** DEADLOCK ***\n\nThe issue is reproducible with a simple userspace program that\nperforms write() and SPI_IOC_WR_MAX_SPEED_HZ ioctl() calls from\nseparate threads on the same spidev file descriptor.\n\nFix this by simplifying the locking model and removing the lock\ninversion entirely. spidev_sync() no longer performs any locking,\nand all callers serialize access using spi_lock.\n\nbuf_lock is removed since its functionality is fully covered by\nspi_lock, eliminating the possibility of lock ordering issues.\n\nThis removes the lock inversion and prevents deadlocks without\nchanging userspace ABI or behaviour.(CVE-2026-43319)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: SMP: force responder MITM requirements before building the pairing response\n\nsmp_cmd_pairing_req() currently builds the pairing response from the\ninitiator auth_req before enforcing the local BT_SECURITY_HIGH\nrequirement. If the initiator omits SMP_AUTH_MITM, the response can\nalso omit it even though the local side still requires MITM.\n\ntk_request() then sees an auth value without SMP_AUTH_MITM and may\nselect JUST_CFM, making method selection inconsistent with the pairing\npolicy the responder already enforces.\n\nWhen the local side requires HIGH security, first verify that MITM can\nbe achieved from the IO capabilities and then force SMP_AUTH_MITM in the\nresponse in both rsp.auth_req and auth. This keeps the responder auth bits\nand later method selection aligned.(CVE-2026-43334)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: require a full NFS mode SID before reading mode bits\n\nparse_dacl() treats an ACE SID matching sid_unix_NFS_mode as an NFS\nmode SID and reads sid.sub_auth[2] to recover the mode bits.\n\nThat assumes the ACE carries three subauthorities, but compare_sids()\nonly compares min(a, b) subauthorities.  A malicious server can return\nan ACE with num_subauth = 2 and sub_auth[] = {88, 3}, which still\nmatches sid_unix_NFS_mode and then drives the sub_auth[2] read four\nbytes past the end of the ACE.\n\nRequire num_subauth \u0026gt;= 3 before treating the ACE as an NFS mode SID.\nThis keeps the fix local to the special-SID mode path without changing\ncompare_sids() semantics for the rest of cifsacl.(CVE-2026-43350)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/kbuf: check if target buffer list is still legacy on recycle\n\nThere\u0026apos;s a gap between when the buffer was grabbed and when it\npotentially gets recycled, where if the list is empty, someone could\u0026apos;ve\nupgraded it to a ring provided type. This can happen if the request\nis forced via io-wq. The legacy recycling is missing checking if the\nbuffer_list still exists, and if it\u0026apos;s of the correct type. Add those\nchecks.(CVE-2026-43366)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: prevent potential out-of-bounds reads in process_message_header()\n\nIf the message frame is (maliciously) corrupted in a way that the\nlength of the control segment ends up being less than the size of the\nmessage header or a different frame is made to look like a message\nframe, out-of-bounds reads may ensue in process_message_header().\n\nPerform an explicit bounds check before decoding the message header.(CVE-2026-43406)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ne1000/e1000e: Fix leak in DMA error cleanup\n\nIf an error is encountered while mapping TX buffers, the driver should\nunmap any buffers already mapped for that skb.\n\nBecause count is incremented after a successful mapping, it will always\nmatch the correct number of unmappings needed when dma_error is reached.\nDecrementing count before the while loop in dma_error causes an\noff-by-one error. If any mapping was successful before an unsuccessful\nmapping, exactly one DMA mapping would leak.\n\nIn these commits, a faulty while condition caused an infinite loop in\ndma_error:\nCommit 03b1320dfcee (\u0026quot;e1000e: remove use of skb_dma_map from e1000e\ndriver\u0026quot;)\nCommit 602c0554d7b0 (\u0026quot;e1000: remove use of skb_dma_map from e1000 driver\u0026quot;)\n\nCommit c1fa347f20f1 (\u0026quot;e1000/e1000e/igb/igbvf/ixgb/ixgbe: Fix tests of\nunsigned in *_tx_map()\u0026quot;) fixed the infinite loop, but introduced the\noff-by-one error.\n\nThis issue may still exist in the igbvf driver, but I did not address it\nin this patch.(CVE-2026-43445)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery\n\nIn case of a TX error CQE, a recovery flow is triggered,\nmlx5e_reset_txqsq_cc_pc() resets dma_fifo_cc to 0 but not dma_fifo_pc,\ndesyncing the DMA FIFO producer and consumer.\n\nAfter recovery, the producer pushes new DMA entries at the old\ndma_fifo_pc, while the consumer reads from position 0.\nThis causes us to unmap stale DMA addresses from before the recovery.\n\nThe DMA FIFO is a purely software construct with no HW counterpart.\nAt the point of reset, all WQEs have been flushed so dma_fifo_cc is\nalready equal to dma_fifo_pc. There is no need to reset either counter,\nsimilar to how skb_fifo pc/cc are untouched.\n\nRemove the \u0026apos;dma_fifo_cc = 0\u0026apos; reset.\n\nThis fixes the following WARNING:\n    WARNING: CPU: 0 PID: 0 at drivers/iommu/dma-iommu.c:1240 iommu_dma_unmap_page+0x79/0x90\n    Modules linked in: mlx5_vdpa vringh vdpa bonding mlx5_ib mlx5_vfio_pci ipip mlx5_fwctl tunnel4 mlx5_core ib_ipoib geneve ip6_gre ip_gre gre nf_tables ip6_tunnel rdma_ucm ib_uverbs ib_umad vfio_pci vfio_pci_core act_mirred act_skbedit act_vlan vhost_net vhost tap ip6table_mangle ip6table_nat ip6table_filter ip6_tables iptable_mangle cls_matchall nfnetlink_cttimeout act_gact cls_flower sch_ingress vhost_iotlb iptable_raw tunnel6 vfio_iommu_type1 vfio openvswitch nsh rpcsec_gss_krb5 auth_rpcgss oid_registry xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat nf_nat xt_addrtype br_netfilter overlay zram zsmalloc rpcrdma ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm ib_core fuse [last unloaded: nf_tables]\n    CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.13.0-rc5_for_upstream_min_debug_2024_12_30_21_33 #1\n    Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n    RIP: 0010:iommu_dma_unmap_page+0x79/0x90\n    Code: 2b 4d 3b 21 72 26 4d 3b 61 08 73 20 49 89 d8 44 89 f9 5b 4c 89 f2 4c 89 e6 48 89 ef 5d 41 5c 41 5d 41 5e 41 5f e9 c7 ae 9e ff \u0026lt;0f\u0026gt; 0b 5b 5d 41 5c 41 5d 41 5e 41 5f c3 66 2e 0f 1f 84 00 00 00 00\n    Call Trace:\n     \u0026lt;IRQ\u0026gt;\n     ? __warn+0x7d/0x110\n     ? iommu_dma_unmap_page+0x79/0x90\n     ? report_bug+0x16d/0x180\n     ? handle_bug+0x4f/0x90\n     ? exc_invalid_op+0x14/0x70\n     ? asm_exc_invalid_op+0x16/0x20\n     ? iommu_dma_unmap_page+0x79/0x90\n     ? iommu_dma_unmap_page+0x2e/0x90\n     dma_unmap_page_attrs+0x10d/0x1b0\n     mlx5e_tx_wi_dma_unmap+0xbe/0x120 [mlx5_core]\n     mlx5e_poll_tx_cq+0x16d/0x690 [mlx5_core]\n     mlx5e_napi_poll+0x8b/0xac0 [mlx5_core]\n     __napi_poll+0x24/0x190\n     net_rx_action+0x32a/0x3b0\n     ? mlx5_eq_comp_int+0x7e/0x270 [mlx5_core]\n     ? notifier_call_chain+0x35/0xa0\n     handle_softirqs+0xc9/0x270\n     irq_exit_rcu+0x71/0xd0\n     common_interrupt+0x7f/0xa0\n     \u0026lt;/IRQ\u0026gt;\n     \u0026lt;TASK\u0026gt;\n     asm_common_interrupt+0x22/0x40(CVE-2026-43466)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Fix deadlock between devlink lock and esw-\u0026gt;wq\n\nesw-\u0026gt;work_queue executes esw_functions_changed_event_handler -\u0026gt;\nesw_vfs_changed_event_handler and acquires the devlink lock.\n\n.eswitch_mode_set (acquires devlink lock in devlink_nl_pre_doit) -\u0026gt;\nmlx5_devlink_eswitch_mode_set -\u0026gt; mlx5_eswitch_disable_locked -\u0026gt;\nmlx5_eswitch_event_handler_unregister -\u0026gt; flush_workqueue deadlocks\nwhen esw_vfs_changed_event_handler executes.\n\nFix that by no longer flushing the work to avoid the deadlock, and using\na generation counter to keep track of work relevance. This avoids an old\nhandler manipulating an esw that has undergone one or more mode changes:\n- the counter is incremented in mlx5_eswitch_event_handler_unregister.\n- the counter is read and passed to the ephemeral mlx5_host_work struct.\n- the work handler takes the devlink lock and bails out if the current\n  generation is different than the one it was scheduled to operate on.\n- mlx5_eswitch_cleanup does the final draining before destroying the wq.\n\nNo longer flushing the workqueue has the side effect of maybe no longer\ncancelling pending vport_change_handler work items, but that\u0026apos;s ok since\nthose are disabled elsewhere:\n- mlx5_eswitch_disable_locked disables the vport eq notifier.\n- mlx5_esw_vport_disable disarms the HW EQ notification and marks\n  vport-\u0026gt;enabled under state_lock to false to prevent pending vport\n  handler from doing anything.\n- mlx5_eswitch_cleanup destroys the workqueue and makes sure all events\n  are disabled/finished.(CVE-2026-43468)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()\n\nAdd the same NULL guard already present in\nl2cap_sock_resume_cb() and l2cap_sock_ready_cb().(CVE-2026-45834)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation\n\nUlrich reports a regression with nfqueue:\n\nIf an application did not set the \u0026apos;F_GSO\u0026apos; capability flag and a gso\npacket with an unconfirmed nf_conn entry is received all packets are\nnow dropped instead of queued, because the check happens after\nskb_gso_segment().  In that case, we did have exclusive ownership\nof the skb and its associated conntrack entry.  The elevated use\ncount is due to skb_clone happening via skb_gso_segment().\n\nMove the check so that its peformed vs. the aggregated packet.\n\nThen, annotate the individual segments except the first one so we\ncan do a 2nd check at reinject time.\n\nFor the normal case, where userspace does in-order reinjects, this avoids\npacket drops: first reinjected segment continues traversal and confirms\nentry, remaining segments observe the confirmed entry.\n\nWhile at it, simplify nf_ct_drop_unconfirmed(): We only care about\nunconfirmed entries with a refcnt \u0026gt; 1, there is no need to special-case\ndying entries.\n\nThis only happens with UDP.  With TCP, the only unconfirmed packet will\nbe the TCP SYN, those aren\u0026apos;t aggregated by GRO.\n\nNext patch adds a udpgro test case to cover this scenario.(CVE-2026-45859)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Fix slab-use-after-free in qd_put\n\nCommit a475c5dd16e5 (\u0026quot;gfs2: Free quota data objects synchronously\u0026quot;)\nstarted freeing quota data objects during filesystem shutdown instead of\nputting them back onto the LRU list, but it failed to remove these\nobjects from the LRU list, causing LRU list corruption.  This caused\nuse-after-free when the shrinker (gfs2_qd_shrink_scan) tried to access\nalready-freed objects on the LRU list.\n\nFix this by removing qd objects from the LRU list before freeing them in\nqd_put().\n\nInitial fix from Deepanshu Kartikey \u0026lt;(CVE-2026-45861)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix bpf_xdp_store_bytes proto for read-only arg\n\nWhile making some maps in Cilium read-only from the BPF side, we noticed\nthat the bpf_xdp_store_bytes proto is incorrect. In particular, the\nverifier was throwing the following error:\n\n  ; ret = ctx_store_bytes(ctx, l3_off + offsetof(struct iphdr, saddr),\n                          \u0026amp;nat-\u0026gt;address, 4, 0);\n  635: (79) r1 = *(u64 *)(r10 -144)     ; R1=ctx() R10=fp0 fp-144=ctx()\n  636: (b4) w2 = 26                     ; R2=26\n  637: (b4) w4 = 4                      ; R4=4\n  638: (b4) w5 = 0                      ; R5=0\n  639: (85) call bpf_xdp_store_bytes#190\n  write into map forbidden, value_size=6 off=0 size=4\n\nnat comes from a BPF_F_RDONLY_PROG map, so R3 is a PTR_TO_MAP_VALUE.\nThe verifier checks the helper\u0026apos;s memory access to R3 in\ncheck_mem_size_reg, as it reaches ARG_CONST_SIZE argument. The third\nargument has expected type ARG_PTR_TO_UNINIT_MEM, which includes the\nMEM_WRITE flag. The verifier thus checks for a BPF_WRITE access on R3.\nGiven R3 points to a read-only map, the check fails.\n\nConversely, ARG_PTR_TO_UNINIT_MEM can also lead to the helper reading\nfrom uninitialized memory.\n\nThis patch simply fixes the expected argument type to match that of\nbpf_skb_store_bytes.(CVE-2026-45886)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: cdns3: fix role switching during resume\n\nIf the role change while we are suspended, the cdns3 driver switches to the\nnew mode during resume. However, switching to host mode in this context\ncauses a NULL pointer dereference.\n\nThe host role\u0026apos;s start() operation registers a xhci-hcd device, but its\nprobe is deferred while we are in the resume path. The host role\u0026apos;s resume()\noperation assumes the xhci-hcd device is already probed, which is not the\ncase, leading to the dereference. Since the start() operation of the new\nrole is already called, the resume operation can be skipped.\n\nSo skip the resume operation for the new role if a role switch occurs\nduring resume. Once the resume sequence is complete, the xhci-hcd device\ncan be probed in case of host mode.\n\nUnable to handle kernel NULL pointer dereference at virtual address 0000000000000208\nMem abort info:\n...\nData abort info:\n...\n[0000000000000208] pgd=0000000000000000, p4d=0000000000000000\nInternal error: Oops: 0000000096000004 [#1]  SMP\nModules linked in:\nCPU: 0 UID: 0 PID: 146 Comm: sh Not tainted\n6.19.0-rc7-00013-g6e64f4aabfae-dirty #135 PREEMPT\nHardware name: Texas Instruments J7200 EVM (DT)\npstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : usb_hcd_is_primary_hcd+0x0/0x1c\nlr : cdns_host_resume+0x24/0x5c\n...\nCall trace:\n usb_hcd_is_primary_hcd+0x0/0x1c (P)\n cdns_resume+0x6c/0xbc\n cdns3_controller_resume.isra.0+0xe8/0x17c\n cdns3_plat_resume+0x18/0x24\n platform_pm_resume+0x2c/0x68\n dpm_run_callback+0x90/0x248\n device_resume+0x100/0x24c\n dpm_resume+0x190/0x2ec\n dpm_resume_end+0x18/0x34\n suspend_devices_and_enter+0x2b0/0xa44\n pm_suspend+0x16c/0x5fc\n state_store+0x80/0xec\n kobj_attr_store+0x18/0x2c\n sysfs_kf_write+0x7c/0x94\n kernfs_fop_write_iter+0x130/0x1dc\n vfs_write+0x240/0x370\n ksys_write+0x70/0x108\n __arm64_sys_write+0x1c/0x28\n invoke_syscall+0x48/0x10c\n el0_svc_common.constprop.0+0x40/0xe0\n do_el0_svc+0x1c/0x28\n el0_svc+0x34/0x108\n el0t_64_sync_handler+0xa0/0xe4\n el0t_64_sync+0x198/0x19c\nCode: 52800003 f9407ca5 d63f00a0 17ffffe4 (f9410401)\n---[ end trace 0000000000000000 ]---(CVE-2026-45911)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: fix memory leaks in gfs2_fill_super error path\n\nFix two memory leaks in the gfs2_fill_super() error handling path when\ntransitioning a filesystem to read-write mode fails.\n\nFirst leak: kthread objects (thread_struct, task_struct, etc.)\nWhen gfs2_freeze_lock_shared() fails after init_threads() succeeds, the\ncreated kernel threads (logd and quotad) are never destroyed. This\noccurs because the fail_per_node label doesn\u0026apos;t call\ngfs2_destroy_threads().\n\nSecond leak: quota bitmap buffer (8192 bytes)\nWhen gfs2_make_fs_rw() fails after gfs2_quota_init() succeeds but\nbefore other operations complete, the allocated quota bitmap is never\nfreed.\n\nThe fix moves thread cleanup to the fail_per_node label to handle all\nerror paths uniformly. gfs2_destroy_threads() is safe to call\nunconditionally as it checks for NULL pointers. Quota cleanup is added\nin gfs2_make_fs_rw() to properly handle the withdrawal case where\nquota initialization succeeds but the filesystem is then withdrawn.\n\nThread leak backtrace (gfs2_freeze_lock_shared failure):\n  unreferenced object 0xffff88801d7bca80 (size 4480):\n    copy_process+0x3a1/0x4670 kernel/fork.c:2422\n    kernel_clone+0xf3/0x6e0 kernel/fork.c:2779\n    kthread_create_on_node+0x100/0x150 kernel/kthread.c:478\n    init_threads+0xab/0x350 fs/gfs2/ops_fstype.c:611\n    gfs2_fill_super+0xe5c/0x1240 fs/gfs2/ops_fstype.c:1265\n\nQuota leak backtrace (gfs2_make_fs_rw failure):\n  unreferenced object 0xffff88812de7c000 (size 8192):\n    gfs2_quota_init+0xe5/0x820 fs/gfs2/quota.c:1409\n    gfs2_make_fs_rw+0x7a/0xe0 fs/gfs2/super.c:149\n    gfs2_fill_super+0xfbb/0x1240 fs/gfs2/ops_fstype.c:1275(CVE-2026-45961)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch()\n\nCover a missed execution path with a new check.(CVE-2026-45982)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Fix use-after-free in iomap inline data write path\n\nThe inline data buffer head (dibh) is being released prematurely in\ngfs2_iomap_begin() via release_metapath() while iomap-\u0026gt;inline_data\nstill points to dibh-\u0026gt;b_data. This causes a use-after-free when\niomap_write_end_inline() later attempts to write to the inline data\narea.\n\nThe bug sequence:\n1. gfs2_iomap_begin() calls gfs2_meta_inode_buffer() to read inode\n   metadata into dibh\n2. Sets iomap-\u0026gt;inline_data = dibh-\u0026gt;b_data + sizeof(struct gfs2_dinode)\n3. Calls release_metapath() which calls brelse(dibh), dropping refcount\n   to 0\n4. kswapd reclaims the page (~39ms later in the syzbot report)\n5. iomap_write_end_inline() tries to memcpy() to iomap-\u0026gt;inline_data\n6. KASAN detects use-after-free write to freed memory\n\nFix by storing dibh in iomap-\u0026gt;private and incrementing its refcount\nwith get_bh() in gfs2_iomap_begin(). The buffer is then properly\nreleased in gfs2_iomap_end() after the inline write completes,\nensuring the page stays alive for the entire iomap operation.\n\nNote: A C reproducer is not available for this issue. The fix is based\non analysis of the KASAN report and code review showing the buffer head\nis freed before use.\n\n[agruenba: Take buffer head reference in gfs2_iomap_begin() to avoid\nleaks in gfs2_iomap_get() and gfs2_iomap_alloc().](CVE-2026-45984)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix unsigned underflow in z_erofs_lz4_handle_overlap()\n\nSome crafted images can have illegal (!partial_decoding \u0026amp;\u0026amp;\nm_llen \u0026lt; m_plen) extents, and the LZ4 inplace decompression path\ncan be wrongly hit, but it cannot handle (outpages \u0026lt; inpages)\nproperly: \u0026quot;outpages - inpages\u0026quot; wraps to a large value and\nthe subsequent rq-\u0026gt;out[] access reads past the decompressed_pages\narray.\n\nHowever, such crafted cases can correctly result in a corruption\nreport in the normal LZ4 non-inplace path.\n\nLet\u0026apos;s add an additional check to fix this for backporting.\n\nReproducible image (base64-encoded gzipped blob):\n\nH4sIAJGR12kCA+3SPUoDQRgG4MkmkkZk8QRbRFIIi9hbpEjrHQI5ghfwCN5BLCzTGtLbBI+g\ndilSJo1CnIm7GEXFxhT6PDDwfrs73/ywIQD/1ePD4r7Ou6ETsrq4mu7XcWfj++Pb58nJU/9i\nPNtbjhan04/9GtX4qVYc814WDqt6FaX5s+ZwXXeq52lndT6IuVvlblytLMvh4Gzwaf90nsvz\n2DF/21+20T/ldgp5s1jXRaN4t/8izsy/OUB6e/Qa79r+JwAAAAAAAL52vQVuGQAAAP6+my1w\nywAAAAAAAADwu14ATsEYtgBQAAA=\n\n$ mount -t erofs -o cache_strategy=disabled foo.erofs /mnt\n$ dd if=/mnt/data of=/dev/null bs=4096 count=1(CVE-2026-45999)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: fix u32 overflow in pushbuf reloc bounds check\n\nnouveau_gem_pushbuf_reloc_apply() validates each relocation with\n\n    if (r-\u0026gt;reloc_bo_offset + 4 \u0026gt; nvbo-\u0026gt;bo.base.size)\n\nbut reloc_bo_offset is __u32 (uapi/drm/nouveau_drm.h) and the integer\nliteral 4 promotes to unsigned int, so the addition is performed in 32\nbits and wraps before the comparison against the size_t bo size.\n\nCast to u64 so the addition happens in 64-bit arithmetic.\n\n[ Add Fixes: tag. - Danilo ](CVE-2026-46006)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Add missing save/restore handling of LBR MSRs\n\nMSR_IA32_DEBUGCTLMSR and LBR MSRs are currently not enumerated by\nKVM_GET_MSR_INDEX_LIST, and LBR MSRs cannot be set with KVM_SET_MSRS. So\nsave/restore is completely broken.\n\nFix it by adding the MSRs to msrs_to_save_base, and allowing writes to\nLBR MSRs from userspace only (as they are read-only MSRs) if LBR\nvirtualization is enabled.  Additionally, to correctly restore L1\u0026apos;s LBRs\nwhile L2 is running, make sure the LBRs are copied from the captured\nVMCB01 save area in svm_copy_vmrun_state().\n\nNote, for VMX, this also fixes a flaw where MSR_IA32_DEBUGCTLMSR isn\u0026apos;t\nreported as an MSR to save/restore.\n\nNote #2, over-reporting MSR_IA32_LASTxxx on Intel is ok, as KVM already\nhandles unsupported reads and writes thanks to commit b5e2fec0ebc3 (\u0026quot;KVM:\nIgnore DEBUGCTL MSRs with no effect\u0026quot;) (kvm_do_msr_access() will morph the\nunsupported userspace write into a nop).\n\n[sean: guard with lbrv checks, massage changelog](CVE-2026-46014)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipmi:ssif: Clean up kthread on errors\n\nIf an error occurs after the ssif kthread is created, but before the\nmain IPMI code starts the ssif interface, the ssif kthread will not\nbe stopped.\n\nSo make sure the kthread is stopped on an error condition if it is\nrunning.(CVE-2026-46044)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid5: fix soft lockup in retry_aligned_read()\n\nWhen retry_aligned_read() encounters an overlapped stripe, it releases\nthe stripe via raid5_release_stripe() which puts it on the lockless\nreleased_stripes llist. In the next raid5d loop iteration,\nrelease_stripe_list() drains the stripe onto handle_list (since\nSTRIPE_HANDLE is set by the original IO), but retry_aligned_read()\nruns before handle_active_stripes() and removes the stripe from\nhandle_list via find_get_stripe() -\u0026gt; list_del_init(). This prevents\nhandle_stripe() from ever processing the stripe to resolve the\noverlap, causing an infinite loop and soft lockup.\n\nFix this by using __release_stripe() with temp_inactive_list instead\nof raid5_release_stripe() in the failure path, so the stripe does not\ngo through the released_stripes llist. This allows raid5d to break out\nof its loop, and the overlap will be resolved when the stripe is\neventually processed by handle_stripe().(CVE-2026-46051)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nceph: only d_add() negative dentries when they are unhashed\n\nCeph can call d_add(dentry, NULL) on a negative dentry that is already\npresent in the primary dcache hash.\n\nIn the current VFS that is not safe.  d_add() goes through __d_add()\nto __d_rehash(), which unconditionally reinserts dentry-\u0026gt;d_hash into\nthe hlist_bl bucket.  If the dentry is already hashed, reinserting the\nsame node can corrupt the bucket, including creating a self-loop.\nOnce that happens, __d_lookup() can spin forever in the hlist_bl walk,\ntypically looping only on the d_name.hash mismatch check and\neventually triggering RCU stall reports like this one:\n\n rcu: INFO: rcu_sched self-detected stall on CPU\n rcu:         87-....: (2100 ticks this GP) idle=3a4c/1/0x4000000000000000 softirq=25003319/25003319 fqs=829\n rcu:         (t=2101 jiffies g=79058445 q=698988 ncpus=192)\n CPU: 87 UID: 2952868916 PID: 3933303 Comm: php-cgi8.3 Not tainted 6.18.17-i1-amd #950 NONE\n Hardware name: Dell Inc. PowerEdge R7615/0G9DHV, BIOS 1.6.6 09/22/2023\n RIP: 0010:__d_lookup+0x46/0xb0\n Code: c1 e8 07 48 8d 04 c2 48 8b 00 49 89 fc 49 89 f5 48 89 c3 48 83 e3 fe 48 83 f8 01 77 0f eb 2d 0f 1f 44 00 00 48 8b 1b 48 85 db \u0026lt;74\u0026gt; 20 39 6b 18 75 f3 48 8d 7b 78 e8 ba 85 d0 00 4c 39 63 10 74 1f\n RSP: 0018:ff745a70c8253898 EFLAGS: 00000282\n RAX: ff26e470054cb208 RBX: ff26e470054cb208 RCX: 000000006e958966\n RDX: ff26e48267340000 RSI: ff745a70c82539b0 RDI: ff26e458f74655c0\n RBP: 000000006e958966 R08: 0000000000000180 R09: 9cd08d909b919a89\n R10: ff26e458f74655c0 R11: 0000000000000000 R12: ff26e458f74655c0\n R13: ff745a70c82539b0 R14: d0d0d0d0d0d0d0d0 R15: 2f2f2f2f2f2f2f2f\n FS:  00007f5770896980(0000) GS:ff26e482c5d88000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007f5764de50c0 CR3: 000000a72abb5001 CR4: 0000000000771ef0\n PKRU: 55555554\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  lookup_fast+0x9f/0x100\n  walk_component+0x1f/0x150\n  link_path_walk+0x20e/0x3d0\n  path_lookupat+0x68/0x180\n  filename_lookup+0xdc/0x1e0\n  vfs_statx+0x6c/0x140\n  vfs_fstatat+0x67/0xa0\n  __do_sys_newfstatat+0x24/0x60\n  do_syscall_64+0x6a/0x230\n  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nThis is reachable with reused cached negative dentries.  A Ceph lookup\nor atomic_open can be handed a negative dentry that is already hashed,\nand fs/ceph/dir.c then hits one of two paths that incorrectly assume\n\u0026quot;negative\u0026quot; also means \u0026quot;unhashed\u0026quot;:\n\n  - ceph_finish_lookup():\n      MDS reply is -ENOENT with no trace\n      -\u0026gt; d_add(dentry, NULL)\n\n  - ceph_lookup():\n      local ENOENT fast path for a complete directory with shared caps\n      -\u0026gt; d_add(dentry, NULL)\n\nBoth paths can therefore re-add an already-hashed negative dentry.\n\nCeph already uses the correct pattern elsewhere: ceph_fill_trace() only\ncalls d_add(dn, NULL) for a negative null-dentry reply when d_unhashed(dn)\nis true.\n\nFix both fs/ceph/dir.c sites the same way: only call d_add() for a\nnegative dentry when it is actually unhashed.  If the negative dentry\nis already hashed, leave it in place and reuse it as-is.\n\nThis preserves the existing behavior for unhashed dentries while\navoiding d_hash list corruption for reused hashed negatives.(CVE-2026-46052)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nSVM: Raise #UD if unhandled VMMCALL isn\u0026apos;t intercepted by L1\n\nExplicitly synthesize a #UD for VMMCALL if L2 is active, L1 does NOT want\nto intercept VMMCALL, nested_svm_l2_tlb_flush_enabled() is true, and the\nhypercall is something other than one of the supported Hyper-V hypercalls.\nWhen all of the above conditions are met, KVM will intercept VMMCALL but\nnever forward it to L1, i.e. will let L2 make hypercalls as if it were L1.\n\nThe TLFS says a whole lot of nothing about this scenario, so go with the\narchitectural behavior, which says that VMMCALL #UDs if it\u0026apos;s not\nintercepted.\n\nOpportunistically do a 2-for-1 stub trade by stub-ifying the new API\ninstead of the helpers it uses.  The last remaining \u0026quot;single\u0026quot; stub will\nsoon be dropped as well.\n\n[sean: rewrite changelog and comment, tag for stable, remove defunct stubs](CVE-2026-46076)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix the out-of-bounds nameoff handling for trailing dirents\n\nCurrently we already have boundary-checks for nameoffs, but the trailing\ndirents are special since the namelens are calculated with strnlen()\nwith unchecked nameoffs.\n\nIf a crafted EROFS has a trailing dirent with nameoff \u0026gt;= maxsize,\nmaxsize - nameoff can underflow, causing strnlen() to read past the\ndirectory block.\n\nnameoff0 should also be verified to be a multiple of\n`sizeof(struct erofs_dirent)` as well [1].\n\n[1] https://sashiko.dev/#/patchset/20260416063511.3173774-1-hsiangkao%40linux.alibaba.com(CVE-2026-46078)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0\n\nINVLPGA should cause a #UD when EFER.SVME is not set. Add a check to\nproperly inject #UD when EFER.SVME=0.\n\n[sean: tag for stable@](CVE-2026-46082)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm/vmalloc: take vmap_purge_lock in shrinker\n\ndecay_va_pool_node() can be invoked concurrently from two paths:\n__purge_vmap_area_lazy() when pools are being purged, and the shrinker via\nvmap_node_shrink_scan().\n\nHowever, decay_va_pool_node() is not safe to run concurrently, and the\nshrinker path currently lacks serialization, leading to races and possible\nleaks.\n\nProtect decay_va_pool_node() by taking vmap_purge_lock in the shrinker\npath to ensure serialization with purge users.(CVE-2026-46093)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt\n\nhci_le_create_big_complete_evt() iterates over BT_BOUND connections for\na BIG handle using a while loop, accessing ev-\u0026gt;bis_handle[i++] on each\niteration.  However, there is no check that i stays within ev-\u0026gt;num_bis\nbefore the array access.\n\nWhen a controller sends a LE_Create_BIG_Complete event with fewer\nbis_handle entries than there are BT_BOUND connections for that BIG,\nor with num_bis=0, the loop reads beyond the valid bis_handle[] flex\narray into adjacent heap memory.  Since the out-of-bounds values\ntypically exceed HCI_CONN_HANDLE_MAX (0x0EFF), hci_conn_set_handle()\nrejects them and the connection remains in BT_BOUND state.  The same\nconnection is then found again by hci_conn_hash_lookup_big_state(),\ncreating an infinite loop with hci_dev_lock held.\n\nFix this by terminating the BIG if in case not all BIS could be setup\nproperly.(CVE-2026-46138)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: vport: fix self-deadlock on release of tunnel ports\n\nvports are used concurrently and protected by RCU, so netdev_put()\nmust happen after the RCU grace period.  So, either in an RCU call or\nafter the synchronize_net().  The rtnl_delete_link() must happen under\nRTNL and so can\u0026apos;t be executed in RCU context.  Calling synchronize_net()\nwhile holding RTNL is not a good idea for performance and system\nstability under load in general, so calling netdev_put() in RCU call\nis the right solution here.\n\nHowever,\nwhen the device is deleted, rtnl_unlock() will call netdev_run_todo()\nand block until all the references are gone.  In the current code this\nmeans that we never reach the call_rcu() and the vport is never freed\nand the reference is never released, causing a self-deadlock on device\nremoval.\n\nFix that by moving the rcu_call() before the rtnl_unlock(), so the\nscheduled RCU callback will be executed when synchronize_net() is\ncalled from the rtnl_unlock()-\u0026gt;netdev_run_todo() while the RTNL itself\nis already released.(CVE-2026-46165)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nriscv: kvm: fix vector context allocation leak\n\nWhen the second kzalloc (host_context.vector.datap) fails in\nkvm_riscv_vcpu_alloc_vector_context, the first allocation\n(guest_context.vector.datap) is leaked. Free it before returning.(CVE-2026-46171)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nx86/CPU/AMD: Prevent improper isolation of shared resources in Zen2\u0026apos;s op cache\n\nMake sure resources are not improperly shared in the op cache and\ncause instruction corruption this way.(CVE-2026-46174)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq()\n\nSashiko points out that mlx4_srq_alloc() was not undone during error\nunwind, add the missing call to mlx4_srq_free().(CVE-2026-46178)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show()\n\nSashiko noticed an out-of-bounds read [1].\n\nIn spi_nor_params_show(), the snor_f_names array is passed to\nspi_nor_print_flags() using sizeof(snor_f_names).\n\nSince snor_f_names is an array of pointers, sizeof() returns the total\nnumber of bytes occupied by the pointers\n\t(element_count * sizeof(void *))\nrather than the element count itself. On 64-bit systems, this makes the\npassed length 8x larger than intended.\n\nInside spi_nor_print_flags(), the \u0026apos;names_len\u0026apos; argument is used to\nbounds-check the \u0026apos;names\u0026apos; array access. An out-of-bounds read occurs\nif a flag bit is set that exceeds the array\u0026apos;s actual element count\nbut is within the inflated byte-size count.\n\nCorrect this by using ARRAY_SIZE() to pass the actual number of\nstring pointers in the array.(CVE-2026-46190)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_inner: Fix IPv6 inner_thoff desync\n\nIn nft_inner_parse_l2l3(), when processing inner IPv6 packets,\nipv6_find_hdr() correctly computes the transport header offset\ntraversing all extension headers, but the result is immediately\noverwritten with nhoff + sizeof(_ip6h) (40 bytes), which only\naccounts for the IPv6 base header. This creates a desync between\ninner_thoff (wrong — points to extension header start) and l4proto\n(correct — e.g., IPPROTO_TCP), enabling transport header forgery\nand potential firewall bypass. This issue affects stable versions\nfrom Linux 6.2.\n\nFor comparison, the normal (non-inner) IPv6 path correctly\npreserves ipv6_find_hdr()\u0026apos;s result. Removing the incorrect overwrite\nensures that ipv6_find_hdr()\u0026apos;s calculated transport header offset is\npreserved, thereby fixing the desynchronization.(CVE-2026-46244)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntap: free page on error paths in tap_get_user_xdp()\n\ntap_get_user_xdp() rejects a frame shorter than ETH_HLEN with -EINVAL,\nand returns -ENOMEM when build_skb() fails. Both paths jump to the err\nlabel without freeing the page that vhost_net_build_xdp() allocated for\nthe frame. tap_sendmsg() discards the per-buffer return value and always\nreturns 0, so vhost_tx_batch() takes the success path and never frees\nthe page; each rejected frame in a batch leaks one page-frag chunk.\n\nFree the page on both error paths, before the skb is built. This is the\ntap counterpart of the same leak in tun_xdp_one().(CVE-2026-46320)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntun: free page on short-frame rejection in tun_xdp_one()\n\ntun_xdp_one() returns -EINVAL on a frame shorter than ETH_HLEN without\nfreeing the page that vhost_net_build_xdp() allocated for it.\ntun_sendmsg() discards that -EINVAL and still returns total_len, so\nvhost_tx_batch() takes the success path and never frees the page; each\nshort frame in a batch leaks one page-frag chunk.\n\nA local process that can open /dev/net/tun and /dev/vhost-net can hit\nthis path: it attaches a tun/tap device as the vhost-net backend and\nfeeds TX descriptors whose length minus the virtio-net header is below\nETH_HLEN. Each kick leaks the page-frag chunks for that batch, and a\ntight submission loop exhausts host memory and triggers an OOM panic.\nFree the page before returning -EINVAL, matching the XDP-program error\npath in the same function.(CVE-2026-46321)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntun: free page on build_skb failure in tun_xdp_one()\n\nWhen build_skb() fails in tun_xdp_one(), the function sets ret to\n-ENOMEM and jumps to the out label, which returns without freeing the\npage that vhost_net_build_xdp() allocated for the frame. As with the\nshort-frame rejection path, tun_sendmsg() discards the per-buffer error\nand still returns total_len, so vhost_tx_batch() takes the success path\nand never frees the page. Each build_skb() failure in a batch leaks one\npage-frag chunk.\n\nFree the page before taking the error path, matching the put_page() the\nother error exits of tun_xdp_one() already perform.(CVE-2026-46322)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: gro: don\u0026apos;t merge zcopy skbs\n\nskb_gro_receive() can currently copy frags between the source and GRO\nskb, without checking the zerocopy status, and in particular the\nSKBFL_MANAGED_FRAG_REFS flag.\n\nWhen SKBFL_MANAGED_FRAG_REFS is set, the skb doesn\u0026apos;t hold a reference\non the pages in shinfo-\u0026gt;frags. Appending those frags to another skb\u0026apos;s\nfrags without fixing up the page refcount can lead to UAF.\n\nWhen either the last skb in the GRO chain (the one we would append\nfrags to) or the source skb is zerocopy, don\u0026apos;t merge the skbs.(CVE-2026-46323)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nRevert \u0026quot;net/smc: Introduce TCP ULP support\u0026quot;\n\nThis reverts commit d7cd421da9da2cc7b4d25b8537f66db5c8331c40.\n\nAs reported by Al Viro, the TCP ULP support for SMC is fundamentally\nbroken. The implementation attempts to convert an active TCP socket\ninto an SMC socket by modifying the underlying `struct file`, dentry,\nand inode in-place, which violates core VFS invariants that assume\nthese structures are immutable for an open file, creating a risk of\nuse after free errors and general system instability.\n\nGiven the severity of this design flaw and the fact that cleaner\nalternatives (e.g., LD_PRELOAD, BPF) exist for legacy application\ntransparency, the correct course of action is to remove this feature\nentirely.(CVE-2026-46330)","status":"published","published":"2026-07-24T11:12:02Z","modified":"2026-08-18T01:21:25.869043975Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-31531","title":"CVE-2026-31531 in linux - Patched by Root","description":"Root has patched CVE-2026-31531 in the linux package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-08-23T09:13:41Z","modified":"2026-08-23T10:17:01.43728098Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:29.900552Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-31531","title":"CVE-2026-31531 in linux - Patched by Root","description":"Root has patched CVE-2026-31531 in the linux package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-10-18T03:18:11Z","modified":"2026-10-18T04:16:28.671045461Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:32.037361Z"},{"id":"ROOT-OS-UBUNTU-2204-CVE-2026-31531","title":"CVE-2026-31531 in linux - Patched by Root","description":"Root has patched CVE-2026-31531 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.","status":"published","published":"2026-11-06T13:52:25Z","modified":"2026-11-06T14:17:06.790093345Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-06T14:57:22.607019Z"},{"id":"ROOT-OS-UBUNTU-2404-CVE-2026-31531","title":"CVE-2026-31531 in linux - Patched by Root","description":"Root has patched CVE-2026-31531 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.","status":"published","published":"2026-11-06T15:54:27Z","modified":"2026-11-06T16:17:56.532688152Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-06T16:59:13.602872Z"},{"id":"UBUNTU-CVE-2026-31531","description":"In the Linux kernel, the following vulnerability has been resolved: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() When querying a nexthop object via RTM_GETNEXTHOP, the kernel currently allocates a fixed-size skb using NLMSG_GOODSIZE. While sufficient for single nexthops and small Equal-Cost Multi-Path groups, this fixed allocation fails for large nexthop groups like 512 nexthops. This results in the following warning splat:  WARNING: net/ipv4/nexthop.c:3395 at rtm_get_nexthop+0x176/0x1c0, CPU#20: rep/4608  [...]  RIP: 0010:rtm_get_nexthop (net/ipv4/nexthop.c:3395)  [...]  Call Trace:   \u003cTASK\u003e   rtnetlink_rcv_msg (net/core/rtnetlink.c:6989)   netlink_rcv_skb (net/netlink/af_netlink.c:2550)   netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)   netlink_sendmsg (net/netlink/af_netlink.c:1894)   ____sys_sendmsg (net/socket.c:721 net/socket.c:736 net/socket.c:2585)   ___sys_sendmsg (net/socket.c:2641)   __sys_sendmsg (net/socket.c:2671)   do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)   \u003c/TASK\u003e Fix this by allocating the size dynamically using nh_nlmsg_size() and using nlmsg_new(), this is consistent with nexthop_notify() behavior. In addition, adjust nh_nlmsg_size_grp() so it calculates the size needed based on flags passed. While at it, also add the size of NHA_FDB for nexthop group size calculation as it was missing too. This cannot be reproduced via iproute2 as the group size is currently limited and the command fails as follows: addattr_l ERROR: message exceeded bound of 1048","status":"published","published":"2026-04-23T12:17:00Z","modified":"2026-11-11T09:39:26.924372851Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-11T10:01:31.493995Z"},{"id":"AZL-83541","title":"CVE-2026-31531 affecting package kernel 6.6.161.1-1","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()\n\nWhen querying a nexthop object via RTM_GETNEXTHOP, the kernel currently\nallocates a fixed-size skb using NLMSG_GOODSIZE. While sufficient for\nsingle nexthops and small Equal-Cost Multi-Path groups, this fixed\nallocation fails for large nexthop groups like 512 nexthops.\n\nThis results in the following warning splat:\n\n WARNING: net/ipv4/nexthop.c:3395 at rtm_get_nexthop+0x176/0x1c0, CPU#20: rep/4608\n [...]\n RIP: 0010:rtm_get_nexthop (net/ipv4/nexthop.c:3395)\n [...]\n Call Trace:\n  \u003cTASK\u003e\n  rtnetlink_rcv_msg (net/core/rtnetlink.c:6989)\n  netlink_rcv_skb (net/netlink/af_netlink.c:2550)\n  netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)\n  netlink_sendmsg (net/netlink/af_netlink.c:1894)\n  ____sys_sendmsg (net/socket.c:721 net/socket.c:736 net/socket.c:2585)\n  ___sys_sendmsg (net/socket.c:2641)\n  __sys_sendmsg (net/socket.c:2671)\n  do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)\n  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n  \u003c/TASK\u003e\n\nFix this by allocating the size dynamically using nh_nlmsg_size() and\nusing nlmsg_new(), this is consistent with nexthop_notify() behavior. In\naddition, adjust nh_nlmsg_size_grp() so it calculates the size needed\nbased on flags passed. While at it, also add the size of NHA_FDB for\nnexthop group size calculation as it was missing too.\n\nThis cannot be reproduced via iproute2 as the group size is currently\nlimited and the command fails as follows:\n\naddattr_l ERROR: message exceeded bound of 1048","status":"published","published":"2026-04-23T12:17:01Z","modified":"2026-11-05T14:17:18.262569279Z","updated_at":"2026-11-05T16:41:24.988217Z"},{"id":"CLSA-2026-1782155469","title":"kernel: Fix of 143 CVEs","description":"- ice: Fix PTP NULL pointer dereference during VSI rebuild {CVE-2026-23210}\n- tracing: Add recursion protection in kernel stack trace recording {CVE-2026-23138}\n- mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() {CVE-2025-38681}\n- cpuset: fix warning when disabling remote partition {CVE-2025-71142}\n- virtio: break and reset virtio devices on device_shutdown() {CVE-2025-38064}\n- netdevsim: fix a race issue related to the operation on bpf_bound_progs list {CVE-2026-23126}\n- atm: clip: Fix potential null-ptr-deref in to_atmarpd(). {CVE-2025-38460}\n- idpf: fix error handling in the init_task on load {CVE-2026-23017}\n- rxrpc: Fix recvmsg() unconditional requeue {CVE-2026-23066}\n- block: zero non-PI portion of auto integrity buffer {CVE-2026-23007}\n- can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode {CVE-2025-38665}\n- virtio_net: Fix napi_skb_cache_put warning {CVE-2024-43835}\n- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}\n- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() {CVE-2026-23169}\n- net: fix segmentation of forwarding fraglist GRO {CVE-2026-23154}\n- gfs2: Validate i_depth for exhash directories {CVE-2025-38710}\n- KVM: Don't clobber irqfd routing type when deassigning irqfd {CVE-2026-23198}\n- ipvlan: Make the addrs_lock be per port {CVE-2026-23103}\n- xfs: fix freemap adjustments when adding xattrs to leaf blocks {CVE-2026-43158}\n- can: mcp251xfd: fix infinite loop when xmit fails {CVE-2024-41088}\n- RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly {CVE-2025-71096}\n- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction {CVE-2025-38161}\n- scsi: qla2xxx: Validate sp before freeing associated memory {CVE-2025-71236}\n- net/sched: netem: account for backlog updates from child qdisc {CVE-2024-56770}\n- drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat {CVE-2026-31656}\n- iavf: fix off-by-one issues in iavf_config_rss_reg() {CVE-2025-71087}\n- net/sched: ets: fix divide by zero in the offload path {CVE-2026-23379}\n- can: j1939: implement NETDEV_UNREGISTER notification handler {CVE-2025-39925}\n- ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() {CVE-2026-31531}\n- Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb {CVE-2026-31510}\n- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() {CVE-2026-23003}\n- drm/i915/gt: Check set_default_submission() before deferencing {CVE-2026-31540}\n- mac802154: check local interfaces before deleting sdata list {CVE-2024-57948}\n- lib/buildid: use __kernel_read() for sleepable context {CVE-2026-23002}\n- scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs {CVE-2023-52808}\n- net: fix memory leak in skb_segment_list for GRO packets {CVE-2026-22979}\n- irqchip/imx-irqsteer: Handle runtime power management correctly {CVE-2024-42290}\n- io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop {CVE-2026-23113}\n- net/sched: ets: Remove drr class from the active list if it changes to strict {CVE-2025-68815}\n- net: bonding: fix NULL deref in bond_debug_rlb_hash_show {CVE-2026-31546}\n- ipvs: fix ipv4 null-ptr-deref in route error path {CVE-2025-68813}\n- openvswitch: fix lockup on tx to unregistering netdev with carrier {CVE-2025-21681}\n- net: USB: Fix wrong-direction WARNING in plusb.c {CVE-2023-52742}\n- module: Fix kernel panic when a symbol st_shndx is out of bounds {CVE-2026-31521}\n- udf: Fix preallocation discarding at indirect extent boundary {CVE-2022-48946}\n- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle {CVE-2025-39947}\n- scsi: core: Wake up the error handler when final completions race against each other {CVE-2026-23110}\n- nbd: don't allow reconnect after disconnect {CVE-2025-21731}\n- nfsd: check that server is running in unlock_filesystem {CVE-2026-22989}\n- af_key: validate families in pfkey_send_migrate() {CVE-2026-31515}\n- netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() {CVE-2024-36286}\n- scsi: qla2xxx: Delay module unload while fabric scan in progress {CVE-2025-71235}\n- smc91x: fix broken irq-context in PREEMPT_RT {CVE-2025-71132}\n- net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb {CVE-2023-53548}\n- net: stmmac: fix the crash issue for zero copy XDP_TX action {CVE-2025-71095}\n- kprobes: Skip clearing aggrprobe's post_handler in kprobe-on-ftrace case {CVE-2022-49779}\n- wifi: ath11k: add srng-\u003elock for ath11k_hal_srng_* in monitor mode {CVE-2024-58096}\n- Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop {CVE-2026-31498}\n- ipv4: Fix reference count leak when using error routes with nexthop objects {CVE-2025-71097}\n- idpf: fix null-ptr-deref in idpf_features_check {CVE-2025-38053}\n- net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled {CVE-2026-23381}\n- xen/privcmd: fix error exit of privcmd_ioctl_dm_op() {CVE-2022-49989}\n- crypto: null - Use spin lock instead of mutex {CVE-2025-37808}\n- x86/efistub: Call mixed mode boot services on the firmware's stack {CVE-2024-35803}\n- ubi: fastmap: Fix duplicate slab cache names while attaching {CVE-2024-53172}\n- ext4: detect invalid INLINE_DATA + EXTENTS flag combination {CVE-2025-40167}\n- nbd: defer config unlock in nbd_genl_connect {CVE-2025-68366}\n- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al {CVE-2025-38653}\n- block: mark GFP_NOIO around sysfs -\u003estore() {CVE-2025-21817}\n- dlm: fix possible lkb_resource null dereference {CVE-2024-47809}\n- xfs: factor out xfs_attr3_leaf_init\n- crypto: qat - flush misc workqueue during device shutdown {CVE-2025-39721}\n- skbuff: Account for tail adjustment during pull operations {CVE-2022-50365}\n- libceph: fix race between delayed_work() and ceph_monc_stop() {CVE-2024-42232}\n- bpf: Fix reference count leak in bpf_prog_test_run_xdp() {CVE-2026-22994}\n- tpm: Cap the number of PCR banks {CVE-2025-71077}\n- ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602}\n- wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure {CVE-2026-23444}\n- fuse: Fix missing FOLL_PIN for direct-io {CVE-2024-53219}\n- tracing: Make sure trace_printk() can output as soon as it can be used {CVE-2023-53007}\n- wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() {CVE-2025-71273}\n- can: mcp251x: fix deadlock in error path of mcp251x_open {CVE-2026-23357}\n- ice: Fix memory leak in ice_set_ringparam() {CVE-2026-23389}\n- ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers {CVE-2025-21870}\n- idpf: fix memory leak in idpf_vport_rel() {CVE-2026-23023}\n- Octeontx2-af: Add proper checks for fwdata {CVE-2026-23070}\n- mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() {CVE-2022-48972}\n- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051}\n- NFSD: NFSv4 file creation neglects setting ACL {CVE-2025-68803}\n- can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak {CVE-2026-23058}\n- net/sched: cls_api: fix error handling causing NULL dereference {CVE-2025-21857}\n- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() {CVE-2025-40194}\n- wifi: ath11k: fix RCU stall while reaping monitor destination ring {CVE-2024-58097}\n- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408}\n- Bluetooth: bcsp: receive data only if registered {CVE-2025-40308}\n- netfilter: nf_tables: release flowtable after rcu grace period on error {CVE-2026-23392}\n- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id {CVE-2025-68724}\n- rxrpc: fix reference count leak in rxrpc_server_keyring() {CVE-2026-31634}\n- drm/ttm: Avoid NULL pointer deref for evicted BOs {CVE-2025-71083}\n- HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them {CVE-2026-23382}\n- wifi: radiotap: reject radiotap with unknown bits {CVE-2026-23367}\n- can: j1939: make j1939_session_activate() fail if device is no longer registered {CVE-2025-71182}\n- sctp: Prevent TOCTOU out-of-bounds write {CVE-2025-40331}\n- HID: alps: fix NULL pointer dereference in alps_raw_event() {CVE-2026-31625}\n- RDMA/cm: Fix leaking the multicast GID table reference {CVE-2025-71084}\n- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() {CVE-2026-23455}\n- rtc: check if __rtc_read_time was successful in rtc_timer_do_work() {CVE-2024-56739}\n- can: j1939: j1939_session_destroy(): fix memory leak of skbs {CVE-2024-56645}\n- Bluetooth: btusb: clamp SCO altsetting table indices {CVE-2026-31497}\n- platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]() {CVE-2022-50521}\n- x86/CPU: Fix FPDSS on Zen1 {CVE-2026-31628}\n- io_uring: fix filename leak in __io_openat_prep() {CVE-2025-68814}\n- wifi: mac80211: don't WARN for connections on invalid channels {CVE-2025-71227}\n- cpufreq: Avoid a bad reference count on CPU node {CVE-2024-50012}\n- netfilter: ip6t_eui64: reject invalid MAC header for all packets {CVE-2026-31685}\n- wifi: rt2x00usb: fix devres lifetime {CVE-2026-31672}\n- ext4: xattr: fix null pointer deref in ext4_raw_inode() {CVE-2025-68820}\n- Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() {CVE-2026-31512}\n- xfrm_user: fix info leak in build_report() {CVE-2026-31671}\n- xfrm: clear trailing padding in build_polexpire() {CVE-2026-31664}\n- ipv6: add NULL checks for idev in SRv6 paths {CVE-2026-23442}\n- octeontx2-pf: fix \"UBSAN: shift-out-of-bounds error\" {CVE-2025-71137}\n- pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() {CVE-2026-23038}\n- ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free {CVE-2025-38105}\n- ALSA: usb-audio: Kill timer properly at removal {CVE-2025-38105}\n- kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork() {CVE-2025-22090}\n- mm: (un)track_pfn_copy() fix + doc improvements {CVE-2025-22090}\n- x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() {CVE-2025-22090}\n- io_uring: fix overflow resched cqe reordering {CVE-2024-50060}\n- io_uring: check if we need to reschedule during overflow flush {CVE-2024-50060}\n- virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN {CVE-2025-38048}\n- nvme-tcp: sanitize request list handling {CVE-2025-38264}\n- KVM: arm64: Reassign nested_mmus array behind mmu_lock {CVE-2026-46316}\n- drm/amd/display: Do not skip unrelated mode changes in DSC validation {CVE-2026-31488}\n- drm/xe: Fix an out-of-bounds shift when invalidating TLB {CVE-2025-37761}\n- fuse: reject oversized dirents in page cache {CVE-2026-31694}\n- bpf, sockmap: Avoid using sk_socket after free when sending {CVE-2025-38154}\n- thermal: core: Fix thermal zone device registration error path {CVE-2026-43332}\n- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). {CVE-2025-40186}\n- smb: client: fix OOB reads parsing symlink error response {CVE-2026-31613}\n- drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl() {CVE-2025-71099}\n- scsi: sg: Do not sleep in atomic context {CVE-2025-40259}\n- net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect {CVE-2025-38385}\n- iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED {CVE-2025-71122}\n- mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() {CVE-2026-31586}\n- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback {CVE-2026-23013}","status":"published","published":"2026-10-21T06:13:51Z","modified":"2026-10-26T09:43:57.202616396Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1783791447","title":"kernel: Fix of 307 CVEs","description":"- gpiolib: cdev: Set lineevent_state::irq after IRQ register successfully {CVE-2022-48660}\n- ipv4: check for NULL idev in ip_route_use_hint() {CVE-2024-36008}\n- KEYS: trusted: Do not use WARN when encode fails {CVE-2024-36975}\n- Fix userfaultfd_api to return EINVAL as expected {CVE-2024-41027}\n- xhci: Fix null pointer dereference when host dies {CVE-2023-52898}\n- sctp: sysctl: auth_enable: avoid using current-\u003ensproxy {CVE-2025-21638}\n- blk-mq: fix IO hang from sbitmap wakeup race {CVE-2024-26671}\n- net: openvswitch: fix flow memory leak in ovs_flow_cmd_new {CVE-2023-52977}\n- gpiolib: fix memory leak in gpiochip_setup_dev() {CVE-2022-48975}\n- HID: betop: check shape of output reports {CVE-2023-53015}\n- mm/swapfile: add cond_resched() in get_swap_pages() {CVE-2023-52932}\n- HV: hv_balloon: fix memory leak with using debugfs_lookup() {CVE-2023-52937}\n- drm/i915: Fix a memory leak with reused mmap_offset {CVE-2023-53002}\n- ptdma: pt_core_execute_cmd() should use spinlock {CVE-2023-53013}\n- RDMA/core: Fix ib block iterator counter overflow {CVE-2023-53026}\n- Bluetooth: hci_conn: Fix memory leaks {CVE-2023-53018}\n- scsi: target: pscsi: Fix bio_put() for error case {CVE-2024-26760}\n- sctp: Prevent TOCTOU out-of-bounds write {CVE-2025-40331}\n- pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() {CVE-2026-23038}\n- cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() {CVE-2025-40194}\n- ALSA: hda/cs8409: Fix possible NULL dereference {CVE-2024-50160}\n- nbd: don't allow reconnect after disconnect {CVE-2025-21731}\n- openvswitch: fix lockup on tx to unregistering netdev with carrier {CVE-2025-21681}\n- ext4: detect invalid INLINE_DATA + EXTENTS flag combination {CVE-2025-40167}\n- ext4: xattr: fix null pointer deref in ext4_raw_inode() {CVE-2025-68820}\n- net: fix memory leak in skb_segment_list for GRO packets {CVE-2026-22979}\n- wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode {CVE-2025-40321}\n- ipvs: fix ipv4 null-ptr-deref in route error path {CVE-2025-68813}\n- ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping {CVE-2025-40121}\n- i40e: Fix macvlan leak by synchronizing access to mac_filter_hash {CVE-2024-50041}\n- net/mlx5e: Fix NULL deref in mlx5e_tir_builder_alloc() {CVE-2024-50000}\n- bpf: Fix reference count leak in bpf_prog_test_run_xdp() {CVE-2026-22994}\n- xsk: check IFF_UP earlier in Tx path {CVE-2023-53240}\n- firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers {CVE-2024-41038}\n- virtgpu: don't reset on shutdown {CVE-2025-38064}\n- xen/netfront: fix crash when removing device {CVE-2022-48969}\n- mptcp: do not fallback when OoO is present {CVE-2024-50185}\n- can: j1939: add missing calls in NETDEV_UNREGISTER notification handler {CVE-2025-39925}\n- netfilter: nf_tables: remove redundant chain validation on register store {CVE-2025-71160}\n- xfs: fix use-after-free in xattr node block inactivation {CVE-2026-43053}\n- ext4: fix racy may inline data check in dio write {CVE-2023-52786}\n- drm/amdgpu/fence: Fix oops due to non-matching drm_sched init/fini {CVE-2023-52738}\n- macsec: fix UAF bug for real_dev {CVE-2022-49390}\n- drm/i915/gem: Fix Virtual Memory mapping boundaries calculation {CVE-2024-42259}\n- mm/shmem: disable PMD-sized page cache if needed {CVE-2024-42241}\n- driver: iio: add missing checks on iio_info's callback access {CVE-2024-46715}\n- udmabuf: fix memory leak on last export_udmabuf() error path {CVE-2024-56712}\n- ALSA: control: Avoid WARN() for symlink errors {CVE-2024-56657}\n- mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM {CVE-2024-56611}\n- eth: bnxt: always recalculate features after XDP clearing, fix null-deref {CVE-2025-21682}\n- net: annotate data-races around sk-\u003esk_{data_ready,write_space} {CVE-2026-23302}\n- udmabuf: change folios array from kmalloc to kvmalloc {CVE-2024-56544}\n- RDMA/mlx5: Move events notifier registration to be after device registration {CVE-2024-53224}\n- dlm: fix possible lkb_resource null dereference {CVE-2024-47809}\n- ACPI: battery: Fix possible crash when unregistering a battery hook {CVE-2024-49955}\n- ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params {CVE-2024-58012}\n- tpm: Change to kvalloc() in eventlog/acpi.c {CVE-2024-58005}\n- net_sched: sch_sfq: move the limit validation {CVE-2025-37752}\n- usb: xhci: Fix NULL pointer dereference on certain command aborts {CVE-2024-57981}\n- mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize() {CVE-2025-21861}\n- bpf: avoid holding freeze_mutex during mmap operation {CVE-2025-21853}\n- acct: perform last write from workqueue {CVE-2025-21846}\n- netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree() {CVE-2025-21959}\n- ipvlan: ensure network headers are in skb linear part {CVE-2025-21891}\n- wifi: iwlwifi: mvm: fix 6 GHz scan construction {CVE-2024-53055}\n- signal: restore the override_rlimit logic {CVE-2024-50271}\n- thermal: core: Reference count the zone in thermal_zone_get_by_id() {CVE-2024-50028}\n- block: fix potential invalid pointer dereference in blk_add_partition {CVE-2024-47705}\n- userfaultfd: fix checks for huge PMDs {CVE-2024-46787}\n- mptcp: pm: only mark 'subflow' endp as available {CVE-2024-45010}\n- mptcp: pm: re-using ID of unused flushed subflows {CVE-2024-45010}\n- eth: bnxt: fix truesize for mb-xdp-pass case {CVE-2025-21961}\n- driver core: fix potential NULL pointer dereference in dev_uevent() {CVE-2025-37800}\n- virtio_net: Fix napi_skb_cache_put warning {CVE-2024-43835}\n- cgroup: fix race between task migration and iteration {CVE-2026-43439}\n- bpf: Fix wrong reg type conversion in release_reference() {CVE-2022-49873}\n- RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error {CVE-2025-21732}\n- serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN {CVE-2026-23472}\n- drm/amdgpu: Limit BO list entry count to prevent resource exhaustion {CVE-2026-23468}\n- net: add proper RCU protection to /proc/net/ptype {CVE-2026-23255}\n- tcp: secure_seq: add back ports to TS offset {CVE-2026-23247}\n- RDMA/mlx5: Fix a WARN during dereg_mr for DM type {CVE-2025-21888}\n- list: fix a data-race around ep-\u003erdllist {CVE-2022-49443}\n- can: isotp: sanitize CAN ID checks in isotp_bind() {CVE-2022-49269}\n- rxrpc: Fix recv-recv race of completed call {CVE-2025-38524}\n- sched/rt: Fix race in push_rt_task {CVE-2025-38234}\n- NFSD: fix race between nfsd registration and exports_proc {CVE-2025-38232}\n- virtio: break and reset virtio devices on device_shutdown() {CVE-2025-38064}\n- block: fix resource leak in blk_register_queue() error path {CVE-2025-37980}\n- xsk: Fix race condition in AF_XDP generic RX path {CVE-2025-37920}\n- mm/vmscan: don't try to reclaim hwpoison folio {CVE-2025-37834}\n- nouveau: offload fence uevents work to workqueue {CVE-2024-26719}\n- bpf: Fix kmemleak warning for percpu hashmap {CVE-2025-37807}\n- x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() {CVE-2024-26906}\n- x86/mm: Move is_vsyscall_vaddr() into asm/vsyscall.h {CVE-2024-26906}\n- net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket {CVE-2024-42246}\n- quota: Fix potential NULL pointer dereference {CVE-2024-26878}\n- arp: Prevent overflow in arp_req_get(). {CVE-2024-26733}\n- ALSA: Fix deadlocks with kctl removals at disconnection {CVE-2024-38600}\n- wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values {CVE-2024-42114}\n- Bluetooth: hci_core: cancel all works upon hci_unregister_dev() {CVE-2024-41063}\n- fsnotify: clear PARENT_WATCHED flags lazily {CVE-2024-47660}\n- mm: use memalloc_nofs_save() in page_cache_ra_order() {CVE-2024-36882}\n- mm/memory-failure: fix deadlock when hugetlb_optimize_vmemmap is enabled {CVE-2024-26987}\n- net: esp: fix bad handling of pages from page_pool {CVE-2024-26953}\n- virtio/vsock: Fix accept_queue memory leak {CVE-2024-53119}\n- netfilter: nft_payload: sanitize offset and length before calling skb_checksum() {CVE-2024-50251}\n- fs/proc: fix softlockup in __read_vmcore (part 2) {CVE-2025-21694}\n- drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability {CVE-2024-53051}\n- net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod. {CVE-2025-23143}\n- x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() {CVE-2025-22090}\n- net: decrease cached dst counters in dst_release {CVE-2025-22057}\n- nfsd: put dl_stid if fail to queue dl_recall {CVE-2025-22025}\n- nfsd: make nfsd4_run_cb a bool return function {CVE-2025-22025}\n- usb: gadget: core: flush gadget workqueue after device removal {CVE-2025-21838}\n- PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1 {CVE-2025-21831}\n- media: uvcvideo: Fix crash during unbind if gpio unit is in use {CVE-2024-58079}\n- usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm() {CVE-2023-52877}\n- ext4: filesystems without casefold feature cannot be mounted with siphash {CVE-2024-49968}\n- padata: use integer wrap around to prevent deadlock on seq_nr overflow {CVE-2024-47739}\n- bpf, lsm: Add check for BPF LSM return value {CVE-2024-47703}\n- sched/smt: Fix unbalance sched_smt_present dec/inc {CVE-2024-44958}\n- xen-netfront: Fix NULL sring after live migration {CVE-2022-48969}\n- dlm: prevent NPD when writing a positive value to event_done {CVE-2025-23131}\n- udp: Deal with race between UDP socket address change and rehash {CVE-2024-57974}\n- bpf: sync_linked_regs() must preserve subreg_def {CVE-2024-53125}\n- mptcp: handle consistently DSS corruption {CVE-2024-50185}\n- null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues' {CVE-2024-36478}\n- net: tunnels: annotate lockless accesses to dev-\u003eneeded_headroom {CVE-2023-53109}\n- net/mlx5e: Avoid WARN_ON when configuring MQPRIO with HTB offload enabled {CVE-2025-38039}\n- uprobes: Reject the shared zeropage in uprobe_write_opcode() {CVE-2025-21881}\n- mm: slub: avoid wake up kswapd in set_track_prepare {CVE-2025-39843}\n- mm/smaps: fix race between smaps_hugetlb_range and migration {CVE-2025-39754}\n- bpf: Reject narrower access to pointer ctx fields {CVE-2025-38591}\n- net: clear the dst when changing skb protocol {CVE-2025-38192}\n- backlight: led_bl: Hold led_access lock when calling led_sysfs_disable() {CVE-2025-23144}\n- RDMA/core: Don't expose hw_counters outside of init net namespace {CVE-2025-22089}\n- can: j1939: implement NETDEV_UNREGISTER notification handler {CVE-2025-39925}\n- net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. {CVE-2025-22111}\n- vxlan: Fix NPD when refreshing an FDB entry with a nexthop object {CVE-2025-39851}\n- loop: Avoid updating block size under exclusive owner {CVE-2025-38709}\n- wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() {CVE-2025-38643}\n- net_sched: sch_sfq: reject invalid perturb period {CVE-2025-38193}\n- net: phy: mscc: Fix memory leak when using one step timestamping {CVE-2025-38148}\n- espintcp: remove encap socket caching to avoid reference leak {CVE-2025-38097}\n- rseq: Fix segfault on registration when rseq_cs is non-zero {CVE-2025-38067}\n- serial: mctrl_gpio: split disable_ms into sync and no_sync APIs {CVE-2025-38040}\n- usb: typec: ucsi: displayport: Fix deadlock {CVE-2025-37967}\n- ipvs: fix uninit-value for saddr in do_output_route4 {CVE-2025-37961}\n- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item {CVE-2025-68211}\n- bpf: Scrub packet on bpf_redirect_peer {CVE-2025-37959}\n- tracing: Verify event formats that have \"%*p..\" {CVE-2025-37938}\n- iommu/amd/pgtbl: Fix possible race while increase page table level {CVE-2025-39961}\n- net/mlx5e: Harden uplink netdev access against device unbind {CVE-2025-39947}\n- dm-stripe: fix a possible integer overflow {CVE-2025-39940}\n- net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer {CVE-2025-39937}\n- can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode {CVE-2025-38665}\n- net/mlx5e: Fix crash on profile change rollback failure {CVE-2026-23000}\n- netfilter: nft_set_pipapo: prevent overflow in lookup table allocation {CVE-2025-38162}\n- tracing: Add recursion protection in kernel stack trace recording {CVE-2026-23138}\n- rxrpc: Fix recvmsg() unconditional requeue {CVE-2026-23066}\n- net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts {CVE-2026-22997}\n- net: can: j1939: recover socket queue on CAN bus error during BAM transmission {CVE-2026-22997}\n- dm-verity: disable recursive forward error correction {CVE-2025-71161}\n- netfilter: nf_tables: avoid chain re-validation if possible {CVE-2025-71160}\n- KEYS: trusted: Fix a memory leak in tpm2_load_cmd {CVE-2025-71147}\n- vsock/virtio: fix potential underflow in virtio_transport_get_credit() {CVE-2026-23069}\n- net: fix segmentation of forwarding fraglist GRO {CVE-2026-23154}\n- ice: Don't process extts if PTP is disabled {CVE-2024-42107}\n- drm/i915/dpt: Make DPT object unshrinkable {CVE-2024-40924}\n- drm/i915/dpt: Treat the DPT BO as a framebuffer {CVE-2024-40924}\n- bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rx {CVE-2024-53091}\n- pipe: wakeup wr_wait after setting max_usage {CVE-2023-52672}\n- bonding: restore bond's IFF_SLAVE flag if a non-eth dev enslave fails {CVE-2023-53103}\n- HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check {CVE-2024-57993}\n- drm/amdkfd: debugfs hang_hws skip GPU with MES {CVE-2025-37853}\n- leds: mlxreg: Use devm_mutex_init() for mutex initialization {CVE-2024-42129}\n- drm/amd/display: fix a Null pointer dereference vulnerability {CVE-2025-39705}\n- gfs2: Validate i_depth for exhash directories {CVE-2025-38710}\n- drm/scheduler: signal scheduled fence when kill job {CVE-2025-38436}\n- drm/amdgpu: Add basic validation for RAS header {CVE-2025-38426}\n- mptcp: fix NULL pointer in can_accept_new_subflow {CVE-2025-23145}\n- bpf: bpf_sk_storage: Fix invalid wait context lockdep report {CVE-2023-53857}\n- nvme-core: fix memory leak in dhchap_secret_store {CVE-2023-53852}\n- virtio_net: Fix error unwinding of XDP initialization {CVE-2023-53499}\n- nvme-core: fix memory leak in dhchap_ctrl_secret {CVE-2023-53792}\n- ceph: fix race condition validating r_parent before applying state {CVE-2025-39927}\n- x86/MCE: Always save CS register on AMD Zen IF Poison errors {CVE-2023-53438}\n- genirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask() {CVE-2023-53332}\n- nfsd: move init of percpu reply_cache_stats counters back to nfsd_init_net {CVE-2023-54276}\n- blk-cgroup: Fix NULL deref caused by blkg_policy_data being installed before init {CVE-2023-54271}\n- net/mlx5e: TC, Fix internal port memory leak {CVE-2023-53999}\n- tipc: do not update mtu if msg_max is too small in mtu negotiation {CVE-2023-53517}\n- tipc: add tipc_bearer_min_mtu to calculate min mtu {CVE-2023-53517}\n- tun: Fix memory leak for detached NAPI queue. {CVE-2023-53685}\n- net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize {CVE-2023-53667}\n- start_kernel: Add __no_stack_protector function attribute {CVE-2023-53491}\n- net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb {CVE-2023-53548}\n- sched/psi: use kernfs polling functions for PSI trigger polling {CVE-2023-54019}\n- cxl/pmem: Fix nvdimm registration races {CVE-2023-54323}\n- drm/radeon: delete radeon_fence_process in is_signaled, no deadlock {CVE-2025-68223}\n- dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() {CVE-2026-23004}\n- wifi: mac80211: don't WARN for connections on invalid channels {CVE-2025-71227}\n- md: suspend array while updating raid_disks via sysfs {CVE-2025-71225}\n- net: stmmac: fix the crash issue for zero copy XDP_TX action {CVE-2025-71095}\n- drm/ttm: Don't leak a resource on eviction error {CVE-2023-54254}\n- firmware: arm_sdei: Fix sleep from invalid context BUG {CVE-2023-54160}\n- iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter {CVE-2023-54057}\n- net: usb: asix: validate PHY address before use {CVE-2025-71094}\n- tty: fix deadlock caused by calling printk() under tty_port-\u003elock {CVE-2022-49441}\n- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE {CVE-2026-23401}\n- blktrace: fix __this_cpu_read/write in preemptible context {CVE-2026-23374}\n- x86/CPU: Fix FPDSS on Zen1 {CVE-2025-54505}\n- ice: Fix PTP NULL pointer dereference during VSI rebuild {CVE-2026-23210}\n- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() {CVE-2026-23169}\n- gfs2: No more self recovery {CVE-2025-38659}\n- tracing: kprobe: Fix memory leak in test_gen_kprobe/kretprobe_cmd() {CVE-2022-49891}\n- tracing: kprobe: Fix potential null-ptr-deref on trace_array in kprobe_event_gen_test_exit() {CVE-2022-49796}\n- tracing: kprobe: Fix potential null-ptr-deref on trace_event_file in kprobe_event_gen_test_exit() {CVE-2022-49797}\n- netlink: Bounds-check struct nlmsgerr creation {CVE-2022-49766}\n- bpf: Prevent bpf program recursion for raw tracepoint probes {CVE-2022-49764}\n- i2c: designware: use casting of u64 in clock multiplication to avoid overflow {CVE-2022-49749}\n- futex: Clear stale exiting pointer in futex_lock_pi() retry path {CVE-2026-31555}\n- ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() {CVE-2026-31531}\n- netfilter: ctnetlink: use netlink policy range checks {CVE-2026-31495}\n- tracing: Fix potential deadlock in cpu hotplug with osnoise {CVE-2026-31480}\n- esp: fix skb leak with espintcp and async crypto {CVE-2026-31518}\n- xfs: factor out xfs_attr3_leaf_init {CVE-2026-43053}\n- xfs: factor out xfs_attr3_node_entry_remove {CVE-2026-43053}\n- ALSA: ctxfi: Check the error for index mapping {CVE-2026-31777}\n- bridge: br_nd_send: validate ND option lengths {CVE-2026-31752}\n- rtnetlink: add missing netlink_ns_capable() check for peer netns {CVE-2026-31692}\n- crypto: af_alg - limit RX SG extraction by receive buffer budget {CVE-2026-31677}\n- APEI/GHES: ensure that won't go past CPER allocated record {CVE-2026-43277}\n- ceph: supply snapshot context in ceph_zero_partial_object() {CVE-2026-43273}\n- team: avoid NETDEV_CHANGEMTU event when unregistering slave {CVE-2026-43234}\n- wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() {CVE-2025-71297}\n- EFI/CPER: don't go past the ARM processor CPER record buffer {CVE-2026-43266}\n- net: bridge: switchdev: Skip MDB replays of deferred events on offload {CVE-2024-26837}\n- can: mcp251xfd: fix infinite loop when xmit fails {CVE-2024-41088}\n- ipvlan: Make the addrs_lock be per port {CVE-2026-23103}\n- netem: fix return value if duplicate enqueue fails {CVE-2024-45016}\n- USB: serial: mos7840: fix crash on resume {CVE-2024-42244}\n- crypto: null - Use spin lock instead of mutex {CVE-2025-37808}\n- RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly {CVE-2025-71096}\n- bpf: Fix overrunning reservations in ringbuf {CVE-2024-41009}\n- bpf: Fix bpf_sk_select_reuseport() memory leak {CVE-2025-21683}\n- drm/i915: Fix request ref counting during error capture \u0026 debugfs dump {CVE-2023-52981}\n- netfilter: conntrack: fix wrong ct-\u003etimeout value {CVE-2023-53635}\n- drop_monitor: replace spin_lock by raw_spin_lock {CVE-2024-40980}\n- net: bonding: fix NULL deref in bond_debug_rlb_hash_show {CVE-2026-31546}\n- serial: protect uart_port_dtr_rts() in uart_shutdown() too {CVE-2024-50058}\n- wifi: mac80211: Fix static_branch_dec() underflow for aql_disable. {CVE-2026-31551}\n- ipv6: Fix signed integer overflow in __ip6_append_data {CVE-2022-49728}\n- selinux: avoid dereference of garbage after mount failure {CVE-2024-35904}\n- fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name {CVE-2024-49934}\n- tracing: Do not let histogram values have some modifiers {CVE-2023-53093}\n- ice: Add netif_device_attach/detach into PF reset flow {CVE-2024-46770}\n- bpf: Fix deadlock between rcu_tasks_trace and event_mutex. {CVE-2025-37884}\n- fbmon: prevent division by zero in fb_videomode_from_videomode() {CVE-2024-35922}\n- drm/amdgpu: Fix the null pointer dereference to ras_manager {CVE-2024-43908}\n- tracing: Ensure visibility when inserting an element into tracing_map {CVE-2024-26645}\n- drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func {CVE-2024-47720}\n- phy: mdio: fix memory leak {CVE-2021-47416}\n- ipv4: Fix reference count leak when using error routes with nexthop objects {CVE-2025-71097}\n- NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies() {CVE-2024-50046}\n- packet: annotate data-races around ignore_outgoing {CVE-2024-26862}\n- md: fix resync softlockup when bitmap size is less than array size {CVE-2024-38598}\n- wireguard: receive: annotate data-race around receiving_counter.counter {CVE-2024-26861}\n- netfs: Only call folio_start_fscache() one time for each folio {CVE-2023-52582}\n- usb: xhci: tegra: fix sleep in atomic call {CVE-2023-53475}\n- ACPI: PAD: fix crash in exit_round_robin() {CVE-2024-49935}\n- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued {CVE-2026-43499}\n- rtmutex: Use waiter::task instead of current in remove_waiter() {CVE-2026-43499}\n- netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() {CVE-2024-50256}\n- Bluetooth: ISO: Fix multiple init when debugfs is disabled {CVE-2024-50077}\n- hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio {CVE-2025-21931}\n- RDMA/core: Silence oversized kvmalloc() warning {CVE-2025-37867}\n- tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() {CVE-2024-26663}\n- net: let net.core.dev_weight always be non-zero {CVE-2025-21806}\n- net: mdio: fix unbalanced fwnode reference count in mdio_device_release() {CVE-2022-48961}\n- eth: alx: take rtnl_lock on resume {CVE-2022-50498}\n- ata: libata-transport: fix error handling in ata_tlink_add() {CVE-2022-49824}\n- ata: libata-transport: fix error handling in ata_tport_add() {CVE-2022-49825}\n- netfilter: br_netfilter: fix panic with metadata_dst skb {CVE-2024-50045}\n- net: fix NULL pointer in skb_segment_list {CVE-2023-52991}\n- hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove {CVE-2024-26698}\n- scsi: qla2xxx: validate nvme_local_port correctly {CVE-2024-42286}\n- rcu/rcuscale: Stop kfree_scale_thread thread(s) after unloading rcuscale {CVE-2023-53291}\n- wifi: mac80211: Discard Beacon frames to non-broadcast address {CVE-2025-71127}\n- wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id() {CVE-2024-46755}\n- sctp: sysctl: cookie_hmac_alg: avoid using current-\u003ensproxy {CVE-2025-21640}\n- drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes {CVE-2024-41089}\n- tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING {CVE-2023-52845}\n- bpf, sockmap: Reject sk_msg egress redirects to non-TCP sockets {CVE-2023-52523}\n- Bluetooth: Fix not cleanup led when bt_init fails {CVE-2022-48971}\n- netfilter: nf_conntrack_h323: Add protection for bmp length out of range {CVE-2024-26851}\n- ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() {CVE-2024-53680}\n- ppp_async: limit MRU to 64K {CVE-2024-26675}\n- USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages {CVE-2024-40904}\n- ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work {CVE-2024-26631}\n- xfrm: fix one more kernel-infoleak in algo dumping {CVE-2024-50110}\n- xdp: fix invalid wait context of page_pool_destroy() {CVE-2024-43834}\n- fs/netfs/fscache_cookie: add missing \"n_accesses\" check {CVE-2024-45000}\n- mac802154: check local interfaces before deleting sdata list {CVE-2024-57948}\n- usbnet: gl620a: fix endpoint checking in genelink_bind() {CVE-2025-21877}\n- IB/core: Fix ib_cache_setup_one error flow cleanup {CVE-2024-47693}\n- can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate {CVE-2021-4454}\n- vfs: fix race between evice_inodes() and find_inode()\u0026iput() {CVE-2024-47679}\n- scsi: storvsc: Fix handling of virtual Fibre Channel timeouts {CVE-2023-53245}\n- iavf: fix off-by-one issues in iavf_config_rss_reg() {CVE-2025-71087}\n- cachefiles: fix memory leak in cachefiles_add_cache() {CVE-2024-26840}\n- ext4: fix access to uninitialised lock in fc replay path {CVE-2024-50014}\n- net: hns3: fix kernel crash when 1588 is sent on HIP08 devices {CVE-2025-21649}\n- ftrace: Fix regression with module command in stack_trace_filter {CVE-2024-56569}\n- ipv6: sr: fix invalid unregister error path {CVE-2024-38612}\n- crypto: pcrypt - Fix handling of MAY_BACKLOG requests {CVE-2026-43493}\n- netfilter: flowtable: strictly check for maximum number of actions {CVE-2026-43329}\n- ipv6: icmp: clear skb2-\u003ecb[] in ip6_err_gen_icmpv6_unreach() {CVE-2026-43038}","status":"published","published":"2026-10-21T12:13:51Z","modified":"2026-10-26T09:43:27.885610959Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CVE-2026-31531","title":"ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()\n\nWhen querying a nexthop object via RTM_GETNEXTHOP, the kernel currently\nallocates a fixed-size skb using NLMSG_GOODSIZE. While sufficient for\nsingle nexthops and small Equal-Cost Multi-Path groups, this fixed\nallocation fails for large nexthop groups like 512 nexthops.\n\nThis results in the following warning splat:\n\n WARNING: net/ipv4/nexthop.c:3395 at rtm_get_nexthop+0x176/0x1c0, CPU#20: rep/4608\n [...]\n RIP: 0010:rtm_get_nexthop (net/ipv4/nexthop.c:3395)\n [...]\n Call Trace:\n  \u003cTASK\u003e\n  rtnetlink_rcv_msg (net/core/rtnetlink.c:6989)\n  netlink_rcv_skb (net/netlink/af_netlink.c:2550)\n  netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)\n  netlink_sendmsg (net/netlink/af_netlink.c:1894)\n  ____sys_sendmsg (net/socket.c:721 net/socket.c:736 net/socket.c:2585)\n  ___sys_sendmsg (net/socket.c:2641)\n  __sys_sendmsg (net/socket.c:2671)\n  do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)\n  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n  \u003c/TASK\u003e\n\nFix this by allocating the size dynamically using nh_nlmsg_size() and\nusing nlmsg_new(), this is consistent with nexthop_notify() behavior. In\naddition, adjust nh_nlmsg_size_grp() so it calculates the size needed\nbased on flags passed. While at it, also add the size of NHA_FDB for\nnexthop group size calculation as it was missing too.\n\nThis cannot be reproduced via iproute2 as the group size is currently\nlimited and the command fails as follows:\n\naddattr_l ERROR: message exceeded bound of 1048","status":"published","published":"2026-04-23T11:12:44.143Z","modified":"2026-11-07T02:30:19.95884852Z","updated_at":"2026-11-07T03:07:40.684996Z"},{"id":"openSUSE-SU-2026:21910-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).\n- CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).\n- CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).\n- CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).\n- CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).\n- CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).\n- CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).\n- CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).\n- CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).\n- CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).\n- CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).\n- CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).\n- CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).\n- CVE-2026-43239: smb: client: prevent races in -\u003equery_interfaces() (bsc#1264444).\n- CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).\n- CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).\n- CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).\n- CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).\n- CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).\n- CVE-2026-43416: powerpc, perf: Check that current-\u003emm is alive before getting user callchain (bsc#1265121).\n- CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).\n- CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).\n- CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).\n- CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).\n- CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).\n- CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).\n- CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).\n- CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).\n- CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).\n- CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).\n- CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).\n- CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).\n- CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).\n- CVE-2026-52912: netfilter: nf_queue: hold bridge skb-\u003edev while queued (bsc#1269000).\n- CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).\n- CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).\n- CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).\n- CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).\n- CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).\n- CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).\n- CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).\n- CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).\n- CVE-2026-52991: sched/psi: fix race between file release and pressure write (bsc#1269134).\n- CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).\n- CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).\n- CVE-2026-53031: bpf: Validate node_id in arena_alloc_pages() (bsc#1269380).\n- CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).\n- CVE-2026-53034: bpf, sockmap: Fix af_unix null-ptr-deref in proto update (bsc#1269140).\n- CVE-2026-53048: gfs2: prevent NULL pointer dereference during unmount (bsc#1269162).\n- CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).\n- CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).\n- CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).\n- CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).\n- CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).\n- CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).\n- CVE-2026-53092: bpf: Fix linked reg delta tracking when src_reg == dst_reg (bsc#1269528).\n- CVE-2026-53094: bpf: Fix stale offload-\u003eprog pointer after constant blinding (bsc#1269965).\n- CVE-2026-53096: bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path (bsc#1269969).\n- CVE-2026-53109: powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy (bsc#1269417).\n- CVE-2026-53110: s390: always declare expoline thunks (bsc#1269985).\n- CVE-2026-53111: bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap (bsc#1269167).\n- CVE-2026-53114: perf: Extend the bit width of the arch-specific flag (bsc#1269999).\n- CVE-2026-53126: blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() (bsc#1269635).\n- CVE-2026-53129: fs/mbcache: cancel shrink work before destroying the cache (bsc#1269633).\n- CVE-2026-53142: drm/xe/display: fix oops in suspend/shutdown without display (bsc#1269402).\n- CVE-2026-53154: mm/hugetlb: restore reservation on error in hugetlb folio copy paths (bsc#1269665).\n- CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (bsc#1269306).\n- CVE-2026-53180: timers/migration: Fix livelock in tmigr_handle_remote_up() (bsc#1269888).\n- CVE-2026-53207: mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison (bsc#1269590).\n- CVE-2026-53219: netfilter: x_tables: avoid leaking percpu counter pointers (bsc#1269686).\n- CVE-2026-53220: netfilter: revalidate bridge ports (bsc#1269381).\n- CVE-2026-53223: net: guard timestamp cmsgs to real error queue skbs (bsc#1269301).\n- CVE-2026-53228: ipv6: sit: reload inner IPv6 header after GSO offloads (bsc#1269256).\n- CVE-2026-53238: netlabel: validate unlabeled address and mask attribute lengths (bsc#1269774).\n- CVE-2026-53264: net/sched: act_api: use RCU with deferred freeing for action lifecycle (bsc#1269238).\n- CVE-2026-53269: netfilter: synproxy: add mutex to guard hook reference counting (bsc#1269579).\n- CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).\n- CVE-2026-53291: ALSA: hda/conexant: Fix missing error check for jack detection (bsc#1269697).\n- CVE-2026-53309: ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison (bsc#1269815).\n- CVE-2026-53330: drm/amd/display: Fix out-of-bounds read in (bsc#1270090).\n- CVE-2026-53336: nvmem: layouts: onie-tlv: fix hang on unknown types (bsc#1270108).\n- CVE-2026-53337: net: bonding: fix NULL pointer dereference in bond_do_ioctl() (bsc#1270251).\n- CVE-2026-53341: fhandle: fix UAF due to unlocked -\u003emnt_ns read in may_decode_fh() (bsc#1270139).\n- CVE-2026-53353: hsr: Remove WARN_ONCE() in hsr_addr_is_self() (bsc#1270111).\n- CVE-2026-53365: vsock/virtio: fix zerocopy completion for multi-skb sends (bsc#1271365).\n- CVE-2026-63801: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (bsc#1272230).\n- CVE-2026-63803: hdlc_ppp: sync per-proto timers before freeing hdlc state (bsc#1272284).\n- CVE-2026-63804: gfs2: fix use-after-free in gfs2_qd_dealloc (bsc#1272287).\n- CVE-2026-63808: exfat: fix potential use-after-free in exfat_find_dir_entry() (bsc#1272260).\n- CVE-2026-63810: block: Avoid mounting the bdev pseudo-filesystem in userspace (bsc#1272297).\n- CVE-2026-63823: keys: Pin request_key_auth payload in instantiate paths (bsc#1272182).\n- CVE-2026-63828: apparmor: mediate the implicit connect of TCP fast open sendmsg (bsc#1272175).\n- CVE-2026-63860: RDMA/core: Prefer NLA_NUL_STRING (bsc#1272429).\n- CVE-2026-63865: bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks (bsc#1272486).\n- CVE-2026-63868: net: garp: fix unsigned integer underflow in garp_pdu_parse_attr (bsc#1272497).\n- CVE-2026-63879: drm/amdgpu: fix amdgpu_hmm_range_get_pages (bsc#1272569).\n- CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272385).\n- CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272390).\n- CVE-2026-63889: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (bsc#1272423).\n- CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).\n- CVE-2026-63891: thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() (bsc#1272641).\n- CVE-2026-63901: USB: serial: digi_acceleport: fix memory corruption with small endpoints (bsc#1272501).\n- CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1272904).\n- CVE-2026-63918: l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (bsc#1272905).\n- CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1272877).\n- CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1272918).\n- CVE-2026-63922,CVE-2026-63924: ipv6: exthdrs: refresh nh after handling HAO option (bsc#1272855).\n- CVE-2026-63925: macsec: fix replay protection at XPN lower-PN wrap (bsc#1273008).\n- CVE-2026-63926: bpf: sockmap: fix tail fragment offset in bpf_msg_push_data (bsc#1273019).\n- CVE-2026-63941: KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor (bsc#1272869).\n- CVE-2026-63969: ipv6: fix possible infinite loop in rt6_fill_node() (bsc#1272484).\n- CVE-2026-63970: vsock/virtio: bind uarg before filling zerocopy skb (bsc#1272673).\n- CVE-2026-63984: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (bsc#1272865).\n- CVE-2026-63985: ethtool: eeprom: add more safeties to EEPROM Netlink fallback (bsc#1272963).\n- CVE-2026-63986: ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on prepare failure (bsc#1272969).\n- CVE-2026-63987: ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES (bsc#1272971).\n- CVE-2026-63990: bonding: refuse to enslave CAN devices (bsc#1273027).\n- CVE-2026-63992: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (bsc#1272868).\n- CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847).\n- CVE-2026-63995: ethtool: cmis: validate start_cmd_payload_size from module (bsc#1273033).\n- CVE-2026-63996: ethtool: cmis: require exact CDB reply length (bsc#1273032).\n- CVE-2026-63997: ethtool: module: avoid leaking a netdev ref on module flash errors (bsc#1273036).\n- CVE-2026-63998: ethtool: module: call ethnl_ops_complete() on module flash errors (bsc#1273037).\n- CVE-2026-63999: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure (bsc#1273038).\n- CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273030).\n- CVE-2026-64002: ipv4: free net-\u003eipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (bsc#1273774).\n- CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782).\n- CVE-2026-64004: net/iucv: fix locking in .getsockopt (bsc#1273804).\n- CVE-2026-64005: net/smc: Do not re-initialize smc hashtables (bsc#1273831).\n- CVE-2026-64006: netfilter: nf_tables: fix dst corruption in same register operation (bsc#1273834).\n- CVE-2026-64007: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (bsc#1273105).\n- CVE-2026-64017: blk-mq: pop cached request if it is usable (bsc#1273770).\n- CVE-2026-64024: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (bsc#1273107).\n- CVE-2026-64033: RDMA/rtrs: Fix use-after-free in path file creation cleanup (bsc#1273134).\n- CVE-2026-64047: net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (bsc#1273060).\n- CVE-2026-64048: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (bsc#1273484).\n- CVE-2026-64052: block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user() (bsc#1272983).\n- CVE-2026-64053: block: don't overwrite bip_vcnt in bio_integrity_copy_user() (bsc#1272985).\n- CVE-2026-64054: net: shaper: reject duplicate leaves in GROUP request (bsc#1272894).\n- CVE-2026-64055: net: ethernet: cortina: Carry over frag counter (bsc#1272893).\n- CVE-2026-64056: net: ethernet: cortina: Make RX SKB per-port (bsc#1272502).\n- CVE-2026-64071: nvme-pci: fix use-after-free in nvme_free_host_mem() (bsc#1273486).\n- CVE-2026-64073: irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT (bsc#1273490).\n- CVE-2026-64088: batman-adv: tt: fix negative tt_buff_len (bsc#1273463).\n- CVE-2026-64089: batman-adv: tt: fix negative last_changeset_len (bsc#1272513).\n- CVE-2026-64093: batman-adv: tp_meter: directly shut down timer on cleanup (bsc#1273461).\n- CVE-2026-64099: drm/v3d: Fix use-after-free of CPU job query arrays on error path (bsc#1273465).\n- CVE-2026-64102: RDMA/siw: Reject MPA FPDU length underflow before signed receive math (bsc#1272516).\n- CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759).\n- CVE-2026-64109: af_unix: Fix UAF read of tail-\u003elen in unix_stream_data_wait() (bsc#1273748).\n- CVE-2026-64111: lsm: hold cred_guard_mutex for lsm_set_self_attr() (bsc#1273740).\n- CVE-2026-64112: rbd: eliminate a race in lock_dwork draining on unmap (bsc#1273741).\n- CVE-2026-64113: ixgbevf: fix use-after-free in VEPA multicast source pruning (bsc#1272262).\n- CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl \u003c 5 (bsc#1273742).\n- CVE-2026-64115: vsock/vmci: fix UAF when peer resets connection during handshake (bsc#1273745).\n- CVE-2026-64118: qed: fix double free in qed_cxt_tables_alloc() (bsc#1273749).\n- CVE-2026-64119: l2tp: use list_del_rcu in l2tp_session_unhash (bsc#1273746).\n- CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273743).\n- CVE-2026-64125: net: bcmgenet: keep RBUF EEE/PM disabled (bsc#1272346).\n- CVE-2026-64131: mm/memory: fix spurious warning when unmapping device-private/exclusive pages (bsc#1274063).\n- CVE-2026-64146: erofs: fix metabuf leak in inode xattr initialization (bsc#1273681).\n- CVE-2026-64147: pds_core: fix debugfs_lookup dentry leak and error handling (bsc#1273119).\n- CVE-2026-64148: pds_core: fix error handling in pdsc_devcmd_wait (bsc#1273956).\n- CVE-2026-64162: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (bsc#1272366).\n- CVE-2026-64164: btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() (bsc#1273957).\n- CVE-2026-64177: phonet/pep: disable BH around forwarded sk_receive_skb() (bsc#1272148).\n- CVE-2026-64179: net: wwan: iosm: fix potential memory leaks in ipc_imem_init() (bsc#1272149).\n- CVE-2026-64180: mm/memory_hotplug: fix memory block reference leak on remove (bsc#1273679).\n- CVE-2026-64184: mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() (bsc#1272199).\n- CVE-2026-64185: sysfs: don't remove existing directory on update failure (bsc#1272200).\n- CVE-2026-64190: net: team: fix NULL pointer dereference in team_xmit during mode change (bsc#1272210).\n- CVE-2026-64192: bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized (bsc#1272213).\n- CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899).\n- CVE-2026-64214: powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise()\n  (bsc#1272799).\n- CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272798).\n- CVE-2026-64222: octeontx2-pf: avoid double free of pool-\u003estack on AQ init failure (bsc#1272788).\n- CVE-2026-64224: octeontx2-pf: fix double free in rvu_rep_rsrc_init() (bsc#1272804).\n- CVE-2026-64225: octeontx2-af: CGX: add bounds check to cgx_speed_mbps index (bsc#1272786).\n- CVE-2026-64232: block: recompute nr_integrity_segments in blk_insert_cloned_request (bsc#1272791).\n- CVE-2026-64239: mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() (bsc#1273898).\n- CVE-2026-64244: drivers/base/memory: set mem-\u003ealtmap after successful device registration (bsc#1273812).\n- CVE-2026-64253: kernel/fork: clear PF_BLOCK_TS in copy_process() (bsc#1273904).\n- CVE-2026-64256: xfs: don't wrap around quota ids in dqiterate (bsc#1273271).\n- CVE-2026-64265: fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (bsc#1273947).\n- CVE-2026-64268: RDMA/siw: bound Read Response placement to the RREAD length (bsc#1273276).\n- CVE-2026-64269: RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg (bsc#1273280).\n- CVE-2026-64283: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values (bsc#1273870).\n- CVE-2026-64286: KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU (bsc#1274058).\n- CVE-2026-64287: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (bsc#1273325).\n- CVE-2026-64294: mm: do file ownership checks with the proper mount idmap (bsc#1273525).\n- CVE-2026-64296: exfat: bound uniname advance in exfat_find_dir_entry() (bsc#1273975).\n- CVE-2026-64298: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (bsc#1273550).\n- CVE-2026-64300: perf/aux: Fix page UAF in map_range() (bsc#1273852).\n- CVE-2026-64307: crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG) (bsc#1273567).\n- CVE-2026-64315: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1274028).\n- CVE-2026-64316: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1273598).\n- CVE-2026-64317: isofs: bound Rock Ridge symlink components to the SL record (bsc#1273936).\n- CVE-2026-64319: nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339).\n- CVE-2026-64320: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420).\n- CVE-2026-64321: nvme: target: rdma: fix ndev refcount leak on queue connect (bsc#1273864).\n- CVE-2026-64322: udf: validate sparing table length as an entry count, not a byte count (bsc#1273958).\n- CVE-2026-64323: udf: validate VAT header length against the VAT inode size (bsc#1273305).\n- CVE-2026-64326: block: skip sync_blockdev() on surprise removal in bdev_mark_dead() (bsc#1273312).\n- CVE-2026-64327: usb: gadget: f_fs: Initialize epfile-\u003ein early to fix endpoint direction checks (bsc#1273283).\n- CVE-2026-64354: bpf: Validate BTF repeated field counts before expansion (bsc#1274060).\n- CVE-2026-64355: bpf: Reject fragmented frames in devmap (bsc#1273422).\n- CVE-2026-64364: HID: multitouch: fix out-of-bounds bit access on mt_io_flags (bsc#1273495).\n- CVE-2026-64368: mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (bsc#1273997).\n- CVE-2026-64373: cpufreq: Fix hotplug-suspend race during reboot (bsc#1273776).\n- CVE-2026-64375: proc: protect ptrace_may_access() with exec_update_lock (FD links) (bsc#1273868).\n- CVE-2026-64378: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (bsc#1273603).\n- CVE-2026-64381: smb: client: Fix next buffer leak in receive_encrypted_standard() (bsc#1273860).\n- CVE-2026-64382: smb: client: fix double-free in SMB2_open() replay (bsc#1273291).\n- CVE-2026-64383: smb: client: fix double-free in SMB2_flush() replay (bsc#1273426).\n- CVE-2026-64384: smb: client: fix change notify replay double-free (bsc#1274541).\n- CVE-2026-64385: smb: client: fix double-free in SMB2_ioctl() replay (bsc#1274539).\n- CVE-2026-64386: smb: client: fix query_info() replay double-free (bsc#1274543).\n- CVE-2026-64387: smb: client: fix query directory replay double-free (bsc#1274545).\n- CVE-2026-64411: netfilter: ebtables: terminate table name before find_table_lock() (bsc#1274077).\n- CVE-2026-64412: netfilter: ebtables: module names must be null-terminated (bsc#1273780).\n- CVE-2026-64415: mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent softlockup (bsc#1273317).\n- CVE-2026-64416: mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless host (bsc#1273286).\n- CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction (bsc#1274274).\n- CVE-2026-64434: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref (bsc#1273880).\n- CVE-2026-64436: net: af_key: initialize alg_key_len for IPComp states (bsc#1274277).\n- CVE-2026-64450: tipc: fix out-of-bounds read in broadcast Gap ACK blocks (bsc#1273523).\n- CVE-2026-64452: 6lowpan: fix NHC entry use-after-free on error path (bsc#1273460).\n- CVE-2026-64458: mm/damon/ops-common: handle extreme intervals in damon_hot_score() (bsc#1273788).\n- CVE-2026-64463: usb: typec: tcpci_rt1711h: unregister TCPCI port with devres (bsc#1273273).\n- CVE-2026-64472: vfio/mlx5: Fix racy bitfields and tighten struct layout (bsc#1274075).\n- CVE-2026-64477: x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled (bsc#1274264).\n- CVE-2026-64507: bpf: Support for hardening against JIT spraying (bsc#1273999).\n- CVE-2026-64518: tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key() (bsc#1273524).\n- CVE-2026-64519: NFSD: Fix infinite loop in layout state revocation (bsc#1274252).\n- CVE-2026-64526: ethtool: tsconfig: fix missing ethnl_ops_complete() (bsc#1274052).\n- CVE-2026-64534: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error (bsc#1273803).\n- CVE-2026-64535: nvmet-tcp: Fix potential UAF when ddgst mismatch (bsc#1273809).\n- CVE-2026-64537: bridge: cfm: reject invalid CCM interval at configuration time (bsc#1273289).\n- CVE-2026-64538: ipv6: Fix null-ptr-deref in fib6_nh_mtu_change() (bsc#1273335).\n- CVE-2026-64541: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (bsc#1273303).\n- CVE-2026-64542: ipv6: ndisc: fix NULL deref in accept_untracked_na() (bsc#1273309).\n- CVE-2026-64543: tipc: fix use-after-free of the discoverer in tipc_disc_rcv() (bsc#1273311).\n- CVE-2026-64545: net, bpf: check master for NULL in xdp_master_redirect() (bsc#1273318).\n- CVE-2026-64548: bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() (bsc#1273337).\n- CVE-2026-64551: sctp: validate STALE_COOKIE cause length before reading staleness (bsc#1273813).\n- CVE-2026-64552: virtio-net: fix len check in receive_big() (bsc#1273323).\n- CVE-2026-64553: net: psample: fix info leak in PSAMPLE_ATTR_DATA (bsc#1273336).\n- CVE-2026-64554: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() (bsc#1273340).\n- CVE-2026-64555: KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops() (bsc#1273331).\n- CVE-2026-64556: perf/core: Detach event groups during remove_on_exec (bsc#1273251).\n- CVE-2026-64563: rhashtable: clear stale iter-\u003ep on table restart (bsc#1273995).\n- CVE-2026-64567: btrfs: reject free space cache with more entries than pages (bsc#1274006).\n- CVE-2026-64569: mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n (bsc#1274009).\n- CVE-2026-64572: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (bsc#1274014).\n- CVE-2026-64576: nexthop: initialize extack in nh_res_bucket_migrate() (bsc#1274030).\n- CVE-2026-64577: gtp: check skb_pull_data() return in gtp1u_send_echo_resp() (bsc#1274031).\n- CVE-2026-64579: xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert (bsc#1274036).\n- CVE-2026-64581: xfrm: fix sk_dst_cache double-free in xfrm_user_policy() (bsc#1274041).\n- CVE-2026-64582: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (bsc#1274040).\n- CVE-2026-64586: wifi: brcmfmac: drain bus_reset work on device removal (bsc#1274492).\n- CVE-2026-68082: libceph: fix two unsafe bare decodes in decode_lockers() (bsc#1274581).\n- CVE-2026-68086: mm/khugepaged: write all dirty file folios when collapsing (bsc#1274713).\n- CVE-2026-68096: audit: fix recursive locking deadlock in audit_dupe_exe() (bsc#1274730).\n- CVE-2026-68105: drm/amdgpu: Fix kernel panic during driver load failure (bsc#1274849).\n- CVE-2026-68116: vxlan: mdb: Fix source list corruption on a failed replace (bsc#1274876).\n- CVE-2026-68117: tipc: clear sock-\u003esk on the failed-insert path in tipc_sk_create() (bsc#1274881).\n- CVE-2026-68120: rtase: Workaround for TX hang caused by hardware packet parsing (bsc#1274887).\n- CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1274888).\n- CVE-2026-68123: openvswitch: fix GSO userspace truncation underflow (bsc#1275169).\n- CVE-2026-68124: mctp: serial: handle zero-length frames to prevent rx buffer overflow (bsc#1275192).\n- CVE-2026-68127: ila: reload IPv6 header after pskb_may_pull in checksum adjust (bsc#1275237).\n- CVE-2026-68128: ice: reject out-of-range ptype in ice_parser_profile_init (bsc#1275238).\n- CVE-2026-68129: gve: fix Rx queue stall on alloc failure (bsc#1275517).\n- CVE-2026-68132: super: fix emergency thaw deadlock on frozen block devices (bsc#1275553).\n- CVE-2026-68133: ice: fix PTP Call Trace during PTP release (bsc#1275555).\n- CVE-2026-68135: net: hip04: fix RX buffer leak on build_skb failure (bsc#1275557).\n- CVE-2026-68136: net: gro: fix double aggregation of flush-marked skbs (bsc#1275474).\n- CVE-2026-68138: net/sched: serialize qdisc_rtab_list against concurrent get/put (bsc#1274941).\n- CVE-2026-68139: net/mlx5e: Use sender devcom for MPV master-up (bsc#1275578).\n- CVE-2026-68141: net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() (bsc#1275094).\n- CVE-2026-68142: geneve: require CAP_NET_ADMIN in the device netns for changelink (bsc#1275582).\n- CVE-2026-68143: net: slip: serialize receive against buffer reallocation (bsc#1275583).\n- CVE-2026-68144: phonet: pep: fix use-after-free in pep_get_sb() (bsc#1275481).\n- CVE-2026-68145: iomap: fix out-of-bounds bitmap_set() with zero-length range (bsc#1275584).\n- CVE-2026-68148: fscrypt: Add missing superblock check in find_or_insert_direct_key() (bsc#1275588).\n- CVE-2026-68149: fs: preserve ACL_DONT_CACHE state in forget_cached_acl() (bsc#1275294).\n- CVE-2026-68152: amt: fix use-after-free in AMT delayed works (bsc#1275300).\n- CVE-2026-68153: libceph: remove debugfs files before client teardown (bsc#1275301).\n- CVE-2026-68154: libceph: reject zero bucket types in crush_decode (bsc#1275303).\n- CVE-2026-68155: libceph: Reject monmaps advertising zero monitors (bsc#1275304).\n- CVE-2026-68156: libceph: refresh auth-\u003eauthorizer_buf{,_len} after authorizer update (bsc#1275305).\n- CVE-2026-68157: libceph: guard missing CRUSH type name lookup (bsc#1275306).\n- CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1275307).\n- CVE-2026-68159: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (bsc#1275470).\n- CVE-2026-68161: sctp: close UDP tunnel sockets during netns teardown (bsc#1274892).\n- CVE-2026-68164: mm/damon/core: disallow overlapping input ranges for damon_set_regions() (bsc#1274955).\n- CVE-2026-68165: mm/damon/core: validate ranges in damon_set_regions() (bsc#1274927).\n- CVE-2026-68166: userfaultfd: prevent registration of special VMAs (bsc#1274930).\n- CVE-2026-68169: mptcp: pm: userspace: fix use-after-free in get_local_id (bsc#1274952).\n- CVE-2026-68183: firmware: stratix10-svc: fix memory leaks and list corruption bugs (bsc#1274957).\n- CVE-2026-68198: wifi: ath6kl: fix use-after-free in aggr_reset_state() (bsc#1274803).\n- CVE-2026-68205: media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() (bsc#1274934).\n- CVE-2026-68238: drm/amdgpu: Release VFCT ACPI table reference (bsc#1275704).\n- CVE-2026-68258: drm/amdkfd: Check bounds on CRIU restore queue type and mqd size (bsc#1275866).\n- CVE-2026-68267: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (bsc#1275139).\n- CVE-2026-68273: drm/amdgpu: Fix context pstate override handling (bsc#1275129).\n- CVE-2026-68284: bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() (bsc#1275970).\n- CVE-2026-68286: drop_monitor: perform u64_stats updates under IRQ-disabled section (bsc#1275973).\n- CVE-2026-68288: net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD (bsc#1275975).\n- CVE-2026-68289: tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() (bsc#1275976).\n- CVE-2026-68293: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (bsc#1275091).\n- CVE-2026-68294: net: qrtr: restrict socket creation to the initial network namespace (bsc#1275092).\n- CVE-2026-68296: net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM (bsc#1275045).\n- CVE-2026-68297: tipc: fix u16 MTU truncation in media and bearer MTU validation (bsc#1275040).\n- CVE-2026-68299: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (bsc#1275088).\n- CVE-2026-68300: sctp: auth: verify auth requirement when auth_chunk is NULL (bsc#1275083).\n- CVE-2026-68302: amt: re-read skb header pointers after every pull (bsc#1275081).\n- CVE-2026-68313: tipc: fix infinite loop in __tipc_nl_compat_dumpit (bsc#1274665).\n- CVE-2026-68315: sctp: validate stream count in sctp_process_strreset_inreq() (bsc#1274662).\n- CVE-2026-68319: pds_core: fix deadlock between reset thread and remove (bsc#1274657).\n- CVE-2026-68320: sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid (bsc#1274659).\n- CVE-2026-68321: net: txgbe: fix FDIR filter leak on remove (bsc#1274652).\n- CVE-2026-68322: rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled (bsc#1274656).\n- CVE-2026-68325: iommu/amd: Bound the early ACPI HID map (bsc#1274651).\n- CVE-2026-68328: nfp: Check resource mutex allocation (bsc#1274646).\n- CVE-2026-68329: iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() (bsc#1274645).\n- CVE-2026-68331: dpaa2-eth: put MAC endpoint device on disconnect (bsc#1274642).\n- CVE-2026-68333: dpaa2-switch: put MAC endpoint device on disconnect (bsc#1274644).\n- CVE-2026-68335: rds: drop incoming messages that cross network namespace boundaries (bsc#1274640).\n- CVE-2026-68336: bonding: fix devconf_all NULL dereference when IPv6 is disabled (bsc#1274639).\n- CVE-2026-68338: net/packet: avoid fanout hook re-registration after unregister (bsc#1274637).\n- CVE-2026-68375: bnxt_en: Handle partially initialized auxiliary devices (bsc#1274835).\n- CVE-2026-68377: net/sched: act_tunnel_key: Defer dst_release to RCU callback (bsc#1274831).\n- CVE-2026-68386: bpf, sockmap: Reject unhashed UDP sockets on sockmap update (bsc#1274814).\n- CVE-2026-68393: Bluetooth: hci_sync: extend conn_hash lookup critical sections (bsc#1274904).\n- CVE-2026-68395: ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered (bsc#1274900).\n- CVE-2026-68397: net/iucv: take a reference on the socket found in afiucv_hs_rcv() (bsc#1274898).\n- CVE-2026-68398: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF (bsc#1274908).\n- CVE-2026-68399: bpf: Fix UAF in sock clone early bailouts (bsc#1274897).\n- CVE-2026-68408: wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (bsc#1274709).\n- CVE-2026-68417: RDMA/siw: publish QP after initialization (bsc#1274696).\n- CVE-2026-68418: RDMA/irdma: Prevent user-triggered null deref on QP create (bsc#1274690).\n- CVE-2026-68419: RDMA/irdma: Prevent rereg_mr for non-mem regions (bsc#1274698).\n- CVE-2026-68422: btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() (bsc#1274706).\n- CVE-2026-68425: IB/mad: Drop unmatched RMPP responses before reassembly (bsc#1274700).\n- CVE-2026-68426: xfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment (bsc#1274705).\n- CVE-2026-68432: vxlan: require CAP_NET_ADMIN in the device netns for changelink (bsc#1274800).\n- CVE-2026-68433: libceph: bound get_version reply decode to front len (bsc#1274801).\n- CVE-2026-68442: btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps (bsc#1274773).\n- CVE-2026-68448: ovl: check access to copy_file_range source with src mounter creds (bsc#1274838).\n- CVE-2026-68450: btrfs: free mapping node on duplicate reloc root insert (bsc#1274834).\n- CVE-2026-68470: wifi: mac80211: validate extension-frame layout before RX (bsc#1276500).\n- CVE-2026-68480: x86/bugs: Make Safe-RET robust against interrupt injection (bsc#1274208).\n- CVE-2026-72017: net: macb: drop in-flight Tx SKBs on close (bsc#1276840).\n- CVE-2026-72019: macsec: don't read an unset MAC header in macsec_encrypt() (bsc#1276865).\n- CVE-2026-72020: ipvs: reset full ip_vs_seq structs in ip_vs_conn_new (bsc#1275506).\n- CVE-2026-72022: llc: fix SAP refcount leak in llc_ui_autobind() (bsc#1276785).\n- CVE-2026-72023: octeontx2-pf: fix SQB pointer leak on init failure (bsc#1276793).\n- CVE-2026-72032: net/mlx5: HWS, fix matcher leak on resize target setup failure (bsc#1276955).\n- CVE-2026-72034: fhandle: reject detached mounts in capable_wrt_mount() (bsc#1276957).\n- CVE-2026-72035: net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1276961).\n- CVE-2026-72036: net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1277034).\n- CVE-2026-72045: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (bsc#1277078).\n- CVE-2026-72046: gve: fix header buffer corruption with header-split and HW-GRO (bsc#1275519).\n- CVE-2026-72051: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276801).\n- CVE-2026-72052: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276803).\n- CVE-2026-72053: net: ipip: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276814).\n- CVE-2026-72054: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276818).\n- CVE-2026-72055: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276821).\n- CVE-2026-72061: net: sit: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277249).\n- CVE-2026-72069: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (bsc#1275528).\n- CVE-2026-72072: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (bsc#1277155).\n- CVE-2026-72083: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (bsc#1275535).\n- CVE-2026-72084: scsi: target: core: Generate correct identifiers for PR OUT transport IDs (bsc#1275540).\n- CVE-2026-72100: dm-integrity: fix a bug if the bio is out of limits (bsc#1277311).\n- CVE-2026-72101: dm-integrity: fix leaking uninitialized kernel memory (bsc#1276831).\n- CVE-2026-72103: dm: avoid leaking the caller's thread keyring via the table device file (bsc#1277315).\n- CVE-2026-72106: dm-ioctl: fix a possible overflow in list_version_get_info (bsc#1277321).\n- CVE-2026-72107: dm era: fix out-of-bounds memory access for non-zero start sector (bsc#1277349).\n- CVE-2026-72108: dm thin metadata: fix metadata snapshot consistency on commit failure (bsc#1277350).\n- CVE-2026-72132: NFS: Charge unstable writes by request size, not folio size (bsc#1277551).\n- CVE-2026-72136: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277574).\n- CVE-2026-72137: xfrm: nat_keepalive: avoid double free on send error (bsc#1275587).\n- CVE-2026-72161: ocfs2: add journal NULL check in ocfs2_checkpoint_inode() (bsc#1277233).\n- CVE-2026-72163: ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits (bsc#1277231).\n- CVE-2026-72164: ocfs2: avoid moving extents to occupied clusters (bsc#1277553).\n- CVE-2026-72176: mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error (bsc#1277230).\n- CVE-2026-72177: mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs() (bsc#1277227).\n- CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1275655).\n- CVE-2026-72221: sunrpc: wait for in-flight TLS handshake callback when cancel loses race (bsc#1275665).\n- CVE-2026-72222: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (bsc#1275669).\n- CVE-2026-72234: batman-adv: access unicast_ttvn skb-\u003edata only after skb realloc (bsc#1275672).\n- CVE-2026-72242: selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (bsc#1277655).\n- CVE-2026-72243: selinux: check connect-related permissions on TCP Fast Open (bsc#1277656).\n- CVE-2026-72251: netfilter: nf_nat_sip: reload possible stale data pointer (bsc#1275827).\n- CVE-2026-72254: netfilter: nft_fib: reject fib expression on the netdev egress hook (bsc#1277204).\n- CVE-2026-72280: KVM: arm64: nv: Drop bogus WARN for write to ZCR_EL2 (bsc#1277726).\n- CVE-2026-72282: KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers (bsc#1277728).\n- CVE-2026-72288: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (bsc#1275886).\n- CVE-2026-72289: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (bsc#1275905).\n- CVE-2026-72296: net: ife: require ETH_HLEN to be pullable in ife_decode() (bsc#1275923).\n- CVE-2026-72297: net: atm: reject out-of-range traffic classes in QoS validation (bsc#1277738).\n- CVE-2026-72306: vduse: Requeue failed read to send_list head (bsc#1277748).\n- CVE-2026-72307: mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() (bsc#1277160).\n- CVE-2026-72308: mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() (bsc#1277159).\n- CVE-2026-72317: SUNRPC: pin upper rpc_clnt across the TLS connect_worker (bsc#1275925).\n- CVE-2026-72323: ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (bsc#1275985).\n- CVE-2026-72325: perf/x86/amd/core: Avoid enabling BRS from the SVM reload path (bsc#1277761).\n- CVE-2026-72330: net/tls: Consume empty data records in tls_sw_read_sock() (bsc#1277764).\n- CVE-2026-72337: Bluetooth: 6lowpan: avoid untracked enable work (bsc#1277773).\n- CVE-2026-72339: qede: fix off-by-one in BD ring consumption on build_skb failure (bsc#1276006).\n- CVE-2026-72341: net/mlx5e: Fix publication race for priv-\u003echannel_stats[] (bsc#1277660).\n- CVE-2026-72342: net/mlx5e: Fix HV VHCA stats agent registration race (bsc#1277775).\n- CVE-2026-72343: net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation (bsc#1277776).\n- CVE-2026-72345: net/mlx5: LAG, Fix off-by-one in single-FDB error rollback (bsc#1277782).\n- CVE-2026-72347: netfilter: xt_connmark: reject invalid shift parameters (bsc#1277783).\n- CVE-2026-72350: netfilter: xt_u32: reject invalid shift counts (bsc#1277822).\n- CVE-2026-72366: netfs: Fix netfs_create_write_req() to handle async cache object creation (bsc#1276333).\n- CVE-2026-72379: fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid (bsc#1277818).\n- CVE-2026-72389: bridge: stp: Fix a potential use-after-free when deleting a bridge (bsc#1273869).\n- CVE-2026-72398: sctp: add INIT verification after cookie unpacking (bsc#1276381).\n- CVE-2026-72399: net: enetc: check the number of BDs needed for xdp_frame (bsc#1276553).\n- CVE-2026-72414: net: dsa: sja1105: round up PTP perout pin duration (bsc#1278039).\n- CVE-2026-72421: ipv4: fib: Don't ignore error route in local/main tables (bsc#1277023).\n- CVE-2026-72425: ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (bsc#1277120).\n- CVE-2026-72430: net/sched: act_ct: fix nf_connlabels leak on two error paths (bsc#1277118).\n- CVE-2026-72437: md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry (bsc#1277874).\n- CVE-2026-72438: md/raid10: fix writes_pending and barrier reference leaks on discard failures (bsc#1277115).\n- CVE-2026-72439: md/raid10: fix writes_pending leak on write request failures (bsc#1277876).\n- CVE-2026-72440: md/raid1: fix writes_pending and barrier reference leaks on write failures (bsc#1277114).\n- CVE-2026-72448: octeontx2-pf: Fix leak of SQ timestamp buffer on teardown (bsc#1277108).\n- CVE-2026-72450: xfrm: validate selector family and prefixlen during match (bsc#1278113).\n- CVE-2026-72459: apparmor: aa_label_alloc use aa_label_free on alloc failure (bsc#1277092).\n- CVE-2026-72460: apparmor: check label build before no_new_privs test (bsc#1277229).\n- CVE-2026-72464: xprtrdma: Post receive buffers after RPC completion (bsc#1277069).\n- CVE-2026-72466: xprtrdma: Fix bcall rep leak and unbounded peek (bsc#1277057).\n- CVE-2026-72467: xprtrdma: Check frwr_wp_create() during connect (bsc#1277059).\n- CVE-2026-72468: xprtrdma: Initialize re_id before removal registration (bsc#1277062).\n- CVE-2026-72469: xprtrdma: Fix ep kref imbalance on ADDR_CHANGE (bsc#1277047).\n- CVE-2026-72473: xprtrdma: Avoid 250 ms delay on backlog wakeup (bsc#1277037).\n- CVE-2026-72485: coresight: platform: defer connection counter increment until alloc succeeds (bsc#1276771).\n- CVE-2026-72487: PCI: Introduce named defines for PCI ROM (bsc#1276767).\n- CVE-2026-72488: soundwire: fix bug in sdw_add_element_group_count found by syzkaller (bsc#1276766).\n- CVE-2026-72494: RDMA/irdma: Replace waitqueue and flag with completion (bsc#1276941).\n- CVE-2026-72495: RDMA/bnxt_re: Avoid repeated requests to allocate WC pages (bsc#1276937).\n- CVE-2026-72497: RDMA/bnxt_re: Add a max slot check for SQ (bsc#1276913).\n- CVE-2026-72499: RDMA/bnxt_re: Free CQ toggle page after firmware teardown (bsc#1276551).\n- CVE-2026-72500: RDMA/bnxt_re: Free SRQ toggle page after firmware teardown (bsc#1276552).\n- CVE-2026-72501: RDMA/bnxt_re: Initialize dpi variable to zero (bsc#1276546).\n- CVE-2026-72502: tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) (bsc#1276542).\n- CVE-2026-74255: tipc: fix UAF in tipc_l2_send_msg() (bsc#1276547).\n- CVE-2026-74261: ALSA: seq: avoid stale FIFO cells during resize (bsc#1276528).\n- CVE-2026-74269: bnxt: fix head underflow on XDP head-grow (bsc#1276507).\n- CVE-2026-74270: handshake: Require admin permission for DONE command (bsc#1276512).\n- CVE-2026-74282: tipc: prevent snt_unacked underflow on CONN_ACK (bsc#1276473).\n- CVE-2026-74284: net/sched: sch_hfsc: Don't make class passive twice (bsc#1276468).\n- CVE-2026-74286: net: pfcp: allocate per-cpu tstats for PFCP netdevs (bsc#1276471).\n- CVE-2026-74296: RDMA/mlx5: Release the HW-provided UAR index rather than the SW one (bsc#1276452).\n- CVE-2026-74297: RDMA/mlx5: Fix undefined shift of user RQ WQE size (bsc#1276446).\n- CVE-2026-74307: ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT (bsc#1276905).\n- CVE-2026-74308: ext4: fix kernel BUG in ext4_write_inline_data_end (bsc#1276880).\n- CVE-2026-74313: vduse: hold vduse_lock across IDR lookup in open path (bsc#1276876).\n- CVE-2026-74316: NFSD: Handle layout stid in nfsd4_drop_revoked_stid() (bsc#1276870).\n- CVE-2026-74317: ixgbe: do not configure xps for XDP queues (bsc#1276866).\n- CVE-2026-74318: btrfs: fix deadlock cloning inline extent when using flushoncommit (bsc#1276864).\n- CVE-2026-74321: btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() (bsc#1277202).\n- CVE-2026-74334: RDMA/nldev: Fix locking when accessing mr-\u003epd (bsc#1277095).\n- CVE-2026-74345: RDMA/siw: Fix endpoint/socket association handling (bsc#1277285).\n- CVE-2026-74346: RDMA/irdma: Fix OOB read during CQ MR registration (bsc#1278155).\n- CVE-2026-74349: ocfs2: reject FITRIM ranges shorter than a cluster (bsc#1278180).\n- CVE-2026-74363: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs (bsc#1278070).\n- CVE-2026-74375: md: replace wait loop with wait_event() in md_handle_request() (bsc#1277649).\n- CVE-2026-74377: RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path (bsc#1278236).\n- CVE-2026-74378: RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe (bsc#1278233).\n- CVE-2026-74382: net/sched: cls_bpf: prevent unbounded recursion in offload rollback (bsc#1278240).\n- CVE-2026-74388: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data (bsc#1278253).\n- CVE-2026-74390: RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs (bsc#1278088).\n- CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277408).\n- CVE-2026-74395: RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference (bsc#1277077).\n- CVE-2026-74397: IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier (bsc#1278098).\n- CVE-2026-74406: vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive() (bsc#1276395).\n- CVE-2026-74464: net: openvswitch: fix skb leak on flow key update failure during ct (bsc#1277070).\n- CVE-2026-74474: vxlan: use pskb_network_may_pull() for transmit path header pulls (bsc#1276335).\n- CVE-2026-74475: vxlan: unclone skb head before modifying eth header in route_shortcircuit() (bsc#1276339).\n- CVE-2026-74476: veth: convert frag_list skbs before running XDP (bsc#1276341).\n- CVE-2026-74479: net: pktgen: fix proc entry use-after-free (bsc#1276354).\n- CVE-2026-74481: mm/page_reporting: use system_freezable_wq to fix UAF during suspend (bsc#1276355).\n- CVE-2026-74482: mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios (bsc#1276346).\n- CVE-2026-74495: igbvf: Fix leak in TX DMA error cleanup (bsc#1275864).\n- CVE-2026-74496: fou: Fix use-after-free in fou_create() (bsc#1275867).\n- CVE-2026-74510: Bluetooth: mgmt: fix UAF in pair command cancellation (bsc#1275950).\n- CVE-2026-74512: audit: fix potential use-after-free in audit_del_rule() (bsc#1275954).\n- CVE-2026-74513: dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister (bsc#1275956).\n- CVE-2026-74517: KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs (bsc#1276258).\n- CVE-2026-74518: mm/hugetlb: fix list corruption in allocate_file_region_entries() (bsc#1275798).\n- CVE-2026-74523: qede: sync udp_tunnel ports outside qede_lock in the recovery path (bsc#1275802).\n- CVE-2026-74527: octeontx2-af: Block VFs from clobbering special CGX PKIND state (bsc#1275805).\n- CVE-2026-74533: Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero (bsc#1275804).\n- CVE-2026-74534: Bluetooth: ISO: Fix data-race on iso_pi(sk) in socket and HCI event paths (bsc#1275801).\n- CVE-2026-74535: Bluetooth: ISO: avoid deadlocks in iso_sock_timeout (bsc#1275812).\n- CVE-2026-74536: Bluetooth: ISO: fix leaking sk after socket release (bsc#1275799).\n- CVE-2026-74537: Bluetooth: ISO: hold sk properly in iso_conn_ready (bsc#1275687).\n- CVE-2026-74545: rtase: fix double free of multi-frag skb on DMA map failure (bsc#1275679).\n- CVE-2026-74548: forcedeth: fix UAF of txrx_stats in nv_remove (bsc#1275695).\n- CVE-2026-74550: net: do not send ICMP/NDISC Redirects when peer allocation fails (bsc#1275688).\n- CVE-2026-74555: scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race (bsc#1275690).\n- CVE-2026-74556: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (bsc#1275696).\n- CVE-2026-74557: scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer (bsc#1275685).\n- CVE-2026-74563: rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() (bsc#1275574).\n- CVE-2026-74566: keys: make keyring key-chunk byte order agree with keyring_diff_objects() (bsc#1275566).\n- CVE-2026-74567: keys: fix out-of-bounds read in keyring_get_key_chunk() (bsc#1275569).\n- CVE-2026-74571: btrfs: skip global block reserve accounting for rescue mounts (bsc#1275561).\n- CVE-2026-74577: net: mpls: initialize rtm_tos in mpls_getroute() (bsc#1275572).\n- CVE-2026-74581: net: ipv6: clear suppressed fib6 rule result (bsc#1275782).\n- CVE-2026-74582: packet: use consistent hard_header_len in non-ring send paths (bsc#1275784).\n- CVE-2026-74584: RDMA/bnxt_re: zero shared page before exposing to userspace (bsc#1277066).\n- CVE-2026-74598: ipv6: fix Route Information option length validation (bsc#1277918).\n- CVE-2026-74610: tls: don't leave a full plaintext sk_msg ring unpushed (bsc#1277054).\n- CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277505).\n- CVE-2026-74615: vxlan: do not arm the ageing timer on a device that is down (bsc#1277901).\n- CVE-2026-74616: xdp: reject clones that overrun skb_shared_info tailroom (bsc#1277813).\n- CVE-2026-74622: net: atlantic: free RX pages of consumed but not refilled buffers (bsc#1277862).\n- CVE-2026-74644: mm/damon/ops-common: putback folios on invalid migrate nid (bsc#1277033).\n- CVE-2026-74665: net: fix skb length accounting after generic XDP frag adjustment (bsc#1277407).\n- CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277391).\n- CVE-2026-74695: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() (bsc#1276931).\n- CVE-2026-74705: udp: fix potential use-after-free in tunnel segmentation (bsc#1276922).\n- CVE-2026-74712: vdpa/mlx5: Fix buffer length in create_direct_keys() (bsc#1276577).\n- CVE-2026-74717: net/mlx5: fw_tracer, return NULL on create error (bsc#1276569).\n- CVE-2026-74719: net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()\n  (bsc#1276572).\n- CVE-2026-74722: btrfs: fix memory leak in btrfs_do_encoded_write() (bsc#1276561).\n- CVE-2026-74723: btrfs: lzo: reject inline extents without valid headers (bsc#1276562).\n- CVE-2026-74730: NFS: Pin the 'struct nfs_server' during a FREE_STATEID call (bsc#1276566).\n- CVE-2026-74737: net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG (bsc#1277898).\n- CVE-2026-74743: macvlan: inherit needed_headroom and needed_tailroom from lowerdev (bsc#1277908).\n- CVE-2026-74744: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (bsc#1278094).\n- CVE-2026-80529: xfs: don't swallow dquot recovery verification errors (bsc#1277688).\n- CVE-2026-80530: xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (bsc#1277668).\n- CVE-2026-80531: xfs: avoid UAF on sc-\u003etempip in xrep_tempfile_create (bsc#1277680).\n- CVE-2026-80533: xfs: don't walk off the end of a null sc-\u003esa.agi_bp in AGI repair (bsc#1277636).\n- CVE-2026-80534: xfs: fix ilock leak on error in xfs_dq_get_next_id (bsc#1277022).\n- CVE-2026-80535: xfs: don't double-lock when deleting a self-referential directory (bsc#1277641).\n- CVE-2026-80557: libceph: fix OOB read in decode_watchers() via missing bounds check (bsc#1277268).\n- CVE-2026-80558: libceph: Avoid using invalid osd indices from primary_temp (bsc#1277485).\n- CVE-2026-80561: libceph: fix multiple unsafe decodes in decode_locker() (bsc#1277265).\n- CVE-2026-80586: mptcp: options: reset DSS fields in case of unexpected size (bsc#1277328).\n- CVE-2026-80589: block: stop the timeout timer when releasing a never added disk (bsc#1277335).\n- CVE-2026-80590: inet: frags: strip GSO state from fragments before reassembly (bsc#1277275).\n- CVE-2026-80603: netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read (bsc#1278293).\n- CVE-2026-80609: qede: fix out-of-bounds check for cqe-\u003elen_list (bsc#1278334).\n- CVE-2026-80629: octeontx2-af: npc: Fix size of entry2cntr_map (bsc#1277308).\n- CVE-2026-80646: ipv6: guard against possible NULL deref in __in6_dev_stats_get() (bsc#1277513).\n- CVE-2026-80647: RDMA/hns: Fix warning in poll cq direct mode (bsc#1278331).\n- CVE-2026-80667: net/mlx5: LAG, MPESW, Fix missing complete() on devcom error (bsc#1278324).\n- CVE-2026-80681: vxlan: re-fetch eth header after route_shortcircuit() (bsc#1278416).\n- CVE-2026-80693: idpf: bound interrupt-vector register fill to the allocated array (bsc#1278395).\n- CVE-2026-80714: ipvs: do not propagate one-packet flag to synced conns (bsc#1277561).\n- CVE-2026-80721: Bluetooth: ISO: ensure no dangling hcon references in iso_conn (bsc#1277845).\n- CVE-2026-80727: x86/mce: Set up the polling timer before CMCI discovery (bsc#1278703).\n- CVE-2026-80731: net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (bsc#1278716).\n- CVE-2026-80737: serial: amba-pl011: synchronize DMA teardown (bsc#1279487).\n- CVE-2026-80739: net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock (bsc#1278733).\n- CVE-2026-80805: xfs: validate attr entry pointer before field access (bsc#1279580).\n- CVE-2026-80813: nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist() (bsc#1279537).\n- CVE-2026-80838: vxlan: keep the last remote linked during FDB flush (bsc#1279842).\n\nThe following non security issues were fixed:\n\n- accel/ivpu: Limit firmware log name prints to field size (git-fixes).\n- accel/ivpu: Validate firmware log buffer metadata (git-fixes).\n- accel/ivpu: Validate full buffer range in ivpu_to_cpu_addr (git-fixes).\n- accel/qaic: Address potential out-of-bounds read in resp_worker() (git-fixes).\n- accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() (git-fixes).\n- accessibility: speakup: unregister tty ldisc on later init failures (git-fixes).\n- ACPI: APEI: Fix ERST timeout unit conversion (git-fixes).\n- ACPI: battery: Adjust charging status validation check (git-fixes).\n- ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer (git-fixes).\n- ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root (git-fixes).\n- ACPI: pfr_update: fix stack buffer overflow in query_capability() (git-fixes).\n- ACPI: processor: idle: Expand _LPI package sanity checks (git-fixes).\n- ACPI: processor: validate MADT IOAPIC entry bounds (git-fixes).\n- ACPI: processor_idle: Mark LPI enter functions as __cpuidle (git-fixes).\n- ACPI: scan: fix bus ID cleanup on device_add() failures (git-fixes).\n- ACPI: video: Release PCI device reference after lookup (git-fixes).\n- ALSA: 6fire: bound the MIDI event length from the device (git-fixes).\n- ALSA: 6fire: Fix UAF at error handling during probe (stable-fixes).\n- ALSA: bcd2000: clear the URB pointers on disconnect (git-fixes).\n- ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev (git-fixes).\n- ALSA: caiaq: Fix potential double-free at error path (git-fixes).\n- ALSA: control: Don't add invalid kcontrols to LED layer (git-fixes).\n- ALSA: core: Fix use-after-free in snd_card_do_free() (git-fixes).\n- ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough (git-fixes).\n- ALSA: dummy: Check card index validity at probe (stable-fixes).\n- ALSA: dummy: Report a change when one capture switch channel moves (git-fixes).\n- ALSA: harmony: initialize locks before requesting IRQ (git-fixes).\n- ALSA: hda/ext: preserve PPLCCTL bits when clearing reset (git-fixes).\n- ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP r (stable-fixes).\n- ALSA: hda: Fix connection list comparison in proc output (git-fixes).\n- ALSA: hda: Report a change when only the channel status bytes move (git-fixes).\n- ALSA: hda: restore MFG widget enumeration after core split (git-fixes).\n- ALSA: hpi: Check transport errors during HPI6000 adapter initialization (git-fixes).\n- ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF (git-fixes).\n- ALSA: pcxhr: initialize mutexes before requesting threaded IRQ (git-fixes).\n- ALSA: rawmidi: Return the error from snd_rawmidi_input_params() (git-fixes).\n- ALSA: scarlett2: Use a private URB for the notification endpoint (git-fixes).\n- ALSA: seq: Don't leak the extension cell pointer in the bounce payload (git-fixes).\n- ALSA: seq: midi: Optimize event_input locking with RCU (git-fixes).\n- ALSA: seq: midi: Serialize input teardown with event_input (git-fixes).\n- ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion (git-fixes).\n- ALSA: usb-audio: Complete cleanup after system-resume errors (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() (git-fixes).\n- ALSA: usb-audio: fix OOB write on Type II inbound URBs (git-fixes).\n- ALSA: usb: Fix UAF at delayed release of MIDI2 EPs (git-fixes).\n- ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf (git-fixes).\n- ALSA: usbusx2y: validate URB actual_length in interrupt callback (git-fixes).\n- ALSA: usx2y: bound the hwdep mmap fault offset (git-fixes).\n- ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() (git-fixes).\n- apparmor: advertise the tcp fast open fix is applied (git-fixes).\n- ASoC: ab8500: Correct digital interface format setup (git-fixes).\n- ASoC: ab8500: Repair the DAPM capture graph (git-fixes).\n- ASoC: ab8500: Reset the audio block before configuring it (git-fixes).\n- ASoC: ab8500: Validate and program TDM slots correctly (git-fixes).\n- ASoC: adau1761: sort the register default table (git-fixes).\n- ASoC: amd: renoir: fix disable_pdm_interrupts() to clear mask bits (git-fixes).\n- ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC (git-fixes).\n- ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close() (git-fixes).\n- ASoC: apple: mca: increase SERDES reset delay (git-fixes).\n- ASoC: bcm: bcm63xx: Publish the OF module aliases (git-fixes).\n- ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses (git-fixes).\n- ASoC: cs35l33: drain threaded IRQ before runtime suspend (git-fixes).\n- ASoC: cs35l34: drain threaded IRQ before runtime suspend (git-fixes).\n- ASoC: cs35l41: sort the register default table (git-fixes).\n- ASoC: cs35l45: sort the register default table (git-fixes).\n- ASoC: cs4265: sort the register default table (git-fixes).\n- ASoC: cx2072x: sort the register default table (git-fixes).\n- ASoC: dapm: Fix off-by-one check on the second enum channel (git-fixes).\n- ASoC: fix unmet dependencies on PPC_BESTCOMM and SND_SOC_AC97_BUS (git-fixes).\n- ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready (git-fixes).\n- ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure (git-fixes).\n- ASoC: fsl_audmix: rework runtime PM handling in probe (git-fixes).\n- ASoC: fsl_easrc: sort the register default table (git-fixes).\n- ASoC: hdac_hda: Fix hlink refcount leak on component registration failure (git-fixes).\n- ASoC: Intel: avs: Clean up streams if their initialization fails (git-fixes).\n- ASoC: Intel: avs: Clean up the bus when fetching ML caps fails (git-fixes).\n- ASoC: Intel: avs: Do not ignore -ENOENT when loading a topology (git-fixes).\n- ASoC: Intel: avs: Fix unbalanced module reference count (git-fixes).\n- AsoC: intel: sst: fix PCI device reference leak on probe failure (git-fixes).\n- ASoC: Intel: SST: Publish the PCI module aliases (git-fixes).\n- ASoC: loongson: Fix error handling in ACPI property parsing (git-fixes).\n- ASoC: max9860: sort the register default table (git-fixes).\n- ASoC: mediatek: mt8183-afe-pcm: Shorten memif_data table using macros (stable-fixes).\n- ASoC: mediatek: mt8183-afe-pcm: Support \u003e32 bit DMA addresses (git-fixes).\n- ASoC: mediatek: mt8183-afe-pcm: use local `dev` pointer in driver callbacks (stable-fixes).\n- ASoC: mediatek: mt8183: Check runtime resume during probe (git-fixes).\n- ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable (stable-fixes).\n- ASoC: mediatek: mt8192: Check runtime resume during probe (git-fixes).\n- ASoC: meson: Keep link pointers valid on realloc failure (git-fixes).\n- ASoC: ml26124: sort the register default table (git-fixes).\n- ASoC: mt6351: Publish the OF module alias (git-fixes).\n- ASoC: pcm512x: sort the register default table (git-fixes).\n- ASoC: pxa: Use devm_clk_get_optional() for extclk clock (git-fixes).\n- ASoC: qcom: q6apm: keep the graph start count in sync with the DSP (git-fixes).\n- ASoC: rt274: sort the register default table (git-fixes).\n- ASoC: rt286: sort the register default table (git-fixes).\n- ASoC: rt298: sort the register default table (git-fixes).\n- ASoC: rt700-sdw: always drain jack work on remove (git-fixes).\n- ASoC: rt700: drop duplicate reg_default entry (git-fixes).\n- ASoC: rt700: sort the register default table (git-fixes).\n- ASoC: rt711-sdca: sort the register default tables (git-fixes).\n- ASoC: rt711: sort the register default table (git-fixes).\n- ASoC: rt712-sdca-dmic: sort the register default table (git-fixes).\n- ASoC: rt712-sdca-sdw: sort the register default table (git-fixes).\n- ASoC: rt715-sdca: drop duplicate reg_default entries (git-fixes).\n- ASoC: rt715-sdca: sort the register default tables (git-fixes).\n- ASoC: rt715: sort the register default table (git-fixes).\n- ASoC: rt1017-sdca-sdw: sort the register default table (git-fixes).\n- ASoC: rt1316-sdw: sort the register default table (git-fixes).\n- ASoC: rt1318-sdw: sort the register default table (git-fixes).\n- ASoC: rt1318: sort the register default table (git-fixes).\n- ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get (git-fixes).\n- ASoC: sgtl5000: sort the register default table (git-fixes).\n- ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() (git-fixes).\n- ASoC: SOF: validate topology volume range before allocation (git-fixes).\n- ASoC: sprd: validate compress buffer sizes against fixed allocations (git-fixes).\n- ASoC: sti-sas: sort the register default table (git-fixes).\n- ASoC: sti: initialize IRQ lock before requesting IRQ (git-fixes).\n- ASoC: tas2552: sort the register default table (git-fixes).\n- ASoC: tas2764: sort the register default table (git-fixes).\n- ASoC: tas2780: sort the register default table (git-fixes).\n- ASoC: tegra210_i2s: sort the register default table (git-fixes).\n- ASoC: tegra210_mixer: sort the register default table (git-fixes).\n- ASoC: tegra: Fix the MIXER enable default value (git-fixes).\n- ASoC: tegra: Sort MBDRC register defaults (git-fixes).\n- ASoC: xilinx: formatter_pcm: fix stream_data leak on open error (git-fixes).\n- ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers (git-fixes).\n- ata: ahci: work around lost interrupts on Marvell 88SE61xx (git-fixes).\n- batman-adv: bla: fix freeing of claims on meshif deletion (git-fixes).\n- batman-adv: bla: prevent CRC corruptions after claim flush (git-fixes).\n- batman-adv: dat: avoid unaligned fault in IP extraction (git-fixes).\n- batman-adv: fix stale receive device on merged fragments (git-fixes).\n- batman-adv: mcast: ensure unshared skb for multicast packets (git-fixes).\n- batman-adv: mcast: linearize skbuff for packet generation (git-fixes).\n- batman-adv: reject unrepresentable multicast TVLV offsets (git-fixes).\n- blk-mq: reinsert cached request to the list (bsc#1273770).\n- Bluetooth: btintel: bound firmware ID by TLV length (git-fixes).\n- Bluetooth: btintel: Fix diagnostics event detection (git-fixes).\n- Bluetooth: btintel: validate version TLV value lengths (git-fixes).\n- Bluetooth: btintel_pcie: Clear automask on spurious interrupts (git-fixes).\n- Bluetooth: btintel_pcie: fix tx_handle bounds off-by-one (git-fixes).\n- Bluetooth: btintel_pcie: validate packet_len before skb_put_data (git-fixes).\n- Bluetooth: btmtk: Declare MT7920 (MT7961 1a) Bluetooth firmware (git-fixes).\n- Bluetooth: btmtk: Do not discard the subsystem reset timeout (git-fixes).\n- Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read() (stable-fixes).\n- Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path (git-fixes).\n- Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX (git-fixes).\n- Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event (git-fixes).\n- Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev (git-fixes).\n- Bluetooth: btrtl: Don't leak return code when parsing firmware format v2 (git-fixes).\n- Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() (git-fixes).\n- Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req() (stable-fixes).\n- Bluetooth: btusb: Fix UAF of btusb_data by rx_work (git-fixes).\n- Bluetooth: do not leak an hci_conn when a second LE connect is rejected (git-fixes).\n- Bluetooth: eir: Fix OOB read in eir_get_service_data() (git-fixes).\n- Bluetooth: hci_aml: validate firmware segment lengths (git-fixes).\n- Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378 (git-fixes).\n- Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_conn: fix the SCO setup context lifetime (git-fixes).\n- Bluetooth: hci_conn: hold conn reference in abort_conn_sync() (git-fixes).\n- Bluetooth: hci_conn: re-enable advertising only for peripheral role (git-fixes).\n- Bluetooth: hci_core: Fix race condition during device registration (git-fixes).\n- Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb (git-fixes).\n- Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection (git-fixes).\n- Bluetooth: hci_event: fix LE list UAF on reset (git-fixes).\n- Bluetooth: hci_event: validate LE Set CIG Parameters response (git-fixes).\n- Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout() (git-fixes).\n- Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request (git-fixes).\n- Bluetooth: hci_sync: Fix accept list UAF during suspend (git-fixes).\n- Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths (git-fixes).\n- Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists (stable-fixes).\n- Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync() (stable-fixes).\n- Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del() (git-fixes).\n- Bluetooth: hci_uart: Fix false success return in hci_uart_setup() (git-fixes).\n- Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync (git-fixes).\n- Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready (git-fixes).\n- Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM (git-fixes).\n- Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan (git-fixes).\n- Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect (git-fixes).\n- Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync (git-fixes).\n- Bluetooth: MGMT: free the HCI command when it is cancelled (git-fixes).\n- Bluetooth: MGMT: free the mesh send cancel command when it is cancelled (git-fixes).\n- Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255 (git-fixes).\n- Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update (git-fixes).\n- Bluetooth: MSFT: validate evt_prefix_len against the response length (git-fixes).\n- Bluetooth: qca: fix NVM tag length underflow in TLV parser (git-fixes).\n- Bluetooth: RFCOMM: serialize security confirmation handling (git-fixes).\n- Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept (git-fixes).\n- Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (git-fixes).\n- Bluetooth: virtio_bt: avoid OOB read of build info string (git-fixes).\n- bnxt_en: Check return value of bnxt_hwrm_vnic_cfg (jsc#PED-16798).\n- bnxt_en: Delay for 5 seconds after AER DPC for all chips (jsc#PED-16798).\n- bnxt_en: Don't assume XDP is never enabled in bnxt_init_dflt_ring_mode() (jsc#PED-16798).\n- bnxt_en: Drop pci_save_state() after pci_restore_state() (jsc#PED-16798).\n- bnxt_en: Implement XDP RSS hash metadata extraction (jsc#PED-16798).\n- bnxt_en: Implement XDP RSS hash metadata extraction for V3_CMP (jsc#PED-16798).\n- bnxt_en: Move bnxt_rss_ext_op into header (jsc#PED-16798).\n- bnxt_en: Refactor some basic ring setup and adjustment logic (jsc#PED-16798).\n- bnxt_en: Restore default stat ctxs for ULP when resource is available (jsc#PED-16798).\n- bnxt_en: Set bp-\u003emax_tpa according to what the FW supports (jsc#PED-16798).\n- bnxt_en: Use absolute target ns from ptp_clock_request (jsc#PED-16798).\n- bnxt_en: use bnxt_xdp_buff for xdp context (jsc#PED-16798).\n- bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation (git-fixes).\n- bus: mhi: host: Fix controller cleanup on EDL sysfs failure (git-fixes).\n- bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET (git-fixes).\n- bus: ti-sysc: Fix /chosen node reference leak (git-fixes).\n- cacheinfo: don't propagate DT/ACPI error when arch supplies info (arm64) (git-fixes).\n- can: j1939: add missing calls in NETDEV_UNREGISTER notification handler (git-fixes).\n- can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking (stable-fixes).\n- char: xilinx_hwicap: unregister class on init errors (git-fixes).\n- cleanup: add a scoped version of CLASS() (stable-fixes).\n- cleanup: fix scoped_class() (git-fixes).\n- compiler_types: Introduce __flex_counter() and family (bsc#1280139).\n- cpufreq: intel_pstate: Add and use hybrid_get_cpu_type() (bsc#1240957 bsc#1249104 bsc#1265220).\n- cpufreq: intel_pstate: Avoid SMP calls to get cpu-type (bsc#1240957 bsc#1249104 bsc#1265220).\n- cpufreq: intel_pstate: Fix hwp_get_cpu_scaling() (bsc#1240957 bsc#1249104 bsc#1265220).\n- cpufreq: intel_pstate: Use correct scaling factor on Raptor Lake-E (bsc#1240957 bsc#1249104 bsc#1265220).\n- cpufreq: intel_pstate: Use CPPC to get scaling factors (bsc#1240957 bsc#1249104 bsc#1265220).\n- cpufreq: intel_pstate: Use HYBRID_SCALING_FACTOR_ADL for Bartlett Lake (bsc#1240957 bsc#1249104 bsc#1265220).\n- crypto: aspeed - Propagate platform_get_irq() errors (git-fixes).\n- crypto: atmel-sha204a - fix heap info leak on I2C transfer failure (git-fixes).\n- crypto: atmel-tdes - use scatterlist length before DMA mapping (git-fixes).\n- crypto: ccm - Set rfc4309 maxauthsize from child (git-fixes).\n- crypto: ccp - Abort doing SEV INIT if SNP INIT fails (stable-fixes).\n- crypto: ccp - Add new SEV/SNP platform shutdown API (stable-fixes).\n- crypto: ccp - Always pass in an error pointer to __sev_platform_shutdown_locked() (git-fixes).\n- crypto: ccp - Fix __sev_snp_shutdown_locked (git-fixes).\n- crypto: ccp - Fix dereferencing uninitialized error pointer (git-fixes).\n- crypto: ccp - Fix memory leak in SEV INIT_EX path (git-fixes).\n- crypto: ccp - Fix possible deadlock in SEV init failure path (git-fixes).\n- crypto: ccp - Fix SNP panic notifier unregistration (git-fixes).\n- crypto: ccp - Move dev_info/err messages for SEV/SNP init and shutdown (stable-fixes).\n- crypto: ccp - Move SEV/SNP Platform initialization to KVM (stable-fixes).\n- crypto: ccp - Register SNP panic notifier only if SNP is enabled (stable-fixes).\n- crypto: ccp - Reset TMR size at SNP Shutdown (stable-fixes).\n- crypto: doc - Remove extra parenthesis (git-fixes).\n- crypto: hisilicon/sec2 - fix CCM algorithm long packet failure (git-fixes).\n- crypto: keembay - Fix AEAD unregister count in error path (git-fixes).\n- crypto: keembay - Initialize completion before requesting IRQ (git-fixes).\n- crypto: keembay - publish OF module alias for OCS AES/SM4 (git-fixes).\n- crypto: lskcipher - propagate errors from unaligned crypt (git-fixes).\n- crypto: mxs-dcp - fix source scatterlist length access (git-fixes).\n- crypto: qat - cancel work on re-enable SR-IOV timeout (git-fixes).\n- crypto: qat - clear AES key schedule from stack (git-fixes).\n- crypto: qce - fix CCM AAD buffer underallocation (git-fixes).\n- crypto: qce - fix error path in devm_qce_register_algs (git-fixes).\n- crypto: qcom-rng - Allow zero as a random number (git-fixes).\n- crypto: qcom-rng - Enable clock in hwrng case (git-fixes).\n- crypto: rk3288 - fail ahash requests on HASH idle timeout (git-fixes).\n- crypto: sa2ul - stop probe if context pool creation fails (git-fixes).\n- crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping (git-fixes).\n- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (stable-fixes).\n- crypto: tegra - fix rctx-\u003ecryptlen calculation in tegra_gcm_do_one_req() (git-fixes).\n- cxl/acpi: Fix CXL_ACPI and CXL_PMEM Kconfig tristate mismatch (git-fixes).\n- cxl: Adjust the startup priority of cxl_pmem to be higher (git-fixes).\n- default_gfp(): avoid using the \"newfangled\" __VA_OPT__ trick (bsc#1280139).\n- device property: fix infinite loop in fwnode_for_each_child_node() (git-fixes).\n- dm/amdgpu: fix malformed link_settings debugfs output (git-fixes).\n- dma-mapping: add __dma_from_device_group_begin()/end() (bsc#1267586).\n- dmaengine: dw-edma: Clear stale requests on termination (git-fixes).\n- dmaengine: dw-edma: Complete descriptors before pausing (git-fixes).\n- dmaengine: dw-edma: Fix HDMA channel status register access (git-fixes).\n- dmaengine: dw-edma: Initialize IRQ data before requesting IRQs (git-fixes).\n- dmaengine: dw-edma: Serialize abort state updates (git-fixes).\n- dmaengine: dw-edma: Serialize channel state checks (git-fixes).\n- dmaengine: dw-edma: Terminate all descriptors without callbacks (git-fixes).\n- dmaengine: fsl-edma: tracing: no ptr dereference during log output (git-fixes).\n- dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe (git-fixes).\n- dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure (git-fixes).\n- dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal (git-fixes).\n- dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers (git-fixes).\n- dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout (git-fixes).\n- dmaengine: zynqmp_dma: fix kernel doc for zynqmp_dma_remove() (git-fixes).\n- driver core: soc: Unregister bus on early device registration failure (git-fixes).\n- drivers/virt: pkvm: Fix end calculation in mmio_guard_ioremap_hook() (git-fixes).\n- Drivers: hv: Use meaningful errnos for hypercall status codes (git-fixes).\n- drm/amd/display: Add AV mute wait frames to dce110_set_avmute (stable-fixes).\n- drm/amd/display: avoid divide-by-zero in __is_lut_linear() (git-fixes).\n- drm/amd/display: Check for tg ops in dce110_set_avmute (git-fixes).\n- drm/amd/display: dce100: skip non-DP stream encoders for DP MST (stable-fixes).\n- drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix (git-fixes).\n- drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE (git-fixes).\n- drm/amd/display: fix division by zero in get_estimated_bw() (git-fixes).\n- drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank() (git-fixes).\n- drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames (stable-fixes).\n- drm/amd/display: Remove unused-but-set variable hubp from (git-fixes).\n- drm/amd/display: validate plane degamma LUT size for private color prop (git-fixes).\n- drm/amd/pm: adjust the visibility of pp_table sysfs node (stable-fixes).\n- drm/amd/pm: fix gpu metrics energy accumulator for smu 13.0.0/13.0.7 (git-fixes).\n- drm/amd/pm: fix smu14 power limit range calculation (stable-fixes).\n- drm/amd/pm: make pp_features read-only when scpm is enabled (stable-fixes).\n- drm/amd/pm: Use same metric table for APU (stable-fixes).\n- drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read (git-fixes).\n- drm/amdgpu/gfx6: Fixup emit_cntxcntl() (git-fixes).\n- drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets (git-fixes).\n- drm/amdgpu/gfx6: Use PFP on the compute queues too (git-fixes).\n- drm/amdgpu/gfx8: drop unecessary BUG_ON() (stable-fixes).\n- drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup (git-fixes).\n- drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup (git-fixes).\n- drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma7.0: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) (stable-fixes).\n- drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older (stable-fixes).\n- drm/amdgpu/vce: fix integer overflow in image size (stable-fixes).\n- drm/amdgpu/vcn4: avoid rereading IB param length (stable-fixes).\n- drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (git-fixes).\n- drm/amdgpu: cap GTT size to physical RAM on APUs (stable-fixes).\n- drm/amdgpu: check ASPM on the dGPU host link (git-fixes).\n- drm/amdgpu: disallow multiple FENCE chunks in one submit (git-fixes).\n- drm/amdgpu: fix aperture iounmap skipped on device removal (git-fixes).\n- drm/amdgpu: fix autosuspend cleanup during removal (git-fixes).\n- drm/amdgpu: fix bo-\u003epin leaking in amdgpu_bo_create_reserved (stable-fixes).\n- drm/amdgpu: fix division by zero with invalid uvd dimensions (stable-fixes).\n- drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (stable-fixes).\n- drm/amdgpu: fix nbif 6.3.1 l1 low power not functional (git-fixes).\n- drm/amdgpu: Fix UVD decode image min size calculation (stable-fixes).\n- drm/amdgpu: Fix UVD dpb min size calculation for H264 (stable-fixes).\n- drm/amdgpu: Fix UVD min buffer sizes (stable-fixes).\n- drm/amdgpu: Fix VCE 3 ring align_mask (git-fixes).\n- drm/amdgpu: Fix VFCT bus number matching with soft filter (stable-fixes).\n- drm/amdgpu: Implement insert_end for VCE 3 (git-fixes).\n- drm/amdgpu: invoke pm_genpd_remove() before freeing genpd (stable-fixes).\n- drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini (git-fixes).\n- drm/amdgpu: read TRUNCATE_COORD_MODE on gfx12 (git-fixes).\n- drm/amdgpu: reject oversized IBs with per-ring packet limits (stable-fixes).\n- drm/amdgpu: Reject UVD message with dimensions above 4096 (stable-fixes).\n- drm/amdgpu: Reject UVD message with invalid number of h265 refs (stable-fixes).\n- drm/amdgpu: remove unused function parameter (stable-fixes).\n- drm/amdgpu: restore UMD profile pstate after runtime resume (stable-fixes).\n- drm/amdgpu: validate GEM_CREATE domain combinations (stable-fixes).\n- drm/amdkfd: Check bounds in allocate_event_notification_slot (stable-fixes).\n- drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (stable-fixes).\n- drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE (stable-fixes).\n- drm/amdkfd: fix QID bit leak in pqm_create_queue() (stable-fixes).\n- drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore (git-fixes).\n- drm/amdkfd: Handle invalid event type in CRIU event restore (stable-fixes).\n- drm/amdkfd: Use kvcalloc to allocate arrays (stable-fixes).\n- drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure (git-fixes).\n- drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure (git-fixes).\n- drm/bridge: ps8640: propagate AUX transfer register errors (git-fixes).\n- drm/bridge: tc358767: clamp the reported AUX read size to the request (git-fixes).\n- drm/connector/hdmi: Fix out of bounds memory read (git-fixes).\n- drm/connector: Fix epoch_counter docs to reflect reality (git-fixes).\n- drm/drm_exec: fix up contended obj when num_objects is 0 (git-fixes).\n- drm/gud: NUL-terminate TV mode names read from the device (git-fixes).\n- drm/gud: validate TV mode names before creating enum property (git-fixes).\n- drm/hibmc: Fix list of formats on the primary plane (git-fixes).\n- drm/hibmc: Use drm_atomic_helper_check_plane_state() (git-fixes).\n- drm/i915/hdcp: check streams bounds before overflow (git-fixes).\n- drm/i915/hdcp: Move to using intel_display in intel_hdcp (stable-fixes).\n- drm/i915/hdcp: require monotonically increasing seq_num_v (git-fixes).\n- drm/i915/hdcp: Skip inactive MST connectors when building stream list (stable-fixes).\n- drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() (stable-fixes).\n- drm/i915/vrr: require valid min/max vfreq for VRR (git-fixes).\n- drm/i915: Fix memory leak in query_perf_config_list() (git-fixes).\n- drm/lima: call drm_mm_init() with a valid allocation range (git-fixes).\n- drm/msm/a6xx: Fix RBBM_CLOCK_CNTL3_TP0 value in a730_hwcg (git-fixes).\n- drm/msm/a6xx: Fix stale rpmh votes after suspend (git-fixes).\n- drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0) (git-fixes).\n- drm/msm/dsi: Drop dev_pm_opp_set_rate(0) (git-fixes).\n- drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value (git-fixes).\n- drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE (git-fixes).\n- drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op (git-fixes).\n- drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE (git-fixes).\n- drm/nouveau: unsubscribe the channel-kill event before the fence context (git-fixes).\n- drm/nouveau: Use write-combined maps for coherent (git-fixes).\n- drm/panel-edp: fix i2c adapter leak on probe failure (git-fixes).\n- drm/panel: samsung-s6d16d0: Power off on prepare failure (git-fixes).\n- drm/panthor: fix firmware control interface bounds checks (git-fixes).\n- drm/panthor: return PTR_ERR() from devm_drm_dev_alloc() (git-fixes).\n- drm/panthor: skip zero-sized firmware sections (git-fixes).\n- drm/radeon: fix autosuspend cleanup during teardown (git-fixes).\n- drm/radeon: fix r100_copy_blit for large BOs (stable-fixes).\n- drm/radeon: restore hardware polling in fence_is_signaled to fix performance regression (git-fixes).\n- drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format (git-fixes).\n- drm/ssd130x: fix column and row end address in partial updates for ssd132x (git-fixes).\n- drm/ssd130x: fix column and row end address in partial updates in ssd133x (git-fixes).\n- drm/sun4i: crtc: Propagate layer initialization error (git-fixes).\n- drm/sun4i: Drop node references while building component list (git-fixes).\n- drm/sun4i: dw-hdmi: Drop TCON TOP port reference (git-fixes).\n- drm/sun4i: fix refcount leak in sun4i_backend_init_sat() (git-fixes).\n- drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz (git-fixes).\n- drm/sun4i: hdmi: Don't leak sync polarity bits into packet control (git-fixes).\n- drm/sun4i: tcon: Drop remote endpoint reference (git-fixes).\n- drm/sun4i: tcon: Drop TCON TOP device reference (git-fixes).\n- drm/sun4i: tcon: Set output mux for DSI and LVDS (git-fixes).\n- drm/sun4i: vi scaler: Fix coefficient selection (git-fixes).\n- drm/tegra: dsi: Re-add clear enable register if DSI was powered by bootloader (git-fixes).\n- drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info (git-fixes).\n- drm/tve200: add OF module alias for autoloading (git-fixes).\n- drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() (git-fixes).\n- drm/xe/oa: Check managed mutex initialization errors (git-fixes).\n- drm/xe/oa: Fix sync entry leak on OA config emit failure (git-fixes).\n- drm/xe/oa: Remove sysfs entry on idr_alloc failure in xe_oa_add_config_ioctl() (git-fixes).\n- drm/xe: Introduce xe_gt_dbg_printer() (stable-fixes).\n- drm/xe: Order ring writes before ring tail updates (git-fixes).\n- drm/xe: Stub out new pagefault layer (stable-fixes).\n- drm/xe: tests: fix error message in xe_migrate_sanity_test() (git-fixes).\n- drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used (git-fixes).\n- drm: fix race between partial drm_dev_register() failure and ioctl (git-fixes).\n- drm: lcdif: Wait for vblank before disabling DMA (git-fixes).\n- drm: Remove unused header in drm_dumb_buffers.c (git-fixes).\n- efi: fix stale reference to efi_recover_from_page_fault() (git-fixes).\n- erspan: Initialize options_len before referencing options (bsc#1274727).\n- ethtool: rss: fix hkey leak when indir_size is 0 (git-fixes).\n- fbdev: bitblit: bound-check glyph index in bit_cursor() (git-fixes).\n- fbdev: core: Fix pointer desynchronization in fb_io_read() (git-fixes).\n- fbdev: kyro: Validate overlay viewport coordinates (git-fixes).\n- fbdev: omapfb: panel-dsi-cm: initialize lock before registering display (git-fixes).\n- fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device() (git-fixes).\n- fbdev: uvesafb: unregister connector callback on init failure (git-fixes).\n- fbdev: vfb: defer cleanup until the last reference (git-fixes).\n- firmware: arm_scmi: Avoid IDR updates while cleaning channels (git-fixes).\n- firmware: arm_scmi: Clean up channels on setup failure (git-fixes).\n- firmware: arm_scmi: Drop handle on protocol bind failures (git-fixes).\n- firmware: arm_scmi: Fix requested device removal race (git-fixes).\n- firmware: arm_scmi: Free transport channel on IDR failure (git-fixes).\n- firmware: arm_scmi: Protect device request lookup with RCU (git-fixes).\n- firmware: arm_scmi: Publish channel state before callbacks (git-fixes).\n- firmware: arm_scmi: Quiesce notifications before teardown (git-fixes).\n- firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context (git-fixes).\n- firmware: arm_scmi: Reject out of range DT protocol IDs (git-fixes).\n- firmware: arm_scmi: Roll back partial protocol table registration (git-fixes).\n- firmware: arm_scmi: Unregister device notifier before IDR teardown (git-fixes).\n- firmware: arm_scmi: Unrequest devices if driver registration fails (git-fixes).\n- firmware: arm_scmi: Unwind P2A receiver mailbox setup failure (git-fixes).\n- firmware: arm_scmi: Unwind TX receiver mailbox setup failure (git-fixes).\n- firmware: arm_scmi: Use channel ID for transport teardown (git-fixes).\n- firmware_loader: do not queue completed sysfs fallback requests (git-fixes).\n- fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write (git-fixes).\n- fpga: dfl: fme: add error handling (git-fixes).\n- fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration (git-fixes).\n- fuse: fix race between interrupt and resend (git-fixes).\n- gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind (git-fixes).\n- gpu: host1x: Avoid stack over-read in debug output helpers (git-fixes).\n- gpu: host1x: Fix offset calculation in trace_write_gather (git-fixes).\n- gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings (stable-fixes).\n- HID: asus: fix missing hid_is_usb() check (git-fixes).\n- HID: asus: simplify RGB init sequence (stable-fixes).\n- HID: bpf: serialize device reference release in struct_ops destroy path (git-fixes).\n- HID: core: fix number/pointer type confusion on long items (git-fixes).\n- HID: core: fix OOB read of field-\u003eusage in hid_set_field() (git-fixes).\n- HID: ft260: fix stack-use-after-return write in I2C read race (git-fixes).\n- HID: ft260: validate i2c input report length (stable-fixes).\n- HID: hyperv: validate initial device info bounds (git-fixes).\n- HID: i2c-hid: Fix \"(null)\" output when reading report descriptor fails (git-fixes).\n- HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure (git-fixes).\n- HID: lg4ff: validate report length before fixed offsets (git-fixes).\n- HID: logitech-dj: Fix maxfield check in DJ short report validation (git-fixes).\n- HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report (git-fixes).\n- HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write (stable-fixes).\n- HID: logitech-dj: Standardise hid_report_enum variable nomenclature (stable-fixes).\n- HID: magicmouse: do not keep a stale msc-\u003einput if no input is claimed (git-fixes).\n- HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C (git-fixes).\n- HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID (stable-fixes).\n- HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() (git-fixes).\n- HID: magicmouse: re-enable multitouch after reset-resume (git-fixes).\n- HID: mcp2221: validate report size in mcp2221_raw_event() (git-fixes).\n- HID: multitouch: reclassify HTIX5288 to WIN_8_FORCE_MULTI_INPUT_NSMU (git-fixes).\n- HID: nintendo: Fix imu_timestamp_us double increment per report (git-fixes).\n- HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() (git-fixes).\n- HID: nintendo: register input device after capabilities are set (git-fixes).\n- HID: nintendo: stop device IO before hid_hw_stop on probe failure (git-fixes).\n- HID: picolcd: clamp eeprom debugfs read to bytes actually received (git-fixes).\n- HID: pidff: Rework pidff_set_time() to fix warnings (stable-fixes).\n- HID: pidff: Use ARRAY_SIZE macro instead of sizeof (stable-fixes).\n- HID: rmi: fix OOB access with undersized RMI reports (git-fixes).\n- HID: roccat: bound device-supplied profile index (git-fixes).\n- HID: roccat: free buffered reports when destroying device (git-fixes).\n- HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature (git-fixes).\n- HID: sensor: custom: Fix field sysfs group cleanup on failure (git-fixes).\n- HID: sensor: custom: Fix use-after-free in enable_sensor (git-fixes).\n- HID: synchronize input before cleaning up a failed probe (git-fixes).\n- HID: tmff: Use 64-bit arithmetic for force feedback scaling (git-fixes).\n- HID: wacom: validate report length in wacom_intuos_pro2_bt_irq (git-fixes).\n- hwmon: (ads7828) Fix external VREF regulator handling (git-fixes).\n- hwmon: (applesmc) fix key backlight workqueue leak on register failure (git-fixes).\n- hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors (git-fixes).\n- hwmon: (chipcap2) fix channels in humidity alarm notifications (git-fixes).\n- hwmon: (coretemp) Fix core_data leak on CPUs without PTS (git-fixes).\n- hwmon: (corsair-cpro) Create debugfs entries after hwmon registration (git-fixes).\n- hwmon: (corsair-cpro) Remove debugfs entries when probe fails (git-fixes).\n- hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination (git-fixes).\n- hwmon: (gpio-fan) Fix use-after-free in alarm work (git-fixes).\n- hwmon: (gpio-fan) take fan_data-\u003elock in gpio_fan_shutdown() (git-fixes).\n- hwmon: (ina2xx) Add support for has_alerts configuration flag (stable-fixes).\n- hwmon: (ina2xx) Add support for INA234 (stable-fixes).\n- hwmon: (ina2xx) Add support for INA260 (stable-fixes).\n- hwmon: (ina2xx) Fix various overflow issues (git-fixes).\n- hwmon: (ina2xx) Make it easier to add more devices (stable-fixes).\n- hwmon: (ina2xx) Shift INA234 shunt and current registers (stable-fixes).\n- hwmon: (ina226) Add support for SY24655 (stable-fixes).\n- hwmon: (ltc4282) Avoid overflow in maximum power calculation (git-fixes).\n- hwmon: (ltc4282) Clamp negative current limits (git-fixes).\n- hwmon: (ltc4282) Fix parsing adi,current-limit-sense-microvolt (git-fixes).\n- hwmon: (ltc4282) Make sure clk_init_data is fully initialized (git-fixes).\n- hwmon: (max6621) fix negative temperature offset and crit readings (git-fixes).\n- hwmon: (max6621) fix temperature clamp range (git-fixes).\n- hwmon: (nzxt-smart2) Check return value of init_device() in probe (git-fixes).\n- hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS (git-fixes).\n- hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations (git-fixes).\n- hwmon: Switch back to struct platform_driver::remove() (stable-fixes).\n- hwrng: ks-sa - Fix runtime PM cleanup on registration failure (git-fixes).\n- hwrng: omap - Fix probe error path cleanup (git-fixes).\n- hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() (git-fixes).\n- i2c: core: fix debugfs UAF on adapter removal (git-fixes).\n- i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (git-fixes).\n- i2c: imx: separate atomic, dma and non-dma use case (stable-fixes).\n- i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure (git-fixes).\n- i2c: mux: Fix channel node leak on adapter add failure (git-fixes).\n- i2c: ocores: Disable clock on failed resume (git-fixes).\n- i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices (git-fixes).\n- i3c: dw: rename \"pclk\" to \"apb\" to match dt-binding (git-fixes).\n- i3c: master: Fix device_register() error path (git-fixes).\n- i3c: master: Fix info leak and UAF in device unregister path (git-fixes).\n- i3c: master: Fix potential UAF in i3c_device_uevent() (git-fixes).\n- i3c: master: svc: bound IBI payload to the requested max_payload_len (git-fixes).\n- ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink (git-fixes).\n- ieee802154: cc2520: fix FIFOP work use-after-free (git-fixes).\n- ieee802154: hwsim: serialize pib updates to fix double-free (git-fixes).\n- iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE (git-fixes).\n- iio: adc: max34408: add missing 'select REGMAP_I2C' to Kconfig (git-fixes).\n- iio: adc: pac1921: fix wrong channel used in trigger handler read (git-fixes).\n- iio: buffer: Fix potential use-after-free in anonymous buffer release (git-fixes).\n- iio: buffer: Make IIO DMA fence release RCU-safe (git-fixes).\n- iio: buffer: Tie IIO dma fence lock lifetime to the fence (git-fixes).\n- iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable (git-fixes).\n- iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF (git-fixes).\n- iio: chemical: sgp30: Handle IAQ thread creation failure (git-fixes).\n- iio: dac: m62332: Fix regulator reference count imbalance (git-fixes).\n- iio: gyro: mpu3050: fix sign of raw angular velocity readings (git-fixes).\n- iio: light: cm32181: return zero after writing calibscale (git-fixes).\n- iio: light: gp2ap002: Disable regulators on resume failure (git-fixes).\n- iio: light: gp2ap002: re-enable irq if runtime suspend fails (git-fixes).\n- iio: light: isl29028: return zero in write_raw() on success (git-fixes).\n- iio: light: ltrf216a: fix runtime PM reference leak in error path (git-fixes).\n- iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem() (git-fixes).\n- iio: light: opt4001: Fix power down clearing bits of the wrong register (git-fixes).\n- iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask (git-fixes).\n- iio: light: opt4001: Reject integration times with a non-zero seconds part (git-fixes).\n- iio: light: tsl2583: return zero in write_raw() on success (git-fixes).\n- iio: light: tsl2772: fix ALS calibscale readback (git-fixes).\n- iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure (git-fixes).\n- iio: pressure: dps310: fix NULL pointer dereference on ACPI probe (git-fixes).\n- iio: pressure: mpl115: Fix runtime PM cleanup (git-fixes).\n- iio: srf04: fix pm_runtime handling on probe error path (git-fixes).\n- iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() (git-fixes).\n- Input: atkbd - skip deactivate for HONOR ZQC-P (git-fixes).\n- Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard (stable-fixes).\n- Input: cs40l50-vibra - validate custom data from user space (git-fixes).\n- Input: evdev - fix information leak in evdev_pass_values() (stable-fixes).\n- Input: evdev - sanitize event type index when fetching event masks (stable-fixes).\n- Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet (git-fixes).\n- Input: focaltech - use signed coordinates to prevent underflow (git-fixes).\n- Input: hynitron_cstxxx - validate touch count and finger IDs (git-fixes).\n- Input: iforce - validate input packet lengths (stable-fixes).\n- Input: iqs5xx - validate firmware record destination span (git-fixes).\n- Input: mms114 - fix Y-resolution configuration (git-fixes).\n- Input: psxpad-spi - set driver data before use (git-fixes).\n- Input: reject inhibit and uninhibit requests on unregistering devices (git-fixes).\n- Input: sur40 - fix input device registration ordering (stable-fixes).\n- Input: sur40 - fix V4L error path cleanup (stable-fixes).\n- Input: synaptics-rmi4 - block s_input when F54 queue is busy (git-fixes).\n- Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer (git-fixes).\n- Input: synaptics-rmi4 - fix F55 transmitter electrode count typo (git-fixes).\n- Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue (git-fixes).\n- Input: synaptics-rmi4 - zero report size on F54 work error (git-fixes).\n- Input: xpad - add support for ZENAIM LEVERLESS (stable-fixes).\n- interconnect: Fix use after free in icc_get() and of_icc_get_by_index() (git-fixes).\n- io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item (git-fixes).\n- io_uring/net: Avoid msghdr on op_connect/op_bind async data (git-fixes).\n- iommu/arm-smmu-v3: Manage teardown with devm (stable-fixes).\n- ip_tunnel: Use ip_tunnel_info() helper instead of 'info + 1' (bsc#1274727).\n- ipmi: ipmb: validate write message length (git-fixes).\n- ipmi: si: Fix NULL pointer dereference after failed registration (git-fixes).\n- KVM: arm64: Ensure FFA ranges are page aligned (git-fixes).\n- KVM: arm64: Fix bounds checking in do_ffa_mem_reclaim() (git-fixes).\n- KVM: arm64: Fix sign-extension of MMIO loads (git-fixes).\n- KVM: arm64: vgic: Reset in_kernel on private IRQ allocation failure (git-fixes).\n- KVM: arm64: Zero out the stack initialized data in the FFA handler (git-fixes).\n- KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN (git-fixes).\n- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (git-fixes).\n- KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit (git-fixes).\n- KVM: nVMX: Service local TLB flushes on failed nested VM-Enter (git-fixes).\n- KVM: PPC: Book3S HV: Add support for compat CPU capabilities for KVM on PowerNV (bsc#1263864 ltc#217835).\n- KVM: PPC: Book3S HV: Implement compat CPU capability retrieval for KVM on PowerVM (bsc#1263864 ltc#217835).\n- KVM: PPC: Book3S HV: Validate arch_compat against host compatibility mode (bsc#1263864 ltc#217835).\n- KVM: PPC: Document KVM_PPC_GET_COMPAT_CAPS ioctl (bsc#1263864 ltc#217835).\n- KVM: PPC: Introduce KVM_CAP_PPC_COMPAT_CAPS and wire up ioctl (bsc#1263864 ltc#217835).\n- KVM: SEV: Use to_kvm_sev_info() for fetching kvm_sev_info struct (git-fixes).\n- KVM: SVM: Add support to initialize SEV/SNP functionality in KVM (bsc#1279887).\n- KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts (git-fixes).\n- KVM: SVM: Serialize accesses to the owner and mirror list with separate lock (git-fixes).\n- KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (git-fixes).\n- KVM: TDX: Account all non-transient page allocations for per-TD structures (git-fixes).\n- KVM: TDX: Fix x2APIC MSR handling in tdx_has_emulated_msr() (git-fixes).\n- KVM: VMX: Don't register posted interrupt wakeup handler if alloc_kvm_area() fails (git-fixes).\n- KVM: x86/hyperv: Check for NULL vCPU Hyper-V object in kvm_hv_get_tlb_flush_fifo() (git-fixes).\n- KVM: x86/hyperv: Ensure vCPU's Hyper-V object is initialized on cross-vCPU accesses (git-fixes).\n- KVM: x86/hyperv: Get target FIFO in hv_tlb_flush_enqueue(), not caller (git-fixes).\n- KVM: x86/mmu: Recover TDP MMU NX huge pages using MMU read lock (bsc#1271050).\n- KVM: x86/mmu: Rename kvm_tdp_mmu_zap_sp() to better indicate its purpose (bsc#1271050).\n- KVM: x86/mmu: Track possible NX huge pages separately for TDP vs. Shadow MMU (bsc#1271050).\n- KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page (git-fixes).\n- KVM: x86: Don't WARN if IRQ disappears because it was cleared from the PIC (git-fixes).\n- KVM: x86: Don't WARN if IRQ disappears when Xen emulation is enabled (git-fixes).\n- KVM: x86: Fix array_index_nospec() protection in kvm_vcpu_ioctl_x86_set_mce() (git-fixes).\n- KVM: x86: Fix emulated CPUID features being applied to wrong sub-leaf (git-fixes).\n- KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock (git-fixes).\n- leds: pca9532: Fix inverted GPIO output polarity (git-fixes).\n- leds: pca9532: Fix phantom device registration on missing hardware (git-fixes).\n- lib/string: fix memchr_inv() for large ranges (git-fixes).\n- lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() (git-fixes).\n- mac802154: fix data race and NULL deref on local-\u003eassoc_dev (git-fixes).\n- mac802154: fix netdev use-after-free in beacon worker (git-fixes).\n- mac802154: fix use-after-free of sdata via queued RX frames (git-fixes).\n- mailbox: pcc: Fix command timeout due to missed interrupt (git-fixes).\n- mailbox: qcom-cpucp: fix PREEMPT_RT self-deadlock in IRQ handler (git-fixes).\n- mailbox: qcom-cpucp: handle NULL data in send_data callback (git-fixes).\n- mailbox: qcom-ipcc: fix duplicate channel allocation across holes (git-fixes).\n- mailbox: rockchip: disable pclk on probe failure and unbind (git-fixes).\n- maple_tree: fix argument name in header (git-fixes).\n- md/raid1: create serial pool adding rdev to array with serialize_policy=1 (bsc#1272261).\n- media: airspy: Return queued buffers on start_streaming() failure (git-fixes).\n- media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref (git-fixes).\n- media: amphion: Remove obsolete frame_count check in venc_start_session (git-fixes).\n- media: bcm2835-unicam: Fix asc leaked in error/remove path (git-fixes).\n- media: cec-pin: Fix event FIFO ordering (git-fixes).\n- media: cec: disable delayed work before freeing an interrupted transmit (git-fixes).\n- media: cec: extron-da-hd-4k-plus: add sanity check (git-fixes).\n- media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash (git-fixes).\n- media: cec: Serialize exclusive follower delivery (git-fixes).\n- media: cec: stm32: prevent out-of-bounds write on RX overflow (git-fixes).\n- media: cedrus: clean up media device on probe failure (git-fixes).\n- media: cedrus: fix memory leak in cedrus_init_ctrls() (git-fixes).\n- media: chips-media: wave5: Guard bit depth check with initial_info_obtained (git-fixes).\n- media: chips-media: wave5: Move src_buf Removal to finish_encode (git-fixes).\n- media: cobalt: Avoid freeing ALSA private data twice (git-fixes).\n- media: cx231xx: fix devres lifetime (git-fixes).\n- media: cx231xx: reject geometry changes while the VBI queue is busy (git-fixes).\n- media: cx23885: add ioremap return check and cleanup (git-fixes).\n- media: cx23885: cancel NetUP CI work before teardown (git-fixes).\n- media: em28xx: defer audio-only extension registration (git-fixes).\n- media: em28xx: fix use-after-free of dev_next-\u003edevlist on disconnect (git-fixes).\n- media: go7007: defer the ALSA v4l2 put until card release (git-fixes).\n- media: hevc: add bounded tile-count helpers (git-fixes).\n- media: i2c: alvium: fix critical pointer access in alvium_ctrl_init (git-fixes).\n- media: i2c: alvium: Fix: Correct name of register in alvium_set_ctrl_auto_exposure (git-fixes).\n- media: i2c: imx219: Rename VTS to FRM_LENGTH (stable-fixes).\n- media: i2c: imx415: Return test pattern write errors (git-fixes).\n- media: i2c: ov02a10: fix endpoint parsing use-after-free (git-fixes).\n- media: i2c: ov7740: fix use-after-destroy in remove (git-fixes).\n- media: i2c: rdacm21: Fix missing media_entity_cleanup() (git-fixes).\n- media: imx219: Fix maximum frame length in lines (git-fixes).\n- media: intel/ipu6: fix async notifier cleanup leak on parse error (git-fixes).\n- media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for overlapping ranges (git-fixes).\n- media: ipu6: Do not free aux device pdata after init (git-fixes).\n- media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define (git-fixes).\n- media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define (git-fixes).\n- media: mc-entity: Add missing kerneldoc (git-fixes).\n- media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity (git-fixes).\n- media: meson: vdec: Fix memory leak in error path of vdec_open (git-fixes).\n- media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common (git-fixes).\n- media: msi2500: Return queued buffers on start_streaming() failure (git-fixes).\n- media: nuvoton: npcm-video: fix error handling in npcm_video_init() (git-fixes).\n- media: nuvoton: npcm-video: fix memory leaks in probe and remove (git-fixes).\n- media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe (git-fixes).\n- media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure (git-fixes).\n- media: nxp: imx8-isi: Correct color map between V4L2 and ISI (git-fixes).\n- media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path (git-fixes).\n- media: nxp: imx8-isi: Fix potential out-of-bounds issues (git-fixes).\n- media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding (git-fixes).\n- media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing (git-fixes).\n- media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks (git-fixes).\n- media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() (stable-fixes).\n- media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup (git-fixes).\n- media: platform: mtk-mdp3: Fix SCP device refcounting (git-fixes).\n- media: pwc: Drain fill_buf on start_streaming() failure (git-fixes).\n- media: pwc: Return queued buffers on start_streaming() failure (git-fixes).\n- media: qcom: camss: Fix RDI streaming for CSID GEN2 (git-fixes).\n- media: radio-si476x: Unregister v4l2_device on probe failure (git-fixes).\n- media: rc: sunxi-cir: Unregister rc device on probe failure (git-fixes).\n- media: rtl2832: fix use-after-free in rtl2832_remove() (git-fixes).\n- media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure (git-fixes).\n- media: rtl2832_sdr: Return queued buffers on start_streaming() failure (git-fixes).\n- media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak (git-fixes).\n- media: s2255: bound JPEG frame size before copying into the buffer (git-fixes).\n- media: s2255: check firmware size before reading trailing marker (git-fixes).\n- media: saa7134: Fix a possible memory leak in saa7134_video_init1 (git-fixes).\n- media: saa7164: fix cleanup on resource allocation failure (git-fixes).\n- media: stm32: dcmi: unregister notifier on probe failure (git-fixes).\n- media: sun4i-csi: Return queued buffers on start_streaming() failure (git-fixes).\n- media: tda18250: fix possible integer overflow (git-fixes).\n- media: tegra-video: vi: fix invalid u32 return value in format lookup (git-fixes).\n- media: usbtv: keep device alive while ALSA card exists (git-fixes).\n- media: v4l2-async: avoid deleting unlinked ASC entry on link error (git-fixes).\n- media: v4l2-async: Unregister sub-device if asc_list is empty (git-fixes).\n- media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() (git-fixes).\n- media: v4l2-ctrls: Allow unknown HDR10 white point and luminance (git-fixes).\n- media: v4l2-ctrls: validate AV1 tile counts (git-fixes).\n- media: v4l2-ctrls: validate HEVC tile counts (git-fixes).\n- media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link (git-fixes).\n- media: v4l2-h264: Fix memcmp() size in B1 reference list comparison (git-fixes).\n- media: v4l2-subdev: Fail {enable,disable}_streams and s_streaming nicely (git-fixes).\n- media: venus: fix payload size calculation in parse_raw_formats() (git-fixes).\n- media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() (git-fixes).\n- media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity (git-fixes).\n- media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer (git-fixes).\n- media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity (git-fixes).\n- media: vicodec: fix out-of-bounds write in FWHT encoder (git-fixes).\n- media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure (git-fixes).\n- media: vimc: fix pixel format lookup in enum_framesizes (git-fixes).\n- media: vivid: add vivid_update_reduced_fps() (git-fixes).\n- media: vivid: check for vb2_is_busy() when toggling caps (git-fixes).\n- media: vivid: fix cleanup bugs in vivid_init() (git-fixes).\n- media: zoran: Avoid freeing a registered video_device twice (git-fixes).\n- mei: pull kvfree out of spinlock (git-fixes).\n- mfd: iqs62x: Reject zero-length firmware records (git-fixes).\n- mfd: rave-sp: validate received frame payload lengths (git-fixes).\n- mfd: sm501: Fix potential memory leaks during remove (git-fixes).\n- misc: bcm-vk: Use acquire/release for msgq_inited (git-fixes).\n- misc: fastrpc: fix channel ctx ref leak when session alloc fails (git-fixes).\n- misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free (git-fixes).\n- misc: fastrpc: Remove buffer from list prior to unmap operation (git-fixes).\n- misc: fastrpc: take fl-\u003elock when moving mmaps on interrupted invoke (git-fixes).\n- misc: nsm: bound the device-reported response length (git-fixes).\n- misc: rtsx: add missing write register handling (git-fixes).\n- misc: sgi-gru: remove interrupt-context page-table walks (git-fixes).\n- misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() (git-fixes).\n- mkspec-dtb: Move DTS prefix into package list.\n- mkspec-dtb: Move provides-obsoletes to package list.\n- mkspec-dtb: Put per-architecture package lists into a hash.\n- mkspec-dtb: re-indent.\n- mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition (git-fixes).\n- mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit (git-fixes).\n- mmc: sdhci: unmap the bounce buffer before device release (git-fixes).\n- mmc: via-sdmmc: stop card-detect handling on probe failure (git-fixes).\n- mtd: afs: validate v2 image info bounds (git-fixes).\n- mtd: fix double free and WARN_ON in add_mtd_device() error paths (git-fixes).\n- mtd: mtdoops: free page bitmap when the backing MTD is removed (git-fixes).\n- mtd: mtdswap: Avoid freeing registered blktrans device twice (git-fixes).\n- mtd: mtdswap: remove debugfs stats file on teardown (git-fixes).\n- mtd: nand: mtk-ecc: stop on ECC idle timeouts (git-fixes).\n- mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() (git-fixes).\n- mtd: rawnand: validate ONFI extended parameter page sections (git-fixes).\n- mtd: spinand: fix direct mapping creation sizes (stable-fixes).\n- mtd: spinand: repeat reading in regular mode if continuous reading fails (stable-fixes).\n- mtd: spinand: try a regular dirmap if creating a dirmap for continuous reading fails (stable-fixes).\n- mtd: ubi: Release device reference on busy detach (git-fixes).\n- mtd: ubi: skip programming unused bits in ubi headers (stable-fixes).\n- net: Add options as a flexible array to struct ip_tunnel_info (bsc#1274727).\n- net: mana: Add debug knob to skip TX timeout recovery reset (git-fixes).\n- net: mana: Add handler for sriov configure (bsc#1272756).\n- net: mana: Cap MSI-X vectors to the device MSI-X table size (git-fixes).\n- net: mana: Extend RX CQE coalescing up to 8 packets (git-fixes).\n- net: mana: Fall back to scattered pages for GDMA queues (git-fixes).\n- net: mana: force full-page RX buffers via ethtool private flag (bsc#1269792).\n- net: mana: refactor mana_get_strings() and mana_get_sset_count() to use switch (bsc#1269792).\n- net: mana: Route ring-buffer access through offset-based helpers (git-fixes).\n- net: tap: set skb-\u003edev before parsing virtio net header in tap_get_user_xdp() (git-fixes bsc#1274550).\n- net: thunderbolt: Count delivered packets in rx_packets and rx_bytes (git-fixes).\n- net: thunderbolt: Mark the connection down when bringing it up fails (git-fixes).\n- net: thunderbolt: Release the Rx HopID that was handed out on mismatch (git-fixes).\n- net: thunderbolt: Tear down DMA paths before stopping the rings (git-fixes).\n- net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() (git-fixes).\n- net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow (git-fixes).\n- net: usb: ipheth: fix carrier_work UAF on disconnect (git-fixes).\n- net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition (git-fixes).\n- nfc: digital: clamp SENSF_RES length to the destination buffer (git-fixes).\n- nfc: digital: Do not dump a NULL response in command completion (git-fixes).\n- nfc: fdp: bound the device-reported read length and fix an skb leak (git-fixes).\n- nfc: llcp: avoid userspace overflow on invalid optlen (git-fixes).\n- nfc: llcp: bound SNL TLV parsing to the skb and add length checks (git-fixes).\n- nfc: llcp: bound the connect_sn TLV walk to the skb (git-fixes).\n- nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (git-fixes).\n- nfc: llcp: read llcp_sock-\u003elocal under the socket lock in getsockopt (git-fixes).\n- nfc: llcp: reject PDUs shorter than the LLCP header (git-fixes).\n- nfc: microread: validate target discovery payload lengths (git-fixes).\n- nfc: nci: fix double completion race in nci_data_exchange_complete (git-fixes).\n- nfc: nci: fix out-of-bounds write in nci_target_auto_activated() (git-fixes).\n- nfc: nci: fix uninit-value in the RF discover/activated NTF handlers (git-fixes).\n- nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing (git-fixes).\n- nfc: nci: free destination parameters when closing a connection (git-fixes).\n- nfc: pn533: hold a reference to the request skb during send_frame (git-fixes).\n- nfc: pn533: purge fragmented skbs during cleanup (git-fixes).\n- nfc: st21nfca: validate ATR_REQ length against the received frame (git-fixes).\n- nouveau/gem: reserve the bo in the info ioctl around the vma lookup (git-fixes).\n- nvme-tcp: fix usage of page_frag_cache (bsc#1267882).\n- nvmet-rdma: fix queue leak when connect backlog is exceeded (git-fixes).\n- of: fix out-of-bounds read in of_alias_scan() stem parser (git-fixes).\n- PCI/ASPM: Use pcie_capability_clear_and_set_word() for ASPM disable/restore (git-fixes).\n- PCI/proc: Avoid spurious runtime PM wakeup on config space accesses (git-fixes).\n- PCI/proc: Use file_ns_capable() when checking config space read access (git-fixes).\n- PCI/proc: Warn on writes to kernel-exclusive config space regions (git-fixes).\n- PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses (git-fixes).\n- PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] (git-fixes).\n- PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip (git-fixes).\n- PCI: j721e: Fix incorrect max_lanes for J7200 (git-fixes).\n- PCI: meson: Fix GPIO state while requesting PERST# (git-fixes).\n- PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts() (git-fixes).\n- PCI: plda: Fix use-after-free of event IRQs during teardown (git-fixes).\n- perf: Reject exited events as group leaders (git-fixes).\n- pinctrl: bcm2835: Don't remove an unregistered GPIO chip (git-fixes).\n- pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip (git-fixes).\n- pinctrl: rockchip: Reset the pin count when recalculating SoC data (git-fixes).\n- platform/chrome: cros_ec_debugfs: Clean up console log on probe failure (git-fixes).\n- platform/chrome: cros_ec_debugfs: Unregister panic notifier (git-fixes).\n- platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count (git-fixes).\n- platform/chrome: sensorhub: Bound the EC-reported sensor number (git-fixes).\n- platform/chrome: sensorhub: Fix dropped timestamp events and log spam (git-fixes).\n- platform/chrome: sensorhub: Fix memory overread in ring handler (git-fixes).\n- platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL (git-fixes).\n- platform/surface: acpi-notify: Check ACPI companion before use (git-fixes).\n- platform/x86/amd/hsmp: Reject negative power cap writes in hwmon (git-fixes).\n- platform/x86: asus-wmi: fix resource leaks on probe failure (git-fixes).\n- platform/x86: dell-privacy: Fix race condition (git-fixes).\n- platform/x86: dell-wmi-base: Fix resource leak on module load failure (git-fixes).\n- platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer (git-fixes).\n- platform/x86: dell-wmi-sysman: Fix instance ID bounds (git-fixes).\n- platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS (git-fixes).\n- platform/x86: hp-bioscfg: advance elem past consumed array elements (git-fixes).\n- platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() (git-fixes).\n- platform/x86: hp-bioscfg: fix heap OOB read on empty password write (git-fixes).\n- platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password (git-fixes).\n- platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() (git-fixes).\n- platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed (git-fixes).\n- platform/x86: hp-bioscfg: fix password encoding bounds check (git-fixes).\n- platform/x86: hp-bioscfg: warn on element type mismatch instead of failing (git-fixes).\n- platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path (git-fixes).\n- platform/x86: ISST: Add a NULL check for sst_inst (git-fixes).\n- platform/x86: ISST: Just allow 2 bits for SST feature enable (git-fixes).\n- platform/x86: ISST: Return error during profile addition (git-fixes).\n- platform/x86: ISST: Use PP level enable mask (git-fixes).\n- platform/x86: ISST: Validate level in perf mask ioctls (git-fixes).\n- platform/x86: ISST: Validate logical CPU id and clos id (git-fixes).\n- platform/x86: ISST: Validate parameter for core power state (git-fixes).\n- platform/x86: ISST: Validate parameter for frequency and priority (git-fixes).\n- platform/x86: ISST: Validate socket ID in clos_assoc ioctl (git-fixes).\n- PM: hibernate: Fix memory leak in snapshot_write_next() error path (git-fixes).\n- PM: sleep: Fix off-by-one in wakelocks number limit check (git-fixes).\n- power: supply: bd99954: Drop bad register fields (git-fixes).\n- power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address (git-fixes).\n- power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address (git-fixes).\n- power: supply: bq27xxx: bq27520g4: fix REG_TTES address (git-fixes).\n- power: supply: bq256xx: drain usb_work before freeing the charger (git-fixes).\n- power: supply: bq24257: fix use-after-free on remove (git-fixes).\n- power: supply: bq25890: Fix power_supply reference leak (git-fixes).\n- power: supply: charger-manager: register regulators before exposing sysfs (git-fixes).\n- power: supply: cros_usbpd-charger: bound the EC-reported port count (git-fixes).\n- power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS (git-fixes).\n- power: supply: isp1704_charger: cancel work on remove (git-fixes).\n- power: supply: lp8727: fix use-after-free in lp8727_release_irq() (git-fixes).\n- power: supply: lp8788-charger: fix use-after-free on remove (git-fixes).\n- power: supply: max17040: drop incorrect I2C functionality check (git-fixes).\n- power: supply: max17040: propagate register read errors (git-fixes).\n- power: supply: max17040: synchronize work cancellation on suspend (git-fixes).\n- power: supply: qcom_battmgr: terminate the strings from firmware (git-fixes).\n- power: supply: rt9455: quiesce delayed work before teardown (git-fixes).\n- power: supply: sbs-battery: Use a per-device serial number buffer (git-fixes).\n- power: supply: sc2731_charger: cancel work on remove (git-fixes).\n- power: supply: twl4030_charger: cancel workers via devm (git-fixes).\n- power: supply: ucs1002: fix use-after-free on remove (git-fixes).\n- powercap: intel_rapl_tpmi: Handle PMU registration failure during probe (git-fixes).\n- powerpc/dt_cpu_ftrs: Set CPU_FTR_P11_PVR for Power11 and later processors (bsc#1263864 ltc#217835).\n- powerpc/kexec_file: Use inclusive range checks in add_usable_mem() (git-fixes).\n- powerpc/pseries: Ensure vpa,slb_shadow \u0026 dtl are unregistered during crash (bsc#1271256).\n- powerpc/pseries: lparcfg - fix kbuf[] underflow (bsc#1274753 ltc#221289 bsc#1274754 ltc#221288 bsc#1274752\n  ltc#221290).\n- powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak (bsc#1274751 ltc#221105 bsc#1274750 ltc#221106).\n- powerpc/pseries: pci - logic bug (bsc#1274749 ltc#221282 bsc#1274755 ltc#221284 bsc#1274756 ltc#221283).\n- powerpc/rtas_pci: No hotplug on permanently removed device on pSeries (git-fixes).\n- powerpc: Replace __ASSEMBLY__ with __ASSEMBLER__ in non-uapi headers (bsc#1263864 ltc#217835).\n- powerpc: Replace __ASSEMBLY__ with __ASSEMBLER__ in uapi headers (bsc#1263864 ltc#217835).\n- ppdev: prevent overflow when setting port timeout (git-fixes).\n- rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() (git-fixes).\n- rapidio: clear mport-\u003enet when rio_add_net() fails (git-fixes).\n- rapidio: mport_cdev: fix use-after-free in dma_req_free() (git-fixes).\n- RDMA/bnxt_re: Avoid displaying the kernel pointer (git-fixes).\n- RDMA/bnxt_re: Proper rollback if the ioremap fails (git-fixes).\n- RDMA/irdma: Remove redundant legacy_mode checks (git-fixes).\n- RDMA/mana_ib: drain QP references after partial table insertion (git-fixes).\n- RDMA/mana_ib: unify QP lookup table (git-fixes).\n- RDMA/mlx5: Fix integer overflow of user QP buffer size (git-fixes).\n- regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer (git-fixes).\n- regulator: core: use system_freezable_wq for init complete work (git-fixes).\n- regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata (git-fixes).\n- regulator: qcom-refgen: correct the regulator type to CURRENT (git-fixes).\n- regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling (git-fixes).\n- remoteproc: qcom: Fix glink-\u003enode reference leak in qcom_add_glink_subdev (git-fixes).\n- remoteproc: qcom_q6v5_adsp: Fix reference leak for device node (git-fixes).\n- remoteproc: scp: Fix device reference leak on failed lookup (git-fixes).\n- Revert \"drm/amdgpu: fix aperture mapping leak\" (git-fixes).\n- Revert \"media: v4l2-dev: fix error handling in __video_register_device()\" (git-fixes).\n- Revert \"net: thunderbolt: Enable end-to-end flow control also in transmit\" (git-fixes).\n- Revert \"thermal/drivers/hwmon: Cleanup coding style a bit\" (stable-fixes).\n- Revert \"wifi: mt76: Disable napi when removing device\" (git-fixes).\n- rpmsg: core: Fix incorrect return value documentation (git-fixes).\n- rpmsg: glink: smem: order FIFO read after availability check (git-fixes).\n- rtc: gamecube: check return value of devm_rtc_register_device() (git-fixes).\n- rtc: pcf8563: fix clock provider leak on unbind (git-fixes).\n- rtc: pcf85363: Add error checking to regmap calls in probe() (git-fixes).\n- rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers (git-fixes).\n- rtc: rzn1: Fix weekday underflow when alarm crosses month boundary (git-fixes).\n- rtc: zynqmp: Return optional clock lookup errors (git-fixes).\n- s390/pkey: Check length in pkey_pckmo handler implementation (bsc#1270266).\n- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (bsc#1270267).\n- sched/psi: Create the psimon kthread outside of cgroup_mutex (bsc#1269134).\n- scsi: fnic: Abort timed-out NVMe LS requests (bsc#1236344).\n- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (bsc#1236344).\n- scsi: fnic: Add FDLS role handling for NVMe initiators (bsc#1236344).\n- scsi: fnic: Add the NVMe/FC transport path (bsc#1236344).\n- scsi: fnic: Advertise NVMe initiator service parameters (bsc#1236344).\n- scsi: fnic: Bump up version number (bsc#1236344).\n- scsi: fnic: Decode firmware role configuration (bsc#1236344).\n- scsi: fnic: Do not use GFP_ZERO for mempools (bsc#1236344).\n- scsi: fnic: Expose NVMe transport state in debugfs (bsc#1236344).\n- scsi: fnic: Handle NVMe LS frames in FDLS (bsc#1236344).\n- scsi: fnic: Make debug logging protocol independent (bsc#1236344).\n- scsi: fnic: Make fnic_queuecommand() easier to analyze (bsc#1236344).\n- scsi: fnic: Refactor in_remove flag and call to fnic_fcpio_reset() (bsc#1236344).\n- scsi: fnic: Remove a useless struct mempool forward declaration (bsc#1236344).\n- scsi: fnic: Rename fnic_scsi_fcpio_reset() (bsc#1236344).\n- scsi: fnic: Route completions and resets by initiator role (bsc#1236344).\n- scsi: fnic: Self-assignment of intr_time_type has no effect (bsc#1236344).\n- scsi: fnic: Send NVMe LS requests through FDLS (bsc#1236344).\n- scsi: fnic: Switch to use %ptSp (bsc#1236344).\n- scsi: fnic: Track NVMe transport statistics (bsc#1236344).\n- scsi: fnic: Use fnic_num for non-SCSI identifiers (bsc#1236344).\n- scsi: fnic: Use mempool for receive frames (bsc#1236344).\n- scsi: qla2xxx: Add support to report MPI FW state (bsc#1275737).\n- scsi: qla2xxx: Declare qla2xxx_mqueuecommand() static (bsc#1275737).\n- scsi: qla2xxx: Use nr_cpu_ids instead of NR_CPUS for qp_cpu_map allocation (bsc#1275737).\n- scsi: storvsc: Support manual scans for all Hyper-V targets (git-fixes).\n- sctp: avoid auth_enable sysctl UAF during netns teardown (git-fixes).\n- selftests/alsa: Fix the step check for INTEGER controls (git-fixes).\n- serial: 8250_dma: Clear stale RX state on shutdown (git-fixes).\n- serial: amba-pl011: unprepare console clock on unregister (git-fixes).\n- serial: core: clear freed pointers on uart_register_driver() failure (git-fixes).\n- serial: imx: serialize imx_uart_ports lifetime (git-fixes).\n- serial: ma35d1: Fix OF node reference leaks in console init (git-fixes).\n- serial: qcom-geni: do not advance stale DMA completions (git-fixes).\n- serial: qcom-geni: fix TX DMA buffer flush (git-fixes).\n- serial: sc16is7xx: enable THRI before filling TX FIFO (git-fixes).\n- serial: sc16is7xx: rename EFR mutex with generic name (stable-fixes).\n- serial: sc16is7xx: use guards for simple mutex locks (stable-fixes).\n- slab.h: disable completely broken overflow handling in flex allocations (bsc#1280139).\n- slab: Introduce kmalloc_flex() and family (bsc#1280139).\n- slab: Introduce kmalloc_obj() and family (bsc#1280139).\n- slab: recognize @GFP parameter as optional in kernel-doc (bsc#1280139).\n- smb/client: handle overlapping allocated ranges in fallocate (bsc#1274902).\n- smb: client: harden POSIX SID length parsing (bsc#1273557).\n- smb: client: require net admin for CIFS SWN netlink (bsc#1273966).\n- smb: client: resolve SWN tcon from live registrations (bsc#1273872).\n- soc: fsl: qe: check platform_driver_register() in qe_ic_of_init() (git-fixes).\n- soc: qcom: rpmh-rsc: manage PM notifiers with devres (git-fixes).\n- soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() (git-fixes).\n- software node: Fix software_node_get_reference_args() with index -1 (git-fixes).\n- soundwire: qcom: Fix port exhaustion check in stream_alloc_ports (git-fixes).\n- speakup: keyhelp: guard letter_offsets possible out-of-range indexing (git-fixes).\n- spi: bcm63xx-hsspi: disable clocks on resume failure (git-fixes).\n- spi: bcm63xx: disable clock on resume failure (git-fixes).\n- spi: bcmbca-hsspi: disable clocks on resume failure (git-fixes).\n- spi: davinci: switch to managed controller allocation (git-fixes).\n- spi: Fix DMA mapping ownership on partial map failure (git-fixes).\n- spi: img-spfi: don't disable runtime PM on DMA deferred probe (git-fixes).\n- spi: oc-tiny: switch to managed controller allocation (git-fixes).\n- spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX (git-fixes).\n- spi: spi-cadence: Move TX FIFO full busy-wait into FIFO (git-fixes).\n- spi: spi-cadence: supports transmission with bits_per_word of 16 and 32 (stable-fixes).\n- spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers (stable-fixes).\n- spi: sprd-adi: Fix probe succeeding without registering the controller (git-fixes).\n- staging: fbtft: Use sysfs_emit_at() to print to sysfs file (git-fixes).\n- staging: media: tegra-video: fix of_node_put() on VIP parse errors (git-fixes).\n- staging: media: tegra-video: vi: fix probe failure on skipped last port (git-fixes).\n- staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown (git-fixes).\n- staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() (git-fixes).\n- staging: rtl8723bs: fix missing shared-key auth challenge length check (git-fixes).\n- staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() (git-fixes).\n- staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() (git-fixes).\n- staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() (git-fixes).\n- staging: rtl8723bs: fix OOB read in WMM_param_handler() (git-fixes).\n- staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() (git-fixes).\n- staging: rtl8723bs: use kfree_sensitive() for key material (git-fixes).\n- staging: rtl8723bs: validate monitor transmit frame lengths (git-fixes).\n- staging: sm750fb: Add missing Kconfig dependency (git-fixes).\n- staging: sm750fb: gate dualview dataflow using g_dualview (git-fixes).\n- thermal/drivers/imx: Disable clock on runtime resume failure (git-fixes).\n- thermal/drivers/qoriq: Disable clock on resume failure (git-fixes).\n- thermal/drivers/rcar: Fix error checking in probe() (git-fixes).\n- thermal: intel: int3400: clean up ODVP on probe failures (git-fixes).\n- thermal: sysfs: switch to use scnprintf() to suppress truncation warning (git-fixes).\n- thunderbolt: Bound the DROM dual link port number before indexing sw-\u003eports (git-fixes).\n- thunderbolt: Fix bandwidth group reservation indexing (git-fixes).\n- thunderbolt: icm: Preserve USB4 proxy data-valid bit (git-fixes).\n- tlclk: if sscanf() fails, fall back to 0, not random value (git-fixes).\n- tpm: st33zp24: Return zero on status read failure (git-fixes).\n- tpm: st33zp24: Validate locality read result (git-fixes).\n- tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout (git-fixes).\n- tty: clear cdev pointer after cdev_add() failure (git-fixes).\n- tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 (git-fixes).\n- tty: skip cdev_del() when no cdev is registered (git-fixes).\n- uio: Fix stale info pointer in failed registration path (git-fixes).\n- usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() (git-fixes).\n- usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect (git-fixes).\n- usb: atm: usbatm: fix invalid ci_range initialization (git-fixes).\n- USB: c67x00: fix use-after-free in c67x00_add_iso_urb() (git-fixes).\n- usb: cdnsp: fix incorrect endian conversions for APB timeout register (git-fixes).\n- usb: core: Add lock to usb_wakeup_notification() (git-fixes).\n- usb: core: Add lock to usb_wakeup_notification() (stable-fixes).\n- usb: core: Strengthen error handling in hub_hub_status() (git-fixes).\n- usb: core: Strengthen error handling in hub_hub_status() (stable-fixes).\n- usb: core: sysfs: add lock to bos_descriptors_read() (stable-fixes).\n- usb: dwc2: add missing @remotewakeup kernel-doc parameter (git-fixes).\n- usb: dwc2: gadget: Exit partial power down state when changing USB pull-up (git-fixes).\n- usb: dwc3: clear forceRM when issuing EndTransfer (git-fixes).\n- usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition (git-fixes).\n- usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns() (git-fixes).\n- usb: fix UAF when probe runs concurrent to dyn ID removal (git-fixes).\n- usb: gadget: aspeed_udc: check endpoint DMA allocation (git-fixes).\n- usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed (git-fixes).\n- usb: gadget: configfs: fix out-of-bounds read of qw_sign (git-fixes).\n- usb: gadget: f_fs: Fix fence cleanup in ffs_dmabuf_transfer() error paths (git-fixes).\n- usb: gadget: f_fs: Prevent deadlock during ep0 read loop (git-fixes).\n- usb: gadget: f_midi: initialize work in f_midi_alloc() (git-fixes).\n- usb: gadget: f_ncm: Use unsigned int for ndp_index (git-fixes).\n- usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() (git-fixes).\n- usb: gadget: f_uac1_legacy: remove broken string configfs attributes (git-fixes).\n- usb: gadget: fix null pointer dereference in usb_put_function_instance() (git-fixes).\n- USB: gadget: fsl-udc: fix dev_printk() device (git-fixes).\n- usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs (git-fixes).\n- usb: gadget: midi2: remove default configfs groups on teardown (git-fixes).\n- usb: gadget: pch_udc: remove excess kernel-doc member for registered (git-fixes).\n- usb: gadget: r8a66597: avoid double free of ep0_req in probe error path (git-fixes).\n- usb: gadget: snps_udc_plat: clean up PHY on probe deferral (git-fixes).\n- usb: gadget: u_audio: Fix use-after-free on sound card disconnect (git-fixes).\n- usb: gadget: uac: validate rate list length before storing (git-fixes).\n- USB: gadget: Use str_enable_disable-like helpers (stable-fixes).\n- usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() (git-fixes).\n- usb: ljca: bound bank_num in ljca_enumerate_gpio() (git-fixes).\n- usb: mtu3: allow system suspend during active gadget connection (git-fixes).\n- usb: musb: omap2430: clean up probe error handling (stable-fixes).\n- usb: musb: omap2430: Do not put borrowed of_node in probe (git-fixes).\n- usb: musb: omap2430: Fix use-after-free in omap2430_probe() (git-fixes).\n- USB: phy: fsl-usb: fix missing static keywords (git-fixes).\n- usb: renesas_usbhs: Fix power-off ordering on unbind (git-fixes).\n- USB: serial: digi_acceleport: fix port registration order (git-fixes).\n- USB: serial: ftdi_sio: add support for E+H FXA291 (stable-fixes).\n- USB: serial: option: add TDTECH MT5710-CN (stable-fixes).\n- USB: serial: option: fix slab OOB read in interrupt URB callback (git-fixes).\n- USB: serial: spcp8x5: drop broken carrier detect support (git-fixes).\n- USB: storage: add NO_ATA_1X quirk for Longmai USB Key (stable-fixes).\n- usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop (git-fixes).\n- usb: typec: qcom-pmic-typec: drain cc_debounce_dwork if port_start() fails (git-fixes).\n- usb: typec: qcom-pmic: cancel reset_work on stop (git-fixes).\n- usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive() (git-fixes).\n- usb: typec: thunderbolt: Disable work before freeing tbt on remove (git-fixes).\n- usb: typec: ucsi: displayport: Fix OOB altmode array index (git-fixes).\n- usb: typec: ucsi: unregister debugfs entries on teardown (git-fixes).\n- usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion (git-fixes).\n- usb: usbfs: fix use-after-free of usb_device in usbdev_release() (git-fixes).\n- usb: usbtest: disable dynamic ID support (stable-fixes).\n- usb: xhci: Handle USB3 port events when there is one roothub (git-fixes).\n- vfs: Add a sysctl for automated deletion of dentry (bsc#1240890 bsc#1276586).\n- vt: add permission check for KDSKBMETA ioctl (stable-fixes).\n- vt: stabilize tty reference in kbd_keycode with tty_port_tty_get (stable-fixes).\n- w1: ds28e17: reject an oversize length on an I2C block read (git-fixes).\n- w1: ds2482: Fix signedness bug in ds2482_w1_triplet() (git-fixes).\n- watchdog: bd96801_wdt: Fix timeout for enabled WDG (git-fixes).\n- watchdog: fix hrtimer start when pretimeout is zero (git-fixes).\n- watchdog: msc313e: Avoid division by zero (git-fixes).\n- watchdog: msc313e: Enable clock before accessing hardware registers (git-fixes).\n- watchdog: msc313e: Fix clock leak and spurious timer in settimeout() (git-fixes).\n- watchdog: msc313e: Fix NULL pointer dereference in PM callbacks (git-fixes).\n- watchdog: msc313e: Fix spurious reset on suspend (git-fixes).\n- watchdog: msc313e: Fix undefined behavior (git-fixes).\n- watchdog: msc313e: Sync timeout value if WDT was running at boot (git-fixes).\n- watchdog: sunxi_wdt: preserve boot-enabled watchdog (git-fixes).\n- wifi: ath6kl: avoid buffer overreads in WMI event handlers (git-fixes).\n- wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets (git-fixes).\n- wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump (git-fixes).\n- wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() (git-fixes).\n- wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate (git-fixes).\n- wifi: ath11k: Correctly copy the hint BSSID in WMI scan request (git-fixes).\n- wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event() (git-fixes).\n- wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx() (git-fixes).\n- wifi: ath12k: Correctly copy the hint BSSID in WMI scan request (git-fixes).\n- wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() (git-fixes).\n- wifi: brcmfmac: fix P2P action frame handling without device vif (git-fixes).\n- wifi: brcmfmac: initialize SDIO data work before cleanup (git-fixes).\n- wifi: cfg80211: bound element ID read when checking non-inheritance (git-fixes).\n- wifi: cfg80211: cancel sched scan results work on unregister (git-fixes).\n- wifi: cfg80211: derive S1G beacon TSF from S1G fields (git-fixes).\n- wifi: cfg80211: reject unsupported PMSR FTM location requests (git-fixes).\n- wifi: cfg80211: validate PMSR FTM preamble range (git-fixes).\n- wifi: cfg80211: validate PMSR measurement type data (git-fixes).\n- wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() (git-fixes).\n- wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs (git-fixes).\n- wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments (git-fixes).\n- wifi: iwlwifi: mei: check SAP message length before reading it (git-fixes).\n- wifi: iwlwifi: mei: pass correct argument to function (git-fixes).\n- wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser (git-fixes).\n- wifi: libertas: fix memory leak in helper_firmware_cb() (git-fixes).\n- wifi: mac80211: disconnect on CSA to channel 0 (git-fixes).\n- wifi: mac80211: fix fils_discovery double free on alloc failure (git-fixes).\n- wifi: mac80211: fix per-STA profile length in cross-link CSA parsing (git-fixes).\n- wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure (git-fixes).\n- wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock (git-fixes).\n- wifi: mac80211: send TWT teardown to peer after setup TX failure (git-fixes).\n- wifi: mac80211: skip default WMM setup for AP_VLAN links (git-fixes).\n- wifi: mac80211: skip unused probe response countdown offsets (git-fixes).\n- wifi: mt76: check txfree done event on the WED hw path (git-fixes).\n- wifi: mt76: fix 4th chain ACK RSSI bitmask in sta_poll (git-fixes).\n- wifi: mt76: fix ER-SU 106-tone RU check in RX rate decode (git-fixes).\n- wifi: mt76: fix HE DCM max-RU capability encoding (git-fixes).\n- wifi: mt76: fix non-AQL packet accounting for MLO stations (git-fixes).\n- wifi: mt76: fix stranded frames in mt76_txq_schedule_pending (git-fixes).\n- wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length (git-fixes).\n- wifi: mt76: mt792x: Fix memory leak in SDIO TX path (git-fixes).\n- wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete (git-fixes).\n- wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex (git-fixes).\n- wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss (git-fixes).\n- wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear (git-fixes).\n- wifi: mt76: mt7915: fix double hif2 init on the non-WED path (git-fixes).\n- wifi: mt76: mt7915: fix ext PHY use-after-free on register error path (git-fixes).\n- wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986 (git-fixes).\n- wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie (git-fixes).\n- wifi: mt76: mt7915: release hif2 reference on probe IRQ failure (git-fixes).\n- wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement (git-fixes).\n- wifi: mt76: mt7915: unwind state on add_interface failure (git-fixes).\n- wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields (git-fixes).\n- wifi: mt76: mt7915: write RX header translation bit to the correct register (git-fixes).\n- wifi: mt76: mt7921: skip unknown CLC firmware records (git-fixes).\n- wifi: mt76: mt7921: validate CLC firmware records (git-fixes).\n- wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb (git-fixes).\n- wifi: mt76: mt7925: fix msg len mismatch between driver and firmware (git-fixes).\n- wifi: mt76: mt7925: update clc before setting sar power table (git-fixes).\n- wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config (git-fixes).\n- wifi: mt76: mt7996: don't report a zero TX bitrate (git-fixes).\n- wifi: mt76: mt7996: fix capability of EHT-MCS 15 in MRU (git-fixes).\n- wifi: mt76: mt7996: fix reg addr remap when addr is 0 (git-fixes).\n- wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV (git-fixes).\n- wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset (git-fixes).\n- wifi: mt76: mt7996: validate RX band_idx before dereferencing phys (git-fixes).\n- wifi: mt76: only consume the WO drop bit on WED v2 devices (git-fixes).\n- wifi: mt76: report data NSS for STBC frames in RX rate decode (git-fixes).\n- wifi: mwifiex: Detach sync cmd buffer on interrupted wait (git-fixes).\n- wifi: nl80211: free RNR data on MBSSID mismatch (git-fixes).\n- wifi: nl80211: validate nested MBSSID IE blobs (git-fixes).\n- wifi: p54: validate RX frame length in p54_rx_eeprom_readback() (git-fixes).\n- wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop (git-fixes).\n- wifi: rtl818x: initialize eeprom_93cx6 struct to zero (git-fixes).\n- wifi: rtlwifi: pci: fix error path in rtl_pci_probe() (git-fixes).\n- wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids (git-fixes).\n- wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars() (git-fixes).\n- wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() (git-fixes).\n- wifi: rtw88: pci: fix resource leak on failed NAPI setup (git-fixes).\n- wifi: rtw89: fix HE extended capability length check (git-fixes).\n- wifi: zd1211rw: reject secondary interfaces to prevent conflicts (git-fixes).\n- x86/virt/tdx: Print TDX module version during init (git-fixes).\n- x86/virt/tdx: Retrieve TDX module version (git-fixes).\n- xhci: dbgtty: Fix unregister on tty_alloc_driver() failure (git-fixes).\n- xhci: dbgtty: Fix unregister on tty_register_driver() failure (git-fixes).\n- xhci: fix lost bounce buffers on TDs spanning several ring segments (git-fixes).\n","status":"published","published":"2026-09-22T15:26:20Z","modified":"2026-09-25T18:23:13.136758616Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23477-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1235944)\n- CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).\n- CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).\n- CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).\n- CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).\n- CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).\n- CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).\n- CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).\n- CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).\n- CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).\n- CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).\n- CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).\n- CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).\n- CVE-2026-43278: dm: clear cloned request bio pointer when last clone bio completes (bsc#1264584).\n- CVE-2026-43319: spi: spidev: fix lock inversion between spi_lock and buf_lock (bsc#1264788).\n- CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).\n- CVE-2026-43416: powerpc, perf: Check that current-\u003emm is alive before getting user callchain (bsc#1265121).\n- CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).\n- CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).\n- CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).\n- CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).\n- CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).\n- CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).\n- CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).\n- CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).\n- CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).\n- CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).\n- CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).\n- CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).\n- CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).\n- CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).\n- CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).\n- CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).\n- CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).\n- CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).\n- CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).\n- CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).\n- CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).\n- CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).\n- CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).\n- CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).\n- CVE-2026-53094: bpf: Fix stale offload-\u003eprog pointer after constant blinding (bsc#1269965).\n- CVE-2026-53096: bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path (bsc#1269969).\n- CVE-2026-53110: selftests/bpf: Add ASSERT_OK_FD macro (bsc#1269985).\n- CVE-2026-53111: bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap (bsc#1269167).\n- CVE-2026-53126: blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() (bsc#1269635).\n- CVE-2026-53154: mm/hugetlb: restore reservation on error in hugetlb folio copy paths (bsc#1269665).\n- CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (bsc#1269306).\n- CVE-2026-53207: mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison (bsc#1269590).\n- CVE-2026-53219: netfilter: x_tables: avoid leaking percpu counter pointers (bsc#1269686).\n- CVE-2026-53220: netfilter: revalidate bridge ports (bsc#1269381).\n- CVE-2026-53223: net: guard timestamp cmsgs to real error queue skbs (bsc#1269301).\n- CVE-2026-53228: ipv6: sit: reload inner IPv6 header after GSO offloads (bsc#1269256).\n- CVE-2026-53238: netlabel: validate unlabeled address and mask attribute lengths (bsc#1269774).\n- CVE-2026-53260: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req() (bsc#1269731).\n- CVE-2026-53264: net/sched: act_api: use RCU with deferred freeing for action lifecycle (bsc#1269238).\n- CVE-2026-53269: netfilter: synproxy: add mutex to guard hook reference counting (bsc#1269579).\n- CVE-2026-53273: tee: optee: prevent use-after-free when the client exits before the supplicant (bsc#1269713).\n- CVE-2026-53309: ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison (bsc#1269815).\n- CVE-2026-53330: drm/amd/display: Fix out-of-bounds read in (bsc#1270090).\n- CVE-2026-53336: nvmem: layouts: onie-tlv: fix hang on unknown types (bsc#1270108).\n- CVE-2026-53337: net: bonding: fix NULL pointer dereference in bond_do_ioctl() (bsc#1270251).\n- CVE-2026-53353: hsr: Remove WARN_ONCE() in hsr_addr_is_self() (bsc#1270111).\n- CVE-2026-53365: vsock/virtio: fix zerocopy completion for multi-skb sends (bsc#1271365).\n- CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830).\n- CVE-2026-63801: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (bsc#1272230).\n- CVE-2026-63808: exfat: fix potential use-after-free in exfat_find_dir_entry() (bsc#1272260).\n- CVE-2026-63810: block: Avoid mounting the bdev pseudo-filesystem in userspace (bsc#1272297).\n- CVE-2026-63823: keys: Pin request_key_auth payload in instantiate paths (bsc#1272182).\n- CVE-2026-63827: apparmor: fix use-after-free in rawdata dedup loop (bsc#1272179).\n- CVE-2026-63828: apparmor: mediate the implicit connect of TCP fast open sendmsg (bsc#1272175).\n- CVE-2026-63860: RDMA/core: Prefer NLA_NUL_STRING (bsc#1272429).\n- CVE-2026-63865: bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks (bsc#1272486).\n- CVE-2026-63868: net: garp: fix unsigned integer underflow in garp_pdu_parse_attr (bsc#1272497).\n- CVE-2026-63879: drm/amdgpu: fix amdgpu_hmm_range_get_pages (bsc#1272569).\n- CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).\n- CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272385).\n- CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272390).\n- CVE-2026-63889: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (bsc#1272423).\n- CVE-2026-63891: thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() (bsc#1272641).\n- CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1272877).\n- CVE-2026-63925: macsec: fix replay protection at XPN lower-PN wrap (bsc#1273008).\n- CVE-2026-63926: bpf: sockmap: fix tail fragment offset in bpf_msg_push_data (bsc#1273019).\n- CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1272662).\n- CVE-2026-63969: ipv6: fix possible infinite loop in rt6_fill_node() (bsc#1272484).\n- CVE-2026-63970: vsock/virtio: bind uarg before filling zerocopy skb (bsc#1272673).\n- CVE-2026-63980: net/handshake: Use spin_lock_bh for hn_lock (bsc#1273028).\n- CVE-2026-63985: ethtool: eeprom: add more safeties to EEPROM Netlink fallback (bsc#1272963).\n- CVE-2026-63990: bonding: refuse to enslave CAN devices (bsc#1273027).\n- CVE-2026-63992: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (bsc#1272868).\n- CVE-2026-63999: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure (bsc#1273038).\n- CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273030).\n- CVE-2026-64001: ALSA: pcm: oss: Fix setup list UAF on proc write error (bsc#1273734).\n- CVE-2026-64002: ipv4: free net-\u003eipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (bsc#1273774).\n- CVE-2026-64004: net/iucv: fix locking in .getsockopt (bsc#1273804).\n- CVE-2026-64005: net/smc: Do not re-initialize smc hashtables (bsc#1273831).\n- CVE-2026-64006: netfilter: nf_tables: fix dst corruption in same register operation (bsc#1273834).\n- CVE-2026-64007: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (bsc#1273105).\n- CVE-2026-64010: nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (bsc#1273882).\n- CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1273891).\n- CVE-2026-64015: security/keys: fix missed RCU read section on lookup (bsc#1273762).\n- CVE-2026-64029: ALSA: seq: Serialize UMP output teardown with event_input (bsc#1273766).\n- CVE-2026-64047: net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (bsc#1273060).\n- CVE-2026-64048: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (bsc#1273484).\n- CVE-2026-64052: block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user() (bsc#1272983).\n- CVE-2026-64073: irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT (bsc#1273490).\n- CVE-2026-64098: drm/virtio: use uninterruptible resv lock for plane updates (bsc#1273488).\n- CVE-2026-64102: RDMA/siw: Reject MPA FPDU length underflow before signed receive math (bsc#1272516).\n- CVE-2026-64109: af_unix: Peek the queue synchronized (bsc#1273748).\n- CVE-2026-64112: rbd: eliminate a race in lock_dwork draining on unmap (bsc#1273741).\n- CVE-2026-64113: ixgbevf: fix use-after-free in VEPA multicast source pruning (bsc#1272262).\n- CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl \u003c 5 (bsc#1273742).\n- CVE-2026-64115: vsock/vmci: fix UAF when peer resets connection during handshake (bsc#1273745).\n- CVE-2026-64118: qed: fix double free in qed_cxt_tables_alloc() (bsc#1273749).\n- CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273743).\n- CVE-2026-64125: net: bcmgenet: keep RBUF EEE/PM disabled (bsc#1272346).\n- CVE-2026-64131: mm/memory: fix spurious warning when unmapping device-private/exclusive pages (bsc#1274063).\n- CVE-2026-64148: pds_core: check health in devcmd wait (bsc#1273956).\n- CVE-2026-64164: btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() (bsc#1273957).\n- CVE-2026-64185: sysfs: don't remove existing directory on update failure (bsc#1272200).\n- CVE-2026-64188: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() (bsc#1272150).\n- CVE-2026-64190: net: team: fix NULL pointer dereference in team_xmit during mode change (bsc#1272210).\n- CVE-2026-64192: bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized (bsc#1272213).\n- CVE-2026-64214: powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise()\n  (bsc#1272799).\n- CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272798).\n- CVE-2026-64222: octeontx2-pf: avoid double free of pool-\u003estack on AQ init failure (bsc#1272788).\n- CVE-2026-64225: octeontx2-af: CGX: add bounds check to cgx_speed_mbps index (bsc#1272786).\n- CVE-2026-64245: fbdev: modedb: fix a possible UAF in fb_find_mode() (bsc#1273905).\n- CVE-2026-64268: RDMA/siw: bound Read Response placement to the RREAD length (bsc#1273276).\n- CVE-2026-64286: KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU (bsc#1274058).\n- CVE-2026-64287: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (bsc#1273325).\n- CVE-2026-64294: mm: do file ownership checks with the proper mount idmap (bsc#1273525).\n- CVE-2026-64296: exfat: bound uniname advance in exfat_find_dir_entry() (bsc#1273975).\n- CVE-2026-64304: crypto: qat - validate RSA CRT component lengths (bsc#1273944).\n- CVE-2026-64312: crypto: pcrypt - restore callback for non-parallel fallback (bsc#1273968).\n- CVE-2026-64315: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1274028).\n- CVE-2026-64316: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1273598).\n- CVE-2026-64317: isofs: bound Rock Ridge symlink components to the SL record (bsc#1273936).\n- CVE-2026-64322: udf: validate sparing table length as an entry count, not a byte count (bsc#1273958).\n- CVE-2026-64323: udf: validate VAT header length against the VAT inode size (bsc#1273305).\n- CVE-2026-64355: bpf: Reject fragmented frames in devmap (bsc#1273422).\n- CVE-2026-64375: proc: protect ptrace_may_access() with exec_update_lock (FD links) (bsc#1273868).\n- CVE-2026-64378: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (bsc#1273603).\n- CVE-2026-64381: smb: client: Fix next buffer leak in receive_encrypted_standard() (bsc#1273860).\n- CVE-2026-64382: smb: client: fix double-free in SMB2_open() replay (bsc#1273291).\n- CVE-2026-64383: smb: client: fix double-free in SMB2_flush() replay (bsc#1273426).\n- CVE-2026-64384: smb: client: fix change notify replay double-free (bsc#1274541).\n- CVE-2026-64385: smb: client: fix double-free in SMB2_ioctl() replay (bsc#1274539).\n- CVE-2026-64386: smb: client: fix query_info() replay double-free (bsc#1274543).\n- CVE-2026-64387: smb: client: fix query directory replay double-free (bsc#1274545).\n- CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).\n- CVE-2026-64411: netfilter: ebtables: terminate table name before find_table_lock() (bsc#1274077).\n- CVE-2026-64412: netfilter: ebtables: module names must be null-terminated (bsc#1273780).\n- CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction (bsc#1274274).\n- CVE-2026-64434: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref (bsc#1273880).\n- CVE-2026-64436: net: af_key: initialize alg_key_len for IPComp states (bsc#1274277).\n- CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).\n- CVE-2026-64450: tipc: fix out-of-bounds read in broadcast Gap ACK blocks (bsc#1273523).\n- CVE-2026-64463: usb: typec: tcpci_rt1711h: unregister TCPCI port with devres (bsc#1273273).\n- CVE-2026-64472: vfio/mlx5: Fix racy bitfields and tighten struct layout (bsc#1274075).\n- CVE-2026-64481: ALSA: hda/cs35l41: Fix firmware load work teardown (bsc#1274547).\n- CVE-2026-64537: bridge: cfm: reject invalid CCM interval at configuration time (bsc#1273289).\n- CVE-2026-64538: ipv6: Fix null-ptr-deref in fib6_nh_mtu_change() (bsc#1273335).\n- CVE-2026-64541: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (bsc#1273303).\n- CVE-2026-64543: tipc: fix use-after-free of the discoverer in tipc_disc_rcv() (bsc#1273311).\n- CVE-2026-64545: net, bpf: check master for NULL in xdp_master_redirect() (bsc#1273318).\n- CVE-2026-64548: bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() (bsc#1273337).\n- CVE-2026-64551: sctp: validate STALE_COOKIE cause length before reading staleness (bsc#1273813).\n- CVE-2026-64552: virtio-net: fix len check in receive_big() (bsc#1273323).\n- CVE-2026-64553: net: psample: fix info leak in PSAMPLE_ATTR_DATA (bsc#1273336).\n- CVE-2026-64554: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() (bsc#1273340).\n- CVE-2026-64562: KVM: nVMX: Hide shadow VMCS right after VMCLEAR (bsc#1273930).\n- CVE-2026-64563: rhashtable: clear stale iter-\u003ep on table restart (bsc#1273995).\n- CVE-2026-64567: btrfs: reject free space cache with more entries than pages (bsc#1274006).\n- CVE-2026-64572: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (bsc#1274014).\n- CVE-2026-64576: nexthop: initialize extack in nh_res_bucket_migrate() (bsc#1274030).\n- CVE-2026-64577: gtp: check skb_pull_data() return in gtp1u_send_echo_resp() (bsc#1274031).\n- CVE-2026-64581: xfrm: fix sk_dst_cache double-free in xfrm_user_policy() (bsc#1274041).\n- CVE-2026-64582: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (bsc#1274040).\n- CVE-2026-64593: btrfs: do not trim a device which is not writeable (bsc#1274497).\n- CVE-2026-64597: smb: client: fix double-free in SMB2_close() replay (bsc#1274297).\n- CVE-2026-64598: smb/client: Fix error code in smb2_aead_req_alloc() (bsc#1274298).\n- CVE-2026-68081: KVM: nVMX: Add helper to put (unmap) vmcs12 pages (bsc#1274580).\n- CVE-2026-68082: libceph: fix two unsafe bare decodes in decode_lockers() (bsc#1274581).\n- CVE-2026-68086: mm/khugepaged: write all dirty file folios when collapsing (bsc#1274713).\n- CVE-2026-68116: vxlan: mdb: Fix source list corruption on a failed replace (bsc#1274876).\n- CVE-2026-68117: tipc: clear sock-\u003esk on the failed-insert path in tipc_sk_create() (bsc#1274881).\n- CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1274888).\n- CVE-2026-68123: openvswitch: fix GSO userspace truncation underflow (bsc#1275169).\n- CVE-2026-68127: ila: reload IPv6 header after pskb_may_pull in checksum adjust (bsc#1275237).\n- CVE-2026-68129: gve: fix Rx queue stall on alloc failure (bsc#1275517).\n- CVE-2026-68132: super: fix emergency thaw deadlock on frozen block devices (bsc#1275553).\n- CVE-2026-68136: net: gro: fix double aggregation of flush-marked skbs (bsc#1275474).\n- CVE-2026-68138: net/sched: serialize qdisc_rtab_list against concurrent get/put (bsc#1274941).\n- CVE-2026-68139: net/mlx5e: Use sender devcom for MPV master-up (bsc#1275578).\n- CVE-2026-68142: geneve: require CAP_NET_ADMIN in the device netns for changelink (bsc#1275582).\n- CVE-2026-68143: net: slip: serialize receive against buffer reallocation (bsc#1275583).\n- CVE-2026-68145: iomap: fix out-of-bounds bitmap_set() with zero-length range (bsc#1275584).\n- CVE-2026-68149: fs: preserve ACL_DONT_CACHE state in forget_cached_acl() (bsc#1275294).\n- CVE-2026-68153: libceph: remove debugfs files before client teardown (bsc#1275301).\n- CVE-2026-68154: libceph: reject zero bucket types in crush_decode (bsc#1275303).\n- CVE-2026-68155: libceph: Reject monmaps advertising zero monitors (bsc#1275304).\n- CVE-2026-68156: libceph: refresh auth-\u003eauthorizer_buf{,_len} after authorizer update (bsc#1275305).\n- CVE-2026-68157: libceph: guard missing CRUSH type name lookup (bsc#1275306).\n- CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1275307).\n- CVE-2026-68159: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (bsc#1275470).\n- CVE-2026-68160: ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() (bsc#1275472).\n- CVE-2026-68161: sctp: close UDP tunnel sockets during netns teardown (bsc#1274892).\n- CVE-2026-68166: userfaultfd: prevent registration of special VMAs (bsc#1274930).\n- CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275161).\n- CVE-2026-68205: media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() (bsc#1274934).\n- CVE-2026-68238: drm/amdgpu: Release VFCT ACPI table reference (bsc#1275704).\n- CVE-2026-68247: drm/i915/bios: range check LFP Data Block panel_type2 (bsc#1275817).\n- CVE-2026-68254: drm/i915/vrr: require valid min/max vfreq for VRR (bsc#1275150).\n- CVE-2026-68284: bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() (bsc#1275970).\n- CVE-2026-68286: drop_monitor: perform u64_stats updates under IRQ-disabled section (bsc#1275973).\n- CVE-2026-68288: net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD (bsc#1275975).\n- CVE-2026-68289: tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() (bsc#1275976).\n- CVE-2026-68293: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (bsc#1275091).\n- CVE-2026-68297: tipc: fix u16 MTU truncation in media and bearer MTU validation (bsc#1275040).\n- CVE-2026-68299: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (bsc#1275088).\n- CVE-2026-68300: sctp: auth: verify auth requirement when auth_chunk is NULL (bsc#1275083).\n- CVE-2026-68312: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (bsc#1274663).\n- CVE-2026-68313: tipc: fix infinite loop in __tipc_nl_compat_dumpit (bsc#1274665).\n- CVE-2026-68315: sctp: validate stream count in sctp_process_strreset_inreq() (bsc#1274662).\n- CVE-2026-68320: sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid (bsc#1274659).\n- CVE-2026-68322: rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled (bsc#1274656).\n- CVE-2026-68324: iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() (bsc#1274649).\n- CVE-2026-68325: iommu/amd: Bound the early ACPI HID map (bsc#1274651).\n- CVE-2026-68328: nfp: Check resource mutex allocation (bsc#1274646).\n- CVE-2026-68329: iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() (bsc#1274645).\n- CVE-2026-68331: dpaa2-eth: put MAC endpoint device on disconnect (bsc#1274642).\n- CVE-2026-68333: dpaa2-switch: put MAC endpoint device on disconnect (bsc#1274644).\n- CVE-2026-68335: rds: drop incoming messages that cross network namespace boundaries (bsc#1274640).\n- CVE-2026-68336: bonding: fix devconf_all NULL dereference when IPv6 is disabled (bsc#1274639).\n- CVE-2026-68343: smb: client: validate DFS referral PathConsumed (bsc#1274629).\n- CVE-2026-68377: net/sched: act_tunnel_key: Defer dst_release to RCU callback (bsc#1274831).\n- CVE-2026-68386: bpf, sockmap: Reject unhashed UDP sockets on sockmap update (bsc#1274814).\n- CVE-2026-68397: net/iucv: take a reference on the socket found in afiucv_hs_rcv() (bsc#1274898).\n- CVE-2026-68398: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF (bsc#1274908).\n- CVE-2026-68408: wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (bsc#1274709).\n- CVE-2026-68417: RDMA/siw: publish QP after initialization (bsc#1274696).\n- CVE-2026-68418: RDMA/irdma: Prevent user-triggered null deref on QP create (bsc#1274690).\n- CVE-2026-68419: RDMA/irdma: Prevent rereg_mr for non-mem regions (bsc#1274698).\n- CVE-2026-68422: btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() (bsc#1274706).\n- CVE-2026-68425: IB/mad: Drop unmatched RMPP responses before reassembly (bsc#1274700).\n- CVE-2026-68426: xfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment (bsc#1274705).\n- CVE-2026-68432: vxlan: require CAP_NET_ADMIN in the device netns for changelink (bsc#1274800).\n- CVE-2026-68433: libceph: bound get_version reply decode to front len (bsc#1274801).\n- CVE-2026-68450: btrfs: free mapping node on duplicate reloc root insert (bsc#1274834).\n- CVE-2026-68470: wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (bsc#1276500).\n- CVE-2026-68480: x86/bugs: Make Safe-RET robust against interrupt injection (bsc#1274208).\n- CVE-2026-72020: ipvs: reset full ip_vs_seq structs in ip_vs_conn_new (bsc#1275506).\n- CVE-2026-72035: net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1276961).\n- CVE-2026-72036: net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1277034).\n- CVE-2026-72069: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (bsc#1275528).\n- CVE-2026-72072: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (bsc#1277155).\n- CVE-2026-72083: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (bsc#1275535).\n- CVE-2026-72084: scsi: target: Bound PR-OUT TransportID parsing to the received buffer (bsc#1275540).\n- CVE-2026-72123: can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (bsc#1277523).\n- CVE-2026-72132: NFS: Charge unstable writes by request size, not folio size (bsc#1277551).\n- CVE-2026-72221: sunrpc: wait for in-flight TLS handshake callback when cancel loses race (bsc#1275665).\n- CVE-2026-72222: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (bsc#1275669).\n- CVE-2026-72251: netfilter: nf_nat_sip: reload possible stale data pointer (bsc#1275827).\n- CVE-2026-72254: netfilter: nft_fib: reject fib expression on the netdev egress hook (bsc#1277204).\n- CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (bsc#1277678).\n- CVE-2026-72288: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (bsc#1275886).\n- CVE-2026-72289: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (bsc#1275905).\n- CVE-2026-72296: net: ife: require ETH_HLEN to be pullable in ife_decode() (bsc#1275923).\n- CVE-2026-72307: mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() (bsc#1277160).\n- CVE-2026-72308: mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() (bsc#1277159).\n- CVE-2026-72317: SUNRPC: pin upper rpc_clnt across the TLS connect_worker (bsc#1275925).\n- CVE-2026-72341: net/mlx5e: Fix publication race for priv-\u003echannel_stats[] (bsc#1277660).\n- CVE-2026-72342: net/mlx5e: Fix HV VHCA stats agent registration race (bsc#1277775).\n- CVE-2026-72343: net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation (bsc#1277776).\n- CVE-2026-72389: bridge: stp: Fix a potential use-after-free when deleting a bridge (bsc#1273869).\n- CVE-2026-72463: xfrm: Fix dev use-after-free in xfrm async resumption (bsc#1268276 bsc#1277064).\n- CVE-2026-72464: xprtrdma: Remove temp allocation of rpcrdma_rep objects (bsc#1277069).\n- CVE-2026-72466: xprtrdma: Fix bcall rep leak and unbounded peek (bsc#1277057).\n- CVE-2026-72467: xprtrdma: Check frwr_wp_create() during connect (bsc#1277059).\n- CVE-2026-72469: xprtrdma: Fix ep kref imbalance on ADDR_CHANGE (bsc#1277047).\n- CVE-2026-72473: xprtrdma: Avoid 250 ms delay on backlog wakeup (bsc#1277037).\n- CVE-2026-72494: RDMA/irdma: Replace waitqueue and flag with completion (bsc#1276941).\n- CVE-2026-72495: RDMA/bnxt_re: Avoid repeated requests to allocate WC pages (bsc#1276937).\n- CVE-2026-72496: RDMA/bnxt_re: Proper rollback if the ioremap fails (bsc#1276943).\n- CVE-2026-72499: RDMA/bnxt_re: Free CQ toggle page after firmware teardown (bsc#1276551).\n- CVE-2026-72501: RDMA/bnxt_re: Initialize dpi variable to zero (bsc#1276546).\n- CVE-2026-72502: tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) (bsc#1276542).\n- CVE-2026-74269: bnxt: fix head underflow on XDP head-grow (bsc#1276507).\n- CVE-2026-74296: RDMA/mlx5: Release the HW-provided UAR index rather than the SW one (bsc#1276452).\n- CVE-2026-74297: RDMA/mlx5: Fix undefined shift of user RQ WQE size (bsc#1276446).\n- CVE-2026-74318: btrfs: fix deadlock cloning inline extent when using flushoncommit (bsc#1276864).\n- CVE-2026-74321: btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() (bsc#1277202).\n- CVE-2026-74334: RDMA/nldev: Fix locking when accessing mr-\u003epd (bsc#1277095).\n- CVE-2026-74345: RDMA/siw: Fix endpoint/socket association handling (bsc#1277285).\n- CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277408).\n- CVE-2026-74395: RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference (bsc#1277077).\n- CVE-2026-74454: drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO (bsc#1277073).\n- CVE-2026-74474: vxlan: use pskb_network_may_pull() for transmit path header pulls (bsc#1276335).\n- CVE-2026-74481: mm/page_reporting: use system_freezable_wq to fix UAF during suspend (bsc#1276355).\n- CVE-2026-74482: mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios (bsc#1276346).\n- CVE-2026-74488: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (bsc#1276350).\n- CVE-2026-74495: igbvf: Fix leak in TX DMA error cleanup (bsc#1275864).\n- CVE-2026-74496: fou: Fix use-after-free in fou_create() (bsc#1275867).\n- CVE-2026-74509: Bluetooth: hci_sync: Fix advertising data UAFs (bsc#1275946).\n- CVE-2026-74510: Bluetooth: mgmt: fix UAF in pair command cancellation (bsc#1275950).\n- CVE-2026-74512: audit: fix potential use-after-free in audit_del_rule() (bsc#1275954).\n- CVE-2026-74516: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (bsc#1275797).\n- CVE-2026-74518: mm/hugetlb: fix list corruption in allocate_file_region_entries() (bsc#1275798).\n- CVE-2026-74527: octeontx2-af: Block VFs from clobbering special CGX PKIND state (bsc#1275805).\n- CVE-2026-74537: Bluetooth: ISO: hold sk properly in iso_conn_ready (bsc#1275687).\n- CVE-2026-74548: forcedeth: fix UAF of txrx_stats in nv_remove (bsc#1275695).\n- CVE-2026-74550: net: do not send ICMP/NDISC Redirects when peer allocation fails (bsc#1275688).\n- CVE-2026-74556: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (bsc#1275696).\n- CVE-2026-74563: rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() (bsc#1275574).\n- CVE-2026-74566: keys: make keyring key-chunk byte order agree with keyring_diff_objects() (bsc#1275566).\n- CVE-2026-74567: keys: fix out-of-bounds read in keyring_get_key_chunk() (bsc#1275569).\n- CVE-2026-74571: btrfs: skip global block reserve accounting for rescue mounts (bsc#1275561).\n- CVE-2026-74581: net: ipv6: clear suppressed fib6 rule result (bsc#1275782).\n- CVE-2026-74582: packet: use consistent hard_header_len in non-ring send paths (bsc#1275784).\n- CVE-2026-74584: RDMA/bnxt_re: zero shared page before exposing to userspace (bsc#1277066).\n- CVE-2026-74610: tls: don't leave a full plaintext sk_msg ring unpushed (bsc#1277054).\n- CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277391).\n- CVE-2026-74692: net/smc: fix TOCTOU race between smc_listen_out() and listener close (bsc#1276927).\n- CVE-2026-74694: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length (bsc#1277625).\n- CVE-2026-74695: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() (bsc#1276931).\n- CVE-2026-74717: net/mlx5: fw_tracer, return NULL on create error (bsc#1276569).\n- CVE-2026-74722: btrfs: fix memory leak in btrfs_do_encoded_write() (bsc#1276561).\n- CVE-2026-80529: xfs: don't swallow dquot recovery verification errors (bsc#1277688).\n- CVE-2026-80534: xfs: fix ilock leak on error in xfs_dq_get_next_id (bsc#1277022).\n- CVE-2026-80590: inet: frags: strip GSO state from fragments before reassembly (bsc#1277275).\n- CVE-2026-80654: soc: xilinx: Shutdown and free rx mailbox channel (bsc#1277516).\n\nThe following non security issues were fixed:\n\n- accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() (git-fixes).\n- accessibility: speakup: unregister tty ldisc on later init failures (git-fixes).\n- ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer (git-fixes).\n- ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root (git-fixes).\n- ACPI: pfr_update: fix stack buffer overflow in query_capability() (git-fixes).\n- ACPI: processor: idle: Expand _LPI package sanity checks (git-fixes).\n- ACPI: processor: validate MADT IOAPIC entry bounds (git-fixes).\n- ACPI: scan: fix bus ID cleanup on device_add() failures (git-fixes).\n- ACPI: video: Release PCI device reference after lookup (git-fixes).\n- add my missing Reviewed-by: tag.\n- ALSA: 6fire: bound the MIDI event length from the device (git-fixes).\n- ALSA: 6fire: Fix UAF at error handling during probe (stable-fixes).\n- ALSA: bcd2000: clear the URB pointers on disconnect (git-fixes).\n- ALSA: core: Fix use-after-free in snd_card_do_free() (git-fixes).\n- ALSA: dummy: Check card index validity at probe (stable-fixes).\n- ALSA: hda/ext: preserve PPLCCTL bits when clearing reset (git-fixes).\n- ALSA: hda: Fix connection list comparison in proc output (git-fixes).\n- ALSA: hpi: Check transport errors during HPI6000 adapter initialization (git-fixes).\n- ALSA: pcxhr: initialize mutexes before requesting threaded IRQ (git-fixes).\n- ALSA: seq: midi: Optimize event_input locking with RCU (git-fixes).\n- ALSA: seq: midi: Serialize input teardown with event_input (git-fixes).\n- ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion (git-fixes).\n- ALSA: usb-audio: Complete cleanup after system-resume errors (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() (git-fixes).\n- ALSA: usb-audio: fix OOB write on Type II inbound URBs (git-fixes).\n- ALSA: usb: Fix UAF at delayed release of MIDI2 EPs (git-fixes).\n- ALSA: usx2y: bound the hwdep mmap fault offset (git-fixes).\n- ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() (git-fixes).\n- apparmor: advertise the tcp fast open fix is applied (git-fixes).\n- ASoC: adau1761: sort the register default table (git-fixes).\n- ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC (git-fixes).\n- ASoC: apple: mca: increase SERDES reset delay (git-fixes).\n- ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses (git-fixes).\n- ASoC: cs35l33: drain threaded IRQ before runtime suspend (git-fixes).\n- ASoC: cs35l34: drain threaded IRQ before runtime suspend (git-fixes).\n- ASoC: cs35l41: sort the register default table (git-fixes).\n- ASoC: cs35l45: sort the register default table (git-fixes).\n- ASoC: cs4265: sort the register default table (git-fixes).\n- ASoC: cx2072x: sort the register default table (git-fixes).\n- ASoC: dapm: Fix off-by-one check on the second enum channel (git-fixes).\n- ASoC: fix unmet dependencies on PPC_BESTCOMM and SND_SOC_AC97_BUS (git-fixes).\n- ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready (git-fixes).\n- ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure (git-fixes).\n- ASoC: fsl_audmix: rework runtime PM handling in probe (git-fixes).\n- ASoC: fsl_easrc: sort the register default table (git-fixes).\n- AsoC: intel: sst: fix PCI device reference leak on probe failure (git-fixes).\n- ASoC: max9860: sort the register default table (git-fixes).\n- ASoC: meson: Keep link pointers valid on realloc failure (git-fixes).\n- ASoC: ml26124: sort the register default table (git-fixes).\n- ASoC: pcm512x: sort the register default table (git-fixes).\n- ASoC: pxa: Use devm_clk_get_optional() for extclk clock (git-fixes).\n- ASoC: qcom: q6apm: keep the graph start count in sync with the DSP (git-fixes).\n- ASoC: rt274: sort the register default table (git-fixes).\n- ASoC: rt286: sort the register default table (git-fixes).\n- ASoC: rt298: sort the register default table (git-fixes).\n- ASoC: rt700-sdw: always drain jack work on remove (git-fixes).\n- ASoC: rt700: drop duplicate reg_default entry (git-fixes).\n- ASoC: rt700: sort the register default table (git-fixes).\n- ASoC: rt711-sdca: sort the register default tables (git-fixes).\n- ASoC: rt711: sort the register default table (git-fixes).\n- ASoC: rt712-sdca-dmic: sort the register default table (git-fixes).\n- ASoC: rt715-sdca: drop duplicate reg_default entries (git-fixes).\n- ASoC: rt715-sdca: sort the register default tables (git-fixes).\n- ASoC: rt715: sort the register default table (git-fixes).\n- ASoC: rt1316-sdw: sort the register default table (git-fixes).\n- ASoC: rt1318-sdw: sort the register default table (git-fixes).\n- ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get (git-fixes).\n- ASoC: sgtl5000: sort the register default table (git-fixes).\n- ASoC: SOF: pcm: Move period/buffer configuration print after platform open (stable-fixes).\n- ASoC: sof: pcm: use snd_pcm_direction_name() (stable-fixes).\n- ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() (git-fixes).\n- ASoC: SOF: validate topology volume range before allocation (git-fixes).\n- ASoC: sti-sas: sort the register default table (git-fixes).\n- ASoC: tas2552: sort the register default table (git-fixes).\n- ASoC: tas2764: sort the register default table (git-fixes).\n- ASoC: tas2780: sort the register default table (git-fixes).\n- ASoC: tegra210_i2s: sort the register default table (git-fixes).\n- ASoC: tegra210_mixer: sort the register default table (git-fixes).\n- ASoC: tegra: Fix the MIXER enable default value (git-fixes).\n- ASoC: tegra: Sort MBDRC register defaults (git-fixes).\n- ASoC: xilinx: formatter_pcm: fix stream_data leak on open error (git-fixes).\n- ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers (git-fixes).\n- batman-adv: bla: fix freeing of claims on meshif deletion (git-fixes).\n- batman-adv: bla: prevent CRC corruptions after claim flush (git-fixes).\n- batman-adv: dat: avoid unaligned fault in IP extraction (git-fixes).\n- batman-adv: fix stale receive device on merged fragments (git-fixes).\n- Bluetooth: btintel: Fix diagnostics event detection (git-fixes).\n- Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path (git-fixes).\n- Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX (git-fixes).\n- Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event (git-fixes).\n- Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() (git-fixes).\n- Bluetooth: do not leak an hci_conn when a second LE connect is rejected (git-fixes).\n- Bluetooth: eir: Fix OOB read in eir_get_service_data() (git-fixes).\n- Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_conn: hold conn reference in abort_conn_sync() (git-fixes).\n- Bluetooth: hci_conn: re-enable advertising only for peripheral role (git-fixes).\n- Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection (git-fixes).\n- Bluetooth: hci_event: fix LE list UAF on reset (git-fixes).\n- Bluetooth: hci_event: validate LE Set CIG Parameters response (git-fixes).\n- Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths (git-fixes).\n- Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists (stable-fixes).\n- Bluetooth: hci_uart: Fix false success return in hci_uart_setup() (git-fixes).\n- Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready (git-fixes).\n- Bluetooth: MGMT: free the mesh send cancel command when it is cancelled (git-fixes).\n- Bluetooth: MSFT: validate evt_prefix_len against the response length (git-fixes).\n- Bluetooth: RFCOMM: serialize security confirmation handling (git-fixes).\n- Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept (git-fixes).\n- Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (git-fixes).\n- Bluetooth: virtio_bt: avoid OOB read of build info string (git-fixes).\n- bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation (git-fixes).\n- bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET (git-fixes).\n- bus: ti-sysc: Fix /chosen node reference leak (git-fixes).\n- cacheinfo: don't propagate DT/ACPI error when arch supplies info (arm64) (git-fixes).\n- can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking (stable-fixes).\n- crypto: aspeed - Propagate platform_get_irq() errors (git-fixes).\n- crypto: atmel-sha204a - fix heap info leak on I2C transfer failure (git-fixes).\n- crypto: atmel-tdes - use scatterlist length before DMA mapping (git-fixes).\n- crypto: ccm - Set rfc4309 maxauthsize from child (git-fixes).\n- crypto: ccp - Fix memory leak in SEV INIT_EX path (git-fixes).\n- crypto: ccp - Fix possible deadlock in SEV init failure path (git-fixes).\n- crypto: doc - Remove extra parenthesis (git-fixes).\n- crypto: hisilicon/sec2 - fix CCM algorithm long packet failure (git-fixes).\n- crypto: keembay - Initialize completion before requesting IRQ (git-fixes).\n- crypto: keembay - publish OF module alias for OCS AES/SM4 (git-fixes).\n- crypto: mxs-dcp - fix source scatterlist length access (git-fixes).\n- crypto: qat - cancel work on re-enable SR-IOV timeout (git-fixes).\n- crypto: qat - clear AES key schedule from stack (git-fixes).\n- crypto: qce - fix CCM AAD buffer underallocation (git-fixes).\n- crypto: qce - fix error path in devm_qce_register_algs (git-fixes).\n- crypto: rk3288 - fail ahash requests on HASH idle timeout (git-fixes).\n- crypto: sa2ul - stop probe if context pool creation fails (git-fixes).\n- crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping (git-fixes).\n- device property: fix infinite loop in fwnode_for_each_child_node() (git-fixes).\n- dmaengine: dw-edma: Clear stale requests on termination (git-fixes).\n- dmaengine: dw-edma: Complete descriptors before pausing (git-fixes).\n- dmaengine: dw-edma: Initialize IRQ data before requesting IRQs (git-fixes).\n- dmaengine: dw-edma: Serialize abort state updates (git-fixes).\n- dmaengine: dw-edma: Serialize channel state checks (git-fixes).\n- dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe (git-fixes).\n- dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure (git-fixes).\n- dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal (git-fixes).\n- dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers (git-fixes).\n- dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout (git-fixes).\n- driver core: soc: Unregister bus on early device registration failure (git-fixes).\n- drm/amd/display: avoid divide-by-zero in __is_lut_linear() (git-fixes).\n- drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read (git-fixes).\n- drm/amdgpu/gfx6: Fixup emit_cntxcntl() (git-fixes).\n- drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets (git-fixes).\n- drm/amdgpu/gfx6: Use PFP on the compute queues too (git-fixes).\n- drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup (git-fixes).\n- drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup (git-fixes).\n- drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (git-fixes).\n- drm/amdgpu: cap GTT size to physical RAM on APUs (stable-fixes).\n- drm/amdgpu: check ASPM on the dGPU host link (git-fixes).\n- drm/amdgpu: disallow multiple FENCE chunks in one submit (git-fixes).\n- drm/amdgpu: fix aperture iounmap skipped on device removal (git-fixes).\n- drm/amdgpu: fix autosuspend cleanup during removal (git-fixes).\n- drm/amdgpu: Fix UVD decode image min size calculation (stable-fixes).\n- drm/amdgpu: Fix UVD dpb min size calculation for H264 (stable-fixes).\n- drm/amdgpu: Fix UVD min buffer sizes (stable-fixes).\n- drm/amdgpu: Fix VCE 3 ring align_mask (git-fixes).\n- drm/amdgpu: Implement insert_end for VCE 3 (git-fixes).\n- drm/amdgpu: Reject UVD message with dimensions above 4096 (stable-fixes).\n- drm/amdgpu: Reject UVD message with invalid number of h265 refs (stable-fixes).\n- drm/amdgpu: restore UMD profile pstate after runtime resume (stable-fixes).\n- drm/amdgpu: validate GEM_CREATE domain combinations (stable-fixes).\n- drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE (stable-fixes).\n- drm/amdkfd: fix QID bit leak in pqm_create_queue() (stable-fixes).\n- drm/amdkfd: Handle invalid event type in CRIU event restore (stable-fixes).\n- drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure (git-fixes).\n- drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure (git-fixes).\n- drm/bridge: ps8640: propagate AUX transfer register errors (git-fixes).\n- drm/bridge: tc358767: clamp the reported AUX read size to the request (git-fixes).\n- drm/connector: Fix epoch_counter docs to reflect reality (git-fixes).\n- drm/hibmc: Fix list of formats on the primary plane (git-fixes).\n- drm/hibmc: Use drm_atomic_helper_check_plane_state() (git-fixes).\n- drm/i915/fbc: Extract intel_fbc_has_fences() (stable-fixes).\n- drm/lima: call drm_mm_init() with a valid allocation range (git-fixes).\n- drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0) (git-fixes).\n- drm/msm/dsi: Drop dev_pm_opp_set_rate(0) (git-fixes).\n- drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value (git-fixes).\n- drm/panel-edp: fix i2c adapter leak on probe failure (git-fixes).\n- drm/panel: samsung-s6d16d0: Power off on prepare failure (git-fixes).\n- drm/radeon: fix autosuspend cleanup during teardown (git-fixes).\n- drm/radeon: restore hardware polling in fence_is_signaled to fix performance regression (git-fixes).\n- drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format (git-fixes).\n- drm/ssd130x: fix column and row end address in partial updates for ssd132x (git-fixes).\n- drm/sun4i: crtc: Propagate layer initialization error (git-fixes).\n- drm/sun4i: Drop node references while building component list (git-fixes).\n- drm/sun4i: dw-hdmi: Drop TCON TOP port reference (git-fixes).\n- drm/sun4i: fix refcount leak in sun4i_backend_init_sat() (git-fixes).\n- drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz (git-fixes).\n- drm/sun4i: tcon: Drop remote endpoint reference (git-fixes).\n- drm/sun4i: tcon: Drop TCON TOP device reference (git-fixes).\n- drm/sun4i: tcon: Set output mux for DSI and LVDS (git-fixes).\n- drm/sun4i: vi scaler: Fix coefficient selection (git-fixes).\n- drm/tegra: dsi: Re-add clear enable register if DSI was powered by bootloader (git-fixes).\n- drm/tve200: add OF module alias for autoloading (git-fixes).\n- drm: fix race between partial drm_dev_register() failure and ioctl (git-fixes).\n- drm: lcdif: Wait for vblank before disabling DMA (git-fixes).\n- drm: Remove unused header in drm_dumb_buffers.c (git-fixes).\n- ethtool: rss: fix hkey leak when indir_size is 0 (git-fixes).\n- fbdev: bitblit: bound-check glyph index in bit_cursor() (git-fixes).\n- fbdev: core: Fix pointer desynchronization in fb_io_read() (git-fixes).\n- fbdev: kyro: Validate overlay viewport coordinates (git-fixes).\n- fbdev: omapfb: panel-dsi-cm: initialize lock before registering display (git-fixes).\n- fbdev: ssd1307fb: defer I2C transfers from damage callbacks (git-fixes).\n- fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device() (git-fixes).\n- fbdev: uvesafb: unregister connector callback on init failure (git-fixes).\n- firmware: arm_scmi: Avoid IDR updates while cleaning channels (git-fixes).\n- firmware: arm_scmi: Drop handle on protocol bind failures (git-fixes).\n- firmware: arm_scmi: Fix requested device removal race (git-fixes).\n- firmware: arm_scmi: Free transport channel on IDR failure (git-fixes).\n- firmware: arm_scmi: Protect device request lookup with RCU (git-fixes).\n- firmware: arm_scmi: Reject out of range DT protocol IDs (git-fixes).\n- firmware: arm_scmi: Unregister device notifier before IDR teardown (git-fixes).\n- firmware: arm_scmi: Use channel ID for transport teardown (git-fixes).\n- firmware_loader: do not queue completed sysfs fallback requests (git-fixes).\n- fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write (git-fixes).\n- fpga: dfl: fme: add error handling (git-fixes).\n- fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration (git-fixes).\n- gpu: host1x: Avoid stack over-read in debug output helpers (git-fixes).\n- gpu: host1x: Fix offset calculation in trace_write_gather (git-fixes).\n- HID: core: fix number/pointer type confusion on long items (git-fixes).\n- HID: core: fix OOB read of field-\u003eusage in hid_set_field() (git-fixes).\n- HID: hyperv: validate initial device info bounds (git-fixes).\n- HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure (git-fixes).\n- HID: lg4ff: validate report length before fixed offsets (git-fixes).\n- HID: logitech-dj: Fix maxfield check in DJ short report validation (git-fixes).\n- HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report (git-fixes).\n- HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write (stable-fixes).\n- HID: logitech-dj: Standardise hid_report_enum variable nomenclature (stable-fixes).\n- HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID (stable-fixes).\n- HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() (git-fixes).\n- HID: mcp2221: validate report size in mcp2221_raw_event() (git-fixes).\n- HID: nintendo: Fix imu_timestamp_us double increment per report (git-fixes).\n- HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() (git-fixes).\n- HID: picolcd: clamp eeprom debugfs read to bytes actually received (git-fixes).\n- HID: roccat: bound device-supplied profile index (git-fixes).\n- HID: roccat: free buffered reports when destroying device (git-fixes).\n- HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature (git-fixes).\n- HID: sensor: custom: Fix field sysfs group cleanup on failure (git-fixes).\n- HID: sensor: custom: Fix use-after-free in enable_sensor (git-fixes).\n- HID: tmff: Use 64-bit arithmetic for force feedback scaling (git-fixes).\n- hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination (git-fixes).\n- hwmon: (lm25066) Use i2c_get_match_data() (stable-fixes).\n- hwmon: (max6621) fix negative temperature offset and crit readings (git-fixes).\n- hwmon: (max6621) fix temperature clamp range (git-fixes).\n- hwmon: (nzxt-smart2) Check return value of init_device() in probe (git-fixes).\n- hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations (git-fixes).\n- hwrng: ks-sa - Fix runtime PM cleanup on registration failure (git-fixes).\n- hwrng: omap - Fix probe error path cleanup (git-fixes).\n- hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() (git-fixes).\n- i2c: bcm-iproc: remove printout on handled timeouts (stable-fixes).\n- i2c: iproc: reset bus after timeout if START_BUSY is stuck (git-fixes).\n- i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure (git-fixes).\n- i2c: mux: Fix channel node leak on adapter add failure (git-fixes).\n- i2c: ocores: Disable clock on failed resume (git-fixes).\n- i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices (git-fixes).\n- i3c: master: Fix device_register() error path (git-fixes).\n- i3c: master: Fix info leak and UAF in device unregister path (git-fixes).\n- i3c: master: svc: bound IBI payload to the requested max_payload_len (git-fixes).\n- ibmvnic: Only record tx completed bytes once per handler (bsc#1274620).\n- iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE (git-fixes).\n- iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable (git-fixes).\n- iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF (git-fixes).\n- iio: chemical: sgp30: Handle IAQ thread creation failure (git-fixes).\n- iio: dac: m62332: Fix regulator reference count imbalance (git-fixes).\n- iio: gyro: mpu3050: fix sign of raw angular velocity readings (git-fixes).\n- iio: light: cm32181: return zero after writing calibscale (git-fixes).\n- iio: light: gp2ap002: Disable regulators on resume failure (git-fixes).\n- iio: light: gp2ap002: re-enable irq if runtime suspend fails (git-fixes).\n- iio: light: isl29028: return zero in write_raw() on success (git-fixes).\n- iio: light: tsl2583: return zero in write_raw() on success (git-fixes).\n- iio: light: tsl2772: fix ALS calibscale readback (git-fixes).\n- iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure (git-fixes).\n- iio: pressure: dps310: fix NULL pointer dereference on ACPI probe (git-fixes).\n- iio: pressure: mpl115: Fix runtime PM cleanup (git-fixes).\n- iio: srf04: fix pm_runtime handling on probe error path (git-fixes).\n- iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() (git-fixes).\n- Input: atkbd - skip deactivate for HONOR ZQC-P (git-fixes).\n- Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard (stable-fixes).\n- Input: evdev - fix information leak in evdev_pass_values() (stable-fixes).\n- Input: evdev - sanitize event type index when fetching event masks (stable-fixes).\n- Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet (git-fixes).\n- Input: focaltech - use signed coordinates to prevent underflow (git-fixes).\n- Input: hynitron_cstxxx - validate touch count and finger IDs (git-fixes).\n- Input: iforce - validate input packet lengths (stable-fixes).\n- Input: iqs5xx - validate firmware record destination span (git-fixes).\n- Input: mms114 - fix Y-resolution configuration (git-fixes).\n- Input: psxpad-spi - set driver data before use (git-fixes).\n- Input: sur40 - fix input device registration ordering (stable-fixes).\n- Input: sur40 - fix V4L error path cleanup (stable-fixes).\n- Input: synaptics-rmi4 - block s_input when F54 queue is busy (git-fixes).\n- Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer (git-fixes).\n- Input: synaptics-rmi4 - fix F55 transmitter electrode count typo (git-fixes).\n- Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue (git-fixes).\n- Input: synaptics-rmi4 - zero report size on F54 work error (git-fixes).\n- Input: xpad - add support for ZENAIM LEVERLESS (stable-fixes).\n- interconnect: Fix use after free in icc_get() and of_icc_get_by_index() (git-fixes).\n- ipmi: ipmb: validate write message length (git-fixes).\n- ipmi: si: Fix NULL pointer dereference after failed registration (git-fixes).\n- KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes).\n- KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page (git-fixes).\n- leds: pca9532: Fix inverted GPIO output polarity (git-fixes).\n- leds: pca9532: Fix phantom device registration on missing hardware (git-fixes).\n- lib/string: fix memchr_inv() for large ranges (git-fixes).\n- lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() (git-fixes).\n- mailbox: qcom-ipcc: fix duplicate channel allocation across holes (git-fixes).\n- mailbox: rockchip: disable pclk on probe failure and unbind (git-fixes).\n- maple_tree: fix argument name in header (git-fixes).\n- md/raid1: create serial pool adding rdev to array with serialize_policy=1 (bsc#1272261).\n- media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref (git-fixes).\n- media: cec-pin: Fix event FIFO ordering (git-fixes).\n- media: cec: disable delayed work before freeing an interrupted transmit (git-fixes).\n- media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash (git-fixes).\n- media: cec: Serialize exclusive follower delivery (git-fixes).\n- media: cec: stm32: prevent out-of-bounds write on RX overflow (git-fixes).\n- media: cedrus: fix memory leak in cedrus_init_ctrls() (git-fixes).\n- media: cobalt: Avoid freeing ALSA private data twice (git-fixes).\n- media: cx231xx: reject geometry changes while the VBI queue is busy (git-fixes).\n- media: cx23885: cancel NetUP CI work before teardown (git-fixes).\n- media: em28xx: defer audio-only extension registration (git-fixes).\n- media: em28xx: fix use-after-free of dev_next-\u003edevlist on disconnect (git-fixes).\n- media: go7007: defer the ALSA v4l2 put until card release (git-fixes).\n- media: i2c: ov02a10: fix endpoint parsing use-after-free (git-fixes).\n- media: i2c: ov7740: fix use-after-destroy in remove (git-fixes).\n- media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define (git-fixes).\n- media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define (git-fixes).\n- media: mc-entity: Add missing kerneldoc (git-fixes).\n- media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common (git-fixes).\n- media: nxp: imx8-isi: Correct color map between V4L2 and ISI (git-fixes).\n- media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing (git-fixes).\n- media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks (git-fixes).\n- media: rc: sunxi-cir: Unregister rc device on probe failure (git-fixes).\n- media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure (git-fixes).\n- media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak (git-fixes).\n- media: s2255: bound JPEG frame size before copying into the buffer (git-fixes).\n- media: s2255: check firmware size before reading trailing marker (git-fixes).\n- media: saa7164: fix cleanup on resource allocation failure (git-fixes).\n- media: tda18250: fix possible integer overflow (git-fixes).\n- media: usbtv: keep device alive while ALSA card exists (git-fixes).\n- media: v4l2-ctrls: Allow unknown HDR10 white point and luminance (git-fixes).\n- media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link (git-fixes).\n- media: venus: fix payload size calculation in parse_raw_formats() (git-fixes).\n- media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() (git-fixes).\n- media: vicodec: fix out-of-bounds write in FWHT encoder (git-fixes).\n- media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure (git-fixes).\n- media: vimc: fix pixel format lookup in enum_framesizes (git-fixes).\n- media: zoran: Avoid freeing a registered video_device twice (git-fixes).\n- mei: pull kvfree out of spinlock (git-fixes).\n- mfd: iqs62x: Reject zero-length firmware records (git-fixes).\n- mfd: rave-sp: validate received frame payload lengths (git-fixes).\n- misc: bcm-vk: Use acquire/release for msgq_inited (git-fixes).\n- misc: fastrpc: fix channel ctx ref leak when session alloc fails (git-fixes).\n- misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free (git-fixes).\n- misc: fastrpc: Remove buffer from list prior to unmap operation (git-fixes).\n- misc: fastrpc: take fl-\u003elock when moving mmaps on interrupted invoke (git-fixes).\n- misc: rtsx: add missing write register handling (git-fixes).\n- misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() (git-fixes).\n- mkspec-dtb: Move DTS prefix into package list.\n- mkspec-dtb: Move provides-obsoletes to package list.\n- mkspec-dtb: Put per-architecture package lists into a hash.\n- mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit (git-fixes).\n- mmc: sdhci: unmap the bounce buffer before device release (git-fixes).\n- mmc: via-sdmmc: stop card-detect handling on probe failure (git-fixes).\n- mtd: afs: validate v2 image info bounds (git-fixes).\n- mtd: mtdoops: free page bitmap when the backing MTD is removed (git-fixes).\n- mtd: mtdswap: Avoid freeing registered blktrans device twice (git-fixes).\n- mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() (git-fixes).\n- mtd: rawnand: validate ONFI extended parameter page sections (git-fixes).\n- net: mana: Add debug knob to skip TX timeout recovery reset (git-fixes).\n- net: mana: Add handler for sriov configure (bsc#1272756).\n- net: mana: Cap MSI-X vectors to the device MSI-X table size (git-fixes).\n- net: mana: Extend RX CQE coalescing up to 8 packets (git-fixes).\n- net: mana: Fall back to scattered pages for GDMA queues (git-fixes).\n- net: mana: force full-page RX buffers via ethtool private flag (bsc#1269792).\n- net: mana: refactor mana_get_strings() and mana_get_sset_count() to use switch (bsc#1269792).\n- net: mana: Route ring-buffer access through offset-based helpers (git-fixes).\n- net: tap: set skb-\u003edev before parsing virtio net header in tap_get_user_xdp() (git-fixes bsc#1274550).\n- net: thunderbolt: Count delivered packets in rx_packets and rx_bytes (git-fixes).\n- net: thunderbolt: Mark the connection down when bringing it up fails (git-fixes).\n- net: thunderbolt: Release the Rx HopID that was handed out on mismatch (git-fixes).\n- net: thunderbolt: Tear down DMA paths before stopping the rings (git-fixes).\n- net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() (git-fixes).\n- net: usb: ipheth: fix carrier_work UAF on disconnect (git-fixes).\n- nfc: digital: clamp SENSF_RES length to the destination buffer (git-fixes).\n- nfc: digital: Do not dump a NULL response in command completion (git-fixes).\n- nfc: fdp: bound the device-reported read length and fix an skb leak (git-fixes).\n- nfc: llcp: avoid userspace overflow on invalid optlen (git-fixes).\n- nfc: llcp: bound SNL TLV parsing to the skb and add length checks (git-fixes).\n- nfc: llcp: bound the connect_sn TLV walk to the skb (git-fixes).\n- nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (git-fixes).\n- nfc: llcp: read llcp_sock-\u003elocal under the socket lock in getsockopt (git-fixes).\n- nfc: llcp: reject PDUs shorter than the LLCP header (git-fixes).\n- nfc: microread: validate target discovery payload lengths (git-fixes).\n- nfc: nci: fix double completion race in nci_data_exchange_complete (git-fixes).\n- nfc: nci: fix out-of-bounds write in nci_target_auto_activated() (git-fixes).\n- nfc: nci: fix uninit-value in the RF discover/activated NTF handlers (git-fixes).\n- nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing (git-fixes).\n- nfc: nci: free destination parameters when closing a connection (git-fixes).\n- nfc: pn533: hold a reference to the request skb during send_frame (git-fixes).\n- nfc: pn533: purge fragmented skbs during cleanup (git-fixes).\n- nfc: st21nfca: validate ATR_REQ length against the received frame (git-fixes).\n- nouveau/gem: reserve the bo in the info ioctl around the vma lookup (git-fixes).\n- PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] (git-fixes).\n- PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk (git-fixes).\n- PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip (git-fixes).\n- PCI: j721e: Fix incorrect max_lanes for J7200 (git-fixes).\n- PCI: meson: Fix GPIO state while requesting PERST# (git-fixes).\n- phy: qcom: qmp-combo: Correct pre-emphasis table for QMP v4 DP PHYs (git-fixes).\n- phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend (git-fixes).\n- phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table (git-fixes).\n- phy: sunplus: fix error handling in sp_uphy_init() (git-fixes).\n- pinctrl: bcm2835: Don't remove an unregistered GPIO chip (git-fixes).\n- pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip (git-fixes).\n- pinctrl: rockchip: Reset the pin count when recalculating SoC data (git-fixes).\n- platform/chrome: cros_ec_debugfs: Clean up console log on probe failure (git-fixes).\n- platform/chrome: cros_ec_debugfs: Unregister panic notifier (git-fixes).\n- platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count (git-fixes).\n- platform/chrome: sensorhub: Bound the EC-reported sensor number (git-fixes).\n- platform/chrome: sensorhub: Fix dropped timestamp events and log spam (git-fixes).\n- platform/chrome: sensorhub: Fix memory overread in ring handler (git-fixes).\n- platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL (git-fixes).\n- platform/surface: acpi-notify: Check ACPI companion before use (git-fixes).\n- platform/x86: dell-privacy: Fix race condition (git-fixes).\n- platform/x86: dell-wmi-base: Fix resource leak on module load failure (git-fixes).\n- platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer (git-fixes).\n- platform/x86: dell-wmi-sysman: Fix instance ID bounds (git-fixes).\n- platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path (git-fixes).\n- platform/x86: ISST: Just allow 2 bits for SST feature enable (git-fixes).\n- platform/x86: ISST: Validate level in perf mask ioctls (git-fixes).\n- platform/x86: ISST: Validate logical CPU id and clos id (git-fixes).\n- platform/x86: ISST: Validate socket ID in clos_assoc ioctl (git-fixes).\n- PM: sleep: Fix off-by-one in wakelocks number limit check (git-fixes).\n- power: supply: bd99954: Drop bad register fields (git-fixes).\n- power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address (git-fixes).\n- power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address (git-fixes).\n- power: supply: bq27xxx: bq27520g4: fix REG_TTES address (git-fixes).\n- power: supply: bq256xx: drain usb_work before freeing the charger (git-fixes).\n- power: supply: bq24257: fix use-after-free on remove (git-fixes).\n- power: supply: bq25890: Fix power_supply reference leak (git-fixes).\n- power: supply: cros_usbpd-charger: bound the EC-reported port count (git-fixes).\n- power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS (git-fixes).\n- power: supply: isp1704_charger: cancel work on remove (git-fixes).\n- power: supply: lp8727: fix use-after-free in lp8727_release_irq() (git-fixes).\n- power: supply: max17040: drop incorrect I2C functionality check (git-fixes).\n- power: supply: max17040: synchronize work cancellation on suspend (git-fixes).\n- power: supply: qcom_battmgr: terminate the strings from firmware (git-fixes).\n- power: supply: rt9455: quiesce delayed work before teardown (git-fixes).\n- power: supply: sbs-battery: Use a per-device serial number buffer (git-fixes).\n- power: supply: twl4030_charger: cancel workers via devm (git-fixes).\n- power: supply: ucs1002: fix use-after-free on remove (git-fixes).\n- powercap: intel_rapl_tpmi: Handle PMU registration failure during probe (git-fixes).\n- powerpc/pseries: Ensure vpa,slb_shadow \u0026 dtl are unregistered during crash (bsc#1271256).\n- powerpc/pseries: lparcfg - fix kbuf[] underflow (bsc#1274753 ltc#221289 bsc#1274754 ltc#221288 bsc#1274752\n  ltc#221290).\n- powerpc/pseries: pci - logic bug (bsc#1274749 ltc#221282 bsc#1274755 ltc#221284 bsc#1274756 ltc#221283).\n- ppdev: prevent overflow when setting port timeout (git-fixes).\n- qede: fix out-of-bounds check for cqe-\u003elen_list (git-fixes).\n- rapidio: clear mport-\u003enet when rio_add_net() fails (git-fixes).\n- rapidio: mport_cdev: fix use-after-free in dma_req_free() (git-fixes).\n- RDMA/irdma: Remove redundant legacy_mode checks (git-fixes).\n- RDMA/mana_ib: drain QP references after partial table insertion (git-fixes).\n- RDMA/mana_ib: unify QP lookup table (git-fixes).\n- RDMA/mlx5: Fix integer overflow of user QP buffer size (git-fixes).\n- regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer (git-fixes).\n- regulator: core: use system_freezable_wq for init complete work (git-fixes).\n- regulator: devres: add API for reference voltage supplies (stable-fixes).\n- regulator: devres: fix devm_regulator_get_enable_read_voltage() return (git-fixes).\n- regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata (git-fixes).\n- regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling (git-fixes).\n- remoteproc: qcom: Fix glink-\u003enode reference leak in qcom_add_glink_subdev (git-fixes).\n- remoteproc: qcom_q6v5_adsp: Fix reference leak for device node (git-fixes).\n- remoteproc: scp: Fix device reference leak on failed lookup (git-fixes).\n- Revert \"drm/amdgpu: fix aperture mapping leak\" (git-fixes).\n- Revert \"media: v4l2-dev: fix error handling in __video_register_device()\" (git-fixes).\n- Revert \"thermal/drivers/hwmon: Cleanup coding style a bit\" (stable-fixes).\n- rpmsg: core: Fix incorrect return value documentation (git-fixes).\n- rpmsg: glink: smem: order FIFO read after availability check (git-fixes).\n- rtc: gamecube: check return value of devm_rtc_register_device() (git-fixes).\n- rtc: pcf8563: fix clock provider leak on unbind (git-fixes).\n- rtc: pcf85363: Add error checking to regmap calls in probe() (git-fixes).\n- rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers (git-fixes).\n- rtc: rzn1: Fix weekday underflow when alarm crosses month boundary (git-fixes).\n- rtc: zynqmp: Return optional clock lookup errors (git-fixes).\n- scsi: storvsc: Support manual scans for all Hyper-V targets (git-fixes).\n- sctp: avoid auth_enable sysctl UAF during netns teardown (git-fixes).\n- serial: 8250_dma: Clear stale RX state on shutdown (git-fixes).\n- serial: amba-pl011: unprepare console clock on unregister (git-fixes).\n- serial: core: clear freed pointers on uart_register_driver() failure (git-fixes).\n- serial: qcom-geni: fix TX DMA buffer flush (git-fixes).\n- serial: sc16is7xx: fix copy-paste errors in EFR_SWFLOWx_BIT constants (stable-fixes).\n- smb/client: handle overlapping allocated ranges in fallocate (bsc#1274902).\n- smb: client: reject overlapping data areas in SMB2 responses (git-fixes).\n- smb: client: require net admin for CIFS SWN netlink (bsc#1273966).\n- smb: client: resolve SWN tcon from live registrations (bsc#1273872).\n- soc: fsl: qe: check platform_driver_register() in qe_ic_of_init() (git-fixes).\n- soc: qcom: rpmh-rsc: manage PM notifiers with devres (git-fixes).\n- soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() (git-fixes).\n- software node: Fix software_node_get_reference_args() with index -1 (git-fixes).\n- soundwire: qcom: Fix port exhaustion check in stream_alloc_ports (git-fixes).\n- speakup: keyhelp: guard letter_offsets possible out-of-range indexing (git-fixes).\n- spi: img-spfi: don't disable runtime PM on DMA deferred probe (git-fixes).\n- spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers (stable-fixes).\n- spi: sprd-adi: Fix probe succeeding without registering the controller (git-fixes).\n- staging: fbtft: Use sysfs_emit_at() to print to sysfs file (git-fixes).\n- staging: media: tegra-video: vi: fix probe failure on skipped last port (git-fixes).\n- staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown (git-fixes).\n- staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() (git-fixes).\n- staging: rtl8723bs: fix missing shared-key auth challenge length check (git-fixes).\n- staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() (git-fixes).\n- staging: rtl8723bs: fix OOB read in WMM_param_handler() (git-fixes).\n- staging: rtl8723bs: use kfree_sensitive() for key material (git-fixes).\n- staging: rtl8723bs: validate monitor transmit frame lengths (git-fixes).\n- staging: sm750fb: gate dualview dataflow using g_dualview (git-fixes).\n- thermal/drivers/imx: Disable clock on runtime resume failure (git-fixes).\n- thermal/drivers/qoriq: Disable clock on resume failure (git-fixes).\n- thermal: intel: int3400: clean up ODVP on probe failures (git-fixes).\n- thunderbolt: Bound the DROM dual link port number before indexing sw-\u003eports (git-fixes).\n- thunderbolt: icm: Preserve USB4 proxy data-valid bit (git-fixes).\n- tlclk: if sscanf() fails, fall back to 0, not random value (git-fixes).\n- tpm: st33zp24: Return zero on status read failure (git-fixes).\n- tpm: st33zp24: Validate locality read result (git-fixes).\n- tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout (git-fixes).\n- tty: clear cdev pointer after cdev_add() failure (git-fixes).\n- tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 (git-fixes).\n- tty: skip cdev_del() when no cdev is registered (git-fixes).\n- uio: Fix stale info pointer in failed registration path (git-fixes).\n- usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() (git-fixes).\n- usb: atm: usbatm: fix invalid ci_range initialization (git-fixes).\n- USB: c67x00: fix use-after-free in c67x00_add_iso_urb() (git-fixes).\n- usb: cdnsp: fix incorrect endian conversions for APB timeout register (git-fixes).\n- usb: dwc2: add missing @remotewakeup kernel-doc parameter (git-fixes).\n- usb: dwc2: gadget: Exit partial power down state when changing USB pull-up (git-fixes).\n- usb: gadget: configfs: fix out-of-bounds read of qw_sign (git-fixes).\n- usb: gadget: f_fs: Prevent deadlock during ep0 read loop (git-fixes).\n- usb: gadget: f_ncm: Use unsigned int for ndp_index (git-fixes).\n- usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() (git-fixes).\n- usb: gadget: f_uac1_legacy: remove broken string configfs attributes (git-fixes).\n- usb: gadget: pch_udc: remove excess kernel-doc member for registered (git-fixes).\n- usb: gadget: r8a66597: avoid double free of ep0_req in probe error path (git-fixes).\n- usb: gadget: snps_udc_plat: clean up PHY on probe deferral (git-fixes).\n- usb: gadget: u_audio: Fix use-after-free on sound card disconnect (git-fixes).\n- usb: gadget: uac: validate rate list length before storing (git-fixes).\n- usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() (git-fixes).\n- usb: mtu3: allow system suspend during active gadget connection (git-fixes).\n- usb: musb: omap2430: clean up probe error handling (stable-fixes).\n- USB: phy: fsl-usb: fix missing static keywords (git-fixes).\n- usb: renesas_usbhs: Fix power-off ordering on unbind (git-fixes).\n- USB: serial: digi_acceleport: fix port registration order (git-fixes).\n- USB: serial: ftdi_sio: add support for E+H FXA291 (stable-fixes).\n- USB: serial: option: add TDTECH MT5710-CN (stable-fixes).\n- USB: serial: option: fix slab OOB read in interrupt URB callback (git-fixes).\n- USB: serial: spcp8x5: drop broken carrier detect support (git-fixes).\n- USB: storage: add NO_ATA_1X quirk for Longmai USB Key (stable-fixes).\n- usb: typec: ucsi: unregister debugfs entries on teardown (git-fixes).\n- usb: usbfs: fix use-after-free of usb_device in usbdev_release() (git-fixes).\n- usb: xhci: Handle USB3 port events when there is one roothub (git-fixes).\n- vt: add permission check for KDSKBMETA ioctl (stable-fixes).\n- vt: stabilize tty reference in kbd_keycode with tty_port_tty_get (stable-fixes).\n- w1: ds28e17: reject an oversize length on an I2C block read (git-fixes).\n- w1: ds2482: Fix signedness bug in ds2482_w1_triplet() (git-fixes).\n- wifi: ath6kl: avoid buffer overreads in WMI event handlers (git-fixes).\n- wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets (git-fixes).\n- wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump (git-fixes).\n- wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() (git-fixes).\n- wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate (git-fixes).\n- wifi: ath11k: Correctly copy the hint BSSID in WMI scan request (git-fixes).\n- wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx() (git-fixes).\n- wifi: ath12k: Correctly copy the hint BSSID in WMI scan request (git-fixes).\n- wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() (git-fixes).\n- wifi: brcmfmac: fix P2P action frame handling without device vif (git-fixes).\n- wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs (git-fixes).\n- wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments (git-fixes).\n- wifi: iwlwifi: mei: pass correct argument to function (git-fixes).\n- wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser (git-fixes).\n- wifi: mac80211: send TWT teardown to peer after setup TX failure (git-fixes).\n- wifi: mac80211: skip default WMM setup for AP_VLAN links (git-fixes).\n- wifi: mac80211: skip unused probe response countdown offsets (git-fixes).\n- wifi: mt76: fix 4th chain ACK RSSI bitmask in sta_poll (git-fixes).\n- wifi: mt76: fix ER-SU 106-tone RU check in RX rate decode (git-fixes).\n- wifi: mt76: fix HE DCM max-RU capability encoding (git-fixes).\n- wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length (git-fixes).\n- wifi: mt76: mt792x: Fix memory leak in SDIO TX path (git-fixes).\n- wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex (git-fixes).\n- wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss (git-fixes).\n- wifi: mt76: mt7915: fix double hif2 init on the non-WED path (git-fixes).\n- wifi: mt76: mt7915: fix ext PHY use-after-free on register error path (git-fixes).\n- wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986 (git-fixes).\n- wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie (git-fixes).\n- wifi: mt76: mt7915: release hif2 reference on probe IRQ failure (git-fixes).\n- wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement (git-fixes).\n- wifi: mt76: mt7915: unwind state on add_interface failure (git-fixes).\n- wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields (git-fixes).\n- wifi: mt76: mt7915: write RX header translation bit to the correct register (git-fixes).\n- wifi: mt76: mt7921: validate CLC firmware records (git-fixes).\n- wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb (git-fixes).\n- wifi: mt76: mt7925: fix msg len mismatch between driver and firmware (git-fixes).\n- wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config (git-fixes).\n- wifi: mt76: mt7996: don't report a zero TX bitrate (git-fixes).\n- wifi: mt76: mt7996: fix reg addr remap when addr is 0 (git-fixes).\n- wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV (git-fixes).\n- wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset (git-fixes).\n- wifi: mt76: mt7996: validate RX band_idx before dereferencing phys (git-fixes).\n- wifi: mt76: report data NSS for STBC frames in RX rate decode (git-fixes).\n- wifi: mwifiex: Detach sync cmd buffer on interrupted wait (git-fixes).\n- wifi: rtlwifi: pci: fix error path in rtl_pci_probe() (git-fixes).\n- wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() (git-fixes).\n- wifi: rtw89: fix HE extended capability length check (git-fixes).\n- wifi: zd1211rw: reject secondary interfaces to prevent conflicts (git-fixes).\n- x86/bugs: Clarify that syscall hardening isn't a BHI mitigation (git-fixes).\n- xhci: dbgtty: Fix unregister on tty_alloc_driver() failure (git-fixes).\n- xhci: dbgtty: Fix unregister on tty_register_driver() failure (git-fixes).\n","status":"published","published":"2026-09-08T12:54:32Z","modified":"2026-09-14T18:23:16.721468657Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23481-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1269731).\n- CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).\n- CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).\n- CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).\n- CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).\n- CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).\n- CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).\n- CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).\n- CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).\n- CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).\n- CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).\n- CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).\n- CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).\n- CVE-2026-43278: dm: clear cloned request bio pointer when last clone bio completes (bsc#1264584).\n- CVE-2026-43319: spi: spidev: fix lock inversion between spi_lock and buf_lock (bsc#1264788).\n- CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).\n- CVE-2026-43416: powerpc, perf: Check that current-\u003emm is alive before getting user callchain (bsc#1265121).\n- CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).\n- CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).\n- CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).\n- CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).\n- CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).\n- CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).\n- CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).\n- CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).\n- CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).\n- CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).\n- CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).\n- CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).\n- CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).\n- CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).\n- CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).\n- CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).\n- CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).\n- CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).\n- CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).\n- CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).\n- CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).\n- CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).\n- CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).\n- CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).\n- CVE-2026-53094: bpf: Fix stale offload-\u003eprog pointer after constant blinding (bsc#1269965).\n- CVE-2026-53096: bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path (bsc#1269969).\n- CVE-2026-53110: selftests/bpf: Add ASSERT_OK_FD macro (bsc#1269985).\n- CVE-2026-53111: bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap (bsc#1269167).\n- CVE-2026-53126: blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() (bsc#1269635).\n- CVE-2026-53154: mm/hugetlb: restore reservation on error in hugetlb folio copy paths (bsc#1269665).\n- CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (bsc#1269306).\n- CVE-2026-53207: mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison (bsc#1269590).\n- CVE-2026-53219: netfilter: x_tables: avoid leaking percpu counter pointers (bsc#1269686).\n- CVE-2026-53220: netfilter: revalidate bridge ports (bsc#1269381).\n- CVE-2026-53223: net: guard timestamp cmsgs to real error queue skbs (bsc#1269301).\n- CVE-2026-53228: ipv6: sit: reload inner IPv6 header after GSO offloads (bsc#1269256).\n- CVE-2026-53238: netlabel: validate unlabeled address and mask attribute lengths (bsc#1269774).\n- CVE-2026-53260: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req() (bsc#1269731) \t  \n- CVE-2026-53264: net/sched: act_api: use RCU with deferred freeing for action lifecycle (bsc#1269238).\n- CVE-2026-53269: netfilter: synproxy: add mutex to guard hook reference counting (bsc#1269579).\n- CVE-2026-53273: tee: optee: prevent use-after-free when the client exits before the supplicant (bsc#1269713).\n- CVE-2026-53309: ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison (bsc#1269815).\n- CVE-2026-53330: drm/amd/display: Fix out-of-bounds read in (bsc#1270090).\n- CVE-2026-53336: nvmem: layouts: onie-tlv: fix hang on unknown types (bsc#1270108).\n- CVE-2026-53337: net: bonding: fix NULL pointer dereference in bond_do_ioctl() (bsc#1270251).\n- CVE-2026-53353: hsr: Remove WARN_ONCE() in hsr_addr_is_self() (bsc#1270111).\n- CVE-2026-53365: vsock/virtio: fix zerocopy completion for multi-skb sends (bsc#1271365).\n- CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830).\n- CVE-2026-63801: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (bsc#1272230).\n- CVE-2026-63808: exfat: fix potential use-after-free in exfat_find_dir_entry() (bsc#1272260).\n- CVE-2026-63810: block: Avoid mounting the bdev pseudo-filesystem in userspace (bsc#1272297).\n- CVE-2026-63823: keys: Pin request_key_auth payload in instantiate paths (bsc#1272182).\n- CVE-2026-63827: apparmor: fix use-after-free in rawdata dedup loop (bsc#1272179).\n- CVE-2026-63828: apparmor: mediate the implicit connect of TCP fast open sendmsg (bsc#1272175).\n- CVE-2026-63860: RDMA/core: Prefer NLA_NUL_STRING (bsc#1272429).\n- CVE-2026-63865: bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks (bsc#1272486).\n- CVE-2026-63868: net: garp: fix unsigned integer underflow in garp_pdu_parse_attr (bsc#1272497).\n- CVE-2026-63879: drm/amdgpu: fix amdgpu_hmm_range_get_pages (bsc#1272569).\n- CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).\n- CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272385).\n- CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272390).\n- CVE-2026-63889: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (bsc#1272423).\n- CVE-2026-63891: thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() (bsc#1272641).\n- CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1272877).\n- CVE-2026-63925: macsec: fix replay protection at XPN lower-PN wrap (bsc#1273008).\n- CVE-2026-63926: bpf: sockmap: fix tail fragment offset in bpf_msg_push_data (bsc#1273019).\n- CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1272662).\n- CVE-2026-63969: ipv6: fix possible infinite loop in rt6_fill_node() (bsc#1272484).\n- CVE-2026-63970: vsock/virtio: bind uarg before filling zerocopy skb (bsc#1272673).\n- CVE-2026-63980: net/handshake: Use spin_lock_bh for hn_lock (bsc#1273028).\n- CVE-2026-63985: ethtool: eeprom: add more safeties to EEPROM Netlink fallback (bsc#1272963).\n- CVE-2026-63990: bonding: refuse to enslave CAN devices (bsc#1273027).\n- CVE-2026-63992: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (bsc#1272868).\n- CVE-2026-63999: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure (bsc#1273038).\n- CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273030).\n- CVE-2026-64001: ALSA: pcm: oss: Fix setup list UAF on proc write error (bsc#1273734).\n- CVE-2026-64002: ipv4: free net-\u003eipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (bsc#1273774).\n- CVE-2026-64004: net/iucv: fix locking in .getsockopt (bsc#1273804).\n- CVE-2026-64005: net/smc: Do not re-initialize smc hashtables (bsc#1273831).\n- CVE-2026-64006: netfilter: nf_tables: fix dst corruption in same register operation (bsc#1273834).\n- CVE-2026-64007: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (bsc#1273105).\n- CVE-2026-64010: nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (bsc#1273882).\n- CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1273891).\n- CVE-2026-64015: security/keys: fix missed RCU read section on lookup (bsc#1273762).\n- CVE-2026-64029: ALSA: seq: Serialize UMP output teardown with event_input (bsc#1273766).\n- CVE-2026-64047: net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (bsc#1273060).\n- CVE-2026-64048: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (bsc#1273484).\n- CVE-2026-64052: block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user() (bsc#1272983).\n- CVE-2026-64073: irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT (bsc#1273490).\n- CVE-2026-64098: drm/virtio: use uninterruptible resv lock for plane updates (bsc#1273488).\n- CVE-2026-64102: RDMA/siw: Reject MPA FPDU length underflow before signed receive math (bsc#1272516).\n- CVE-2026-64109: af_unix: Peek the queue synchronized (bsc#1273748).\n- CVE-2026-64112: rbd: eliminate a race in lock_dwork draining on unmap (bsc#1273741).\n- CVE-2026-64113: ixgbevf: fix use-after-free in VEPA multicast source pruning (bsc#1272262).\n- CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl \u003c 5 (bsc#1273742).\n- CVE-2026-64115: vsock/vmci: fix UAF when peer resets connection during handshake (bsc#1273745).\n- CVE-2026-64118: qed: fix double free in qed_cxt_tables_alloc() (bsc#1273749).\n- CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273743).\n- CVE-2026-64125: net: bcmgenet: keep RBUF EEE/PM disabled (bsc#1272346).\n- CVE-2026-64131: mm/memory: fix spurious warning when unmapping device-private/exclusive pages (bsc#1274063).\n- CVE-2026-64148: pds_core: check health in devcmd wait (bsc#1273956).\n- CVE-2026-64164: btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() (bsc#1273957).\n- CVE-2026-64185: sysfs: don't remove existing directory on update failure (bsc#1272200).\n- CVE-2026-64188: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() (bsc#1272150).\n- CVE-2026-64190: net: team: fix NULL pointer dereference in team_xmit during mode change (bsc#1272210).\n- CVE-2026-64192: bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized (bsc#1272213).\n- CVE-2026-64214: powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise()\n  (bsc#1272799).\n- CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272798).\n- CVE-2026-64222: octeontx2-pf: avoid double free of pool-\u003estack on AQ init failure (bsc#1272788).\n- CVE-2026-64225: octeontx2-af: CGX: add bounds check to cgx_speed_mbps index (bsc#1272786).\n- CVE-2026-64245: fbdev: modedb: fix a possible UAF in fb_find_mode() (bsc#1273905).\n- CVE-2026-64268: RDMA/siw: bound Read Response placement to the RREAD length (bsc#1273276).\n- CVE-2026-64286: KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU (bsc#1274058).\n- CVE-2026-64287: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (bsc#1273325).\n- CVE-2026-64294: mm: do file ownership checks with the proper mount idmap (bsc#1273525).\n- CVE-2026-64296: exfat: bound uniname advance in exfat_find_dir_entry() (bsc#1273975).\n- CVE-2026-64304: crypto: qat - validate RSA CRT component lengths (bsc#1273944).\n- CVE-2026-64312: crypto: pcrypt - restore callback for non-parallel fallback (bsc#1273968).\n- CVE-2026-64315: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1274028).\n- CVE-2026-64316: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1273598).\n- CVE-2026-64317: isofs: bound Rock Ridge symlink components to the SL record (bsc#1273936).\n- CVE-2026-64322: udf: validate sparing table length as an entry count, not a byte count (bsc#1273958).\n- CVE-2026-64323: udf: validate VAT header length against the VAT inode size (bsc#1273305).\n- CVE-2026-64355: bpf: Reject fragmented frames in devmap (bsc#1273422).\n- CVE-2026-64375: proc: protect ptrace_may_access() with exec_update_lock (FD links) (bsc#1273868).\n- CVE-2026-64378: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (bsc#1273603).\n- CVE-2026-64381: smb: client: Fix next buffer leak in receive_encrypted_standard() (bsc#1273860).\n- CVE-2026-64382: smb: client: fix double-free in SMB2_open() replay (bsc#1273291).\n- CVE-2026-64383: smb: client: fix double-free in SMB2_flush() replay (bsc#1273426).\n- CVE-2026-64384: smb: client: fix change notify replay double-free (bsc#1274541).\n- CVE-2026-64385: smb: client: fix double-free in SMB2_ioctl() replay (bsc#1274539).\n- CVE-2026-64386: smb: client: fix query_info() replay double-free (bsc#1274543).\n- CVE-2026-64387: smb: client: fix query directory replay double-free (bsc#1274545).\n- CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).\n- CVE-2026-64411: netfilter: ebtables: terminate table name before find_table_lock() (bsc#1274077).\n- CVE-2026-64412: netfilter: ebtables: module names must be null-terminated (bsc#1273780).\n- CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction (bsc#1274274).\n- CVE-2026-64434: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref (bsc#1273880).\n- CVE-2026-64436: net: af_key: initialize alg_key_len for IPComp states (bsc#1274277).\n- CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).\n- CVE-2026-64450: tipc: fix out-of-bounds read in broadcast Gap ACK blocks (bsc#1273523).\n- CVE-2026-64463: usb: typec: tcpci_rt1711h: unregister TCPCI port with devres (bsc#1273273).\n- CVE-2026-64472: vfio/mlx5: Fix racy bitfields and tighten struct layout (bsc#1274075).\n- CVE-2026-64481: ALSA: hda/cs35l41: Fix firmware load work teardown (bsc#1274547).\n- CVE-2026-64537: bridge: cfm: reject invalid CCM interval at configuration time (bsc#1273289).\n- CVE-2026-64538: ipv6: Fix null-ptr-deref in fib6_nh_mtu_change() (bsc#1273335).\n- CVE-2026-64541: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (bsc#1273303).\n- CVE-2026-64543: tipc: fix use-after-free of the discoverer in tipc_disc_rcv() (bsc#1273311).\n- CVE-2026-64545: net, bpf: check master for NULL in xdp_master_redirect() (bsc#1273318).\n- CVE-2026-64548: bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() (bsc#1273337).\n- CVE-2026-64551: sctp: validate STALE_COOKIE cause length before reading staleness (bsc#1273813).\n- CVE-2026-64552: virtio-net: fix len check in receive_big() (bsc#1273323).\n- CVE-2026-64553: net: psample: fix info leak in PSAMPLE_ATTR_DATA (bsc#1273336).\n- CVE-2026-64554: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() (bsc#1273340).\n- CVE-2026-64562: KVM: nVMX: Hide shadow VMCS right after VMCLEAR (bsc#1273930).\n- CVE-2026-64563: rhashtable: clear stale iter-\u003ep on table restart (bsc#1273995).\n- CVE-2026-64567: btrfs: reject free space cache with more entries than pages (bsc#1274006).\n- CVE-2026-64572: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (bsc#1274014).\n- CVE-2026-64576: nexthop: initialize extack in nh_res_bucket_migrate() (bsc#1274030).\n- CVE-2026-64577: gtp: check skb_pull_data() return in gtp1u_send_echo_resp() (bsc#1274031).\n- CVE-2026-64581: xfrm: fix sk_dst_cache double-free in xfrm_user_policy() (bsc#1274041).\n- CVE-2026-64582: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (bsc#1274040).\n- CVE-2026-64593: btrfs: do not trim a device which is not writeable (bsc#1274497).\n- CVE-2026-64597: smb: client: fix double-free in SMB2_close() replay (bsc#1274297).\n- CVE-2026-64598: smb/client: Fix error code in smb2_aead_req_alloc() (bsc#1274298).\n- CVE-2026-68081: KVM: nVMX: Add helper to put (unmap) vmcs12 pages (bsc#1274580).\n- CVE-2026-68082: libceph: fix two unsafe bare decodes in decode_lockers() (bsc#1274581).\n- CVE-2026-68086: mm/khugepaged: write all dirty file folios when collapsing (bsc#1274713).\n- CVE-2026-68116: vxlan: mdb: Fix source list corruption on a failed replace (bsc#1274876).\n- CVE-2026-68117: tipc: clear sock-\u003esk on the failed-insert path in tipc_sk_create() (bsc#1274881).\n- CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1274888).\n- CVE-2026-68123: openvswitch: fix GSO userspace truncation underflow (bsc#1275169).\n- CVE-2026-68127: ila: reload IPv6 header after pskb_may_pull in checksum adjust (bsc#1275237).\n- CVE-2026-68129: gve: fix Rx queue stall on alloc failure (bsc#1275517).\n- CVE-2026-68132: super: fix emergency thaw deadlock on frozen block devices (bsc#1275553).\n- CVE-2026-68136: net: gro: fix double aggregation of flush-marked skbs (bsc#1275474).\n- CVE-2026-68138: net/sched: serialize qdisc_rtab_list against concurrent get/put (bsc#1274941).\n- CVE-2026-68139: net/mlx5e: Use sender devcom for MPV master-up (bsc#1275578).\n- CVE-2026-68142: geneve: require CAP_NET_ADMIN in the device netns for changelink (bsc#1275582).\n- CVE-2026-68143: net: slip: serialize receive against buffer reallocation (bsc#1275583).\n- CVE-2026-68145: iomap: fix out-of-bounds bitmap_set() with zero-length range (bsc#1275584).\n- CVE-2026-68149: fs: preserve ACL_DONT_CACHE state in forget_cached_acl() (bsc#1275294).\n- CVE-2026-68153: libceph: remove debugfs files before client teardown (bsc#1275301).\n- CVE-2026-68154: libceph: reject zero bucket types in crush_decode (bsc#1275303).\n- CVE-2026-68155: libceph: Reject monmaps advertising zero monitors (bsc#1275304).\n- CVE-2026-68156: libceph: refresh auth-\u003eauthorizer_buf{,_len} after authorizer update (bsc#1275305).\n- CVE-2026-68157: libceph: guard missing CRUSH type name lookup (bsc#1275306).\n- CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1275307).\n- CVE-2026-68159: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (bsc#1275470).\n- CVE-2026-68160: ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() (bsc#1275472).\n- CVE-2026-68161: sctp: close UDP tunnel sockets during netns teardown (bsc#1274892).\n- CVE-2026-68166: userfaultfd: prevent registration of special VMAs (bsc#1274930).\n- CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275161).\n- CVE-2026-68205: media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() (bsc#1274934).\n- CVE-2026-68238: drm/amdgpu: Release VFCT ACPI table reference (bsc#1275704).\n- CVE-2026-68247: drm/i915/bios: range check LFP Data Block panel_type2 (bsc#1275817).\n- CVE-2026-68254: drm/i915/vrr: require valid min/max vfreq for VRR (bsc#1275150).\n- CVE-2026-68284: bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() (bsc#1275970).\n- CVE-2026-68286: drop_monitor: perform u64_stats updates under IRQ-disabled section (bsc#1275973).\n- CVE-2026-68288: net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD (bsc#1275975).\n- CVE-2026-68289: tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() (bsc#1275976).\n- CVE-2026-68293: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (bsc#1275091).\n- CVE-2026-68297: tipc: fix u16 MTU truncation in media and bearer MTU validation (bsc#1275040).\n- CVE-2026-68299: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (bsc#1275088).\n- CVE-2026-68300: sctp: auth: verify auth requirement when auth_chunk is NULL (bsc#1275083).\n- CVE-2026-68312: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (bsc#1274663).\n- CVE-2026-68313: tipc: fix infinite loop in __tipc_nl_compat_dumpit (bsc#1274665).\n- CVE-2026-68315: sctp: validate stream count in sctp_process_strreset_inreq() (bsc#1274662).\n- CVE-2026-68320: sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid (bsc#1274659).\n- CVE-2026-68322: rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled (bsc#1274656).\n- CVE-2026-68324: iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() (bsc#1274649).\n- CVE-2026-68325: iommu/amd: Bound the early ACPI HID map (bsc#1274651).\n- CVE-2026-68328: nfp: Check resource mutex allocation (bsc#1274646).\n- CVE-2026-68329: iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() (bsc#1274645).\n- CVE-2026-68331: dpaa2-eth: put MAC endpoint device on disconnect (bsc#1274642).\n- CVE-2026-68333: dpaa2-switch: put MAC endpoint device on disconnect (bsc#1274644).\n- CVE-2026-68335: rds: drop incoming messages that cross network namespace boundaries (bsc#1274640).\n- CVE-2026-68336: bonding: fix devconf_all NULL dereference when IPv6 is disabled (bsc#1274639).\n- CVE-2026-68343: smb: client: validate DFS referral PathConsumed (bsc#1274629).\n- CVE-2026-68377: net/sched: act_tunnel_key: Defer dst_release to RCU callback (bsc#1274831).\n- CVE-2026-68386: bpf, sockmap: Reject unhashed UDP sockets on sockmap update (bsc#1274814).\n- CVE-2026-68397: net/iucv: take a reference on the socket found in afiucv_hs_rcv() (bsc#1274898).\n- CVE-2026-68398: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF (bsc#1274908).\n- CVE-2026-68408: wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (bsc#1274709).\n- CVE-2026-68417: RDMA/siw: publish QP after initialization (bsc#1274696).\n- CVE-2026-68418: RDMA/irdma: Prevent user-triggered null deref on QP create (bsc#1274690).\n- CVE-2026-68419: RDMA/irdma: Prevent rereg_mr for non-mem regions (bsc#1274698).\n- CVE-2026-68422: btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() (bsc#1274706).\n- CVE-2026-68425: IB/mad: Drop unmatched RMPP responses before reassembly (bsc#1274700).\n- CVE-2026-68426: xfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment (bsc#1274705).\n- CVE-2026-68432: vxlan: require CAP_NET_ADMIN in the device netns for changelink (bsc#1274800).\n- CVE-2026-68433: libceph: bound get_version reply decode to front len (bsc#1274801).\n- CVE-2026-68450: btrfs: free mapping node on duplicate reloc root insert (bsc#1274834).\n- CVE-2026-68470: wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (bsc#1276500).\n- CVE-2026-68480: x86/bugs: Make Safe-RET robust against interrupt injection (bsc#1274208).\n- CVE-2026-72020: ipvs: reset full ip_vs_seq structs in ip_vs_conn_new (bsc#1275506).\n- CVE-2026-72035: net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1276961).\n- CVE-2026-72036: net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1277034).\n- CVE-2026-72069: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (bsc#1275528).\n- CVE-2026-72072: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (bsc#1277155).\n- CVE-2026-72083: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (bsc#1275535).\n- CVE-2026-72084: scsi: target: Bound PR-OUT TransportID parsing to the received buffer (bsc#1275540).\n- CVE-2026-72123: can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (bsc#1277523).\n- CVE-2026-72132: NFS: Charge unstable writes by request size, not folio size (bsc#1277551).\n- CVE-2026-72221: sunrpc: wait for in-flight TLS handshake callback when cancel loses race (bsc#1275665).\n- CVE-2026-72222: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (bsc#1275669).\n- CVE-2026-72251: netfilter: nf_nat_sip: reload possible stale data pointer (bsc#1275827).\n- CVE-2026-72254: netfilter: nft_fib: reject fib expression on the netdev egress hook (bsc#1277204).\n- CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (bsc#1277678).\n- CVE-2026-72288: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (bsc#1275886).\n- CVE-2026-72289: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (bsc#1275905).\n- CVE-2026-72296: net: ife: require ETH_HLEN to be pullable in ife_decode() (bsc#1275923).\n- CVE-2026-72307: mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() (bsc#1277160).\n- CVE-2026-72308: mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() (bsc#1277159).\n- CVE-2026-72317: SUNRPC: pin upper rpc_clnt across the TLS connect_worker (bsc#1275925).\n- CVE-2026-72341: net/mlx5e: Fix publication race for priv-\u003echannel_stats[] (bsc#1277660).\n- CVE-2026-72342: net/mlx5e: Fix HV VHCA stats agent registration race (bsc#1277775).\n- CVE-2026-72343: net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation (bsc#1277776).\n- CVE-2026-72389: bridge: stp: Fix a potential use-after-free when deleting a bridge (bsc#1273869).\n- CVE-2026-72463: xfrm: Fix dev use-after-free in xfrm async resumption (bsc#1268276 bsc#1277064).\n- CVE-2026-72464: xprtrdma: Remove temp allocation of rpcrdma_rep objects (bsc#1277069).\n- CVE-2026-72466: xprtrdma: Fix bcall rep leak and unbounded peek (bsc#1277057).\n- CVE-2026-72467: xprtrdma: Check frwr_wp_create() during connect (bsc#1277059).\n- CVE-2026-72469: xprtrdma: Fix ep kref imbalance on ADDR_CHANGE (bsc#1277047).\n- CVE-2026-72473: xprtrdma: Avoid 250 ms delay on backlog wakeup (bsc#1277037).\n- CVE-2026-72494: RDMA/irdma: Replace waitqueue and flag with completion (bsc#1276941).\n- CVE-2026-72495: RDMA/bnxt_re: Avoid repeated requests to allocate WC pages (bsc#1276937).\n- CVE-2026-72496: RDMA/bnxt_re: Proper rollback if the ioremap fails (bsc#1276943).\n- CVE-2026-72499: RDMA/bnxt_re: Free CQ toggle page after firmware teardown (bsc#1276551).\n- CVE-2026-72501: RDMA/bnxt_re: Initialize dpi variable to zero (bsc#1276546).\n- CVE-2026-72502: tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) (bsc#1276542).\n- CVE-2026-74269: bnxt: fix head underflow on XDP head-grow (bsc#1276507).\n- CVE-2026-74296: RDMA/mlx5: Release the HW-provided UAR index rather than the SW one (bsc#1276452).\n- CVE-2026-74297: RDMA/mlx5: Fix undefined shift of user RQ WQE size (bsc#1276446).\n- CVE-2026-74318: btrfs: fix deadlock cloning inline extent when using flushoncommit (bsc#1276864).\n- CVE-2026-74321: btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() (bsc#1277202).\n- CVE-2026-74334: RDMA/nldev: Fix locking when accessing mr-\u003epd (bsc#1277095).\n- CVE-2026-74345: RDMA/siw: Fix endpoint/socket association handling (bsc#1277285).\n- CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277408).\n- CVE-2026-74395: RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference (bsc#1277077).\n- CVE-2026-74454: drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO (bsc#1277073).\n- CVE-2026-74474: vxlan: use pskb_network_may_pull() for transmit path header pulls (bsc#1276335).\n- CVE-2026-74481: mm/page_reporting: use system_freezable_wq to fix UAF during suspend (bsc#1276355).\n- CVE-2026-74482: mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios (bsc#1276346).\n- CVE-2026-74488: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (bsc#1276350).\n- CVE-2026-74495: igbvf: Fix leak in TX DMA error cleanup (bsc#1275864).\n- CVE-2026-74496: fou: Fix use-after-free in fou_create() (bsc#1275867).\n- CVE-2026-74509: Bluetooth: hci_sync: Fix advertising data UAFs (bsc#1275946).\n- CVE-2026-74510: Bluetooth: mgmt: fix UAF in pair command cancellation (bsc#1275950).\n- CVE-2026-74512: audit: fix potential use-after-free in audit_del_rule() (bsc#1275954).\n- CVE-2026-74516: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (bsc#1275797).\n- CVE-2026-74518: mm/hugetlb: fix list corruption in allocate_file_region_entries() (bsc#1275798).\n- CVE-2026-74527: octeontx2-af: Block VFs from clobbering special CGX PKIND state (bsc#1275805).\n- CVE-2026-74537: Bluetooth: ISO: hold sk properly in iso_conn_ready (bsc#1275687).\n- CVE-2026-74548: forcedeth: fix UAF of txrx_stats in nv_remove (bsc#1275695).\n- CVE-2026-74550: net: do not send ICMP/NDISC Redirects when peer allocation fails (bsc#1275688).\n- CVE-2026-74556: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (bsc#1275696).\n- CVE-2026-74563: rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() (bsc#1275574).\n- CVE-2026-74566: keys: make keyring key-chunk byte order agree with keyring_diff_objects() (bsc#1275566).\n- CVE-2026-74567: keys: fix out-of-bounds read in keyring_get_key_chunk() (bsc#1275569).\n- CVE-2026-74571: btrfs: skip global block reserve accounting for rescue mounts (bsc#1275561).\n- CVE-2026-74581: net: ipv6: clear suppressed fib6 rule result (bsc#1275782).\n- CVE-2026-74582: packet: use consistent hard_header_len in non-ring send paths (bsc#1275784).\n- CVE-2026-74584: RDMA/bnxt_re: zero shared page before exposing to userspace (bsc#1277066).\n- CVE-2026-74610: tls: don't leave a full plaintext sk_msg ring unpushed (bsc#1277054).\n- CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277391).\n- CVE-2026-74692: net/smc: fix TOCTOU race between smc_listen_out() and listener close (bsc#1276927).\n- CVE-2026-74694: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length (bsc#1277625).\n- CVE-2026-74695: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() (bsc#1276931).\n- CVE-2026-74717: net/mlx5: fw_tracer, return NULL on create error (bsc#1276569).\n- CVE-2026-74722: btrfs: fix memory leak in btrfs_do_encoded_write() (bsc#1276561).\n- CVE-2026-80529: xfs: don't swallow dquot recovery verification errors (bsc#1277688).\n- CVE-2026-80534: xfs: fix ilock leak on error in xfs_dq_get_next_id (bsc#1277022).\n- CVE-2026-80590: inet: frags: strip GSO state from fragments before reassembly (bsc#1277275).\n- CVE-2026-80654: soc: xilinx: Shutdown and free rx mailbox channel (bsc#1277516).\n\nThe following non security issues were fixed:\n\n- accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() (git-fixes).\n- accessibility: speakup: unregister tty ldisc on later init failures (git-fixes).\n- ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer (git-fixes).\n- ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root (git-fixes).\n- ACPI: pfr_update: fix stack buffer overflow in query_capability() (git-fixes).\n- ACPI: processor: idle: Expand _LPI package sanity checks (git-fixes).\n- ACPI: processor: validate MADT IOAPIC entry bounds (git-fixes).\n- ACPI: scan: fix bus ID cleanup on device_add() failures (git-fixes).\n- ACPI: video: Release PCI device reference after lookup (git-fixes).\n- add my missing Reviewed-by: tag.\n- ALSA: 6fire: bound the MIDI event length from the device (git-fixes).\n- ALSA: 6fire: Fix UAF at error handling during probe (stable-fixes).\n- ALSA: bcd2000: clear the URB pointers on disconnect (git-fixes).\n- ALSA: core: Fix use-after-free in snd_card_do_free() (git-fixes).\n- ALSA: dummy: Check card index validity at probe (stable-fixes).\n- ALSA: hda/ext: preserve PPLCCTL bits when clearing reset (git-fixes).\n- ALSA: hda: Fix connection list comparison in proc output (git-fixes).\n- ALSA: hpi: Check transport errors during HPI6000 adapter initialization (git-fixes).\n- ALSA: pcxhr: initialize mutexes before requesting threaded IRQ (git-fixes).\n- ALSA: seq: midi: Optimize event_input locking with RCU (git-fixes).\n- ALSA: seq: midi: Serialize input teardown with event_input (git-fixes).\n- ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion (git-fixes).\n- ALSA: usb-audio: Complete cleanup after system-resume errors (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() (git-fixes).\n- ALSA: usb-audio: fix OOB write on Type II inbound URBs (git-fixes).\n- ALSA: usb: Fix UAF at delayed release of MIDI2 EPs (git-fixes).\n- ALSA: usx2y: bound the hwdep mmap fault offset (git-fixes).\n- ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() (git-fixes).\n- apparmor: advertise the tcp fast open fix is applied (git-fixes).\n- ASoC: adau1761: sort the register default table (git-fixes).\n- ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC (git-fixes).\n- ASoC: apple: mca: increase SERDES reset delay (git-fixes).\n- ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses (git-fixes).\n- ASoC: cs35l33: drain threaded IRQ before runtime suspend (git-fixes).\n- ASoC: cs35l34: drain threaded IRQ before runtime suspend (git-fixes).\n- ASoC: cs35l41: sort the register default table (git-fixes).\n- ASoC: cs35l45: sort the register default table (git-fixes).\n- ASoC: cs4265: sort the register default table (git-fixes).\n- ASoC: cx2072x: sort the register default table (git-fixes).\n- ASoC: dapm: Fix off-by-one check on the second enum channel (git-fixes).\n- ASoC: fix unmet dependencies on PPC_BESTCOMM and SND_SOC_AC97_BUS (git-fixes).\n- ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready (git-fixes).\n- ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure (git-fixes).\n- ASoC: fsl_audmix: rework runtime PM handling in probe (git-fixes).\n- ASoC: fsl_easrc: sort the register default table (git-fixes).\n- AsoC: intel: sst: fix PCI device reference leak on probe failure (git-fixes).\n- ASoC: max9860: sort the register default table (git-fixes).\n- ASoC: meson: Keep link pointers valid on realloc failure (git-fixes).\n- ASoC: ml26124: sort the register default table (git-fixes).\n- ASoC: pcm512x: sort the register default table (git-fixes).\n- ASoC: pxa: Use devm_clk_get_optional() for extclk clock (git-fixes).\n- ASoC: qcom: q6apm: keep the graph start count in sync with the DSP (git-fixes).\n- ASoC: rt274: sort the register default table (git-fixes).\n- ASoC: rt286: sort the register default table (git-fixes).\n- ASoC: rt298: sort the register default table (git-fixes).\n- ASoC: rt700-sdw: always drain jack work on remove (git-fixes).\n- ASoC: rt700: drop duplicate reg_default entry (git-fixes).\n- ASoC: rt700: sort the register default table (git-fixes).\n- ASoC: rt711-sdca: sort the register default tables (git-fixes).\n- ASoC: rt711: sort the register default table (git-fixes).\n- ASoC: rt712-sdca-dmic: sort the register default table (git-fixes).\n- ASoC: rt715-sdca: drop duplicate reg_default entries (git-fixes).\n- ASoC: rt715-sdca: sort the register default tables (git-fixes).\n- ASoC: rt715: sort the register default table (git-fixes).\n- ASoC: rt1316-sdw: sort the register default table (git-fixes).\n- ASoC: rt1318-sdw: sort the register default table (git-fixes).\n- ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get (git-fixes).\n- ASoC: sgtl5000: sort the register default table (git-fixes).\n- ASoC: SOF: pcm: Move period/buffer configuration print after platform open (stable-fixes).\n- ASoC: sof: pcm: use snd_pcm_direction_name() (stable-fixes).\n- ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() (git-fixes).\n- ASoC: SOF: validate topology volume range before allocation (git-fixes).\n- ASoC: sti-sas: sort the register default table (git-fixes).\n- ASoC: tas2552: sort the register default table (git-fixes).\n- ASoC: tas2764: sort the register default table (git-fixes).\n- ASoC: tas2780: sort the register default table (git-fixes).\n- ASoC: tegra210_i2s: sort the register default table (git-fixes).\n- ASoC: tegra210_mixer: sort the register default table (git-fixes).\n- ASoC: tegra: Fix the MIXER enable default value (git-fixes).\n- ASoC: tegra: Sort MBDRC register defaults (git-fixes).\n- ASoC: xilinx: formatter_pcm: fix stream_data leak on open error (git-fixes).\n- ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers (git-fixes).\n- batman-adv: bla: fix freeing of claims on meshif deletion (git-fixes).\n- batman-adv: bla: prevent CRC corruptions after claim flush (git-fixes).\n- batman-adv: dat: avoid unaligned fault in IP extraction (git-fixes).\n- batman-adv: fix stale receive device on merged fragments (git-fixes).\n- Bluetooth: btintel: Fix diagnostics event detection (git-fixes).\n- Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path (git-fixes).\n- Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX (git-fixes).\n- Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event (git-fixes).\n- Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() (git-fixes).\n- Bluetooth: do not leak an hci_conn when a second LE connect is rejected (git-fixes).\n- Bluetooth: eir: Fix OOB read in eir_get_service_data() (git-fixes).\n- Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_conn: hold conn reference in abort_conn_sync() (git-fixes).\n- Bluetooth: hci_conn: re-enable advertising only for peripheral role (git-fixes).\n- Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection (git-fixes).\n- Bluetooth: hci_event: fix LE list UAF on reset (git-fixes).\n- Bluetooth: hci_event: validate LE Set CIG Parameters response (git-fixes).\n- Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths (git-fixes).\n- Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists (stable-fixes).\n- Bluetooth: hci_uart: Fix false success return in hci_uart_setup() (git-fixes).\n- Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready (git-fixes).\n- Bluetooth: MGMT: free the mesh send cancel command when it is cancelled (git-fixes).\n- Bluetooth: MSFT: validate evt_prefix_len against the response length (git-fixes).\n- Bluetooth: RFCOMM: serialize security confirmation handling (git-fixes).\n- Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept (git-fixes).\n- Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (git-fixes).\n- Bluetooth: virtio_bt: avoid OOB read of build info string (git-fixes).\n- bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation (git-fixes).\n- bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET (git-fixes).\n- bus: ti-sysc: Fix /chosen node reference leak (git-fixes).\n- cacheinfo: don't propagate DT/ACPI error when arch supplies info (arm64) (git-fixes).\n- can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking (stable-fixes).\n- crypto: aspeed - Propagate platform_get_irq() errors (git-fixes).\n- crypto: atmel-sha204a - fix heap info leak on I2C transfer failure (git-fixes).\n- crypto: atmel-tdes - use scatterlist length before DMA mapping (git-fixes).\n- crypto: ccm - Set rfc4309 maxauthsize from child (git-fixes).\n- crypto: ccp - Fix memory leak in SEV INIT_EX path (git-fixes).\n- crypto: ccp - Fix possible deadlock in SEV init failure path (git-fixes).\n- crypto: doc - Remove extra parenthesis (git-fixes).\n- crypto: hisilicon/sec2 - fix CCM algorithm long packet failure (git-fixes).\n- crypto: keembay - Initialize completion before requesting IRQ (git-fixes).\n- crypto: keembay - publish OF module alias for OCS AES/SM4 (git-fixes).\n- crypto: mxs-dcp - fix source scatterlist length access (git-fixes).\n- crypto: qat - cancel work on re-enable SR-IOV timeout (git-fixes).\n- crypto: qat - clear AES key schedule from stack (git-fixes).\n- crypto: qce - fix CCM AAD buffer underallocation (git-fixes).\n- crypto: qce - fix error path in devm_qce_register_algs (git-fixes).\n- crypto: rk3288 - fail ahash requests on HASH idle timeout (git-fixes).\n- crypto: sa2ul - stop probe if context pool creation fails (git-fixes).\n- crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping (git-fixes).\n- device property: fix infinite loop in fwnode_for_each_child_node() (git-fixes).\n- dmaengine: dw-edma: Clear stale requests on termination (git-fixes).\n- dmaengine: dw-edma: Complete descriptors before pausing (git-fixes).\n- dmaengine: dw-edma: Initialize IRQ data before requesting IRQs (git-fixes).\n- dmaengine: dw-edma: Serialize abort state updates (git-fixes).\n- dmaengine: dw-edma: Serialize channel state checks (git-fixes).\n- dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe (git-fixes).\n- dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure (git-fixes).\n- dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal (git-fixes).\n- dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers (git-fixes).\n- dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout (git-fixes).\n- driver core: soc: Unregister bus on early device registration failure (git-fixes).\n- drm/amd/display: avoid divide-by-zero in __is_lut_linear() (git-fixes).\n- drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read (git-fixes).\n- drm/amdgpu/gfx6: Fixup emit_cntxcntl() (git-fixes).\n- drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets (git-fixes).\n- drm/amdgpu/gfx6: Use PFP on the compute queues too (git-fixes).\n- drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup (git-fixes).\n- drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup (git-fixes).\n- drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (git-fixes).\n- drm/amdgpu: cap GTT size to physical RAM on APUs (stable-fixes).\n- drm/amdgpu: check ASPM on the dGPU host link (git-fixes).\n- drm/amdgpu: disallow multiple FENCE chunks in one submit (git-fixes).\n- drm/amdgpu: fix aperture iounmap skipped on device removal (git-fixes).\n- drm/amdgpu: fix autosuspend cleanup during removal (git-fixes).\n- drm/amdgpu: Fix UVD decode image min size calculation (stable-fixes).\n- drm/amdgpu: Fix UVD dpb min size calculation for H264 (stable-fixes).\n- drm/amdgpu: Fix UVD min buffer sizes (stable-fixes).\n- drm/amdgpu: Fix VCE 3 ring align_mask (git-fixes).\n- drm/amdgpu: Implement insert_end for VCE 3 (git-fixes).\n- drm/amdgpu: Reject UVD message with dimensions above 4096 (stable-fixes).\n- drm/amdgpu: Reject UVD message with invalid number of h265 refs (stable-fixes).\n- drm/amdgpu: restore UMD profile pstate after runtime resume (stable-fixes).\n- drm/amdgpu: validate GEM_CREATE domain combinations (stable-fixes).\n- drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE (stable-fixes).\n- drm/amdkfd: fix QID bit leak in pqm_create_queue() (stable-fixes).\n- drm/amdkfd: Handle invalid event type in CRIU event restore (stable-fixes).\n- drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure (git-fixes).\n- drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure (git-fixes).\n- drm/bridge: ps8640: propagate AUX transfer register errors (git-fixes).\n- drm/bridge: tc358767: clamp the reported AUX read size to the request (git-fixes).\n- drm/connector: Fix epoch_counter docs to reflect reality (git-fixes).\n- drm/hibmc: Fix list of formats on the primary plane (git-fixes).\n- drm/hibmc: Use drm_atomic_helper_check_plane_state() (git-fixes).\n- drm/i915/fbc: Extract intel_fbc_has_fences() (stable-fixes).\n- drm/lima: call drm_mm_init() with a valid allocation range (git-fixes).\n- drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0) (git-fixes).\n- drm/msm/dsi: Drop dev_pm_opp_set_rate(0) (git-fixes).\n- drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value (git-fixes).\n- drm/panel-edp: fix i2c adapter leak on probe failure (git-fixes).\n- drm/panel: samsung-s6d16d0: Power off on prepare failure (git-fixes).\n- drm/radeon: fix autosuspend cleanup during teardown (git-fixes).\n- drm/radeon: restore hardware polling in fence_is_signaled to fix performance regression (git-fixes).\n- drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format (git-fixes).\n- drm/ssd130x: fix column and row end address in partial updates for ssd132x (git-fixes).\n- drm/sun4i: crtc: Propagate layer initialization error (git-fixes).\n- drm/sun4i: Drop node references while building component list (git-fixes).\n- drm/sun4i: dw-hdmi: Drop TCON TOP port reference (git-fixes).\n- drm/sun4i: fix refcount leak in sun4i_backend_init_sat() (git-fixes).\n- drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz (git-fixes).\n- drm/sun4i: tcon: Drop remote endpoint reference (git-fixes).\n- drm/sun4i: tcon: Drop TCON TOP device reference (git-fixes).\n- drm/sun4i: tcon: Set output mux for DSI and LVDS (git-fixes).\n- drm/sun4i: vi scaler: Fix coefficient selection (git-fixes).\n- drm/tegra: dsi: Re-add clear enable register if DSI was powered by bootloader (git-fixes).\n- drm/tve200: add OF module alias for autoloading (git-fixes).\n- drm: fix race between partial drm_dev_register() failure and ioctl (git-fixes).\n- drm: lcdif: Wait for vblank before disabling DMA (git-fixes).\n- drm: Remove unused header in drm_dumb_buffers.c (git-fixes).\n- ethtool: rss: fix hkey leak when indir_size is 0 (git-fixes).\n- fbdev: bitblit: bound-check glyph index in bit_cursor() (git-fixes).\n- fbdev: core: Fix pointer desynchronization in fb_io_read() (git-fixes).\n- fbdev: kyro: Validate overlay viewport coordinates (git-fixes).\n- fbdev: omapfb: panel-dsi-cm: initialize lock before registering display (git-fixes).\n- fbdev: ssd1307fb: defer I2C transfers from damage callbacks (git-fixes).\n- fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device() (git-fixes).\n- fbdev: uvesafb: unregister connector callback on init failure (git-fixes).\n- firmware: arm_scmi: Avoid IDR updates while cleaning channels (git-fixes).\n- firmware: arm_scmi: Drop handle on protocol bind failures (git-fixes).\n- firmware: arm_scmi: Fix requested device removal race (git-fixes).\n- firmware: arm_scmi: Free transport channel on IDR failure (git-fixes).\n- firmware: arm_scmi: Protect device request lookup with RCU (git-fixes).\n- firmware: arm_scmi: Reject out of range DT protocol IDs (git-fixes).\n- firmware: arm_scmi: Unregister device notifier before IDR teardown (git-fixes).\n- firmware: arm_scmi: Use channel ID for transport teardown (git-fixes).\n- firmware_loader: do not queue completed sysfs fallback requests (git-fixes).\n- fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write (git-fixes).\n- fpga: dfl: fme: add error handling (git-fixes).\n- fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration (git-fixes).\n- gpu: host1x: Avoid stack over-read in debug output helpers (git-fixes).\n- gpu: host1x: Fix offset calculation in trace_write_gather (git-fixes).\n- HID: core: fix number/pointer type confusion on long items (git-fixes).\n- HID: core: fix OOB read of field-\u003eusage in hid_set_field() (git-fixes).\n- HID: hyperv: validate initial device info bounds (git-fixes).\n- HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure (git-fixes).\n- HID: lg4ff: validate report length before fixed offsets (git-fixes).\n- HID: logitech-dj: Fix maxfield check in DJ short report validation (git-fixes).\n- HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report (git-fixes).\n- HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write (stable-fixes).\n- HID: logitech-dj: Standardise hid_report_enum variable nomenclature (stable-fixes).\n- HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID (stable-fixes).\n- HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() (git-fixes).\n- HID: mcp2221: validate report size in mcp2221_raw_event() (git-fixes).\n- HID: nintendo: Fix imu_timestamp_us double increment per report (git-fixes).\n- HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() (git-fixes).\n- HID: picolcd: clamp eeprom debugfs read to bytes actually received (git-fixes).\n- HID: roccat: bound device-supplied profile index (git-fixes).\n- HID: roccat: free buffered reports when destroying device (git-fixes).\n- HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature (git-fixes).\n- HID: sensor: custom: Fix field sysfs group cleanup on failure (git-fixes).\n- HID: sensor: custom: Fix use-after-free in enable_sensor (git-fixes).\n- HID: tmff: Use 64-bit arithmetic for force feedback scaling (git-fixes).\n- hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination (git-fixes).\n- hwmon: (lm25066) Use i2c_get_match_data() (stable-fixes).\n- hwmon: (max6621) fix negative temperature offset and crit readings (git-fixes).\n- hwmon: (max6621) fix temperature clamp range (git-fixes).\n- hwmon: (nzxt-smart2) Check return value of init_device() in probe (git-fixes).\n- hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations (git-fixes).\n- hwrng: ks-sa - Fix runtime PM cleanup on registration failure (git-fixes).\n- hwrng: omap - Fix probe error path cleanup (git-fixes).\n- hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() (git-fixes).\n- i2c: bcm-iproc: remove printout on handled timeouts (stable-fixes).\n- i2c: iproc: reset bus after timeout if START_BUSY is stuck (git-fixes).\n- i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure (git-fixes).\n- i2c: mux: Fix channel node leak on adapter add failure (git-fixes).\n- i2c: ocores: Disable clock on failed resume (git-fixes).\n- i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices (git-fixes).\n- i3c: master: Fix device_register() error path (git-fixes).\n- i3c: master: Fix info leak and UAF in device unregister path (git-fixes).\n- i3c: master: svc: bound IBI payload to the requested max_payload_len (git-fixes).\n- ibmvnic: Only record tx completed bytes once per handler (bsc#1274620).\n- iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE (git-fixes).\n- iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable (git-fixes).\n- iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF (git-fixes).\n- iio: chemical: sgp30: Handle IAQ thread creation failure (git-fixes).\n- iio: dac: m62332: Fix regulator reference count imbalance (git-fixes).\n- iio: gyro: mpu3050: fix sign of raw angular velocity readings (git-fixes).\n- iio: light: cm32181: return zero after writing calibscale (git-fixes).\n- iio: light: gp2ap002: Disable regulators on resume failure (git-fixes).\n- iio: light: gp2ap002: re-enable irq if runtime suspend fails (git-fixes).\n- iio: light: isl29028: return zero in write_raw() on success (git-fixes).\n- iio: light: tsl2583: return zero in write_raw() on success (git-fixes).\n- iio: light: tsl2772: fix ALS calibscale readback (git-fixes).\n- iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure (git-fixes).\n- iio: pressure: dps310: fix NULL pointer dereference on ACPI probe (git-fixes).\n- iio: pressure: mpl115: Fix runtime PM cleanup (git-fixes).\n- iio: srf04: fix pm_runtime handling on probe error path (git-fixes).\n- iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() (git-fixes).\n- Input: atkbd - skip deactivate for HONOR ZQC-P (git-fixes).\n- Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard (stable-fixes).\n- Input: evdev - fix information leak in evdev_pass_values() (stable-fixes).\n- Input: evdev - sanitize event type index when fetching event masks (stable-fixes).\n- Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet (git-fixes).\n- Input: focaltech - use signed coordinates to prevent underflow (git-fixes).\n- Input: hynitron_cstxxx - validate touch count and finger IDs (git-fixes).\n- Input: iforce - validate input packet lengths (stable-fixes).\n- Input: iqs5xx - validate firmware record destination span (git-fixes).\n- Input: mms114 - fix Y-resolution configuration (git-fixes).\n- Input: psxpad-spi - set driver data before use (git-fixes).\n- Input: sur40 - fix input device registration ordering (stable-fixes).\n- Input: sur40 - fix V4L error path cleanup (stable-fixes).\n- Input: synaptics-rmi4 - block s_input when F54 queue is busy (git-fixes).\n- Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer (git-fixes).\n- Input: synaptics-rmi4 - fix F55 transmitter electrode count typo (git-fixes).\n- Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue (git-fixes).\n- Input: synaptics-rmi4 - zero report size on F54 work error (git-fixes).\n- Input: xpad - add support for ZENAIM LEVERLESS (stable-fixes).\n- interconnect: Fix use after free in icc_get() and of_icc_get_by_index() (git-fixes).\n- ipmi: ipmb: validate write message length (git-fixes).\n- ipmi: si: Fix NULL pointer dereference after failed registration (git-fixes).\n- KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes).\n- KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page (git-fixes).\n- leds: pca9532: Fix inverted GPIO output polarity (git-fixes).\n- leds: pca9532: Fix phantom device registration on missing hardware (git-fixes).\n- lib/string: fix memchr_inv() for large ranges (git-fixes).\n- lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() (git-fixes).\n- mailbox: qcom-ipcc: fix duplicate channel allocation across holes (git-fixes).\n- mailbox: rockchip: disable pclk on probe failure and unbind (git-fixes).\n- maple_tree: fix argument name in header (git-fixes).\n- md/raid1: create serial pool adding rdev to array with serialize_policy=1 (bsc#1272261).\n- media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref (git-fixes).\n- media: cec-pin: Fix event FIFO ordering (git-fixes).\n- media: cec: disable delayed work before freeing an interrupted transmit (git-fixes).\n- media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash (git-fixes).\n- media: cec: Serialize exclusive follower delivery (git-fixes).\n- media: cec: stm32: prevent out-of-bounds write on RX overflow (git-fixes).\n- media: cedrus: fix memory leak in cedrus_init_ctrls() (git-fixes).\n- media: cobalt: Avoid freeing ALSA private data twice (git-fixes).\n- media: cx231xx: reject geometry changes while the VBI queue is busy (git-fixes).\n- media: cx23885: cancel NetUP CI work before teardown (git-fixes).\n- media: em28xx: defer audio-only extension registration (git-fixes).\n- media: em28xx: fix use-after-free of dev_next-\u003edevlist on disconnect (git-fixes).\n- media: go7007: defer the ALSA v4l2 put until card release (git-fixes).\n- media: i2c: ov02a10: fix endpoint parsing use-after-free (git-fixes).\n- media: i2c: ov7740: fix use-after-destroy in remove (git-fixes).\n- media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define (git-fixes).\n- media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define (git-fixes).\n- media: mc-entity: Add missing kerneldoc (git-fixes).\n- media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common (git-fixes).\n- media: nxp: imx8-isi: Correct color map between V4L2 and ISI (git-fixes).\n- media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing (git-fixes).\n- media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks (git-fixes).\n- media: rc: sunxi-cir: Unregister rc device on probe failure (git-fixes).\n- media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure (git-fixes).\n- media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak (git-fixes).\n- media: s2255: bound JPEG frame size before copying into the buffer (git-fixes).\n- media: s2255: check firmware size before reading trailing marker (git-fixes).\n- media: saa7164: fix cleanup on resource allocation failure (git-fixes).\n- media: tda18250: fix possible integer overflow (git-fixes).\n- media: usbtv: keep device alive while ALSA card exists (git-fixes).\n- media: v4l2-ctrls: Allow unknown HDR10 white point and luminance (git-fixes).\n- media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link (git-fixes).\n- media: venus: fix payload size calculation in parse_raw_formats() (git-fixes).\n- media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() (git-fixes).\n- media: vicodec: fix out-of-bounds write in FWHT encoder (git-fixes).\n- media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure (git-fixes).\n- media: vimc: fix pixel format lookup in enum_framesizes (git-fixes).\n- media: zoran: Avoid freeing a registered video_device twice (git-fixes).\n- mei: pull kvfree out of spinlock (git-fixes).\n- mfd: iqs62x: Reject zero-length firmware records (git-fixes).\n- mfd: rave-sp: validate received frame payload lengths (git-fixes).\n- misc: bcm-vk: Use acquire/release for msgq_inited (git-fixes).\n- misc: fastrpc: fix channel ctx ref leak when session alloc fails (git-fixes).\n- misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free (git-fixes).\n- misc: fastrpc: Remove buffer from list prior to unmap operation (git-fixes).\n- misc: fastrpc: take fl-\u003elock when moving mmaps on interrupted invoke (git-fixes).\n- misc: rtsx: add missing write register handling (git-fixes).\n- misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() (git-fixes).\n- mkspec-dtb: Move DTS prefix into package list.\n- mkspec-dtb: Move provides-obsoletes to package list.\n- mkspec-dtb: Put per-architecture package lists into a hash.\n- mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit (git-fixes).\n- mmc: sdhci: unmap the bounce buffer before device release (git-fixes).\n- mmc: via-sdmmc: stop card-detect handling on probe failure (git-fixes).\n- mtd: afs: validate v2 image info bounds (git-fixes).\n- mtd: mtdoops: free page bitmap when the backing MTD is removed (git-fixes).\n- mtd: mtdswap: Avoid freeing registered blktrans device twice (git-fixes).\n- mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() (git-fixes).\n- mtd: rawnand: validate ONFI extended parameter page sections (git-fixes).\n- net: mana: Add debug knob to skip TX timeout recovery reset (git-fixes).\n- net: mana: Add handler for sriov configure (bsc#1272756).\n- net: mana: Cap MSI-X vectors to the device MSI-X table size (git-fixes).\n- net: mana: Extend RX CQE coalescing up to 8 packets (git-fixes).\n- net: mana: Fall back to scattered pages for GDMA queues (git-fixes).\n- net: mana: force full-page RX buffers via ethtool private flag (bsc#1269792).\n- net: mana: refactor mana_get_strings() and mana_get_sset_count() to use switch (bsc#1269792).\n- net: mana: Route ring-buffer access through offset-based helpers (git-fixes).\n- net: tap: set skb-\u003edev before parsing virtio net header in tap_get_user_xdp() (git-fixes bsc#1274550).\n- net: thunderbolt: Count delivered packets in rx_packets and rx_bytes (git-fixes).\n- net: thunderbolt: Mark the connection down when bringing it up fails (git-fixes).\n- net: thunderbolt: Release the Rx HopID that was handed out on mismatch (git-fixes).\n- net: thunderbolt: Tear down DMA paths before stopping the rings (git-fixes).\n- net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() (git-fixes).\n- net: usb: ipheth: fix carrier_work UAF on disconnect (git-fixes).\n- nfc: digital: clamp SENSF_RES length to the destination buffer (git-fixes).\n- nfc: digital: Do not dump a NULL response in command completion (git-fixes).\n- nfc: fdp: bound the device-reported read length and fix an skb leak (git-fixes).\n- nfc: llcp: avoid userspace overflow on invalid optlen (git-fixes).\n- nfc: llcp: bound SNL TLV parsing to the skb and add length checks (git-fixes).\n- nfc: llcp: bound the connect_sn TLV walk to the skb (git-fixes).\n- nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (git-fixes).\n- nfc: llcp: read llcp_sock-\u003elocal under the socket lock in getsockopt (git-fixes).\n- nfc: llcp: reject PDUs shorter than the LLCP header (git-fixes).\n- nfc: microread: validate target discovery payload lengths (git-fixes).\n- nfc: nci: fix double completion race in nci_data_exchange_complete (git-fixes).\n- nfc: nci: fix out-of-bounds write in nci_target_auto_activated() (git-fixes).\n- nfc: nci: fix uninit-value in the RF discover/activated NTF handlers (git-fixes).\n- nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing (git-fixes).\n- nfc: nci: free destination parameters when closing a connection (git-fixes).\n- nfc: pn533: hold a reference to the request skb during send_frame (git-fixes).\n- nfc: pn533: purge fragmented skbs during cleanup (git-fixes).\n- nfc: st21nfca: validate ATR_REQ length against the received frame (git-fixes).\n- nouveau/gem: reserve the bo in the info ioctl around the vma lookup (git-fixes).\n- PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] (git-fixes).\n- PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk (git-fixes).\n- PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip (git-fixes).\n- PCI: j721e: Fix incorrect max_lanes for J7200 (git-fixes).\n- PCI: meson: Fix GPIO state while requesting PERST# (git-fixes).\n- phy: qcom: qmp-combo: Correct pre-emphasis table for QMP v4 DP PHYs (git-fixes).\n- phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend (git-fixes).\n- phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table (git-fixes).\n- phy: sunplus: fix error handling in sp_uphy_init() (git-fixes).\n- pinctrl: bcm2835: Don't remove an unregistered GPIO chip (git-fixes).\n- pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip (git-fixes).\n- pinctrl: rockchip: Reset the pin count when recalculating SoC data (git-fixes).\n- platform/chrome: cros_ec_debugfs: Clean up console log on probe failure (git-fixes).\n- platform/chrome: cros_ec_debugfs: Unregister panic notifier (git-fixes).\n- platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count (git-fixes).\n- platform/chrome: sensorhub: Bound the EC-reported sensor number (git-fixes).\n- platform/chrome: sensorhub: Fix dropped timestamp events and log spam (git-fixes).\n- platform/chrome: sensorhub: Fix memory overread in ring handler (git-fixes).\n- platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL (git-fixes).\n- platform/surface: acpi-notify: Check ACPI companion before use (git-fixes).\n- platform/x86: dell-privacy: Fix race condition (git-fixes).\n- platform/x86: dell-wmi-base: Fix resource leak on module load failure (git-fixes).\n- platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer (git-fixes).\n- platform/x86: dell-wmi-sysman: Fix instance ID bounds (git-fixes).\n- platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path (git-fixes).\n- platform/x86: ISST: Just allow 2 bits for SST feature enable (git-fixes).\n- platform/x86: ISST: Validate level in perf mask ioctls (git-fixes).\n- platform/x86: ISST: Validate logical CPU id and clos id (git-fixes).\n- platform/x86: ISST: Validate socket ID in clos_assoc ioctl (git-fixes).\n- PM: sleep: Fix off-by-one in wakelocks number limit check (git-fixes).\n- power: supply: bd99954: Drop bad register fields (git-fixes).\n- power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address (git-fixes).\n- power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address (git-fixes).\n- power: supply: bq27xxx: bq27520g4: fix REG_TTES address (git-fixes).\n- power: supply: bq256xx: drain usb_work before freeing the charger (git-fixes).\n- power: supply: bq24257: fix use-after-free on remove (git-fixes).\n- power: supply: bq25890: Fix power_supply reference leak (git-fixes).\n- power: supply: cros_usbpd-charger: bound the EC-reported port count (git-fixes).\n- power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS (git-fixes).\n- power: supply: isp1704_charger: cancel work on remove (git-fixes).\n- power: supply: lp8727: fix use-after-free in lp8727_release_irq() (git-fixes).\n- power: supply: max17040: drop incorrect I2C functionality check (git-fixes).\n- power: supply: max17040: synchronize work cancellation on suspend (git-fixes).\n- power: supply: qcom_battmgr: terminate the strings from firmware (git-fixes).\n- power: supply: rt9455: quiesce delayed work before teardown (git-fixes).\n- power: supply: sbs-battery: Use a per-device serial number buffer (git-fixes).\n- power: supply: twl4030_charger: cancel workers via devm (git-fixes).\n- power: supply: ucs1002: fix use-after-free on remove (git-fixes).\n- powercap: intel_rapl_tpmi: Handle PMU registration failure during probe (git-fixes).\n- powerpc/pseries: Ensure vpa,slb_shadow \u0026 dtl are unregistered during crash (bsc#1271256).\n- powerpc/pseries: lparcfg - fix kbuf[] underflow (bsc#1274753 ltc#221289 bsc#1274754 ltc#221288 bsc#1274752\n  ltc#221290).\n- powerpc/pseries: pci - logic bug (bsc#1274749 ltc#221282 bsc#1274755 ltc#221284 bsc#1274756 ltc#221283).\n- ppdev: prevent overflow when setting port timeout (git-fixes).\n- qede: fix out-of-bounds check for cqe-\u003elen_list (git-fixes).\n- rapidio: clear mport-\u003enet when rio_add_net() fails (git-fixes).\n- rapidio: mport_cdev: fix use-after-free in dma_req_free() (git-fixes).\n- RDMA/irdma: Remove redundant legacy_mode checks (git-fixes).\n- RDMA/mana_ib: drain QP references after partial table insertion (git-fixes).\n- RDMA/mana_ib: unify QP lookup table (git-fixes).\n- RDMA/mlx5: Fix integer overflow of user QP buffer size (git-fixes).\n- regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer (git-fixes).\n- regulator: core: use system_freezable_wq for init complete work (git-fixes).\n- regulator: devres: add API for reference voltage supplies (stable-fixes).\n- regulator: devres: fix devm_regulator_get_enable_read_voltage() return (git-fixes).\n- regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata (git-fixes).\n- regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling (git-fixes).\n- remoteproc: qcom: Fix glink-\u003enode reference leak in qcom_add_glink_subdev (git-fixes).\n- remoteproc: qcom_q6v5_adsp: Fix reference leak for device node (git-fixes).\n- remoteproc: scp: Fix device reference leak on failed lookup (git-fixes).\n- Revert \"drm/amdgpu: fix aperture mapping leak\" (git-fixes).\n- Revert \"media: v4l2-dev: fix error handling in __video_register_device()\" (git-fixes).\n- Revert \"thermal/drivers/hwmon: Cleanup coding style a bit\" (stable-fixes).\n- rpmsg: core: Fix incorrect return value documentation (git-fixes).\n- rpmsg: glink: smem: order FIFO read after availability check (git-fixes).\n- rtc: gamecube: check return value of devm_rtc_register_device() (git-fixes).\n- rtc: pcf8563: fix clock provider leak on unbind (git-fixes).\n- rtc: pcf85363: Add error checking to regmap calls in probe() (git-fixes).\n- rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers (git-fixes).\n- rtc: rzn1: Fix weekday underflow when alarm crosses month boundary (git-fixes).\n- rtc: zynqmp: Return optional clock lookup errors (git-fixes).\n- scsi: storvsc: Support manual scans for all Hyper-V targets (git-fixes).\n- sctp: avoid auth_enable sysctl UAF during netns teardown (git-fixes).\n- serial: 8250_dma: Clear stale RX state on shutdown (git-fixes).\n- serial: amba-pl011: unprepare console clock on unregister (git-fixes).\n- serial: core: clear freed pointers on uart_register_driver() failure (git-fixes).\n- serial: qcom-geni: fix TX DMA buffer flush (git-fixes).\n- serial: sc16is7xx: fix copy-paste errors in EFR_SWFLOWx_BIT constants (stable-fixes).\n- smb/client: handle overlapping allocated ranges in fallocate (bsc#1274902).\n- smb: client: reject overlapping data areas in SMB2 responses (git-fixes).\n- smb: client: require net admin for CIFS SWN netlink (bsc#1273966).\n- smb: client: resolve SWN tcon from live registrations (bsc#1273872).\n- soc: fsl: qe: check platform_driver_register() in qe_ic_of_init() (git-fixes).\n- soc: qcom: rpmh-rsc: manage PM notifiers with devres (git-fixes).\n- soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() (git-fixes).\n- software node: Fix software_node_get_reference_args() with index -1 (git-fixes).\n- soundwire: qcom: Fix port exhaustion check in stream_alloc_ports (git-fixes).\n- speakup: keyhelp: guard letter_offsets possible out-of-range indexing (git-fixes).\n- spi: img-spfi: don't disable runtime PM on DMA deferred probe (git-fixes).\n- spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers (stable-fixes).\n- spi: sprd-adi: Fix probe succeeding without registering the controller (git-fixes).\n- staging: fbtft: Use sysfs_emit_at() to print to sysfs file (git-fixes).\n- staging: media: tegra-video: vi: fix probe failure on skipped last port (git-fixes).\n- staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown (git-fixes).\n- staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() (git-fixes).\n- staging: rtl8723bs: fix missing shared-key auth challenge length check (git-fixes).\n- staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() (git-fixes).\n- staging: rtl8723bs: fix OOB read in WMM_param_handler() (git-fixes).\n- staging: rtl8723bs: use kfree_sensitive() for key material (git-fixes).\n- staging: rtl8723bs: validate monitor transmit frame lengths (git-fixes).\n- staging: sm750fb: gate dualview dataflow using g_dualview (git-fixes).\n- thermal/drivers/imx: Disable clock on runtime resume failure (git-fixes).\n- thermal/drivers/qoriq: Disable clock on resume failure (git-fixes).\n- thermal: intel: int3400: clean up ODVP on probe failures (git-fixes).\n- thunderbolt: Bound the DROM dual link port number before indexing sw-\u003eports (git-fixes).\n- thunderbolt: icm: Preserve USB4 proxy data-valid bit (git-fixes).\n- tlclk: if sscanf() fails, fall back to 0, not random value (git-fixes).\n- tpm: st33zp24: Return zero on status read failure (git-fixes).\n- tpm: st33zp24: Validate locality read result (git-fixes).\n- tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout (git-fixes).\n- tty: clear cdev pointer after cdev_add() failure (git-fixes).\n- tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 (git-fixes).\n- tty: skip cdev_del() when no cdev is registered (git-fixes).\n- uio: Fix stale info pointer in failed registration path (git-fixes).\n- usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() (git-fixes).\n- usb: atm: usbatm: fix invalid ci_range initialization (git-fixes).\n- USB: c67x00: fix use-after-free in c67x00_add_iso_urb() (git-fixes).\n- usb: cdnsp: fix incorrect endian conversions for APB timeout register (git-fixes).\n- usb: dwc2: add missing @remotewakeup kernel-doc parameter (git-fixes).\n- usb: dwc2: gadget: Exit partial power down state when changing USB pull-up (git-fixes).\n- usb: gadget: configfs: fix out-of-bounds read of qw_sign (git-fixes).\n- usb: gadget: f_fs: Prevent deadlock during ep0 read loop (git-fixes).\n- usb: gadget: f_ncm: Use unsigned int for ndp_index (git-fixes).\n- usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() (git-fixes).\n- usb: gadget: f_uac1_legacy: remove broken string configfs attributes (git-fixes).\n- usb: gadget: pch_udc: remove excess kernel-doc member for registered (git-fixes).\n- usb: gadget: r8a66597: avoid double free of ep0_req in probe error path (git-fixes).\n- usb: gadget: snps_udc_plat: clean up PHY on probe deferral (git-fixes).\n- usb: gadget: u_audio: Fix use-after-free on sound card disconnect (git-fixes).\n- usb: gadget: uac: validate rate list length before storing (git-fixes).\n- usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() (git-fixes).\n- usb: mtu3: allow system suspend during active gadget connection (git-fixes).\n- usb: musb: omap2430: clean up probe error handling (stable-fixes).\n- USB: phy: fsl-usb: fix missing static keywords (git-fixes).\n- usb: renesas_usbhs: Fix power-off ordering on unbind (git-fixes).\n- USB: serial: digi_acceleport: fix port registration order (git-fixes).\n- USB: serial: ftdi_sio: add support for E+H FXA291 (stable-fixes).\n- USB: serial: option: add TDTECH MT5710-CN (stable-fixes).\n- USB: serial: option: fix slab OOB read in interrupt URB callback (git-fixes).\n- USB: serial: spcp8x5: drop broken carrier detect support (git-fixes).\n- USB: storage: add NO_ATA_1X quirk for Longmai USB Key (stable-fixes).\n- usb: typec: ucsi: unregister debugfs entries on teardown (git-fixes).\n- usb: usbfs: fix use-after-free of usb_device in usbdev_release() (git-fixes).\n- usb: xhci: Handle USB3 port events when there is one roothub (git-fixes).\n- vt: add permission check for KDSKBMETA ioctl (stable-fixes).\n- vt: stabilize tty reference in kbd_keycode with tty_port_tty_get (stable-fixes).\n- w1: ds28e17: reject an oversize length on an I2C block read (git-fixes).\n- w1: ds2482: Fix signedness bug in ds2482_w1_triplet() (git-fixes).\n- wifi: ath6kl: avoid buffer overreads in WMI event handlers (git-fixes).\n- wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets (git-fixes).\n- wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump (git-fixes).\n- wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() (git-fixes).\n- wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate (git-fixes).\n- wifi: ath11k: Correctly copy the hint BSSID in WMI scan request (git-fixes).\n- wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx() (git-fixes).\n- wifi: ath12k: Correctly copy the hint BSSID in WMI scan request (git-fixes).\n- wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() (git-fixes).\n- wifi: brcmfmac: fix P2P action frame handling without device vif (git-fixes).\n- wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs (git-fixes).\n- wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments (git-fixes).\n- wifi: iwlwifi: mei: pass correct argument to function (git-fixes).\n- wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser (git-fixes).\n- wifi: mac80211: send TWT teardown to peer after setup TX failure (git-fixes).\n- wifi: mac80211: skip default WMM setup for AP_VLAN links (git-fixes).\n- wifi: mac80211: skip unused probe response countdown offsets (git-fixes).\n- wifi: mt76: fix 4th chain ACK RSSI bitmask in sta_poll (git-fixes).\n- wifi: mt76: fix ER-SU 106-tone RU check in RX rate decode (git-fixes).\n- wifi: mt76: fix HE DCM max-RU capability encoding (git-fixes).\n- wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length (git-fixes).\n- wifi: mt76: mt792x: Fix memory leak in SDIO TX path (git-fixes).\n- wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex (git-fixes).\n- wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss (git-fixes).\n- wifi: mt76: mt7915: fix double hif2 init on the non-WED path (git-fixes).\n- wifi: mt76: mt7915: fix ext PHY use-after-free on register error path (git-fixes).\n- wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986 (git-fixes).\n- wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie (git-fixes).\n- wifi: mt76: mt7915: release hif2 reference on probe IRQ failure (git-fixes).\n- wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement (git-fixes).\n- wifi: mt76: mt7915: unwind state on add_interface failure (git-fixes).\n- wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields (git-fixes).\n- wifi: mt76: mt7915: write RX header translation bit to the correct register (git-fixes).\n- wifi: mt76: mt7921: validate CLC firmware records (git-fixes).\n- wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb (git-fixes).\n- wifi: mt76: mt7925: fix msg len mismatch between driver and firmware (git-fixes).\n- wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config (git-fixes).\n- wifi: mt76: mt7996: don't report a zero TX bitrate (git-fixes).\n- wifi: mt76: mt7996: fix reg addr remap when addr is 0 (git-fixes).\n- wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV (git-fixes).\n- wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset (git-fixes).\n- wifi: mt76: mt7996: validate RX band_idx before dereferencing phys (git-fixes).\n- wifi: mt76: report data NSS for STBC frames in RX rate decode (git-fixes).\n- wifi: mwifiex: Detach sync cmd buffer on interrupted wait (git-fixes).\n- wifi: rtlwifi: pci: fix error path in rtl_pci_probe() (git-fixes).\n- wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() (git-fixes).\n- wifi: rtw89: fix HE extended capability length check (git-fixes).\n- wifi: zd1211rw: reject secondary interfaces to prevent conflicts (git-fixes).\n- x86/bugs: Clarify that syscall hardening isn't a BHI mitigation (git-fixes).\n- xhci: dbgtty: Fix unregister on tty_alloc_driver() failure (git-fixes).\n- xhci: dbgtty: Fix unregister on tty_register_driver() failure (git-fixes).\n","status":"published","published":"2026-09-08T13:00:49Z","modified":"2026-09-14T18:23:13.340667208Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23528-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1235944)\n- CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).\n- CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).\n- CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).\n- CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).\n- CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).\n- CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).\n- CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).\n- CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).\n- CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).\n- CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).\n- CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).\n- CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).\n- CVE-2026-43278: dm: clear cloned request bio pointer when last clone bio completes (bsc#1264584).\n- CVE-2026-43319: spi: spidev: fix lock inversion between spi_lock and buf_lock (bsc#1264788).\n- CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).\n- CVE-2026-43416: powerpc, perf: Check that current-\u003emm is alive before getting user callchain (bsc#1265121).\n- CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).\n- CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).\n- CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).\n- CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).\n- CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).\n- CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).\n- CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).\n- CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).\n- CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).\n- CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).\n- CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).\n- CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).\n- CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).\n- CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).\n- CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).\n- CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).\n- CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).\n- CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).\n- CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).\n- CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).\n- CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).\n- CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).\n- CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).\n- CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).\n- CVE-2026-53094: bpf: Fix stale offload-\u003eprog pointer after constant blinding (bsc#1269965).\n- CVE-2026-53096: bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path (bsc#1269969).\n- CVE-2026-53110: selftests/bpf: Add ASSERT_OK_FD macro (bsc#1269985).\n- CVE-2026-53111: bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap (bsc#1269167).\n- CVE-2026-53126: blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() (bsc#1269635).\n- CVE-2026-53154: mm/hugetlb: restore reservation on error in hugetlb folio copy paths (bsc#1269665).\n- CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (bsc#1269306).\n- CVE-2026-53207: mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison (bsc#1269590).\n- CVE-2026-53219: netfilter: x_tables: avoid leaking percpu counter pointers (bsc#1269686).\n- CVE-2026-53220: netfilter: revalidate bridge ports (bsc#1269381).\n- CVE-2026-53223: net: guard timestamp cmsgs to real error queue skbs (bsc#1269301).\n- CVE-2026-53228: ipv6: sit: reload inner IPv6 header after GSO offloads (bsc#1269256).\n- CVE-2026-53238: netlabel: validate unlabeled address and mask attribute lengths (bsc#1269774).\n- CVE-2026-53260: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req() (bsc#1269731).\n- CVE-2026-53264: net/sched: act_api: use RCU with deferred freeing for action lifecycle (bsc#1269238).\n- CVE-2026-53269: netfilter: synproxy: add mutex to guard hook reference counting (bsc#1269579).\n- CVE-2026-53273: tee: optee: prevent use-after-free when the client exits before the supplicant (bsc#1269713).\n- CVE-2026-53309: ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison (bsc#1269815).\n- CVE-2026-53330: drm/amd/display: Fix out-of-bounds read in (bsc#1270090).\n- CVE-2026-53336: nvmem: layouts: onie-tlv: fix hang on unknown types (bsc#1270108).\n- CVE-2026-53337: net: bonding: fix NULL pointer dereference in bond_do_ioctl() (bsc#1270251).\n- CVE-2026-53353: hsr: Remove WARN_ONCE() in hsr_addr_is_self() (bsc#1270111).\n- CVE-2026-53365: vsock/virtio: fix zerocopy completion for multi-skb sends (bsc#1271365).\n- CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830).\n- CVE-2026-63801: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (bsc#1272230).\n- CVE-2026-63808: exfat: fix potential use-after-free in exfat_find_dir_entry() (bsc#1272260).\n- CVE-2026-63810: block: Avoid mounting the bdev pseudo-filesystem in userspace (bsc#1272297).\n- CVE-2026-63823: keys: Pin request_key_auth payload in instantiate paths (bsc#1272182).\n- CVE-2026-63827: apparmor: fix use-after-free in rawdata dedup loop (bsc#1272179).\n- CVE-2026-63828: apparmor: mediate the implicit connect of TCP fast open sendmsg (bsc#1272175).\n- CVE-2026-63860: RDMA/core: Prefer NLA_NUL_STRING (bsc#1272429).\n- CVE-2026-63865: bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks (bsc#1272486).\n- CVE-2026-63868: net: garp: fix unsigned integer underflow in garp_pdu_parse_attr (bsc#1272497).\n- CVE-2026-63879: drm/amdgpu: fix amdgpu_hmm_range_get_pages (bsc#1272569).\n- CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).\n- CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272385).\n- CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272390).\n- CVE-2026-63889: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (bsc#1272423).\n- CVE-2026-63891: thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() (bsc#1272641).\n- CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1272877).\n- CVE-2026-63925: macsec: fix replay protection at XPN lower-PN wrap (bsc#1273008).\n- CVE-2026-63926: bpf: sockmap: fix tail fragment offset in bpf_msg_push_data (bsc#1273019).\n- CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1272662).\n- CVE-2026-63969: ipv6: fix possible infinite loop in rt6_fill_node() (bsc#1272484).\n- CVE-2026-63970: vsock/virtio: bind uarg before filling zerocopy skb (bsc#1272673).\n- CVE-2026-63980: net/handshake: Use spin_lock_bh for hn_lock (bsc#1273028).\n- CVE-2026-63985: ethtool: eeprom: add more safeties to EEPROM Netlink fallback (bsc#1272963).\n- CVE-2026-63990: bonding: refuse to enslave CAN devices (bsc#1273027).\n- CVE-2026-63992: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (bsc#1272868).\n- CVE-2026-63999: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure (bsc#1273038).\n- CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273030).\n- CVE-2026-64001: ALSA: pcm: oss: Fix setup list UAF on proc write error (bsc#1273734).\n- CVE-2026-64002: ipv4: free net-\u003eipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (bsc#1273774).\n- CVE-2026-64004: net/iucv: fix locking in .getsockopt (bsc#1273804).\n- CVE-2026-64005: net/smc: Do not re-initialize smc hashtables (bsc#1273831).\n- CVE-2026-64006: netfilter: nf_tables: fix dst corruption in same register operation (bsc#1273834).\n- CVE-2026-64007: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (bsc#1273105).\n- CVE-2026-64010: nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (bsc#1273882).\n- CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1273891).\n- CVE-2026-64015: security/keys: fix missed RCU read section on lookup (bsc#1273762).\n- CVE-2026-64029: ALSA: seq: Serialize UMP output teardown with event_input (bsc#1273766).\n- CVE-2026-64047: net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (bsc#1273060).\n- CVE-2026-64048: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (bsc#1273484).\n- CVE-2026-64052: block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user() (bsc#1272983).\n- CVE-2026-64073: irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT (bsc#1273490).\n- CVE-2026-64098: drm/virtio: use uninterruptible resv lock for plane updates (bsc#1273488).\n- CVE-2026-64102: RDMA/siw: Reject MPA FPDU length underflow before signed receive math (bsc#1272516).\n- CVE-2026-64109: af_unix: Peek the queue synchronized (bsc#1273748).\n- CVE-2026-64112: rbd: eliminate a race in lock_dwork draining on unmap (bsc#1273741).\n- CVE-2026-64113: ixgbevf: fix use-after-free in VEPA multicast source pruning (bsc#1272262).\n- CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl \u003c 5 (bsc#1273742).\n- CVE-2026-64115: vsock/vmci: fix UAF when peer resets connection during handshake (bsc#1273745).\n- CVE-2026-64118: qed: fix double free in qed_cxt_tables_alloc() (bsc#1273749).\n- CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273743).\n- CVE-2026-64125: net: bcmgenet: keep RBUF EEE/PM disabled (bsc#1272346).\n- CVE-2026-64131: mm/memory: fix spurious warning when unmapping device-private/exclusive pages (bsc#1274063).\n- CVE-2026-64148: pds_core: check health in devcmd wait (bsc#1273956).\n- CVE-2026-64164: btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() (bsc#1273957).\n- CVE-2026-64185: sysfs: don't remove existing directory on update failure (bsc#1272200).\n- CVE-2026-64188: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() (bsc#1272150).\n- CVE-2026-64190: net: team: fix NULL pointer dereference in team_xmit during mode change (bsc#1272210).\n- CVE-2026-64192: bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized (bsc#1272213).\n- CVE-2026-64214: powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise()\n  (bsc#1272799).\n- CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272798).\n- CVE-2026-64222: octeontx2-pf: avoid double free of pool-\u003estack on AQ init failure (bsc#1272788).\n- CVE-2026-64225: octeontx2-af: CGX: add bounds check to cgx_speed_mbps index (bsc#1272786).\n- CVE-2026-64245: fbdev: modedb: fix a possible UAF in fb_find_mode() (bsc#1273905).\n- CVE-2026-64268: RDMA/siw: bound Read Response placement to the RREAD length (bsc#1273276).\n- CVE-2026-64286: KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU (bsc#1274058).\n- CVE-2026-64287: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (bsc#1273325).\n- CVE-2026-64294: mm: do file ownership checks with the proper mount idmap (bsc#1273525).\n- CVE-2026-64296: exfat: bound uniname advance in exfat_find_dir_entry() (bsc#1273975).\n- CVE-2026-64304: crypto: qat - validate RSA CRT component lengths (bsc#1273944).\n- CVE-2026-64312: crypto: pcrypt - restore callback for non-parallel fallback (bsc#1273968).\n- CVE-2026-64315: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1274028).\n- CVE-2026-64316: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1273598).\n- CVE-2026-64317: isofs: bound Rock Ridge symlink components to the SL record (bsc#1273936).\n- CVE-2026-64322: udf: validate sparing table length as an entry count, not a byte count (bsc#1273958).\n- CVE-2026-64323: udf: validate VAT header length against the VAT inode size (bsc#1273305).\n- CVE-2026-64355: bpf: Reject fragmented frames in devmap (bsc#1273422).\n- CVE-2026-64375: proc: protect ptrace_may_access() with exec_update_lock (FD links) (bsc#1273868).\n- CVE-2026-64378: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (bsc#1273603).\n- CVE-2026-64381: smb: client: Fix next buffer leak in receive_encrypted_standard() (bsc#1273860).\n- CVE-2026-64382: smb: client: fix double-free in SMB2_open() replay (bsc#1273291).\n- CVE-2026-64383: smb: client: fix double-free in SMB2_flush() replay (bsc#1273426).\n- CVE-2026-64384: smb: client: fix change notify replay double-free (bsc#1274541).\n- CVE-2026-64385: smb: client: fix double-free in SMB2_ioctl() replay (bsc#1274539).\n- CVE-2026-64386: smb: client: fix query_info() replay double-free (bsc#1274543).\n- CVE-2026-64387: smb: client: fix query directory replay double-free (bsc#1274545).\n- CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).\n- CVE-2026-64411: netfilter: ebtables: terminate table name before find_table_lock() (bsc#1274077).\n- CVE-2026-64412: netfilter: ebtables: module names must be null-terminated (bsc#1273780).\n- CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction (bsc#1274274).\n- CVE-2026-64434: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref (bsc#1273880).\n- CVE-2026-64436: net: af_key: initialize alg_key_len for IPComp states (bsc#1274277).\n- CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).\n- CVE-2026-64450: tipc: fix out-of-bounds read in broadcast Gap ACK blocks (bsc#1273523).\n- CVE-2026-64463: usb: typec: tcpci_rt1711h: unregister TCPCI port with devres (bsc#1273273).\n- CVE-2026-64472: vfio/mlx5: Fix racy bitfields and tighten struct layout (bsc#1274075).\n- CVE-2026-64481: ALSA: hda/cs35l41: Fix firmware load work teardown (bsc#1274547).\n- CVE-2026-64537: bridge: cfm: reject invalid CCM interval at configuration time (bsc#1273289).\n- CVE-2026-64538: ipv6: Fix null-ptr-deref in fib6_nh_mtu_change() (bsc#1273335).\n- CVE-2026-64541: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (bsc#1273303).\n- CVE-2026-64543: tipc: fix use-after-free of the discoverer in tipc_disc_rcv() (bsc#1273311).\n- CVE-2026-64545: net, bpf: check master for NULL in xdp_master_redirect() (bsc#1273318).\n- CVE-2026-64548: bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() (bsc#1273337).\n- CVE-2026-64551: sctp: validate STALE_COOKIE cause length before reading staleness (bsc#1273813).\n- CVE-2026-64552: virtio-net: fix len check in receive_big() (bsc#1273323).\n- CVE-2026-64553: net: psample: fix info leak in PSAMPLE_ATTR_DATA (bsc#1273336).\n- CVE-2026-64554: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() (bsc#1273340).\n- CVE-2026-64562: KVM: nVMX: Hide shadow VMCS right after VMCLEAR (bsc#1273930).\n- CVE-2026-64563: rhashtable: clear stale iter-\u003ep on table restart (bsc#1273995).\n- CVE-2026-64567: btrfs: reject free space cache with more entries than pages (bsc#1274006).\n- CVE-2026-64572: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (bsc#1274014).\n- CVE-2026-64576: nexthop: initialize extack in nh_res_bucket_migrate() (bsc#1274030).\n- CVE-2026-64577: gtp: check skb_pull_data() return in gtp1u_send_echo_resp() (bsc#1274031).\n- CVE-2026-64581: xfrm: fix sk_dst_cache double-free in xfrm_user_policy() (bsc#1274041).\n- CVE-2026-64582: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (bsc#1274040).\n- CVE-2026-64593: btrfs: do not trim a device which is not writeable (bsc#1274497).\n- CVE-2026-64597: smb: client: fix double-free in SMB2_close() replay (bsc#1274297).\n- CVE-2026-64598: smb/client: Fix error code in smb2_aead_req_alloc() (bsc#1274298).\n- CVE-2026-68081: KVM: nVMX: Add helper to put (unmap) vmcs12 pages (bsc#1274580).\n- CVE-2026-68082: libceph: fix two unsafe bare decodes in decode_lockers() (bsc#1274581).\n- CVE-2026-68086: mm/khugepaged: write all dirty file folios when collapsing (bsc#1274713).\n- CVE-2026-68116: vxlan: mdb: Fix source list corruption on a failed replace (bsc#1274876).\n- CVE-2026-68117: tipc: clear sock-\u003esk on the failed-insert path in tipc_sk_create() (bsc#1274881).\n- CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1274888).\n- CVE-2026-68123: openvswitch: fix GSO userspace truncation underflow (bsc#1275169).\n- CVE-2026-68127: ila: reload IPv6 header after pskb_may_pull in checksum adjust (bsc#1275237).\n- CVE-2026-68129: gve: fix Rx queue stall on alloc failure (bsc#1275517).\n- CVE-2026-68132: super: fix emergency thaw deadlock on frozen block devices (bsc#1275553).\n- CVE-2026-68136: net: gro: fix double aggregation of flush-marked skbs (bsc#1275474).\n- CVE-2026-68138: net/sched: serialize qdisc_rtab_list against concurrent get/put (bsc#1274941).\n- CVE-2026-68139: net/mlx5e: Use sender devcom for MPV master-up (bsc#1275578).\n- CVE-2026-68142: geneve: require CAP_NET_ADMIN in the device netns for changelink (bsc#1275582).\n- CVE-2026-68143: net: slip: serialize receive against buffer reallocation (bsc#1275583).\n- CVE-2026-68145: iomap: fix out-of-bounds bitmap_set() with zero-length range (bsc#1275584).\n- CVE-2026-68149: fs: preserve ACL_DONT_CACHE state in forget_cached_acl() (bsc#1275294).\n- CVE-2026-68153: libceph: remove debugfs files before client teardown (bsc#1275301).\n- CVE-2026-68154: libceph: reject zero bucket types in crush_decode (bsc#1275303).\n- CVE-2026-68155: libceph: Reject monmaps advertising zero monitors (bsc#1275304).\n- CVE-2026-68156: libceph: refresh auth-\u003eauthorizer_buf{,_len} after authorizer update (bsc#1275305).\n- CVE-2026-68157: libceph: guard missing CRUSH type name lookup (bsc#1275306).\n- CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1275307).\n- CVE-2026-68159: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (bsc#1275470).\n- CVE-2026-68160: ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() (bsc#1275472).\n- CVE-2026-68161: sctp: close UDP tunnel sockets during netns teardown (bsc#1274892).\n- CVE-2026-68166: userfaultfd: prevent registration of special VMAs (bsc#1274930).\n- CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275161).\n- CVE-2026-68205: media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() (bsc#1274934).\n- CVE-2026-68238: drm/amdgpu: Release VFCT ACPI table reference (bsc#1275704).\n- CVE-2026-68247: drm/i915/bios: range check LFP Data Block panel_type2 (bsc#1275817).\n- CVE-2026-68254: drm/i915/vrr: require valid min/max vfreq for VRR (bsc#1275150).\n- CVE-2026-68284: bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() (bsc#1275970).\n- CVE-2026-68286: drop_monitor: perform u64_stats updates under IRQ-disabled section (bsc#1275973).\n- CVE-2026-68288: net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD (bsc#1275975).\n- CVE-2026-68289: tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() (bsc#1275976).\n- CVE-2026-68293: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (bsc#1275091).\n- CVE-2026-68297: tipc: fix u16 MTU truncation in media and bearer MTU validation (bsc#1275040).\n- CVE-2026-68299: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (bsc#1275088).\n- CVE-2026-68300: sctp: auth: verify auth requirement when auth_chunk is NULL (bsc#1275083).\n- CVE-2026-68312: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (bsc#1274663).\n- CVE-2026-68313: tipc: fix infinite loop in __tipc_nl_compat_dumpit (bsc#1274665).\n- CVE-2026-68315: sctp: validate stream count in sctp_process_strreset_inreq() (bsc#1274662).\n- CVE-2026-68320: sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid (bsc#1274659).\n- CVE-2026-68322: rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled (bsc#1274656).\n- CVE-2026-68324: iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() (bsc#1274649).\n- CVE-2026-68325: iommu/amd: Bound the early ACPI HID map (bsc#1274651).\n- CVE-2026-68328: nfp: Check resource mutex allocation (bsc#1274646).\n- CVE-2026-68329: iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() (bsc#1274645).\n- CVE-2026-68331: dpaa2-eth: put MAC endpoint device on disconnect (bsc#1274642).\n- CVE-2026-68333: dpaa2-switch: put MAC endpoint device on disconnect (bsc#1274644).\n- CVE-2026-68335: rds: drop incoming messages that cross network namespace boundaries (bsc#1274640).\n- CVE-2026-68336: bonding: fix devconf_all NULL dereference when IPv6 is disabled (bsc#1274639).\n- CVE-2026-68343: smb: client: validate DFS referral PathConsumed (bsc#1274629).\n- CVE-2026-68377: net/sched: act_tunnel_key: Defer dst_release to RCU callback (bsc#1274831).\n- CVE-2026-68386: bpf, sockmap: Reject unhashed UDP sockets on sockmap update (bsc#1274814).\n- CVE-2026-68397: net/iucv: take a reference on the socket found in afiucv_hs_rcv() (bsc#1274898).\n- CVE-2026-68398: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF (bsc#1274908).\n- CVE-2026-68408: wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (bsc#1274709).\n- CVE-2026-68417: RDMA/siw: publish QP after initialization (bsc#1274696).\n- CVE-2026-68418: RDMA/irdma: Prevent user-triggered null deref on QP create (bsc#1274690).\n- CVE-2026-68419: RDMA/irdma: Prevent rereg_mr for non-mem regions (bsc#1274698).\n- CVE-2026-68422: btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() (bsc#1274706).\n- CVE-2026-68425: IB/mad: Drop unmatched RMPP responses before reassembly (bsc#1274700).\n- CVE-2026-68426: xfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment (bsc#1274705).\n- CVE-2026-68432: vxlan: require CAP_NET_ADMIN in the device netns for changelink (bsc#1274800).\n- CVE-2026-68433: libceph: bound get_version reply decode to front len (bsc#1274801).\n- CVE-2026-68450: btrfs: free mapping node on duplicate reloc root insert (bsc#1274834).\n- CVE-2026-68470: wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (bsc#1276500).\n- CVE-2026-68480: x86/bugs: Make Safe-RET robust against interrupt injection (bsc#1274208).\n- CVE-2026-72020: ipvs: reset full ip_vs_seq structs in ip_vs_conn_new (bsc#1275506).\n- CVE-2026-72035: net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1276961).\n- CVE-2026-72036: net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1277034).\n- CVE-2026-72069: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (bsc#1275528).\n- CVE-2026-72072: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (bsc#1277155).\n- CVE-2026-72083: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (bsc#1275535).\n- CVE-2026-72084: scsi: target: Bound PR-OUT TransportID parsing to the received buffer (bsc#1275540).\n- CVE-2026-72123: can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (bsc#1277523).\n- CVE-2026-72132: NFS: Charge unstable writes by request size, not folio size (bsc#1277551).\n- CVE-2026-72221: sunrpc: wait for in-flight TLS handshake callback when cancel loses race (bsc#1275665).\n- CVE-2026-72222: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (bsc#1275669).\n- CVE-2026-72251: netfilter: nf_nat_sip: reload possible stale data pointer (bsc#1275827).\n- CVE-2026-72254: netfilter: nft_fib: reject fib expression on the netdev egress hook (bsc#1277204).\n- CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (bsc#1277678).\n- CVE-2026-72288: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (bsc#1275886).\n- CVE-2026-72289: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (bsc#1275905).\n- CVE-2026-72296: net: ife: require ETH_HLEN to be pullable in ife_decode() (bsc#1275923).\n- CVE-2026-72307: mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() (bsc#1277160).\n- CVE-2026-72308: mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() (bsc#1277159).\n- CVE-2026-72317: SUNRPC: pin upper rpc_clnt across the TLS connect_worker (bsc#1275925).\n- CVE-2026-72341: net/mlx5e: Fix publication race for priv-\u003echannel_stats[] (bsc#1277660).\n- CVE-2026-72342: net/mlx5e: Fix HV VHCA stats agent registration race (bsc#1277775).\n- CVE-2026-72343: net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation (bsc#1277776).\n- CVE-2026-72389: bridge: stp: Fix a potential use-after-free when deleting a bridge (bsc#1273869).\n- CVE-2026-72463: xfrm: Fix dev use-after-free in xfrm async resumption (bsc#1268276 bsc#1277064).\n- CVE-2026-72464: xprtrdma: Remove temp allocation of rpcrdma_rep objects (bsc#1277069).\n- CVE-2026-72466: xprtrdma: Fix bcall rep leak and unbounded peek (bsc#1277057).\n- CVE-2026-72467: xprtrdma: Check frwr_wp_create() during connect (bsc#1277059).\n- CVE-2026-72469: xprtrdma: Fix ep kref imbalance on ADDR_CHANGE (bsc#1277047).\n- CVE-2026-72473: xprtrdma: Avoid 250 ms delay on backlog wakeup (bsc#1277037).\n- CVE-2026-72494: RDMA/irdma: Replace waitqueue and flag with completion (bsc#1276941).\n- CVE-2026-72495: RDMA/bnxt_re: Avoid repeated requests to allocate WC pages (bsc#1276937).\n- CVE-2026-72496: RDMA/bnxt_re: Proper rollback if the ioremap fails (bsc#1276943).\n- CVE-2026-72499: RDMA/bnxt_re: Free CQ toggle page after firmware teardown (bsc#1276551).\n- CVE-2026-72501: RDMA/bnxt_re: Initialize dpi variable to zero (bsc#1276546).\n- CVE-2026-72502: tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) (bsc#1276542).\n- CVE-2026-74269: bnxt: fix head underflow on XDP head-grow (bsc#1276507).\n- CVE-2026-74296: RDMA/mlx5: Release the HW-provided UAR index rather than the SW one (bsc#1276452).\n- CVE-2026-74297: RDMA/mlx5: Fix undefined shift of user RQ WQE size (bsc#1276446).\n- CVE-2026-74318: btrfs: fix deadlock cloning inline extent when using flushoncommit (bsc#1276864).\n- CVE-2026-74321: btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() (bsc#1277202).\n- CVE-2026-74334: RDMA/nldev: Fix locking when accessing mr-\u003epd (bsc#1277095).\n- CVE-2026-74345: RDMA/siw: Fix endpoint/socket association handling (bsc#1277285).\n- CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277408).\n- CVE-2026-74395: RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference (bsc#1277077).\n- CVE-2026-74454: drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO (bsc#1277073).\n- CVE-2026-74474: vxlan: use pskb_network_may_pull() for transmit path header pulls (bsc#1276335).\n- CVE-2026-74481: mm/page_reporting: use system_freezable_wq to fix UAF during suspend (bsc#1276355).\n- CVE-2026-74482: mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios (bsc#1276346).\n- CVE-2026-74488: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (bsc#1276350).\n- CVE-2026-74495: igbvf: Fix leak in TX DMA error cleanup (bsc#1275864).\n- CVE-2026-74496: fou: Fix use-after-free in fou_create() (bsc#1275867).\n- CVE-2026-74509: Bluetooth: hci_sync: Fix advertising data UAFs (bsc#1275946).\n- CVE-2026-74510: Bluetooth: mgmt: fix UAF in pair command cancellation (bsc#1275950).\n- CVE-2026-74512: audit: fix potential use-after-free in audit_del_rule() (bsc#1275954).\n- CVE-2026-74516: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (bsc#1275797).\n- CVE-2026-74518: mm/hugetlb: fix list corruption in allocate_file_region_entries() (bsc#1275798).\n- CVE-2026-74527: octeontx2-af: Block VFs from clobbering special CGX PKIND state (bsc#1275805).\n- CVE-2026-74537: Bluetooth: ISO: hold sk properly in iso_conn_ready (bsc#1275687).\n- CVE-2026-74548: forcedeth: fix UAF of txrx_stats in nv_remove (bsc#1275695).\n- CVE-2026-74550: net: do not send ICMP/NDISC Redirects when peer allocation fails (bsc#1275688).\n- CVE-2026-74556: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (bsc#1275696).\n- CVE-2026-74563: rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() (bsc#1275574).\n- CVE-2026-74566: keys: make keyring key-chunk byte order agree with keyring_diff_objects() (bsc#1275566).\n- CVE-2026-74567: keys: fix out-of-bounds read in keyring_get_key_chunk() (bsc#1275569).\n- CVE-2026-74571: btrfs: skip global block reserve accounting for rescue mounts (bsc#1275561).\n- CVE-2026-74581: net: ipv6: clear suppressed fib6 rule result (bsc#1275782).\n- CVE-2026-74582: packet: use consistent hard_header_len in non-ring send paths (bsc#1275784).\n- CVE-2026-74584: RDMA/bnxt_re: zero shared page before exposing to userspace (bsc#1277066).\n- CVE-2026-74610: tls: don't leave a full plaintext sk_msg ring unpushed (bsc#1277054).\n- CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277391).\n- CVE-2026-74692: net/smc: fix TOCTOU race between smc_listen_out() and listener close (bsc#1276927).\n- CVE-2026-74694: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length (bsc#1277625).\n- CVE-2026-74695: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() (bsc#1276931).\n- CVE-2026-74717: net/mlx5: fw_tracer, return NULL on create error (bsc#1276569).\n- CVE-2026-74722: btrfs: fix memory leak in btrfs_do_encoded_write() (bsc#1276561).\n- CVE-2026-80529: xfs: don't swallow dquot recovery verification errors (bsc#1277688).\n- CVE-2026-80534: xfs: fix ilock leak on error in xfs_dq_get_next_id (bsc#1277022).\n- CVE-2026-80590: inet: frags: strip GSO state from fragments before reassembly (bsc#1277275).\n- CVE-2026-80654: soc: xilinx: Shutdown and free rx mailbox channel (bsc#1277516).\n\nThe following non security issues were fixed:\n\n- accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() (git-fixes).\n- accessibility: speakup: unregister tty ldisc on later init failures (git-fixes).\n- ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer (git-fixes).\n- ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root (git-fixes).\n- ACPI: pfr_update: fix stack buffer overflow in query_capability() (git-fixes).\n- ACPI: processor: idle: Expand _LPI package sanity checks (git-fixes).\n- ACPI: processor: validate MADT IOAPIC entry bounds (git-fixes).\n- ACPI: scan: fix bus ID cleanup on device_add() failures (git-fixes).\n- ACPI: video: Release PCI device reference after lookup (git-fixes).\n- add my missing Reviewed-by: tag.\n- ALSA: 6fire: bound the MIDI event length from the device (git-fixes).\n- ALSA: 6fire: Fix UAF at error handling during probe (stable-fixes).\n- ALSA: bcd2000: clear the URB pointers on disconnect (git-fixes).\n- ALSA: core: Fix use-after-free in snd_card_do_free() (git-fixes).\n- ALSA: dummy: Check card index validity at probe (stable-fixes).\n- ALSA: hda/ext: preserve PPLCCTL bits when clearing reset (git-fixes).\n- ALSA: hda: Fix connection list comparison in proc output (git-fixes).\n- ALSA: hpi: Check transport errors during HPI6000 adapter initialization (git-fixes).\n- ALSA: pcxhr: initialize mutexes before requesting threaded IRQ (git-fixes).\n- ALSA: seq: midi: Optimize event_input locking with RCU (git-fixes).\n- ALSA: seq: midi: Serialize input teardown with event_input (git-fixes).\n- ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion (git-fixes).\n- ALSA: usb-audio: Complete cleanup after system-resume errors (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() (git-fixes).\n- ALSA: usb-audio: fix OOB write on Type II inbound URBs (git-fixes).\n- ALSA: usb: Fix UAF at delayed release of MIDI2 EPs (git-fixes).\n- ALSA: usx2y: bound the hwdep mmap fault offset (git-fixes).\n- ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() (git-fixes).\n- apparmor: advertise the tcp fast open fix is applied (git-fixes).\n- ASoC: adau1761: sort the register default table (git-fixes).\n- ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC (git-fixes).\n- ASoC: apple: mca: increase SERDES reset delay (git-fixes).\n- ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses (git-fixes).\n- ASoC: cs35l33: drain threaded IRQ before runtime suspend (git-fixes).\n- ASoC: cs35l34: drain threaded IRQ before runtime suspend (git-fixes).\n- ASoC: cs35l41: sort the register default table (git-fixes).\n- ASoC: cs35l45: sort the register default table (git-fixes).\n- ASoC: cs4265: sort the register default table (git-fixes).\n- ASoC: cx2072x: sort the register default table (git-fixes).\n- ASoC: dapm: Fix off-by-one check on the second enum channel (git-fixes).\n- ASoC: fix unmet dependencies on PPC_BESTCOMM and SND_SOC_AC97_BUS (git-fixes).\n- ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready (git-fixes).\n- ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure (git-fixes).\n- ASoC: fsl_audmix: rework runtime PM handling in probe (git-fixes).\n- ASoC: fsl_easrc: sort the register default table (git-fixes).\n- AsoC: intel: sst: fix PCI device reference leak on probe failure (git-fixes).\n- ASoC: max9860: sort the register default table (git-fixes).\n- ASoC: meson: Keep link pointers valid on realloc failure (git-fixes).\n- ASoC: ml26124: sort the register default table (git-fixes).\n- ASoC: pcm512x: sort the register default table (git-fixes).\n- ASoC: pxa: Use devm_clk_get_optional() for extclk clock (git-fixes).\n- ASoC: qcom: q6apm: keep the graph start count in sync with the DSP (git-fixes).\n- ASoC: rt274: sort the register default table (git-fixes).\n- ASoC: rt286: sort the register default table (git-fixes).\n- ASoC: rt298: sort the register default table (git-fixes).\n- ASoC: rt700-sdw: always drain jack work on remove (git-fixes).\n- ASoC: rt700: drop duplicate reg_default entry (git-fixes).\n- ASoC: rt700: sort the register default table (git-fixes).\n- ASoC: rt711-sdca: sort the register default tables (git-fixes).\n- ASoC: rt711: sort the register default table (git-fixes).\n- ASoC: rt712-sdca-dmic: sort the register default table (git-fixes).\n- ASoC: rt715-sdca: drop duplicate reg_default entries (git-fixes).\n- ASoC: rt715-sdca: sort the register default tables (git-fixes).\n- ASoC: rt715: sort the register default table (git-fixes).\n- ASoC: rt1316-sdw: sort the register default table (git-fixes).\n- ASoC: rt1318-sdw: sort the register default table (git-fixes).\n- ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get (git-fixes).\n- ASoC: sgtl5000: sort the register default table (git-fixes).\n- ASoC: SOF: pcm: Move period/buffer configuration print after platform open (stable-fixes).\n- ASoC: sof: pcm: use snd_pcm_direction_name() (stable-fixes).\n- ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() (git-fixes).\n- ASoC: SOF: validate topology volume range before allocation (git-fixes).\n- ASoC: sti-sas: sort the register default table (git-fixes).\n- ASoC: tas2552: sort the register default table (git-fixes).\n- ASoC: tas2764: sort the register default table (git-fixes).\n- ASoC: tas2780: sort the register default table (git-fixes).\n- ASoC: tegra210_i2s: sort the register default table (git-fixes).\n- ASoC: tegra210_mixer: sort the register default table (git-fixes).\n- ASoC: tegra: Fix the MIXER enable default value (git-fixes).\n- ASoC: tegra: Sort MBDRC register defaults (git-fixes).\n- ASoC: xilinx: formatter_pcm: fix stream_data leak on open error (git-fixes).\n- ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers (git-fixes).\n- batman-adv: bla: fix freeing of claims on meshif deletion (git-fixes).\n- batman-adv: bla: prevent CRC corruptions after claim flush (git-fixes).\n- batman-adv: dat: avoid unaligned fault in IP extraction (git-fixes).\n- batman-adv: fix stale receive device on merged fragments (git-fixes).\n- Bluetooth: btintel: Fix diagnostics event detection (git-fixes).\n- Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path (git-fixes).\n- Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX (git-fixes).\n- Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event (git-fixes).\n- Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() (git-fixes).\n- Bluetooth: do not leak an hci_conn when a second LE connect is rejected (git-fixes).\n- Bluetooth: eir: Fix OOB read in eir_get_service_data() (git-fixes).\n- Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_conn: hold conn reference in abort_conn_sync() (git-fixes).\n- Bluetooth: hci_conn: re-enable advertising only for peripheral role (git-fixes).\n- Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection (git-fixes).\n- Bluetooth: hci_event: fix LE list UAF on reset (git-fixes).\n- Bluetooth: hci_event: validate LE Set CIG Parameters response (git-fixes).\n- Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths (git-fixes).\n- Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists (stable-fixes).\n- Bluetooth: hci_uart: Fix false success return in hci_uart_setup() (git-fixes).\n- Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready (git-fixes).\n- Bluetooth: MGMT: free the mesh send cancel command when it is cancelled (git-fixes).\n- Bluetooth: MSFT: validate evt_prefix_len against the response length (git-fixes).\n- Bluetooth: RFCOMM: serialize security confirmation handling (git-fixes).\n- Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept (git-fixes).\n- Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (git-fixes).\n- Bluetooth: virtio_bt: avoid OOB read of build info string (git-fixes).\n- bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation (git-fixes).\n- bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET (git-fixes).\n- bus: ti-sysc: Fix /chosen node reference leak (git-fixes).\n- cacheinfo: don't propagate DT/ACPI error when arch supplies info (arm64) (git-fixes).\n- can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking (stable-fixes).\n- crypto: aspeed - Propagate platform_get_irq() errors (git-fixes).\n- crypto: atmel-sha204a - fix heap info leak on I2C transfer failure (git-fixes).\n- crypto: atmel-tdes - use scatterlist length before DMA mapping (git-fixes).\n- crypto: ccm - Set rfc4309 maxauthsize from child (git-fixes).\n- crypto: ccp - Fix memory leak in SEV INIT_EX path (git-fixes).\n- crypto: ccp - Fix possible deadlock in SEV init failure path (git-fixes).\n- crypto: doc - Remove extra parenthesis (git-fixes).\n- crypto: hisilicon/sec2 - fix CCM algorithm long packet failure (git-fixes).\n- crypto: keembay - Initialize completion before requesting IRQ (git-fixes).\n- crypto: keembay - publish OF module alias for OCS AES/SM4 (git-fixes).\n- crypto: mxs-dcp - fix source scatterlist length access (git-fixes).\n- crypto: qat - cancel work on re-enable SR-IOV timeout (git-fixes).\n- crypto: qat - clear AES key schedule from stack (git-fixes).\n- crypto: qce - fix CCM AAD buffer underallocation (git-fixes).\n- crypto: qce - fix error path in devm_qce_register_algs (git-fixes).\n- crypto: rk3288 - fail ahash requests on HASH idle timeout (git-fixes).\n- crypto: sa2ul - stop probe if context pool creation fails (git-fixes).\n- crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping (git-fixes).\n- device property: fix infinite loop in fwnode_for_each_child_node() (git-fixes).\n- dmaengine: dw-edma: Clear stale requests on termination (git-fixes).\n- dmaengine: dw-edma: Complete descriptors before pausing (git-fixes).\n- dmaengine: dw-edma: Initialize IRQ data before requesting IRQs (git-fixes).\n- dmaengine: dw-edma: Serialize abort state updates (git-fixes).\n- dmaengine: dw-edma: Serialize channel state checks (git-fixes).\n- dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe (git-fixes).\n- dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure (git-fixes).\n- dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal (git-fixes).\n- dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers (git-fixes).\n- dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout (git-fixes).\n- driver core: soc: Unregister bus on early device registration failure (git-fixes).\n- drm/amd/display: avoid divide-by-zero in __is_lut_linear() (git-fixes).\n- drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read (git-fixes).\n- drm/amdgpu/gfx6: Fixup emit_cntxcntl() (git-fixes).\n- drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets (git-fixes).\n- drm/amdgpu/gfx6: Use PFP on the compute queues too (git-fixes).\n- drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup (git-fixes).\n- drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup (git-fixes).\n- drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (git-fixes).\n- drm/amdgpu: cap GTT size to physical RAM on APUs (stable-fixes).\n- drm/amdgpu: check ASPM on the dGPU host link (git-fixes).\n- drm/amdgpu: disallow multiple FENCE chunks in one submit (git-fixes).\n- drm/amdgpu: fix aperture iounmap skipped on device removal (git-fixes).\n- drm/amdgpu: fix autosuspend cleanup during removal (git-fixes).\n- drm/amdgpu: Fix UVD decode image min size calculation (stable-fixes).\n- drm/amdgpu: Fix UVD dpb min size calculation for H264 (stable-fixes).\n- drm/amdgpu: Fix UVD min buffer sizes (stable-fixes).\n- drm/amdgpu: Fix VCE 3 ring align_mask (git-fixes).\n- drm/amdgpu: Implement insert_end for VCE 3 (git-fixes).\n- drm/amdgpu: Reject UVD message with dimensions above 4096 (stable-fixes).\n- drm/amdgpu: Reject UVD message with invalid number of h265 refs (stable-fixes).\n- drm/amdgpu: restore UMD profile pstate after runtime resume (stable-fixes).\n- drm/amdgpu: validate GEM_CREATE domain combinations (stable-fixes).\n- drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE (stable-fixes).\n- drm/amdkfd: fix QID bit leak in pqm_create_queue() (stable-fixes).\n- drm/amdkfd: Handle invalid event type in CRIU event restore (stable-fixes).\n- drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure (git-fixes).\n- drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure (git-fixes).\n- drm/bridge: ps8640: propagate AUX transfer register errors (git-fixes).\n- drm/bridge: tc358767: clamp the reported AUX read size to the request (git-fixes).\n- drm/connector: Fix epoch_counter docs to reflect reality (git-fixes).\n- drm/hibmc: Fix list of formats on the primary plane (git-fixes).\n- drm/hibmc: Use drm_atomic_helper_check_plane_state() (git-fixes).\n- drm/i915/fbc: Extract intel_fbc_has_fences() (stable-fixes).\n- drm/lima: call drm_mm_init() with a valid allocation range (git-fixes).\n- drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0) (git-fixes).\n- drm/msm/dsi: Drop dev_pm_opp_set_rate(0) (git-fixes).\n- drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value (git-fixes).\n- drm/panel-edp: fix i2c adapter leak on probe failure (git-fixes).\n- drm/panel: samsung-s6d16d0: Power off on prepare failure (git-fixes).\n- drm/radeon: fix autosuspend cleanup during teardown (git-fixes).\n- drm/radeon: restore hardware polling in fence_is_signaled to fix performance regression (git-fixes).\n- drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format (git-fixes).\n- drm/ssd130x: fix column and row end address in partial updates for ssd132x (git-fixes).\n- drm/sun4i: crtc: Propagate layer initialization error (git-fixes).\n- drm/sun4i: Drop node references while building component list (git-fixes).\n- drm/sun4i: dw-hdmi: Drop TCON TOP port reference (git-fixes).\n- drm/sun4i: fix refcount leak in sun4i_backend_init_sat() (git-fixes).\n- drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz (git-fixes).\n- drm/sun4i: tcon: Drop remote endpoint reference (git-fixes).\n- drm/sun4i: tcon: Drop TCON TOP device reference (git-fixes).\n- drm/sun4i: tcon: Set output mux for DSI and LVDS (git-fixes).\n- drm/sun4i: vi scaler: Fix coefficient selection (git-fixes).\n- drm/tegra: dsi: Re-add clear enable register if DSI was powered by bootloader (git-fixes).\n- drm/tve200: add OF module alias for autoloading (git-fixes).\n- drm: fix race between partial drm_dev_register() failure and ioctl (git-fixes).\n- drm: lcdif: Wait for vblank before disabling DMA (git-fixes).\n- drm: Remove unused header in drm_dumb_buffers.c (git-fixes).\n- ethtool: rss: fix hkey leak when indir_size is 0 (git-fixes).\n- fbdev: bitblit: bound-check glyph index in bit_cursor() (git-fixes).\n- fbdev: core: Fix pointer desynchronization in fb_io_read() (git-fixes).\n- fbdev: kyro: Validate overlay viewport coordinates (git-fixes).\n- fbdev: omapfb: panel-dsi-cm: initialize lock before registering display (git-fixes).\n- fbdev: ssd1307fb: defer I2C transfers from damage callbacks (git-fixes).\n- fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device() (git-fixes).\n- fbdev: uvesafb: unregister connector callback on init failure (git-fixes).\n- firmware: arm_scmi: Avoid IDR updates while cleaning channels (git-fixes).\n- firmware: arm_scmi: Drop handle on protocol bind failures (git-fixes).\n- firmware: arm_scmi: Fix requested device removal race (git-fixes).\n- firmware: arm_scmi: Free transport channel on IDR failure (git-fixes).\n- firmware: arm_scmi: Protect device request lookup with RCU (git-fixes).\n- firmware: arm_scmi: Reject out of range DT protocol IDs (git-fixes).\n- firmware: arm_scmi: Unregister device notifier before IDR teardown (git-fixes).\n- firmware: arm_scmi: Use channel ID for transport teardown (git-fixes).\n- firmware_loader: do not queue completed sysfs fallback requests (git-fixes).\n- fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write (git-fixes).\n- fpga: dfl: fme: add error handling (git-fixes).\n- fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration (git-fixes).\n- gpu: host1x: Avoid stack over-read in debug output helpers (git-fixes).\n- gpu: host1x: Fix offset calculation in trace_write_gather (git-fixes).\n- HID: core: fix number/pointer type confusion on long items (git-fixes).\n- HID: core: fix OOB read of field-\u003eusage in hid_set_field() (git-fixes).\n- HID: hyperv: validate initial device info bounds (git-fixes).\n- HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure (git-fixes).\n- HID: lg4ff: validate report length before fixed offsets (git-fixes).\n- HID: logitech-dj: Fix maxfield check in DJ short report validation (git-fixes).\n- HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report (git-fixes).\n- HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write (stable-fixes).\n- HID: logitech-dj: Standardise hid_report_enum variable nomenclature (stable-fixes).\n- HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID (stable-fixes).\n- HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() (git-fixes).\n- HID: mcp2221: validate report size in mcp2221_raw_event() (git-fixes).\n- HID: nintendo: Fix imu_timestamp_us double increment per report (git-fixes).\n- HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() (git-fixes).\n- HID: picolcd: clamp eeprom debugfs read to bytes actually received (git-fixes).\n- HID: roccat: bound device-supplied profile index (git-fixes).\n- HID: roccat: free buffered reports when destroying device (git-fixes).\n- HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature (git-fixes).\n- HID: sensor: custom: Fix field sysfs group cleanup on failure (git-fixes).\n- HID: sensor: custom: Fix use-after-free in enable_sensor (git-fixes).\n- HID: tmff: Use 64-bit arithmetic for force feedback scaling (git-fixes).\n- hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination (git-fixes).\n- hwmon: (lm25066) Use i2c_get_match_data() (stable-fixes).\n- hwmon: (max6621) fix negative temperature offset and crit readings (git-fixes).\n- hwmon: (max6621) fix temperature clamp range (git-fixes).\n- hwmon: (nzxt-smart2) Check return value of init_device() in probe (git-fixes).\n- hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations (git-fixes).\n- hwrng: ks-sa - Fix runtime PM cleanup on registration failure (git-fixes).\n- hwrng: omap - Fix probe error path cleanup (git-fixes).\n- hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() (git-fixes).\n- i2c: bcm-iproc: remove printout on handled timeouts (stable-fixes).\n- i2c: iproc: reset bus after timeout if START_BUSY is stuck (git-fixes).\n- i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure (git-fixes).\n- i2c: mux: Fix channel node leak on adapter add failure (git-fixes).\n- i2c: ocores: Disable clock on failed resume (git-fixes).\n- i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices (git-fixes).\n- i3c: master: Fix device_register() error path (git-fixes).\n- i3c: master: Fix info leak and UAF in device unregister path (git-fixes).\n- i3c: master: svc: bound IBI payload to the requested max_payload_len (git-fixes).\n- ibmvnic: Only record tx completed bytes once per handler (bsc#1274620).\n- iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE (git-fixes).\n- iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable (git-fixes).\n- iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF (git-fixes).\n- iio: chemical: sgp30: Handle IAQ thread creation failure (git-fixes).\n- iio: dac: m62332: Fix regulator reference count imbalance (git-fixes).\n- iio: gyro: mpu3050: fix sign of raw angular velocity readings (git-fixes).\n- iio: light: cm32181: return zero after writing calibscale (git-fixes).\n- iio: light: gp2ap002: Disable regulators on resume failure (git-fixes).\n- iio: light: gp2ap002: re-enable irq if runtime suspend fails (git-fixes).\n- iio: light: isl29028: return zero in write_raw() on success (git-fixes).\n- iio: light: tsl2583: return zero in write_raw() on success (git-fixes).\n- iio: light: tsl2772: fix ALS calibscale readback (git-fixes).\n- iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure (git-fixes).\n- iio: pressure: dps310: fix NULL pointer dereference on ACPI probe (git-fixes).\n- iio: pressure: mpl115: Fix runtime PM cleanup (git-fixes).\n- iio: srf04: fix pm_runtime handling on probe error path (git-fixes).\n- iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() (git-fixes).\n- Input: atkbd - skip deactivate for HONOR ZQC-P (git-fixes).\n- Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard (stable-fixes).\n- Input: evdev - fix information leak in evdev_pass_values() (stable-fixes).\n- Input: evdev - sanitize event type index when fetching event masks (stable-fixes).\n- Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet (git-fixes).\n- Input: focaltech - use signed coordinates to prevent underflow (git-fixes).\n- Input: hynitron_cstxxx - validate touch count and finger IDs (git-fixes).\n- Input: iforce - validate input packet lengths (stable-fixes).\n- Input: iqs5xx - validate firmware record destination span (git-fixes).\n- Input: mms114 - fix Y-resolution configuration (git-fixes).\n- Input: psxpad-spi - set driver data before use (git-fixes).\n- Input: sur40 - fix input device registration ordering (stable-fixes).\n- Input: sur40 - fix V4L error path cleanup (stable-fixes).\n- Input: synaptics-rmi4 - block s_input when F54 queue is busy (git-fixes).\n- Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer (git-fixes).\n- Input: synaptics-rmi4 - fix F55 transmitter electrode count typo (git-fixes).\n- Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue (git-fixes).\n- Input: synaptics-rmi4 - zero report size on F54 work error (git-fixes).\n- Input: xpad - add support for ZENAIM LEVERLESS (stable-fixes).\n- interconnect: Fix use after free in icc_get() and of_icc_get_by_index() (git-fixes).\n- ipmi: ipmb: validate write message length (git-fixes).\n- ipmi: si: Fix NULL pointer dereference after failed registration (git-fixes).\n- KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes).\n- KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page (git-fixes).\n- leds: pca9532: Fix inverted GPIO output polarity (git-fixes).\n- leds: pca9532: Fix phantom device registration on missing hardware (git-fixes).\n- lib/string: fix memchr_inv() for large ranges (git-fixes).\n- lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() (git-fixes).\n- mailbox: qcom-ipcc: fix duplicate channel allocation across holes (git-fixes).\n- mailbox: rockchip: disable pclk on probe failure and unbind (git-fixes).\n- maple_tree: fix argument name in header (git-fixes).\n- md/raid1: create serial pool adding rdev to array with serialize_policy=1 (bsc#1272261).\n- media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref (git-fixes).\n- media: cec-pin: Fix event FIFO ordering (git-fixes).\n- media: cec: disable delayed work before freeing an interrupted transmit (git-fixes).\n- media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash (git-fixes).\n- media: cec: Serialize exclusive follower delivery (git-fixes).\n- media: cec: stm32: prevent out-of-bounds write on RX overflow (git-fixes).\n- media: cedrus: fix memory leak in cedrus_init_ctrls() (git-fixes).\n- media: cobalt: Avoid freeing ALSA private data twice (git-fixes).\n- media: cx231xx: reject geometry changes while the VBI queue is busy (git-fixes).\n- media: cx23885: cancel NetUP CI work before teardown (git-fixes).\n- media: em28xx: defer audio-only extension registration (git-fixes).\n- media: em28xx: fix use-after-free of dev_next-\u003edevlist on disconnect (git-fixes).\n- media: go7007: defer the ALSA v4l2 put until card release (git-fixes).\n- media: i2c: ov02a10: fix endpoint parsing use-after-free (git-fixes).\n- media: i2c: ov7740: fix use-after-destroy in remove (git-fixes).\n- media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define (git-fixes).\n- media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define (git-fixes).\n- media: mc-entity: Add missing kerneldoc (git-fixes).\n- media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common (git-fixes).\n- media: nxp: imx8-isi: Correct color map between V4L2 and ISI (git-fixes).\n- media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing (git-fixes).\n- media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks (git-fixes).\n- media: rc: sunxi-cir: Unregister rc device on probe failure (git-fixes).\n- media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure (git-fixes).\n- media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak (git-fixes).\n- media: s2255: bound JPEG frame size before copying into the buffer (git-fixes).\n- media: s2255: check firmware size before reading trailing marker (git-fixes).\n- media: saa7164: fix cleanup on resource allocation failure (git-fixes).\n- media: tda18250: fix possible integer overflow (git-fixes).\n- media: usbtv: keep device alive while ALSA card exists (git-fixes).\n- media: v4l2-ctrls: Allow unknown HDR10 white point and luminance (git-fixes).\n- media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link (git-fixes).\n- media: venus: fix payload size calculation in parse_raw_formats() (git-fixes).\n- media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() (git-fixes).\n- media: vicodec: fix out-of-bounds write in FWHT encoder (git-fixes).\n- media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure (git-fixes).\n- media: vimc: fix pixel format lookup in enum_framesizes (git-fixes).\n- media: zoran: Avoid freeing a registered video_device twice (git-fixes).\n- mei: pull kvfree out of spinlock (git-fixes).\n- mfd: iqs62x: Reject zero-length firmware records (git-fixes).\n- mfd: rave-sp: validate received frame payload lengths (git-fixes).\n- misc: bcm-vk: Use acquire/release for msgq_inited (git-fixes).\n- misc: fastrpc: fix channel ctx ref leak when session alloc fails (git-fixes).\n- misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free (git-fixes).\n- misc: fastrpc: Remove buffer from list prior to unmap operation (git-fixes).\n- misc: fastrpc: take fl-\u003elock when moving mmaps on interrupted invoke (git-fixes).\n- misc: rtsx: add missing write register handling (git-fixes).\n- misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() (git-fixes).\n- mkspec-dtb: Move DTS prefix into package list.\n- mkspec-dtb: Move provides-obsoletes to package list.\n- mkspec-dtb: Put per-architecture package lists into a hash.\n- mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit (git-fixes).\n- mmc: sdhci: unmap the bounce buffer before device release (git-fixes).\n- mmc: via-sdmmc: stop card-detect handling on probe failure (git-fixes).\n- mtd: afs: validate v2 image info bounds (git-fixes).\n- mtd: mtdoops: free page bitmap when the backing MTD is removed (git-fixes).\n- mtd: mtdswap: Avoid freeing registered blktrans device twice (git-fixes).\n- mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() (git-fixes).\n- mtd: rawnand: validate ONFI extended parameter page sections (git-fixes).\n- net: mana: Add debug knob to skip TX timeout recovery reset (git-fixes).\n- net: mana: Add handler for sriov configure (bsc#1272756).\n- net: mana: Cap MSI-X vectors to the device MSI-X table size (git-fixes).\n- net: mana: Extend RX CQE coalescing up to 8 packets (git-fixes).\n- net: mana: Fall back to scattered pages for GDMA queues (git-fixes).\n- net: mana: force full-page RX buffers via ethtool private flag (bsc#1269792).\n- net: mana: refactor mana_get_strings() and mana_get_sset_count() to use switch (bsc#1269792).\n- net: mana: Route ring-buffer access through offset-based helpers (git-fixes).\n- net: tap: set skb-\u003edev before parsing virtio net header in tap_get_user_xdp() (git-fixes bsc#1274550).\n- net: thunderbolt: Count delivered packets in rx_packets and rx_bytes (git-fixes).\n- net: thunderbolt: Mark the connection down when bringing it up fails (git-fixes).\n- net: thunderbolt: Release the Rx HopID that was handed out on mismatch (git-fixes).\n- net: thunderbolt: Tear down DMA paths before stopping the rings (git-fixes).\n- net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() (git-fixes).\n- net: usb: ipheth: fix carrier_work UAF on disconnect (git-fixes).\n- nfc: digital: clamp SENSF_RES length to the destination buffer (git-fixes).\n- nfc: digital: Do not dump a NULL response in command completion (git-fixes).\n- nfc: fdp: bound the device-reported read length and fix an skb leak (git-fixes).\n- nfc: llcp: avoid userspace overflow on invalid optlen (git-fixes).\n- nfc: llcp: bound SNL TLV parsing to the skb and add length checks (git-fixes).\n- nfc: llcp: bound the connect_sn TLV walk to the skb (git-fixes).\n- nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (git-fixes).\n- nfc: llcp: read llcp_sock-\u003elocal under the socket lock in getsockopt (git-fixes).\n- nfc: llcp: reject PDUs shorter than the LLCP header (git-fixes).\n- nfc: microread: validate target discovery payload lengths (git-fixes).\n- nfc: nci: fix double completion race in nci_data_exchange_complete (git-fixes).\n- nfc: nci: fix out-of-bounds write in nci_target_auto_activated() (git-fixes).\n- nfc: nci: fix uninit-value in the RF discover/activated NTF handlers (git-fixes).\n- nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing (git-fixes).\n- nfc: nci: free destination parameters when closing a connection (git-fixes).\n- nfc: pn533: hold a reference to the request skb during send_frame (git-fixes).\n- nfc: pn533: purge fragmented skbs during cleanup (git-fixes).\n- nfc: st21nfca: validate ATR_REQ length against the received frame (git-fixes).\n- nouveau/gem: reserve the bo in the info ioctl around the vma lookup (git-fixes).\n- PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] (git-fixes).\n- PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk (git-fixes).\n- PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip (git-fixes).\n- PCI: j721e: Fix incorrect max_lanes for J7200 (git-fixes).\n- PCI: meson: Fix GPIO state while requesting PERST# (git-fixes).\n- phy: qcom: qmp-combo: Correct pre-emphasis table for QMP v4 DP PHYs (git-fixes).\n- phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend (git-fixes).\n- phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table (git-fixes).\n- phy: sunplus: fix error handling in sp_uphy_init() (git-fixes).\n- pinctrl: bcm2835: Don't remove an unregistered GPIO chip (git-fixes).\n- pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip (git-fixes).\n- pinctrl: rockchip: Reset the pin count when recalculating SoC data (git-fixes).\n- platform/chrome: cros_ec_debugfs: Clean up console log on probe failure (git-fixes).\n- platform/chrome: cros_ec_debugfs: Unregister panic notifier (git-fixes).\n- platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count (git-fixes).\n- platform/chrome: sensorhub: Bound the EC-reported sensor number (git-fixes).\n- platform/chrome: sensorhub: Fix dropped timestamp events and log spam (git-fixes).\n- platform/chrome: sensorhub: Fix memory overread in ring handler (git-fixes).\n- platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL (git-fixes).\n- platform/surface: acpi-notify: Check ACPI companion before use (git-fixes).\n- platform/x86: dell-privacy: Fix race condition (git-fixes).\n- platform/x86: dell-wmi-base: Fix resource leak on module load failure (git-fixes).\n- platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer (git-fixes).\n- platform/x86: dell-wmi-sysman: Fix instance ID bounds (git-fixes).\n- platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path (git-fixes).\n- platform/x86: ISST: Just allow 2 bits for SST feature enable (git-fixes).\n- platform/x86: ISST: Validate level in perf mask ioctls (git-fixes).\n- platform/x86: ISST: Validate logical CPU id and clos id (git-fixes).\n- platform/x86: ISST: Validate socket ID in clos_assoc ioctl (git-fixes).\n- PM: sleep: Fix off-by-one in wakelocks number limit check (git-fixes).\n- power: supply: bd99954: Drop bad register fields (git-fixes).\n- power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address (git-fixes).\n- power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address (git-fixes).\n- power: supply: bq27xxx: bq27520g4: fix REG_TTES address (git-fixes).\n- power: supply: bq256xx: drain usb_work before freeing the charger (git-fixes).\n- power: supply: bq24257: fix use-after-free on remove (git-fixes).\n- power: supply: bq25890: Fix power_supply reference leak (git-fixes).\n- power: supply: cros_usbpd-charger: bound the EC-reported port count (git-fixes).\n- power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS (git-fixes).\n- power: supply: isp1704_charger: cancel work on remove (git-fixes).\n- power: supply: lp8727: fix use-after-free in lp8727_release_irq() (git-fixes).\n- power: supply: max17040: drop incorrect I2C functionality check (git-fixes).\n- power: supply: max17040: synchronize work cancellation on suspend (git-fixes).\n- power: supply: qcom_battmgr: terminate the strings from firmware (git-fixes).\n- power: supply: rt9455: quiesce delayed work before teardown (git-fixes).\n- power: supply: sbs-battery: Use a per-device serial number buffer (git-fixes).\n- power: supply: twl4030_charger: cancel workers via devm (git-fixes).\n- power: supply: ucs1002: fix use-after-free on remove (git-fixes).\n- powercap: intel_rapl_tpmi: Handle PMU registration failure during probe (git-fixes).\n- powerpc/pseries: Ensure vpa,slb_shadow \u0026 dtl are unregistered during crash (bsc#1271256).\n- powerpc/pseries: lparcfg - fix kbuf[] underflow (bsc#1274753 ltc#221289 bsc#1274754 ltc#221288 bsc#1274752\n  ltc#221290).\n- powerpc/pseries: pci - logic bug (bsc#1274749 ltc#221282 bsc#1274755 ltc#221284 bsc#1274756 ltc#221283).\n- ppdev: prevent overflow when setting port timeout (git-fixes).\n- qede: fix out-of-bounds check for cqe-\u003elen_list (git-fixes).\n- rapidio: clear mport-\u003enet when rio_add_net() fails (git-fixes).\n- rapidio: mport_cdev: fix use-after-free in dma_req_free() (git-fixes).\n- RDMA/irdma: Remove redundant legacy_mode checks (git-fixes).\n- RDMA/mana_ib: drain QP references after partial table insertion (git-fixes).\n- RDMA/mana_ib: unify QP lookup table (git-fixes).\n- RDMA/mlx5: Fix integer overflow of user QP buffer size (git-fixes).\n- regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer (git-fixes).\n- regulator: core: use system_freezable_wq for init complete work (git-fixes).\n- regulator: devres: add API for reference voltage supplies (stable-fixes).\n- regulator: devres: fix devm_regulator_get_enable_read_voltage() return (git-fixes).\n- regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata (git-fixes).\n- regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling (git-fixes).\n- remoteproc: qcom: Fix glink-\u003enode reference leak in qcom_add_glink_subdev (git-fixes).\n- remoteproc: qcom_q6v5_adsp: Fix reference leak for device node (git-fixes).\n- remoteproc: scp: Fix device reference leak on failed lookup (git-fixes).\n- Revert \"drm/amdgpu: fix aperture mapping leak\" (git-fixes).\n- Revert \"media: v4l2-dev: fix error handling in __video_register_device()\" (git-fixes).\n- Revert \"thermal/drivers/hwmon: Cleanup coding style a bit\" (stable-fixes).\n- rpmsg: core: Fix incorrect return value documentation (git-fixes).\n- rpmsg: glink: smem: order FIFO read after availability check (git-fixes).\n- rtc: gamecube: check return value of devm_rtc_register_device() (git-fixes).\n- rtc: pcf8563: fix clock provider leak on unbind (git-fixes).\n- rtc: pcf85363: Add error checking to regmap calls in probe() (git-fixes).\n- rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers (git-fixes).\n- rtc: rzn1: Fix weekday underflow when alarm crosses month boundary (git-fixes).\n- rtc: zynqmp: Return optional clock lookup errors (git-fixes).\n- scsi: storvsc: Support manual scans for all Hyper-V targets (git-fixes).\n- sctp: avoid auth_enable sysctl UAF during netns teardown (git-fixes).\n- serial: 8250_dma: Clear stale RX state on shutdown (git-fixes).\n- serial: amba-pl011: unprepare console clock on unregister (git-fixes).\n- serial: core: clear freed pointers on uart_register_driver() failure (git-fixes).\n- serial: qcom-geni: fix TX DMA buffer flush (git-fixes).\n- serial: sc16is7xx: fix copy-paste errors in EFR_SWFLOWx_BIT constants (stable-fixes).\n- smb/client: handle overlapping allocated ranges in fallocate (bsc#1274902).\n- smb: client: reject overlapping data areas in SMB2 responses (git-fixes).\n- smb: client: require net admin for CIFS SWN netlink (bsc#1273966).\n- smb: client: resolve SWN tcon from live registrations (bsc#1273872).\n- soc: fsl: qe: check platform_driver_register() in qe_ic_of_init() (git-fixes).\n- soc: qcom: rpmh-rsc: manage PM notifiers with devres (git-fixes).\n- soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() (git-fixes).\n- software node: Fix software_node_get_reference_args() with index -1 (git-fixes).\n- soundwire: qcom: Fix port exhaustion check in stream_alloc_ports (git-fixes).\n- speakup: keyhelp: guard letter_offsets possible out-of-range indexing (git-fixes).\n- spi: img-spfi: don't disable runtime PM on DMA deferred probe (git-fixes).\n- spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers (stable-fixes).\n- spi: sprd-adi: Fix probe succeeding without registering the controller (git-fixes).\n- staging: fbtft: Use sysfs_emit_at() to print to sysfs file (git-fixes).\n- staging: media: tegra-video: vi: fix probe failure on skipped last port (git-fixes).\n- staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown (git-fixes).\n- staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() (git-fixes).\n- staging: rtl8723bs: fix missing shared-key auth challenge length check (git-fixes).\n- staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() (git-fixes).\n- staging: rtl8723bs: fix OOB read in WMM_param_handler() (git-fixes).\n- staging: rtl8723bs: use kfree_sensitive() for key material (git-fixes).\n- staging: rtl8723bs: validate monitor transmit frame lengths (git-fixes).\n- staging: sm750fb: gate dualview dataflow using g_dualview (git-fixes).\n- thermal/drivers/imx: Disable clock on runtime resume failure (git-fixes).\n- thermal/drivers/qoriq: Disable clock on resume failure (git-fixes).\n- thermal: intel: int3400: clean up ODVP on probe failures (git-fixes).\n- thunderbolt: Bound the DROM dual link port number before indexing sw-\u003eports (git-fixes).\n- thunderbolt: icm: Preserve USB4 proxy data-valid bit (git-fixes).\n- tlclk: if sscanf() fails, fall back to 0, not random value (git-fixes).\n- tpm: st33zp24: Return zero on status read failure (git-fixes).\n- tpm: st33zp24: Validate locality read result (git-fixes).\n- tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout (git-fixes).\n- tty: clear cdev pointer after cdev_add() failure (git-fixes).\n- tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 (git-fixes).\n- tty: skip cdev_del() when no cdev is registered (git-fixes).\n- uio: Fix stale info pointer in failed registration path (git-fixes).\n- usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() (git-fixes).\n- usb: atm: usbatm: fix invalid ci_range initialization (git-fixes).\n- USB: c67x00: fix use-after-free in c67x00_add_iso_urb() (git-fixes).\n- usb: cdnsp: fix incorrect endian conversions for APB timeout register (git-fixes).\n- usb: dwc2: add missing @remotewakeup kernel-doc parameter (git-fixes).\n- usb: dwc2: gadget: Exit partial power down state when changing USB pull-up (git-fixes).\n- usb: gadget: configfs: fix out-of-bounds read of qw_sign (git-fixes).\n- usb: gadget: f_fs: Prevent deadlock during ep0 read loop (git-fixes).\n- usb: gadget: f_ncm: Use unsigned int for ndp_index (git-fixes).\n- usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() (git-fixes).\n- usb: gadget: f_uac1_legacy: remove broken string configfs attributes (git-fixes).\n- usb: gadget: pch_udc: remove excess kernel-doc member for registered (git-fixes).\n- usb: gadget: r8a66597: avoid double free of ep0_req in probe error path (git-fixes).\n- usb: gadget: snps_udc_plat: clean up PHY on probe deferral (git-fixes).\n- usb: gadget: u_audio: Fix use-after-free on sound card disconnect (git-fixes).\n- usb: gadget: uac: validate rate list length before storing (git-fixes).\n- usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() (git-fixes).\n- usb: mtu3: allow system suspend during active gadget connection (git-fixes).\n- usb: musb: omap2430: clean up probe error handling (stable-fixes).\n- USB: phy: fsl-usb: fix missing static keywords (git-fixes).\n- usb: renesas_usbhs: Fix power-off ordering on unbind (git-fixes).\n- USB: serial: digi_acceleport: fix port registration order (git-fixes).\n- USB: serial: ftdi_sio: add support for E+H FXA291 (stable-fixes).\n- USB: serial: option: add TDTECH MT5710-CN (stable-fixes).\n- USB: serial: option: fix slab OOB read in interrupt URB callback (git-fixes).\n- USB: serial: spcp8x5: drop broken carrier detect support (git-fixes).\n- USB: storage: add NO_ATA_1X quirk for Longmai USB Key (stable-fixes).\n- usb: typec: ucsi: unregister debugfs entries on teardown (git-fixes).\n- usb: usbfs: fix use-after-free of usb_device in usbdev_release() (git-fixes).\n- usb: xhci: Handle USB3 port events when there is one roothub (git-fixes).\n- vt: add permission check for KDSKBMETA ioctl (stable-fixes).\n- vt: stabilize tty reference in kbd_keycode with tty_port_tty_get (stable-fixes).\n- w1: ds28e17: reject an oversize length on an I2C block read (git-fixes).\n- w1: ds2482: Fix signedness bug in ds2482_w1_triplet() (git-fixes).\n- wifi: ath6kl: avoid buffer overreads in WMI event handlers (git-fixes).\n- wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets (git-fixes).\n- wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump (git-fixes).\n- wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() (git-fixes).\n- wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate (git-fixes).\n- wifi: ath11k: Correctly copy the hint BSSID in WMI scan request (git-fixes).\n- wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx() (git-fixes).\n- wifi: ath12k: Correctly copy the hint BSSID in WMI scan request (git-fixes).\n- wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() (git-fixes).\n- wifi: brcmfmac: fix P2P action frame handling without device vif (git-fixes).\n- wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs (git-fixes).\n- wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments (git-fixes).\n- wifi: iwlwifi: mei: pass correct argument to function (git-fixes).\n- wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser (git-fixes).\n- wifi: mac80211: send TWT teardown to peer after setup TX failure (git-fixes).\n- wifi: mac80211: skip default WMM setup for AP_VLAN links (git-fixes).\n- wifi: mac80211: skip unused probe response countdown offsets (git-fixes).\n- wifi: mt76: fix 4th chain ACK RSSI bitmask in sta_poll (git-fixes).\n- wifi: mt76: fix ER-SU 106-tone RU check in RX rate decode (git-fixes).\n- wifi: mt76: fix HE DCM max-RU capability encoding (git-fixes).\n- wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length (git-fixes).\n- wifi: mt76: mt792x: Fix memory leak in SDIO TX path (git-fixes).\n- wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex (git-fixes).\n- wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss (git-fixes).\n- wifi: mt76: mt7915: fix double hif2 init on the non-WED path (git-fixes).\n- wifi: mt76: mt7915: fix ext PHY use-after-free on register error path (git-fixes).\n- wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986 (git-fixes).\n- wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie (git-fixes).\n- wifi: mt76: mt7915: release hif2 reference on probe IRQ failure (git-fixes).\n- wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement (git-fixes).\n- wifi: mt76: mt7915: unwind state on add_interface failure (git-fixes).\n- wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields (git-fixes).\n- wifi: mt76: mt7915: write RX header translation bit to the correct register (git-fixes).\n- wifi: mt76: mt7921: validate CLC firmware records (git-fixes).\n- wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb (git-fixes).\n- wifi: mt76: mt7925: fix msg len mismatch between driver and firmware (git-fixes).\n- wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config (git-fixes).\n- wifi: mt76: mt7996: don't report a zero TX bitrate (git-fixes).\n- wifi: mt76: mt7996: fix reg addr remap when addr is 0 (git-fixes).\n- wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV (git-fixes).\n- wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset (git-fixes).\n- wifi: mt76: mt7996: validate RX band_idx before dereferencing phys (git-fixes).\n- wifi: mt76: report data NSS for STBC frames in RX rate decode (git-fixes).\n- wifi: mwifiex: Detach sync cmd buffer on interrupted wait (git-fixes).\n- wifi: rtlwifi: pci: fix error path in rtl_pci_probe() (git-fixes).\n- wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() (git-fixes).\n- wifi: rtw89: fix HE extended capability length check (git-fixes).\n- wifi: zd1211rw: reject secondary interfaces to prevent conflicts (git-fixes).\n- x86/bugs: Clarify that syscall hardening isn't a BHI mitigation (git-fixes).\n- xhci: dbgtty: Fix unregister on tty_alloc_driver() failure (git-fixes).\n- xhci: dbgtty: Fix unregister on tty_register_driver() failure (git-fixes).\n","status":"published","published":"2026-09-08T10:34:26Z","modified":"2026-09-15T18:23:09.824440367Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23529-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1269731).\n- CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).\n- CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).\n- CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).\n- CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).\n- CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).\n- CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).\n- CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).\n- CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).\n- CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).\n- CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).\n- CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).\n- CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).\n- CVE-2026-43278: dm: clear cloned request bio pointer when last clone bio completes (bsc#1264584).\n- CVE-2026-43319: spi: spidev: fix lock inversion between spi_lock and buf_lock (bsc#1264788).\n- CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).\n- CVE-2026-43416: powerpc, perf: Check that current-\u003emm is alive before getting user callchain (bsc#1265121).\n- CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).\n- CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).\n- CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).\n- CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).\n- CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).\n- CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).\n- CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).\n- CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).\n- CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).\n- CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).\n- CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).\n- CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).\n- CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).\n- CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).\n- CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).\n- CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).\n- CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).\n- CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).\n- CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).\n- CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).\n- CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).\n- CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).\n- CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).\n- CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).\n- CVE-2026-53094: bpf: Fix stale offload-\u003eprog pointer after constant blinding (bsc#1269965).\n- CVE-2026-53096: bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path (bsc#1269969).\n- CVE-2026-53110: selftests/bpf: Add ASSERT_OK_FD macro (bsc#1269985).\n- CVE-2026-53111: bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap (bsc#1269167).\n- CVE-2026-53126: blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() (bsc#1269635).\n- CVE-2026-53154: mm/hugetlb: restore reservation on error in hugetlb folio copy paths (bsc#1269665).\n- CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (bsc#1269306).\n- CVE-2026-53207: mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison (bsc#1269590).\n- CVE-2026-53219: netfilter: x_tables: avoid leaking percpu counter pointers (bsc#1269686).\n- CVE-2026-53220: netfilter: revalidate bridge ports (bsc#1269381).\n- CVE-2026-53223: net: guard timestamp cmsgs to real error queue skbs (bsc#1269301).\n- CVE-2026-53228: ipv6: sit: reload inner IPv6 header after GSO offloads (bsc#1269256).\n- CVE-2026-53238: netlabel: validate unlabeled address and mask attribute lengths (bsc#1269774).\n- CVE-2026-53260: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req() (bsc#1269731) \t  \n- CVE-2026-53264: net/sched: act_api: use RCU with deferred freeing for action lifecycle (bsc#1269238).\n- CVE-2026-53269: netfilter: synproxy: add mutex to guard hook reference counting (bsc#1269579).\n- CVE-2026-53273: tee: optee: prevent use-after-free when the client exits before the supplicant (bsc#1269713).\n- CVE-2026-53309: ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison (bsc#1269815).\n- CVE-2026-53330: drm/amd/display: Fix out-of-bounds read in (bsc#1270090).\n- CVE-2026-53336: nvmem: layouts: onie-tlv: fix hang on unknown types (bsc#1270108).\n- CVE-2026-53337: net: bonding: fix NULL pointer dereference in bond_do_ioctl() (bsc#1270251).\n- CVE-2026-53353: hsr: Remove WARN_ONCE() in hsr_addr_is_self() (bsc#1270111).\n- CVE-2026-53365: vsock/virtio: fix zerocopy completion for multi-skb sends (bsc#1271365).\n- CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830).\n- CVE-2026-63801: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (bsc#1272230).\n- CVE-2026-63808: exfat: fix potential use-after-free in exfat_find_dir_entry() (bsc#1272260).\n- CVE-2026-63810: block: Avoid mounting the bdev pseudo-filesystem in userspace (bsc#1272297).\n- CVE-2026-63823: keys: Pin request_key_auth payload in instantiate paths (bsc#1272182).\n- CVE-2026-63827: apparmor: fix use-after-free in rawdata dedup loop (bsc#1272179).\n- CVE-2026-63828: apparmor: mediate the implicit connect of TCP fast open sendmsg (bsc#1272175).\n- CVE-2026-63860: RDMA/core: Prefer NLA_NUL_STRING (bsc#1272429).\n- CVE-2026-63865: bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks (bsc#1272486).\n- CVE-2026-63868: net: garp: fix unsigned integer underflow in garp_pdu_parse_attr (bsc#1272497).\n- CVE-2026-63879: drm/amdgpu: fix amdgpu_hmm_range_get_pages (bsc#1272569).\n- CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).\n- CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272385).\n- CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272390).\n- CVE-2026-63889: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (bsc#1272423).\n- CVE-2026-63891: thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() (bsc#1272641).\n- CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1272877).\n- CVE-2026-63925: macsec: fix replay protection at XPN lower-PN wrap (bsc#1273008).\n- CVE-2026-63926: bpf: sockmap: fix tail fragment offset in bpf_msg_push_data (bsc#1273019).\n- CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1272662).\n- CVE-2026-63969: ipv6: fix possible infinite loop in rt6_fill_node() (bsc#1272484).\n- CVE-2026-63970: vsock/virtio: bind uarg before filling zerocopy skb (bsc#1272673).\n- CVE-2026-63980: net/handshake: Use spin_lock_bh for hn_lock (bsc#1273028).\n- CVE-2026-63985: ethtool: eeprom: add more safeties to EEPROM Netlink fallback (bsc#1272963).\n- CVE-2026-63990: bonding: refuse to enslave CAN devices (bsc#1273027).\n- CVE-2026-63992: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (bsc#1272868).\n- CVE-2026-63999: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure (bsc#1273038).\n- CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273030).\n- CVE-2026-64001: ALSA: pcm: oss: Fix setup list UAF on proc write error (bsc#1273734).\n- CVE-2026-64002: ipv4: free net-\u003eipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (bsc#1273774).\n- CVE-2026-64004: net/iucv: fix locking in .getsockopt (bsc#1273804).\n- CVE-2026-64005: net/smc: Do not re-initialize smc hashtables (bsc#1273831).\n- CVE-2026-64006: netfilter: nf_tables: fix dst corruption in same register operation (bsc#1273834).\n- CVE-2026-64007: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (bsc#1273105).\n- CVE-2026-64010: nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (bsc#1273882).\n- CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1273891).\n- CVE-2026-64015: security/keys: fix missed RCU read section on lookup (bsc#1273762).\n- CVE-2026-64029: ALSA: seq: Serialize UMP output teardown with event_input (bsc#1273766).\n- CVE-2026-64047: net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (bsc#1273060).\n- CVE-2026-64048: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (bsc#1273484).\n- CVE-2026-64052: block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user() (bsc#1272983).\n- CVE-2026-64073: irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT (bsc#1273490).\n- CVE-2026-64098: drm/virtio: use uninterruptible resv lock for plane updates (bsc#1273488).\n- CVE-2026-64102: RDMA/siw: Reject MPA FPDU length underflow before signed receive math (bsc#1272516).\n- CVE-2026-64109: af_unix: Peek the queue synchronized (bsc#1273748).\n- CVE-2026-64112: rbd: eliminate a race in lock_dwork draining on unmap (bsc#1273741).\n- CVE-2026-64113: ixgbevf: fix use-after-free in VEPA multicast source pruning (bsc#1272262).\n- CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl \u003c 5 (bsc#1273742).\n- CVE-2026-64115: vsock/vmci: fix UAF when peer resets connection during handshake (bsc#1273745).\n- CVE-2026-64118: qed: fix double free in qed_cxt_tables_alloc() (bsc#1273749).\n- CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273743).\n- CVE-2026-64125: net: bcmgenet: keep RBUF EEE/PM disabled (bsc#1272346).\n- CVE-2026-64131: mm/memory: fix spurious warning when unmapping device-private/exclusive pages (bsc#1274063).\n- CVE-2026-64148: pds_core: check health in devcmd wait (bsc#1273956).\n- CVE-2026-64164: btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() (bsc#1273957).\n- CVE-2026-64185: sysfs: don't remove existing directory on update failure (bsc#1272200).\n- CVE-2026-64188: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() (bsc#1272150).\n- CVE-2026-64190: net: team: fix NULL pointer dereference in team_xmit during mode change (bsc#1272210).\n- CVE-2026-64192: bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized (bsc#1272213).\n- CVE-2026-64214: powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise()\n  (bsc#1272799).\n- CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272798).\n- CVE-2026-64222: octeontx2-pf: avoid double free of pool-\u003estack on AQ init failure (bsc#1272788).\n- CVE-2026-64225: octeontx2-af: CGX: add bounds check to cgx_speed_mbps index (bsc#1272786).\n- CVE-2026-64245: fbdev: modedb: fix a possible UAF in fb_find_mode() (bsc#1273905).\n- CVE-2026-64268: RDMA/siw: bound Read Response placement to the RREAD length (bsc#1273276).\n- CVE-2026-64286: KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU (bsc#1274058).\n- CVE-2026-64287: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (bsc#1273325).\n- CVE-2026-64294: mm: do file ownership checks with the proper mount idmap (bsc#1273525).\n- CVE-2026-64296: exfat: bound uniname advance in exfat_find_dir_entry() (bsc#1273975).\n- CVE-2026-64304: crypto: qat - validate RSA CRT component lengths (bsc#1273944).\n- CVE-2026-64312: crypto: pcrypt - restore callback for non-parallel fallback (bsc#1273968).\n- CVE-2026-64315: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1274028).\n- CVE-2026-64316: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1273598).\n- CVE-2026-64317: isofs: bound Rock Ridge symlink components to the SL record (bsc#1273936).\n- CVE-2026-64322: udf: validate sparing table length as an entry count, not a byte count (bsc#1273958).\n- CVE-2026-64323: udf: validate VAT header length against the VAT inode size (bsc#1273305).\n- CVE-2026-64355: bpf: Reject fragmented frames in devmap (bsc#1273422).\n- CVE-2026-64375: proc: protect ptrace_may_access() with exec_update_lock (FD links) (bsc#1273868).\n- CVE-2026-64378: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (bsc#1273603).\n- CVE-2026-64381: smb: client: Fix next buffer leak in receive_encrypted_standard() (bsc#1273860).\n- CVE-2026-64382: smb: client: fix double-free in SMB2_open() replay (bsc#1273291).\n- CVE-2026-64383: smb: client: fix double-free in SMB2_flush() replay (bsc#1273426).\n- CVE-2026-64384: smb: client: fix change notify replay double-free (bsc#1274541).\n- CVE-2026-64385: smb: client: fix double-free in SMB2_ioctl() replay (bsc#1274539).\n- CVE-2026-64386: smb: client: fix query_info() replay double-free (bsc#1274543).\n- CVE-2026-64387: smb: client: fix query directory replay double-free (bsc#1274545).\n- CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).\n- CVE-2026-64411: netfilter: ebtables: terminate table name before find_table_lock() (bsc#1274077).\n- CVE-2026-64412: netfilter: ebtables: module names must be null-terminated (bsc#1273780).\n- CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction (bsc#1274274).\n- CVE-2026-64434: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref (bsc#1273880).\n- CVE-2026-64436: net: af_key: initialize alg_key_len for IPComp states (bsc#1274277).\n- CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).\n- CVE-2026-64450: tipc: fix out-of-bounds read in broadcast Gap ACK blocks (bsc#1273523).\n- CVE-2026-64463: usb: typec: tcpci_rt1711h: unregister TCPCI port with devres (bsc#1273273).\n- CVE-2026-64472: vfio/mlx5: Fix racy bitfields and tighten struct layout (bsc#1274075).\n- CVE-2026-64481: ALSA: hda/cs35l41: Fix firmware load work teardown (bsc#1274547).\n- CVE-2026-64537: bridge: cfm: reject invalid CCM interval at configuration time (bsc#1273289).\n- CVE-2026-64538: ipv6: Fix null-ptr-deref in fib6_nh_mtu_change() (bsc#1273335).\n- CVE-2026-64541: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (bsc#1273303).\n- CVE-2026-64543: tipc: fix use-after-free of the discoverer in tipc_disc_rcv() (bsc#1273311).\n- CVE-2026-64545: net, bpf: check master for NULL in xdp_master_redirect() (bsc#1273318).\n- CVE-2026-64548: bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() (bsc#1273337).\n- CVE-2026-64551: sctp: validate STALE_COOKIE cause length before reading staleness (bsc#1273813).\n- CVE-2026-64552: virtio-net: fix len check in receive_big() (bsc#1273323).\n- CVE-2026-64553: net: psample: fix info leak in PSAMPLE_ATTR_DATA (bsc#1273336).\n- CVE-2026-64554: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() (bsc#1273340).\n- CVE-2026-64562: KVM: nVMX: Hide shadow VMCS right after VMCLEAR (bsc#1273930).\n- CVE-2026-64563: rhashtable: clear stale iter-\u003ep on table restart (bsc#1273995).\n- CVE-2026-64567: btrfs: reject free space cache with more entries than pages (bsc#1274006).\n- CVE-2026-64572: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (bsc#1274014).\n- CVE-2026-64576: nexthop: initialize extack in nh_res_bucket_migrate() (bsc#1274030).\n- CVE-2026-64577: gtp: check skb_pull_data() return in gtp1u_send_echo_resp() (bsc#1274031).\n- CVE-2026-64581: xfrm: fix sk_dst_cache double-free in xfrm_user_policy() (bsc#1274041).\n- CVE-2026-64582: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (bsc#1274040).\n- CVE-2026-64593: btrfs: do not trim a device which is not writeable (bsc#1274497).\n- CVE-2026-64597: smb: client: fix double-free in SMB2_close() replay (bsc#1274297).\n- CVE-2026-64598: smb/client: Fix error code in smb2_aead_req_alloc() (bsc#1274298).\n- CVE-2026-68081: KVM: nVMX: Add helper to put (unmap) vmcs12 pages (bsc#1274580).\n- CVE-2026-68082: libceph: fix two unsafe bare decodes in decode_lockers() (bsc#1274581).\n- CVE-2026-68086: mm/khugepaged: write all dirty file folios when collapsing (bsc#1274713).\n- CVE-2026-68116: vxlan: mdb: Fix source list corruption on a failed replace (bsc#1274876).\n- CVE-2026-68117: tipc: clear sock-\u003esk on the failed-insert path in tipc_sk_create() (bsc#1274881).\n- CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1274888).\n- CVE-2026-68123: openvswitch: fix GSO userspace truncation underflow (bsc#1275169).\n- CVE-2026-68127: ila: reload IPv6 header after pskb_may_pull in checksum adjust (bsc#1275237).\n- CVE-2026-68129: gve: fix Rx queue stall on alloc failure (bsc#1275517).\n- CVE-2026-68132: super: fix emergency thaw deadlock on frozen block devices (bsc#1275553).\n- CVE-2026-68136: net: gro: fix double aggregation of flush-marked skbs (bsc#1275474).\n- CVE-2026-68138: net/sched: serialize qdisc_rtab_list against concurrent get/put (bsc#1274941).\n- CVE-2026-68139: net/mlx5e: Use sender devcom for MPV master-up (bsc#1275578).\n- CVE-2026-68142: geneve: require CAP_NET_ADMIN in the device netns for changelink (bsc#1275582).\n- CVE-2026-68143: net: slip: serialize receive against buffer reallocation (bsc#1275583).\n- CVE-2026-68145: iomap: fix out-of-bounds bitmap_set() with zero-length range (bsc#1275584).\n- CVE-2026-68149: fs: preserve ACL_DONT_CACHE state in forget_cached_acl() (bsc#1275294).\n- CVE-2026-68153: libceph: remove debugfs files before client teardown (bsc#1275301).\n- CVE-2026-68154: libceph: reject zero bucket types in crush_decode (bsc#1275303).\n- CVE-2026-68155: libceph: Reject monmaps advertising zero monitors (bsc#1275304).\n- CVE-2026-68156: libceph: refresh auth-\u003eauthorizer_buf{,_len} after authorizer update (bsc#1275305).\n- CVE-2026-68157: libceph: guard missing CRUSH type name lookup (bsc#1275306).\n- CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1275307).\n- CVE-2026-68159: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (bsc#1275470).\n- CVE-2026-68160: ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() (bsc#1275472).\n- CVE-2026-68161: sctp: close UDP tunnel sockets during netns teardown (bsc#1274892).\n- CVE-2026-68166: userfaultfd: prevent registration of special VMAs (bsc#1274930).\n- CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275161).\n- CVE-2026-68205: media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() (bsc#1274934).\n- CVE-2026-68238: drm/amdgpu: Release VFCT ACPI table reference (bsc#1275704).\n- CVE-2026-68247: drm/i915/bios: range check LFP Data Block panel_type2 (bsc#1275817).\n- CVE-2026-68254: drm/i915/vrr: require valid min/max vfreq for VRR (bsc#1275150).\n- CVE-2026-68284: bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() (bsc#1275970).\n- CVE-2026-68286: drop_monitor: perform u64_stats updates under IRQ-disabled section (bsc#1275973).\n- CVE-2026-68288: net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD (bsc#1275975).\n- CVE-2026-68289: tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() (bsc#1275976).\n- CVE-2026-68293: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (bsc#1275091).\n- CVE-2026-68297: tipc: fix u16 MTU truncation in media and bearer MTU validation (bsc#1275040).\n- CVE-2026-68299: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (bsc#1275088).\n- CVE-2026-68300: sctp: auth: verify auth requirement when auth_chunk is NULL (bsc#1275083).\n- CVE-2026-68312: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (bsc#1274663).\n- CVE-2026-68313: tipc: fix infinite loop in __tipc_nl_compat_dumpit (bsc#1274665).\n- CVE-2026-68315: sctp: validate stream count in sctp_process_strreset_inreq() (bsc#1274662).\n- CVE-2026-68320: sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid (bsc#1274659).\n- CVE-2026-68322: rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled (bsc#1274656).\n- CVE-2026-68324: iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() (bsc#1274649).\n- CVE-2026-68325: iommu/amd: Bound the early ACPI HID map (bsc#1274651).\n- CVE-2026-68328: nfp: Check resource mutex allocation (bsc#1274646).\n- CVE-2026-68329: iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() (bsc#1274645).\n- CVE-2026-68331: dpaa2-eth: put MAC endpoint device on disconnect (bsc#1274642).\n- CVE-2026-68333: dpaa2-switch: put MAC endpoint device on disconnect (bsc#1274644).\n- CVE-2026-68335: rds: drop incoming messages that cross network namespace boundaries (bsc#1274640).\n- CVE-2026-68336: bonding: fix devconf_all NULL dereference when IPv6 is disabled (bsc#1274639).\n- CVE-2026-68343: smb: client: validate DFS referral PathConsumed (bsc#1274629).\n- CVE-2026-68377: net/sched: act_tunnel_key: Defer dst_release to RCU callback (bsc#1274831).\n- CVE-2026-68386: bpf, sockmap: Reject unhashed UDP sockets on sockmap update (bsc#1274814).\n- CVE-2026-68397: net/iucv: take a reference on the socket found in afiucv_hs_rcv() (bsc#1274898).\n- CVE-2026-68398: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF (bsc#1274908).\n- CVE-2026-68408: wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (bsc#1274709).\n- CVE-2026-68417: RDMA/siw: publish QP after initialization (bsc#1274696).\n- CVE-2026-68418: RDMA/irdma: Prevent user-triggered null deref on QP create (bsc#1274690).\n- CVE-2026-68419: RDMA/irdma: Prevent rereg_mr for non-mem regions (bsc#1274698).\n- CVE-2026-68422: btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() (bsc#1274706).\n- CVE-2026-68425: IB/mad: Drop unmatched RMPP responses before reassembly (bsc#1274700).\n- CVE-2026-68426: xfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment (bsc#1274705).\n- CVE-2026-68432: vxlan: require CAP_NET_ADMIN in the device netns for changelink (bsc#1274800).\n- CVE-2026-68433: libceph: bound get_version reply decode to front len (bsc#1274801).\n- CVE-2026-68450: btrfs: free mapping node on duplicate reloc root insert (bsc#1274834).\n- CVE-2026-68470: wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (bsc#1276500).\n- CVE-2026-68480: x86/bugs: Make Safe-RET robust against interrupt injection (bsc#1274208).\n- CVE-2026-72020: ipvs: reset full ip_vs_seq structs in ip_vs_conn_new (bsc#1275506).\n- CVE-2026-72035: net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1276961).\n- CVE-2026-72036: net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1277034).\n- CVE-2026-72069: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (bsc#1275528).\n- CVE-2026-72072: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (bsc#1277155).\n- CVE-2026-72083: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (bsc#1275535).\n- CVE-2026-72084: scsi: target: Bound PR-OUT TransportID parsing to the received buffer (bsc#1275540).\n- CVE-2026-72123: can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (bsc#1277523).\n- CVE-2026-72132: NFS: Charge unstable writes by request size, not folio size (bsc#1277551).\n- CVE-2026-72221: sunrpc: wait for in-flight TLS handshake callback when cancel loses race (bsc#1275665).\n- CVE-2026-72222: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (bsc#1275669).\n- CVE-2026-72251: netfilter: nf_nat_sip: reload possible stale data pointer (bsc#1275827).\n- CVE-2026-72254: netfilter: nft_fib: reject fib expression on the netdev egress hook (bsc#1277204).\n- CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (bsc#1277678).\n- CVE-2026-72288: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (bsc#1275886).\n- CVE-2026-72289: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (bsc#1275905).\n- CVE-2026-72296: net: ife: require ETH_HLEN to be pullable in ife_decode() (bsc#1275923).\n- CVE-2026-72307: mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() (bsc#1277160).\n- CVE-2026-72308: mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() (bsc#1277159).\n- CVE-2026-72317: SUNRPC: pin upper rpc_clnt across the TLS connect_worker (bsc#1275925).\n- CVE-2026-72341: net/mlx5e: Fix publication race for priv-\u003echannel_stats[] (bsc#1277660).\n- CVE-2026-72342: net/mlx5e: Fix HV VHCA stats agent registration race (bsc#1277775).\n- CVE-2026-72343: net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation (bsc#1277776).\n- CVE-2026-72389: bridge: stp: Fix a potential use-after-free when deleting a bridge (bsc#1273869).\n- CVE-2026-72463: xfrm: Fix dev use-after-free in xfrm async resumption (bsc#1268276 bsc#1277064).\n- CVE-2026-72464: xprtrdma: Remove temp allocation of rpcrdma_rep objects (bsc#1277069).\n- CVE-2026-72466: xprtrdma: Fix bcall rep leak and unbounded peek (bsc#1277057).\n- CVE-2026-72467: xprtrdma: Check frwr_wp_create() during connect (bsc#1277059).\n- CVE-2026-72469: xprtrdma: Fix ep kref imbalance on ADDR_CHANGE (bsc#1277047).\n- CVE-2026-72473: xprtrdma: Avoid 250 ms delay on backlog wakeup (bsc#1277037).\n- CVE-2026-72494: RDMA/irdma: Replace waitqueue and flag with completion (bsc#1276941).\n- CVE-2026-72495: RDMA/bnxt_re: Avoid repeated requests to allocate WC pages (bsc#1276937).\n- CVE-2026-72496: RDMA/bnxt_re: Proper rollback if the ioremap fails (bsc#1276943).\n- CVE-2026-72499: RDMA/bnxt_re: Free CQ toggle page after firmware teardown (bsc#1276551).\n- CVE-2026-72501: RDMA/bnxt_re: Initialize dpi variable to zero (bsc#1276546).\n- CVE-2026-72502: tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) (bsc#1276542).\n- CVE-2026-74269: bnxt: fix head underflow on XDP head-grow (bsc#1276507).\n- CVE-2026-74296: RDMA/mlx5: Release the HW-provided UAR index rather than the SW one (bsc#1276452).\n- CVE-2026-74297: RDMA/mlx5: Fix undefined shift of user RQ WQE size (bsc#1276446).\n- CVE-2026-74318: btrfs: fix deadlock cloning inline extent when using flushoncommit (bsc#1276864).\n- CVE-2026-74321: btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() (bsc#1277202).\n- CVE-2026-74334: RDMA/nldev: Fix locking when accessing mr-\u003epd (bsc#1277095).\n- CVE-2026-74345: RDMA/siw: Fix endpoint/socket association handling (bsc#1277285).\n- CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277408).\n- CVE-2026-74395: RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference (bsc#1277077).\n- CVE-2026-74454: drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO (bsc#1277073).\n- CVE-2026-74474: vxlan: use pskb_network_may_pull() for transmit path header pulls (bsc#1276335).\n- CVE-2026-74481: mm/page_reporting: use system_freezable_wq to fix UAF during suspend (bsc#1276355).\n- CVE-2026-74482: mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios (bsc#1276346).\n- CVE-2026-74488: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (bsc#1276350).\n- CVE-2026-74495: igbvf: Fix leak in TX DMA error cleanup (bsc#1275864).\n- CVE-2026-74496: fou: Fix use-after-free in fou_create() (bsc#1275867).\n- CVE-2026-74509: Bluetooth: hci_sync: Fix advertising data UAFs (bsc#1275946).\n- CVE-2026-74510: Bluetooth: mgmt: fix UAF in pair command cancellation (bsc#1275950).\n- CVE-2026-74512: audit: fix potential use-after-free in audit_del_rule() (bsc#1275954).\n- CVE-2026-74516: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (bsc#1275797).\n- CVE-2026-74518: mm/hugetlb: fix list corruption in allocate_file_region_entries() (bsc#1275798).\n- CVE-2026-74527: octeontx2-af: Block VFs from clobbering special CGX PKIND state (bsc#1275805).\n- CVE-2026-74537: Bluetooth: ISO: hold sk properly in iso_conn_ready (bsc#1275687).\n- CVE-2026-74548: forcedeth: fix UAF of txrx_stats in nv_remove (bsc#1275695).\n- CVE-2026-74550: net: do not send ICMP/NDISC Redirects when peer allocation fails (bsc#1275688).\n- CVE-2026-74556: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (bsc#1275696).\n- CVE-2026-74563: rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() (bsc#1275574).\n- CVE-2026-74566: keys: make keyring key-chunk byte order agree with keyring_diff_objects() (bsc#1275566).\n- CVE-2026-74567: keys: fix out-of-bounds read in keyring_get_key_chunk() (bsc#1275569).\n- CVE-2026-74571: btrfs: skip global block reserve accounting for rescue mounts (bsc#1275561).\n- CVE-2026-74581: net: ipv6: clear suppressed fib6 rule result (bsc#1275782).\n- CVE-2026-74582: packet: use consistent hard_header_len in non-ring send paths (bsc#1275784).\n- CVE-2026-74584: RDMA/bnxt_re: zero shared page before exposing to userspace (bsc#1277066).\n- CVE-2026-74610: tls: don't leave a full plaintext sk_msg ring unpushed (bsc#1277054).\n- CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277391).\n- CVE-2026-74692: net/smc: fix TOCTOU race between smc_listen_out() and listener close (bsc#1276927).\n- CVE-2026-74694: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length (bsc#1277625).\n- CVE-2026-74695: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() (bsc#1276931).\n- CVE-2026-74717: net/mlx5: fw_tracer, return NULL on create error (bsc#1276569).\n- CVE-2026-74722: btrfs: fix memory leak in btrfs_do_encoded_write() (bsc#1276561).\n- CVE-2026-80529: xfs: don't swallow dquot recovery verification errors (bsc#1277688).\n- CVE-2026-80534: xfs: fix ilock leak on error in xfs_dq_get_next_id (bsc#1277022).\n- CVE-2026-80590: inet: frags: strip GSO state from fragments before reassembly (bsc#1277275).\n- CVE-2026-80654: soc: xilinx: Shutdown and free rx mailbox channel (bsc#1277516).\n\nThe following non security issues were fixed:\n\n- accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() (git-fixes).\n- accessibility: speakup: unregister tty ldisc on later init failures (git-fixes).\n- ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer (git-fixes).\n- ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root (git-fixes).\n- ACPI: pfr_update: fix stack buffer overflow in query_capability() (git-fixes).\n- ACPI: processor: idle: Expand _LPI package sanity checks (git-fixes).\n- ACPI: processor: validate MADT IOAPIC entry bounds (git-fixes).\n- ACPI: scan: fix bus ID cleanup on device_add() failures (git-fixes).\n- ACPI: video: Release PCI device reference after lookup (git-fixes).\n- add my missing Reviewed-by: tag.\n- ALSA: 6fire: bound the MIDI event length from the device (git-fixes).\n- ALSA: 6fire: Fix UAF at error handling during probe (stable-fixes).\n- ALSA: bcd2000: clear the URB pointers on disconnect (git-fixes).\n- ALSA: core: Fix use-after-free in snd_card_do_free() (git-fixes).\n- ALSA: dummy: Check card index validity at probe (stable-fixes).\n- ALSA: hda/ext: preserve PPLCCTL bits when clearing reset (git-fixes).\n- ALSA: hda: Fix connection list comparison in proc output (git-fixes).\n- ALSA: hpi: Check transport errors during HPI6000 adapter initialization (git-fixes).\n- ALSA: pcxhr: initialize mutexes before requesting threaded IRQ (git-fixes).\n- ALSA: seq: midi: Optimize event_input locking with RCU (git-fixes).\n- ALSA: seq: midi: Serialize input teardown with event_input (git-fixes).\n- ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion (git-fixes).\n- ALSA: usb-audio: Complete cleanup after system-resume errors (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() (git-fixes).\n- ALSA: usb-audio: fix OOB write on Type II inbound URBs (git-fixes).\n- ALSA: usb: Fix UAF at delayed release of MIDI2 EPs (git-fixes).\n- ALSA: usx2y: bound the hwdep mmap fault offset (git-fixes).\n- ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() (git-fixes).\n- apparmor: advertise the tcp fast open fix is applied (git-fixes).\n- ASoC: adau1761: sort the register default table (git-fixes).\n- ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC (git-fixes).\n- ASoC: apple: mca: increase SERDES reset delay (git-fixes).\n- ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses (git-fixes).\n- ASoC: cs35l33: drain threaded IRQ before runtime suspend (git-fixes).\n- ASoC: cs35l34: drain threaded IRQ before runtime suspend (git-fixes).\n- ASoC: cs35l41: sort the register default table (git-fixes).\n- ASoC: cs35l45: sort the register default table (git-fixes).\n- ASoC: cs4265: sort the register default table (git-fixes).\n- ASoC: cx2072x: sort the register default table (git-fixes).\n- ASoC: dapm: Fix off-by-one check on the second enum channel (git-fixes).\n- ASoC: fix unmet dependencies on PPC_BESTCOMM and SND_SOC_AC97_BUS (git-fixes).\n- ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready (git-fixes).\n- ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure (git-fixes).\n- ASoC: fsl_audmix: rework runtime PM handling in probe (git-fixes).\n- ASoC: fsl_easrc: sort the register default table (git-fixes).\n- AsoC: intel: sst: fix PCI device reference leak on probe failure (git-fixes).\n- ASoC: max9860: sort the register default table (git-fixes).\n- ASoC: meson: Keep link pointers valid on realloc failure (git-fixes).\n- ASoC: ml26124: sort the register default table (git-fixes).\n- ASoC: pcm512x: sort the register default table (git-fixes).\n- ASoC: pxa: Use devm_clk_get_optional() for extclk clock (git-fixes).\n- ASoC: qcom: q6apm: keep the graph start count in sync with the DSP (git-fixes).\n- ASoC: rt274: sort the register default table (git-fixes).\n- ASoC: rt286: sort the register default table (git-fixes).\n- ASoC: rt298: sort the register default table (git-fixes).\n- ASoC: rt700-sdw: always drain jack work on remove (git-fixes).\n- ASoC: rt700: drop duplicate reg_default entry (git-fixes).\n- ASoC: rt700: sort the register default table (git-fixes).\n- ASoC: rt711-sdca: sort the register default tables (git-fixes).\n- ASoC: rt711: sort the register default table (git-fixes).\n- ASoC: rt712-sdca-dmic: sort the register default table (git-fixes).\n- ASoC: rt715-sdca: drop duplicate reg_default entries (git-fixes).\n- ASoC: rt715-sdca: sort the register default tables (git-fixes).\n- ASoC: rt715: sort the register default table (git-fixes).\n- ASoC: rt1316-sdw: sort the register default table (git-fixes).\n- ASoC: rt1318-sdw: sort the register default table (git-fixes).\n- ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get (git-fixes).\n- ASoC: sgtl5000: sort the register default table (git-fixes).\n- ASoC: SOF: pcm: Move period/buffer configuration print after platform open (stable-fixes).\n- ASoC: sof: pcm: use snd_pcm_direction_name() (stable-fixes).\n- ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() (git-fixes).\n- ASoC: SOF: validate topology volume range before allocation (git-fixes).\n- ASoC: sti-sas: sort the register default table (git-fixes).\n- ASoC: tas2552: sort the register default table (git-fixes).\n- ASoC: tas2764: sort the register default table (git-fixes).\n- ASoC: tas2780: sort the register default table (git-fixes).\n- ASoC: tegra210_i2s: sort the register default table (git-fixes).\n- ASoC: tegra210_mixer: sort the register default table (git-fixes).\n- ASoC: tegra: Fix the MIXER enable default value (git-fixes).\n- ASoC: tegra: Sort MBDRC register defaults (git-fixes).\n- ASoC: xilinx: formatter_pcm: fix stream_data leak on open error (git-fixes).\n- ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers (git-fixes).\n- batman-adv: bla: fix freeing of claims on meshif deletion (git-fixes).\n- batman-adv: bla: prevent CRC corruptions after claim flush (git-fixes).\n- batman-adv: dat: avoid unaligned fault in IP extraction (git-fixes).\n- batman-adv: fix stale receive device on merged fragments (git-fixes).\n- Bluetooth: btintel: Fix diagnostics event detection (git-fixes).\n- Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path (git-fixes).\n- Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX (git-fixes).\n- Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event (git-fixes).\n- Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() (git-fixes).\n- Bluetooth: do not leak an hci_conn when a second LE connect is rejected (git-fixes).\n- Bluetooth: eir: Fix OOB read in eir_get_service_data() (git-fixes).\n- Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_conn: hold conn reference in abort_conn_sync() (git-fixes).\n- Bluetooth: hci_conn: re-enable advertising only for peripheral role (git-fixes).\n- Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection (git-fixes).\n- Bluetooth: hci_event: fix LE list UAF on reset (git-fixes).\n- Bluetooth: hci_event: validate LE Set CIG Parameters response (git-fixes).\n- Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths (git-fixes).\n- Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists (stable-fixes).\n- Bluetooth: hci_uart: Fix false success return in hci_uart_setup() (git-fixes).\n- Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready (git-fixes).\n- Bluetooth: MGMT: free the mesh send cancel command when it is cancelled (git-fixes).\n- Bluetooth: MSFT: validate evt_prefix_len against the response length (git-fixes).\n- Bluetooth: RFCOMM: serialize security confirmation handling (git-fixes).\n- Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept (git-fixes).\n- Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (git-fixes).\n- Bluetooth: virtio_bt: avoid OOB read of build info string (git-fixes).\n- bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation (git-fixes).\n- bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET (git-fixes).\n- bus: ti-sysc: Fix /chosen node reference leak (git-fixes).\n- cacheinfo: don't propagate DT/ACPI error when arch supplies info (arm64) (git-fixes).\n- can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking (stable-fixes).\n- crypto: aspeed - Propagate platform_get_irq() errors (git-fixes).\n- crypto: atmel-sha204a - fix heap info leak on I2C transfer failure (git-fixes).\n- crypto: atmel-tdes - use scatterlist length before DMA mapping (git-fixes).\n- crypto: ccm - Set rfc4309 maxauthsize from child (git-fixes).\n- crypto: ccp - Fix memory leak in SEV INIT_EX path (git-fixes).\n- crypto: ccp - Fix possible deadlock in SEV init failure path (git-fixes).\n- crypto: doc - Remove extra parenthesis (git-fixes).\n- crypto: hisilicon/sec2 - fix CCM algorithm long packet failure (git-fixes).\n- crypto: keembay - Initialize completion before requesting IRQ (git-fixes).\n- crypto: keembay - publish OF module alias for OCS AES/SM4 (git-fixes).\n- crypto: mxs-dcp - fix source scatterlist length access (git-fixes).\n- crypto: qat - cancel work on re-enable SR-IOV timeout (git-fixes).\n- crypto: qat - clear AES key schedule from stack (git-fixes).\n- crypto: qce - fix CCM AAD buffer underallocation (git-fixes).\n- crypto: qce - fix error path in devm_qce_register_algs (git-fixes).\n- crypto: rk3288 - fail ahash requests on HASH idle timeout (git-fixes).\n- crypto: sa2ul - stop probe if context pool creation fails (git-fixes).\n- crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping (git-fixes).\n- device property: fix infinite loop in fwnode_for_each_child_node() (git-fixes).\n- dmaengine: dw-edma: Clear stale requests on termination (git-fixes).\n- dmaengine: dw-edma: Complete descriptors before pausing (git-fixes).\n- dmaengine: dw-edma: Initialize IRQ data before requesting IRQs (git-fixes).\n- dmaengine: dw-edma: Serialize abort state updates (git-fixes).\n- dmaengine: dw-edma: Serialize channel state checks (git-fixes).\n- dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe (git-fixes).\n- dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure (git-fixes).\n- dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal (git-fixes).\n- dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers (git-fixes).\n- dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout (git-fixes).\n- driver core: soc: Unregister bus on early device registration failure (git-fixes).\n- drm/amd/display: avoid divide-by-zero in __is_lut_linear() (git-fixes).\n- drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read (git-fixes).\n- drm/amdgpu/gfx6: Fixup emit_cntxcntl() (git-fixes).\n- drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets (git-fixes).\n- drm/amdgpu/gfx6: Use PFP on the compute queues too (git-fixes).\n- drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup (git-fixes).\n- drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup (git-fixes).\n- drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (git-fixes).\n- drm/amdgpu: cap GTT size to physical RAM on APUs (stable-fixes).\n- drm/amdgpu: check ASPM on the dGPU host link (git-fixes).\n- drm/amdgpu: disallow multiple FENCE chunks in one submit (git-fixes).\n- drm/amdgpu: fix aperture iounmap skipped on device removal (git-fixes).\n- drm/amdgpu: fix autosuspend cleanup during removal (git-fixes).\n- drm/amdgpu: Fix UVD decode image min size calculation (stable-fixes).\n- drm/amdgpu: Fix UVD dpb min size calculation for H264 (stable-fixes).\n- drm/amdgpu: Fix UVD min buffer sizes (stable-fixes).\n- drm/amdgpu: Fix VCE 3 ring align_mask (git-fixes).\n- drm/amdgpu: Implement insert_end for VCE 3 (git-fixes).\n- drm/amdgpu: Reject UVD message with dimensions above 4096 (stable-fixes).\n- drm/amdgpu: Reject UVD message with invalid number of h265 refs (stable-fixes).\n- drm/amdgpu: restore UMD profile pstate after runtime resume (stable-fixes).\n- drm/amdgpu: validate GEM_CREATE domain combinations (stable-fixes).\n- drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE (stable-fixes).\n- drm/amdkfd: fix QID bit leak in pqm_create_queue() (stable-fixes).\n- drm/amdkfd: Handle invalid event type in CRIU event restore (stable-fixes).\n- drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure (git-fixes).\n- drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure (git-fixes).\n- drm/bridge: ps8640: propagate AUX transfer register errors (git-fixes).\n- drm/bridge: tc358767: clamp the reported AUX read size to the request (git-fixes).\n- drm/connector: Fix epoch_counter docs to reflect reality (git-fixes).\n- drm/hibmc: Fix list of formats on the primary plane (git-fixes).\n- drm/hibmc: Use drm_atomic_helper_check_plane_state() (git-fixes).\n- drm/i915/fbc: Extract intel_fbc_has_fences() (stable-fixes).\n- drm/lima: call drm_mm_init() with a valid allocation range (git-fixes).\n- drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0) (git-fixes).\n- drm/msm/dsi: Drop dev_pm_opp_set_rate(0) (git-fixes).\n- drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value (git-fixes).\n- drm/panel-edp: fix i2c adapter leak on probe failure (git-fixes).\n- drm/panel: samsung-s6d16d0: Power off on prepare failure (git-fixes).\n- drm/radeon: fix autosuspend cleanup during teardown (git-fixes).\n- drm/radeon: restore hardware polling in fence_is_signaled to fix performance regression (git-fixes).\n- drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format (git-fixes).\n- drm/ssd130x: fix column and row end address in partial updates for ssd132x (git-fixes).\n- drm/sun4i: crtc: Propagate layer initialization error (git-fixes).\n- drm/sun4i: Drop node references while building component list (git-fixes).\n- drm/sun4i: dw-hdmi: Drop TCON TOP port reference (git-fixes).\n- drm/sun4i: fix refcount leak in sun4i_backend_init_sat() (git-fixes).\n- drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz (git-fixes).\n- drm/sun4i: tcon: Drop remote endpoint reference (git-fixes).\n- drm/sun4i: tcon: Drop TCON TOP device reference (git-fixes).\n- drm/sun4i: tcon: Set output mux for DSI and LVDS (git-fixes).\n- drm/sun4i: vi scaler: Fix coefficient selection (git-fixes).\n- drm/tegra: dsi: Re-add clear enable register if DSI was powered by bootloader (git-fixes).\n- drm/tve200: add OF module alias for autoloading (git-fixes).\n- drm: fix race between partial drm_dev_register() failure and ioctl (git-fixes).\n- drm: lcdif: Wait for vblank before disabling DMA (git-fixes).\n- drm: Remove unused header in drm_dumb_buffers.c (git-fixes).\n- ethtool: rss: fix hkey leak when indir_size is 0 (git-fixes).\n- fbdev: bitblit: bound-check glyph index in bit_cursor() (git-fixes).\n- fbdev: core: Fix pointer desynchronization in fb_io_read() (git-fixes).\n- fbdev: kyro: Validate overlay viewport coordinates (git-fixes).\n- fbdev: omapfb: panel-dsi-cm: initialize lock before registering display (git-fixes).\n- fbdev: ssd1307fb: defer I2C transfers from damage callbacks (git-fixes).\n- fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device() (git-fixes).\n- fbdev: uvesafb: unregister connector callback on init failure (git-fixes).\n- firmware: arm_scmi: Avoid IDR updates while cleaning channels (git-fixes).\n- firmware: arm_scmi: Drop handle on protocol bind failures (git-fixes).\n- firmware: arm_scmi: Fix requested device removal race (git-fixes).\n- firmware: arm_scmi: Free transport channel on IDR failure (git-fixes).\n- firmware: arm_scmi: Protect device request lookup with RCU (git-fixes).\n- firmware: arm_scmi: Reject out of range DT protocol IDs (git-fixes).\n- firmware: arm_scmi: Unregister device notifier before IDR teardown (git-fixes).\n- firmware: arm_scmi: Use channel ID for transport teardown (git-fixes).\n- firmware_loader: do not queue completed sysfs fallback requests (git-fixes).\n- fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write (git-fixes).\n- fpga: dfl: fme: add error handling (git-fixes).\n- fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration (git-fixes).\n- gpu: host1x: Avoid stack over-read in debug output helpers (git-fixes).\n- gpu: host1x: Fix offset calculation in trace_write_gather (git-fixes).\n- HID: core: fix number/pointer type confusion on long items (git-fixes).\n- HID: core: fix OOB read of field-\u003eusage in hid_set_field() (git-fixes).\n- HID: hyperv: validate initial device info bounds (git-fixes).\n- HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure (git-fixes).\n- HID: lg4ff: validate report length before fixed offsets (git-fixes).\n- HID: logitech-dj: Fix maxfield check in DJ short report validation (git-fixes).\n- HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report (git-fixes).\n- HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write (stable-fixes).\n- HID: logitech-dj: Standardise hid_report_enum variable nomenclature (stable-fixes).\n- HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID (stable-fixes).\n- HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() (git-fixes).\n- HID: mcp2221: validate report size in mcp2221_raw_event() (git-fixes).\n- HID: nintendo: Fix imu_timestamp_us double increment per report (git-fixes).\n- HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() (git-fixes).\n- HID: picolcd: clamp eeprom debugfs read to bytes actually received (git-fixes).\n- HID: roccat: bound device-supplied profile index (git-fixes).\n- HID: roccat: free buffered reports when destroying device (git-fixes).\n- HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature (git-fixes).\n- HID: sensor: custom: Fix field sysfs group cleanup on failure (git-fixes).\n- HID: sensor: custom: Fix use-after-free in enable_sensor (git-fixes).\n- HID: tmff: Use 64-bit arithmetic for force feedback scaling (git-fixes).\n- hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination (git-fixes).\n- hwmon: (lm25066) Use i2c_get_match_data() (stable-fixes).\n- hwmon: (max6621) fix negative temperature offset and crit readings (git-fixes).\n- hwmon: (max6621) fix temperature clamp range (git-fixes).\n- hwmon: (nzxt-smart2) Check return value of init_device() in probe (git-fixes).\n- hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations (git-fixes).\n- hwrng: ks-sa - Fix runtime PM cleanup on registration failure (git-fixes).\n- hwrng: omap - Fix probe error path cleanup (git-fixes).\n- hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() (git-fixes).\n- i2c: bcm-iproc: remove printout on handled timeouts (stable-fixes).\n- i2c: iproc: reset bus after timeout if START_BUSY is stuck (git-fixes).\n- i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure (git-fixes).\n- i2c: mux: Fix channel node leak on adapter add failure (git-fixes).\n- i2c: ocores: Disable clock on failed resume (git-fixes).\n- i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices (git-fixes).\n- i3c: master: Fix device_register() error path (git-fixes).\n- i3c: master: Fix info leak and UAF in device unregister path (git-fixes).\n- i3c: master: svc: bound IBI payload to the requested max_payload_len (git-fixes).\n- ibmvnic: Only record tx completed bytes once per handler (bsc#1274620).\n- iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE (git-fixes).\n- iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable (git-fixes).\n- iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF (git-fixes).\n- iio: chemical: sgp30: Handle IAQ thread creation failure (git-fixes).\n- iio: dac: m62332: Fix regulator reference count imbalance (git-fixes).\n- iio: gyro: mpu3050: fix sign of raw angular velocity readings (git-fixes).\n- iio: light: cm32181: return zero after writing calibscale (git-fixes).\n- iio: light: gp2ap002: Disable regulators on resume failure (git-fixes).\n- iio: light: gp2ap002: re-enable irq if runtime suspend fails (git-fixes).\n- iio: light: isl29028: return zero in write_raw() on success (git-fixes).\n- iio: light: tsl2583: return zero in write_raw() on success (git-fixes).\n- iio: light: tsl2772: fix ALS calibscale readback (git-fixes).\n- iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure (git-fixes).\n- iio: pressure: dps310: fix NULL pointer dereference on ACPI probe (git-fixes).\n- iio: pressure: mpl115: Fix runtime PM cleanup (git-fixes).\n- iio: srf04: fix pm_runtime handling on probe error path (git-fixes).\n- iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() (git-fixes).\n- Input: atkbd - skip deactivate for HONOR ZQC-P (git-fixes).\n- Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard (stable-fixes).\n- Input: evdev - fix information leak in evdev_pass_values() (stable-fixes).\n- Input: evdev - sanitize event type index when fetching event masks (stable-fixes).\n- Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet (git-fixes).\n- Input: focaltech - use signed coordinates to prevent underflow (git-fixes).\n- Input: hynitron_cstxxx - validate touch count and finger IDs (git-fixes).\n- Input: iforce - validate input packet lengths (stable-fixes).\n- Input: iqs5xx - validate firmware record destination span (git-fixes).\n- Input: mms114 - fix Y-resolution configuration (git-fixes).\n- Input: psxpad-spi - set driver data before use (git-fixes).\n- Input: sur40 - fix input device registration ordering (stable-fixes).\n- Input: sur40 - fix V4L error path cleanup (stable-fixes).\n- Input: synaptics-rmi4 - block s_input when F54 queue is busy (git-fixes).\n- Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer (git-fixes).\n- Input: synaptics-rmi4 - fix F55 transmitter electrode count typo (git-fixes).\n- Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue (git-fixes).\n- Input: synaptics-rmi4 - zero report size on F54 work error (git-fixes).\n- Input: xpad - add support for ZENAIM LEVERLESS (stable-fixes).\n- interconnect: Fix use after free in icc_get() and of_icc_get_by_index() (git-fixes).\n- ipmi: ipmb: validate write message length (git-fixes).\n- ipmi: si: Fix NULL pointer dereference after failed registration (git-fixes).\n- KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes).\n- KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page (git-fixes).\n- leds: pca9532: Fix inverted GPIO output polarity (git-fixes).\n- leds: pca9532: Fix phantom device registration on missing hardware (git-fixes).\n- lib/string: fix memchr_inv() for large ranges (git-fixes).\n- lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() (git-fixes).\n- mailbox: qcom-ipcc: fix duplicate channel allocation across holes (git-fixes).\n- mailbox: rockchip: disable pclk on probe failure and unbind (git-fixes).\n- maple_tree: fix argument name in header (git-fixes).\n- md/raid1: create serial pool adding rdev to array with serialize_policy=1 (bsc#1272261).\n- media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref (git-fixes).\n- media: cec-pin: Fix event FIFO ordering (git-fixes).\n- media: cec: disable delayed work before freeing an interrupted transmit (git-fixes).\n- media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash (git-fixes).\n- media: cec: Serialize exclusive follower delivery (git-fixes).\n- media: cec: stm32: prevent out-of-bounds write on RX overflow (git-fixes).\n- media: cedrus: fix memory leak in cedrus_init_ctrls() (git-fixes).\n- media: cobalt: Avoid freeing ALSA private data twice (git-fixes).\n- media: cx231xx: reject geometry changes while the VBI queue is busy (git-fixes).\n- media: cx23885: cancel NetUP CI work before teardown (git-fixes).\n- media: em28xx: defer audio-only extension registration (git-fixes).\n- media: em28xx: fix use-after-free of dev_next-\u003edevlist on disconnect (git-fixes).\n- media: go7007: defer the ALSA v4l2 put until card release (git-fixes).\n- media: i2c: ov02a10: fix endpoint parsing use-after-free (git-fixes).\n- media: i2c: ov7740: fix use-after-destroy in remove (git-fixes).\n- media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define (git-fixes).\n- media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define (git-fixes).\n- media: mc-entity: Add missing kerneldoc (git-fixes).\n- media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common (git-fixes).\n- media: nxp: imx8-isi: Correct color map between V4L2 and ISI (git-fixes).\n- media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing (git-fixes).\n- media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks (git-fixes).\n- media: rc: sunxi-cir: Unregister rc device on probe failure (git-fixes).\n- media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure (git-fixes).\n- media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak (git-fixes).\n- media: s2255: bound JPEG frame size before copying into the buffer (git-fixes).\n- media: s2255: check firmware size before reading trailing marker (git-fixes).\n- media: saa7164: fix cleanup on resource allocation failure (git-fixes).\n- media: tda18250: fix possible integer overflow (git-fixes).\n- media: usbtv: keep device alive while ALSA card exists (git-fixes).\n- media: v4l2-ctrls: Allow unknown HDR10 white point and luminance (git-fixes).\n- media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link (git-fixes).\n- media: venus: fix payload size calculation in parse_raw_formats() (git-fixes).\n- media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() (git-fixes).\n- media: vicodec: fix out-of-bounds write in FWHT encoder (git-fixes).\n- media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure (git-fixes).\n- media: vimc: fix pixel format lookup in enum_framesizes (git-fixes).\n- media: zoran: Avoid freeing a registered video_device twice (git-fixes).\n- mei: pull kvfree out of spinlock (git-fixes).\n- mfd: iqs62x: Reject zero-length firmware records (git-fixes).\n- mfd: rave-sp: validate received frame payload lengths (git-fixes).\n- misc: bcm-vk: Use acquire/release for msgq_inited (git-fixes).\n- misc: fastrpc: fix channel ctx ref leak when session alloc fails (git-fixes).\n- misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free (git-fixes).\n- misc: fastrpc: Remove buffer from list prior to unmap operation (git-fixes).\n- misc: fastrpc: take fl-\u003elock when moving mmaps on interrupted invoke (git-fixes).\n- misc: rtsx: add missing write register handling (git-fixes).\n- misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() (git-fixes).\n- mkspec-dtb: Move DTS prefix into package list.\n- mkspec-dtb: Move provides-obsoletes to package list.\n- mkspec-dtb: Put per-architecture package lists into a hash.\n- mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit (git-fixes).\n- mmc: sdhci: unmap the bounce buffer before device release (git-fixes).\n- mmc: via-sdmmc: stop card-detect handling on probe failure (git-fixes).\n- mtd: afs: validate v2 image info bounds (git-fixes).\n- mtd: mtdoops: free page bitmap when the backing MTD is removed (git-fixes).\n- mtd: mtdswap: Avoid freeing registered blktrans device twice (git-fixes).\n- mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() (git-fixes).\n- mtd: rawnand: validate ONFI extended parameter page sections (git-fixes).\n- net: mana: Add debug knob to skip TX timeout recovery reset (git-fixes).\n- net: mana: Add handler for sriov configure (bsc#1272756).\n- net: mana: Cap MSI-X vectors to the device MSI-X table size (git-fixes).\n- net: mana: Extend RX CQE coalescing up to 8 packets (git-fixes).\n- net: mana: Fall back to scattered pages for GDMA queues (git-fixes).\n- net: mana: force full-page RX buffers via ethtool private flag (bsc#1269792).\n- net: mana: refactor mana_get_strings() and mana_get_sset_count() to use switch (bsc#1269792).\n- net: mana: Route ring-buffer access through offset-based helpers (git-fixes).\n- net: tap: set skb-\u003edev before parsing virtio net header in tap_get_user_xdp() (git-fixes bsc#1274550).\n- net: thunderbolt: Count delivered packets in rx_packets and rx_bytes (git-fixes).\n- net: thunderbolt: Mark the connection down when bringing it up fails (git-fixes).\n- net: thunderbolt: Release the Rx HopID that was handed out on mismatch (git-fixes).\n- net: thunderbolt: Tear down DMA paths before stopping the rings (git-fixes).\n- net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() (git-fixes).\n- net: usb: ipheth: fix carrier_work UAF on disconnect (git-fixes).\n- nfc: digital: clamp SENSF_RES length to the destination buffer (git-fixes).\n- nfc: digital: Do not dump a NULL response in command completion (git-fixes).\n- nfc: fdp: bound the device-reported read length and fix an skb leak (git-fixes).\n- nfc: llcp: avoid userspace overflow on invalid optlen (git-fixes).\n- nfc: llcp: bound SNL TLV parsing to the skb and add length checks (git-fixes).\n- nfc: llcp: bound the connect_sn TLV walk to the skb (git-fixes).\n- nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (git-fixes).\n- nfc: llcp: read llcp_sock-\u003elocal under the socket lock in getsockopt (git-fixes).\n- nfc: llcp: reject PDUs shorter than the LLCP header (git-fixes).\n- nfc: microread: validate target discovery payload lengths (git-fixes).\n- nfc: nci: fix double completion race in nci_data_exchange_complete (git-fixes).\n- nfc: nci: fix out-of-bounds write in nci_target_auto_activated() (git-fixes).\n- nfc: nci: fix uninit-value in the RF discover/activated NTF handlers (git-fixes).\n- nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing (git-fixes).\n- nfc: nci: free destination parameters when closing a connection (git-fixes).\n- nfc: pn533: hold a reference to the request skb during send_frame (git-fixes).\n- nfc: pn533: purge fragmented skbs during cleanup (git-fixes).\n- nfc: st21nfca: validate ATR_REQ length against the received frame (git-fixes).\n- nouveau/gem: reserve the bo in the info ioctl around the vma lookup (git-fixes).\n- PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] (git-fixes).\n- PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk (git-fixes).\n- PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip (git-fixes).\n- PCI: j721e: Fix incorrect max_lanes for J7200 (git-fixes).\n- PCI: meson: Fix GPIO state while requesting PERST# (git-fixes).\n- phy: qcom: qmp-combo: Correct pre-emphasis table for QMP v4 DP PHYs (git-fixes).\n- phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend (git-fixes).\n- phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table (git-fixes).\n- phy: sunplus: fix error handling in sp_uphy_init() (git-fixes).\n- pinctrl: bcm2835: Don't remove an unregistered GPIO chip (git-fixes).\n- pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip (git-fixes).\n- pinctrl: rockchip: Reset the pin count when recalculating SoC data (git-fixes).\n- platform/chrome: cros_ec_debugfs: Clean up console log on probe failure (git-fixes).\n- platform/chrome: cros_ec_debugfs: Unregister panic notifier (git-fixes).\n- platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count (git-fixes).\n- platform/chrome: sensorhub: Bound the EC-reported sensor number (git-fixes).\n- platform/chrome: sensorhub: Fix dropped timestamp events and log spam (git-fixes).\n- platform/chrome: sensorhub: Fix memory overread in ring handler (git-fixes).\n- platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL (git-fixes).\n- platform/surface: acpi-notify: Check ACPI companion before use (git-fixes).\n- platform/x86: dell-privacy: Fix race condition (git-fixes).\n- platform/x86: dell-wmi-base: Fix resource leak on module load failure (git-fixes).\n- platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer (git-fixes).\n- platform/x86: dell-wmi-sysman: Fix instance ID bounds (git-fixes).\n- platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path (git-fixes).\n- platform/x86: ISST: Just allow 2 bits for SST feature enable (git-fixes).\n- platform/x86: ISST: Validate level in perf mask ioctls (git-fixes).\n- platform/x86: ISST: Validate logical CPU id and clos id (git-fixes).\n- platform/x86: ISST: Validate socket ID in clos_assoc ioctl (git-fixes).\n- PM: sleep: Fix off-by-one in wakelocks number limit check (git-fixes).\n- power: supply: bd99954: Drop bad register fields (git-fixes).\n- power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address (git-fixes).\n- power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address (git-fixes).\n- power: supply: bq27xxx: bq27520g4: fix REG_TTES address (git-fixes).\n- power: supply: bq256xx: drain usb_work before freeing the charger (git-fixes).\n- power: supply: bq24257: fix use-after-free on remove (git-fixes).\n- power: supply: bq25890: Fix power_supply reference leak (git-fixes).\n- power: supply: cros_usbpd-charger: bound the EC-reported port count (git-fixes).\n- power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS (git-fixes).\n- power: supply: isp1704_charger: cancel work on remove (git-fixes).\n- power: supply: lp8727: fix use-after-free in lp8727_release_irq() (git-fixes).\n- power: supply: max17040: drop incorrect I2C functionality check (git-fixes).\n- power: supply: max17040: synchronize work cancellation on suspend (git-fixes).\n- power: supply: qcom_battmgr: terminate the strings from firmware (git-fixes).\n- power: supply: rt9455: quiesce delayed work before teardown (git-fixes).\n- power: supply: sbs-battery: Use a per-device serial number buffer (git-fixes).\n- power: supply: twl4030_charger: cancel workers via devm (git-fixes).\n- power: supply: ucs1002: fix use-after-free on remove (git-fixes).\n- powercap: intel_rapl_tpmi: Handle PMU registration failure during probe (git-fixes).\n- powerpc/pseries: Ensure vpa,slb_shadow \u0026 dtl are unregistered during crash (bsc#1271256).\n- powerpc/pseries: lparcfg - fix kbuf[] underflow (bsc#1274753 ltc#221289 bsc#1274754 ltc#221288 bsc#1274752\n  ltc#221290).\n- powerpc/pseries: pci - logic bug (bsc#1274749 ltc#221282 bsc#1274755 ltc#221284 bsc#1274756 ltc#221283).\n- ppdev: prevent overflow when setting port timeout (git-fixes).\n- qede: fix out-of-bounds check for cqe-\u003elen_list (git-fixes).\n- rapidio: clear mport-\u003enet when rio_add_net() fails (git-fixes).\n- rapidio: mport_cdev: fix use-after-free in dma_req_free() (git-fixes).\n- RDMA/irdma: Remove redundant legacy_mode checks (git-fixes).\n- RDMA/mana_ib: drain QP references after partial table insertion (git-fixes).\n- RDMA/mana_ib: unify QP lookup table (git-fixes).\n- RDMA/mlx5: Fix integer overflow of user QP buffer size (git-fixes).\n- regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer (git-fixes).\n- regulator: core: use system_freezable_wq for init complete work (git-fixes).\n- regulator: devres: add API for reference voltage supplies (stable-fixes).\n- regulator: devres: fix devm_regulator_get_enable_read_voltage() return (git-fixes).\n- regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata (git-fixes).\n- regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling (git-fixes).\n- remoteproc: qcom: Fix glink-\u003enode reference leak in qcom_add_glink_subdev (git-fixes).\n- remoteproc: qcom_q6v5_adsp: Fix reference leak for device node (git-fixes).\n- remoteproc: scp: Fix device reference leak on failed lookup (git-fixes).\n- Revert \"drm/amdgpu: fix aperture mapping leak\" (git-fixes).\n- Revert \"media: v4l2-dev: fix error handling in __video_register_device()\" (git-fixes).\n- Revert \"thermal/drivers/hwmon: Cleanup coding style a bit\" (stable-fixes).\n- rpmsg: core: Fix incorrect return value documentation (git-fixes).\n- rpmsg: glink: smem: order FIFO read after availability check (git-fixes).\n- rtc: gamecube: check return value of devm_rtc_register_device() (git-fixes).\n- rtc: pcf8563: fix clock provider leak on unbind (git-fixes).\n- rtc: pcf85363: Add error checking to regmap calls in probe() (git-fixes).\n- rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers (git-fixes).\n- rtc: rzn1: Fix weekday underflow when alarm crosses month boundary (git-fixes).\n- rtc: zynqmp: Return optional clock lookup errors (git-fixes).\n- scsi: storvsc: Support manual scans for all Hyper-V targets (git-fixes).\n- sctp: avoid auth_enable sysctl UAF during netns teardown (git-fixes).\n- serial: 8250_dma: Clear stale RX state on shutdown (git-fixes).\n- serial: amba-pl011: unprepare console clock on unregister (git-fixes).\n- serial: core: clear freed pointers on uart_register_driver() failure (git-fixes).\n- serial: qcom-geni: fix TX DMA buffer flush (git-fixes).\n- serial: sc16is7xx: fix copy-paste errors in EFR_SWFLOWx_BIT constants (stable-fixes).\n- smb/client: handle overlapping allocated ranges in fallocate (bsc#1274902).\n- smb: client: reject overlapping data areas in SMB2 responses (git-fixes).\n- smb: client: require net admin for CIFS SWN netlink (bsc#1273966).\n- smb: client: resolve SWN tcon from live registrations (bsc#1273872).\n- soc: fsl: qe: check platform_driver_register() in qe_ic_of_init() (git-fixes).\n- soc: qcom: rpmh-rsc: manage PM notifiers with devres (git-fixes).\n- soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() (git-fixes).\n- software node: Fix software_node_get_reference_args() with index -1 (git-fixes).\n- soundwire: qcom: Fix port exhaustion check in stream_alloc_ports (git-fixes).\n- speakup: keyhelp: guard letter_offsets possible out-of-range indexing (git-fixes).\n- spi: img-spfi: don't disable runtime PM on DMA deferred probe (git-fixes).\n- spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers (stable-fixes).\n- spi: sprd-adi: Fix probe succeeding without registering the controller (git-fixes).\n- staging: fbtft: Use sysfs_emit_at() to print to sysfs file (git-fixes).\n- staging: media: tegra-video: vi: fix probe failure on skipped last port (git-fixes).\n- staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown (git-fixes).\n- staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() (git-fixes).\n- staging: rtl8723bs: fix missing shared-key auth challenge length check (git-fixes).\n- staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() (git-fixes).\n- staging: rtl8723bs: fix OOB read in WMM_param_handler() (git-fixes).\n- staging: rtl8723bs: use kfree_sensitive() for key material (git-fixes).\n- staging: rtl8723bs: validate monitor transmit frame lengths (git-fixes).\n- staging: sm750fb: gate dualview dataflow using g_dualview (git-fixes).\n- thermal/drivers/imx: Disable clock on runtime resume failure (git-fixes).\n- thermal/drivers/qoriq: Disable clock on resume failure (git-fixes).\n- thermal: intel: int3400: clean up ODVP on probe failures (git-fixes).\n- thunderbolt: Bound the DROM dual link port number before indexing sw-\u003eports (git-fixes).\n- thunderbolt: icm: Preserve USB4 proxy data-valid bit (git-fixes).\n- tlclk: if sscanf() fails, fall back to 0, not random value (git-fixes).\n- tpm: st33zp24: Return zero on status read failure (git-fixes).\n- tpm: st33zp24: Validate locality read result (git-fixes).\n- tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout (git-fixes).\n- tty: clear cdev pointer after cdev_add() failure (git-fixes).\n- tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 (git-fixes).\n- tty: skip cdev_del() when no cdev is registered (git-fixes).\n- uio: Fix stale info pointer in failed registration path (git-fixes).\n- usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() (git-fixes).\n- usb: atm: usbatm: fix invalid ci_range initialization (git-fixes).\n- USB: c67x00: fix use-after-free in c67x00_add_iso_urb() (git-fixes).\n- usb: cdnsp: fix incorrect endian conversions for APB timeout register (git-fixes).\n- usb: dwc2: add missing @remotewakeup kernel-doc parameter (git-fixes).\n- usb: dwc2: gadget: Exit partial power down state when changing USB pull-up (git-fixes).\n- usb: gadget: configfs: fix out-of-bounds read of qw_sign (git-fixes).\n- usb: gadget: f_fs: Prevent deadlock during ep0 read loop (git-fixes).\n- usb: gadget: f_ncm: Use unsigned int for ndp_index (git-fixes).\n- usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() (git-fixes).\n- usb: gadget: f_uac1_legacy: remove broken string configfs attributes (git-fixes).\n- usb: gadget: pch_udc: remove excess kernel-doc member for registered (git-fixes).\n- usb: gadget: r8a66597: avoid double free of ep0_req in probe error path (git-fixes).\n- usb: gadget: snps_udc_plat: clean up PHY on probe deferral (git-fixes).\n- usb: gadget: u_audio: Fix use-after-free on sound card disconnect (git-fixes).\n- usb: gadget: uac: validate rate list length before storing (git-fixes).\n- usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() (git-fixes).\n- usb: mtu3: allow system suspend during active gadget connection (git-fixes).\n- usb: musb: omap2430: clean up probe error handling (stable-fixes).\n- USB: phy: fsl-usb: fix missing static keywords (git-fixes).\n- usb: renesas_usbhs: Fix power-off ordering on unbind (git-fixes).\n- USB: serial: digi_acceleport: fix port registration order (git-fixes).\n- USB: serial: ftdi_sio: add support for E+H FXA291 (stable-fixes).\n- USB: serial: option: add TDTECH MT5710-CN (stable-fixes).\n- USB: serial: option: fix slab OOB read in interrupt URB callback (git-fixes).\n- USB: serial: spcp8x5: drop broken carrier detect support (git-fixes).\n- USB: storage: add NO_ATA_1X quirk for Longmai USB Key (stable-fixes).\n- usb: typec: ucsi: unregister debugfs entries on teardown (git-fixes).\n- usb: usbfs: fix use-after-free of usb_device in usbdev_release() (git-fixes).\n- usb: xhci: Handle USB3 port events when there is one roothub (git-fixes).\n- vt: add permission check for KDSKBMETA ioctl (stable-fixes).\n- vt: stabilize tty reference in kbd_keycode with tty_port_tty_get (stable-fixes).\n- w1: ds28e17: reject an oversize length on an I2C block read (git-fixes).\n- w1: ds2482: Fix signedness bug in ds2482_w1_triplet() (git-fixes).\n- wifi: ath6kl: avoid buffer overreads in WMI event handlers (git-fixes).\n- wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets (git-fixes).\n- wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump (git-fixes).\n- wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() (git-fixes).\n- wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate (git-fixes).\n- wifi: ath11k: Correctly copy the hint BSSID in WMI scan request (git-fixes).\n- wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx() (git-fixes).\n- wifi: ath12k: Correctly copy the hint BSSID in WMI scan request (git-fixes).\n- wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() (git-fixes).\n- wifi: brcmfmac: fix P2P action frame handling without device vif (git-fixes).\n- wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs (git-fixes).\n- wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments (git-fixes).\n- wifi: iwlwifi: mei: pass correct argument to function (git-fixes).\n- wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser (git-fixes).\n- wifi: mac80211: send TWT teardown to peer after setup TX failure (git-fixes).\n- wifi: mac80211: skip default WMM setup for AP_VLAN links (git-fixes).\n- wifi: mac80211: skip unused probe response countdown offsets (git-fixes).\n- wifi: mt76: fix 4th chain ACK RSSI bitmask in sta_poll (git-fixes).\n- wifi: mt76: fix ER-SU 106-tone RU check in RX rate decode (git-fixes).\n- wifi: mt76: fix HE DCM max-RU capability encoding (git-fixes).\n- wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length (git-fixes).\n- wifi: mt76: mt792x: Fix memory leak in SDIO TX path (git-fixes).\n- wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex (git-fixes).\n- wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss (git-fixes).\n- wifi: mt76: mt7915: fix double hif2 init on the non-WED path (git-fixes).\n- wifi: mt76: mt7915: fix ext PHY use-after-free on register error path (git-fixes).\n- wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986 (git-fixes).\n- wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie (git-fixes).\n- wifi: mt76: mt7915: release hif2 reference on probe IRQ failure (git-fixes).\n- wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement (git-fixes).\n- wifi: mt76: mt7915: unwind state on add_interface failure (git-fixes).\n- wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields (git-fixes).\n- wifi: mt76: mt7915: write RX header translation bit to the correct register (git-fixes).\n- wifi: mt76: mt7921: validate CLC firmware records (git-fixes).\n- wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb (git-fixes).\n- wifi: mt76: mt7925: fix msg len mismatch between driver and firmware (git-fixes).\n- wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config (git-fixes).\n- wifi: mt76: mt7996: don't report a zero TX bitrate (git-fixes).\n- wifi: mt76: mt7996: fix reg addr remap when addr is 0 (git-fixes).\n- wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV (git-fixes).\n- wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset (git-fixes).\n- wifi: mt76: mt7996: validate RX band_idx before dereferencing phys (git-fixes).\n- wifi: mt76: report data NSS for STBC frames in RX rate decode (git-fixes).\n- wifi: mwifiex: Detach sync cmd buffer on interrupted wait (git-fixes).\n- wifi: rtlwifi: pci: fix error path in rtl_pci_probe() (git-fixes).\n- wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() (git-fixes).\n- wifi: rtw89: fix HE extended capability length check (git-fixes).\n- wifi: zd1211rw: reject secondary interfaces to prevent conflicts (git-fixes).\n- x86/bugs: Clarify that syscall hardening isn't a BHI mitigation (git-fixes).\n- xhci: dbgtty: Fix unregister on tty_alloc_driver() failure (git-fixes).\n- xhci: dbgtty: Fix unregister on tty_register_driver() failure (git-fixes).\n","status":"published","published":"2026-09-08T11:00:17Z","modified":"2026-09-15T18:23:09.921123083Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23881-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).\n- CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).\n- CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).\n- CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).\n- CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).\n- CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).\n- CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).\n- CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).\n- CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).\n- CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).\n- CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).\n- CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).\n- CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).\n- CVE-2026-43239: smb: client: prevent races in -\u003equery_interfaces() (bsc#1264444).\n- CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).\n- CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).\n- CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).\n- CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).\n- CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).\n- CVE-2026-43416: powerpc, perf: Check that current-\u003emm is alive before getting user callchain (bsc#1265121).\n- CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).\n- CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).\n- CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).\n- CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).\n- CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).\n- CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).\n- CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).\n- CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).\n- CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).\n- CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).\n- CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).\n- CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).\n- CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).\n- CVE-2026-52912: netfilter: nf_queue: hold bridge skb-\u003edev while queued (bsc#1269000).\n- CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).\n- CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).\n- CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).\n- CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).\n- CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).\n- CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).\n- CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).\n- CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).\n- CVE-2026-52991: sched/psi: fix race between file release and pressure write (bsc#1269134).\n- CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).\n- CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).\n- CVE-2026-53031: bpf: Validate node_id in arena_alloc_pages() (bsc#1269380).\n- CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).\n- CVE-2026-53034: bpf, sockmap: Fix af_unix null-ptr-deref in proto update (bsc#1269140).\n- CVE-2026-53048: gfs2: prevent NULL pointer dereference during unmount (bsc#1269162).\n- CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).\n- CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).\n- CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).\n- CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).\n- CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).\n- CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).\n- CVE-2026-53092: bpf: Fix linked reg delta tracking when src_reg == dst_reg (bsc#1269528).\n- CVE-2026-53094: bpf: Fix stale offload-\u003eprog pointer after constant blinding (bsc#1269965).\n- CVE-2026-53096: bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path (bsc#1269969).\n- CVE-2026-53109: powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy (bsc#1269417).\n- CVE-2026-53110: s390: always declare expoline thunks (bsc#1269985).\n- CVE-2026-53111: bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap (bsc#1269167).\n- CVE-2026-53114: perf: Extend the bit width of the arch-specific flag (bsc#1269999).\n- CVE-2026-53126: blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() (bsc#1269635).\n- CVE-2026-53129: fs/mbcache: cancel shrink work before destroying the cache (bsc#1269633).\n- CVE-2026-53142: drm/xe/display: fix oops in suspend/shutdown without display (bsc#1269402).\n- CVE-2026-53154: mm/hugetlb: restore reservation on error in hugetlb folio copy paths (bsc#1269665).\n- CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (bsc#1269306).\n- CVE-2026-53180: timers/migration: Fix livelock in tmigr_handle_remote_up() (bsc#1269888).\n- CVE-2026-53207: mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison (bsc#1269590).\n- CVE-2026-53219: netfilter: x_tables: avoid leaking percpu counter pointers (bsc#1269686).\n- CVE-2026-53220: netfilter: revalidate bridge ports (bsc#1269381).\n- CVE-2026-53223: net: guard timestamp cmsgs to real error queue skbs (bsc#1269301).\n- CVE-2026-53228: ipv6: sit: reload inner IPv6 header after GSO offloads (bsc#1269256).\n- CVE-2026-53238: netlabel: validate unlabeled address and mask attribute lengths (bsc#1269774).\n- CVE-2026-53264: net/sched: act_api: use RCU with deferred freeing for action lifecycle (bsc#1269238).\n- CVE-2026-53269: netfilter: synproxy: add mutex to guard hook reference counting (bsc#1269579).\n- CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).\n- CVE-2026-53291: ALSA: hda/conexant: Fix missing error check for jack detection (bsc#1269697).\n- CVE-2026-53309: ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison (bsc#1269815).\n- CVE-2026-53330: drm/amd/display: Fix out-of-bounds read in (bsc#1270090).\n- CVE-2026-53336: nvmem: layouts: onie-tlv: fix hang on unknown types (bsc#1270108).\n- CVE-2026-53337: net: bonding: fix NULL pointer dereference in bond_do_ioctl() (bsc#1270251).\n- CVE-2026-53341: fhandle: fix UAF due to unlocked -\u003emnt_ns read in may_decode_fh() (bsc#1270139).\n- CVE-2026-53353: hsr: Remove WARN_ONCE() in hsr_addr_is_self() (bsc#1270111).\n- CVE-2026-53365: vsock/virtio: fix zerocopy completion for multi-skb sends (bsc#1271365).\n- CVE-2026-63801: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (bsc#1272230).\n- CVE-2026-63803: hdlc_ppp: sync per-proto timers before freeing hdlc state (bsc#1272284).\n- CVE-2026-63804: gfs2: fix use-after-free in gfs2_qd_dealloc (bsc#1272287).\n- CVE-2026-63808: exfat: fix potential use-after-free in exfat_find_dir_entry() (bsc#1272260).\n- CVE-2026-63810: block: Avoid mounting the bdev pseudo-filesystem in userspace (bsc#1272297).\n- CVE-2026-63823: keys: Pin request_key_auth payload in instantiate paths (bsc#1272182).\n- CVE-2026-63828: apparmor: mediate the implicit connect of TCP fast open sendmsg (bsc#1272175).\n- CVE-2026-63860: RDMA/core: Prefer NLA_NUL_STRING (bsc#1272429).\n- CVE-2026-63865: bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks (bsc#1272486).\n- CVE-2026-63868: net: garp: fix unsigned integer underflow in garp_pdu_parse_attr (bsc#1272497).\n- CVE-2026-63879: drm/amdgpu: fix amdgpu_hmm_range_get_pages (bsc#1272569).\n- CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272385).\n- CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272390).\n- CVE-2026-63889: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (bsc#1272423).\n- CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).\n- CVE-2026-63891: thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() (bsc#1272641).\n- CVE-2026-63901: USB: serial: digi_acceleport: fix memory corruption with small endpoints (bsc#1272501).\n- CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1272904).\n- CVE-2026-63918: l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (bsc#1272905).\n- CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1272877).\n- CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1272918).\n- CVE-2026-63922,CVE-2026-63924: ipv6: exthdrs: refresh nh after handling HAO option (bsc#1272855).\n- CVE-2026-63925: macsec: fix replay protection at XPN lower-PN wrap (bsc#1273008).\n- CVE-2026-63926: bpf: sockmap: fix tail fragment offset in bpf_msg_push_data (bsc#1273019).\n- CVE-2026-63941: KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor (bsc#1272869).\n- CVE-2026-63969: ipv6: fix possible infinite loop in rt6_fill_node() (bsc#1272484).\n- CVE-2026-63970: vsock/virtio: bind uarg before filling zerocopy skb (bsc#1272673).\n- CVE-2026-63984: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (bsc#1272865).\n- CVE-2026-63985: ethtool: eeprom: add more safeties to EEPROM Netlink fallback (bsc#1272963).\n- CVE-2026-63986: ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on prepare failure (bsc#1272969).\n- CVE-2026-63987: ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES (bsc#1272971).\n- CVE-2026-63990: bonding: refuse to enslave CAN devices (bsc#1273027).\n- CVE-2026-63992: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (bsc#1272868).\n- CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847).\n- CVE-2026-63995: ethtool: cmis: validate start_cmd_payload_size from module (bsc#1273033).\n- CVE-2026-63996: ethtool: cmis: require exact CDB reply length (bsc#1273032).\n- CVE-2026-63997: ethtool: module: avoid leaking a netdev ref on module flash errors (bsc#1273036).\n- CVE-2026-63998: ethtool: module: call ethnl_ops_complete() on module flash errors (bsc#1273037).\n- CVE-2026-63999: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure (bsc#1273038).\n- CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273030).\n- CVE-2026-64002: ipv4: free net-\u003eipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (bsc#1273774).\n- CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782).\n- CVE-2026-64004: net/iucv: fix locking in .getsockopt (bsc#1273804).\n- CVE-2026-64005: net/smc: Do not re-initialize smc hashtables (bsc#1273831).\n- CVE-2026-64006: netfilter: nf_tables: fix dst corruption in same register operation (bsc#1273834).\n- CVE-2026-64007: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (bsc#1273105).\n- CVE-2026-64017: blk-mq: pop cached request if it is usable (bsc#1273770).\n- CVE-2026-64024: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (bsc#1273107).\n- CVE-2026-64033: RDMA/rtrs: Fix use-after-free in path file creation cleanup (bsc#1273134).\n- CVE-2026-64047: net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (bsc#1273060).\n- CVE-2026-64048: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (bsc#1273484).\n- CVE-2026-64052: block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user() (bsc#1272983).\n- CVE-2026-64053: block: don't overwrite bip_vcnt in bio_integrity_copy_user() (bsc#1272985).\n- CVE-2026-64054: net: shaper: reject duplicate leaves in GROUP request (bsc#1272894).\n- CVE-2026-64055: net: ethernet: cortina: Carry over frag counter (bsc#1272893).\n- CVE-2026-64056: net: ethernet: cortina: Make RX SKB per-port (bsc#1272502).\n- CVE-2026-64071: nvme-pci: fix use-after-free in nvme_free_host_mem() (bsc#1273486).\n- CVE-2026-64073: irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT (bsc#1273490).\n- CVE-2026-64088: batman-adv: tt: fix negative tt_buff_len (bsc#1273463).\n- CVE-2026-64089: batman-adv: tt: fix negative last_changeset_len (bsc#1272513).\n- CVE-2026-64093: batman-adv: tp_meter: directly shut down timer on cleanup (bsc#1273461).\n- CVE-2026-64099: drm/v3d: Fix use-after-free of CPU job query arrays on error path (bsc#1273465).\n- CVE-2026-64102: RDMA/siw: Reject MPA FPDU length underflow before signed receive math (bsc#1272516).\n- CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759).\n- CVE-2026-64109: af_unix: Fix UAF read of tail-\u003elen in unix_stream_data_wait() (bsc#1273748).\n- CVE-2026-64111: lsm: hold cred_guard_mutex for lsm_set_self_attr() (bsc#1273740).\n- CVE-2026-64112: rbd: eliminate a race in lock_dwork draining on unmap (bsc#1273741).\n- CVE-2026-64113: ixgbevf: fix use-after-free in VEPA multicast source pruning (bsc#1272262).\n- CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl \u003c 5 (bsc#1273742).\n- CVE-2026-64115: vsock/vmci: fix UAF when peer resets connection during handshake (bsc#1273745).\n- CVE-2026-64118: qed: fix double free in qed_cxt_tables_alloc() (bsc#1273749).\n- CVE-2026-64119: l2tp: use list_del_rcu in l2tp_session_unhash (bsc#1273746).\n- CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273743).\n- CVE-2026-64125: net: bcmgenet: keep RBUF EEE/PM disabled (bsc#1272346).\n- CVE-2026-64131: mm/memory: fix spurious warning when unmapping device-private/exclusive pages (bsc#1274063).\n- CVE-2026-64146: erofs: fix metabuf leak in inode xattr initialization (bsc#1273681).\n- CVE-2026-64147: pds_core: fix debugfs_lookup dentry leak and error handling (bsc#1273119).\n- CVE-2026-64148: pds_core: fix error handling in pdsc_devcmd_wait (bsc#1273956).\n- CVE-2026-64162: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (bsc#1272366).\n- CVE-2026-64164: btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() (bsc#1273957).\n- CVE-2026-64177: phonet/pep: disable BH around forwarded sk_receive_skb() (bsc#1272148).\n- CVE-2026-64179: net: wwan: iosm: fix potential memory leaks in ipc_imem_init() (bsc#1272149).\n- CVE-2026-64180: mm/memory_hotplug: fix memory block reference leak on remove (bsc#1273679).\n- CVE-2026-64184: mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() (bsc#1272199).\n- CVE-2026-64185: sysfs: don't remove existing directory on update failure (bsc#1272200).\n- CVE-2026-64190: net: team: fix NULL pointer dereference in team_xmit during mode change (bsc#1272210).\n- CVE-2026-64192: bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized (bsc#1272213).\n- CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899).\n- CVE-2026-64214: powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise()\n  (bsc#1272799).\n- CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272798).\n- CVE-2026-64222: octeontx2-pf: avoid double free of pool-\u003estack on AQ init failure (bsc#1272788).\n- CVE-2026-64224: octeontx2-pf: fix double free in rvu_rep_rsrc_init() (bsc#1272804).\n- CVE-2026-64225: octeontx2-af: CGX: add bounds check to cgx_speed_mbps index (bsc#1272786).\n- CVE-2026-64232: block: recompute nr_integrity_segments in blk_insert_cloned_request (bsc#1272791).\n- CVE-2026-64239: mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() (bsc#1273898).\n- CVE-2026-64244: drivers/base/memory: set mem-\u003ealtmap after successful device registration (bsc#1273812).\n- CVE-2026-64253: kernel/fork: clear PF_BLOCK_TS in copy_process() (bsc#1273904).\n- CVE-2026-64256: xfs: don't wrap around quota ids in dqiterate (bsc#1273271).\n- CVE-2026-64265: fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (bsc#1273947).\n- CVE-2026-64268: RDMA/siw: bound Read Response placement to the RREAD length (bsc#1273276).\n- CVE-2026-64269: RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg (bsc#1273280).\n- CVE-2026-64283: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values (bsc#1273870).\n- CVE-2026-64286: KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU (bsc#1274058).\n- CVE-2026-64287: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (bsc#1273325).\n- CVE-2026-64294: mm: do file ownership checks with the proper mount idmap (bsc#1273525).\n- CVE-2026-64296: exfat: bound uniname advance in exfat_find_dir_entry() (bsc#1273975).\n- CVE-2026-64298: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (bsc#1273550).\n- CVE-2026-64300: perf/aux: Fix page UAF in map_range() (bsc#1273852).\n- CVE-2026-64307: crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG) (bsc#1273567).\n- CVE-2026-64315: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1274028).\n- CVE-2026-64316: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1273598).\n- CVE-2026-64317: isofs: bound Rock Ridge symlink components to the SL record (bsc#1273936).\n- CVE-2026-64319: nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339).\n- CVE-2026-64320: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420).\n- CVE-2026-64321: nvme: target: rdma: fix ndev refcount leak on queue connect (bsc#1273864).\n- CVE-2026-64322: udf: validate sparing table length as an entry count, not a byte count (bsc#1273958).\n- CVE-2026-64323: udf: validate VAT header length against the VAT inode size (bsc#1273305).\n- CVE-2026-64326: block: skip sync_blockdev() on surprise removal in bdev_mark_dead() (bsc#1273312).\n- CVE-2026-64327: usb: gadget: f_fs: Initialize epfile-\u003ein early to fix endpoint direction checks (bsc#1273283).\n- CVE-2026-64354: bpf: Validate BTF repeated field counts before expansion (bsc#1274060).\n- CVE-2026-64355: bpf: Reject fragmented frames in devmap (bsc#1273422).\n- CVE-2026-64364: HID: multitouch: fix out-of-bounds bit access on mt_io_flags (bsc#1273495).\n- CVE-2026-64368: mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (bsc#1273997).\n- CVE-2026-64373: cpufreq: Fix hotplug-suspend race during reboot (bsc#1273776).\n- CVE-2026-64375: proc: protect ptrace_may_access() with exec_update_lock (FD links) (bsc#1273868).\n- CVE-2026-64378: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (bsc#1273603).\n- CVE-2026-64381: smb: client: Fix next buffer leak in receive_encrypted_standard() (bsc#1273860).\n- CVE-2026-64382: smb: client: fix double-free in SMB2_open() replay (bsc#1273291).\n- CVE-2026-64383: smb: client: fix double-free in SMB2_flush() replay (bsc#1273426).\n- CVE-2026-64384: smb: client: fix change notify replay double-free (bsc#1274541).\n- CVE-2026-64385: smb: client: fix double-free in SMB2_ioctl() replay (bsc#1274539).\n- CVE-2026-64386: smb: client: fix query_info() replay double-free (bsc#1274543).\n- CVE-2026-64387: smb: client: fix query directory replay double-free (bsc#1274545).\n- CVE-2026-64411: netfilter: ebtables: terminate table name before find_table_lock() (bsc#1274077).\n- CVE-2026-64412: netfilter: ebtables: module names must be null-terminated (bsc#1273780).\n- CVE-2026-64415: mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent softlockup (bsc#1273317).\n- CVE-2026-64416: mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless host (bsc#1273286).\n- CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction (bsc#1274274).\n- CVE-2026-64434: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref (bsc#1273880).\n- CVE-2026-64436: net: af_key: initialize alg_key_len for IPComp states (bsc#1274277).\n- CVE-2026-64450: tipc: fix out-of-bounds read in broadcast Gap ACK blocks (bsc#1273523).\n- CVE-2026-64452: 6lowpan: fix NHC entry use-after-free on error path (bsc#1273460).\n- CVE-2026-64458: mm/damon/ops-common: handle extreme intervals in damon_hot_score() (bsc#1273788).\n- CVE-2026-64463: usb: typec: tcpci_rt1711h: unregister TCPCI port with devres (bsc#1273273).\n- CVE-2026-64472: vfio/mlx5: Fix racy bitfields and tighten struct layout (bsc#1274075).\n- CVE-2026-64477: x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled (bsc#1274264).\n- CVE-2026-64507: bpf: Support for hardening against JIT spraying (bsc#1273999).\n- CVE-2026-64518: tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key() (bsc#1273524).\n- CVE-2026-64519: NFSD: Fix infinite loop in layout state revocation (bsc#1274252).\n- CVE-2026-64526: ethtool: tsconfig: fix missing ethnl_ops_complete() (bsc#1274052).\n- CVE-2026-64534: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error (bsc#1273803).\n- CVE-2026-64535: nvmet-tcp: Fix potential UAF when ddgst mismatch (bsc#1273809).\n- CVE-2026-64537: bridge: cfm: reject invalid CCM interval at configuration time (bsc#1273289).\n- CVE-2026-64538: ipv6: Fix null-ptr-deref in fib6_nh_mtu_change() (bsc#1273335).\n- CVE-2026-64541: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (bsc#1273303).\n- CVE-2026-64542: ipv6: ndisc: fix NULL deref in accept_untracked_na() (bsc#1273309).\n- CVE-2026-64543: tipc: fix use-after-free of the discoverer in tipc_disc_rcv() (bsc#1273311).\n- CVE-2026-64545: net, bpf: check master for NULL in xdp_master_redirect() (bsc#1273318).\n- CVE-2026-64548: bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() (bsc#1273337).\n- CVE-2026-64551: sctp: validate STALE_COOKIE cause length before reading staleness (bsc#1273813).\n- CVE-2026-64552: virtio-net: fix len check in receive_big() (bsc#1273323).\n- CVE-2026-64553: net: psample: fix info leak in PSAMPLE_ATTR_DATA (bsc#1273336).\n- CVE-2026-64554: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() (bsc#1273340).\n- CVE-2026-64555: KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops() (bsc#1273331).\n- CVE-2026-64556: perf/core: Detach event groups during remove_on_exec (bsc#1273251).\n- CVE-2026-64563: rhashtable: clear stale iter-\u003ep on table restart (bsc#1273995).\n- CVE-2026-64567: btrfs: reject free space cache with more entries than pages (bsc#1274006).\n- CVE-2026-64569: mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n (bsc#1274009).\n- CVE-2026-64572: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (bsc#1274014).\n- CVE-2026-64576: nexthop: initialize extack in nh_res_bucket_migrate() (bsc#1274030).\n- CVE-2026-64577: gtp: check skb_pull_data() return in gtp1u_send_echo_resp() (bsc#1274031).\n- CVE-2026-64579: xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert (bsc#1274036).\n- CVE-2026-64581: xfrm: fix sk_dst_cache double-free in xfrm_user_policy() (bsc#1274041).\n- CVE-2026-64582: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (bsc#1274040).\n- CVE-2026-64586: wifi: brcmfmac: drain bus_reset work on device removal (bsc#1274492).\n- CVE-2026-68082: libceph: fix two unsafe bare decodes in decode_lockers() (bsc#1274581).\n- CVE-2026-68086: mm/khugepaged: write all dirty file folios when collapsing (bsc#1274713).\n- CVE-2026-68096: audit: fix recursive locking deadlock in audit_dupe_exe() (bsc#1274730).\n- CVE-2026-68105: drm/amdgpu: Fix kernel panic during driver load failure (bsc#1274849).\n- CVE-2026-68116: vxlan: mdb: Fix source list corruption on a failed replace (bsc#1274876).\n- CVE-2026-68117: tipc: clear sock-\u003esk on the failed-insert path in tipc_sk_create() (bsc#1274881).\n- CVE-2026-68120: rtase: Workaround for TX hang caused by hardware packet parsing (bsc#1274887).\n- CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1274888).\n- CVE-2026-68123: openvswitch: fix GSO userspace truncation underflow (bsc#1275169).\n- CVE-2026-68124: mctp: serial: handle zero-length frames to prevent rx buffer overflow (bsc#1275192).\n- CVE-2026-68127: ila: reload IPv6 header after pskb_may_pull in checksum adjust (bsc#1275237).\n- CVE-2026-68128: ice: reject out-of-range ptype in ice_parser_profile_init (bsc#1275238).\n- CVE-2026-68129: gve: fix Rx queue stall on alloc failure (bsc#1275517).\n- CVE-2026-68132: super: fix emergency thaw deadlock on frozen block devices (bsc#1275553).\n- CVE-2026-68133: ice: fix PTP Call Trace during PTP release (bsc#1275555).\n- CVE-2026-68135: net: hip04: fix RX buffer leak on build_skb failure (bsc#1275557).\n- CVE-2026-68136: net: gro: fix double aggregation of flush-marked skbs (bsc#1275474).\n- CVE-2026-68138: net/sched: serialize qdisc_rtab_list against concurrent get/put (bsc#1274941).\n- CVE-2026-68139: net/mlx5e: Use sender devcom for MPV master-up (bsc#1275578).\n- CVE-2026-68141: net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() (bsc#1275094).\n- CVE-2026-68142: geneve: require CAP_NET_ADMIN in the device netns for changelink (bsc#1275582).\n- CVE-2026-68143: net: slip: serialize receive against buffer reallocation (bsc#1275583).\n- CVE-2026-68144: phonet: pep: fix use-after-free in pep_get_sb() (bsc#1275481).\n- CVE-2026-68145: iomap: fix out-of-bounds bitmap_set() with zero-length range (bsc#1275584).\n- CVE-2026-68148: fscrypt: Add missing superblock check in find_or_insert_direct_key() (bsc#1275588).\n- CVE-2026-68149: fs: preserve ACL_DONT_CACHE state in forget_cached_acl() (bsc#1275294).\n- CVE-2026-68152: amt: fix use-after-free in AMT delayed works (bsc#1275300).\n- CVE-2026-68153: libceph: remove debugfs files before client teardown (bsc#1275301).\n- CVE-2026-68154: libceph: reject zero bucket types in crush_decode (bsc#1275303).\n- CVE-2026-68155: libceph: Reject monmaps advertising zero monitors (bsc#1275304).\n- CVE-2026-68156: libceph: refresh auth-\u003eauthorizer_buf{,_len} after authorizer update (bsc#1275305).\n- CVE-2026-68157: libceph: guard missing CRUSH type name lookup (bsc#1275306).\n- CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1275307).\n- CVE-2026-68159: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (bsc#1275470).\n- CVE-2026-68161: sctp: close UDP tunnel sockets during netns teardown (bsc#1274892).\n- CVE-2026-68164: mm/damon/core: disallow overlapping input ranges for damon_set_regions() (bsc#1274955).\n- CVE-2026-68165: mm/damon/core: validate ranges in damon_set_regions() (bsc#1274927).\n- CVE-2026-68166: userfaultfd: prevent registration of special VMAs (bsc#1274930).\n- CVE-2026-68169: mptcp: pm: userspace: fix use-after-free in get_local_id (bsc#1274952).\n- CVE-2026-68183: firmware: stratix10-svc: fix memory leaks and list corruption bugs (bsc#1274957).\n- CVE-2026-68198: wifi: ath6kl: fix use-after-free in aggr_reset_state() (bsc#1274803).\n- CVE-2026-68205: media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() (bsc#1274934).\n- CVE-2026-68238: drm/amdgpu: Release VFCT ACPI table reference (bsc#1275704).\n- CVE-2026-68258: drm/amdkfd: Check bounds on CRIU restore queue type and mqd size (bsc#1275866).\n- CVE-2026-68267: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (bsc#1275139).\n- CVE-2026-68273: drm/amdgpu: Fix context pstate override handling (bsc#1275129).\n- CVE-2026-68284: bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() (bsc#1275970).\n- CVE-2026-68286: drop_monitor: perform u64_stats updates under IRQ-disabled section (bsc#1275973).\n- CVE-2026-68288: net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD (bsc#1275975).\n- CVE-2026-68289: tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() (bsc#1275976).\n- CVE-2026-68293: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (bsc#1275091).\n- CVE-2026-68294: net: qrtr: restrict socket creation to the initial network namespace (bsc#1275092).\n- CVE-2026-68296: net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM (bsc#1275045).\n- CVE-2026-68297: tipc: fix u16 MTU truncation in media and bearer MTU validation (bsc#1275040).\n- CVE-2026-68299: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (bsc#1275088).\n- CVE-2026-68300: sctp: auth: verify auth requirement when auth_chunk is NULL (bsc#1275083).\n- CVE-2026-68302: amt: re-read skb header pointers after every pull (bsc#1275081).\n- CVE-2026-68313: tipc: fix infinite loop in __tipc_nl_compat_dumpit (bsc#1274665).\n- CVE-2026-68315: sctp: validate stream count in sctp_process_strreset_inreq() (bsc#1274662).\n- CVE-2026-68319: pds_core: fix deadlock between reset thread and remove (bsc#1274657).\n- CVE-2026-68320: sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid (bsc#1274659).\n- CVE-2026-68321: net: txgbe: fix FDIR filter leak on remove (bsc#1274652).\n- CVE-2026-68322: rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled (bsc#1274656).\n- CVE-2026-68325: iommu/amd: Bound the early ACPI HID map (bsc#1274651).\n- CVE-2026-68328: nfp: Check resource mutex allocation (bsc#1274646).\n- CVE-2026-68329: iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() (bsc#1274645).\n- CVE-2026-68331: dpaa2-eth: put MAC endpoint device on disconnect (bsc#1274642).\n- CVE-2026-68333: dpaa2-switch: put MAC endpoint device on disconnect (bsc#1274644).\n- CVE-2026-68335: rds: drop incoming messages that cross network namespace boundaries (bsc#1274640).\n- CVE-2026-68336: bonding: fix devconf_all NULL dereference when IPv6 is disabled (bsc#1274639).\n- CVE-2026-68338: net/packet: avoid fanout hook re-registration after unregister (bsc#1274637).\n- CVE-2026-68375: bnxt_en: Handle partially initialized auxiliary devices (bsc#1274835).\n- CVE-2026-68377: net/sched: act_tunnel_key: Defer dst_release to RCU callback (bsc#1274831).\n- CVE-2026-68386: bpf, sockmap: Reject unhashed UDP sockets on sockmap update (bsc#1274814).\n- CVE-2026-68393: Bluetooth: hci_sync: extend conn_hash lookup critical sections (bsc#1274904).\n- CVE-2026-68395: ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered (bsc#1274900).\n- CVE-2026-68397: net/iucv: take a reference on the socket found in afiucv_hs_rcv() (bsc#1274898).\n- CVE-2026-68398: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF (bsc#1274908).\n- CVE-2026-68399: bpf: Fix UAF in sock clone early bailouts (bsc#1274897).\n- CVE-2026-68408: wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (bsc#1274709).\n- CVE-2026-68417: RDMA/siw: publish QP after initialization (bsc#1274696).\n- CVE-2026-68418: RDMA/irdma: Prevent user-triggered null deref on QP create (bsc#1274690).\n- CVE-2026-68419: RDMA/irdma: Prevent rereg_mr for non-mem regions (bsc#1274698).\n- CVE-2026-68422: btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() (bsc#1274706).\n- CVE-2026-68425: IB/mad: Drop unmatched RMPP responses before reassembly (bsc#1274700).\n- CVE-2026-68426: xfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment (bsc#1274705).\n- CVE-2026-68432: vxlan: require CAP_NET_ADMIN in the device netns for changelink (bsc#1274800).\n- CVE-2026-68433: libceph: bound get_version reply decode to front len (bsc#1274801).\n- CVE-2026-68442: btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps (bsc#1274773).\n- CVE-2026-68448: ovl: check access to copy_file_range source with src mounter creds (bsc#1274838).\n- CVE-2026-68450: btrfs: free mapping node on duplicate reloc root insert (bsc#1274834).\n- CVE-2026-68470: wifi: mac80211: validate extension-frame layout before RX (bsc#1276500).\n- CVE-2026-68480: x86/bugs: Make Safe-RET robust against interrupt injection (bsc#1274208).\n- CVE-2026-72017: net: macb: drop in-flight Tx SKBs on close (bsc#1276840).\n- CVE-2026-72019: macsec: don't read an unset MAC header in macsec_encrypt() (bsc#1276865).\n- CVE-2026-72020: ipvs: reset full ip_vs_seq structs in ip_vs_conn_new (bsc#1275506).\n- CVE-2026-72022: llc: fix SAP refcount leak in llc_ui_autobind() (bsc#1276785).\n- CVE-2026-72023: octeontx2-pf: fix SQB pointer leak on init failure (bsc#1276793).\n- CVE-2026-72032: net/mlx5: HWS, fix matcher leak on resize target setup failure (bsc#1276955).\n- CVE-2026-72034: fhandle: reject detached mounts in capable_wrt_mount() (bsc#1276957).\n- CVE-2026-72035: net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1276961).\n- CVE-2026-72036: net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1277034).\n- CVE-2026-72045: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (bsc#1277078).\n- CVE-2026-72046: gve: fix header buffer corruption with header-split and HW-GRO (bsc#1275519).\n- CVE-2026-72051: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276801).\n- CVE-2026-72052: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276803).\n- CVE-2026-72053: net: ipip: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276814).\n- CVE-2026-72054: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276818).\n- CVE-2026-72055: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276821).\n- CVE-2026-72061: net: sit: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277249).\n- CVE-2026-72069: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (bsc#1275528).\n- CVE-2026-72072: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (bsc#1277155).\n- CVE-2026-72083: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (bsc#1275535).\n- CVE-2026-72084: scsi: target: core: Generate correct identifiers for PR OUT transport IDs (bsc#1275540).\n- CVE-2026-72100: dm-integrity: fix a bug if the bio is out of limits (bsc#1277311).\n- CVE-2026-72101: dm-integrity: fix leaking uninitialized kernel memory (bsc#1276831).\n- CVE-2026-72103: dm: avoid leaking the caller's thread keyring via the table device file (bsc#1277315).\n- CVE-2026-72106: dm-ioctl: fix a possible overflow in list_version_get_info (bsc#1277321).\n- CVE-2026-72107: dm era: fix out-of-bounds memory access for non-zero start sector (bsc#1277349).\n- CVE-2026-72108: dm thin metadata: fix metadata snapshot consistency on commit failure (bsc#1277350).\n- CVE-2026-72132: NFS: Charge unstable writes by request size, not folio size (bsc#1277551).\n- CVE-2026-72136: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277574).\n- CVE-2026-72137: xfrm: nat_keepalive: avoid double free on send error (bsc#1275587).\n- CVE-2026-72161: ocfs2: add journal NULL check in ocfs2_checkpoint_inode() (bsc#1277233).\n- CVE-2026-72163: ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits (bsc#1277231).\n- CVE-2026-72164: ocfs2: avoid moving extents to occupied clusters (bsc#1277553).\n- CVE-2026-72176: mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error (bsc#1277230).\n- CVE-2026-72177: mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs() (bsc#1277227).\n- CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1275655).\n- CVE-2026-72221: sunrpc: wait for in-flight TLS handshake callback when cancel loses race (bsc#1275665).\n- CVE-2026-72222: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (bsc#1275669).\n- CVE-2026-72234: batman-adv: access unicast_ttvn skb-\u003edata only after skb realloc (bsc#1275672).\n- CVE-2026-72242: selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (bsc#1277655).\n- CVE-2026-72243: selinux: check connect-related permissions on TCP Fast Open (bsc#1277656).\n- CVE-2026-72251: netfilter: nf_nat_sip: reload possible stale data pointer (bsc#1275827).\n- CVE-2026-72254: netfilter: nft_fib: reject fib expression on the netdev egress hook (bsc#1277204).\n- CVE-2026-72280: KVM: arm64: nv: Drop bogus WARN for write to ZCR_EL2 (bsc#1277726).\n- CVE-2026-72282: KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers (bsc#1277728).\n- CVE-2026-72288: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (bsc#1275886).\n- CVE-2026-72289: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (bsc#1275905).\n- CVE-2026-72296: net: ife: require ETH_HLEN to be pullable in ife_decode() (bsc#1275923).\n- CVE-2026-72297: net: atm: reject out-of-range traffic classes in QoS validation (bsc#1277738).\n- CVE-2026-72306: vduse: Requeue failed read to send_list head (bsc#1277748).\n- CVE-2026-72307: mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() (bsc#1277160).\n- CVE-2026-72308: mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() (bsc#1277159).\n- CVE-2026-72317: SUNRPC: pin upper rpc_clnt across the TLS connect_worker (bsc#1275925).\n- CVE-2026-72323: ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (bsc#1275985).\n- CVE-2026-72325: perf/x86/amd/core: Avoid enabling BRS from the SVM reload path (bsc#1277761).\n- CVE-2026-72330: net/tls: Consume empty data records in tls_sw_read_sock() (bsc#1277764).\n- CVE-2026-72337: Bluetooth: 6lowpan: avoid untracked enable work (bsc#1277773).\n- CVE-2026-72339: qede: fix off-by-one in BD ring consumption on build_skb failure (bsc#1276006).\n- CVE-2026-72341: net/mlx5e: Fix publication race for priv-\u003echannel_stats[] (bsc#1277660).\n- CVE-2026-72342: net/mlx5e: Fix HV VHCA stats agent registration race (bsc#1277775).\n- CVE-2026-72343: net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation (bsc#1277776).\n- CVE-2026-72345: net/mlx5: LAG, Fix off-by-one in single-FDB error rollback (bsc#1277782).\n- CVE-2026-72347: netfilter: xt_connmark: reject invalid shift parameters (bsc#1277783).\n- CVE-2026-72350: netfilter: xt_u32: reject invalid shift counts (bsc#1277822).\n- CVE-2026-72366: netfs: Fix netfs_create_write_req() to handle async cache object creation (bsc#1276333).\n- CVE-2026-72379: fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid (bsc#1277818).\n- CVE-2026-72389: bridge: stp: Fix a potential use-after-free when deleting a bridge (bsc#1273869).\n- CVE-2026-72398: sctp: add INIT verification after cookie unpacking (bsc#1276381).\n- CVE-2026-72399: net: enetc: check the number of BDs needed for xdp_frame (bsc#1276553).\n- CVE-2026-72414: net: dsa: sja1105: round up PTP perout pin duration (bsc#1278039).\n- CVE-2026-72421: ipv4: fib: Don't ignore error route in local/main tables (bsc#1277023).\n- CVE-2026-72425: ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (bsc#1277120).\n- CVE-2026-72430: net/sched: act_ct: fix nf_connlabels leak on two error paths (bsc#1277118).\n- CVE-2026-72437: md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry (bsc#1277874).\n- CVE-2026-72438: md/raid10: fix writes_pending and barrier reference leaks on discard failures (bsc#1277115).\n- CVE-2026-72439: md/raid10: fix writes_pending leak on write request failures (bsc#1277876).\n- CVE-2026-72440: md/raid1: fix writes_pending and barrier reference leaks on write failures (bsc#1277114).\n- CVE-2026-72448: octeontx2-pf: Fix leak of SQ timestamp buffer on teardown (bsc#1277108).\n- CVE-2026-72450: xfrm: validate selector family and prefixlen during match (bsc#1278113).\n- CVE-2026-72459: apparmor: aa_label_alloc use aa_label_free on alloc failure (bsc#1277092).\n- CVE-2026-72460: apparmor: check label build before no_new_privs test (bsc#1277229).\n- CVE-2026-72464: xprtrdma: Post receive buffers after RPC completion (bsc#1277069).\n- CVE-2026-72466: xprtrdma: Fix bcall rep leak and unbounded peek (bsc#1277057).\n- CVE-2026-72467: xprtrdma: Check frwr_wp_create() during connect (bsc#1277059).\n- CVE-2026-72468: xprtrdma: Initialize re_id before removal registration (bsc#1277062).\n- CVE-2026-72469: xprtrdma: Fix ep kref imbalance on ADDR_CHANGE (bsc#1277047).\n- CVE-2026-72473: xprtrdma: Avoid 250 ms delay on backlog wakeup (bsc#1277037).\n- CVE-2026-72485: coresight: platform: defer connection counter increment until alloc succeeds (bsc#1276771).\n- CVE-2026-72487: PCI: Introduce named defines for PCI ROM (bsc#1276767).\n- CVE-2026-72488: soundwire: fix bug in sdw_add_element_group_count found by syzkaller (bsc#1276766).\n- CVE-2026-72494: RDMA/irdma: Replace waitqueue and flag with completion (bsc#1276941).\n- CVE-2026-72495: RDMA/bnxt_re: Avoid repeated requests to allocate WC pages (bsc#1276937).\n- CVE-2026-72497: RDMA/bnxt_re: Add a max slot check for SQ (bsc#1276913).\n- CVE-2026-72499: RDMA/bnxt_re: Free CQ toggle page after firmware teardown (bsc#1276551).\n- CVE-2026-72500: RDMA/bnxt_re: Free SRQ toggle page after firmware teardown (bsc#1276552).\n- CVE-2026-72501: RDMA/bnxt_re: Initialize dpi variable to zero (bsc#1276546).\n- CVE-2026-72502: tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) (bsc#1276542).\n- CVE-2026-74255: tipc: fix UAF in tipc_l2_send_msg() (bsc#1276547).\n- CVE-2026-74261: ALSA: seq: avoid stale FIFO cells during resize (bsc#1276528).\n- CVE-2026-74269: bnxt: fix head underflow on XDP head-grow (bsc#1276507).\n- CVE-2026-74270: handshake: Require admin permission for DONE command (bsc#1276512).\n- CVE-2026-74282: tipc: prevent snt_unacked underflow on CONN_ACK (bsc#1276473).\n- CVE-2026-74284: net/sched: sch_hfsc: Don't make class passive twice (bsc#1276468).\n- CVE-2026-74286: net: pfcp: allocate per-cpu tstats for PFCP netdevs (bsc#1276471).\n- CVE-2026-74296: RDMA/mlx5: Release the HW-provided UAR index rather than the SW one (bsc#1276452).\n- CVE-2026-74297: RDMA/mlx5: Fix undefined shift of user RQ WQE size (bsc#1276446).\n- CVE-2026-74307: ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT (bsc#1276905).\n- CVE-2026-74308: ext4: fix kernel BUG in ext4_write_inline_data_end (bsc#1276880).\n- CVE-2026-74313: vduse: hold vduse_lock across IDR lookup in open path (bsc#1276876).\n- CVE-2026-74316: NFSD: Handle layout stid in nfsd4_drop_revoked_stid() (bsc#1276870).\n- CVE-2026-74317: ixgbe: do not configure xps for XDP queues (bsc#1276866).\n- CVE-2026-74318: btrfs: fix deadlock cloning inline extent when using flushoncommit (bsc#1276864).\n- CVE-2026-74321: btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() (bsc#1277202).\n- CVE-2026-74334: RDMA/nldev: Fix locking when accessing mr-\u003epd (bsc#1277095).\n- CVE-2026-74345: RDMA/siw: Fix endpoint/socket association handling (bsc#1277285).\n- CVE-2026-74346: RDMA/irdma: Fix OOB read during CQ MR registration (bsc#1278155).\n- CVE-2026-74349: ocfs2: reject FITRIM ranges shorter than a cluster (bsc#1278180).\n- CVE-2026-74363: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs (bsc#1278070).\n- CVE-2026-74375: md: replace wait loop with wait_event() in md_handle_request() (bsc#1277649).\n- CVE-2026-74377: RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path (bsc#1278236).\n- CVE-2026-74378: RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe (bsc#1278233).\n- CVE-2026-74382: net/sched: cls_bpf: prevent unbounded recursion in offload rollback (bsc#1278240).\n- CVE-2026-74388: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data (bsc#1278253).\n- CVE-2026-74390: RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs (bsc#1278088).\n- CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277408).\n- CVE-2026-74395: RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference (bsc#1277077).\n- CVE-2026-74397: IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier (bsc#1278098).\n- CVE-2026-74406: vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive() (bsc#1276395).\n- CVE-2026-74464: net: openvswitch: fix skb leak on flow key update failure during ct (bsc#1277070).\n- CVE-2026-74474: vxlan: use pskb_network_may_pull() for transmit path header pulls (bsc#1276335).\n- CVE-2026-74475: vxlan: unclone skb head before modifying eth header in route_shortcircuit() (bsc#1276339).\n- CVE-2026-74476: veth: convert frag_list skbs before running XDP (bsc#1276341).\n- CVE-2026-74479: net: pktgen: fix proc entry use-after-free (bsc#1276354).\n- CVE-2026-74481: mm/page_reporting: use system_freezable_wq to fix UAF during suspend (bsc#1276355).\n- CVE-2026-74482: mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios (bsc#1276346).\n- CVE-2026-74495: igbvf: Fix leak in TX DMA error cleanup (bsc#1275864).\n- CVE-2026-74496: fou: Fix use-after-free in fou_create() (bsc#1275867).\n- CVE-2026-74510: Bluetooth: mgmt: fix UAF in pair command cancellation (bsc#1275950).\n- CVE-2026-74512: audit: fix potential use-after-free in audit_del_rule() (bsc#1275954).\n- CVE-2026-74513: dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister (bsc#1275956).\n- CVE-2026-74517: KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs (bsc#1276258).\n- CVE-2026-74518: mm/hugetlb: fix list corruption in allocate_file_region_entries() (bsc#1275798).\n- CVE-2026-74523: qede: sync udp_tunnel ports outside qede_lock in the recovery path (bsc#1275802).\n- CVE-2026-74527: octeontx2-af: Block VFs from clobbering special CGX PKIND state (bsc#1275805).\n- CVE-2026-74533: Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero (bsc#1275804).\n- CVE-2026-74534: Bluetooth: ISO: Fix data-race on iso_pi(sk) in socket and HCI event paths (bsc#1275801).\n- CVE-2026-74535: Bluetooth: ISO: avoid deadlocks in iso_sock_timeout (bsc#1275812).\n- CVE-2026-74536: Bluetooth: ISO: fix leaking sk after socket release (bsc#1275799).\n- CVE-2026-74537: Bluetooth: ISO: hold sk properly in iso_conn_ready (bsc#1275687).\n- CVE-2026-74545: rtase: fix double free of multi-frag skb on DMA map failure (bsc#1275679).\n- CVE-2026-74548: forcedeth: fix UAF of txrx_stats in nv_remove (bsc#1275695).\n- CVE-2026-74550: net: do not send ICMP/NDISC Redirects when peer allocation fails (bsc#1275688).\n- CVE-2026-74555: scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race (bsc#1275690).\n- CVE-2026-74556: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (bsc#1275696).\n- CVE-2026-74557: scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer (bsc#1275685).\n- CVE-2026-74563: rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() (bsc#1275574).\n- CVE-2026-74566: keys: make keyring key-chunk byte order agree with keyring_diff_objects() (bsc#1275566).\n- CVE-2026-74567: keys: fix out-of-bounds read in keyring_get_key_chunk() (bsc#1275569).\n- CVE-2026-74571: btrfs: skip global block reserve accounting for rescue mounts (bsc#1275561).\n- CVE-2026-74577: net: mpls: initialize rtm_tos in mpls_getroute() (bsc#1275572).\n- CVE-2026-74581: net: ipv6: clear suppressed fib6 rule result (bsc#1275782).\n- CVE-2026-74582: packet: use consistent hard_header_len in non-ring send paths (bsc#1275784).\n- CVE-2026-74584: RDMA/bnxt_re: zero shared page before exposing to userspace (bsc#1277066).\n- CVE-2026-74598: ipv6: fix Route Information option length validation (bsc#1277918).\n- CVE-2026-74610: tls: don't leave a full plaintext sk_msg ring unpushed (bsc#1277054).\n- CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277505).\n- CVE-2026-74615: vxlan: do not arm the ageing timer on a device that is down (bsc#1277901).\n- CVE-2026-74616: xdp: reject clones that overrun skb_shared_info tailroom (bsc#1277813).\n- CVE-2026-74622: net: atlantic: free RX pages of consumed but not refilled buffers (bsc#1277862).\n- CVE-2026-74644: mm/damon/ops-common: putback folios on invalid migrate nid (bsc#1277033).\n- CVE-2026-74665: net: fix skb length accounting after generic XDP frag adjustment (bsc#1277407).\n- CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277391).\n- CVE-2026-74695: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() (bsc#1276931).\n- CVE-2026-74705: udp: fix potential use-after-free in tunnel segmentation (bsc#1276922).\n- CVE-2026-74712: vdpa/mlx5: Fix buffer length in create_direct_keys() (bsc#1276577).\n- CVE-2026-74717: net/mlx5: fw_tracer, return NULL on create error (bsc#1276569).\n- CVE-2026-74719: net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()\n  (bsc#1276572).\n- CVE-2026-74722: btrfs: fix memory leak in btrfs_do_encoded_write() (bsc#1276561).\n- CVE-2026-74723: btrfs: lzo: reject inline extents without valid headers (bsc#1276562).\n- CVE-2026-74730: NFS: Pin the 'struct nfs_server' during a FREE_STATEID call (bsc#1276566).\n- CVE-2026-74737: net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG (bsc#1277898).\n- CVE-2026-74743: macvlan: inherit needed_headroom and needed_tailroom from lowerdev (bsc#1277908).\n- CVE-2026-74744: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (bsc#1278094).\n- CVE-2026-80529: xfs: don't swallow dquot recovery verification errors (bsc#1277688).\n- CVE-2026-80530: xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (bsc#1277668).\n- CVE-2026-80531: xfs: avoid UAF on sc-\u003etempip in xrep_tempfile_create (bsc#1277680).\n- CVE-2026-80533: xfs: don't walk off the end of a null sc-\u003esa.agi_bp in AGI repair (bsc#1277636).\n- CVE-2026-80534: xfs: fix ilock leak on error in xfs_dq_get_next_id (bsc#1277022).\n- CVE-2026-80535: xfs: don't double-lock when deleting a self-referential directory (bsc#1277641).\n- CVE-2026-80557: libceph: fix OOB read in decode_watchers() via missing bounds check (bsc#1277268).\n- CVE-2026-80558: libceph: Avoid using invalid osd indices from primary_temp (bsc#1277485).\n- CVE-2026-80561: libceph: fix multiple unsafe decodes in decode_locker() (bsc#1277265).\n- CVE-2026-80586: mptcp: options: reset DSS fields in case of unexpected size (bsc#1277328).\n- CVE-2026-80589: block: stop the timeout timer when releasing a never added disk (bsc#1277335).\n- CVE-2026-80590: inet: frags: strip GSO state from fragments before reassembly (bsc#1277275).\n- CVE-2026-80603: netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read (bsc#1278293).\n- CVE-2026-80609: qede: fix out-of-bounds check for cqe-\u003elen_list (bsc#1278334).\n- CVE-2026-80629: octeontx2-af: npc: Fix size of entry2cntr_map (bsc#1277308).\n- CVE-2026-80646: ipv6: guard against possible NULL deref in __in6_dev_stats_get() (bsc#1277513).\n- CVE-2026-80647: RDMA/hns: Fix warning in poll cq direct mode (bsc#1278331).\n- CVE-2026-80667: net/mlx5: LAG, MPESW, Fix missing complete() on devcom error (bsc#1278324).\n- CVE-2026-80681: vxlan: re-fetch eth header after route_shortcircuit() (bsc#1278416).\n- CVE-2026-80693: idpf: bound interrupt-vector register fill to the allocated array (bsc#1278395).\n- CVE-2026-80714: ipvs: do not propagate one-packet flag to synced conns (bsc#1277561).\n- CVE-2026-80721: Bluetooth: ISO: ensure no dangling hcon references in iso_conn (bsc#1277845).\n- CVE-2026-80727: x86/mce: Set up the polling timer before CMCI discovery (bsc#1278703).\n- CVE-2026-80731: net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (bsc#1278716).\n- CVE-2026-80737: serial: amba-pl011: synchronize DMA teardown (bsc#1279487).\n- CVE-2026-80739: net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock (bsc#1278733).\n- CVE-2026-80805: xfs: validate attr entry pointer before field access (bsc#1279580).\n- CVE-2026-80813: nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist() (bsc#1279537).\n- CVE-2026-80838: vxlan: keep the last remote linked during FDB flush (bsc#1279842).\n\nThe following non security issues were fixed:\n\n- accel/ivpu: Limit firmware log name prints to field size (git-fixes).\n- accel/ivpu: Validate firmware log buffer metadata (git-fixes).\n- accel/ivpu: Validate full buffer range in ivpu_to_cpu_addr (git-fixes).\n- accel/qaic: Address potential out-of-bounds read in resp_worker() (git-fixes).\n- accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() (git-fixes).\n- accessibility: speakup: unregister tty ldisc on later init failures (git-fixes).\n- ACPI: APEI: Fix ERST timeout unit conversion (git-fixes).\n- ACPI: battery: Adjust charging status validation check (git-fixes).\n- ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer (git-fixes).\n- ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root (git-fixes).\n- ACPI: pfr_update: fix stack buffer overflow in query_capability() (git-fixes).\n- ACPI: processor: idle: Expand _LPI package sanity checks (git-fixes).\n- ACPI: processor: validate MADT IOAPIC entry bounds (git-fixes).\n- ACPI: processor_idle: Mark LPI enter functions as __cpuidle (git-fixes).\n- ACPI: scan: fix bus ID cleanup on device_add() failures (git-fixes).\n- ACPI: video: Release PCI device reference after lookup (git-fixes).\n- ALSA: 6fire: bound the MIDI event length from the device (git-fixes).\n- ALSA: 6fire: Fix UAF at error handling during probe (stable-fixes).\n- ALSA: bcd2000: clear the URB pointers on disconnect (git-fixes).\n- ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev (git-fixes).\n- ALSA: caiaq: Fix potential double-free at error path (git-fixes).\n- ALSA: control: Don't add invalid kcontrols to LED layer (git-fixes).\n- ALSA: core: Fix use-after-free in snd_card_do_free() (git-fixes).\n- ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough (git-fixes).\n- ALSA: dummy: Check card index validity at probe (stable-fixes).\n- ALSA: dummy: Report a change when one capture switch channel moves (git-fixes).\n- ALSA: harmony: initialize locks before requesting IRQ (git-fixes).\n- ALSA: hda/ext: preserve PPLCCTL bits when clearing reset (git-fixes).\n- ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP r (stable-fixes).\n- ALSA: hda: Fix connection list comparison in proc output (git-fixes).\n- ALSA: hda: Report a change when only the channel status bytes move (git-fixes).\n- ALSA: hda: restore MFG widget enumeration after core split (git-fixes).\n- ALSA: hpi: Check transport errors during HPI6000 adapter initialization (git-fixes).\n- ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF (git-fixes).\n- ALSA: pcxhr: initialize mutexes before requesting threaded IRQ (git-fixes).\n- ALSA: rawmidi: Return the error from snd_rawmidi_input_params() (git-fixes).\n- ALSA: scarlett2: Use a private URB for the notification endpoint (git-fixes).\n- ALSA: seq: Don't leak the extension cell pointer in the bounce payload (git-fixes).\n- ALSA: seq: midi: Optimize event_input locking with RCU (git-fixes).\n- ALSA: seq: midi: Serialize input teardown with event_input (git-fixes).\n- ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion (git-fixes).\n- ALSA: usb-audio: Complete cleanup after system-resume errors (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() (git-fixes).\n- ALSA: usb-audio: fix OOB write on Type II inbound URBs (git-fixes).\n- ALSA: usb: Fix UAF at delayed release of MIDI2 EPs (git-fixes).\n- ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf (git-fixes).\n- ALSA: usbusx2y: validate URB actual_length in interrupt callback (git-fixes).\n- ALSA: usx2y: bound the hwdep mmap fault offset (git-fixes).\n- ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() (git-fixes).\n- apparmor: advertise the tcp fast open fix is applied (git-fixes).\n- ASoC: ab8500: Correct digital interface format setup (git-fixes).\n- ASoC: ab8500: Repair the DAPM capture graph (git-fixes).\n- ASoC: ab8500: Reset the audio block before configuring it (git-fixes).\n- ASoC: ab8500: Validate and program TDM slots correctly (git-fixes).\n- ASoC: adau1761: sort the register default table (git-fixes).\n- ASoC: amd: renoir: fix disable_pdm_interrupts() to clear mask bits (git-fixes).\n- ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC (git-fixes).\n- ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close() (git-fixes).\n- ASoC: apple: mca: increase SERDES reset delay (git-fixes).\n- ASoC: bcm: bcm63xx: Publish the OF module aliases (git-fixes).\n- ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses (git-fixes).\n- ASoC: cs35l33: drain threaded IRQ before runtime suspend (git-fixes).\n- ASoC: cs35l34: drain threaded IRQ before runtime suspend (git-fixes).\n- ASoC: cs35l41: sort the register default table (git-fixes).\n- ASoC: cs35l45: sort the register default table (git-fixes).\n- ASoC: cs4265: sort the register default table (git-fixes).\n- ASoC: cx2072x: sort the register default table (git-fixes).\n- ASoC: dapm: Fix off-by-one check on the second enum channel (git-fixes).\n- ASoC: fix unmet dependencies on PPC_BESTCOMM and SND_SOC_AC97_BUS (git-fixes).\n- ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready (git-fixes).\n- ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure (git-fixes).\n- ASoC: fsl_audmix: rework runtime PM handling in probe (git-fixes).\n- ASoC: fsl_easrc: sort the register default table (git-fixes).\n- ASoC: hdac_hda: Fix hlink refcount leak on component registration failure (git-fixes).\n- ASoC: Intel: avs: Clean up streams if their initialization fails (git-fixes).\n- ASoC: Intel: avs: Clean up the bus when fetching ML caps fails (git-fixes).\n- ASoC: Intel: avs: Do not ignore -ENOENT when loading a topology (git-fixes).\n- ASoC: Intel: avs: Fix unbalanced module reference count (git-fixes).\n- AsoC: intel: sst: fix PCI device reference leak on probe failure (git-fixes).\n- ASoC: Intel: SST: Publish the PCI module aliases (git-fixes).\n- ASoC: loongson: Fix error handling in ACPI property parsing (git-fixes).\n- ASoC: max9860: sort the register default table (git-fixes).\n- ASoC: mediatek: mt8183-afe-pcm: Shorten memif_data table using macros (stable-fixes).\n- ASoC: mediatek: mt8183-afe-pcm: Support \u003e32 bit DMA addresses (git-fixes).\n- ASoC: mediatek: mt8183-afe-pcm: use local `dev` pointer in driver callbacks (stable-fixes).\n- ASoC: mediatek: mt8183: Check runtime resume during probe (git-fixes).\n- ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable (stable-fixes).\n- ASoC: mediatek: mt8192: Check runtime resume during probe (git-fixes).\n- ASoC: meson: Keep link pointers valid on realloc failure (git-fixes).\n- ASoC: ml26124: sort the register default table (git-fixes).\n- ASoC: mt6351: Publish the OF module alias (git-fixes).\n- ASoC: pcm512x: sort the register default table (git-fixes).\n- ASoC: pxa: Use devm_clk_get_optional() for extclk clock (git-fixes).\n- ASoC: qcom: q6apm: keep the graph start count in sync with the DSP (git-fixes).\n- ASoC: rt274: sort the register default table (git-fixes).\n- ASoC: rt286: sort the register default table (git-fixes).\n- ASoC: rt298: sort the register default table (git-fixes).\n- ASoC: rt700-sdw: always drain jack work on remove (git-fixes).\n- ASoC: rt700: drop duplicate reg_default entry (git-fixes).\n- ASoC: rt700: sort the register default table (git-fixes).\n- ASoC: rt711-sdca: sort the register default tables (git-fixes).\n- ASoC: rt711: sort the register default table (git-fixes).\n- ASoC: rt712-sdca-dmic: sort the register default table (git-fixes).\n- ASoC: rt712-sdca-sdw: sort the register default table (git-fixes).\n- ASoC: rt715-sdca: drop duplicate reg_default entries (git-fixes).\n- ASoC: rt715-sdca: sort the register default tables (git-fixes).\n- ASoC: rt715: sort the register default table (git-fixes).\n- ASoC: rt1017-sdca-sdw: sort the register default table (git-fixes).\n- ASoC: rt1316-sdw: sort the register default table (git-fixes).\n- ASoC: rt1318-sdw: sort the register default table (git-fixes).\n- ASoC: rt1318: sort the register default table (git-fixes).\n- ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get (git-fixes).\n- ASoC: sgtl5000: sort the register default table (git-fixes).\n- ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() (git-fixes).\n- ASoC: SOF: validate topology volume range before allocation (git-fixes).\n- ASoC: sprd: validate compress buffer sizes against fixed allocations (git-fixes).\n- ASoC: sti-sas: sort the register default table (git-fixes).\n- ASoC: sti: initialize IRQ lock before requesting IRQ (git-fixes).\n- ASoC: tas2552: sort the register default table (git-fixes).\n- ASoC: tas2764: sort the register default table (git-fixes).\n- ASoC: tas2780: sort the register default table (git-fixes).\n- ASoC: tegra210_i2s: sort the register default table (git-fixes).\n- ASoC: tegra210_mixer: sort the register default table (git-fixes).\n- ASoC: tegra: Fix the MIXER enable default value (git-fixes).\n- ASoC: tegra: Sort MBDRC register defaults (git-fixes).\n- ASoC: xilinx: formatter_pcm: fix stream_data leak on open error (git-fixes).\n- ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers (git-fixes).\n- ata: ahci: work around lost interrupts on Marvell 88SE61xx (git-fixes).\n- batman-adv: bla: fix freeing of claims on meshif deletion (git-fixes).\n- batman-adv: bla: prevent CRC corruptions after claim flush (git-fixes).\n- batman-adv: dat: avoid unaligned fault in IP extraction (git-fixes).\n- batman-adv: fix stale receive device on merged fragments (git-fixes).\n- batman-adv: mcast: ensure unshared skb for multicast packets (git-fixes).\n- batman-adv: mcast: linearize skbuff for packet generation (git-fixes).\n- batman-adv: reject unrepresentable multicast TVLV offsets (git-fixes).\n- blk-mq: reinsert cached request to the list (bsc#1273770).\n- Bluetooth: btintel: bound firmware ID by TLV length (git-fixes).\n- Bluetooth: btintel: Fix diagnostics event detection (git-fixes).\n- Bluetooth: btintel: validate version TLV value lengths (git-fixes).\n- Bluetooth: btintel_pcie: Clear automask on spurious interrupts (git-fixes).\n- Bluetooth: btintel_pcie: fix tx_handle bounds off-by-one (git-fixes).\n- Bluetooth: btintel_pcie: validate packet_len before skb_put_data (git-fixes).\n- Bluetooth: btmtk: Declare MT7920 (MT7961 1a) Bluetooth firmware (git-fixes).\n- Bluetooth: btmtk: Do not discard the subsystem reset timeout (git-fixes).\n- Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read() (stable-fixes).\n- Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path (git-fixes).\n- Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX (git-fixes).\n- Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event (git-fixes).\n- Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev (git-fixes).\n- Bluetooth: btrtl: Don't leak return code when parsing firmware format v2 (git-fixes).\n- Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() (git-fixes).\n- Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req() (stable-fixes).\n- Bluetooth: btusb: Fix UAF of btusb_data by rx_work (git-fixes).\n- Bluetooth: do not leak an hci_conn when a second LE connect is rejected (git-fixes).\n- Bluetooth: eir: Fix OOB read in eir_get_service_data() (git-fixes).\n- Bluetooth: hci_aml: validate firmware segment lengths (git-fixes).\n- Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378 (git-fixes).\n- Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_conn: fix the SCO setup context lifetime (git-fixes).\n- Bluetooth: hci_conn: hold conn reference in abort_conn_sync() (git-fixes).\n- Bluetooth: hci_conn: re-enable advertising only for peripheral role (git-fixes).\n- Bluetooth: hci_core: Fix race condition during device registration (git-fixes).\n- Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb (git-fixes).\n- Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection (git-fixes).\n- Bluetooth: hci_event: fix LE list UAF on reset (git-fixes).\n- Bluetooth: hci_event: validate LE Set CIG Parameters response (git-fixes).\n- Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout() (git-fixes).\n- Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request (git-fixes).\n- Bluetooth: hci_sync: Fix accept list UAF during suspend (git-fixes).\n- Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths (git-fixes).\n- Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists (stable-fixes).\n- Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync() (stable-fixes).\n- Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del() (git-fixes).\n- Bluetooth: hci_uart: Fix false success return in hci_uart_setup() (git-fixes).\n- Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync (git-fixes).\n- Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready (git-fixes).\n- Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM (git-fixes).\n- Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan (git-fixes).\n- Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect (git-fixes).\n- Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync (git-fixes).\n- Bluetooth: MGMT: free the HCI command when it is cancelled (git-fixes).\n- Bluetooth: MGMT: free the mesh send cancel command when it is cancelled (git-fixes).\n- Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255 (git-fixes).\n- Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update (git-fixes).\n- Bluetooth: MSFT: validate evt_prefix_len against the response length (git-fixes).\n- Bluetooth: qca: fix NVM tag length underflow in TLV parser (git-fixes).\n- Bluetooth: RFCOMM: serialize security confirmation handling (git-fixes).\n- Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept (git-fixes).\n- Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (git-fixes).\n- Bluetooth: virtio_bt: avoid OOB read of build info string (git-fixes).\n- bnxt_en: Check return value of bnxt_hwrm_vnic_cfg (jsc#PED-16798).\n- bnxt_en: Delay for 5 seconds after AER DPC for all chips (jsc#PED-16798).\n- bnxt_en: Don't assume XDP is never enabled in bnxt_init_dflt_ring_mode() (jsc#PED-16798).\n- bnxt_en: Drop pci_save_state() after pci_restore_state() (jsc#PED-16798).\n- bnxt_en: Implement XDP RSS hash metadata extraction (jsc#PED-16798).\n- bnxt_en: Implement XDP RSS hash metadata extraction for V3_CMP (jsc#PED-16798).\n- bnxt_en: Move bnxt_rss_ext_op into header (jsc#PED-16798).\n- bnxt_en: Refactor some basic ring setup and adjustment logic (jsc#PED-16798).\n- bnxt_en: Restore default stat ctxs for ULP when resource is available (jsc#PED-16798).\n- bnxt_en: Set bp-\u003emax_tpa according to what the FW supports (jsc#PED-16798).\n- bnxt_en: Use absolute target ns from ptp_clock_request (jsc#PED-16798).\n- bnxt_en: use bnxt_xdp_buff for xdp context (jsc#PED-16798).\n- bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation (git-fixes).\n- bus: mhi: host: Fix controller cleanup on EDL sysfs failure (git-fixes).\n- bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET (git-fixes).\n- bus: ti-sysc: Fix /chosen node reference leak (git-fixes).\n- cacheinfo: don't propagate DT/ACPI error when arch supplies info (arm64) (git-fixes).\n- can: j1939: add missing calls in NETDEV_UNREGISTER notification handler (git-fixes).\n- can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking (stable-fixes).\n- char: xilinx_hwicap: unregister class on init errors (git-fixes).\n- cleanup: add a scoped version of CLASS() (stable-fixes).\n- cleanup: fix scoped_class() (git-fixes).\n- compiler_types: Introduce __flex_counter() and family (bsc#1280139).\n- cpufreq: intel_pstate: Add and use hybrid_get_cpu_type() (bsc#1240957 bsc#1249104 bsc#1265220).\n- cpufreq: intel_pstate: Avoid SMP calls to get cpu-type (bsc#1240957 bsc#1249104 bsc#1265220).\n- cpufreq: intel_pstate: Fix hwp_get_cpu_scaling() (bsc#1240957 bsc#1249104 bsc#1265220).\n- cpufreq: intel_pstate: Use correct scaling factor on Raptor Lake-E (bsc#1240957 bsc#1249104 bsc#1265220).\n- cpufreq: intel_pstate: Use CPPC to get scaling factors (bsc#1240957 bsc#1249104 bsc#1265220).\n- cpufreq: intel_pstate: Use HYBRID_SCALING_FACTOR_ADL for Bartlett Lake (bsc#1240957 bsc#1249104 bsc#1265220).\n- crypto: aspeed - Propagate platform_get_irq() errors (git-fixes).\n- crypto: atmel-sha204a - fix heap info leak on I2C transfer failure (git-fixes).\n- crypto: atmel-tdes - use scatterlist length before DMA mapping (git-fixes).\n- crypto: ccm - Set rfc4309 maxauthsize from child (git-fixes).\n- crypto: ccp - Abort doing SEV INIT if SNP INIT fails (stable-fixes).\n- crypto: ccp - Add new SEV/SNP platform shutdown API (stable-fixes).\n- crypto: ccp - Always pass in an error pointer to __sev_platform_shutdown_locked() (git-fixes).\n- crypto: ccp - Fix __sev_snp_shutdown_locked (git-fixes).\n- crypto: ccp - Fix dereferencing uninitialized error pointer (git-fixes).\n- crypto: ccp - Fix memory leak in SEV INIT_EX path (git-fixes).\n- crypto: ccp - Fix possible deadlock in SEV init failure path (git-fixes).\n- crypto: ccp - Fix SNP panic notifier unregistration (git-fixes).\n- crypto: ccp - Move dev_info/err messages for SEV/SNP init and shutdown (stable-fixes).\n- crypto: ccp - Move SEV/SNP Platform initialization to KVM (stable-fixes).\n- crypto: ccp - Register SNP panic notifier only if SNP is enabled (stable-fixes).\n- crypto: ccp - Reset TMR size at SNP Shutdown (stable-fixes).\n- crypto: doc - Remove extra parenthesis (git-fixes).\n- crypto: hisilicon/sec2 - fix CCM algorithm long packet failure (git-fixes).\n- crypto: keembay - Fix AEAD unregister count in error path (git-fixes).\n- crypto: keembay - Initialize completion before requesting IRQ (git-fixes).\n- crypto: keembay - publish OF module alias for OCS AES/SM4 (git-fixes).\n- crypto: lskcipher - propagate errors from unaligned crypt (git-fixes).\n- crypto: mxs-dcp - fix source scatterlist length access (git-fixes).\n- crypto: qat - cancel work on re-enable SR-IOV timeout (git-fixes).\n- crypto: qat - clear AES key schedule from stack (git-fixes).\n- crypto: qce - fix CCM AAD buffer underallocation (git-fixes).\n- crypto: qce - fix error path in devm_qce_register_algs (git-fixes).\n- crypto: qcom-rng - Allow zero as a random number (git-fixes).\n- crypto: qcom-rng - Enable clock in hwrng case (git-fixes).\n- crypto: rk3288 - fail ahash requests on HASH idle timeout (git-fixes).\n- crypto: sa2ul - stop probe if context pool creation fails (git-fixes).\n- crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping (git-fixes).\n- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (stable-fixes).\n- crypto: tegra - fix rctx-\u003ecryptlen calculation in tegra_gcm_do_one_req() (git-fixes).\n- cxl/acpi: Fix CXL_ACPI and CXL_PMEM Kconfig tristate mismatch (git-fixes).\n- cxl: Adjust the startup priority of cxl_pmem to be higher (git-fixes).\n- default_gfp(): avoid using the \"newfangled\" __VA_OPT__ trick (bsc#1280139).\n- device property: fix infinite loop in fwnode_for_each_child_node() (git-fixes).\n- dm/amdgpu: fix malformed link_settings debugfs output (git-fixes).\n- dma-mapping: add __dma_from_device_group_begin()/end() (bsc#1267586).\n- dmaengine: dw-edma: Clear stale requests on termination (git-fixes).\n- dmaengine: dw-edma: Complete descriptors before pausing (git-fixes).\n- dmaengine: dw-edma: Fix HDMA channel status register access (git-fixes).\n- dmaengine: dw-edma: Initialize IRQ data before requesting IRQs (git-fixes).\n- dmaengine: dw-edma: Serialize abort state updates (git-fixes).\n- dmaengine: dw-edma: Serialize channel state checks (git-fixes).\n- dmaengine: dw-edma: Terminate all descriptors without callbacks (git-fixes).\n- dmaengine: fsl-edma: tracing: no ptr dereference during log output (git-fixes).\n- dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe (git-fixes).\n- dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure (git-fixes).\n- dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal (git-fixes).\n- dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers (git-fixes).\n- dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout (git-fixes).\n- dmaengine: zynqmp_dma: fix kernel doc for zynqmp_dma_remove() (git-fixes).\n- driver core: soc: Unregister bus on early device registration failure (git-fixes).\n- drivers/virt: pkvm: Fix end calculation in mmio_guard_ioremap_hook() (git-fixes).\n- Drivers: hv: Use meaningful errnos for hypercall status codes (git-fixes).\n- drm/amd/display: Add AV mute wait frames to dce110_set_avmute (stable-fixes).\n- drm/amd/display: avoid divide-by-zero in __is_lut_linear() (git-fixes).\n- drm/amd/display: Check for tg ops in dce110_set_avmute (git-fixes).\n- drm/amd/display: dce100: skip non-DP stream encoders for DP MST (stable-fixes).\n- drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix (git-fixes).\n- drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE (git-fixes).\n- drm/amd/display: fix division by zero in get_estimated_bw() (git-fixes).\n- drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank() (git-fixes).\n- drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames (stable-fixes).\n- drm/amd/display: Remove unused-but-set variable hubp from (git-fixes).\n- drm/amd/display: validate plane degamma LUT size for private color prop (git-fixes).\n- drm/amd/pm: adjust the visibility of pp_table sysfs node (stable-fixes).\n- drm/amd/pm: fix gpu metrics energy accumulator for smu 13.0.0/13.0.7 (git-fixes).\n- drm/amd/pm: fix smu14 power limit range calculation (stable-fixes).\n- drm/amd/pm: make pp_features read-only when scpm is enabled (stable-fixes).\n- drm/amd/pm: Use same metric table for APU (stable-fixes).\n- drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read (git-fixes).\n- drm/amdgpu/gfx6: Fixup emit_cntxcntl() (git-fixes).\n- drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets (git-fixes).\n- drm/amdgpu/gfx6: Use PFP on the compute queues too (git-fixes).\n- drm/amdgpu/gfx8: drop unecessary BUG_ON() (stable-fixes).\n- drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup (git-fixes).\n- drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup (git-fixes).\n- drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma7.0: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) (stable-fixes).\n- drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older (stable-fixes).\n- drm/amdgpu/vce: fix integer overflow in image size (stable-fixes).\n- drm/amdgpu/vcn4: avoid rereading IB param length (stable-fixes).\n- drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (git-fixes).\n- drm/amdgpu: cap GTT size to physical RAM on APUs (stable-fixes).\n- drm/amdgpu: check ASPM on the dGPU host link (git-fixes).\n- drm/amdgpu: disallow multiple FENCE chunks in one submit (git-fixes).\n- drm/amdgpu: fix aperture iounmap skipped on device removal (git-fixes).\n- drm/amdgpu: fix autosuspend cleanup during removal (git-fixes).\n- drm/amdgpu: fix bo-\u003epin leaking in amdgpu_bo_create_reserved (stable-fixes).\n- drm/amdgpu: fix division by zero with invalid uvd dimensions (stable-fixes).\n- drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (stable-fixes).\n- drm/amdgpu: fix nbif 6.3.1 l1 low power not functional (git-fixes).\n- drm/amdgpu: Fix UVD decode image min size calculation (stable-fixes).\n- drm/amdgpu: Fix UVD dpb min size calculation for H264 (stable-fixes).\n- drm/amdgpu: Fix UVD min buffer sizes (stable-fixes).\n- drm/amdgpu: Fix VCE 3 ring align_mask (git-fixes).\n- drm/amdgpu: Fix VFCT bus number matching with soft filter (stable-fixes).\n- drm/amdgpu: Implement insert_end for VCE 3 (git-fixes).\n- drm/amdgpu: invoke pm_genpd_remove() before freeing genpd (stable-fixes).\n- drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini (git-fixes).\n- drm/amdgpu: read TRUNCATE_COORD_MODE on gfx12 (git-fixes).\n- drm/amdgpu: reject oversized IBs with per-ring packet limits (stable-fixes).\n- drm/amdgpu: Reject UVD message with dimensions above 4096 (stable-fixes).\n- drm/amdgpu: Reject UVD message with invalid number of h265 refs (stable-fixes).\n- drm/amdgpu: remove unused function parameter (stable-fixes).\n- drm/amdgpu: restore UMD profile pstate after runtime resume (stable-fixes).\n- drm/amdgpu: validate GEM_CREATE domain combinations (stable-fixes).\n- drm/amdkfd: Check bounds in allocate_event_notification_slot (stable-fixes).\n- drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (stable-fixes).\n- drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE (stable-fixes).\n- drm/amdkfd: fix QID bit leak in pqm_create_queue() (stable-fixes).\n- drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore (git-fixes).\n- drm/amdkfd: Handle invalid event type in CRIU event restore (stable-fixes).\n- drm/amdkfd: Use kvcalloc to allocate arrays (stable-fixes).\n- drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure (git-fixes).\n- drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure (git-fixes).\n- drm/bridge: ps8640: propagate AUX transfer register errors (git-fixes).\n- drm/bridge: tc358767: clamp the reported AUX read size to the request (git-fixes).\n- drm/connector/hdmi: Fix out of bounds memory read (git-fixes).\n- drm/connector: Fix epoch_counter docs to reflect reality (git-fixes).\n- drm/drm_exec: fix up contended obj when num_objects is 0 (git-fixes).\n- drm/gud: NUL-terminate TV mode names read from the device (git-fixes).\n- drm/gud: validate TV mode names before creating enum property (git-fixes).\n- drm/hibmc: Fix list of formats on the primary plane (git-fixes).\n- drm/hibmc: Use drm_atomic_helper_check_plane_state() (git-fixes).\n- drm/i915/hdcp: check streams bounds before overflow (git-fixes).\n- drm/i915/hdcp: Move to using intel_display in intel_hdcp (stable-fixes).\n- drm/i915/hdcp: require monotonically increasing seq_num_v (git-fixes).\n- drm/i915/hdcp: Skip inactive MST connectors when building stream list (stable-fixes).\n- drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() (stable-fixes).\n- drm/i915/vrr: require valid min/max vfreq for VRR (git-fixes).\n- drm/i915: Fix memory leak in query_perf_config_list() (git-fixes).\n- drm/lima: call drm_mm_init() with a valid allocation range (git-fixes).\n- drm/msm/a6xx: Fix RBBM_CLOCK_CNTL3_TP0 value in a730_hwcg (git-fixes).\n- drm/msm/a6xx: Fix stale rpmh votes after suspend (git-fixes).\n- drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0) (git-fixes).\n- drm/msm/dsi: Drop dev_pm_opp_set_rate(0) (git-fixes).\n- drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value (git-fixes).\n- drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE (git-fixes).\n- drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op (git-fixes).\n- drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE (git-fixes).\n- drm/nouveau: unsubscribe the channel-kill event before the fence context (git-fixes).\n- drm/nouveau: Use write-combined maps for coherent (git-fixes).\n- drm/panel-edp: fix i2c adapter leak on probe failure (git-fixes).\n- drm/panel: samsung-s6d16d0: Power off on prepare failure (git-fixes).\n- drm/panthor: fix firmware control interface bounds checks (git-fixes).\n- drm/panthor: return PTR_ERR() from devm_drm_dev_alloc() (git-fixes).\n- drm/panthor: skip zero-sized firmware sections (git-fixes).\n- drm/radeon: fix autosuspend cleanup during teardown (git-fixes).\n- drm/radeon: fix r100_copy_blit for large BOs (stable-fixes).\n- drm/radeon: restore hardware polling in fence_is_signaled to fix performance regression (git-fixes).\n- drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format (git-fixes).\n- drm/ssd130x: fix column and row end address in partial updates for ssd132x (git-fixes).\n- drm/ssd130x: fix column and row end address in partial updates in ssd133x (git-fixes).\n- drm/sun4i: crtc: Propagate layer initialization error (git-fixes).\n- drm/sun4i: Drop node references while building component list (git-fixes).\n- drm/sun4i: dw-hdmi: Drop TCON TOP port reference (git-fixes).\n- drm/sun4i: fix refcount leak in sun4i_backend_init_sat() (git-fixes).\n- drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz (git-fixes).\n- drm/sun4i: hdmi: Don't leak sync polarity bits into packet control (git-fixes).\n- drm/sun4i: tcon: Drop remote endpoint reference (git-fixes).\n- drm/sun4i: tcon: Drop TCON TOP device reference (git-fixes).\n- drm/sun4i: tcon: Set output mux for DSI and LVDS (git-fixes).\n- drm/sun4i: vi scaler: Fix coefficient selection (git-fixes).\n- drm/tegra: dsi: Re-add clear enable register if DSI was powered by bootloader (git-fixes).\n- drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info (git-fixes).\n- drm/tve200: add OF module alias for autoloading (git-fixes).\n- drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() (git-fixes).\n- drm/xe/oa: Check managed mutex initialization errors (git-fixes).\n- drm/xe/oa: Fix sync entry leak on OA config emit failure (git-fixes).\n- drm/xe/oa: Remove sysfs entry on idr_alloc failure in xe_oa_add_config_ioctl() (git-fixes).\n- drm/xe: Introduce xe_gt_dbg_printer() (stable-fixes).\n- drm/xe: Order ring writes before ring tail updates (git-fixes).\n- drm/xe: Stub out new pagefault layer (stable-fixes).\n- drm/xe: tests: fix error message in xe_migrate_sanity_test() (git-fixes).\n- drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used (git-fixes).\n- drm: fix race between partial drm_dev_register() failure and ioctl (git-fixes).\n- drm: lcdif: Wait for vblank before disabling DMA (git-fixes).\n- drm: Remove unused header in drm_dumb_buffers.c (git-fixes).\n- efi: fix stale reference to efi_recover_from_page_fault() (git-fixes).\n- erspan: Initialize options_len before referencing options (bsc#1274727).\n- ethtool: rss: fix hkey leak when indir_size is 0 (git-fixes).\n- fbdev: bitblit: bound-check glyph index in bit_cursor() (git-fixes).\n- fbdev: core: Fix pointer desynchronization in fb_io_read() (git-fixes).\n- fbdev: kyro: Validate overlay viewport coordinates (git-fixes).\n- fbdev: omapfb: panel-dsi-cm: initialize lock before registering display (git-fixes).\n- fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device() (git-fixes).\n- fbdev: uvesafb: unregister connector callback on init failure (git-fixes).\n- fbdev: vfb: defer cleanup until the last reference (git-fixes).\n- firmware: arm_scmi: Avoid IDR updates while cleaning channels (git-fixes).\n- firmware: arm_scmi: Clean up channels on setup failure (git-fixes).\n- firmware: arm_scmi: Drop handle on protocol bind failures (git-fixes).\n- firmware: arm_scmi: Fix requested device removal race (git-fixes).\n- firmware: arm_scmi: Free transport channel on IDR failure (git-fixes).\n- firmware: arm_scmi: Protect device request lookup with RCU (git-fixes).\n- firmware: arm_scmi: Publish channel state before callbacks (git-fixes).\n- firmware: arm_scmi: Quiesce notifications before teardown (git-fixes).\n- firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context (git-fixes).\n- firmware: arm_scmi: Reject out of range DT protocol IDs (git-fixes).\n- firmware: arm_scmi: Roll back partial protocol table registration (git-fixes).\n- firmware: arm_scmi: Unregister device notifier before IDR teardown (git-fixes).\n- firmware: arm_scmi: Unrequest devices if driver registration fails (git-fixes).\n- firmware: arm_scmi: Unwind P2A receiver mailbox setup failure (git-fixes).\n- firmware: arm_scmi: Unwind TX receiver mailbox setup failure (git-fixes).\n- firmware: arm_scmi: Use channel ID for transport teardown (git-fixes).\n- firmware_loader: do not queue completed sysfs fallback requests (git-fixes).\n- fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write (git-fixes).\n- fpga: dfl: fme: add error handling (git-fixes).\n- fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration (git-fixes).\n- fuse: fix race between interrupt and resend (git-fixes).\n- gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind (git-fixes).\n- gpu: host1x: Avoid stack over-read in debug output helpers (git-fixes).\n- gpu: host1x: Fix offset calculation in trace_write_gather (git-fixes).\n- gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings (stable-fixes).\n- HID: asus: fix missing hid_is_usb() check (git-fixes).\n- HID: asus: simplify RGB init sequence (stable-fixes).\n- HID: bpf: serialize device reference release in struct_ops destroy path (git-fixes).\n- HID: core: fix number/pointer type confusion on long items (git-fixes).\n- HID: core: fix OOB read of field-\u003eusage in hid_set_field() (git-fixes).\n- HID: ft260: fix stack-use-after-return write in I2C read race (git-fixes).\n- HID: ft260: validate i2c input report length (stable-fixes).\n- HID: hyperv: validate initial device info bounds (git-fixes).\n- HID: i2c-hid: Fix \"(null)\" output when reading report descriptor fails (git-fixes).\n- HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure (git-fixes).\n- HID: lg4ff: validate report length before fixed offsets (git-fixes).\n- HID: logitech-dj: Fix maxfield check in DJ short report validation (git-fixes).\n- HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report (git-fixes).\n- HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write (stable-fixes).\n- HID: logitech-dj: Standardise hid_report_enum variable nomenclature (stable-fixes).\n- HID: magicmouse: do not keep a stale msc-\u003einput if no input is claimed (git-fixes).\n- HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C (git-fixes).\n- HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID (stable-fixes).\n- HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() (git-fixes).\n- HID: magicmouse: re-enable multitouch after reset-resume (git-fixes).\n- HID: mcp2221: validate report size in mcp2221_raw_event() (git-fixes).\n- HID: multitouch: reclassify HTIX5288 to WIN_8_FORCE_MULTI_INPUT_NSMU (git-fixes).\n- HID: nintendo: Fix imu_timestamp_us double increment per report (git-fixes).\n- HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() (git-fixes).\n- HID: nintendo: register input device after capabilities are set (git-fixes).\n- HID: nintendo: stop device IO before hid_hw_stop on probe failure (git-fixes).\n- HID: picolcd: clamp eeprom debugfs read to bytes actually received (git-fixes).\n- HID: pidff: Rework pidff_set_time() to fix warnings (stable-fixes).\n- HID: pidff: Use ARRAY_SIZE macro instead of sizeof (stable-fixes).\n- HID: rmi: fix OOB access with undersized RMI reports (git-fixes).\n- HID: roccat: bound device-supplied profile index (git-fixes).\n- HID: roccat: free buffered reports when destroying device (git-fixes).\n- HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature (git-fixes).\n- HID: sensor: custom: Fix field sysfs group cleanup on failure (git-fixes).\n- HID: sensor: custom: Fix use-after-free in enable_sensor (git-fixes).\n- HID: synchronize input before cleaning up a failed probe (git-fixes).\n- HID: tmff: Use 64-bit arithmetic for force feedback scaling (git-fixes).\n- HID: wacom: validate report length in wacom_intuos_pro2_bt_irq (git-fixes).\n- hwmon: (ads7828) Fix external VREF regulator handling (git-fixes).\n- hwmon: (applesmc) fix key backlight workqueue leak on register failure (git-fixes).\n- hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors (git-fixes).\n- hwmon: (chipcap2) fix channels in humidity alarm notifications (git-fixes).\n- hwmon: (coretemp) Fix core_data leak on CPUs without PTS (git-fixes).\n- hwmon: (corsair-cpro) Create debugfs entries after hwmon registration (git-fixes).\n- hwmon: (corsair-cpro) Remove debugfs entries when probe fails (git-fixes).\n- hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination (git-fixes).\n- hwmon: (gpio-fan) Fix use-after-free in alarm work (git-fixes).\n- hwmon: (gpio-fan) take fan_data-\u003elock in gpio_fan_shutdown() (git-fixes).\n- hwmon: (ina2xx) Add support for has_alerts configuration flag (stable-fixes).\n- hwmon: (ina2xx) Add support for INA234 (stable-fixes).\n- hwmon: (ina2xx) Add support for INA260 (stable-fixes).\n- hwmon: (ina2xx) Fix various overflow issues (git-fixes).\n- hwmon: (ina2xx) Make it easier to add more devices (stable-fixes).\n- hwmon: (ina2xx) Shift INA234 shunt and current registers (stable-fixes).\n- hwmon: (ina226) Add support for SY24655 (stable-fixes).\n- hwmon: (ltc4282) Avoid overflow in maximum power calculation (git-fixes).\n- hwmon: (ltc4282) Clamp negative current limits (git-fixes).\n- hwmon: (ltc4282) Fix parsing adi,current-limit-sense-microvolt (git-fixes).\n- hwmon: (ltc4282) Make sure clk_init_data is fully initialized (git-fixes).\n- hwmon: (max6621) fix negative temperature offset and crit readings (git-fixes).\n- hwmon: (max6621) fix temperature clamp range (git-fixes).\n- hwmon: (nzxt-smart2) Check return value of init_device() in probe (git-fixes).\n- hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS (git-fixes).\n- hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations (git-fixes).\n- hwmon: Switch back to struct platform_driver::remove() (stable-fixes).\n- hwrng: ks-sa - Fix runtime PM cleanup on registration failure (git-fixes).\n- hwrng: omap - Fix probe error path cleanup (git-fixes).\n- hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() (git-fixes).\n- i2c: core: fix debugfs UAF on adapter removal (git-fixes).\n- i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (git-fixes).\n- i2c: imx: separate atomic, dma and non-dma use case (stable-fixes).\n- i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure (git-fixes).\n- i2c: mux: Fix channel node leak on adapter add failure (git-fixes).\n- i2c: ocores: Disable clock on failed resume (git-fixes).\n- i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices (git-fixes).\n- i3c: dw: rename \"pclk\" to \"apb\" to match dt-binding (git-fixes).\n- i3c: master: Fix device_register() error path (git-fixes).\n- i3c: master: Fix info leak and UAF in device unregister path (git-fixes).\n- i3c: master: Fix potential UAF in i3c_device_uevent() (git-fixes).\n- i3c: master: svc: bound IBI payload to the requested max_payload_len (git-fixes).\n- ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink (git-fixes).\n- ieee802154: cc2520: fix FIFOP work use-after-free (git-fixes).\n- ieee802154: hwsim: serialize pib updates to fix double-free (git-fixes).\n- iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE (git-fixes).\n- iio: adc: max34408: add missing 'select REGMAP_I2C' to Kconfig (git-fixes).\n- iio: adc: pac1921: fix wrong channel used in trigger handler read (git-fixes).\n- iio: buffer: Fix potential use-after-free in anonymous buffer release (git-fixes).\n- iio: buffer: Make IIO DMA fence release RCU-safe (git-fixes).\n- iio: buffer: Tie IIO dma fence lock lifetime to the fence (git-fixes).\n- iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable (git-fixes).\n- iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF (git-fixes).\n- iio: chemical: sgp30: Handle IAQ thread creation failure (git-fixes).\n- iio: dac: m62332: Fix regulator reference count imbalance (git-fixes).\n- iio: gyro: mpu3050: fix sign of raw angular velocity readings (git-fixes).\n- iio: light: cm32181: return zero after writing calibscale (git-fixes).\n- iio: light: gp2ap002: Disable regulators on resume failure (git-fixes).\n- iio: light: gp2ap002: re-enable irq if runtime suspend fails (git-fixes).\n- iio: light: isl29028: return zero in write_raw() on success (git-fixes).\n- iio: light: ltrf216a: fix runtime PM reference leak in error path (git-fixes).\n- iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem() (git-fixes).\n- iio: light: opt4001: Fix power down clearing bits of the wrong register (git-fixes).\n- iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask (git-fixes).\n- iio: light: opt4001: Reject integration times with a non-zero seconds part (git-fixes).\n- iio: light: tsl2583: return zero in write_raw() on success (git-fixes).\n- iio: light: tsl2772: fix ALS calibscale readback (git-fixes).\n- iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure (git-fixes).\n- iio: pressure: dps310: fix NULL pointer dereference on ACPI probe (git-fixes).\n- iio: pressure: mpl115: Fix runtime PM cleanup (git-fixes).\n- iio: srf04: fix pm_runtime handling on probe error path (git-fixes).\n- iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() (git-fixes).\n- Input: atkbd - skip deactivate for HONOR ZQC-P (git-fixes).\n- Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard (stable-fixes).\n- Input: cs40l50-vibra - validate custom data from user space (git-fixes).\n- Input: evdev - fix information leak in evdev_pass_values() (stable-fixes).\n- Input: evdev - sanitize event type index when fetching event masks (stable-fixes).\n- Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet (git-fixes).\n- Input: focaltech - use signed coordinates to prevent underflow (git-fixes).\n- Input: hynitron_cstxxx - validate touch count and finger IDs (git-fixes).\n- Input: iforce - validate input packet lengths (stable-fixes).\n- Input: iqs5xx - validate firmware record destination span (git-fixes).\n- Input: mms114 - fix Y-resolution configuration (git-fixes).\n- Input: psxpad-spi - set driver data before use (git-fixes).\n- Input: reject inhibit and uninhibit requests on unregistering devices (git-fixes).\n- Input: sur40 - fix input device registration ordering (stable-fixes).\n- Input: sur40 - fix V4L error path cleanup (stable-fixes).\n- Input: synaptics-rmi4 - block s_input when F54 queue is busy (git-fixes).\n- Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer (git-fixes).\n- Input: synaptics-rmi4 - fix F55 transmitter electrode count typo (git-fixes).\n- Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue (git-fixes).\n- Input: synaptics-rmi4 - zero report size on F54 work error (git-fixes).\n- Input: xpad - add support for ZENAIM LEVERLESS (stable-fixes).\n- interconnect: Fix use after free in icc_get() and of_icc_get_by_index() (git-fixes).\n- io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item (git-fixes).\n- io_uring/net: Avoid msghdr on op_connect/op_bind async data (git-fixes).\n- iommu/arm-smmu-v3: Manage teardown with devm (stable-fixes).\n- ip_tunnel: Use ip_tunnel_info() helper instead of 'info + 1' (bsc#1274727).\n- ipmi: ipmb: validate write message length (git-fixes).\n- ipmi: si: Fix NULL pointer dereference after failed registration (git-fixes).\n- KVM: arm64: Ensure FFA ranges are page aligned (git-fixes).\n- KVM: arm64: Fix bounds checking in do_ffa_mem_reclaim() (git-fixes).\n- KVM: arm64: Fix sign-extension of MMIO loads (git-fixes).\n- KVM: arm64: vgic: Reset in_kernel on private IRQ allocation failure (git-fixes).\n- KVM: arm64: Zero out the stack initialized data in the FFA handler (git-fixes).\n- KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN (git-fixes).\n- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (git-fixes).\n- KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit (git-fixes).\n- KVM: nVMX: Service local TLB flushes on failed nested VM-Enter (git-fixes).\n- KVM: PPC: Book3S HV: Add support for compat CPU capabilities for KVM on PowerNV (bsc#1263864 ltc#217835).\n- KVM: PPC: Book3S HV: Implement compat CPU capability retrieval for KVM on PowerVM (bsc#1263864 ltc#217835).\n- KVM: PPC: Book3S HV: Validate arch_compat against host compatibility mode (bsc#1263864 ltc#217835).\n- KVM: PPC: Document KVM_PPC_GET_COMPAT_CAPS ioctl (bsc#1263864 ltc#217835).\n- KVM: PPC: Introduce KVM_CAP_PPC_COMPAT_CAPS and wire up ioctl (bsc#1263864 ltc#217835).\n- KVM: SEV: Use to_kvm_sev_info() for fetching kvm_sev_info struct (git-fixes).\n- KVM: SVM: Add support to initialize SEV/SNP functionality in KVM (bsc#1279887).\n- KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts (git-fixes).\n- KVM: SVM: Serialize accesses to the owner and mirror list with separate lock (git-fixes).\n- KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (git-fixes).\n- KVM: TDX: Account all non-transient page allocations for per-TD structures (git-fixes).\n- KVM: TDX: Fix x2APIC MSR handling in tdx_has_emulated_msr() (git-fixes).\n- KVM: VMX: Don't register posted interrupt wakeup handler if alloc_kvm_area() fails (git-fixes).\n- KVM: x86/hyperv: Check for NULL vCPU Hyper-V object in kvm_hv_get_tlb_flush_fifo() (git-fixes).\n- KVM: x86/hyperv: Ensure vCPU's Hyper-V object is initialized on cross-vCPU accesses (git-fixes).\n- KVM: x86/hyperv: Get target FIFO in hv_tlb_flush_enqueue(), not caller (git-fixes).\n- KVM: x86/mmu: Recover TDP MMU NX huge pages using MMU read lock (bsc#1271050).\n- KVM: x86/mmu: Rename kvm_tdp_mmu_zap_sp() to better indicate its purpose (bsc#1271050).\n- KVM: x86/mmu: Track possible NX huge pages separately for TDP vs. Shadow MMU (bsc#1271050).\n- KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page (git-fixes).\n- KVM: x86: Don't WARN if IRQ disappears because it was cleared from the PIC (git-fixes).\n- KVM: x86: Don't WARN if IRQ disappears when Xen emulation is enabled (git-fixes).\n- KVM: x86: Fix array_index_nospec() protection in kvm_vcpu_ioctl_x86_set_mce() (git-fixes).\n- KVM: x86: Fix emulated CPUID features being applied to wrong sub-leaf (git-fixes).\n- KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock (git-fixes).\n- leds: pca9532: Fix inverted GPIO output polarity (git-fixes).\n- leds: pca9532: Fix phantom device registration on missing hardware (git-fixes).\n- lib/string: fix memchr_inv() for large ranges (git-fixes).\n- lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() (git-fixes).\n- mac802154: fix data race and NULL deref on local-\u003eassoc_dev (git-fixes).\n- mac802154: fix netdev use-after-free in beacon worker (git-fixes).\n- mac802154: fix use-after-free of sdata via queued RX frames (git-fixes).\n- mailbox: pcc: Fix command timeout due to missed interrupt (git-fixes).\n- mailbox: qcom-cpucp: fix PREEMPT_RT self-deadlock in IRQ handler (git-fixes).\n- mailbox: qcom-cpucp: handle NULL data in send_data callback (git-fixes).\n- mailbox: qcom-ipcc: fix duplicate channel allocation across holes (git-fixes).\n- mailbox: rockchip: disable pclk on probe failure and unbind (git-fixes).\n- maple_tree: fix argument name in header (git-fixes).\n- md/raid1: create serial pool adding rdev to array with serialize_policy=1 (bsc#1272261).\n- media: airspy: Return queued buffers on start_streaming() failure (git-fixes).\n- media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref (git-fixes).\n- media: amphion: Remove obsolete frame_count check in venc_start_session (git-fixes).\n- media: bcm2835-unicam: Fix asc leaked in error/remove path (git-fixes).\n- media: cec-pin: Fix event FIFO ordering (git-fixes).\n- media: cec: disable delayed work before freeing an interrupted transmit (git-fixes).\n- media: cec: extron-da-hd-4k-plus: add sanity check (git-fixes).\n- media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash (git-fixes).\n- media: cec: Serialize exclusive follower delivery (git-fixes).\n- media: cec: stm32: prevent out-of-bounds write on RX overflow (git-fixes).\n- media: cedrus: clean up media device on probe failure (git-fixes).\n- media: cedrus: fix memory leak in cedrus_init_ctrls() (git-fixes).\n- media: chips-media: wave5: Guard bit depth check with initial_info_obtained (git-fixes).\n- media: chips-media: wave5: Move src_buf Removal to finish_encode (git-fixes).\n- media: cobalt: Avoid freeing ALSA private data twice (git-fixes).\n- media: cx231xx: fix devres lifetime (git-fixes).\n- media: cx231xx: reject geometry changes while the VBI queue is busy (git-fixes).\n- media: cx23885: add ioremap return check and cleanup (git-fixes).\n- media: cx23885: cancel NetUP CI work before teardown (git-fixes).\n- media: em28xx: defer audio-only extension registration (git-fixes).\n- media: em28xx: fix use-after-free of dev_next-\u003edevlist on disconnect (git-fixes).\n- media: go7007: defer the ALSA v4l2 put until card release (git-fixes).\n- media: hevc: add bounded tile-count helpers (git-fixes).\n- media: i2c: alvium: fix critical pointer access in alvium_ctrl_init (git-fixes).\n- media: i2c: alvium: Fix: Correct name of register in alvium_set_ctrl_auto_exposure (git-fixes).\n- media: i2c: imx219: Rename VTS to FRM_LENGTH (stable-fixes).\n- media: i2c: imx415: Return test pattern write errors (git-fixes).\n- media: i2c: ov02a10: fix endpoint parsing use-after-free (git-fixes).\n- media: i2c: ov7740: fix use-after-destroy in remove (git-fixes).\n- media: i2c: rdacm21: Fix missing media_entity_cleanup() (git-fixes).\n- media: imx219: Fix maximum frame length in lines (git-fixes).\n- media: intel/ipu6: fix async notifier cleanup leak on parse error (git-fixes).\n- media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for overlapping ranges (git-fixes).\n- media: ipu6: Do not free aux device pdata after init (git-fixes).\n- media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define (git-fixes).\n- media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define (git-fixes).\n- media: mc-entity: Add missing kerneldoc (git-fixes).\n- media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity (git-fixes).\n- media: meson: vdec: Fix memory leak in error path of vdec_open (git-fixes).\n- media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common (git-fixes).\n- media: msi2500: Return queued buffers on start_streaming() failure (git-fixes).\n- media: nuvoton: npcm-video: fix error handling in npcm_video_init() (git-fixes).\n- media: nuvoton: npcm-video: fix memory leaks in probe and remove (git-fixes).\n- media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe (git-fixes).\n- media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure (git-fixes).\n- media: nxp: imx8-isi: Correct color map between V4L2 and ISI (git-fixes).\n- media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path (git-fixes).\n- media: nxp: imx8-isi: Fix potential out-of-bounds issues (git-fixes).\n- media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding (git-fixes).\n- media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing (git-fixes).\n- media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks (git-fixes).\n- media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() (stable-fixes).\n- media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup (git-fixes).\n- media: platform: mtk-mdp3: Fix SCP device refcounting (git-fixes).\n- media: pwc: Drain fill_buf on start_streaming() failure (git-fixes).\n- media: pwc: Return queued buffers on start_streaming() failure (git-fixes).\n- media: qcom: camss: Fix RDI streaming for CSID GEN2 (git-fixes).\n- media: radio-si476x: Unregister v4l2_device on probe failure (git-fixes).\n- media: rc: sunxi-cir: Unregister rc device on probe failure (git-fixes).\n- media: rtl2832: fix use-after-free in rtl2832_remove() (git-fixes).\n- media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure (git-fixes).\n- media: rtl2832_sdr: Return queued buffers on start_streaming() failure (git-fixes).\n- media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak (git-fixes).\n- media: s2255: bound JPEG frame size before copying into the buffer (git-fixes).\n- media: s2255: check firmware size before reading trailing marker (git-fixes).\n- media: saa7134: Fix a possible memory leak in saa7134_video_init1 (git-fixes).\n- media: saa7164: fix cleanup on resource allocation failure (git-fixes).\n- media: stm32: dcmi: unregister notifier on probe failure (git-fixes).\n- media: sun4i-csi: Return queued buffers on start_streaming() failure (git-fixes).\n- media: tda18250: fix possible integer overflow (git-fixes).\n- media: tegra-video: vi: fix invalid u32 return value in format lookup (git-fixes).\n- media: usbtv: keep device alive while ALSA card exists (git-fixes).\n- media: v4l2-async: avoid deleting unlinked ASC entry on link error (git-fixes).\n- media: v4l2-async: Unregister sub-device if asc_list is empty (git-fixes).\n- media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() (git-fixes).\n- media: v4l2-ctrls: Allow unknown HDR10 white point and luminance (git-fixes).\n- media: v4l2-ctrls: validate AV1 tile counts (git-fixes).\n- media: v4l2-ctrls: validate HEVC tile counts (git-fixes).\n- media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link (git-fixes).\n- media: v4l2-h264: Fix memcmp() size in B1 reference list comparison (git-fixes).\n- media: v4l2-subdev: Fail {enable,disable}_streams and s_streaming nicely (git-fixes).\n- media: venus: fix payload size calculation in parse_raw_formats() (git-fixes).\n- media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() (git-fixes).\n- media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity (git-fixes).\n- media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer (git-fixes).\n- media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity (git-fixes).\n- media: vicodec: fix out-of-bounds write in FWHT encoder (git-fixes).\n- media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure (git-fixes).\n- media: vimc: fix pixel format lookup in enum_framesizes (git-fixes).\n- media: vivid: add vivid_update_reduced_fps() (git-fixes).\n- media: vivid: check for vb2_is_busy() when toggling caps (git-fixes).\n- media: vivid: fix cleanup bugs in vivid_init() (git-fixes).\n- media: zoran: Avoid freeing a registered video_device twice (git-fixes).\n- mei: pull kvfree out of spinlock (git-fixes).\n- mfd: iqs62x: Reject zero-length firmware records (git-fixes).\n- mfd: rave-sp: validate received frame payload lengths (git-fixes).\n- mfd: sm501: Fix potential memory leaks during remove (git-fixes).\n- misc: bcm-vk: Use acquire/release for msgq_inited (git-fixes).\n- misc: fastrpc: fix channel ctx ref leak when session alloc fails (git-fixes).\n- misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free (git-fixes).\n- misc: fastrpc: Remove buffer from list prior to unmap operation (git-fixes).\n- misc: fastrpc: take fl-\u003elock when moving mmaps on interrupted invoke (git-fixes).\n- misc: nsm: bound the device-reported response length (git-fixes).\n- misc: rtsx: add missing write register handling (git-fixes).\n- misc: sgi-gru: remove interrupt-context page-table walks (git-fixes).\n- misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() (git-fixes).\n- mkspec-dtb: Move DTS prefix into package list.\n- mkspec-dtb: Move provides-obsoletes to package list.\n- mkspec-dtb: Put per-architecture package lists into a hash.\n- mkspec-dtb: re-indent.\n- mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition (git-fixes).\n- mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit (git-fixes).\n- mmc: sdhci: unmap the bounce buffer before device release (git-fixes).\n- mmc: via-sdmmc: stop card-detect handling on probe failure (git-fixes).\n- mtd: afs: validate v2 image info bounds (git-fixes).\n- mtd: fix double free and WARN_ON in add_mtd_device() error paths (git-fixes).\n- mtd: mtdoops: free page bitmap when the backing MTD is removed (git-fixes).\n- mtd: mtdswap: Avoid freeing registered blktrans device twice (git-fixes).\n- mtd: mtdswap: remove debugfs stats file on teardown (git-fixes).\n- mtd: nand: mtk-ecc: stop on ECC idle timeouts (git-fixes).\n- mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() (git-fixes).\n- mtd: rawnand: validate ONFI extended parameter page sections (git-fixes).\n- mtd: spinand: fix direct mapping creation sizes (stable-fixes).\n- mtd: spinand: repeat reading in regular mode if continuous reading fails (stable-fixes).\n- mtd: spinand: try a regular dirmap if creating a dirmap for continuous reading fails (stable-fixes).\n- mtd: ubi: Release device reference on busy detach (git-fixes).\n- mtd: ubi: skip programming unused bits in ubi headers (stable-fixes).\n- net: Add options as a flexible array to struct ip_tunnel_info (bsc#1274727).\n- net: mana: Add debug knob to skip TX timeout recovery reset (git-fixes).\n- net: mana: Add handler for sriov configure (bsc#1272756).\n- net: mana: Cap MSI-X vectors to the device MSI-X table size (git-fixes).\n- net: mana: Extend RX CQE coalescing up to 8 packets (git-fixes).\n- net: mana: Fall back to scattered pages for GDMA queues (git-fixes).\n- net: mana: force full-page RX buffers via ethtool private flag (bsc#1269792).\n- net: mana: refactor mana_get_strings() and mana_get_sset_count() to use switch (bsc#1269792).\n- net: mana: Route ring-buffer access through offset-based helpers (git-fixes).\n- net: tap: set skb-\u003edev before parsing virtio net header in tap_get_user_xdp() (git-fixes bsc#1274550).\n- net: thunderbolt: Count delivered packets in rx_packets and rx_bytes (git-fixes).\n- net: thunderbolt: Mark the connection down when bringing it up fails (git-fixes).\n- net: thunderbolt: Release the Rx HopID that was handed out on mismatch (git-fixes).\n- net: thunderbolt: Tear down DMA paths before stopping the rings (git-fixes).\n- net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() (git-fixes).\n- net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow (git-fixes).\n- net: usb: ipheth: fix carrier_work UAF on disconnect (git-fixes).\n- net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition (git-fixes).\n- nfc: digital: clamp SENSF_RES length to the destination buffer (git-fixes).\n- nfc: digital: Do not dump a NULL response in command completion (git-fixes).\n- nfc: fdp: bound the device-reported read length and fix an skb leak (git-fixes).\n- nfc: llcp: avoid userspace overflow on invalid optlen (git-fixes).\n- nfc: llcp: bound SNL TLV parsing to the skb and add length checks (git-fixes).\n- nfc: llcp: bound the connect_sn TLV walk to the skb (git-fixes).\n- nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (git-fixes).\n- nfc: llcp: read llcp_sock-\u003elocal under the socket lock in getsockopt (git-fixes).\n- nfc: llcp: reject PDUs shorter than the LLCP header (git-fixes).\n- nfc: microread: validate target discovery payload lengths (git-fixes).\n- nfc: nci: fix double completion race in nci_data_exchange_complete (git-fixes).\n- nfc: nci: fix out-of-bounds write in nci_target_auto_activated() (git-fixes).\n- nfc: nci: fix uninit-value in the RF discover/activated NTF handlers (git-fixes).\n- nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing (git-fixes).\n- nfc: nci: free destination parameters when closing a connection (git-fixes).\n- nfc: pn533: hold a reference to the request skb during send_frame (git-fixes).\n- nfc: pn533: purge fragmented skbs during cleanup (git-fixes).\n- nfc: st21nfca: validate ATR_REQ length against the received frame (git-fixes).\n- nouveau/gem: reserve the bo in the info ioctl around the vma lookup (git-fixes).\n- nvme-tcp: fix usage of page_frag_cache (bsc#1267882).\n- nvmet-rdma: fix queue leak when connect backlog is exceeded (git-fixes).\n- of: fix out-of-bounds read in of_alias_scan() stem parser (git-fixes).\n- PCI/ASPM: Use pcie_capability_clear_and_set_word() for ASPM disable/restore (git-fixes).\n- PCI/proc: Avoid spurious runtime PM wakeup on config space accesses (git-fixes).\n- PCI/proc: Use file_ns_capable() when checking config space read access (git-fixes).\n- PCI/proc: Warn on writes to kernel-exclusive config space regions (git-fixes).\n- PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses (git-fixes).\n- PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] (git-fixes).\n- PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip (git-fixes).\n- PCI: j721e: Fix incorrect max_lanes for J7200 (git-fixes).\n- PCI: meson: Fix GPIO state while requesting PERST# (git-fixes).\n- PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts() (git-fixes).\n- PCI: plda: Fix use-after-free of event IRQs during teardown (git-fixes).\n- perf: Reject exited events as group leaders (git-fixes).\n- pinctrl: bcm2835: Don't remove an unregistered GPIO chip (git-fixes).\n- pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip (git-fixes).\n- pinctrl: rockchip: Reset the pin count when recalculating SoC data (git-fixes).\n- platform/chrome: cros_ec_debugfs: Clean up console log on probe failure (git-fixes).\n- platform/chrome: cros_ec_debugfs: Unregister panic notifier (git-fixes).\n- platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count (git-fixes).\n- platform/chrome: sensorhub: Bound the EC-reported sensor number (git-fixes).\n- platform/chrome: sensorhub: Fix dropped timestamp events and log spam (git-fixes).\n- platform/chrome: sensorhub: Fix memory overread in ring handler (git-fixes).\n- platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL (git-fixes).\n- platform/surface: acpi-notify: Check ACPI companion before use (git-fixes).\n- platform/x86/amd/hsmp: Reject negative power cap writes in hwmon (git-fixes).\n- platform/x86: asus-wmi: fix resource leaks on probe failure (git-fixes).\n- platform/x86: dell-privacy: Fix race condition (git-fixes).\n- platform/x86: dell-wmi-base: Fix resource leak on module load failure (git-fixes).\n- platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer (git-fixes).\n- platform/x86: dell-wmi-sysman: Fix instance ID bounds (git-fixes).\n- platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS (git-fixes).\n- platform/x86: hp-bioscfg: advance elem past consumed array elements (git-fixes).\n- platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() (git-fixes).\n- platform/x86: hp-bioscfg: fix heap OOB read on empty password write (git-fixes).\n- platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password (git-fixes).\n- platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() (git-fixes).\n- platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed (git-fixes).\n- platform/x86: hp-bioscfg: fix password encoding bounds check (git-fixes).\n- platform/x86: hp-bioscfg: warn on element type mismatch instead of failing (git-fixes).\n- platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path (git-fixes).\n- platform/x86: ISST: Add a NULL check for sst_inst (git-fixes).\n- platform/x86: ISST: Just allow 2 bits for SST feature enable (git-fixes).\n- platform/x86: ISST: Return error during profile addition (git-fixes).\n- platform/x86: ISST: Use PP level enable mask (git-fixes).\n- platform/x86: ISST: Validate level in perf mask ioctls (git-fixes).\n- platform/x86: ISST: Validate logical CPU id and clos id (git-fixes).\n- platform/x86: ISST: Validate parameter for core power state (git-fixes).\n- platform/x86: ISST: Validate parameter for frequency and priority (git-fixes).\n- platform/x86: ISST: Validate socket ID in clos_assoc ioctl (git-fixes).\n- PM: hibernate: Fix memory leak in snapshot_write_next() error path (git-fixes).\n- PM: sleep: Fix off-by-one in wakelocks number limit check (git-fixes).\n- power: supply: bd99954: Drop bad register fields (git-fixes).\n- power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address (git-fixes).\n- power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address (git-fixes).\n- power: supply: bq27xxx: bq27520g4: fix REG_TTES address (git-fixes).\n- power: supply: bq256xx: drain usb_work before freeing the charger (git-fixes).\n- power: supply: bq24257: fix use-after-free on remove (git-fixes).\n- power: supply: bq25890: Fix power_supply reference leak (git-fixes).\n- power: supply: charger-manager: register regulators before exposing sysfs (git-fixes).\n- power: supply: cros_usbpd-charger: bound the EC-reported port count (git-fixes).\n- power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS (git-fixes).\n- power: supply: isp1704_charger: cancel work on remove (git-fixes).\n- power: supply: lp8727: fix use-after-free in lp8727_release_irq() (git-fixes).\n- power: supply: lp8788-charger: fix use-after-free on remove (git-fixes).\n- power: supply: max17040: drop incorrect I2C functionality check (git-fixes).\n- power: supply: max17040: propagate register read errors (git-fixes).\n- power: supply: max17040: synchronize work cancellation on suspend (git-fixes).\n- power: supply: qcom_battmgr: terminate the strings from firmware (git-fixes).\n- power: supply: rt9455: quiesce delayed work before teardown (git-fixes).\n- power: supply: sbs-battery: Use a per-device serial number buffer (git-fixes).\n- power: supply: sc2731_charger: cancel work on remove (git-fixes).\n- power: supply: twl4030_charger: cancel workers via devm (git-fixes).\n- power: supply: ucs1002: fix use-after-free on remove (git-fixes).\n- powercap: intel_rapl_tpmi: Handle PMU registration failure during probe (git-fixes).\n- powerpc/dt_cpu_ftrs: Set CPU_FTR_P11_PVR for Power11 and later processors (bsc#1263864 ltc#217835).\n- powerpc/kexec_file: Use inclusive range checks in add_usable_mem() (git-fixes).\n- powerpc/pseries: Ensure vpa,slb_shadow \u0026 dtl are unregistered during crash (bsc#1271256).\n- powerpc/pseries: lparcfg - fix kbuf[] underflow (bsc#1274753 ltc#221289 bsc#1274754 ltc#221288 bsc#1274752\n  ltc#221290).\n- powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak (bsc#1274751 ltc#221105 bsc#1274750 ltc#221106).\n- powerpc/pseries: pci - logic bug (bsc#1274749 ltc#221282 bsc#1274755 ltc#221284 bsc#1274756 ltc#221283).\n- powerpc/rtas_pci: No hotplug on permanently removed device on pSeries (git-fixes).\n- powerpc: Replace __ASSEMBLY__ with __ASSEMBLER__ in non-uapi headers (bsc#1263864 ltc#217835).\n- powerpc: Replace __ASSEMBLY__ with __ASSEMBLER__ in uapi headers (bsc#1263864 ltc#217835).\n- ppdev: prevent overflow when setting port timeout (git-fixes).\n- rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() (git-fixes).\n- rapidio: clear mport-\u003enet when rio_add_net() fails (git-fixes).\n- rapidio: mport_cdev: fix use-after-free in dma_req_free() (git-fixes).\n- RDMA/bnxt_re: Avoid displaying the kernel pointer (git-fixes).\n- RDMA/bnxt_re: Proper rollback if the ioremap fails (git-fixes).\n- RDMA/irdma: Remove redundant legacy_mode checks (git-fixes).\n- RDMA/mana_ib: drain QP references after partial table insertion (git-fixes).\n- RDMA/mana_ib: unify QP lookup table (git-fixes).\n- RDMA/mlx5: Fix integer overflow of user QP buffer size (git-fixes).\n- regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer (git-fixes).\n- regulator: core: use system_freezable_wq for init complete work (git-fixes).\n- regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata (git-fixes).\n- regulator: qcom-refgen: correct the regulator type to CURRENT (git-fixes).\n- regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling (git-fixes).\n- remoteproc: qcom: Fix glink-\u003enode reference leak in qcom_add_glink_subdev (git-fixes).\n- remoteproc: qcom_q6v5_adsp: Fix reference leak for device node (git-fixes).\n- remoteproc: scp: Fix device reference leak on failed lookup (git-fixes).\n- Revert \"drm/amdgpu: fix aperture mapping leak\" (git-fixes).\n- Revert \"media: v4l2-dev: fix error handling in __video_register_device()\" (git-fixes).\n- Revert \"net: thunderbolt: Enable end-to-end flow control also in transmit\" (git-fixes).\n- Revert \"thermal/drivers/hwmon: Cleanup coding style a bit\" (stable-fixes).\n- Revert \"wifi: mt76: Disable napi when removing device\" (git-fixes).\n- rpmsg: core: Fix incorrect return value documentation (git-fixes).\n- rpmsg: glink: smem: order FIFO read after availability check (git-fixes).\n- rtc: gamecube: check return value of devm_rtc_register_device() (git-fixes).\n- rtc: pcf8563: fix clock provider leak on unbind (git-fixes).\n- rtc: pcf85363: Add error checking to regmap calls in probe() (git-fixes).\n- rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers (git-fixes).\n- rtc: rzn1: Fix weekday underflow when alarm crosses month boundary (git-fixes).\n- rtc: zynqmp: Return optional clock lookup errors (git-fixes).\n- s390/pkey: Check length in pkey_pckmo handler implementation (bsc#1270266).\n- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (bsc#1270267).\n- sched/psi: Create the psimon kthread outside of cgroup_mutex (bsc#1269134).\n- scsi: fnic: Abort timed-out NVMe LS requests (bsc#1236344).\n- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (bsc#1236344).\n- scsi: fnic: Add FDLS role handling for NVMe initiators (bsc#1236344).\n- scsi: fnic: Add the NVMe/FC transport path (bsc#1236344).\n- scsi: fnic: Advertise NVMe initiator service parameters (bsc#1236344).\n- scsi: fnic: Bump up version number (bsc#1236344).\n- scsi: fnic: Decode firmware role configuration (bsc#1236344).\n- scsi: fnic: Do not use GFP_ZERO for mempools (bsc#1236344).\n- scsi: fnic: Expose NVMe transport state in debugfs (bsc#1236344).\n- scsi: fnic: Handle NVMe LS frames in FDLS (bsc#1236344).\n- scsi: fnic: Make debug logging protocol independent (bsc#1236344).\n- scsi: fnic: Make fnic_queuecommand() easier to analyze (bsc#1236344).\n- scsi: fnic: Refactor in_remove flag and call to fnic_fcpio_reset() (bsc#1236344).\n- scsi: fnic: Remove a useless struct mempool forward declaration (bsc#1236344).\n- scsi: fnic: Rename fnic_scsi_fcpio_reset() (bsc#1236344).\n- scsi: fnic: Route completions and resets by initiator role (bsc#1236344).\n- scsi: fnic: Self-assignment of intr_time_type has no effect (bsc#1236344).\n- scsi: fnic: Send NVMe LS requests through FDLS (bsc#1236344).\n- scsi: fnic: Switch to use %ptSp (bsc#1236344).\n- scsi: fnic: Track NVMe transport statistics (bsc#1236344).\n- scsi: fnic: Use fnic_num for non-SCSI identifiers (bsc#1236344).\n- scsi: fnic: Use mempool for receive frames (bsc#1236344).\n- scsi: qla2xxx: Add support to report MPI FW state (bsc#1275737).\n- scsi: qla2xxx: Declare qla2xxx_mqueuecommand() static (bsc#1275737).\n- scsi: qla2xxx: Use nr_cpu_ids instead of NR_CPUS for qp_cpu_map allocation (bsc#1275737).\n- scsi: storvsc: Support manual scans for all Hyper-V targets (git-fixes).\n- sctp: avoid auth_enable sysctl UAF during netns teardown (git-fixes).\n- selftests/alsa: Fix the step check for INTEGER controls (git-fixes).\n- serial: 8250_dma: Clear stale RX state on shutdown (git-fixes).\n- serial: amba-pl011: unprepare console clock on unregister (git-fixes).\n- serial: core: clear freed pointers on uart_register_driver() failure (git-fixes).\n- serial: imx: serialize imx_uart_ports lifetime (git-fixes).\n- serial: ma35d1: Fix OF node reference leaks in console init (git-fixes).\n- serial: qcom-geni: do not advance stale DMA completions (git-fixes).\n- serial: qcom-geni: fix TX DMA buffer flush (git-fixes).\n- serial: sc16is7xx: enable THRI before filling TX FIFO (git-fixes).\n- serial: sc16is7xx: rename EFR mutex with generic name (stable-fixes).\n- serial: sc16is7xx: use guards for simple mutex locks (stable-fixes).\n- slab.h: disable completely broken overflow handling in flex allocations (bsc#1280139).\n- slab: Introduce kmalloc_flex() and family (bsc#1280139).\n- slab: Introduce kmalloc_obj() and family (bsc#1280139).\n- slab: recognize @GFP parameter as optional in kernel-doc (bsc#1280139).\n- smb/client: handle overlapping allocated ranges in fallocate (bsc#1274902).\n- smb: client: harden POSIX SID length parsing (bsc#1273557).\n- smb: client: require net admin for CIFS SWN netlink (bsc#1273966).\n- smb: client: resolve SWN tcon from live registrations (bsc#1273872).\n- soc: fsl: qe: check platform_driver_register() in qe_ic_of_init() (git-fixes).\n- soc: qcom: rpmh-rsc: manage PM notifiers with devres (git-fixes).\n- soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() (git-fixes).\n- software node: Fix software_node_get_reference_args() with index -1 (git-fixes).\n- soundwire: qcom: Fix port exhaustion check in stream_alloc_ports (git-fixes).\n- speakup: keyhelp: guard letter_offsets possible out-of-range indexing (git-fixes).\n- spi: bcm63xx-hsspi: disable clocks on resume failure (git-fixes).\n- spi: bcm63xx: disable clock on resume failure (git-fixes).\n- spi: bcmbca-hsspi: disable clocks on resume failure (git-fixes).\n- spi: davinci: switch to managed controller allocation (git-fixes).\n- spi: Fix DMA mapping ownership on partial map failure (git-fixes).\n- spi: img-spfi: don't disable runtime PM on DMA deferred probe (git-fixes).\n- spi: oc-tiny: switch to managed controller allocation (git-fixes).\n- spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX (git-fixes).\n- spi: spi-cadence: Move TX FIFO full busy-wait into FIFO (git-fixes).\n- spi: spi-cadence: supports transmission with bits_per_word of 16 and 32 (stable-fixes).\n- spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers (stable-fixes).\n- spi: sprd-adi: Fix probe succeeding without registering the controller (git-fixes).\n- staging: fbtft: Use sysfs_emit_at() to print to sysfs file (git-fixes).\n- staging: media: tegra-video: fix of_node_put() on VIP parse errors (git-fixes).\n- staging: media: tegra-video: vi: fix probe failure on skipped last port (git-fixes).\n- staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown (git-fixes).\n- staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() (git-fixes).\n- staging: rtl8723bs: fix missing shared-key auth challenge length check (git-fixes).\n- staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() (git-fixes).\n- staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() (git-fixes).\n- staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() (git-fixes).\n- staging: rtl8723bs: fix OOB read in WMM_param_handler() (git-fixes).\n- staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() (git-fixes).\n- staging: rtl8723bs: use kfree_sensitive() for key material (git-fixes).\n- staging: rtl8723bs: validate monitor transmit frame lengths (git-fixes).\n- staging: sm750fb: Add missing Kconfig dependency (git-fixes).\n- staging: sm750fb: gate dualview dataflow using g_dualview (git-fixes).\n- thermal/drivers/imx: Disable clock on runtime resume failure (git-fixes).\n- thermal/drivers/qoriq: Disable clock on resume failure (git-fixes).\n- thermal/drivers/rcar: Fix error checking in probe() (git-fixes).\n- thermal: intel: int3400: clean up ODVP on probe failures (git-fixes).\n- thermal: sysfs: switch to use scnprintf() to suppress truncation warning (git-fixes).\n- thunderbolt: Bound the DROM dual link port number before indexing sw-\u003eports (git-fixes).\n- thunderbolt: Fix bandwidth group reservation indexing (git-fixes).\n- thunderbolt: icm: Preserve USB4 proxy data-valid bit (git-fixes).\n- tlclk: if sscanf() fails, fall back to 0, not random value (git-fixes).\n- tpm: st33zp24: Return zero on status read failure (git-fixes).\n- tpm: st33zp24: Validate locality read result (git-fixes).\n- tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout (git-fixes).\n- tty: clear cdev pointer after cdev_add() failure (git-fixes).\n- tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 (git-fixes).\n- tty: skip cdev_del() when no cdev is registered (git-fixes).\n- uio: Fix stale info pointer in failed registration path (git-fixes).\n- usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() (git-fixes).\n- usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect (git-fixes).\n- usb: atm: usbatm: fix invalid ci_range initialization (git-fixes).\n- USB: c67x00: fix use-after-free in c67x00_add_iso_urb() (git-fixes).\n- usb: cdnsp: fix incorrect endian conversions for APB timeout register (git-fixes).\n- usb: core: Add lock to usb_wakeup_notification() (git-fixes).\n- usb: core: Add lock to usb_wakeup_notification() (stable-fixes).\n- usb: core: Strengthen error handling in hub_hub_status() (git-fixes).\n- usb: core: Strengthen error handling in hub_hub_status() (stable-fixes).\n- usb: core: sysfs: add lock to bos_descriptors_read() (stable-fixes).\n- usb: dwc2: add missing @remotewakeup kernel-doc parameter (git-fixes).\n- usb: dwc2: gadget: Exit partial power down state when changing USB pull-up (git-fixes).\n- usb: dwc3: clear forceRM when issuing EndTransfer (git-fixes).\n- usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition (git-fixes).\n- usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns() (git-fixes).\n- usb: fix UAF when probe runs concurrent to dyn ID removal (git-fixes).\n- usb: gadget: aspeed_udc: check endpoint DMA allocation (git-fixes).\n- usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed (git-fixes).\n- usb: gadget: configfs: fix out-of-bounds read of qw_sign (git-fixes).\n- usb: gadget: f_fs: Fix fence cleanup in ffs_dmabuf_transfer() error paths (git-fixes).\n- usb: gadget: f_fs: Prevent deadlock during ep0 read loop (git-fixes).\n- usb: gadget: f_midi: initialize work in f_midi_alloc() (git-fixes).\n- usb: gadget: f_ncm: Use unsigned int for ndp_index (git-fixes).\n- usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() (git-fixes).\n- usb: gadget: f_uac1_legacy: remove broken string configfs attributes (git-fixes).\n- usb: gadget: fix null pointer dereference in usb_put_function_instance() (git-fixes).\n- USB: gadget: fsl-udc: fix dev_printk() device (git-fixes).\n- usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs (git-fixes).\n- usb: gadget: midi2: remove default configfs groups on teardown (git-fixes).\n- usb: gadget: pch_udc: remove excess kernel-doc member for registered (git-fixes).\n- usb: gadget: r8a66597: avoid double free of ep0_req in probe error path (git-fixes).\n- usb: gadget: snps_udc_plat: clean up PHY on probe deferral (git-fixes).\n- usb: gadget: u_audio: Fix use-after-free on sound card disconnect (git-fixes).\n- usb: gadget: uac: validate rate list length before storing (git-fixes).\n- USB: gadget: Use str_enable_disable-like helpers (stable-fixes).\n- usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() (git-fixes).\n- usb: ljca: bound bank_num in ljca_enumerate_gpio() (git-fixes).\n- usb: mtu3: allow system suspend during active gadget connection (git-fixes).\n- usb: musb: omap2430: clean up probe error handling (stable-fixes).\n- usb: musb: omap2430: Do not put borrowed of_node in probe (git-fixes).\n- usb: musb: omap2430: Fix use-after-free in omap2430_probe() (git-fixes).\n- USB: phy: fsl-usb: fix missing static keywords (git-fixes).\n- usb: renesas_usbhs: Fix power-off ordering on unbind (git-fixes).\n- USB: serial: digi_acceleport: fix port registration order (git-fixes).\n- USB: serial: ftdi_sio: add support for E+H FXA291 (stable-fixes).\n- USB: serial: option: add TDTECH MT5710-CN (stable-fixes).\n- USB: serial: option: fix slab OOB read in interrupt URB callback (git-fixes).\n- USB: serial: spcp8x5: drop broken carrier detect support (git-fixes).\n- USB: storage: add NO_ATA_1X quirk for Longmai USB Key (stable-fixes).\n- usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop (git-fixes).\n- usb: typec: qcom-pmic-typec: drain cc_debounce_dwork if port_start() fails (git-fixes).\n- usb: typec: qcom-pmic: cancel reset_work on stop (git-fixes).\n- usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive() (git-fixes).\n- usb: typec: thunderbolt: Disable work before freeing tbt on remove (git-fixes).\n- usb: typec: ucsi: displayport: Fix OOB altmode array index (git-fixes).\n- usb: typec: ucsi: unregister debugfs entries on teardown (git-fixes).\n- usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion (git-fixes).\n- usb: usbfs: fix use-after-free of usb_device in usbdev_release() (git-fixes).\n- usb: usbtest: disable dynamic ID support (stable-fixes).\n- usb: xhci: Handle USB3 port events when there is one roothub (git-fixes).\n- vfs: Add a sysctl for automated deletion of dentry (bsc#1240890 bsc#1276586).\n- vt: add permission check for KDSKBMETA ioctl (stable-fixes).\n- vt: stabilize tty reference in kbd_keycode with tty_port_tty_get (stable-fixes).\n- w1: ds28e17: reject an oversize length on an I2C block read (git-fixes).\n- w1: ds2482: Fix signedness bug in ds2482_w1_triplet() (git-fixes).\n- watchdog: bd96801_wdt: Fix timeout for enabled WDG (git-fixes).\n- watchdog: fix hrtimer start when pretimeout is zero (git-fixes).\n- watchdog: msc313e: Avoid division by zero (git-fixes).\n- watchdog: msc313e: Enable clock before accessing hardware registers (git-fixes).\n- watchdog: msc313e: Fix clock leak and spurious timer in settimeout() (git-fixes).\n- watchdog: msc313e: Fix NULL pointer dereference in PM callbacks (git-fixes).\n- watchdog: msc313e: Fix spurious reset on suspend (git-fixes).\n- watchdog: msc313e: Fix undefined behavior (git-fixes).\n- watchdog: msc313e: Sync timeout value if WDT was running at boot (git-fixes).\n- watchdog: sunxi_wdt: preserve boot-enabled watchdog (git-fixes).\n- wifi: ath6kl: avoid buffer overreads in WMI event handlers (git-fixes).\n- wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets (git-fixes).\n- wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump (git-fixes).\n- wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() (git-fixes).\n- wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate (git-fixes).\n- wifi: ath11k: Correctly copy the hint BSSID in WMI scan request (git-fixes).\n- wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event() (git-fixes).\n- wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx() (git-fixes).\n- wifi: ath12k: Correctly copy the hint BSSID in WMI scan request (git-fixes).\n- wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() (git-fixes).\n- wifi: brcmfmac: fix P2P action frame handling without device vif (git-fixes).\n- wifi: brcmfmac: initialize SDIO data work before cleanup (git-fixes).\n- wifi: cfg80211: bound element ID read when checking non-inheritance (git-fixes).\n- wifi: cfg80211: cancel sched scan results work on unregister (git-fixes).\n- wifi: cfg80211: derive S1G beacon TSF from S1G fields (git-fixes).\n- wifi: cfg80211: reject unsupported PMSR FTM location requests (git-fixes).\n- wifi: cfg80211: validate PMSR FTM preamble range (git-fixes).\n- wifi: cfg80211: validate PMSR measurement type data (git-fixes).\n- wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() (git-fixes).\n- wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs (git-fixes).\n- wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments (git-fixes).\n- wifi: iwlwifi: mei: check SAP message length before reading it (git-fixes).\n- wifi: iwlwifi: mei: pass correct argument to function (git-fixes).\n- wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser (git-fixes).\n- wifi: libertas: fix memory leak in helper_firmware_cb() (git-fixes).\n- wifi: mac80211: disconnect on CSA to channel 0 (git-fixes).\n- wifi: mac80211: fix fils_discovery double free on alloc failure (git-fixes).\n- wifi: mac80211: fix per-STA profile length in cross-link CSA parsing (git-fixes).\n- wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure (git-fixes).\n- wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock (git-fixes).\n- wifi: mac80211: send TWT teardown to peer after setup TX failure (git-fixes).\n- wifi: mac80211: skip default WMM setup for AP_VLAN links (git-fixes).\n- wifi: mac80211: skip unused probe response countdown offsets (git-fixes).\n- wifi: mt76: check txfree done event on the WED hw path (git-fixes).\n- wifi: mt76: fix 4th chain ACK RSSI bitmask in sta_poll (git-fixes).\n- wifi: mt76: fix ER-SU 106-tone RU check in RX rate decode (git-fixes).\n- wifi: mt76: fix HE DCM max-RU capability encoding (git-fixes).\n- wifi: mt76: fix non-AQL packet accounting for MLO stations (git-fixes).\n- wifi: mt76: fix stranded frames in mt76_txq_schedule_pending (git-fixes).\n- wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length (git-fixes).\n- wifi: mt76: mt792x: Fix memory leak in SDIO TX path (git-fixes).\n- wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete (git-fixes).\n- wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex (git-fixes).\n- wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss (git-fixes).\n- wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear (git-fixes).\n- wifi: mt76: mt7915: fix double hif2 init on the non-WED path (git-fixes).\n- wifi: mt76: mt7915: fix ext PHY use-after-free on register error path (git-fixes).\n- wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986 (git-fixes).\n- wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie (git-fixes).\n- wifi: mt76: mt7915: release hif2 reference on probe IRQ failure (git-fixes).\n- wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement (git-fixes).\n- wifi: mt76: mt7915: unwind state on add_interface failure (git-fixes).\n- wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields (git-fixes).\n- wifi: mt76: mt7915: write RX header translation bit to the correct register (git-fixes).\n- wifi: mt76: mt7921: skip unknown CLC firmware records (git-fixes).\n- wifi: mt76: mt7921: validate CLC firmware records (git-fixes).\n- wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb (git-fixes).\n- wifi: mt76: mt7925: fix msg len mismatch between driver and firmware (git-fixes).\n- wifi: mt76: mt7925: update clc before setting sar power table (git-fixes).\n- wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config (git-fixes).\n- wifi: mt76: mt7996: don't report a zero TX bitrate (git-fixes).\n- wifi: mt76: mt7996: fix capability of EHT-MCS 15 in MRU (git-fixes).\n- wifi: mt76: mt7996: fix reg addr remap when addr is 0 (git-fixes).\n- wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV (git-fixes).\n- wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset (git-fixes).\n- wifi: mt76: mt7996: validate RX band_idx before dereferencing phys (git-fixes).\n- wifi: mt76: only consume the WO drop bit on WED v2 devices (git-fixes).\n- wifi: mt76: report data NSS for STBC frames in RX rate decode (git-fixes).\n- wifi: mwifiex: Detach sync cmd buffer on interrupted wait (git-fixes).\n- wifi: nl80211: free RNR data on MBSSID mismatch (git-fixes).\n- wifi: nl80211: validate nested MBSSID IE blobs (git-fixes).\n- wifi: p54: validate RX frame length in p54_rx_eeprom_readback() (git-fixes).\n- wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop (git-fixes).\n- wifi: rtl818x: initialize eeprom_93cx6 struct to zero (git-fixes).\n- wifi: rtlwifi: pci: fix error path in rtl_pci_probe() (git-fixes).\n- wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids (git-fixes).\n- wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars() (git-fixes).\n- wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() (git-fixes).\n- wifi: rtw88: pci: fix resource leak on failed NAPI setup (git-fixes).\n- wifi: rtw89: fix HE extended capability length check (git-fixes).\n- wifi: zd1211rw: reject secondary interfaces to prevent conflicts (git-fixes).\n- x86/virt/tdx: Print TDX module version during init (git-fixes).\n- x86/virt/tdx: Retrieve TDX module version (git-fixes).\n- xhci: dbgtty: Fix unregister on tty_alloc_driver() failure (git-fixes).\n- xhci: dbgtty: Fix unregister on tty_register_driver() failure (git-fixes).\n- xhci: fix lost bounce buffers on TDs spanning several ring segments (git-fixes).\n","status":"published","published":"2026-09-22T13:18:52Z","modified":"2026-09-30T18:23:11.183114716Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23887-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).\n- CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).\n- CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).\n- CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).\n- CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).\n- CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).\n- CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).\n- CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).\n- CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).\n- CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).\n- CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).\n- CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).\n- CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).\n- CVE-2026-43239: smb: client: prevent races in -\u003equery_interfaces() (bsc#1264444).\n- CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).\n- CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).\n- CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).\n- CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).\n- CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).\n- CVE-2026-43416: powerpc, perf: Check that current-\u003emm is alive before getting user callchain (bsc#1265121).\n- CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).\n- CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).\n- CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).\n- CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).\n- CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).\n- CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).\n- CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).\n- CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).\n- CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).\n- CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).\n- CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).\n- CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).\n- CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).\n- CVE-2026-52912: netfilter: nf_queue: hold bridge skb-\u003edev while queued (bsc#1269000).\n- CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).\n- CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).\n- CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).\n- CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).\n- CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).\n- CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).\n- CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).\n- CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).\n- CVE-2026-52991: sched/psi: fix race between file release and pressure write (bsc#1269134).\n- CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).\n- CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).\n- CVE-2026-53031: bpf: Validate node_id in arena_alloc_pages() (bsc#1269380).\n- CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).\n- CVE-2026-53034: bpf, sockmap: Fix af_unix null-ptr-deref in proto update (bsc#1269140).\n- CVE-2026-53048: gfs2: prevent NULL pointer dereference during unmount (bsc#1269162).\n- CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).\n- CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).\n- CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).\n- CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).\n- CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).\n- CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).\n- CVE-2026-53092: bpf: Fix linked reg delta tracking when src_reg == dst_reg (bsc#1269528).\n- CVE-2026-53094: bpf: Fix stale offload-\u003eprog pointer after constant blinding (bsc#1269965).\n- CVE-2026-53096: bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path (bsc#1269969).\n- CVE-2026-53109: powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy (bsc#1269417).\n- CVE-2026-53110: s390: always declare expoline thunks (bsc#1269985).\n- CVE-2026-53111: bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap (bsc#1269167).\n- CVE-2026-53114: perf: Extend the bit width of the arch-specific flag (bsc#1269999).\n- CVE-2026-53126: blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() (bsc#1269635).\n- CVE-2026-53129: fs/mbcache: cancel shrink work before destroying the cache (bsc#1269633).\n- CVE-2026-53142: drm/xe/display: fix oops in suspend/shutdown without display (bsc#1269402).\n- CVE-2026-53154: mm/hugetlb: restore reservation on error in hugetlb folio copy paths (bsc#1269665).\n- CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (bsc#1269306).\n- CVE-2026-53180: timers/migration: Fix livelock in tmigr_handle_remote_up() (bsc#1269888).\n- CVE-2026-53207: mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison (bsc#1269590).\n- CVE-2026-53219: netfilter: x_tables: avoid leaking percpu counter pointers (bsc#1269686).\n- CVE-2026-53220: netfilter: revalidate bridge ports (bsc#1269381).\n- CVE-2026-53223: net: guard timestamp cmsgs to real error queue skbs (bsc#1269301).\n- CVE-2026-53228: ipv6: sit: reload inner IPv6 header after GSO offloads (bsc#1269256).\n- CVE-2026-53238: netlabel: validate unlabeled address and mask attribute lengths (bsc#1269774).\n- CVE-2026-53264: net/sched: act_api: use RCU with deferred freeing for action lifecycle (bsc#1269238).\n- CVE-2026-53269: netfilter: synproxy: add mutex to guard hook reference counting (bsc#1269579).\n- CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).\n- CVE-2026-53291: ALSA: hda/conexant: Fix missing error check for jack detection (bsc#1269697).\n- CVE-2026-53309: ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison (bsc#1269815).\n- CVE-2026-53330: drm/amd/display: Fix out-of-bounds read in (bsc#1270090).\n- CVE-2026-53336: nvmem: layouts: onie-tlv: fix hang on unknown types (bsc#1270108).\n- CVE-2026-53337: net: bonding: fix NULL pointer dereference in bond_do_ioctl() (bsc#1270251).\n- CVE-2026-53341: fhandle: fix UAF due to unlocked -\u003emnt_ns read in may_decode_fh() (bsc#1270139).\n- CVE-2026-53353: hsr: Remove WARN_ONCE() in hsr_addr_is_self() (bsc#1270111).\n- CVE-2026-53365: vsock/virtio: fix zerocopy completion for multi-skb sends (bsc#1271365).\n- CVE-2026-63801: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (bsc#1272230).\n- CVE-2026-63803: hdlc_ppp: sync per-proto timers before freeing hdlc state (bsc#1272284).\n- CVE-2026-63804: gfs2: fix use-after-free in gfs2_qd_dealloc (bsc#1272287).\n- CVE-2026-63808: exfat: fix potential use-after-free in exfat_find_dir_entry() (bsc#1272260).\n- CVE-2026-63810: block: Avoid mounting the bdev pseudo-filesystem in userspace (bsc#1272297).\n- CVE-2026-63823: keys: Pin request_key_auth payload in instantiate paths (bsc#1272182).\n- CVE-2026-63828: apparmor: mediate the implicit connect of TCP fast open sendmsg (bsc#1272175).\n- CVE-2026-63860: RDMA/core: Prefer NLA_NUL_STRING (bsc#1272429).\n- CVE-2026-63865: bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks (bsc#1272486).\n- CVE-2026-63868: net: garp: fix unsigned integer underflow in garp_pdu_parse_attr (bsc#1272497).\n- CVE-2026-63879: drm/amdgpu: fix amdgpu_hmm_range_get_pages (bsc#1272569).\n- CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272385).\n- CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272390).\n- CVE-2026-63889: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (bsc#1272423).\n- CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).\n- CVE-2026-63891: thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() (bsc#1272641).\n- CVE-2026-63901: USB: serial: digi_acceleport: fix memory corruption with small endpoints (bsc#1272501).\n- CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1272904).\n- CVE-2026-63918: l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (bsc#1272905).\n- CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1272877).\n- CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1272918).\n- CVE-2026-63922,CVE-2026-63924: ipv6: exthdrs: refresh nh after handling HAO option (bsc#1272855).\n- CVE-2026-63925: macsec: fix replay protection at XPN lower-PN wrap (bsc#1273008).\n- CVE-2026-63926: bpf: sockmap: fix tail fragment offset in bpf_msg_push_data (bsc#1273019).\n- CVE-2026-63941: KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor (bsc#1272869).\n- CVE-2026-63969: ipv6: fix possible infinite loop in rt6_fill_node() (bsc#1272484).\n- CVE-2026-63970: vsock/virtio: bind uarg before filling zerocopy skb (bsc#1272673).\n- CVE-2026-63984: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (bsc#1272865).\n- CVE-2026-63985: ethtool: eeprom: add more safeties to EEPROM Netlink fallback (bsc#1272963).\n- CVE-2026-63986: ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on prepare failure (bsc#1272969).\n- CVE-2026-63987: ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES (bsc#1272971).\n- CVE-2026-63990: bonding: refuse to enslave CAN devices (bsc#1273027).\n- CVE-2026-63992: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (bsc#1272868).\n- CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847).\n- CVE-2026-63995: ethtool: cmis: validate start_cmd_payload_size from module (bsc#1273033).\n- CVE-2026-63996: ethtool: cmis: require exact CDB reply length (bsc#1273032).\n- CVE-2026-63997: ethtool: module: avoid leaking a netdev ref on module flash errors (bsc#1273036).\n- CVE-2026-63998: ethtool: module: call ethnl_ops_complete() on module flash errors (bsc#1273037).\n- CVE-2026-63999: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure (bsc#1273038).\n- CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273030).\n- CVE-2026-64002: ipv4: free net-\u003eipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (bsc#1273774).\n- CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782).\n- CVE-2026-64004: net/iucv: fix locking in .getsockopt (bsc#1273804).\n- CVE-2026-64005: net/smc: Do not re-initialize smc hashtables (bsc#1273831).\n- CVE-2026-64006: netfilter: nf_tables: fix dst corruption in same register operation (bsc#1273834).\n- CVE-2026-64007: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (bsc#1273105).\n- CVE-2026-64017: blk-mq: pop cached request if it is usable (bsc#1273770).\n- CVE-2026-64024: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (bsc#1273107).\n- CVE-2026-64033: RDMA/rtrs: Fix use-after-free in path file creation cleanup (bsc#1273134).\n- CVE-2026-64047: net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (bsc#1273060).\n- CVE-2026-64048: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (bsc#1273484).\n- CVE-2026-64052: block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user() (bsc#1272983).\n- CVE-2026-64053: block: don't overwrite bip_vcnt in bio_integrity_copy_user() (bsc#1272985).\n- CVE-2026-64054: net: shaper: reject duplicate leaves in GROUP request (bsc#1272894).\n- CVE-2026-64055: net: ethernet: cortina: Carry over frag counter (bsc#1272893).\n- CVE-2026-64056: net: ethernet: cortina: Make RX SKB per-port (bsc#1272502).\n- CVE-2026-64071: nvme-pci: fix use-after-free in nvme_free_host_mem() (bsc#1273486).\n- CVE-2026-64073: irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT (bsc#1273490).\n- CVE-2026-64088: batman-adv: tt: fix negative tt_buff_len (bsc#1273463).\n- CVE-2026-64089: batman-adv: tt: fix negative last_changeset_len (bsc#1272513).\n- CVE-2026-64093: batman-adv: tp_meter: directly shut down timer on cleanup (bsc#1273461).\n- CVE-2026-64099: drm/v3d: Fix use-after-free of CPU job query arrays on error path (bsc#1273465).\n- CVE-2026-64102: RDMA/siw: Reject MPA FPDU length underflow before signed receive math (bsc#1272516).\n- CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759).\n- CVE-2026-64109: af_unix: Fix UAF read of tail-\u003elen in unix_stream_data_wait() (bsc#1273748).\n- CVE-2026-64111: lsm: hold cred_guard_mutex for lsm_set_self_attr() (bsc#1273740).\n- CVE-2026-64112: rbd: eliminate a race in lock_dwork draining on unmap (bsc#1273741).\n- CVE-2026-64113: ixgbevf: fix use-after-free in VEPA multicast source pruning (bsc#1272262).\n- CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl \u003c 5 (bsc#1273742).\n- CVE-2026-64115: vsock/vmci: fix UAF when peer resets connection during handshake (bsc#1273745).\n- CVE-2026-64118: qed: fix double free in qed_cxt_tables_alloc() (bsc#1273749).\n- CVE-2026-64119: l2tp: use list_del_rcu in l2tp_session_unhash (bsc#1273746).\n- CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273743).\n- CVE-2026-64125: net: bcmgenet: keep RBUF EEE/PM disabled (bsc#1272346).\n- CVE-2026-64131: mm/memory: fix spurious warning when unmapping device-private/exclusive pages (bsc#1274063).\n- CVE-2026-64146: erofs: fix metabuf leak in inode xattr initialization (bsc#1273681).\n- CVE-2026-64147: pds_core: fix debugfs_lookup dentry leak and error handling (bsc#1273119).\n- CVE-2026-64148: pds_core: fix error handling in pdsc_devcmd_wait (bsc#1273956).\n- CVE-2026-64162: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (bsc#1272366).\n- CVE-2026-64164: btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() (bsc#1273957).\n- CVE-2026-64177: phonet/pep: disable BH around forwarded sk_receive_skb() (bsc#1272148).\n- CVE-2026-64179: net: wwan: iosm: fix potential memory leaks in ipc_imem_init() (bsc#1272149).\n- CVE-2026-64180: mm/memory_hotplug: fix memory block reference leak on remove (bsc#1273679).\n- CVE-2026-64184: mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() (bsc#1272199).\n- CVE-2026-64185: sysfs: don't remove existing directory on update failure (bsc#1272200).\n- CVE-2026-64190: net: team: fix NULL pointer dereference in team_xmit during mode change (bsc#1272210).\n- CVE-2026-64192: bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized (bsc#1272213).\n- CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899).\n- CVE-2026-64214: powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise()\n  (bsc#1272799).\n- CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272798).\n- CVE-2026-64222: octeontx2-pf: avoid double free of pool-\u003estack on AQ init failure (bsc#1272788).\n- CVE-2026-64224: octeontx2-pf: fix double free in rvu_rep_rsrc_init() (bsc#1272804).\n- CVE-2026-64225: octeontx2-af: CGX: add bounds check to cgx_speed_mbps index (bsc#1272786).\n- CVE-2026-64232: block: recompute nr_integrity_segments in blk_insert_cloned_request (bsc#1272791).\n- CVE-2026-64239: mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() (bsc#1273898).\n- CVE-2026-64244: drivers/base/memory: set mem-\u003ealtmap after successful device registration (bsc#1273812).\n- CVE-2026-64253: kernel/fork: clear PF_BLOCK_TS in copy_process() (bsc#1273904).\n- CVE-2026-64256: xfs: don't wrap around quota ids in dqiterate (bsc#1273271).\n- CVE-2026-64265: fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (bsc#1273947).\n- CVE-2026-64268: RDMA/siw: bound Read Response placement to the RREAD length (bsc#1273276).\n- CVE-2026-64269: RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg (bsc#1273280).\n- CVE-2026-64283: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values (bsc#1273870).\n- CVE-2026-64286: KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU (bsc#1274058).\n- CVE-2026-64287: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (bsc#1273325).\n- CVE-2026-64294: mm: do file ownership checks with the proper mount idmap (bsc#1273525).\n- CVE-2026-64296: exfat: bound uniname advance in exfat_find_dir_entry() (bsc#1273975).\n- CVE-2026-64298: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (bsc#1273550).\n- CVE-2026-64300: perf/aux: Fix page UAF in map_range() (bsc#1273852).\n- CVE-2026-64307: crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG) (bsc#1273567).\n- CVE-2026-64315: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1274028).\n- CVE-2026-64316: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1273598).\n- CVE-2026-64317: isofs: bound Rock Ridge symlink components to the SL record (bsc#1273936).\n- CVE-2026-64319: nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339).\n- CVE-2026-64320: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420).\n- CVE-2026-64321: nvme: target: rdma: fix ndev refcount leak on queue connect (bsc#1273864).\n- CVE-2026-64322: udf: validate sparing table length as an entry count, not a byte count (bsc#1273958).\n- CVE-2026-64323: udf: validate VAT header length against the VAT inode size (bsc#1273305).\n- CVE-2026-64326: block: skip sync_blockdev() on surprise removal in bdev_mark_dead() (bsc#1273312).\n- CVE-2026-64327: usb: gadget: f_fs: Initialize epfile-\u003ein early to fix endpoint direction checks (bsc#1273283).\n- CVE-2026-64354: bpf: Validate BTF repeated field counts before expansion (bsc#1274060).\n- CVE-2026-64355: bpf: Reject fragmented frames in devmap (bsc#1273422).\n- CVE-2026-64364: HID: multitouch: fix out-of-bounds bit access on mt_io_flags (bsc#1273495).\n- CVE-2026-64368: mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (bsc#1273997).\n- CVE-2026-64373: cpufreq: Fix hotplug-suspend race during reboot (bsc#1273776).\n- CVE-2026-64375: proc: protect ptrace_may_access() with exec_update_lock (FD links) (bsc#1273868).\n- CVE-2026-64378: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (bsc#1273603).\n- CVE-2026-64381: smb: client: Fix next buffer leak in receive_encrypted_standard() (bsc#1273860).\n- CVE-2026-64382: smb: client: fix double-free in SMB2_open() replay (bsc#1273291).\n- CVE-2026-64383: smb: client: fix double-free in SMB2_flush() replay (bsc#1273426).\n- CVE-2026-64384: smb: client: fix change notify replay double-free (bsc#1274541).\n- CVE-2026-64385: smb: client: fix double-free in SMB2_ioctl() replay (bsc#1274539).\n- CVE-2026-64386: smb: client: fix query_info() replay double-free (bsc#1274543).\n- CVE-2026-64387: smb: client: fix query directory replay double-free (bsc#1274545).\n- CVE-2026-64411: netfilter: ebtables: terminate table name before find_table_lock() (bsc#1274077).\n- CVE-2026-64412: netfilter: ebtables: module names must be null-terminated (bsc#1273780).\n- CVE-2026-64415: mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent softlockup (bsc#1273317).\n- CVE-2026-64416: mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless host (bsc#1273286).\n- CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction (bsc#1274274).\n- CVE-2026-64434: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref (bsc#1273880).\n- CVE-2026-64436: net: af_key: initialize alg_key_len for IPComp states (bsc#1274277).\n- CVE-2026-64450: tipc: fix out-of-bounds read in broadcast Gap ACK blocks (bsc#1273523).\n- CVE-2026-64452: 6lowpan: fix NHC entry use-after-free on error path (bsc#1273460).\n- CVE-2026-64458: mm/damon/ops-common: handle extreme intervals in damon_hot_score() (bsc#1273788).\n- CVE-2026-64463: usb: typec: tcpci_rt1711h: unregister TCPCI port with devres (bsc#1273273).\n- CVE-2026-64472: vfio/mlx5: Fix racy bitfields and tighten struct layout (bsc#1274075).\n- CVE-2026-64477: x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled (bsc#1274264).\n- CVE-2026-64507: bpf: Support for hardening against JIT spraying (bsc#1273999).\n- CVE-2026-64518: tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key() (bsc#1273524).\n- CVE-2026-64519: NFSD: Fix infinite loop in layout state revocation (bsc#1274252).\n- CVE-2026-64526: ethtool: tsconfig: fix missing ethnl_ops_complete() (bsc#1274052).\n- CVE-2026-64534: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error (bsc#1273803).\n- CVE-2026-64535: nvmet-tcp: Fix potential UAF when ddgst mismatch (bsc#1273809).\n- CVE-2026-64537: bridge: cfm: reject invalid CCM interval at configuration time (bsc#1273289).\n- CVE-2026-64538: ipv6: Fix null-ptr-deref in fib6_nh_mtu_change() (bsc#1273335).\n- CVE-2026-64541: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (bsc#1273303).\n- CVE-2026-64542: ipv6: ndisc: fix NULL deref in accept_untracked_na() (bsc#1273309).\n- CVE-2026-64543: tipc: fix use-after-free of the discoverer in tipc_disc_rcv() (bsc#1273311).\n- CVE-2026-64545: net, bpf: check master for NULL in xdp_master_redirect() (bsc#1273318).\n- CVE-2026-64548: bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() (bsc#1273337).\n- CVE-2026-64551: sctp: validate STALE_COOKIE cause length before reading staleness (bsc#1273813).\n- CVE-2026-64552: virtio-net: fix len check in receive_big() (bsc#1273323).\n- CVE-2026-64553: net: psample: fix info leak in PSAMPLE_ATTR_DATA (bsc#1273336).\n- CVE-2026-64554: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() (bsc#1273340).\n- CVE-2026-64555: KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops() (bsc#1273331).\n- CVE-2026-64556: perf/core: Detach event groups during remove_on_exec (bsc#1273251).\n- CVE-2026-64563: rhashtable: clear stale iter-\u003ep on table restart (bsc#1273995).\n- CVE-2026-64567: btrfs: reject free space cache with more entries than pages (bsc#1274006).\n- CVE-2026-64569: mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n (bsc#1274009).\n- CVE-2026-64572: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (bsc#1274014).\n- CVE-2026-64576: nexthop: initialize extack in nh_res_bucket_migrate() (bsc#1274030).\n- CVE-2026-64577: gtp: check skb_pull_data() return in gtp1u_send_echo_resp() (bsc#1274031).\n- CVE-2026-64579: xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert (bsc#1274036).\n- CVE-2026-64581: xfrm: fix sk_dst_cache double-free in xfrm_user_policy() (bsc#1274041).\n- CVE-2026-64582: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (bsc#1274040).\n- CVE-2026-64586: wifi: brcmfmac: drain bus_reset work on device removal (bsc#1274492).\n- CVE-2026-68082: libceph: fix two unsafe bare decodes in decode_lockers() (bsc#1274581).\n- CVE-2026-68086: mm/khugepaged: write all dirty file folios when collapsing (bsc#1274713).\n- CVE-2026-68096: audit: fix recursive locking deadlock in audit_dupe_exe() (bsc#1274730).\n- CVE-2026-68105: drm/amdgpu: Fix kernel panic during driver load failure (bsc#1274849).\n- CVE-2026-68116: vxlan: mdb: Fix source list corruption on a failed replace (bsc#1274876).\n- CVE-2026-68117: tipc: clear sock-\u003esk on the failed-insert path in tipc_sk_create() (bsc#1274881).\n- CVE-2026-68120: rtase: Workaround for TX hang caused by hardware packet parsing (bsc#1274887).\n- CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1274888).\n- CVE-2026-68123: openvswitch: fix GSO userspace truncation underflow (bsc#1275169).\n- CVE-2026-68124: mctp: serial: handle zero-length frames to prevent rx buffer overflow (bsc#1275192).\n- CVE-2026-68127: ila: reload IPv6 header after pskb_may_pull in checksum adjust (bsc#1275237).\n- CVE-2026-68128: ice: reject out-of-range ptype in ice_parser_profile_init (bsc#1275238).\n- CVE-2026-68129: gve: fix Rx queue stall on alloc failure (bsc#1275517).\n- CVE-2026-68132: super: fix emergency thaw deadlock on frozen block devices (bsc#1275553).\n- CVE-2026-68133: ice: fix PTP Call Trace during PTP release (bsc#1275555).\n- CVE-2026-68135: net: hip04: fix RX buffer leak on build_skb failure (bsc#1275557).\n- CVE-2026-68136: net: gro: fix double aggregation of flush-marked skbs (bsc#1275474).\n- CVE-2026-68138: net/sched: serialize qdisc_rtab_list against concurrent get/put (bsc#1274941).\n- CVE-2026-68139: net/mlx5e: Use sender devcom for MPV master-up (bsc#1275578).\n- CVE-2026-68141: net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() (bsc#1275094).\n- CVE-2026-68142: geneve: require CAP_NET_ADMIN in the device netns for changelink (bsc#1275582).\n- CVE-2026-68143: net: slip: serialize receive against buffer reallocation (bsc#1275583).\n- CVE-2026-68144: phonet: pep: fix use-after-free in pep_get_sb() (bsc#1275481).\n- CVE-2026-68145: iomap: fix out-of-bounds bitmap_set() with zero-length range (bsc#1275584).\n- CVE-2026-68148: fscrypt: Add missing superblock check in find_or_insert_direct_key() (bsc#1275588).\n- CVE-2026-68149: fs: preserve ACL_DONT_CACHE state in forget_cached_acl() (bsc#1275294).\n- CVE-2026-68152: amt: fix use-after-free in AMT delayed works (bsc#1275300).\n- CVE-2026-68153: libceph: remove debugfs files before client teardown (bsc#1275301).\n- CVE-2026-68154: libceph: reject zero bucket types in crush_decode (bsc#1275303).\n- CVE-2026-68155: libceph: Reject monmaps advertising zero monitors (bsc#1275304).\n- CVE-2026-68156: libceph: refresh auth-\u003eauthorizer_buf{,_len} after authorizer update (bsc#1275305).\n- CVE-2026-68157: libceph: guard missing CRUSH type name lookup (bsc#1275306).\n- CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1275307).\n- CVE-2026-68159: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (bsc#1275470).\n- CVE-2026-68161: sctp: close UDP tunnel sockets during netns teardown (bsc#1274892).\n- CVE-2026-68164: mm/damon/core: disallow overlapping input ranges for damon_set_regions() (bsc#1274955).\n- CVE-2026-68165: mm/damon/core: validate ranges in damon_set_regions() (bsc#1274927).\n- CVE-2026-68166: userfaultfd: prevent registration of special VMAs (bsc#1274930).\n- CVE-2026-68169: mptcp: pm: userspace: fix use-after-free in get_local_id (bsc#1274952).\n- CVE-2026-68183: firmware: stratix10-svc: fix memory leaks and list corruption bugs (bsc#1274957).\n- CVE-2026-68198: wifi: ath6kl: fix use-after-free in aggr_reset_state() (bsc#1274803).\n- CVE-2026-68205: media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() (bsc#1274934).\n- CVE-2026-68238: drm/amdgpu: Release VFCT ACPI table reference (bsc#1275704).\n- CVE-2026-68258: drm/amdkfd: Check bounds on CRIU restore queue type and mqd size (bsc#1275866).\n- CVE-2026-68267: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (bsc#1275139).\n- CVE-2026-68273: drm/amdgpu: Fix context pstate override handling (bsc#1275129).\n- CVE-2026-68284: bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() (bsc#1275970).\n- CVE-2026-68286: drop_monitor: perform u64_stats updates under IRQ-disabled section (bsc#1275973).\n- CVE-2026-68288: net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD (bsc#1275975).\n- CVE-2026-68289: tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() (bsc#1275976).\n- CVE-2026-68293: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (bsc#1275091).\n- CVE-2026-68294: net: qrtr: restrict socket creation to the initial network namespace (bsc#1275092).\n- CVE-2026-68296: net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM (bsc#1275045).\n- CVE-2026-68297: tipc: fix u16 MTU truncation in media and bearer MTU validation (bsc#1275040).\n- CVE-2026-68299: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (bsc#1275088).\n- CVE-2026-68300: sctp: auth: verify auth requirement when auth_chunk is NULL (bsc#1275083).\n- CVE-2026-68302: amt: re-read skb header pointers after every pull (bsc#1275081).\n- CVE-2026-68313: tipc: fix infinite loop in __tipc_nl_compat_dumpit (bsc#1274665).\n- CVE-2026-68315: sctp: validate stream count in sctp_process_strreset_inreq() (bsc#1274662).\n- CVE-2026-68319: pds_core: fix deadlock between reset thread and remove (bsc#1274657).\n- CVE-2026-68320: sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid (bsc#1274659).\n- CVE-2026-68321: net: txgbe: fix FDIR filter leak on remove (bsc#1274652).\n- CVE-2026-68322: rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled (bsc#1274656).\n- CVE-2026-68325: iommu/amd: Bound the early ACPI HID map (bsc#1274651).\n- CVE-2026-68328: nfp: Check resource mutex allocation (bsc#1274646).\n- CVE-2026-68329: iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() (bsc#1274645).\n- CVE-2026-68331: dpaa2-eth: put MAC endpoint device on disconnect (bsc#1274642).\n- CVE-2026-68333: dpaa2-switch: put MAC endpoint device on disconnect (bsc#1274644).\n- CVE-2026-68335: rds: drop incoming messages that cross network namespace boundaries (bsc#1274640).\n- CVE-2026-68336: bonding: fix devconf_all NULL dereference when IPv6 is disabled (bsc#1274639).\n- CVE-2026-68338: net/packet: avoid fanout hook re-registration after unregister (bsc#1274637).\n- CVE-2026-68375: bnxt_en: Handle partially initialized auxiliary devices (bsc#1274835).\n- CVE-2026-68377: net/sched: act_tunnel_key: Defer dst_release to RCU callback (bsc#1274831).\n- CVE-2026-68386: bpf, sockmap: Reject unhashed UDP sockets on sockmap update (bsc#1274814).\n- CVE-2026-68393: Bluetooth: hci_sync: extend conn_hash lookup critical sections (bsc#1274904).\n- CVE-2026-68395: ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered (bsc#1274900).\n- CVE-2026-68397: net/iucv: take a reference on the socket found in afiucv_hs_rcv() (bsc#1274898).\n- CVE-2026-68398: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF (bsc#1274908).\n- CVE-2026-68399: bpf: Fix UAF in sock clone early bailouts (bsc#1274897).\n- CVE-2026-68408: wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (bsc#1274709).\n- CVE-2026-68417: RDMA/siw: publish QP after initialization (bsc#1274696).\n- CVE-2026-68418: RDMA/irdma: Prevent user-triggered null deref on QP create (bsc#1274690).\n- CVE-2026-68419: RDMA/irdma: Prevent rereg_mr for non-mem regions (bsc#1274698).\n- CVE-2026-68422: btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() (bsc#1274706).\n- CVE-2026-68425: IB/mad: Drop unmatched RMPP responses before reassembly (bsc#1274700).\n- CVE-2026-68426: xfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment (bsc#1274705).\n- CVE-2026-68432: vxlan: require CAP_NET_ADMIN in the device netns for changelink (bsc#1274800).\n- CVE-2026-68433: libceph: bound get_version reply decode to front len (bsc#1274801).\n- CVE-2026-68442: btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps (bsc#1274773).\n- CVE-2026-68448: ovl: check access to copy_file_range source with src mounter creds (bsc#1274838).\n- CVE-2026-68450: btrfs: free mapping node on duplicate reloc root insert (bsc#1274834).\n- CVE-2026-68470: wifi: mac80211: validate extension-frame layout before RX (bsc#1276500).\n- CVE-2026-68480: x86/bugs: Make Safe-RET robust against interrupt injection (bsc#1274208).\n- CVE-2026-72017: net: macb: drop in-flight Tx SKBs on close (bsc#1276840).\n- CVE-2026-72019: macsec: don't read an unset MAC header in macsec_encrypt() (bsc#1276865).\n- CVE-2026-72020: ipvs: reset full ip_vs_seq structs in ip_vs_conn_new (bsc#1275506).\n- CVE-2026-72022: llc: fix SAP refcount leak in llc_ui_autobind() (bsc#1276785).\n- CVE-2026-72023: octeontx2-pf: fix SQB pointer leak on init failure (bsc#1276793).\n- CVE-2026-72032: net/mlx5: HWS, fix matcher leak on resize target setup failure (bsc#1276955).\n- CVE-2026-72034: fhandle: reject detached mounts in capable_wrt_mount() (bsc#1276957).\n- CVE-2026-72035: net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1276961).\n- CVE-2026-72036: net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1277034).\n- CVE-2026-72045: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (bsc#1277078).\n- CVE-2026-72046: gve: fix header buffer corruption with header-split and HW-GRO (bsc#1275519).\n- CVE-2026-72051: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276801).\n- CVE-2026-72052: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276803).\n- CVE-2026-72053: net: ipip: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276814).\n- CVE-2026-72054: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276818).\n- CVE-2026-72055: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276821).\n- CVE-2026-72061: net: sit: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277249).\n- CVE-2026-72069: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (bsc#1275528).\n- CVE-2026-72072: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (bsc#1277155).\n- CVE-2026-72083: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (bsc#1275535).\n- CVE-2026-72084: scsi: target: core: Generate correct identifiers for PR OUT transport IDs (bsc#1275540).\n- CVE-2026-72100: dm-integrity: fix a bug if the bio is out of limits (bsc#1277311).\n- CVE-2026-72101: dm-integrity: fix leaking uninitialized kernel memory (bsc#1276831).\n- CVE-2026-72103: dm: avoid leaking the caller's thread keyring via the table device file (bsc#1277315).\n- CVE-2026-72106: dm-ioctl: fix a possible overflow in list_version_get_info (bsc#1277321).\n- CVE-2026-72107: dm era: fix out-of-bounds memory access for non-zero start sector (bsc#1277349).\n- CVE-2026-72108: dm thin metadata: fix metadata snapshot consistency on commit failure (bsc#1277350).\n- CVE-2026-72132: NFS: Charge unstable writes by request size, not folio size (bsc#1277551).\n- CVE-2026-72136: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277574).\n- CVE-2026-72137: xfrm: nat_keepalive: avoid double free on send error (bsc#1275587).\n- CVE-2026-72161: ocfs2: add journal NULL check in ocfs2_checkpoint_inode() (bsc#1277233).\n- CVE-2026-72163: ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits (bsc#1277231).\n- CVE-2026-72164: ocfs2: avoid moving extents to occupied clusters (bsc#1277553).\n- CVE-2026-72176: mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error (bsc#1277230).\n- CVE-2026-72177: mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs() (bsc#1277227).\n- CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1275655).\n- CVE-2026-72221: sunrpc: wait for in-flight TLS handshake callback when cancel loses race (bsc#1275665).\n- CVE-2026-72222: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (bsc#1275669).\n- CVE-2026-72234: batman-adv: access unicast_ttvn skb-\u003edata only after skb realloc (bsc#1275672).\n- CVE-2026-72242: selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (bsc#1277655).\n- CVE-2026-72243: selinux: check connect-related permissions on TCP Fast Open (bsc#1277656).\n- CVE-2026-72251: netfilter: nf_nat_sip: reload possible stale data pointer (bsc#1275827).\n- CVE-2026-72254: netfilter: nft_fib: reject fib expression on the netdev egress hook (bsc#1277204).\n- CVE-2026-72280: KVM: arm64: nv: Drop bogus WARN for write to ZCR_EL2 (bsc#1277726).\n- CVE-2026-72282: KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers (bsc#1277728).\n- CVE-2026-72288: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (bsc#1275886).\n- CVE-2026-72289: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (bsc#1275905).\n- CVE-2026-72296: net: ife: require ETH_HLEN to be pullable in ife_decode() (bsc#1275923).\n- CVE-2026-72297: net: atm: reject out-of-range traffic classes in QoS validation (bsc#1277738).\n- CVE-2026-72306: vduse: Requeue failed read to send_list head (bsc#1277748).\n- CVE-2026-72307: mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() (bsc#1277160).\n- CVE-2026-72308: mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() (bsc#1277159).\n- CVE-2026-72317: SUNRPC: pin upper rpc_clnt across the TLS connect_worker (bsc#1275925).\n- CVE-2026-72323: ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (bsc#1275985).\n- CVE-2026-72325: perf/x86/amd/core: Avoid enabling BRS from the SVM reload path (bsc#1277761).\n- CVE-2026-72330: net/tls: Consume empty data records in tls_sw_read_sock() (bsc#1277764).\n- CVE-2026-72337: Bluetooth: 6lowpan: avoid untracked enable work (bsc#1277773).\n- CVE-2026-72339: qede: fix off-by-one in BD ring consumption on build_skb failure (bsc#1276006).\n- CVE-2026-72341: net/mlx5e: Fix publication race for priv-\u003echannel_stats[] (bsc#1277660).\n- CVE-2026-72342: net/mlx5e: Fix HV VHCA stats agent registration race (bsc#1277775).\n- CVE-2026-72343: net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation (bsc#1277776).\n- CVE-2026-72345: net/mlx5: LAG, Fix off-by-one in single-FDB error rollback (bsc#1277782).\n- CVE-2026-72347: netfilter: xt_connmark: reject invalid shift parameters (bsc#1277783).\n- CVE-2026-72350: netfilter: xt_u32: reject invalid shift counts (bsc#1277822).\n- CVE-2026-72366: netfs: Fix netfs_create_write_req() to handle async cache object creation (bsc#1276333).\n- CVE-2026-72379: fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid (bsc#1277818).\n- CVE-2026-72389: bridge: stp: Fix a potential use-after-free when deleting a bridge (bsc#1273869).\n- CVE-2026-72398: sctp: add INIT verification after cookie unpacking (bsc#1276381).\n- CVE-2026-72399: net: enetc: check the number of BDs needed for xdp_frame (bsc#1276553).\n- CVE-2026-72414: net: dsa: sja1105: round up PTP perout pin duration (bsc#1278039).\n- CVE-2026-72421: ipv4: fib: Don't ignore error route in local/main tables (bsc#1277023).\n- CVE-2026-72425: ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (bsc#1277120).\n- CVE-2026-72430: net/sched: act_ct: fix nf_connlabels leak on two error paths (bsc#1277118).\n- CVE-2026-72437: md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry (bsc#1277874).\n- CVE-2026-72438: md/raid10: fix writes_pending and barrier reference leaks on discard failures (bsc#1277115).\n- CVE-2026-72439: md/raid10: fix writes_pending leak on write request failures (bsc#1277876).\n- CVE-2026-72440: md/raid1: fix writes_pending and barrier reference leaks on write failures (bsc#1277114).\n- CVE-2026-72448: octeontx2-pf: Fix leak of SQ timestamp buffer on teardown (bsc#1277108).\n- CVE-2026-72450: xfrm: validate selector family and prefixlen during match (bsc#1278113).\n- CVE-2026-72459: apparmor: aa_label_alloc use aa_label_free on alloc failure (bsc#1277092).\n- CVE-2026-72460: apparmor: check label build before no_new_privs test (bsc#1277229).\n- CVE-2026-72464: xprtrdma: Post receive buffers after RPC completion (bsc#1277069).\n- CVE-2026-72466: xprtrdma: Fix bcall rep leak and unbounded peek (bsc#1277057).\n- CVE-2026-72467: xprtrdma: Check frwr_wp_create() during connect (bsc#1277059).\n- CVE-2026-72468: xprtrdma: Initialize re_id before removal registration (bsc#1277062).\n- CVE-2026-72469: xprtrdma: Fix ep kref imbalance on ADDR_CHANGE (bsc#1277047).\n- CVE-2026-72473: xprtrdma: Avoid 250 ms delay on backlog wakeup (bsc#1277037).\n- CVE-2026-72485: coresight: platform: defer connection counter increment until alloc succeeds (bsc#1276771).\n- CVE-2026-72487: PCI: Introduce named defines for PCI ROM (bsc#1276767).\n- CVE-2026-72488: soundwire: fix bug in sdw_add_element_group_count found by syzkaller (bsc#1276766).\n- CVE-2026-72494: RDMA/irdma: Replace waitqueue and flag with completion (bsc#1276941).\n- CVE-2026-72495: RDMA/bnxt_re: Avoid repeated requests to allocate WC pages (bsc#1276937).\n- CVE-2026-72497: RDMA/bnxt_re: Add a max slot check for SQ (bsc#1276913).\n- CVE-2026-72499: RDMA/bnxt_re: Free CQ toggle page after firmware teardown (bsc#1276551).\n- CVE-2026-72500: RDMA/bnxt_re: Free SRQ toggle page after firmware teardown (bsc#1276552).\n- CVE-2026-72501: RDMA/bnxt_re: Initialize dpi variable to zero (bsc#1276546).\n- CVE-2026-72502: tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) (bsc#1276542).\n- CVE-2026-74255: tipc: fix UAF in tipc_l2_send_msg() (bsc#1276547).\n- CVE-2026-74261: ALSA: seq: avoid stale FIFO cells during resize (bsc#1276528).\n- CVE-2026-74269: bnxt: fix head underflow on XDP head-grow (bsc#1276507).\n- CVE-2026-74270: handshake: Require admin permission for DONE command (bsc#1276512).\n- CVE-2026-74282: tipc: prevent snt_unacked underflow on CONN_ACK (bsc#1276473).\n- CVE-2026-74284: net/sched: sch_hfsc: Don't make class passive twice (bsc#1276468).\n- CVE-2026-74286: net: pfcp: allocate per-cpu tstats for PFCP netdevs (bsc#1276471).\n- CVE-2026-74296: RDMA/mlx5: Release the HW-provided UAR index rather than the SW one (bsc#1276452).\n- CVE-2026-74297: RDMA/mlx5: Fix undefined shift of user RQ WQE size (bsc#1276446).\n- CVE-2026-74307: ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT (bsc#1276905).\n- CVE-2026-74308: ext4: fix kernel BUG in ext4_write_inline_data_end (bsc#1276880).\n- CVE-2026-74313: vduse: hold vduse_lock across IDR lookup in open path (bsc#1276876).\n- CVE-2026-74316: NFSD: Handle layout stid in nfsd4_drop_revoked_stid() (bsc#1276870).\n- CVE-2026-74317: ixgbe: do not configure xps for XDP queues (bsc#1276866).\n- CVE-2026-74318: btrfs: fix deadlock cloning inline extent when using flushoncommit (bsc#1276864).\n- CVE-2026-74321: btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() (bsc#1277202).\n- CVE-2026-74334: RDMA/nldev: Fix locking when accessing mr-\u003epd (bsc#1277095).\n- CVE-2026-74345: RDMA/siw: Fix endpoint/socket association handling (bsc#1277285).\n- CVE-2026-74346: RDMA/irdma: Fix OOB read during CQ MR registration (bsc#1278155).\n- CVE-2026-74349: ocfs2: reject FITRIM ranges shorter than a cluster (bsc#1278180).\n- CVE-2026-74363: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs (bsc#1278070).\n- CVE-2026-74375: md: replace wait loop with wait_event() in md_handle_request() (bsc#1277649).\n- CVE-2026-74377: RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path (bsc#1278236).\n- CVE-2026-74378: RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe (bsc#1278233).\n- CVE-2026-74382: net/sched: cls_bpf: prevent unbounded recursion in offload rollback (bsc#1278240).\n- CVE-2026-74388: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data (bsc#1278253).\n- CVE-2026-74390: RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs (bsc#1278088).\n- CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277408).\n- CVE-2026-74395: RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference (bsc#1277077).\n- CVE-2026-74397: IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier (bsc#1278098).\n- CVE-2026-74406: vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive() (bsc#1276395).\n- CVE-2026-74464: net: openvswitch: fix skb leak on flow key update failure during ct (bsc#1277070).\n- CVE-2026-74474: vxlan: use pskb_network_may_pull() for transmit path header pulls (bsc#1276335).\n- CVE-2026-74475: vxlan: unclone skb head before modifying eth header in route_shortcircuit() (bsc#1276339).\n- CVE-2026-74476: veth: convert frag_list skbs before running XDP (bsc#1276341).\n- CVE-2026-74479: net: pktgen: fix proc entry use-after-free (bsc#1276354).\n- CVE-2026-74481: mm/page_reporting: use system_freezable_wq to fix UAF during suspend (bsc#1276355).\n- CVE-2026-74482: mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios (bsc#1276346).\n- CVE-2026-74495: igbvf: Fix leak in TX DMA error cleanup (bsc#1275864).\n- CVE-2026-74496: fou: Fix use-after-free in fou_create() (bsc#1275867).\n- CVE-2026-74510: Bluetooth: mgmt: fix UAF in pair command cancellation (bsc#1275950).\n- CVE-2026-74512: audit: fix potential use-after-free in audit_del_rule() (bsc#1275954).\n- CVE-2026-74513: dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister (bsc#1275956).\n- CVE-2026-74517: KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs (bsc#1276258).\n- CVE-2026-74518: mm/hugetlb: fix list corruption in allocate_file_region_entries() (bsc#1275798).\n- CVE-2026-74523: qede: sync udp_tunnel ports outside qede_lock in the recovery path (bsc#1275802).\n- CVE-2026-74527: octeontx2-af: Block VFs from clobbering special CGX PKIND state (bsc#1275805).\n- CVE-2026-74533: Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero (bsc#1275804).\n- CVE-2026-74534: Bluetooth: ISO: Fix data-race on iso_pi(sk) in socket and HCI event paths (bsc#1275801).\n- CVE-2026-74535: Bluetooth: ISO: avoid deadlocks in iso_sock_timeout (bsc#1275812).\n- CVE-2026-74536: Bluetooth: ISO: fix leaking sk after socket release (bsc#1275799).\n- CVE-2026-74537: Bluetooth: ISO: hold sk properly in iso_conn_ready (bsc#1275687).\n- CVE-2026-74545: rtase: fix double free of multi-frag skb on DMA map failure (bsc#1275679).\n- CVE-2026-74548: forcedeth: fix UAF of txrx_stats in nv_remove (bsc#1275695).\n- CVE-2026-74550: net: do not send ICMP/NDISC Redirects when peer allocation fails (bsc#1275688).\n- CVE-2026-74555: scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race (bsc#1275690).\n- CVE-2026-74556: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (bsc#1275696).\n- CVE-2026-74557: scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer (bsc#1275685).\n- CVE-2026-74563: rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() (bsc#1275574).\n- CVE-2026-74566: keys: make keyring key-chunk byte order agree with keyring_diff_objects() (bsc#1275566).\n- CVE-2026-74567: keys: fix out-of-bounds read in keyring_get_key_chunk() (bsc#1275569).\n- CVE-2026-74571: btrfs: skip global block reserve accounting for rescue mounts (bsc#1275561).\n- CVE-2026-74577: net: mpls: initialize rtm_tos in mpls_getroute() (bsc#1275572).\n- CVE-2026-74581: net: ipv6: clear suppressed fib6 rule result (bsc#1275782).\n- CVE-2026-74582: packet: use consistent hard_header_len in non-ring send paths (bsc#1275784).\n- CVE-2026-74584: RDMA/bnxt_re: zero shared page before exposing to userspace (bsc#1277066).\n- CVE-2026-74598: ipv6: fix Route Information option length validation (bsc#1277918).\n- CVE-2026-74610: tls: don't leave a full plaintext sk_msg ring unpushed (bsc#1277054).\n- CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277505).\n- CVE-2026-74615: vxlan: do not arm the ageing timer on a device that is down (bsc#1277901).\n- CVE-2026-74616: xdp: reject clones that overrun skb_shared_info tailroom (bsc#1277813).\n- CVE-2026-74622: net: atlantic: free RX pages of consumed but not refilled buffers (bsc#1277862).\n- CVE-2026-74644: mm/damon/ops-common: putback folios on invalid migrate nid (bsc#1277033).\n- CVE-2026-74665: net: fix skb length accounting after generic XDP frag adjustment (bsc#1277407).\n- CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277391).\n- CVE-2026-74695: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() (bsc#1276931).\n- CVE-2026-74705: udp: fix potential use-after-free in tunnel segmentation (bsc#1276922).\n- CVE-2026-74712: vdpa/mlx5: Fix buffer length in create_direct_keys() (bsc#1276577).\n- CVE-2026-74717: net/mlx5: fw_tracer, return NULL on create error (bsc#1276569).\n- CVE-2026-74719: net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()\n  (bsc#1276572).\n- CVE-2026-74722: btrfs: fix memory leak in btrfs_do_encoded_write() (bsc#1276561).\n- CVE-2026-74723: btrfs: lzo: reject inline extents without valid headers (bsc#1276562).\n- CVE-2026-74730: NFS: Pin the 'struct nfs_server' during a FREE_STATEID call (bsc#1276566).\n- CVE-2026-74737: net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG (bsc#1277898).\n- CVE-2026-74743: macvlan: inherit needed_headroom and needed_tailroom from lowerdev (bsc#1277908).\n- CVE-2026-74744: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (bsc#1278094).\n- CVE-2026-80529: xfs: don't swallow dquot recovery verification errors (bsc#1277688).\n- CVE-2026-80530: xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (bsc#1277668).\n- CVE-2026-80531: xfs: avoid UAF on sc-\u003etempip in xrep_tempfile_create (bsc#1277680).\n- CVE-2026-80533: xfs: don't walk off the end of a null sc-\u003esa.agi_bp in AGI repair (bsc#1277636).\n- CVE-2026-80534: xfs: fix ilock leak on error in xfs_dq_get_next_id (bsc#1277022).\n- CVE-2026-80535: xfs: don't double-lock when deleting a self-referential directory (bsc#1277641).\n- CVE-2026-80557: libceph: fix OOB read in decode_watchers() via missing bounds check (bsc#1277268).\n- CVE-2026-80558: libceph: Avoid using invalid osd indices from primary_temp (bsc#1277485).\n- CVE-2026-80561: libceph: fix multiple unsafe decodes in decode_locker() (bsc#1277265).\n- CVE-2026-80586: mptcp: options: reset DSS fields in case of unexpected size (bsc#1277328).\n- CVE-2026-80589: block: stop the timeout timer when releasing a never added disk (bsc#1277335).\n- CVE-2026-80590: inet: frags: strip GSO state from fragments before reassembly (bsc#1277275).\n- CVE-2026-80603: netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read (bsc#1278293).\n- CVE-2026-80609: qede: fix out-of-bounds check for cqe-\u003elen_list (bsc#1278334).\n- CVE-2026-80629: octeontx2-af: npc: Fix size of entry2cntr_map (bsc#1277308).\n- CVE-2026-80646: ipv6: guard against possible NULL deref in __in6_dev_stats_get() (bsc#1277513).\n- CVE-2026-80647: RDMA/hns: Fix warning in poll cq direct mode (bsc#1278331).\n- CVE-2026-80667: net/mlx5: LAG, MPESW, Fix missing complete() on devcom error (bsc#1278324).\n- CVE-2026-80681: vxlan: re-fetch eth header after route_shortcircuit() (bsc#1278416).\n- CVE-2026-80693: idpf: bound interrupt-vector register fill to the allocated array (bsc#1278395).\n- CVE-2026-80714: ipvs: do not propagate one-packet flag to synced conns (bsc#1277561).\n- CVE-2026-80721: Bluetooth: ISO: ensure no dangling hcon references in iso_conn (bsc#1277845).\n- CVE-2026-80727: x86/mce: Set up the polling timer before CMCI discovery (bsc#1278703).\n- CVE-2026-80731: net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (bsc#1278716).\n- CVE-2026-80737: serial: amba-pl011: synchronize DMA teardown (bsc#1279487).\n- CVE-2026-80739: net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock (bsc#1278733).\n- CVE-2026-80805: xfs: validate attr entry pointer before field access (bsc#1279580).\n- CVE-2026-80813: nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist() (bsc#1279537).\n- CVE-2026-80838: vxlan: keep the last remote linked during FDB flush (bsc#1279842).\n\nThe following non security issues were fixed:\n\n- accel/ivpu: Limit firmware log name prints to field size (git-fixes).\n- accel/ivpu: Validate firmware log buffer metadata (git-fixes).\n- accel/ivpu: Validate full buffer range in ivpu_to_cpu_addr (git-fixes).\n- accel/qaic: Address potential out-of-bounds read in resp_worker() (git-fixes).\n- accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() (git-fixes).\n- accessibility: speakup: unregister tty ldisc on later init failures (git-fixes).\n- ACPI: APEI: Fix ERST timeout unit conversion (git-fixes).\n- ACPI: battery: Adjust charging status validation check (git-fixes).\n- ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer (git-fixes).\n- ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root (git-fixes).\n- ACPI: pfr_update: fix stack buffer overflow in query_capability() (git-fixes).\n- ACPI: processor: idle: Expand _LPI package sanity checks (git-fixes).\n- ACPI: processor: validate MADT IOAPIC entry bounds (git-fixes).\n- ACPI: processor_idle: Mark LPI enter functions as __cpuidle (git-fixes).\n- ACPI: scan: fix bus ID cleanup on device_add() failures (git-fixes).\n- ACPI: video: Release PCI device reference after lookup (git-fixes).\n- ALSA: 6fire: bound the MIDI event length from the device (git-fixes).\n- ALSA: 6fire: Fix UAF at error handling during probe (stable-fixes).\n- ALSA: bcd2000: clear the URB pointers on disconnect (git-fixes).\n- ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev (git-fixes).\n- ALSA: caiaq: Fix potential double-free at error path (git-fixes).\n- ALSA: control: Don't add invalid kcontrols to LED layer (git-fixes).\n- ALSA: core: Fix use-after-free in snd_card_do_free() (git-fixes).\n- ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough (git-fixes).\n- ALSA: dummy: Check card index validity at probe (stable-fixes).\n- ALSA: dummy: Report a change when one capture switch channel moves (git-fixes).\n- ALSA: harmony: initialize locks before requesting IRQ (git-fixes).\n- ALSA: hda/ext: preserve PPLCCTL bits when clearing reset (git-fixes).\n- ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP r (stable-fixes).\n- ALSA: hda: Fix connection list comparison in proc output (git-fixes).\n- ALSA: hda: Report a change when only the channel status bytes move (git-fixes).\n- ALSA: hda: restore MFG widget enumeration after core split (git-fixes).\n- ALSA: hpi: Check transport errors during HPI6000 adapter initialization (git-fixes).\n- ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF (git-fixes).\n- ALSA: pcxhr: initialize mutexes before requesting threaded IRQ (git-fixes).\n- ALSA: rawmidi: Return the error from snd_rawmidi_input_params() (git-fixes).\n- ALSA: scarlett2: Use a private URB for the notification endpoint (git-fixes).\n- ALSA: seq: Don't leak the extension cell pointer in the bounce payload (git-fixes).\n- ALSA: seq: midi: Optimize event_input locking with RCU (git-fixes).\n- ALSA: seq: midi: Serialize input teardown with event_input (git-fixes).\n- ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion (git-fixes).\n- ALSA: usb-audio: Complete cleanup after system-resume errors (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() (git-fixes).\n- ALSA: usb-audio: fix OOB write on Type II inbound URBs (git-fixes).\n- ALSA: usb: Fix UAF at delayed release of MIDI2 EPs (git-fixes).\n- ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf (git-fixes).\n- ALSA: usbusx2y: validate URB actual_length in interrupt callback (git-fixes).\n- ALSA: usx2y: bound the hwdep mmap fault offset (git-fixes).\n- ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() (git-fixes).\n- apparmor: advertise the tcp fast open fix is applied (git-fixes).\n- ASoC: ab8500: Correct digital interface format setup (git-fixes).\n- ASoC: ab8500: Repair the DAPM capture graph (git-fixes).\n- ASoC: ab8500: Reset the audio block before configuring it (git-fixes).\n- ASoC: ab8500: Validate and program TDM slots correctly (git-fixes).\n- ASoC: adau1761: sort the register default table (git-fixes).\n- ASoC: amd: renoir: fix disable_pdm_interrupts() to clear mask bits (git-fixes).\n- ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC (git-fixes).\n- ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close() (git-fixes).\n- ASoC: apple: mca: increase SERDES reset delay (git-fixes).\n- ASoC: bcm: bcm63xx: Publish the OF module aliases (git-fixes).\n- ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses (git-fixes).\n- ASoC: cs35l33: drain threaded IRQ before runtime suspend (git-fixes).\n- ASoC: cs35l34: drain threaded IRQ before runtime suspend (git-fixes).\n- ASoC: cs35l41: sort the register default table (git-fixes).\n- ASoC: cs35l45: sort the register default table (git-fixes).\n- ASoC: cs4265: sort the register default table (git-fixes).\n- ASoC: cx2072x: sort the register default table (git-fixes).\n- ASoC: dapm: Fix off-by-one check on the second enum channel (git-fixes).\n- ASoC: fix unmet dependencies on PPC_BESTCOMM and SND_SOC_AC97_BUS (git-fixes).\n- ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready (git-fixes).\n- ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure (git-fixes).\n- ASoC: fsl_audmix: rework runtime PM handling in probe (git-fixes).\n- ASoC: fsl_easrc: sort the register default table (git-fixes).\n- ASoC: hdac_hda: Fix hlink refcount leak on component registration failure (git-fixes).\n- ASoC: Intel: avs: Clean up streams if their initialization fails (git-fixes).\n- ASoC: Intel: avs: Clean up the bus when fetching ML caps fails (git-fixes).\n- ASoC: Intel: avs: Do not ignore -ENOENT when loading a topology (git-fixes).\n- ASoC: Intel: avs: Fix unbalanced module reference count (git-fixes).\n- AsoC: intel: sst: fix PCI device reference leak on probe failure (git-fixes).\n- ASoC: Intel: SST: Publish the PCI module aliases (git-fixes).\n- ASoC: loongson: Fix error handling in ACPI property parsing (git-fixes).\n- ASoC: max9860: sort the register default table (git-fixes).\n- ASoC: mediatek: mt8183-afe-pcm: Shorten memif_data table using macros (stable-fixes).\n- ASoC: mediatek: mt8183-afe-pcm: Support \u003e32 bit DMA addresses (git-fixes).\n- ASoC: mediatek: mt8183-afe-pcm: use local `dev` pointer in driver callbacks (stable-fixes).\n- ASoC: mediatek: mt8183: Check runtime resume during probe (git-fixes).\n- ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable (stable-fixes).\n- ASoC: mediatek: mt8192: Check runtime resume during probe (git-fixes).\n- ASoC: meson: Keep link pointers valid on realloc failure (git-fixes).\n- ASoC: ml26124: sort the register default table (git-fixes).\n- ASoC: mt6351: Publish the OF module alias (git-fixes).\n- ASoC: pcm512x: sort the register default table (git-fixes).\n- ASoC: pxa: Use devm_clk_get_optional() for extclk clock (git-fixes).\n- ASoC: qcom: q6apm: keep the graph start count in sync with the DSP (git-fixes).\n- ASoC: rt274: sort the register default table (git-fixes).\n- ASoC: rt286: sort the register default table (git-fixes).\n- ASoC: rt298: sort the register default table (git-fixes).\n- ASoC: rt700-sdw: always drain jack work on remove (git-fixes).\n- ASoC: rt700: drop duplicate reg_default entry (git-fixes).\n- ASoC: rt700: sort the register default table (git-fixes).\n- ASoC: rt711-sdca: sort the register default tables (git-fixes).\n- ASoC: rt711: sort the register default table (git-fixes).\n- ASoC: rt712-sdca-dmic: sort the register default table (git-fixes).\n- ASoC: rt712-sdca-sdw: sort the register default table (git-fixes).\n- ASoC: rt715-sdca: drop duplicate reg_default entries (git-fixes).\n- ASoC: rt715-sdca: sort the register default tables (git-fixes).\n- ASoC: rt715: sort the register default table (git-fixes).\n- ASoC: rt1017-sdca-sdw: sort the register default table (git-fixes).\n- ASoC: rt1316-sdw: sort the register default table (git-fixes).\n- ASoC: rt1318-sdw: sort the register default table (git-fixes).\n- ASoC: rt1318: sort the register default table (git-fixes).\n- ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get (git-fixes).\n- ASoC: sgtl5000: sort the register default table (git-fixes).\n- ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() (git-fixes).\n- ASoC: SOF: validate topology volume range before allocation (git-fixes).\n- ASoC: sprd: validate compress buffer sizes against fixed allocations (git-fixes).\n- ASoC: sti-sas: sort the register default table (git-fixes).\n- ASoC: sti: initialize IRQ lock before requesting IRQ (git-fixes).\n- ASoC: tas2552: sort the register default table (git-fixes).\n- ASoC: tas2764: sort the register default table (git-fixes).\n- ASoC: tas2780: sort the register default table (git-fixes).\n- ASoC: tegra210_i2s: sort the register default table (git-fixes).\n- ASoC: tegra210_mixer: sort the register default table (git-fixes).\n- ASoC: tegra: Fix the MIXER enable default value (git-fixes).\n- ASoC: tegra: Sort MBDRC register defaults (git-fixes).\n- ASoC: xilinx: formatter_pcm: fix stream_data leak on open error (git-fixes).\n- ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers (git-fixes).\n- ata: ahci: work around lost interrupts on Marvell 88SE61xx (git-fixes).\n- batman-adv: bla: fix freeing of claims on meshif deletion (git-fixes).\n- batman-adv: bla: prevent CRC corruptions after claim flush (git-fixes).\n- batman-adv: dat: avoid unaligned fault in IP extraction (git-fixes).\n- batman-adv: fix stale receive device on merged fragments (git-fixes).\n- batman-adv: mcast: ensure unshared skb for multicast packets (git-fixes).\n- batman-adv: mcast: linearize skbuff for packet generation (git-fixes).\n- batman-adv: reject unrepresentable multicast TVLV offsets (git-fixes).\n- blk-mq: reinsert cached request to the list (bsc#1273770).\n- Bluetooth: btintel: bound firmware ID by TLV length (git-fixes).\n- Bluetooth: btintel: Fix diagnostics event detection (git-fixes).\n- Bluetooth: btintel: validate version TLV value lengths (git-fixes).\n- Bluetooth: btintel_pcie: Clear automask on spurious interrupts (git-fixes).\n- Bluetooth: btintel_pcie: fix tx_handle bounds off-by-one (git-fixes).\n- Bluetooth: btintel_pcie: validate packet_len before skb_put_data (git-fixes).\n- Bluetooth: btmtk: Declare MT7920 (MT7961 1a) Bluetooth firmware (git-fixes).\n- Bluetooth: btmtk: Do not discard the subsystem reset timeout (git-fixes).\n- Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read() (stable-fixes).\n- Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path (git-fixes).\n- Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX (git-fixes).\n- Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event (git-fixes).\n- Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev (git-fixes).\n- Bluetooth: btrtl: Don't leak return code when parsing firmware format v2 (git-fixes).\n- Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() (git-fixes).\n- Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req() (stable-fixes).\n- Bluetooth: btusb: Fix UAF of btusb_data by rx_work (git-fixes).\n- Bluetooth: do not leak an hci_conn when a second LE connect is rejected (git-fixes).\n- Bluetooth: eir: Fix OOB read in eir_get_service_data() (git-fixes).\n- Bluetooth: hci_aml: validate firmware segment lengths (git-fixes).\n- Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378 (git-fixes).\n- Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_conn: fix the SCO setup context lifetime (git-fixes).\n- Bluetooth: hci_conn: hold conn reference in abort_conn_sync() (git-fixes).\n- Bluetooth: hci_conn: re-enable advertising only for peripheral role (git-fixes).\n- Bluetooth: hci_core: Fix race condition during device registration (git-fixes).\n- Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb (git-fixes).\n- Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection (git-fixes).\n- Bluetooth: hci_event: fix LE list UAF on reset (git-fixes).\n- Bluetooth: hci_event: validate LE Set CIG Parameters response (git-fixes).\n- Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout() (git-fixes).\n- Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request (git-fixes).\n- Bluetooth: hci_sync: Fix accept list UAF during suspend (git-fixes).\n- Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths (git-fixes).\n- Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists (stable-fixes).\n- Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync() (stable-fixes).\n- Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del() (git-fixes).\n- Bluetooth: hci_uart: Fix false success return in hci_uart_setup() (git-fixes).\n- Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync (git-fixes).\n- Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready (git-fixes).\n- Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM (git-fixes).\n- Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan (git-fixes).\n- Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect (git-fixes).\n- Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync (git-fixes).\n- Bluetooth: MGMT: free the HCI command when it is cancelled (git-fixes).\n- Bluetooth: MGMT: free the mesh send cancel command when it is cancelled (git-fixes).\n- Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255 (git-fixes).\n- Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update (git-fixes).\n- Bluetooth: MSFT: validate evt_prefix_len against the response length (git-fixes).\n- Bluetooth: qca: fix NVM tag length underflow in TLV parser (git-fixes).\n- Bluetooth: RFCOMM: serialize security confirmation handling (git-fixes).\n- Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept (git-fixes).\n- Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (git-fixes).\n- Bluetooth: virtio_bt: avoid OOB read of build info string (git-fixes).\n- bnxt_en: Check return value of bnxt_hwrm_vnic_cfg (jsc#PED-16798).\n- bnxt_en: Delay for 5 seconds after AER DPC for all chips (jsc#PED-16798).\n- bnxt_en: Don't assume XDP is never enabled in bnxt_init_dflt_ring_mode() (jsc#PED-16798).\n- bnxt_en: Drop pci_save_state() after pci_restore_state() (jsc#PED-16798).\n- bnxt_en: Implement XDP RSS hash metadata extraction (jsc#PED-16798).\n- bnxt_en: Implement XDP RSS hash metadata extraction for V3_CMP (jsc#PED-16798).\n- bnxt_en: Move bnxt_rss_ext_op into header (jsc#PED-16798).\n- bnxt_en: Refactor some basic ring setup and adjustment logic (jsc#PED-16798).\n- bnxt_en: Restore default stat ctxs for ULP when resource is available (jsc#PED-16798).\n- bnxt_en: Set bp-\u003emax_tpa according to what the FW supports (jsc#PED-16798).\n- bnxt_en: Use absolute target ns from ptp_clock_request (jsc#PED-16798).\n- bnxt_en: use bnxt_xdp_buff for xdp context (jsc#PED-16798).\n- bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation (git-fixes).\n- bus: mhi: host: Fix controller cleanup on EDL sysfs failure (git-fixes).\n- bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET (git-fixes).\n- bus: ti-sysc: Fix /chosen node reference leak (git-fixes).\n- cacheinfo: don't propagate DT/ACPI error when arch supplies info (arm64) (git-fixes).\n- can: j1939: add missing calls in NETDEV_UNREGISTER notification handler (git-fixes).\n- can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking (stable-fixes).\n- char: xilinx_hwicap: unregister class on init errors (git-fixes).\n- cleanup: add a scoped version of CLASS() (stable-fixes).\n- cleanup: fix scoped_class() (git-fixes).\n- compiler_types: Introduce __flex_counter() and family (bsc#1280139).\n- cpufreq: intel_pstate: Add and use hybrid_get_cpu_type() (bsc#1240957 bsc#1249104 bsc#1265220).\n- cpufreq: intel_pstate: Avoid SMP calls to get cpu-type (bsc#1240957 bsc#1249104 bsc#1265220).\n- cpufreq: intel_pstate: Fix hwp_get_cpu_scaling() (bsc#1240957 bsc#1249104 bsc#1265220).\n- cpufreq: intel_pstate: Use correct scaling factor on Raptor Lake-E (bsc#1240957 bsc#1249104 bsc#1265220).\n- cpufreq: intel_pstate: Use CPPC to get scaling factors (bsc#1240957 bsc#1249104 bsc#1265220).\n- cpufreq: intel_pstate: Use HYBRID_SCALING_FACTOR_ADL for Bartlett Lake (bsc#1240957 bsc#1249104 bsc#1265220).\n- crypto: aspeed - Propagate platform_get_irq() errors (git-fixes).\n- crypto: atmel-sha204a - fix heap info leak on I2C transfer failure (git-fixes).\n- crypto: atmel-tdes - use scatterlist length before DMA mapping (git-fixes).\n- crypto: ccm - Set rfc4309 maxauthsize from child (git-fixes).\n- crypto: ccp - Abort doing SEV INIT if SNP INIT fails (stable-fixes).\n- crypto: ccp - Add new SEV/SNP platform shutdown API (stable-fixes).\n- crypto: ccp - Always pass in an error pointer to __sev_platform_shutdown_locked() (git-fixes).\n- crypto: ccp - Fix __sev_snp_shutdown_locked (git-fixes).\n- crypto: ccp - Fix dereferencing uninitialized error pointer (git-fixes).\n- crypto: ccp - Fix memory leak in SEV INIT_EX path (git-fixes).\n- crypto: ccp - Fix possible deadlock in SEV init failure path (git-fixes).\n- crypto: ccp - Fix SNP panic notifier unregistration (git-fixes).\n- crypto: ccp - Move dev_info/err messages for SEV/SNP init and shutdown (stable-fixes).\n- crypto: ccp - Move SEV/SNP Platform initialization to KVM (stable-fixes).\n- crypto: ccp - Register SNP panic notifier only if SNP is enabled (stable-fixes).\n- crypto: ccp - Reset TMR size at SNP Shutdown (stable-fixes).\n- crypto: doc - Remove extra parenthesis (git-fixes).\n- crypto: hisilicon/sec2 - fix CCM algorithm long packet failure (git-fixes).\n- crypto: keembay - Fix AEAD unregister count in error path (git-fixes).\n- crypto: keembay - Initialize completion before requesting IRQ (git-fixes).\n- crypto: keembay - publish OF module alias for OCS AES/SM4 (git-fixes).\n- crypto: lskcipher - propagate errors from unaligned crypt (git-fixes).\n- crypto: mxs-dcp - fix source scatterlist length access (git-fixes).\n- crypto: qat - cancel work on re-enable SR-IOV timeout (git-fixes).\n- crypto: qat - clear AES key schedule from stack (git-fixes).\n- crypto: qce - fix CCM AAD buffer underallocation (git-fixes).\n- crypto: qce - fix error path in devm_qce_register_algs (git-fixes).\n- crypto: qcom-rng - Allow zero as a random number (git-fixes).\n- crypto: qcom-rng - Enable clock in hwrng case (git-fixes).\n- crypto: rk3288 - fail ahash requests on HASH idle timeout (git-fixes).\n- crypto: sa2ul - stop probe if context pool creation fails (git-fixes).\n- crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping (git-fixes).\n- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (stable-fixes).\n- crypto: tegra - fix rctx-\u003ecryptlen calculation in tegra_gcm_do_one_req() (git-fixes).\n- cxl/acpi: Fix CXL_ACPI and CXL_PMEM Kconfig tristate mismatch (git-fixes).\n- cxl: Adjust the startup priority of cxl_pmem to be higher (git-fixes).\n- default_gfp(): avoid using the \"newfangled\" __VA_OPT__ trick (bsc#1280139).\n- device property: fix infinite loop in fwnode_for_each_child_node() (git-fixes).\n- dm/amdgpu: fix malformed link_settings debugfs output (git-fixes).\n- dma-mapping: add __dma_from_device_group_begin()/end() (bsc#1267586).\n- dmaengine: dw-edma: Clear stale requests on termination (git-fixes).\n- dmaengine: dw-edma: Complete descriptors before pausing (git-fixes).\n- dmaengine: dw-edma: Fix HDMA channel status register access (git-fixes).\n- dmaengine: dw-edma: Initialize IRQ data before requesting IRQs (git-fixes).\n- dmaengine: dw-edma: Serialize abort state updates (git-fixes).\n- dmaengine: dw-edma: Serialize channel state checks (git-fixes).\n- dmaengine: dw-edma: Terminate all descriptors without callbacks (git-fixes).\n- dmaengine: fsl-edma: tracing: no ptr dereference during log output (git-fixes).\n- dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe (git-fixes).\n- dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure (git-fixes).\n- dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal (git-fixes).\n- dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers (git-fixes).\n- dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout (git-fixes).\n- dmaengine: zynqmp_dma: fix kernel doc for zynqmp_dma_remove() (git-fixes).\n- driver core: soc: Unregister bus on early device registration failure (git-fixes).\n- drivers/virt: pkvm: Fix end calculation in mmio_guard_ioremap_hook() (git-fixes).\n- Drivers: hv: Use meaningful errnos for hypercall status codes (git-fixes).\n- drm/amd/display: Add AV mute wait frames to dce110_set_avmute (stable-fixes).\n- drm/amd/display: avoid divide-by-zero in __is_lut_linear() (git-fixes).\n- drm/amd/display: Check for tg ops in dce110_set_avmute (git-fixes).\n- drm/amd/display: dce100: skip non-DP stream encoders for DP MST (stable-fixes).\n- drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix (git-fixes).\n- drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE (git-fixes).\n- drm/amd/display: fix division by zero in get_estimated_bw() (git-fixes).\n- drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank() (git-fixes).\n- drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames (stable-fixes).\n- drm/amd/display: Remove unused-but-set variable hubp from (git-fixes).\n- drm/amd/display: validate plane degamma LUT size for private color prop (git-fixes).\n- drm/amd/pm: adjust the visibility of pp_table sysfs node (stable-fixes).\n- drm/amd/pm: fix gpu metrics energy accumulator for smu 13.0.0/13.0.7 (git-fixes).\n- drm/amd/pm: fix smu14 power limit range calculation (stable-fixes).\n- drm/amd/pm: make pp_features read-only when scpm is enabled (stable-fixes).\n- drm/amd/pm: Use same metric table for APU (stable-fixes).\n- drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read (git-fixes).\n- drm/amdgpu/gfx6: Fixup emit_cntxcntl() (git-fixes).\n- drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets (git-fixes).\n- drm/amdgpu/gfx6: Use PFP on the compute queues too (git-fixes).\n- drm/amdgpu/gfx8: drop unecessary BUG_ON() (stable-fixes).\n- drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup (git-fixes).\n- drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup (git-fixes).\n- drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma7.0: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) (stable-fixes).\n- drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older (stable-fixes).\n- drm/amdgpu/vce: fix integer overflow in image size (stable-fixes).\n- drm/amdgpu/vcn4: avoid rereading IB param length (stable-fixes).\n- drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (git-fixes).\n- drm/amdgpu: cap GTT size to physical RAM on APUs (stable-fixes).\n- drm/amdgpu: check ASPM on the dGPU host link (git-fixes).\n- drm/amdgpu: disallow multiple FENCE chunks in one submit (git-fixes).\n- drm/amdgpu: fix aperture iounmap skipped on device removal (git-fixes).\n- drm/amdgpu: fix autosuspend cleanup during removal (git-fixes).\n- drm/amdgpu: fix bo-\u003epin leaking in amdgpu_bo_create_reserved (stable-fixes).\n- drm/amdgpu: fix division by zero with invalid uvd dimensions (stable-fixes).\n- drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (stable-fixes).\n- drm/amdgpu: fix nbif 6.3.1 l1 low power not functional (git-fixes).\n- drm/amdgpu: Fix UVD decode image min size calculation (stable-fixes).\n- drm/amdgpu: Fix UVD dpb min size calculation for H264 (stable-fixes).\n- drm/amdgpu: Fix UVD min buffer sizes (stable-fixes).\n- drm/amdgpu: Fix VCE 3 ring align_mask (git-fixes).\n- drm/amdgpu: Fix VFCT bus number matching with soft filter (stable-fixes).\n- drm/amdgpu: Implement insert_end for VCE 3 (git-fixes).\n- drm/amdgpu: invoke pm_genpd_remove() before freeing genpd (stable-fixes).\n- drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini (git-fixes).\n- drm/amdgpu: read TRUNCATE_COORD_MODE on gfx12 (git-fixes).\n- drm/amdgpu: reject oversized IBs with per-ring packet limits (stable-fixes).\n- drm/amdgpu: Reject UVD message with dimensions above 4096 (stable-fixes).\n- drm/amdgpu: Reject UVD message with invalid number of h265 refs (stable-fixes).\n- drm/amdgpu: remove unused function parameter (stable-fixes).\n- drm/amdgpu: restore UMD profile pstate after runtime resume (stable-fixes).\n- drm/amdgpu: validate GEM_CREATE domain combinations (stable-fixes).\n- drm/amdkfd: Check bounds in allocate_event_notification_slot (stable-fixes).\n- drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (stable-fixes).\n- drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE (stable-fixes).\n- drm/amdkfd: fix QID bit leak in pqm_create_queue() (stable-fixes).\n- drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore (git-fixes).\n- drm/amdkfd: Handle invalid event type in CRIU event restore (stable-fixes).\n- drm/amdkfd: Use kvcalloc to allocate arrays (stable-fixes).\n- drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure (git-fixes).\n- drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure (git-fixes).\n- drm/bridge: ps8640: propagate AUX transfer register errors (git-fixes).\n- drm/bridge: tc358767: clamp the reported AUX read size to the request (git-fixes).\n- drm/connector/hdmi: Fix out of bounds memory read (git-fixes).\n- drm/connector: Fix epoch_counter docs to reflect reality (git-fixes).\n- drm/drm_exec: fix up contended obj when num_objects is 0 (git-fixes).\n- drm/gud: NUL-terminate TV mode names read from the device (git-fixes).\n- drm/gud: validate TV mode names before creating enum property (git-fixes).\n- drm/hibmc: Fix list of formats on the primary plane (git-fixes).\n- drm/hibmc: Use drm_atomic_helper_check_plane_state() (git-fixes).\n- drm/i915/hdcp: check streams bounds before overflow (git-fixes).\n- drm/i915/hdcp: Move to using intel_display in intel_hdcp (stable-fixes).\n- drm/i915/hdcp: require monotonically increasing seq_num_v (git-fixes).\n- drm/i915/hdcp: Skip inactive MST connectors when building stream list (stable-fixes).\n- drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() (stable-fixes).\n- drm/i915/vrr: require valid min/max vfreq for VRR (git-fixes).\n- drm/i915: Fix memory leak in query_perf_config_list() (git-fixes).\n- drm/lima: call drm_mm_init() with a valid allocation range (git-fixes).\n- drm/msm/a6xx: Fix RBBM_CLOCK_CNTL3_TP0 value in a730_hwcg (git-fixes).\n- drm/msm/a6xx: Fix stale rpmh votes after suspend (git-fixes).\n- drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0) (git-fixes).\n- drm/msm/dsi: Drop dev_pm_opp_set_rate(0) (git-fixes).\n- drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value (git-fixes).\n- drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE (git-fixes).\n- drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op (git-fixes).\n- drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE (git-fixes).\n- drm/nouveau: unsubscribe the channel-kill event before the fence context (git-fixes).\n- drm/nouveau: Use write-combined maps for coherent (git-fixes).\n- drm/panel-edp: fix i2c adapter leak on probe failure (git-fixes).\n- drm/panel: samsung-s6d16d0: Power off on prepare failure (git-fixes).\n- drm/panthor: fix firmware control interface bounds checks (git-fixes).\n- drm/panthor: return PTR_ERR() from devm_drm_dev_alloc() (git-fixes).\n- drm/panthor: skip zero-sized firmware sections (git-fixes).\n- drm/radeon: fix autosuspend cleanup during teardown (git-fixes).\n- drm/radeon: fix r100_copy_blit for large BOs (stable-fixes).\n- drm/radeon: restore hardware polling in fence_is_signaled to fix performance regression (git-fixes).\n- drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format (git-fixes).\n- drm/ssd130x: fix column and row end address in partial updates for ssd132x (git-fixes).\n- drm/ssd130x: fix column and row end address in partial updates in ssd133x (git-fixes).\n- drm/sun4i: crtc: Propagate layer initialization error (git-fixes).\n- drm/sun4i: Drop node references while building component list (git-fixes).\n- drm/sun4i: dw-hdmi: Drop TCON TOP port reference (git-fixes).\n- drm/sun4i: fix refcount leak in sun4i_backend_init_sat() (git-fixes).\n- drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz (git-fixes).\n- drm/sun4i: hdmi: Don't leak sync polarity bits into packet control (git-fixes).\n- drm/sun4i: tcon: Drop remote endpoint reference (git-fixes).\n- drm/sun4i: tcon: Drop TCON TOP device reference (git-fixes).\n- drm/sun4i: tcon: Set output mux for DSI and LVDS (git-fixes).\n- drm/sun4i: vi scaler: Fix coefficient selection (git-fixes).\n- drm/tegra: dsi: Re-add clear enable register if DSI was powered by bootloader (git-fixes).\n- drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info (git-fixes).\n- drm/tve200: add OF module alias for autoloading (git-fixes).\n- drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() (git-fixes).\n- drm/xe/oa: Check managed mutex initialization errors (git-fixes).\n- drm/xe/oa: Fix sync entry leak on OA config emit failure (git-fixes).\n- drm/xe/oa: Remove sysfs entry on idr_alloc failure in xe_oa_add_config_ioctl() (git-fixes).\n- drm/xe: Introduce xe_gt_dbg_printer() (stable-fixes).\n- drm/xe: Order ring writes before ring tail updates (git-fixes).\n- drm/xe: Stub out new pagefault layer (stable-fixes).\n- drm/xe: tests: fix error message in xe_migrate_sanity_test() (git-fixes).\n- drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used (git-fixes).\n- drm: fix race between partial drm_dev_register() failure and ioctl (git-fixes).\n- drm: lcdif: Wait for vblank before disabling DMA (git-fixes).\n- drm: Remove unused header in drm_dumb_buffers.c (git-fixes).\n- efi: fix stale reference to efi_recover_from_page_fault() (git-fixes).\n- erspan: Initialize options_len before referencing options (bsc#1274727).\n- ethtool: rss: fix hkey leak when indir_size is 0 (git-fixes).\n- fbdev: bitblit: bound-check glyph index in bit_cursor() (git-fixes).\n- fbdev: core: Fix pointer desynchronization in fb_io_read() (git-fixes).\n- fbdev: kyro: Validate overlay viewport coordinates (git-fixes).\n- fbdev: omapfb: panel-dsi-cm: initialize lock before registering display (git-fixes).\n- fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device() (git-fixes).\n- fbdev: uvesafb: unregister connector callback on init failure (git-fixes).\n- fbdev: vfb: defer cleanup until the last reference (git-fixes).\n- firmware: arm_scmi: Avoid IDR updates while cleaning channels (git-fixes).\n- firmware: arm_scmi: Clean up channels on setup failure (git-fixes).\n- firmware: arm_scmi: Drop handle on protocol bind failures (git-fixes).\n- firmware: arm_scmi: Fix requested device removal race (git-fixes).\n- firmware: arm_scmi: Free transport channel on IDR failure (git-fixes).\n- firmware: arm_scmi: Protect device request lookup with RCU (git-fixes).\n- firmware: arm_scmi: Publish channel state before callbacks (git-fixes).\n- firmware: arm_scmi: Quiesce notifications before teardown (git-fixes).\n- firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context (git-fixes).\n- firmware: arm_scmi: Reject out of range DT protocol IDs (git-fixes).\n- firmware: arm_scmi: Roll back partial protocol table registration (git-fixes).\n- firmware: arm_scmi: Unregister device notifier before IDR teardown (git-fixes).\n- firmware: arm_scmi: Unrequest devices if driver registration fails (git-fixes).\n- firmware: arm_scmi: Unwind P2A receiver mailbox setup failure (git-fixes).\n- firmware: arm_scmi: Unwind TX receiver mailbox setup failure (git-fixes).\n- firmware: arm_scmi: Use channel ID for transport teardown (git-fixes).\n- firmware_loader: do not queue completed sysfs fallback requests (git-fixes).\n- fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write (git-fixes).\n- fpga: dfl: fme: add error handling (git-fixes).\n- fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration (git-fixes).\n- fuse: fix race between interrupt and resend (git-fixes).\n- gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind (git-fixes).\n- gpu: host1x: Avoid stack over-read in debug output helpers (git-fixes).\n- gpu: host1x: Fix offset calculation in trace_write_gather (git-fixes).\n- gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings (stable-fixes).\n- HID: asus: fix missing hid_is_usb() check (git-fixes).\n- HID: asus: simplify RGB init sequence (stable-fixes).\n- HID: bpf: serialize device reference release in struct_ops destroy path (git-fixes).\n- HID: core: fix number/pointer type confusion on long items (git-fixes).\n- HID: core: fix OOB read of field-\u003eusage in hid_set_field() (git-fixes).\n- HID: ft260: fix stack-use-after-return write in I2C read race (git-fixes).\n- HID: ft260: validate i2c input report length (stable-fixes).\n- HID: hyperv: validate initial device info bounds (git-fixes).\n- HID: i2c-hid: Fix \"(null)\" output when reading report descriptor fails (git-fixes).\n- HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure (git-fixes).\n- HID: lg4ff: validate report length before fixed offsets (git-fixes).\n- HID: logitech-dj: Fix maxfield check in DJ short report validation (git-fixes).\n- HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report (git-fixes).\n- HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write (stable-fixes).\n- HID: logitech-dj: Standardise hid_report_enum variable nomenclature (stable-fixes).\n- HID: magicmouse: do not keep a stale msc-\u003einput if no input is claimed (git-fixes).\n- HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C (git-fixes).\n- HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID (stable-fixes).\n- HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() (git-fixes).\n- HID: magicmouse: re-enable multitouch after reset-resume (git-fixes).\n- HID: mcp2221: validate report size in mcp2221_raw_event() (git-fixes).\n- HID: multitouch: reclassify HTIX5288 to WIN_8_FORCE_MULTI_INPUT_NSMU (git-fixes).\n- HID: nintendo: Fix imu_timestamp_us double increment per report (git-fixes).\n- HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() (git-fixes).\n- HID: nintendo: register input device after capabilities are set (git-fixes).\n- HID: nintendo: stop device IO before hid_hw_stop on probe failure (git-fixes).\n- HID: picolcd: clamp eeprom debugfs read to bytes actually received (git-fixes).\n- HID: pidff: Rework pidff_set_time() to fix warnings (stable-fixes).\n- HID: pidff: Use ARRAY_SIZE macro instead of sizeof (stable-fixes).\n- HID: rmi: fix OOB access with undersized RMI reports (git-fixes).\n- HID: roccat: bound device-supplied profile index (git-fixes).\n- HID: roccat: free buffered reports when destroying device (git-fixes).\n- HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature (git-fixes).\n- HID: sensor: custom: Fix field sysfs group cleanup on failure (git-fixes).\n- HID: sensor: custom: Fix use-after-free in enable_sensor (git-fixes).\n- HID: synchronize input before cleaning up a failed probe (git-fixes).\n- HID: tmff: Use 64-bit arithmetic for force feedback scaling (git-fixes).\n- HID: wacom: validate report length in wacom_intuos_pro2_bt_irq (git-fixes).\n- hwmon: (ads7828) Fix external VREF regulator handling (git-fixes).\n- hwmon: (applesmc) fix key backlight workqueue leak on register failure (git-fixes).\n- hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors (git-fixes).\n- hwmon: (chipcap2) fix channels in humidity alarm notifications (git-fixes).\n- hwmon: (coretemp) Fix core_data leak on CPUs without PTS (git-fixes).\n- hwmon: (corsair-cpro) Create debugfs entries after hwmon registration (git-fixes).\n- hwmon: (corsair-cpro) Remove debugfs entries when probe fails (git-fixes).\n- hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination (git-fixes).\n- hwmon: (gpio-fan) Fix use-after-free in alarm work (git-fixes).\n- hwmon: (gpio-fan) take fan_data-\u003elock in gpio_fan_shutdown() (git-fixes).\n- hwmon: (ina2xx) Add support for has_alerts configuration flag (stable-fixes).\n- hwmon: (ina2xx) Add support for INA234 (stable-fixes).\n- hwmon: (ina2xx) Add support for INA260 (stable-fixes).\n- hwmon: (ina2xx) Fix various overflow issues (git-fixes).\n- hwmon: (ina2xx) Make it easier to add more devices (stable-fixes).\n- hwmon: (ina2xx) Shift INA234 shunt and current registers (stable-fixes).\n- hwmon: (ina226) Add support for SY24655 (stable-fixes).\n- hwmon: (ltc4282) Avoid overflow in maximum power calculation (git-fixes).\n- hwmon: (ltc4282) Clamp negative current limits (git-fixes).\n- hwmon: (ltc4282) Fix parsing adi,current-limit-sense-microvolt (git-fixes).\n- hwmon: (ltc4282) Make sure clk_init_data is fully initialized (git-fixes).\n- hwmon: (max6621) fix negative temperature offset and crit readings (git-fixes).\n- hwmon: (max6621) fix temperature clamp range (git-fixes).\n- hwmon: (nzxt-smart2) Check return value of init_device() in probe (git-fixes).\n- hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS (git-fixes).\n- hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations (git-fixes).\n- hwmon: Switch back to struct platform_driver::remove() (stable-fixes).\n- hwrng: ks-sa - Fix runtime PM cleanup on registration failure (git-fixes).\n- hwrng: omap - Fix probe error path cleanup (git-fixes).\n- hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() (git-fixes).\n- i2c: core: fix debugfs UAF on adapter removal (git-fixes).\n- i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (git-fixes).\n- i2c: imx: separate atomic, dma and non-dma use case (stable-fixes).\n- i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure (git-fixes).\n- i2c: mux: Fix channel node leak on adapter add failure (git-fixes).\n- i2c: ocores: Disable clock on failed resume (git-fixes).\n- i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices (git-fixes).\n- i3c: dw: rename \"pclk\" to \"apb\" to match dt-binding (git-fixes).\n- i3c: master: Fix device_register() error path (git-fixes).\n- i3c: master: Fix info leak and UAF in device unregister path (git-fixes).\n- i3c: master: Fix potential UAF in i3c_device_uevent() (git-fixes).\n- i3c: master: svc: bound IBI payload to the requested max_payload_len (git-fixes).\n- ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink (git-fixes).\n- ieee802154: cc2520: fix FIFOP work use-after-free (git-fixes).\n- ieee802154: hwsim: serialize pib updates to fix double-free (git-fixes).\n- iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE (git-fixes).\n- iio: adc: max34408: add missing 'select REGMAP_I2C' to Kconfig (git-fixes).\n- iio: adc: pac1921: fix wrong channel used in trigger handler read (git-fixes).\n- iio: buffer: Fix potential use-after-free in anonymous buffer release (git-fixes).\n- iio: buffer: Make IIO DMA fence release RCU-safe (git-fixes).\n- iio: buffer: Tie IIO dma fence lock lifetime to the fence (git-fixes).\n- iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable (git-fixes).\n- iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF (git-fixes).\n- iio: chemical: sgp30: Handle IAQ thread creation failure (git-fixes).\n- iio: dac: m62332: Fix regulator reference count imbalance (git-fixes).\n- iio: gyro: mpu3050: fix sign of raw angular velocity readings (git-fixes).\n- iio: light: cm32181: return zero after writing calibscale (git-fixes).\n- iio: light: gp2ap002: Disable regulators on resume failure (git-fixes).\n- iio: light: gp2ap002: re-enable irq if runtime suspend fails (git-fixes).\n- iio: light: isl29028: return zero in write_raw() on success (git-fixes).\n- iio: light: ltrf216a: fix runtime PM reference leak in error path (git-fixes).\n- iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem() (git-fixes).\n- iio: light: opt4001: Fix power down clearing bits of the wrong register (git-fixes).\n- iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask (git-fixes).\n- iio: light: opt4001: Reject integration times with a non-zero seconds part (git-fixes).\n- iio: light: tsl2583: return zero in write_raw() on success (git-fixes).\n- iio: light: tsl2772: fix ALS calibscale readback (git-fixes).\n- iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure (git-fixes).\n- iio: pressure: dps310: fix NULL pointer dereference on ACPI probe (git-fixes).\n- iio: pressure: mpl115: Fix runtime PM cleanup (git-fixes).\n- iio: srf04: fix pm_runtime handling on probe error path (git-fixes).\n- iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() (git-fixes).\n- Input: atkbd - skip deactivate for HONOR ZQC-P (git-fixes).\n- Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard (stable-fixes).\n- Input: cs40l50-vibra - validate custom data from user space (git-fixes).\n- Input: evdev - fix information leak in evdev_pass_values() (stable-fixes).\n- Input: evdev - sanitize event type index when fetching event masks (stable-fixes).\n- Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet (git-fixes).\n- Input: focaltech - use signed coordinates to prevent underflow (git-fixes).\n- Input: hynitron_cstxxx - validate touch count and finger IDs (git-fixes).\n- Input: iforce - validate input packet lengths (stable-fixes).\n- Input: iqs5xx - validate firmware record destination span (git-fixes).\n- Input: mms114 - fix Y-resolution configuration (git-fixes).\n- Input: psxpad-spi - set driver data before use (git-fixes).\n- Input: reject inhibit and uninhibit requests on unregistering devices (git-fixes).\n- Input: sur40 - fix input device registration ordering (stable-fixes).\n- Input: sur40 - fix V4L error path cleanup (stable-fixes).\n- Input: synaptics-rmi4 - block s_input when F54 queue is busy (git-fixes).\n- Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer (git-fixes).\n- Input: synaptics-rmi4 - fix F55 transmitter electrode count typo (git-fixes).\n- Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue (git-fixes).\n- Input: synaptics-rmi4 - zero report size on F54 work error (git-fixes).\n- Input: xpad - add support for ZENAIM LEVERLESS (stable-fixes).\n- interconnect: Fix use after free in icc_get() and of_icc_get_by_index() (git-fixes).\n- io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item (git-fixes).\n- io_uring/net: Avoid msghdr on op_connect/op_bind async data (git-fixes).\n- iommu/arm-smmu-v3: Manage teardown with devm (stable-fixes).\n- ip_tunnel: Use ip_tunnel_info() helper instead of 'info + 1' (bsc#1274727).\n- ipmi: ipmb: validate write message length (git-fixes).\n- ipmi: si: Fix NULL pointer dereference after failed registration (git-fixes).\n- KVM: arm64: Ensure FFA ranges are page aligned (git-fixes).\n- KVM: arm64: Fix bounds checking in do_ffa_mem_reclaim() (git-fixes).\n- KVM: arm64: Fix sign-extension of MMIO loads (git-fixes).\n- KVM: arm64: vgic: Reset in_kernel on private IRQ allocation failure (git-fixes).\n- KVM: arm64: Zero out the stack initialized data in the FFA handler (git-fixes).\n- KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN (git-fixes).\n- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (git-fixes).\n- KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit (git-fixes).\n- KVM: nVMX: Service local TLB flushes on failed nested VM-Enter (git-fixes).\n- KVM: PPC: Book3S HV: Add support for compat CPU capabilities for KVM on PowerNV (bsc#1263864 ltc#217835).\n- KVM: PPC: Book3S HV: Implement compat CPU capability retrieval for KVM on PowerVM (bsc#1263864 ltc#217835).\n- KVM: PPC: Book3S HV: Validate arch_compat against host compatibility mode (bsc#1263864 ltc#217835).\n- KVM: PPC: Document KVM_PPC_GET_COMPAT_CAPS ioctl (bsc#1263864 ltc#217835).\n- KVM: PPC: Introduce KVM_CAP_PPC_COMPAT_CAPS and wire up ioctl (bsc#1263864 ltc#217835).\n- KVM: SEV: Use to_kvm_sev_info() for fetching kvm_sev_info struct (git-fixes).\n- KVM: SVM: Add support to initialize SEV/SNP functionality in KVM (bsc#1279887).\n- KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts (git-fixes).\n- KVM: SVM: Serialize accesses to the owner and mirror list with separate lock (git-fixes).\n- KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (git-fixes).\n- KVM: TDX: Account all non-transient page allocations for per-TD structures (git-fixes).\n- KVM: TDX: Fix x2APIC MSR handling in tdx_has_emulated_msr() (git-fixes).\n- KVM: VMX: Don't register posted interrupt wakeup handler if alloc_kvm_area() fails (git-fixes).\n- KVM: x86/hyperv: Check for NULL vCPU Hyper-V object in kvm_hv_get_tlb_flush_fifo() (git-fixes).\n- KVM: x86/hyperv: Ensure vCPU's Hyper-V object is initialized on cross-vCPU accesses (git-fixes).\n- KVM: x86/hyperv: Get target FIFO in hv_tlb_flush_enqueue(), not caller (git-fixes).\n- KVM: x86/mmu: Recover TDP MMU NX huge pages using MMU read lock (bsc#1271050).\n- KVM: x86/mmu: Rename kvm_tdp_mmu_zap_sp() to better indicate its purpose (bsc#1271050).\n- KVM: x86/mmu: Track possible NX huge pages separately for TDP vs. Shadow MMU (bsc#1271050).\n- KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page (git-fixes).\n- KVM: x86: Don't WARN if IRQ disappears because it was cleared from the PIC (git-fixes).\n- KVM: x86: Don't WARN if IRQ disappears when Xen emulation is enabled (git-fixes).\n- KVM: x86: Fix array_index_nospec() protection in kvm_vcpu_ioctl_x86_set_mce() (git-fixes).\n- KVM: x86: Fix emulated CPUID features being applied to wrong sub-leaf (git-fixes).\n- KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock (git-fixes).\n- leds: pca9532: Fix inverted GPIO output polarity (git-fixes).\n- leds: pca9532: Fix phantom device registration on missing hardware (git-fixes).\n- lib/string: fix memchr_inv() for large ranges (git-fixes).\n- lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() (git-fixes).\n- mac802154: fix data race and NULL deref on local-\u003eassoc_dev (git-fixes).\n- mac802154: fix netdev use-after-free in beacon worker (git-fixes).\n- mac802154: fix use-after-free of sdata via queued RX frames (git-fixes).\n- mailbox: pcc: Fix command timeout due to missed interrupt (git-fixes).\n- mailbox: qcom-cpucp: fix PREEMPT_RT self-deadlock in IRQ handler (git-fixes).\n- mailbox: qcom-cpucp: handle NULL data in send_data callback (git-fixes).\n- mailbox: qcom-ipcc: fix duplicate channel allocation across holes (git-fixes).\n- mailbox: rockchip: disable pclk on probe failure and unbind (git-fixes).\n- maple_tree: fix argument name in header (git-fixes).\n- md/raid1: create serial pool adding rdev to array with serialize_policy=1 (bsc#1272261).\n- media: airspy: Return queued buffers on start_streaming() failure (git-fixes).\n- media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref (git-fixes).\n- media: amphion: Remove obsolete frame_count check in venc_start_session (git-fixes).\n- media: bcm2835-unicam: Fix asc leaked in error/remove path (git-fixes).\n- media: cec-pin: Fix event FIFO ordering (git-fixes).\n- media: cec: disable delayed work before freeing an interrupted transmit (git-fixes).\n- media: cec: extron-da-hd-4k-plus: add sanity check (git-fixes).\n- media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash (git-fixes).\n- media: cec: Serialize exclusive follower delivery (git-fixes).\n- media: cec: stm32: prevent out-of-bounds write on RX overflow (git-fixes).\n- media: cedrus: clean up media device on probe failure (git-fixes).\n- media: cedrus: fix memory leak in cedrus_init_ctrls() (git-fixes).\n- media: chips-media: wave5: Guard bit depth check with initial_info_obtained (git-fixes).\n- media: chips-media: wave5: Move src_buf Removal to finish_encode (git-fixes).\n- media: cobalt: Avoid freeing ALSA private data twice (git-fixes).\n- media: cx231xx: fix devres lifetime (git-fixes).\n- media: cx231xx: reject geometry changes while the VBI queue is busy (git-fixes).\n- media: cx23885: add ioremap return check and cleanup (git-fixes).\n- media: cx23885: cancel NetUP CI work before teardown (git-fixes).\n- media: em28xx: defer audio-only extension registration (git-fixes).\n- media: em28xx: fix use-after-free of dev_next-\u003edevlist on disconnect (git-fixes).\n- media: go7007: defer the ALSA v4l2 put until card release (git-fixes).\n- media: hevc: add bounded tile-count helpers (git-fixes).\n- media: i2c: alvium: fix critical pointer access in alvium_ctrl_init (git-fixes).\n- media: i2c: alvium: Fix: Correct name of register in alvium_set_ctrl_auto_exposure (git-fixes).\n- media: i2c: imx219: Rename VTS to FRM_LENGTH (stable-fixes).\n- media: i2c: imx415: Return test pattern write errors (git-fixes).\n- media: i2c: ov02a10: fix endpoint parsing use-after-free (git-fixes).\n- media: i2c: ov7740: fix use-after-destroy in remove (git-fixes).\n- media: i2c: rdacm21: Fix missing media_entity_cleanup() (git-fixes).\n- media: imx219: Fix maximum frame length in lines (git-fixes).\n- media: intel/ipu6: fix async notifier cleanup leak on parse error (git-fixes).\n- media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for overlapping ranges (git-fixes).\n- media: ipu6: Do not free aux device pdata after init (git-fixes).\n- media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define (git-fixes).\n- media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define (git-fixes).\n- media: mc-entity: Add missing kerneldoc (git-fixes).\n- media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity (git-fixes).\n- media: meson: vdec: Fix memory leak in error path of vdec_open (git-fixes).\n- media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common (git-fixes).\n- media: msi2500: Return queued buffers on start_streaming() failure (git-fixes).\n- media: nuvoton: npcm-video: fix error handling in npcm_video_init() (git-fixes).\n- media: nuvoton: npcm-video: fix memory leaks in probe and remove (git-fixes).\n- media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe (git-fixes).\n- media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure (git-fixes).\n- media: nxp: imx8-isi: Correct color map between V4L2 and ISI (git-fixes).\n- media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path (git-fixes).\n- media: nxp: imx8-isi: Fix potential out-of-bounds issues (git-fixes).\n- media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding (git-fixes).\n- media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing (git-fixes).\n- media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks (git-fixes).\n- media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() (stable-fixes).\n- media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup (git-fixes).\n- media: platform: mtk-mdp3: Fix SCP device refcounting (git-fixes).\n- media: pwc: Drain fill_buf on start_streaming() failure (git-fixes).\n- media: pwc: Return queued buffers on start_streaming() failure (git-fixes).\n- media: qcom: camss: Fix RDI streaming for CSID GEN2 (git-fixes).\n- media: radio-si476x: Unregister v4l2_device on probe failure (git-fixes).\n- media: rc: sunxi-cir: Unregister rc device on probe failure (git-fixes).\n- media: rtl2832: fix use-after-free in rtl2832_remove() (git-fixes).\n- media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure (git-fixes).\n- media: rtl2832_sdr: Return queued buffers on start_streaming() failure (git-fixes).\n- media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak (git-fixes).\n- media: s2255: bound JPEG frame size before copying into the buffer (git-fixes).\n- media: s2255: check firmware size before reading trailing marker (git-fixes).\n- media: saa7134: Fix a possible memory leak in saa7134_video_init1 (git-fixes).\n- media: saa7164: fix cleanup on resource allocation failure (git-fixes).\n- media: stm32: dcmi: unregister notifier on probe failure (git-fixes).\n- media: sun4i-csi: Return queued buffers on start_streaming() failure (git-fixes).\n- media: tda18250: fix possible integer overflow (git-fixes).\n- media: tegra-video: vi: fix invalid u32 return value in format lookup (git-fixes).\n- media: usbtv: keep device alive while ALSA card exists (git-fixes).\n- media: v4l2-async: avoid deleting unlinked ASC entry on link error (git-fixes).\n- media: v4l2-async: Unregister sub-device if asc_list is empty (git-fixes).\n- media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() (git-fixes).\n- media: v4l2-ctrls: Allow unknown HDR10 white point and luminance (git-fixes).\n- media: v4l2-ctrls: validate AV1 tile counts (git-fixes).\n- media: v4l2-ctrls: validate HEVC tile counts (git-fixes).\n- media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link (git-fixes).\n- media: v4l2-h264: Fix memcmp() size in B1 reference list comparison (git-fixes).\n- media: v4l2-subdev: Fail {enable,disable}_streams and s_streaming nicely (git-fixes).\n- media: venus: fix payload size calculation in parse_raw_formats() (git-fixes).\n- media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() (git-fixes).\n- media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity (git-fixes).\n- media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer (git-fixes).\n- media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity (git-fixes).\n- media: vicodec: fix out-of-bounds write in FWHT encoder (git-fixes).\n- media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure (git-fixes).\n- media: vimc: fix pixel format lookup in enum_framesizes (git-fixes).\n- media: vivid: add vivid_update_reduced_fps() (git-fixes).\n- media: vivid: check for vb2_is_busy() when toggling caps (git-fixes).\n- media: vivid: fix cleanup bugs in vivid_init() (git-fixes).\n- media: zoran: Avoid freeing a registered video_device twice (git-fixes).\n- mei: pull kvfree out of spinlock (git-fixes).\n- mfd: iqs62x: Reject zero-length firmware records (git-fixes).\n- mfd: rave-sp: validate received frame payload lengths (git-fixes).\n- mfd: sm501: Fix potential memory leaks during remove (git-fixes).\n- misc: bcm-vk: Use acquire/release for msgq_inited (git-fixes).\n- misc: fastrpc: fix channel ctx ref leak when session alloc fails (git-fixes).\n- misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free (git-fixes).\n- misc: fastrpc: Remove buffer from list prior to unmap operation (git-fixes).\n- misc: fastrpc: take fl-\u003elock when moving mmaps on interrupted invoke (git-fixes).\n- misc: nsm: bound the device-reported response length (git-fixes).\n- misc: rtsx: add missing write register handling (git-fixes).\n- misc: sgi-gru: remove interrupt-context page-table walks (git-fixes).\n- misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() (git-fixes).\n- mkspec-dtb: Move DTS prefix into package list.\n- mkspec-dtb: Move provides-obsoletes to package list.\n- mkspec-dtb: Put per-architecture package lists into a hash.\n- mkspec-dtb: re-indent.\n- mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition (git-fixes).\n- mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit (git-fixes).\n- mmc: sdhci: unmap the bounce buffer before device release (git-fixes).\n- mmc: via-sdmmc: stop card-detect handling on probe failure (git-fixes).\n- mtd: afs: validate v2 image info bounds (git-fixes).\n- mtd: fix double free and WARN_ON in add_mtd_device() error paths (git-fixes).\n- mtd: mtdoops: free page bitmap when the backing MTD is removed (git-fixes).\n- mtd: mtdswap: Avoid freeing registered blktrans device twice (git-fixes).\n- mtd: mtdswap: remove debugfs stats file on teardown (git-fixes).\n- mtd: nand: mtk-ecc: stop on ECC idle timeouts (git-fixes).\n- mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() (git-fixes).\n- mtd: rawnand: validate ONFI extended parameter page sections (git-fixes).\n- mtd: spinand: fix direct mapping creation sizes (stable-fixes).\n- mtd: spinand: repeat reading in regular mode if continuous reading fails (stable-fixes).\n- mtd: spinand: try a regular dirmap if creating a dirmap for continuous reading fails (stable-fixes).\n- mtd: ubi: Release device reference on busy detach (git-fixes).\n- mtd: ubi: skip programming unused bits in ubi headers (stable-fixes).\n- net: Add options as a flexible array to struct ip_tunnel_info (bsc#1274727).\n- net: mana: Add debug knob to skip TX timeout recovery reset (git-fixes).\n- net: mana: Add handler for sriov configure (bsc#1272756).\n- net: mana: Cap MSI-X vectors to the device MSI-X table size (git-fixes).\n- net: mana: Extend RX CQE coalescing up to 8 packets (git-fixes).\n- net: mana: Fall back to scattered pages for GDMA queues (git-fixes).\n- net: mana: force full-page RX buffers via ethtool private flag (bsc#1269792).\n- net: mana: refactor mana_get_strings() and mana_get_sset_count() to use switch (bsc#1269792).\n- net: mana: Route ring-buffer access through offset-based helpers (git-fixes).\n- net: tap: set skb-\u003edev before parsing virtio net header in tap_get_user_xdp() (git-fixes bsc#1274550).\n- net: thunderbolt: Count delivered packets in rx_packets and rx_bytes (git-fixes).\n- net: thunderbolt: Mark the connection down when bringing it up fails (git-fixes).\n- net: thunderbolt: Release the Rx HopID that was handed out on mismatch (git-fixes).\n- net: thunderbolt: Tear down DMA paths before stopping the rings (git-fixes).\n- net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() (git-fixes).\n- net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow (git-fixes).\n- net: usb: ipheth: fix carrier_work UAF on disconnect (git-fixes).\n- net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition (git-fixes).\n- nfc: digital: clamp SENSF_RES length to the destination buffer (git-fixes).\n- nfc: digital: Do not dump a NULL response in command completion (git-fixes).\n- nfc: fdp: bound the device-reported read length and fix an skb leak (git-fixes).\n- nfc: llcp: avoid userspace overflow on invalid optlen (git-fixes).\n- nfc: llcp: bound SNL TLV parsing to the skb and add length checks (git-fixes).\n- nfc: llcp: bound the connect_sn TLV walk to the skb (git-fixes).\n- nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (git-fixes).\n- nfc: llcp: read llcp_sock-\u003elocal under the socket lock in getsockopt (git-fixes).\n- nfc: llcp: reject PDUs shorter than the LLCP header (git-fixes).\n- nfc: microread: validate target discovery payload lengths (git-fixes).\n- nfc: nci: fix double completion race in nci_data_exchange_complete (git-fixes).\n- nfc: nci: fix out-of-bounds write in nci_target_auto_activated() (git-fixes).\n- nfc: nci: fix uninit-value in the RF discover/activated NTF handlers (git-fixes).\n- nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing (git-fixes).\n- nfc: nci: free destination parameters when closing a connection (git-fixes).\n- nfc: pn533: hold a reference to the request skb during send_frame (git-fixes).\n- nfc: pn533: purge fragmented skbs during cleanup (git-fixes).\n- nfc: st21nfca: validate ATR_REQ length against the received frame (git-fixes).\n- nouveau/gem: reserve the bo in the info ioctl around the vma lookup (git-fixes).\n- nvme-tcp: fix usage of page_frag_cache (bsc#1267882).\n- nvmet-rdma: fix queue leak when connect backlog is exceeded (git-fixes).\n- of: fix out-of-bounds read in of_alias_scan() stem parser (git-fixes).\n- PCI/ASPM: Use pcie_capability_clear_and_set_word() for ASPM disable/restore (git-fixes).\n- PCI/proc: Avoid spurious runtime PM wakeup on config space accesses (git-fixes).\n- PCI/proc: Use file_ns_capable() when checking config space read access (git-fixes).\n- PCI/proc: Warn on writes to kernel-exclusive config space regions (git-fixes).\n- PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses (git-fixes).\n- PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] (git-fixes).\n- PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip (git-fixes).\n- PCI: j721e: Fix incorrect max_lanes for J7200 (git-fixes).\n- PCI: meson: Fix GPIO state while requesting PERST# (git-fixes).\n- PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts() (git-fixes).\n- PCI: plda: Fix use-after-free of event IRQs during teardown (git-fixes).\n- perf: Reject exited events as group leaders (git-fixes).\n- pinctrl: bcm2835: Don't remove an unregistered GPIO chip (git-fixes).\n- pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip (git-fixes).\n- pinctrl: rockchip: Reset the pin count when recalculating SoC data (git-fixes).\n- platform/chrome: cros_ec_debugfs: Clean up console log on probe failure (git-fixes).\n- platform/chrome: cros_ec_debugfs: Unregister panic notifier (git-fixes).\n- platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count (git-fixes).\n- platform/chrome: sensorhub: Bound the EC-reported sensor number (git-fixes).\n- platform/chrome: sensorhub: Fix dropped timestamp events and log spam (git-fixes).\n- platform/chrome: sensorhub: Fix memory overread in ring handler (git-fixes).\n- platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL (git-fixes).\n- platform/surface: acpi-notify: Check ACPI companion before use (git-fixes).\n- platform/x86/amd/hsmp: Reject negative power cap writes in hwmon (git-fixes).\n- platform/x86: asus-wmi: fix resource leaks on probe failure (git-fixes).\n- platform/x86: dell-privacy: Fix race condition (git-fixes).\n- platform/x86: dell-wmi-base: Fix resource leak on module load failure (git-fixes).\n- platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer (git-fixes).\n- platform/x86: dell-wmi-sysman: Fix instance ID bounds (git-fixes).\n- platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS (git-fixes).\n- platform/x86: hp-bioscfg: advance elem past consumed array elements (git-fixes).\n- platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() (git-fixes).\n- platform/x86: hp-bioscfg: fix heap OOB read on empty password write (git-fixes).\n- platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password (git-fixes).\n- platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() (git-fixes).\n- platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed (git-fixes).\n- platform/x86: hp-bioscfg: fix password encoding bounds check (git-fixes).\n- platform/x86: hp-bioscfg: warn on element type mismatch instead of failing (git-fixes).\n- platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path (git-fixes).\n- platform/x86: ISST: Add a NULL check for sst_inst (git-fixes).\n- platform/x86: ISST: Just allow 2 bits for SST feature enable (git-fixes).\n- platform/x86: ISST: Return error during profile addition (git-fixes).\n- platform/x86: ISST: Use PP level enable mask (git-fixes).\n- platform/x86: ISST: Validate level in perf mask ioctls (git-fixes).\n- platform/x86: ISST: Validate logical CPU id and clos id (git-fixes).\n- platform/x86: ISST: Validate parameter for core power state (git-fixes).\n- platform/x86: ISST: Validate parameter for frequency and priority (git-fixes).\n- platform/x86: ISST: Validate socket ID in clos_assoc ioctl (git-fixes).\n- PM: hibernate: Fix memory leak in snapshot_write_next() error path (git-fixes).\n- PM: sleep: Fix off-by-one in wakelocks number limit check (git-fixes).\n- power: supply: bd99954: Drop bad register fields (git-fixes).\n- power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address (git-fixes).\n- power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address (git-fixes).\n- power: supply: bq27xxx: bq27520g4: fix REG_TTES address (git-fixes).\n- power: supply: bq256xx: drain usb_work before freeing the charger (git-fixes).\n- power: supply: bq24257: fix use-after-free on remove (git-fixes).\n- power: supply: bq25890: Fix power_supply reference leak (git-fixes).\n- power: supply: charger-manager: register regulators before exposing sysfs (git-fixes).\n- power: supply: cros_usbpd-charger: bound the EC-reported port count (git-fixes).\n- power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS (git-fixes).\n- power: supply: isp1704_charger: cancel work on remove (git-fixes).\n- power: supply: lp8727: fix use-after-free in lp8727_release_irq() (git-fixes).\n- power: supply: lp8788-charger: fix use-after-free on remove (git-fixes).\n- power: supply: max17040: drop incorrect I2C functionality check (git-fixes).\n- power: supply: max17040: propagate register read errors (git-fixes).\n- power: supply: max17040: synchronize work cancellation on suspend (git-fixes).\n- power: supply: qcom_battmgr: terminate the strings from firmware (git-fixes).\n- power: supply: rt9455: quiesce delayed work before teardown (git-fixes).\n- power: supply: sbs-battery: Use a per-device serial number buffer (git-fixes).\n- power: supply: sc2731_charger: cancel work on remove (git-fixes).\n- power: supply: twl4030_charger: cancel workers via devm (git-fixes).\n- power: supply: ucs1002: fix use-after-free on remove (git-fixes).\n- powercap: intel_rapl_tpmi: Handle PMU registration failure during probe (git-fixes).\n- powerpc/dt_cpu_ftrs: Set CPU_FTR_P11_PVR for Power11 and later processors (bsc#1263864 ltc#217835).\n- powerpc/kexec_file: Use inclusive range checks in add_usable_mem() (git-fixes).\n- powerpc/pseries: Ensure vpa,slb_shadow \u0026 dtl are unregistered during crash (bsc#1271256).\n- powerpc/pseries: lparcfg - fix kbuf[] underflow (bsc#1274753 ltc#221289 bsc#1274754 ltc#221288 bsc#1274752\n  ltc#221290).\n- powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak (bsc#1274751 ltc#221105 bsc#1274750 ltc#221106).\n- powerpc/pseries: pci - logic bug (bsc#1274749 ltc#221282 bsc#1274755 ltc#221284 bsc#1274756 ltc#221283).\n- powerpc/rtas_pci: No hotplug on permanently removed device on pSeries (git-fixes).\n- powerpc: Replace __ASSEMBLY__ with __ASSEMBLER__ in non-uapi headers (bsc#1263864 ltc#217835).\n- powerpc: Replace __ASSEMBLY__ with __ASSEMBLER__ in uapi headers (bsc#1263864 ltc#217835).\n- ppdev: prevent overflow when setting port timeout (git-fixes).\n- rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() (git-fixes).\n- rapidio: clear mport-\u003enet when rio_add_net() fails (git-fixes).\n- rapidio: mport_cdev: fix use-after-free in dma_req_free() (git-fixes).\n- RDMA/bnxt_re: Avoid displaying the kernel pointer (git-fixes).\n- RDMA/bnxt_re: Proper rollback if the ioremap fails (git-fixes).\n- RDMA/irdma: Remove redundant legacy_mode checks (git-fixes).\n- RDMA/mana_ib: drain QP references after partial table insertion (git-fixes).\n- RDMA/mana_ib: unify QP lookup table (git-fixes).\n- RDMA/mlx5: Fix integer overflow of user QP buffer size (git-fixes).\n- regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer (git-fixes).\n- regulator: core: use system_freezable_wq for init complete work (git-fixes).\n- regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata (git-fixes).\n- regulator: qcom-refgen: correct the regulator type to CURRENT (git-fixes).\n- regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling (git-fixes).\n- remoteproc: qcom: Fix glink-\u003enode reference leak in qcom_add_glink_subdev (git-fixes).\n- remoteproc: qcom_q6v5_adsp: Fix reference leak for device node (git-fixes).\n- remoteproc: scp: Fix device reference leak on failed lookup (git-fixes).\n- Revert \"drm/amdgpu: fix aperture mapping leak\" (git-fixes).\n- Revert \"media: v4l2-dev: fix error handling in __video_register_device()\" (git-fixes).\n- Revert \"net: thunderbolt: Enable end-to-end flow control also in transmit\" (git-fixes).\n- Revert \"thermal/drivers/hwmon: Cleanup coding style a bit\" (stable-fixes).\n- Revert \"wifi: mt76: Disable napi when removing device\" (git-fixes).\n- rpmsg: core: Fix incorrect return value documentation (git-fixes).\n- rpmsg: glink: smem: order FIFO read after availability check (git-fixes).\n- rtc: gamecube: check return value of devm_rtc_register_device() (git-fixes).\n- rtc: pcf8563: fix clock provider leak on unbind (git-fixes).\n- rtc: pcf85363: Add error checking to regmap calls in probe() (git-fixes).\n- rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers (git-fixes).\n- rtc: rzn1: Fix weekday underflow when alarm crosses month boundary (git-fixes).\n- rtc: zynqmp: Return optional clock lookup errors (git-fixes).\n- s390/pkey: Check length in pkey_pckmo handler implementation (bsc#1270266).\n- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (bsc#1270267).\n- sched/psi: Create the psimon kthread outside of cgroup_mutex (bsc#1269134).\n- scsi: fnic: Abort timed-out NVMe LS requests (bsc#1236344).\n- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (bsc#1236344).\n- scsi: fnic: Add FDLS role handling for NVMe initiators (bsc#1236344).\n- scsi: fnic: Add the NVMe/FC transport path (bsc#1236344).\n- scsi: fnic: Advertise NVMe initiator service parameters (bsc#1236344).\n- scsi: fnic: Bump up version number (bsc#1236344).\n- scsi: fnic: Decode firmware role configuration (bsc#1236344).\n- scsi: fnic: Do not use GFP_ZERO for mempools (bsc#1236344).\n- scsi: fnic: Expose NVMe transport state in debugfs (bsc#1236344).\n- scsi: fnic: Handle NVMe LS frames in FDLS (bsc#1236344).\n- scsi: fnic: Make debug logging protocol independent (bsc#1236344).\n- scsi: fnic: Make fnic_queuecommand() easier to analyze (bsc#1236344).\n- scsi: fnic: Refactor in_remove flag and call to fnic_fcpio_reset() (bsc#1236344).\n- scsi: fnic: Remove a useless struct mempool forward declaration (bsc#1236344).\n- scsi: fnic: Rename fnic_scsi_fcpio_reset() (bsc#1236344).\n- scsi: fnic: Route completions and resets by initiator role (bsc#1236344).\n- scsi: fnic: Self-assignment of intr_time_type has no effect (bsc#1236344).\n- scsi: fnic: Send NVMe LS requests through FDLS (bsc#1236344).\n- scsi: fnic: Switch to use %ptSp (bsc#1236344).\n- scsi: fnic: Track NVMe transport statistics (bsc#1236344).\n- scsi: fnic: Use fnic_num for non-SCSI identifiers (bsc#1236344).\n- scsi: fnic: Use mempool for receive frames (bsc#1236344).\n- scsi: qla2xxx: Add support to report MPI FW state (bsc#1275737).\n- scsi: qla2xxx: Declare qla2xxx_mqueuecommand() static (bsc#1275737).\n- scsi: qla2xxx: Use nr_cpu_ids instead of NR_CPUS for qp_cpu_map allocation (bsc#1275737).\n- scsi: storvsc: Support manual scans for all Hyper-V targets (git-fixes).\n- sctp: avoid auth_enable sysctl UAF during netns teardown (git-fixes).\n- selftests/alsa: Fix the step check for INTEGER controls (git-fixes).\n- serial: 8250_dma: Clear stale RX state on shutdown (git-fixes).\n- serial: amba-pl011: unprepare console clock on unregister (git-fixes).\n- serial: core: clear freed pointers on uart_register_driver() failure (git-fixes).\n- serial: imx: serialize imx_uart_ports lifetime (git-fixes).\n- serial: ma35d1: Fix OF node reference leaks in console init (git-fixes).\n- serial: qcom-geni: do not advance stale DMA completions (git-fixes).\n- serial: qcom-geni: fix TX DMA buffer flush (git-fixes).\n- serial: sc16is7xx: enable THRI before filling TX FIFO (git-fixes).\n- serial: sc16is7xx: rename EFR mutex with generic name (stable-fixes).\n- serial: sc16is7xx: use guards for simple mutex locks (stable-fixes).\n- slab.h: disable completely broken overflow handling in flex allocations (bsc#1280139).\n- slab: Introduce kmalloc_flex() and family (bsc#1280139).\n- slab: Introduce kmalloc_obj() and family (bsc#1280139).\n- slab: recognize @GFP parameter as optional in kernel-doc (bsc#1280139).\n- smb/client: handle overlapping allocated ranges in fallocate (bsc#1274902).\n- smb: client: harden POSIX SID length parsing (bsc#1273557).\n- smb: client: require net admin for CIFS SWN netlink (bsc#1273966).\n- smb: client: resolve SWN tcon from live registrations (bsc#1273872).\n- soc: fsl: qe: check platform_driver_register() in qe_ic_of_init() (git-fixes).\n- soc: qcom: rpmh-rsc: manage PM notifiers with devres (git-fixes).\n- soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() (git-fixes).\n- software node: Fix software_node_get_reference_args() with index -1 (git-fixes).\n- soundwire: qcom: Fix port exhaustion check in stream_alloc_ports (git-fixes).\n- speakup: keyhelp: guard letter_offsets possible out-of-range indexing (git-fixes).\n- spi: bcm63xx-hsspi: disable clocks on resume failure (git-fixes).\n- spi: bcm63xx: disable clock on resume failure (git-fixes).\n- spi: bcmbca-hsspi: disable clocks on resume failure (git-fixes).\n- spi: davinci: switch to managed controller allocation (git-fixes).\n- spi: Fix DMA mapping ownership on partial map failure (git-fixes).\n- spi: img-spfi: don't disable runtime PM on DMA deferred probe (git-fixes).\n- spi: oc-tiny: switch to managed controller allocation (git-fixes).\n- spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX (git-fixes).\n- spi: spi-cadence: Move TX FIFO full busy-wait into FIFO (git-fixes).\n- spi: spi-cadence: supports transmission with bits_per_word of 16 and 32 (stable-fixes).\n- spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers (stable-fixes).\n- spi: sprd-adi: Fix probe succeeding without registering the controller (git-fixes).\n- staging: fbtft: Use sysfs_emit_at() to print to sysfs file (git-fixes).\n- staging: media: tegra-video: fix of_node_put() on VIP parse errors (git-fixes).\n- staging: media: tegra-video: vi: fix probe failure on skipped last port (git-fixes).\n- staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown (git-fixes).\n- staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() (git-fixes).\n- staging: rtl8723bs: fix missing shared-key auth challenge length check (git-fixes).\n- staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() (git-fixes).\n- staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() (git-fixes).\n- staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() (git-fixes).\n- staging: rtl8723bs: fix OOB read in WMM_param_handler() (git-fixes).\n- staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() (git-fixes).\n- staging: rtl8723bs: use kfree_sensitive() for key material (git-fixes).\n- staging: rtl8723bs: validate monitor transmit frame lengths (git-fixes).\n- staging: sm750fb: Add missing Kconfig dependency (git-fixes).\n- staging: sm750fb: gate dualview dataflow using g_dualview (git-fixes).\n- thermal/drivers/imx: Disable clock on runtime resume failure (git-fixes).\n- thermal/drivers/qoriq: Disable clock on resume failure (git-fixes).\n- thermal/drivers/rcar: Fix error checking in probe() (git-fixes).\n- thermal: intel: int3400: clean up ODVP on probe failures (git-fixes).\n- thermal: sysfs: switch to use scnprintf() to suppress truncation warning (git-fixes).\n- thunderbolt: Bound the DROM dual link port number before indexing sw-\u003eports (git-fixes).\n- thunderbolt: Fix bandwidth group reservation indexing (git-fixes).\n- thunderbolt: icm: Preserve USB4 proxy data-valid bit (git-fixes).\n- tlclk: if sscanf() fails, fall back to 0, not random value (git-fixes).\n- tpm: st33zp24: Return zero on status read failure (git-fixes).\n- tpm: st33zp24: Validate locality read result (git-fixes).\n- tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout (git-fixes).\n- tty: clear cdev pointer after cdev_add() failure (git-fixes).\n- tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 (git-fixes).\n- tty: skip cdev_del() when no cdev is registered (git-fixes).\n- uio: Fix stale info pointer in failed registration path (git-fixes).\n- usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() (git-fixes).\n- usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect (git-fixes).\n- usb: atm: usbatm: fix invalid ci_range initialization (git-fixes).\n- USB: c67x00: fix use-after-free in c67x00_add_iso_urb() (git-fixes).\n- usb: cdnsp: fix incorrect endian conversions for APB timeout register (git-fixes).\n- usb: core: Add lock to usb_wakeup_notification() (git-fixes).\n- usb: core: Add lock to usb_wakeup_notification() (stable-fixes).\n- usb: core: Strengthen error handling in hub_hub_status() (git-fixes).\n- usb: core: Strengthen error handling in hub_hub_status() (stable-fixes).\n- usb: core: sysfs: add lock to bos_descriptors_read() (stable-fixes).\n- usb: dwc2: add missing @remotewakeup kernel-doc parameter (git-fixes).\n- usb: dwc2: gadget: Exit partial power down state when changing USB pull-up (git-fixes).\n- usb: dwc3: clear forceRM when issuing EndTransfer (git-fixes).\n- usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition (git-fixes).\n- usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns() (git-fixes).\n- usb: fix UAF when probe runs concurrent to dyn ID removal (git-fixes).\n- usb: gadget: aspeed_udc: check endpoint DMA allocation (git-fixes).\n- usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed (git-fixes).\n- usb: gadget: configfs: fix out-of-bounds read of qw_sign (git-fixes).\n- usb: gadget: f_fs: Fix fence cleanup in ffs_dmabuf_transfer() error paths (git-fixes).\n- usb: gadget: f_fs: Prevent deadlock during ep0 read loop (git-fixes).\n- usb: gadget: f_midi: initialize work in f_midi_alloc() (git-fixes).\n- usb: gadget: f_ncm: Use unsigned int for ndp_index (git-fixes).\n- usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() (git-fixes).\n- usb: gadget: f_uac1_legacy: remove broken string configfs attributes (git-fixes).\n- usb: gadget: fix null pointer dereference in usb_put_function_instance() (git-fixes).\n- USB: gadget: fsl-udc: fix dev_printk() device (git-fixes).\n- usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs (git-fixes).\n- usb: gadget: midi2: remove default configfs groups on teardown (git-fixes).\n- usb: gadget: pch_udc: remove excess kernel-doc member for registered (git-fixes).\n- usb: gadget: r8a66597: avoid double free of ep0_req in probe error path (git-fixes).\n- usb: gadget: snps_udc_plat: clean up PHY on probe deferral (git-fixes).\n- usb: gadget: u_audio: Fix use-after-free on sound card disconnect (git-fixes).\n- usb: gadget: uac: validate rate list length before storing (git-fixes).\n- USB: gadget: Use str_enable_disable-like helpers (stable-fixes).\n- usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() (git-fixes).\n- usb: ljca: bound bank_num in ljca_enumerate_gpio() (git-fixes).\n- usb: mtu3: allow system suspend during active gadget connection (git-fixes).\n- usb: musb: omap2430: clean up probe error handling (stable-fixes).\n- usb: musb: omap2430: Do not put borrowed of_node in probe (git-fixes).\n- usb: musb: omap2430: Fix use-after-free in omap2430_probe() (git-fixes).\n- USB: phy: fsl-usb: fix missing static keywords (git-fixes).\n- usb: renesas_usbhs: Fix power-off ordering on unbind (git-fixes).\n- USB: serial: digi_acceleport: fix port registration order (git-fixes).\n- USB: serial: ftdi_sio: add support for E+H FXA291 (stable-fixes).\n- USB: serial: option: add TDTECH MT5710-CN (stable-fixes).\n- USB: serial: option: fix slab OOB read in interrupt URB callback (git-fixes).\n- USB: serial: spcp8x5: drop broken carrier detect support (git-fixes).\n- USB: storage: add NO_ATA_1X quirk for Longmai USB Key (stable-fixes).\n- usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop (git-fixes).\n- usb: typec: qcom-pmic-typec: drain cc_debounce_dwork if port_start() fails (git-fixes).\n- usb: typec: qcom-pmic: cancel reset_work on stop (git-fixes).\n- usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive() (git-fixes).\n- usb: typec: thunderbolt: Disable work before freeing tbt on remove (git-fixes).\n- usb: typec: ucsi: displayport: Fix OOB altmode array index (git-fixes).\n- usb: typec: ucsi: unregister debugfs entries on teardown (git-fixes).\n- usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion (git-fixes).\n- usb: usbfs: fix use-after-free of usb_device in usbdev_release() (git-fixes).\n- usb: usbtest: disable dynamic ID support (stable-fixes).\n- usb: xhci: Handle USB3 port events when there is one roothub (git-fixes).\n- vfs: Add a sysctl for automated deletion of dentry (bsc#1240890 bsc#1276586).\n- vt: add permission check for KDSKBMETA ioctl (stable-fixes).\n- vt: stabilize tty reference in kbd_keycode with tty_port_tty_get (stable-fixes).\n- w1: ds28e17: reject an oversize length on an I2C block read (git-fixes).\n- w1: ds2482: Fix signedness bug in ds2482_w1_triplet() (git-fixes).\n- watchdog: bd96801_wdt: Fix timeout for enabled WDG (git-fixes).\n- watchdog: fix hrtimer start when pretimeout is zero (git-fixes).\n- watchdog: msc313e: Avoid division by zero (git-fixes).\n- watchdog: msc313e: Enable clock before accessing hardware registers (git-fixes).\n- watchdog: msc313e: Fix clock leak and spurious timer in settimeout() (git-fixes).\n- watchdog: msc313e: Fix NULL pointer dereference in PM callbacks (git-fixes).\n- watchdog: msc313e: Fix spurious reset on suspend (git-fixes).\n- watchdog: msc313e: Fix undefined behavior (git-fixes).\n- watchdog: msc313e: Sync timeout value if WDT was running at boot (git-fixes).\n- watchdog: sunxi_wdt: preserve boot-enabled watchdog (git-fixes).\n- wifi: ath6kl: avoid buffer overreads in WMI event handlers (git-fixes).\n- wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets (git-fixes).\n- wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump (git-fixes).\n- wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() (git-fixes).\n- wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate (git-fixes).\n- wifi: ath11k: Correctly copy the hint BSSID in WMI scan request (git-fixes).\n- wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event() (git-fixes).\n- wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx() (git-fixes).\n- wifi: ath12k: Correctly copy the hint BSSID in WMI scan request (git-fixes).\n- wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() (git-fixes).\n- wifi: brcmfmac: fix P2P action frame handling without device vif (git-fixes).\n- wifi: brcmfmac: initialize SDIO data work before cleanup (git-fixes).\n- wifi: cfg80211: bound element ID read when checking non-inheritance (git-fixes).\n- wifi: cfg80211: cancel sched scan results work on unregister (git-fixes).\n- wifi: cfg80211: derive S1G beacon TSF from S1G fields (git-fixes).\n- wifi: cfg80211: reject unsupported PMSR FTM location requests (git-fixes).\n- wifi: cfg80211: validate PMSR FTM preamble range (git-fixes).\n- wifi: cfg80211: validate PMSR measurement type data (git-fixes).\n- wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() (git-fixes).\n- wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs (git-fixes).\n- wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments (git-fixes).\n- wifi: iwlwifi: mei: check SAP message length before reading it (git-fixes).\n- wifi: iwlwifi: mei: pass correct argument to function (git-fixes).\n- wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser (git-fixes).\n- wifi: libertas: fix memory leak in helper_firmware_cb() (git-fixes).\n- wifi: mac80211: disconnect on CSA to channel 0 (git-fixes).\n- wifi: mac80211: fix fils_discovery double free on alloc failure (git-fixes).\n- wifi: mac80211: fix per-STA profile length in cross-link CSA parsing (git-fixes).\n- wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure (git-fixes).\n- wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock (git-fixes).\n- wifi: mac80211: send TWT teardown to peer after setup TX failure (git-fixes).\n- wifi: mac80211: skip default WMM setup for AP_VLAN links (git-fixes).\n- wifi: mac80211: skip unused probe response countdown offsets (git-fixes).\n- wifi: mt76: check txfree done event on the WED hw path (git-fixes).\n- wifi: mt76: fix 4th chain ACK RSSI bitmask in sta_poll (git-fixes).\n- wifi: mt76: fix ER-SU 106-tone RU check in RX rate decode (git-fixes).\n- wifi: mt76: fix HE DCM max-RU capability encoding (git-fixes).\n- wifi: mt76: fix non-AQL packet accounting for MLO stations (git-fixes).\n- wifi: mt76: fix stranded frames in mt76_txq_schedule_pending (git-fixes).\n- wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length (git-fixes).\n- wifi: mt76: mt792x: Fix memory leak in SDIO TX path (git-fixes).\n- wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete (git-fixes).\n- wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex (git-fixes).\n- wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss (git-fixes).\n- wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear (git-fixes).\n- wifi: mt76: mt7915: fix double hif2 init on the non-WED path (git-fixes).\n- wifi: mt76: mt7915: fix ext PHY use-after-free on register error path (git-fixes).\n- wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986 (git-fixes).\n- wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie (git-fixes).\n- wifi: mt76: mt7915: release hif2 reference on probe IRQ failure (git-fixes).\n- wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement (git-fixes).\n- wifi: mt76: mt7915: unwind state on add_interface failure (git-fixes).\n- wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields (git-fixes).\n- wifi: mt76: mt7915: write RX header translation bit to the correct register (git-fixes).\n- wifi: mt76: mt7921: skip unknown CLC firmware records (git-fixes).\n- wifi: mt76: mt7921: validate CLC firmware records (git-fixes).\n- wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb (git-fixes).\n- wifi: mt76: mt7925: fix msg len mismatch between driver and firmware (git-fixes).\n- wifi: mt76: mt7925: update clc before setting sar power table (git-fixes).\n- wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config (git-fixes).\n- wifi: mt76: mt7996: don't report a zero TX bitrate (git-fixes).\n- wifi: mt76: mt7996: fix capability of EHT-MCS 15 in MRU (git-fixes).\n- wifi: mt76: mt7996: fix reg addr remap when addr is 0 (git-fixes).\n- wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV (git-fixes).\n- wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset (git-fixes).\n- wifi: mt76: mt7996: validate RX band_idx before dereferencing phys (git-fixes).\n- wifi: mt76: only consume the WO drop bit on WED v2 devices (git-fixes).\n- wifi: mt76: report data NSS for STBC frames in RX rate decode (git-fixes).\n- wifi: mwifiex: Detach sync cmd buffer on interrupted wait (git-fixes).\n- wifi: nl80211: free RNR data on MBSSID mismatch (git-fixes).\n- wifi: nl80211: validate nested MBSSID IE blobs (git-fixes).\n- wifi: p54: validate RX frame length in p54_rx_eeprom_readback() (git-fixes).\n- wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop (git-fixes).\n- wifi: rtl818x: initialize eeprom_93cx6 struct to zero (git-fixes).\n- wifi: rtlwifi: pci: fix error path in rtl_pci_probe() (git-fixes).\n- wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids (git-fixes).\n- wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars() (git-fixes).\n- wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() (git-fixes).\n- wifi: rtw88: pci: fix resource leak on failed NAPI setup (git-fixes).\n- wifi: rtw89: fix HE extended capability length check (git-fixes).\n- wifi: zd1211rw: reject secondary interfaces to prevent conflicts (git-fixes).\n- x86/virt/tdx: Print TDX module version during init (git-fixes).\n- x86/virt/tdx: Retrieve TDX module version (git-fixes).\n- xhci: dbgtty: Fix unregister on tty_alloc_driver() failure (git-fixes).\n- xhci: dbgtty: Fix unregister on tty_register_driver() failure (git-fixes).\n- xhci: fix lost bounce buffers on TDs spanning several ring segments (git-fixes).\n","status":"published","published":"2026-09-22T14:23:31Z","modified":"2026-09-30T18:23:11.253192518Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23897-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).\n- CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).\n- CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).\n- CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).\n- CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).\n- CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).\n- CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).\n- CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).\n- CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).\n- CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).\n- CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).\n- CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).\n- CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).\n- CVE-2026-43239: smb: client: prevent races in -\u003equery_interfaces() (bsc#1264444).\n- CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).\n- CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).\n- CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).\n- CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).\n- CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).\n- CVE-2026-43416: powerpc, perf: Check that current-\u003emm is alive before getting user callchain (bsc#1265121).\n- CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).\n- CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).\n- CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).\n- CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).\n- CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).\n- CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).\n- CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).\n- CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).\n- CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).\n- CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).\n- CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).\n- CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).\n- CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).\n- CVE-2026-52912: netfilter: nf_queue: hold bridge skb-\u003edev while queued (bsc#1269000).\n- CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).\n- CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).\n- CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).\n- CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).\n- CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).\n- CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).\n- CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).\n- CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).\n- CVE-2026-52991: sched/psi: fix race between file release and pressure write (bsc#1269134).\n- CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).\n- CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).\n- CVE-2026-53031: bpf: Validate node_id in arena_alloc_pages() (bsc#1269380).\n- CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).\n- CVE-2026-53034: bpf, sockmap: Fix af_unix null-ptr-deref in proto update (bsc#1269140).\n- CVE-2026-53048: gfs2: prevent NULL pointer dereference during unmount (bsc#1269162).\n- CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).\n- CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).\n- CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).\n- CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).\n- CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).\n- CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).\n- CVE-2026-53092: bpf: Fix linked reg delta tracking when src_reg == dst_reg (bsc#1269528).\n- CVE-2026-53094: bpf: Fix stale offload-\u003eprog pointer after constant blinding (bsc#1269965).\n- CVE-2026-53096: bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path (bsc#1269969).\n- CVE-2026-53109: powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy (bsc#1269417).\n- CVE-2026-53110: s390: always declare expoline thunks (bsc#1269985).\n- CVE-2026-53111: bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap (bsc#1269167).\n- CVE-2026-53114: perf: Extend the bit width of the arch-specific flag (bsc#1269999).\n- CVE-2026-53126: blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() (bsc#1269635).\n- CVE-2026-53129: fs/mbcache: cancel shrink work before destroying the cache (bsc#1269633).\n- CVE-2026-53142: drm/xe/display: fix oops in suspend/shutdown without display (bsc#1269402).\n- CVE-2026-53154: mm/hugetlb: restore reservation on error in hugetlb folio copy paths (bsc#1269665).\n- CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (bsc#1269306).\n- CVE-2026-53180: timers/migration: Fix livelock in tmigr_handle_remote_up() (bsc#1269888).\n- CVE-2026-53207: mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison (bsc#1269590).\n- CVE-2026-53219: netfilter: x_tables: avoid leaking percpu counter pointers (bsc#1269686).\n- CVE-2026-53220: netfilter: revalidate bridge ports (bsc#1269381).\n- CVE-2026-53223: net: guard timestamp cmsgs to real error queue skbs (bsc#1269301).\n- CVE-2026-53228: ipv6: sit: reload inner IPv6 header after GSO offloads (bsc#1269256).\n- CVE-2026-53238: netlabel: validate unlabeled address and mask attribute lengths (bsc#1269774).\n- CVE-2026-53264: net/sched: act_api: use RCU with deferred freeing for action lifecycle (bsc#1269238).\n- CVE-2026-53269: netfilter: synproxy: add mutex to guard hook reference counting (bsc#1269579).\n- CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).\n- CVE-2026-53291: ALSA: hda/conexant: Fix missing error check for jack detection (bsc#1269697).\n- CVE-2026-53309: ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison (bsc#1269815).\n- CVE-2026-53330: drm/amd/display: Fix out-of-bounds read in (bsc#1270090).\n- CVE-2026-53336: nvmem: layouts: onie-tlv: fix hang on unknown types (bsc#1270108).\n- CVE-2026-53337: net: bonding: fix NULL pointer dereference in bond_do_ioctl() (bsc#1270251).\n- CVE-2026-53341: fhandle: fix UAF due to unlocked -\u003emnt_ns read in may_decode_fh() (bsc#1270139).\n- CVE-2026-53353: hsr: Remove WARN_ONCE() in hsr_addr_is_self() (bsc#1270111).\n- CVE-2026-53365: vsock/virtio: fix zerocopy completion for multi-skb sends (bsc#1271365).\n- CVE-2026-63801: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (bsc#1272230).\n- CVE-2026-63803: hdlc_ppp: sync per-proto timers before freeing hdlc state (bsc#1272284).\n- CVE-2026-63804: gfs2: fix use-after-free in gfs2_qd_dealloc (bsc#1272287).\n- CVE-2026-63808: exfat: fix potential use-after-free in exfat_find_dir_entry() (bsc#1272260).\n- CVE-2026-63810: block: Avoid mounting the bdev pseudo-filesystem in userspace (bsc#1272297).\n- CVE-2026-63823: keys: Pin request_key_auth payload in instantiate paths (bsc#1272182).\n- CVE-2026-63828: apparmor: mediate the implicit connect of TCP fast open sendmsg (bsc#1272175).\n- CVE-2026-63860: RDMA/core: Prefer NLA_NUL_STRING (bsc#1272429).\n- CVE-2026-63865: bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks (bsc#1272486).\n- CVE-2026-63868: net: garp: fix unsigned integer underflow in garp_pdu_parse_attr (bsc#1272497).\n- CVE-2026-63879: drm/amdgpu: fix amdgpu_hmm_range_get_pages (bsc#1272569).\n- CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272385).\n- CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272390).\n- CVE-2026-63889: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (bsc#1272423).\n- CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).\n- CVE-2026-63891: thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() (bsc#1272641).\n- CVE-2026-63901: USB: serial: digi_acceleport: fix memory corruption with small endpoints (bsc#1272501).\n- CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1272904).\n- CVE-2026-63918: l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (bsc#1272905).\n- CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1272877).\n- CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1272918).\n- CVE-2026-63922,CVE-2026-63924: ipv6: exthdrs: refresh nh after handling HAO option (bsc#1272855).\n- CVE-2026-63925: macsec: fix replay protection at XPN lower-PN wrap (bsc#1273008).\n- CVE-2026-63926: bpf: sockmap: fix tail fragment offset in bpf_msg_push_data (bsc#1273019).\n- CVE-2026-63941: KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor (bsc#1272869).\n- CVE-2026-63969: ipv6: fix possible infinite loop in rt6_fill_node() (bsc#1272484).\n- CVE-2026-63970: vsock/virtio: bind uarg before filling zerocopy skb (bsc#1272673).\n- CVE-2026-63984: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (bsc#1272865).\n- CVE-2026-63985: ethtool: eeprom: add more safeties to EEPROM Netlink fallback (bsc#1272963).\n- CVE-2026-63986: ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on prepare failure (bsc#1272969).\n- CVE-2026-63987: ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES (bsc#1272971).\n- CVE-2026-63990: bonding: refuse to enslave CAN devices (bsc#1273027).\n- CVE-2026-63992: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (bsc#1272868).\n- CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847).\n- CVE-2026-63995: ethtool: cmis: validate start_cmd_payload_size from module (bsc#1273033).\n- CVE-2026-63996: ethtool: cmis: require exact CDB reply length (bsc#1273032).\n- CVE-2026-63997: ethtool: module: avoid leaking a netdev ref on module flash errors (bsc#1273036).\n- CVE-2026-63998: ethtool: module: call ethnl_ops_complete() on module flash errors (bsc#1273037).\n- CVE-2026-63999: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure (bsc#1273038).\n- CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273030).\n- CVE-2026-64002: ipv4: free net-\u003eipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (bsc#1273774).\n- CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782).\n- CVE-2026-64004: net/iucv: fix locking in .getsockopt (bsc#1273804).\n- CVE-2026-64005: net/smc: Do not re-initialize smc hashtables (bsc#1273831).\n- CVE-2026-64006: netfilter: nf_tables: fix dst corruption in same register operation (bsc#1273834).\n- CVE-2026-64007: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (bsc#1273105).\n- CVE-2026-64017: blk-mq: pop cached request if it is usable (bsc#1273770).\n- CVE-2026-64024: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (bsc#1273107).\n- CVE-2026-64033: RDMA/rtrs: Fix use-after-free in path file creation cleanup (bsc#1273134).\n- CVE-2026-64047: net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (bsc#1273060).\n- CVE-2026-64048: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (bsc#1273484).\n- CVE-2026-64052: block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user() (bsc#1272983).\n- CVE-2026-64053: block: don't overwrite bip_vcnt in bio_integrity_copy_user() (bsc#1272985).\n- CVE-2026-64054: net: shaper: reject duplicate leaves in GROUP request (bsc#1272894).\n- CVE-2026-64055: net: ethernet: cortina: Carry over frag counter (bsc#1272893).\n- CVE-2026-64056: net: ethernet: cortina: Make RX SKB per-port (bsc#1272502).\n- CVE-2026-64071: nvme-pci: fix use-after-free in nvme_free_host_mem() (bsc#1273486).\n- CVE-2026-64073: irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT (bsc#1273490).\n- CVE-2026-64088: batman-adv: tt: fix negative tt_buff_len (bsc#1273463).\n- CVE-2026-64089: batman-adv: tt: fix negative last_changeset_len (bsc#1272513).\n- CVE-2026-64093: batman-adv: tp_meter: directly shut down timer on cleanup (bsc#1273461).\n- CVE-2026-64099: drm/v3d: Fix use-after-free of CPU job query arrays on error path (bsc#1273465).\n- CVE-2026-64102: RDMA/siw: Reject MPA FPDU length underflow before signed receive math (bsc#1272516).\n- CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759).\n- CVE-2026-64109: af_unix: Fix UAF read of tail-\u003elen in unix_stream_data_wait() (bsc#1273748).\n- CVE-2026-64111: lsm: hold cred_guard_mutex for lsm_set_self_attr() (bsc#1273740).\n- CVE-2026-64112: rbd: eliminate a race in lock_dwork draining on unmap (bsc#1273741).\n- CVE-2026-64113: ixgbevf: fix use-after-free in VEPA multicast source pruning (bsc#1272262).\n- CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl \u003c 5 (bsc#1273742).\n- CVE-2026-64115: vsock/vmci: fix UAF when peer resets connection during handshake (bsc#1273745).\n- CVE-2026-64118: qed: fix double free in qed_cxt_tables_alloc() (bsc#1273749).\n- CVE-2026-64119: l2tp: use list_del_rcu in l2tp_session_unhash (bsc#1273746).\n- CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273743).\n- CVE-2026-64125: net: bcmgenet: keep RBUF EEE/PM disabled (bsc#1272346).\n- CVE-2026-64131: mm/memory: fix spurious warning when unmapping device-private/exclusive pages (bsc#1274063).\n- CVE-2026-64146: erofs: fix metabuf leak in inode xattr initialization (bsc#1273681).\n- CVE-2026-64147: pds_core: fix debugfs_lookup dentry leak and error handling (bsc#1273119).\n- CVE-2026-64148: pds_core: fix error handling in pdsc_devcmd_wait (bsc#1273956).\n- CVE-2026-64162: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (bsc#1272366).\n- CVE-2026-64164: btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() (bsc#1273957).\n- CVE-2026-64177: phonet/pep: disable BH around forwarded sk_receive_skb() (bsc#1272148).\n- CVE-2026-64179: net: wwan: iosm: fix potential memory leaks in ipc_imem_init() (bsc#1272149).\n- CVE-2026-64180: mm/memory_hotplug: fix memory block reference leak on remove (bsc#1273679).\n- CVE-2026-64184: mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() (bsc#1272199).\n- CVE-2026-64185: sysfs: don't remove existing directory on update failure (bsc#1272200).\n- CVE-2026-64190: net: team: fix NULL pointer dereference in team_xmit during mode change (bsc#1272210).\n- CVE-2026-64192: bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized (bsc#1272213).\n- CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899).\n- CVE-2026-64214: powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise()\n  (bsc#1272799).\n- CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272798).\n- CVE-2026-64222: octeontx2-pf: avoid double free of pool-\u003estack on AQ init failure (bsc#1272788).\n- CVE-2026-64224: octeontx2-pf: fix double free in rvu_rep_rsrc_init() (bsc#1272804).\n- CVE-2026-64225: octeontx2-af: CGX: add bounds check to cgx_speed_mbps index (bsc#1272786).\n- CVE-2026-64232: block: recompute nr_integrity_segments in blk_insert_cloned_request (bsc#1272791).\n- CVE-2026-64239: mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() (bsc#1273898).\n- CVE-2026-64244: drivers/base/memory: set mem-\u003ealtmap after successful device registration (bsc#1273812).\n- CVE-2026-64253: kernel/fork: clear PF_BLOCK_TS in copy_process() (bsc#1273904).\n- CVE-2026-64256: xfs: don't wrap around quota ids in dqiterate (bsc#1273271).\n- CVE-2026-64265: fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (bsc#1273947).\n- CVE-2026-64268: RDMA/siw: bound Read Response placement to the RREAD length (bsc#1273276).\n- CVE-2026-64269: RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg (bsc#1273280).\n- CVE-2026-64283: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values (bsc#1273870).\n- CVE-2026-64286: KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU (bsc#1274058).\n- CVE-2026-64287: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (bsc#1273325).\n- CVE-2026-64294: mm: do file ownership checks with the proper mount idmap (bsc#1273525).\n- CVE-2026-64296: exfat: bound uniname advance in exfat_find_dir_entry() (bsc#1273975).\n- CVE-2026-64298: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (bsc#1273550).\n- CVE-2026-64300: perf/aux: Fix page UAF in map_range() (bsc#1273852).\n- CVE-2026-64307: crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG) (bsc#1273567).\n- CVE-2026-64315: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1274028).\n- CVE-2026-64316: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1273598).\n- CVE-2026-64317: isofs: bound Rock Ridge symlink components to the SL record (bsc#1273936).\n- CVE-2026-64319: nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339).\n- CVE-2026-64320: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420).\n- CVE-2026-64321: nvme: target: rdma: fix ndev refcount leak on queue connect (bsc#1273864).\n- CVE-2026-64322: udf: validate sparing table length as an entry count, not a byte count (bsc#1273958).\n- CVE-2026-64323: udf: validate VAT header length against the VAT inode size (bsc#1273305).\n- CVE-2026-64326: block: skip sync_blockdev() on surprise removal in bdev_mark_dead() (bsc#1273312).\n- CVE-2026-64327: usb: gadget: f_fs: Initialize epfile-\u003ein early to fix endpoint direction checks (bsc#1273283).\n- CVE-2026-64354: bpf: Validate BTF repeated field counts before expansion (bsc#1274060).\n- CVE-2026-64355: bpf: Reject fragmented frames in devmap (bsc#1273422).\n- CVE-2026-64364: HID: multitouch: fix out-of-bounds bit access on mt_io_flags (bsc#1273495).\n- CVE-2026-64368: mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (bsc#1273997).\n- CVE-2026-64373: cpufreq: Fix hotplug-suspend race during reboot (bsc#1273776).\n- CVE-2026-64375: proc: protect ptrace_may_access() with exec_update_lock (FD links) (bsc#1273868).\n- CVE-2026-64378: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (bsc#1273603).\n- CVE-2026-64381: smb: client: Fix next buffer leak in receive_encrypted_standard() (bsc#1273860).\n- CVE-2026-64382: smb: client: fix double-free in SMB2_open() replay (bsc#1273291).\n- CVE-2026-64383: smb: client: fix double-free in SMB2_flush() replay (bsc#1273426).\n- CVE-2026-64384: smb: client: fix change notify replay double-free (bsc#1274541).\n- CVE-2026-64385: smb: client: fix double-free in SMB2_ioctl() replay (bsc#1274539).\n- CVE-2026-64386: smb: client: fix query_info() replay double-free (bsc#1274543).\n- CVE-2026-64387: smb: client: fix query directory replay double-free (bsc#1274545).\n- CVE-2026-64411: netfilter: ebtables: terminate table name before find_table_lock() (bsc#1274077).\n- CVE-2026-64412: netfilter: ebtables: module names must be null-terminated (bsc#1273780).\n- CVE-2026-64415: mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent softlockup (bsc#1273317).\n- CVE-2026-64416: mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless host (bsc#1273286).\n- CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction (bsc#1274274).\n- CVE-2026-64434: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref (bsc#1273880).\n- CVE-2026-64436: net: af_key: initialize alg_key_len for IPComp states (bsc#1274277).\n- CVE-2026-64450: tipc: fix out-of-bounds read in broadcast Gap ACK blocks (bsc#1273523).\n- CVE-2026-64452: 6lowpan: fix NHC entry use-after-free on error path (bsc#1273460).\n- CVE-2026-64458: mm/damon/ops-common: handle extreme intervals in damon_hot_score() (bsc#1273788).\n- CVE-2026-64463: usb: typec: tcpci_rt1711h: unregister TCPCI port with devres (bsc#1273273).\n- CVE-2026-64472: vfio/mlx5: Fix racy bitfields and tighten struct layout (bsc#1274075).\n- CVE-2026-64477: x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled (bsc#1274264).\n- CVE-2026-64507: bpf: Support for hardening against JIT spraying (bsc#1273999).\n- CVE-2026-64518: tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key() (bsc#1273524).\n- CVE-2026-64519: NFSD: Fix infinite loop in layout state revocation (bsc#1274252).\n- CVE-2026-64526: ethtool: tsconfig: fix missing ethnl_ops_complete() (bsc#1274052).\n- CVE-2026-64534: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error (bsc#1273803).\n- CVE-2026-64535: nvmet-tcp: Fix potential UAF when ddgst mismatch (bsc#1273809).\n- CVE-2026-64537: bridge: cfm: reject invalid CCM interval at configuration time (bsc#1273289).\n- CVE-2026-64538: ipv6: Fix null-ptr-deref in fib6_nh_mtu_change() (bsc#1273335).\n- CVE-2026-64541: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (bsc#1273303).\n- CVE-2026-64542: ipv6: ndisc: fix NULL deref in accept_untracked_na() (bsc#1273309).\n- CVE-2026-64543: tipc: fix use-after-free of the discoverer in tipc_disc_rcv() (bsc#1273311).\n- CVE-2026-64545: net, bpf: check master for NULL in xdp_master_redirect() (bsc#1273318).\n- CVE-2026-64548: bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() (bsc#1273337).\n- CVE-2026-64551: sctp: validate STALE_COOKIE cause length before reading staleness (bsc#1273813).\n- CVE-2026-64552: virtio-net: fix len check in receive_big() (bsc#1273323).\n- CVE-2026-64553: net: psample: fix info leak in PSAMPLE_ATTR_DATA (bsc#1273336).\n- CVE-2026-64554: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() (bsc#1273340).\n- CVE-2026-64555: KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops() (bsc#1273331).\n- CVE-2026-64556: perf/core: Detach event groups during remove_on_exec (bsc#1273251).\n- CVE-2026-64563: rhashtable: clear stale iter-\u003ep on table restart (bsc#1273995).\n- CVE-2026-64567: btrfs: reject free space cache with more entries than pages (bsc#1274006).\n- CVE-2026-64569: mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n (bsc#1274009).\n- CVE-2026-64572: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (bsc#1274014).\n- CVE-2026-64576: nexthop: initialize extack in nh_res_bucket_migrate() (bsc#1274030).\n- CVE-2026-64577: gtp: check skb_pull_data() return in gtp1u_send_echo_resp() (bsc#1274031).\n- CVE-2026-64579: xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert (bsc#1274036).\n- CVE-2026-64581: xfrm: fix sk_dst_cache double-free in xfrm_user_policy() (bsc#1274041).\n- CVE-2026-64582: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (bsc#1274040).\n- CVE-2026-64586: wifi: brcmfmac: drain bus_reset work on device removal (bsc#1274492).\n- CVE-2026-68082: libceph: fix two unsafe bare decodes in decode_lockers() (bsc#1274581).\n- CVE-2026-68086: mm/khugepaged: write all dirty file folios when collapsing (bsc#1274713).\n- CVE-2026-68096: audit: fix recursive locking deadlock in audit_dupe_exe() (bsc#1274730).\n- CVE-2026-68105: drm/amdgpu: Fix kernel panic during driver load failure (bsc#1274849).\n- CVE-2026-68116: vxlan: mdb: Fix source list corruption on a failed replace (bsc#1274876).\n- CVE-2026-68117: tipc: clear sock-\u003esk on the failed-insert path in tipc_sk_create() (bsc#1274881).\n- CVE-2026-68120: rtase: Workaround for TX hang caused by hardware packet parsing (bsc#1274887).\n- CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1274888).\n- CVE-2026-68123: openvswitch: fix GSO userspace truncation underflow (bsc#1275169).\n- CVE-2026-68124: mctp: serial: handle zero-length frames to prevent rx buffer overflow (bsc#1275192).\n- CVE-2026-68127: ila: reload IPv6 header after pskb_may_pull in checksum adjust (bsc#1275237).\n- CVE-2026-68128: ice: reject out-of-range ptype in ice_parser_profile_init (bsc#1275238).\n- CVE-2026-68129: gve: fix Rx queue stall on alloc failure (bsc#1275517).\n- CVE-2026-68132: super: fix emergency thaw deadlock on frozen block devices (bsc#1275553).\n- CVE-2026-68133: ice: fix PTP Call Trace during PTP release (bsc#1275555).\n- CVE-2026-68135: net: hip04: fix RX buffer leak on build_skb failure (bsc#1275557).\n- CVE-2026-68136: net: gro: fix double aggregation of flush-marked skbs (bsc#1275474).\n- CVE-2026-68138: net/sched: serialize qdisc_rtab_list against concurrent get/put (bsc#1274941).\n- CVE-2026-68139: net/mlx5e: Use sender devcom for MPV master-up (bsc#1275578).\n- CVE-2026-68141: net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() (bsc#1275094).\n- CVE-2026-68142: geneve: require CAP_NET_ADMIN in the device netns for changelink (bsc#1275582).\n- CVE-2026-68143: net: slip: serialize receive against buffer reallocation (bsc#1275583).\n- CVE-2026-68144: phonet: pep: fix use-after-free in pep_get_sb() (bsc#1275481).\n- CVE-2026-68145: iomap: fix out-of-bounds bitmap_set() with zero-length range (bsc#1275584).\n- CVE-2026-68148: fscrypt: Add missing superblock check in find_or_insert_direct_key() (bsc#1275588).\n- CVE-2026-68149: fs: preserve ACL_DONT_CACHE state in forget_cached_acl() (bsc#1275294).\n- CVE-2026-68152: amt: fix use-after-free in AMT delayed works (bsc#1275300).\n- CVE-2026-68153: libceph: remove debugfs files before client teardown (bsc#1275301).\n- CVE-2026-68154: libceph: reject zero bucket types in crush_decode (bsc#1275303).\n- CVE-2026-68155: libceph: Reject monmaps advertising zero monitors (bsc#1275304).\n- CVE-2026-68156: libceph: refresh auth-\u003eauthorizer_buf{,_len} after authorizer update (bsc#1275305).\n- CVE-2026-68157: libceph: guard missing CRUSH type name lookup (bsc#1275306).\n- CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1275307).\n- CVE-2026-68159: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (bsc#1275470).\n- CVE-2026-68161: sctp: close UDP tunnel sockets during netns teardown (bsc#1274892).\n- CVE-2026-68164: mm/damon/core: disallow overlapping input ranges for damon_set_regions() (bsc#1274955).\n- CVE-2026-68165: mm/damon/core: validate ranges in damon_set_regions() (bsc#1274927).\n- CVE-2026-68166: userfaultfd: prevent registration of special VMAs (bsc#1274930).\n- CVE-2026-68169: mptcp: pm: userspace: fix use-after-free in get_local_id (bsc#1274952).\n- CVE-2026-68183: firmware: stratix10-svc: fix memory leaks and list corruption bugs (bsc#1274957).\n- CVE-2026-68198: wifi: ath6kl: fix use-after-free in aggr_reset_state() (bsc#1274803).\n- CVE-2026-68205: media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() (bsc#1274934).\n- CVE-2026-68238: drm/amdgpu: Release VFCT ACPI table reference (bsc#1275704).\n- CVE-2026-68258: drm/amdkfd: Check bounds on CRIU restore queue type and mqd size (bsc#1275866).\n- CVE-2026-68267: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (bsc#1275139).\n- CVE-2026-68273: drm/amdgpu: Fix context pstate override handling (bsc#1275129).\n- CVE-2026-68284: bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() (bsc#1275970).\n- CVE-2026-68286: drop_monitor: perform u64_stats updates under IRQ-disabled section (bsc#1275973).\n- CVE-2026-68288: net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD (bsc#1275975).\n- CVE-2026-68289: tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() (bsc#1275976).\n- CVE-2026-68293: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (bsc#1275091).\n- CVE-2026-68294: net: qrtr: restrict socket creation to the initial network namespace (bsc#1275092).\n- CVE-2026-68296: net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM (bsc#1275045).\n- CVE-2026-68297: tipc: fix u16 MTU truncation in media and bearer MTU validation (bsc#1275040).\n- CVE-2026-68299: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (bsc#1275088).\n- CVE-2026-68300: sctp: auth: verify auth requirement when auth_chunk is NULL (bsc#1275083).\n- CVE-2026-68302: amt: re-read skb header pointers after every pull (bsc#1275081).\n- CVE-2026-68313: tipc: fix infinite loop in __tipc_nl_compat_dumpit (bsc#1274665).\n- CVE-2026-68315: sctp: validate stream count in sctp_process_strreset_inreq() (bsc#1274662).\n- CVE-2026-68319: pds_core: fix deadlock between reset thread and remove (bsc#1274657).\n- CVE-2026-68320: sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid (bsc#1274659).\n- CVE-2026-68321: net: txgbe: fix FDIR filter leak on remove (bsc#1274652).\n- CVE-2026-68322: rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled (bsc#1274656).\n- CVE-2026-68325: iommu/amd: Bound the early ACPI HID map (bsc#1274651).\n- CVE-2026-68328: nfp: Check resource mutex allocation (bsc#1274646).\n- CVE-2026-68329: iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() (bsc#1274645).\n- CVE-2026-68331: dpaa2-eth: put MAC endpoint device on disconnect (bsc#1274642).\n- CVE-2026-68333: dpaa2-switch: put MAC endpoint device on disconnect (bsc#1274644).\n- CVE-2026-68335: rds: drop incoming messages that cross network namespace boundaries (bsc#1274640).\n- CVE-2026-68336: bonding: fix devconf_all NULL dereference when IPv6 is disabled (bsc#1274639).\n- CVE-2026-68338: net/packet: avoid fanout hook re-registration after unregister (bsc#1274637).\n- CVE-2026-68375: bnxt_en: Handle partially initialized auxiliary devices (bsc#1274835).\n- CVE-2026-68377: net/sched: act_tunnel_key: Defer dst_release to RCU callback (bsc#1274831).\n- CVE-2026-68386: bpf, sockmap: Reject unhashed UDP sockets on sockmap update (bsc#1274814).\n- CVE-2026-68393: Bluetooth: hci_sync: extend conn_hash lookup critical sections (bsc#1274904).\n- CVE-2026-68395: ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered (bsc#1274900).\n- CVE-2026-68397: net/iucv: take a reference on the socket found in afiucv_hs_rcv() (bsc#1274898).\n- CVE-2026-68398: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF (bsc#1274908).\n- CVE-2026-68399: bpf: Fix UAF in sock clone early bailouts (bsc#1274897).\n- CVE-2026-68408: wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (bsc#1274709).\n- CVE-2026-68417: RDMA/siw: publish QP after initialization (bsc#1274696).\n- CVE-2026-68418: RDMA/irdma: Prevent user-triggered null deref on QP create (bsc#1274690).\n- CVE-2026-68419: RDMA/irdma: Prevent rereg_mr for non-mem regions (bsc#1274698).\n- CVE-2026-68422: btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() (bsc#1274706).\n- CVE-2026-68425: IB/mad: Drop unmatched RMPP responses before reassembly (bsc#1274700).\n- CVE-2026-68426: xfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment (bsc#1274705).\n- CVE-2026-68432: vxlan: require CAP_NET_ADMIN in the device netns for changelink (bsc#1274800).\n- CVE-2026-68433: libceph: bound get_version reply decode to front len (bsc#1274801).\n- CVE-2026-68442: btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps (bsc#1274773).\n- CVE-2026-68448: ovl: check access to copy_file_range source with src mounter creds (bsc#1274838).\n- CVE-2026-68450: btrfs: free mapping node on duplicate reloc root insert (bsc#1274834).\n- CVE-2026-68470: wifi: mac80211: validate extension-frame layout before RX (bsc#1276500).\n- CVE-2026-68480: x86/bugs: Make Safe-RET robust against interrupt injection (bsc#1274208).\n- CVE-2026-72017: net: macb: drop in-flight Tx SKBs on close (bsc#1276840).\n- CVE-2026-72019: macsec: don't read an unset MAC header in macsec_encrypt() (bsc#1276865).\n- CVE-2026-72020: ipvs: reset full ip_vs_seq structs in ip_vs_conn_new (bsc#1275506).\n- CVE-2026-72022: llc: fix SAP refcount leak in llc_ui_autobind() (bsc#1276785).\n- CVE-2026-72023: octeontx2-pf: fix SQB pointer leak on init failure (bsc#1276793).\n- CVE-2026-72032: net/mlx5: HWS, fix matcher leak on resize target setup failure (bsc#1276955).\n- CVE-2026-72034: fhandle: reject detached mounts in capable_wrt_mount() (bsc#1276957).\n- CVE-2026-72035: net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1276961).\n- CVE-2026-72036: net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1277034).\n- CVE-2026-72045: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (bsc#1277078).\n- CVE-2026-72046: gve: fix header buffer corruption with header-split and HW-GRO (bsc#1275519).\n- CVE-2026-72051: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276801).\n- CVE-2026-72052: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276803).\n- CVE-2026-72053: net: ipip: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276814).\n- CVE-2026-72054: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276818).\n- CVE-2026-72055: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276821).\n- CVE-2026-72061: net: sit: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277249).\n- CVE-2026-72069: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (bsc#1275528).\n- CVE-2026-72072: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (bsc#1277155).\n- CVE-2026-72083: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (bsc#1275535).\n- CVE-2026-72084: scsi: target: core: Generate correct identifiers for PR OUT transport IDs (bsc#1275540).\n- CVE-2026-72100: dm-integrity: fix a bug if the bio is out of limits (bsc#1277311).\n- CVE-2026-72101: dm-integrity: fix leaking uninitialized kernel memory (bsc#1276831).\n- CVE-2026-72103: dm: avoid leaking the caller's thread keyring via the table device file (bsc#1277315).\n- CVE-2026-72106: dm-ioctl: fix a possible overflow in list_version_get_info (bsc#1277321).\n- CVE-2026-72107: dm era: fix out-of-bounds memory access for non-zero start sector (bsc#1277349).\n- CVE-2026-72108: dm thin metadata: fix metadata snapshot consistency on commit failure (bsc#1277350).\n- CVE-2026-72132: NFS: Charge unstable writes by request size, not folio size (bsc#1277551).\n- CVE-2026-72136: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277574).\n- CVE-2026-72137: xfrm: nat_keepalive: avoid double free on send error (bsc#1275587).\n- CVE-2026-72161: ocfs2: add journal NULL check in ocfs2_checkpoint_inode() (bsc#1277233).\n- CVE-2026-72163: ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits (bsc#1277231).\n- CVE-2026-72164: ocfs2: avoid moving extents to occupied clusters (bsc#1277553).\n- CVE-2026-72176: mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error (bsc#1277230).\n- CVE-2026-72177: mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs() (bsc#1277227).\n- CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1275655).\n- CVE-2026-72221: sunrpc: wait for in-flight TLS handshake callback when cancel loses race (bsc#1275665).\n- CVE-2026-72222: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (bsc#1275669).\n- CVE-2026-72234: batman-adv: access unicast_ttvn skb-\u003edata only after skb realloc (bsc#1275672).\n- CVE-2026-72242: selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (bsc#1277655).\n- CVE-2026-72243: selinux: check connect-related permissions on TCP Fast Open (bsc#1277656).\n- CVE-2026-72251: netfilter: nf_nat_sip: reload possible stale data pointer (bsc#1275827).\n- CVE-2026-72254: netfilter: nft_fib: reject fib expression on the netdev egress hook (bsc#1277204).\n- CVE-2026-72280: KVM: arm64: nv: Drop bogus WARN for write to ZCR_EL2 (bsc#1277726).\n- CVE-2026-72282: KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers (bsc#1277728).\n- CVE-2026-72288: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (bsc#1275886).\n- CVE-2026-72289: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (bsc#1275905).\n- CVE-2026-72296: net: ife: require ETH_HLEN to be pullable in ife_decode() (bsc#1275923).\n- CVE-2026-72297: net: atm: reject out-of-range traffic classes in QoS validation (bsc#1277738).\n- CVE-2026-72306: vduse: Requeue failed read to send_list head (bsc#1277748).\n- CVE-2026-72307: mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() (bsc#1277160).\n- CVE-2026-72308: mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() (bsc#1277159).\n- CVE-2026-72317: SUNRPC: pin upper rpc_clnt across the TLS connect_worker (bsc#1275925).\n- CVE-2026-72323: ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (bsc#1275985).\n- CVE-2026-72325: perf/x86/amd/core: Avoid enabling BRS from the SVM reload path (bsc#1277761).\n- CVE-2026-72330: net/tls: Consume empty data records in tls_sw_read_sock() (bsc#1277764).\n- CVE-2026-72337: Bluetooth: 6lowpan: avoid untracked enable work (bsc#1277773).\n- CVE-2026-72339: qede: fix off-by-one in BD ring consumption on build_skb failure (bsc#1276006).\n- CVE-2026-72341: net/mlx5e: Fix publication race for priv-\u003echannel_stats[] (bsc#1277660).\n- CVE-2026-72342: net/mlx5e: Fix HV VHCA stats agent registration race (bsc#1277775).\n- CVE-2026-72343: net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation (bsc#1277776).\n- CVE-2026-72345: net/mlx5: LAG, Fix off-by-one in single-FDB error rollback (bsc#1277782).\n- CVE-2026-72347: netfilter: xt_connmark: reject invalid shift parameters (bsc#1277783).\n- CVE-2026-72350: netfilter: xt_u32: reject invalid shift counts (bsc#1277822).\n- CVE-2026-72366: netfs: Fix netfs_create_write_req() to handle async cache object creation (bsc#1276333).\n- CVE-2026-72379: fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid (bsc#1277818).\n- CVE-2026-72389: bridge: stp: Fix a potential use-after-free when deleting a bridge (bsc#1273869).\n- CVE-2026-72398: sctp: add INIT verification after cookie unpacking (bsc#1276381).\n- CVE-2026-72399: net: enetc: check the number of BDs needed for xdp_frame (bsc#1276553).\n- CVE-2026-72414: net: dsa: sja1105: round up PTP perout pin duration (bsc#1278039).\n- CVE-2026-72421: ipv4: fib: Don't ignore error route in local/main tables (bsc#1277023).\n- CVE-2026-72425: ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (bsc#1277120).\n- CVE-2026-72430: net/sched: act_ct: fix nf_connlabels leak on two error paths (bsc#1277118).\n- CVE-2026-72437: md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry (bsc#1277874).\n- CVE-2026-72438: md/raid10: fix writes_pending and barrier reference leaks on discard failures (bsc#1277115).\n- CVE-2026-72439: md/raid10: fix writes_pending leak on write request failures (bsc#1277876).\n- CVE-2026-72440: md/raid1: fix writes_pending and barrier reference leaks on write failures (bsc#1277114).\n- CVE-2026-72448: octeontx2-pf: Fix leak of SQ timestamp buffer on teardown (bsc#1277108).\n- CVE-2026-72450: xfrm: validate selector family and prefixlen during match (bsc#1278113).\n- CVE-2026-72459: apparmor: aa_label_alloc use aa_label_free on alloc failure (bsc#1277092).\n- CVE-2026-72460: apparmor: check label build before no_new_privs test (bsc#1277229).\n- CVE-2026-72464: xprtrdma: Post receive buffers after RPC completion (bsc#1277069).\n- CVE-2026-72466: xprtrdma: Fix bcall rep leak and unbounded peek (bsc#1277057).\n- CVE-2026-72467: xprtrdma: Check frwr_wp_create() during connect (bsc#1277059).\n- CVE-2026-72468: xprtrdma: Initialize re_id before removal registration (bsc#1277062).\n- CVE-2026-72469: xprtrdma: Fix ep kref imbalance on ADDR_CHANGE (bsc#1277047).\n- CVE-2026-72473: xprtrdma: Avoid 250 ms delay on backlog wakeup (bsc#1277037).\n- CVE-2026-72485: coresight: platform: defer connection counter increment until alloc succeeds (bsc#1276771).\n- CVE-2026-72487: PCI: Introduce named defines for PCI ROM (bsc#1276767).\n- CVE-2026-72488: soundwire: fix bug in sdw_add_element_group_count found by syzkaller (bsc#1276766).\n- CVE-2026-72494: RDMA/irdma: Replace waitqueue and flag with completion (bsc#1276941).\n- CVE-2026-72495: RDMA/bnxt_re: Avoid repeated requests to allocate WC pages (bsc#1276937).\n- CVE-2026-72497: RDMA/bnxt_re: Add a max slot check for SQ (bsc#1276913).\n- CVE-2026-72499: RDMA/bnxt_re: Free CQ toggle page after firmware teardown (bsc#1276551).\n- CVE-2026-72500: RDMA/bnxt_re: Free SRQ toggle page after firmware teardown (bsc#1276552).\n- CVE-2026-72501: RDMA/bnxt_re: Initialize dpi variable to zero (bsc#1276546).\n- CVE-2026-72502: tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) (bsc#1276542).\n- CVE-2026-74255: tipc: fix UAF in tipc_l2_send_msg() (bsc#1276547).\n- CVE-2026-74261: ALSA: seq: avoid stale FIFO cells during resize (bsc#1276528).\n- CVE-2026-74269: bnxt: fix head underflow on XDP head-grow (bsc#1276507).\n- CVE-2026-74270: handshake: Require admin permission for DONE command (bsc#1276512).\n- CVE-2026-74282: tipc: prevent snt_unacked underflow on CONN_ACK (bsc#1276473).\n- CVE-2026-74284: net/sched: sch_hfsc: Don't make class passive twice (bsc#1276468).\n- CVE-2026-74286: net: pfcp: allocate per-cpu tstats for PFCP netdevs (bsc#1276471).\n- CVE-2026-74296: RDMA/mlx5: Release the HW-provided UAR index rather than the SW one (bsc#1276452).\n- CVE-2026-74297: RDMA/mlx5: Fix undefined shift of user RQ WQE size (bsc#1276446).\n- CVE-2026-74307: ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT (bsc#1276905).\n- CVE-2026-74308: ext4: fix kernel BUG in ext4_write_inline_data_end (bsc#1276880).\n- CVE-2026-74313: vduse: hold vduse_lock across IDR lookup in open path (bsc#1276876).\n- CVE-2026-74316: NFSD: Handle layout stid in nfsd4_drop_revoked_stid() (bsc#1276870).\n- CVE-2026-74317: ixgbe: do not configure xps for XDP queues (bsc#1276866).\n- CVE-2026-74318: btrfs: fix deadlock cloning inline extent when using flushoncommit (bsc#1276864).\n- CVE-2026-74321: btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() (bsc#1277202).\n- CVE-2026-74334: RDMA/nldev: Fix locking when accessing mr-\u003epd (bsc#1277095).\n- CVE-2026-74345: RDMA/siw: Fix endpoint/socket association handling (bsc#1277285).\n- CVE-2026-74346: RDMA/irdma: Fix OOB read during CQ MR registration (bsc#1278155).\n- CVE-2026-74349: ocfs2: reject FITRIM ranges shorter than a cluster (bsc#1278180).\n- CVE-2026-74363: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs (bsc#1278070).\n- CVE-2026-74375: md: replace wait loop with wait_event() in md_handle_request() (bsc#1277649).\n- CVE-2026-74377: RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path (bsc#1278236).\n- CVE-2026-74378: RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe (bsc#1278233).\n- CVE-2026-74382: net/sched: cls_bpf: prevent unbounded recursion in offload rollback (bsc#1278240).\n- CVE-2026-74388: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data (bsc#1278253).\n- CVE-2026-74390: RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs (bsc#1278088).\n- CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277408).\n- CVE-2026-74395: RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference (bsc#1277077).\n- CVE-2026-74397: IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier (bsc#1278098).\n- CVE-2026-74406: vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive() (bsc#1276395).\n- CVE-2026-74464: net: openvswitch: fix skb leak on flow key update failure during ct (bsc#1277070).\n- CVE-2026-74474: vxlan: use pskb_network_may_pull() for transmit path header pulls (bsc#1276335).\n- CVE-2026-74475: vxlan: unclone skb head before modifying eth header in route_shortcircuit() (bsc#1276339).\n- CVE-2026-74476: veth: convert frag_list skbs before running XDP (bsc#1276341).\n- CVE-2026-74479: net: pktgen: fix proc entry use-after-free (bsc#1276354).\n- CVE-2026-74481: mm/page_reporting: use system_freezable_wq to fix UAF during suspend (bsc#1276355).\n- CVE-2026-74482: mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios (bsc#1276346).\n- CVE-2026-74495: igbvf: Fix leak in TX DMA error cleanup (bsc#1275864).\n- CVE-2026-74496: fou: Fix use-after-free in fou_create() (bsc#1275867).\n- CVE-2026-74510: Bluetooth: mgmt: fix UAF in pair command cancellation (bsc#1275950).\n- CVE-2026-74512: audit: fix potential use-after-free in audit_del_rule() (bsc#1275954).\n- CVE-2026-74513: dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister (bsc#1275956).\n- CVE-2026-74517: KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs (bsc#1276258).\n- CVE-2026-74518: mm/hugetlb: fix list corruption in allocate_file_region_entries() (bsc#1275798).\n- CVE-2026-74523: qede: sync udp_tunnel ports outside qede_lock in the recovery path (bsc#1275802).\n- CVE-2026-74527: octeontx2-af: Block VFs from clobbering special CGX PKIND state (bsc#1275805).\n- CVE-2026-74533: Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero (bsc#1275804).\n- CVE-2026-74534: Bluetooth: ISO: Fix data-race on iso_pi(sk) in socket and HCI event paths (bsc#1275801).\n- CVE-2026-74535: Bluetooth: ISO: avoid deadlocks in iso_sock_timeout (bsc#1275812).\n- CVE-2026-74536: Bluetooth: ISO: fix leaking sk after socket release (bsc#1275799).\n- CVE-2026-74537: Bluetooth: ISO: hold sk properly in iso_conn_ready (bsc#1275687).\n- CVE-2026-74545: rtase: fix double free of multi-frag skb on DMA map failure (bsc#1275679).\n- CVE-2026-74548: forcedeth: fix UAF of txrx_stats in nv_remove (bsc#1275695).\n- CVE-2026-74550: net: do not send ICMP/NDISC Redirects when peer allocation fails (bsc#1275688).\n- CVE-2026-74555: scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race (bsc#1275690).\n- CVE-2026-74556: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (bsc#1275696).\n- CVE-2026-74557: scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer (bsc#1275685).\n- CVE-2026-74563: rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() (bsc#1275574).\n- CVE-2026-74566: keys: make keyring key-chunk byte order agree with keyring_diff_objects() (bsc#1275566).\n- CVE-2026-74567: keys: fix out-of-bounds read in keyring_get_key_chunk() (bsc#1275569).\n- CVE-2026-74571: btrfs: skip global block reserve accounting for rescue mounts (bsc#1275561).\n- CVE-2026-74577: net: mpls: initialize rtm_tos in mpls_getroute() (bsc#1275572).\n- CVE-2026-74581: net: ipv6: clear suppressed fib6 rule result (bsc#1275782).\n- CVE-2026-74582: packet: use consistent hard_header_len in non-ring send paths (bsc#1275784).\n- CVE-2026-74584: RDMA/bnxt_re: zero shared page before exposing to userspace (bsc#1277066).\n- CVE-2026-74598: ipv6: fix Route Information option length validation (bsc#1277918).\n- CVE-2026-74610: tls: don't leave a full plaintext sk_msg ring unpushed (bsc#1277054).\n- CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277505).\n- CVE-2026-74615: vxlan: do not arm the ageing timer on a device that is down (bsc#1277901).\n- CVE-2026-74616: xdp: reject clones that overrun skb_shared_info tailroom (bsc#1277813).\n- CVE-2026-74622: net: atlantic: free RX pages of consumed but not refilled buffers (bsc#1277862).\n- CVE-2026-74644: mm/damon/ops-common: putback folios on invalid migrate nid (bsc#1277033).\n- CVE-2026-74665: net: fix skb length accounting after generic XDP frag adjustment (bsc#1277407).\n- CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277391).\n- CVE-2026-74695: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() (bsc#1276931).\n- CVE-2026-74705: udp: fix potential use-after-free in tunnel segmentation (bsc#1276922).\n- CVE-2026-74712: vdpa/mlx5: Fix buffer length in create_direct_keys() (bsc#1276577).\n- CVE-2026-74717: net/mlx5: fw_tracer, return NULL on create error (bsc#1276569).\n- CVE-2026-74719: net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()\n  (bsc#1276572).\n- CVE-2026-74722: btrfs: fix memory leak in btrfs_do_encoded_write() (bsc#1276561).\n- CVE-2026-74723: btrfs: lzo: reject inline extents without valid headers (bsc#1276562).\n- CVE-2026-74730: NFS: Pin the 'struct nfs_server' during a FREE_STATEID call (bsc#1276566).\n- CVE-2026-74737: net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG (bsc#1277898).\n- CVE-2026-74743: macvlan: inherit needed_headroom and needed_tailroom from lowerdev (bsc#1277908).\n- CVE-2026-74744: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (bsc#1278094).\n- CVE-2026-80529: xfs: don't swallow dquot recovery verification errors (bsc#1277688).\n- CVE-2026-80530: xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (bsc#1277668).\n- CVE-2026-80531: xfs: avoid UAF on sc-\u003etempip in xrep_tempfile_create (bsc#1277680).\n- CVE-2026-80533: xfs: don't walk off the end of a null sc-\u003esa.agi_bp in AGI repair (bsc#1277636).\n- CVE-2026-80534: xfs: fix ilock leak on error in xfs_dq_get_next_id (bsc#1277022).\n- CVE-2026-80535: xfs: don't double-lock when deleting a self-referential directory (bsc#1277641).\n- CVE-2026-80557: libceph: fix OOB read in decode_watchers() via missing bounds check (bsc#1277268).\n- CVE-2026-80558: libceph: Avoid using invalid osd indices from primary_temp (bsc#1277485).\n- CVE-2026-80561: libceph: fix multiple unsafe decodes in decode_locker() (bsc#1277265).\n- CVE-2026-80586: mptcp: options: reset DSS fields in case of unexpected size (bsc#1277328).\n- CVE-2026-80589: block: stop the timeout timer when releasing a never added disk (bsc#1277335).\n- CVE-2026-80590: inet: frags: strip GSO state from fragments before reassembly (bsc#1277275).\n- CVE-2026-80603: netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read (bsc#1278293).\n- CVE-2026-80609: qede: fix out-of-bounds check for cqe-\u003elen_list (bsc#1278334).\n- CVE-2026-80629: octeontx2-af: npc: Fix size of entry2cntr_map (bsc#1277308).\n- CVE-2026-80646: ipv6: guard against possible NULL deref in __in6_dev_stats_get() (bsc#1277513).\n- CVE-2026-80647: RDMA/hns: Fix warning in poll cq direct mode (bsc#1278331).\n- CVE-2026-80667: net/mlx5: LAG, MPESW, Fix missing complete() on devcom error (bsc#1278324).\n- CVE-2026-80681: vxlan: re-fetch eth header after route_shortcircuit() (bsc#1278416).\n- CVE-2026-80693: idpf: bound interrupt-vector register fill to the allocated array (bsc#1278395).\n- CVE-2026-80714: ipvs: do not propagate one-packet flag to synced conns (bsc#1277561).\n- CVE-2026-80721: Bluetooth: ISO: ensure no dangling hcon references in iso_conn (bsc#1277845).\n- CVE-2026-80727: x86/mce: Set up the polling timer before CMCI discovery (bsc#1278703).\n- CVE-2026-80731: net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (bsc#1278716).\n- CVE-2026-80737: serial: amba-pl011: synchronize DMA teardown (bsc#1279487).\n- CVE-2026-80739: net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock (bsc#1278733).\n- CVE-2026-80805: xfs: validate attr entry pointer before field access (bsc#1279580).\n- CVE-2026-80813: nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist() (bsc#1279537).\n- CVE-2026-80838: vxlan: keep the last remote linked during FDB flush (bsc#1279842).\n\nThe following non security issues were fixed:\n\n- accel/ivpu: Limit firmware log name prints to field size (git-fixes).\n- accel/ivpu: Validate firmware log buffer metadata (git-fixes).\n- accel/ivpu: Validate full buffer range in ivpu_to_cpu_addr (git-fixes).\n- accel/qaic: Address potential out-of-bounds read in resp_worker() (git-fixes).\n- accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() (git-fixes).\n- accessibility: speakup: unregister tty ldisc on later init failures (git-fixes).\n- ACPI: APEI: Fix ERST timeout unit conversion (git-fixes).\n- ACPI: battery: Adjust charging status validation check (git-fixes).\n- ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer (git-fixes).\n- ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root (git-fixes).\n- ACPI: pfr_update: fix stack buffer overflow in query_capability() (git-fixes).\n- ACPI: processor: idle: Expand _LPI package sanity checks (git-fixes).\n- ACPI: processor: validate MADT IOAPIC entry bounds (git-fixes).\n- ACPI: processor_idle: Mark LPI enter functions as __cpuidle (git-fixes).\n- ACPI: scan: fix bus ID cleanup on device_add() failures (git-fixes).\n- ACPI: video: Release PCI device reference after lookup (git-fixes).\n- ALSA: 6fire: bound the MIDI event length from the device (git-fixes).\n- ALSA: 6fire: Fix UAF at error handling during probe (stable-fixes).\n- ALSA: bcd2000: clear the URB pointers on disconnect (git-fixes).\n- ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev (git-fixes).\n- ALSA: caiaq: Fix potential double-free at error path (git-fixes).\n- ALSA: control: Don't add invalid kcontrols to LED layer (git-fixes).\n- ALSA: core: Fix use-after-free in snd_card_do_free() (git-fixes).\n- ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough (git-fixes).\n- ALSA: dummy: Check card index validity at probe (stable-fixes).\n- ALSA: dummy: Report a change when one capture switch channel moves (git-fixes).\n- ALSA: harmony: initialize locks before requesting IRQ (git-fixes).\n- ALSA: hda/ext: preserve PPLCCTL bits when clearing reset (git-fixes).\n- ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP r (stable-fixes).\n- ALSA: hda: Fix connection list comparison in proc output (git-fixes).\n- ALSA: hda: Report a change when only the channel status bytes move (git-fixes).\n- ALSA: hda: restore MFG widget enumeration after core split (git-fixes).\n- ALSA: hpi: Check transport errors during HPI6000 adapter initialization (git-fixes).\n- ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF (git-fixes).\n- ALSA: pcxhr: initialize mutexes before requesting threaded IRQ (git-fixes).\n- ALSA: rawmidi: Return the error from snd_rawmidi_input_params() (git-fixes).\n- ALSA: scarlett2: Use a private URB for the notification endpoint (git-fixes).\n- ALSA: seq: Don't leak the extension cell pointer in the bounce payload (git-fixes).\n- ALSA: seq: midi: Optimize event_input locking with RCU (git-fixes).\n- ALSA: seq: midi: Serialize input teardown with event_input (git-fixes).\n- ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion (git-fixes).\n- ALSA: usb-audio: Complete cleanup after system-resume errors (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() (git-fixes).\n- ALSA: usb-audio: fix OOB write on Type II inbound URBs (git-fixes).\n- ALSA: usb: Fix UAF at delayed release of MIDI2 EPs (git-fixes).\n- ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf (git-fixes).\n- ALSA: usbusx2y: validate URB actual_length in interrupt callback (git-fixes).\n- ALSA: usx2y: bound the hwdep mmap fault offset (git-fixes).\n- ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() (git-fixes).\n- apparmor: advertise the tcp fast open fix is applied (git-fixes).\n- ASoC: ab8500: Correct digital interface format setup (git-fixes).\n- ASoC: ab8500: Repair the DAPM capture graph (git-fixes).\n- ASoC: ab8500: Reset the audio block before configuring it (git-fixes).\n- ASoC: ab8500: Validate and program TDM slots correctly (git-fixes).\n- ASoC: adau1761: sort the register default table (git-fixes).\n- ASoC: amd: renoir: fix disable_pdm_interrupts() to clear mask bits (git-fixes).\n- ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC (git-fixes).\n- ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close() (git-fixes).\n- ASoC: apple: mca: increase SERDES reset delay (git-fixes).\n- ASoC: bcm: bcm63xx: Publish the OF module aliases (git-fixes).\n- ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses (git-fixes).\n- ASoC: cs35l33: drain threaded IRQ before runtime suspend (git-fixes).\n- ASoC: cs35l34: drain threaded IRQ before runtime suspend (git-fixes).\n- ASoC: cs35l41: sort the register default table (git-fixes).\n- ASoC: cs35l45: sort the register default table (git-fixes).\n- ASoC: cs4265: sort the register default table (git-fixes).\n- ASoC: cx2072x: sort the register default table (git-fixes).\n- ASoC: dapm: Fix off-by-one check on the second enum channel (git-fixes).\n- ASoC: fix unmet dependencies on PPC_BESTCOMM and SND_SOC_AC97_BUS (git-fixes).\n- ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready (git-fixes).\n- ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure (git-fixes).\n- ASoC: fsl_audmix: rework runtime PM handling in probe (git-fixes).\n- ASoC: fsl_easrc: sort the register default table (git-fixes).\n- ASoC: hdac_hda: Fix hlink refcount leak on component registration failure (git-fixes).\n- ASoC: Intel: avs: Clean up streams if their initialization fails (git-fixes).\n- ASoC: Intel: avs: Clean up the bus when fetching ML caps fails (git-fixes).\n- ASoC: Intel: avs: Do not ignore -ENOENT when loading a topology (git-fixes).\n- ASoC: Intel: avs: Fix unbalanced module reference count (git-fixes).\n- AsoC: intel: sst: fix PCI device reference leak on probe failure (git-fixes).\n- ASoC: Intel: SST: Publish the PCI module aliases (git-fixes).\n- ASoC: loongson: Fix error handling in ACPI property parsing (git-fixes).\n- ASoC: max9860: sort the register default table (git-fixes).\n- ASoC: mediatek: mt8183-afe-pcm: Shorten memif_data table using macros (stable-fixes).\n- ASoC: mediatek: mt8183-afe-pcm: Support \u003e32 bit DMA addresses (git-fixes).\n- ASoC: mediatek: mt8183-afe-pcm: use local `dev` pointer in driver callbacks (stable-fixes).\n- ASoC: mediatek: mt8183: Check runtime resume during probe (git-fixes).\n- ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable (stable-fixes).\n- ASoC: mediatek: mt8192: Check runtime resume during probe (git-fixes).\n- ASoC: meson: Keep link pointers valid on realloc failure (git-fixes).\n- ASoC: ml26124: sort the register default table (git-fixes).\n- ASoC: mt6351: Publish the OF module alias (git-fixes).\n- ASoC: pcm512x: sort the register default table (git-fixes).\n- ASoC: pxa: Use devm_clk_get_optional() for extclk clock (git-fixes).\n- ASoC: qcom: q6apm: keep the graph start count in sync with the DSP (git-fixes).\n- ASoC: rt274: sort the register default table (git-fixes).\n- ASoC: rt286: sort the register default table (git-fixes).\n- ASoC: rt298: sort the register default table (git-fixes).\n- ASoC: rt700-sdw: always drain jack work on remove (git-fixes).\n- ASoC: rt700: drop duplicate reg_default entry (git-fixes).\n- ASoC: rt700: sort the register default table (git-fixes).\n- ASoC: rt711-sdca: sort the register default tables (git-fixes).\n- ASoC: rt711: sort the register default table (git-fixes).\n- ASoC: rt712-sdca-dmic: sort the register default table (git-fixes).\n- ASoC: rt712-sdca-sdw: sort the register default table (git-fixes).\n- ASoC: rt715-sdca: drop duplicate reg_default entries (git-fixes).\n- ASoC: rt715-sdca: sort the register default tables (git-fixes).\n- ASoC: rt715: sort the register default table (git-fixes).\n- ASoC: rt1017-sdca-sdw: sort the register default table (git-fixes).\n- ASoC: rt1316-sdw: sort the register default table (git-fixes).\n- ASoC: rt1318-sdw: sort the register default table (git-fixes).\n- ASoC: rt1318: sort the register default table (git-fixes).\n- ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get (git-fixes).\n- ASoC: sgtl5000: sort the register default table (git-fixes).\n- ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() (git-fixes).\n- ASoC: SOF: validate topology volume range before allocation (git-fixes).\n- ASoC: sprd: validate compress buffer sizes against fixed allocations (git-fixes).\n- ASoC: sti-sas: sort the register default table (git-fixes).\n- ASoC: sti: initialize IRQ lock before requesting IRQ (git-fixes).\n- ASoC: tas2552: sort the register default table (git-fixes).\n- ASoC: tas2764: sort the register default table (git-fixes).\n- ASoC: tas2780: sort the register default table (git-fixes).\n- ASoC: tegra210_i2s: sort the register default table (git-fixes).\n- ASoC: tegra210_mixer: sort the register default table (git-fixes).\n- ASoC: tegra: Fix the MIXER enable default value (git-fixes).\n- ASoC: tegra: Sort MBDRC register defaults (git-fixes).\n- ASoC: xilinx: formatter_pcm: fix stream_data leak on open error (git-fixes).\n- ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers (git-fixes).\n- ata: ahci: work around lost interrupts on Marvell 88SE61xx (git-fixes).\n- batman-adv: bla: fix freeing of claims on meshif deletion (git-fixes).\n- batman-adv: bla: prevent CRC corruptions after claim flush (git-fixes).\n- batman-adv: dat: avoid unaligned fault in IP extraction (git-fixes).\n- batman-adv: fix stale receive device on merged fragments (git-fixes).\n- batman-adv: mcast: ensure unshared skb for multicast packets (git-fixes).\n- batman-adv: mcast: linearize skbuff for packet generation (git-fixes).\n- batman-adv: reject unrepresentable multicast TVLV offsets (git-fixes).\n- blk-mq: reinsert cached request to the list (bsc#1273770).\n- Bluetooth: btintel: bound firmware ID by TLV length (git-fixes).\n- Bluetooth: btintel: Fix diagnostics event detection (git-fixes).\n- Bluetooth: btintel: validate version TLV value lengths (git-fixes).\n- Bluetooth: btintel_pcie: Clear automask on spurious interrupts (git-fixes).\n- Bluetooth: btintel_pcie: fix tx_handle bounds off-by-one (git-fixes).\n- Bluetooth: btintel_pcie: validate packet_len before skb_put_data (git-fixes).\n- Bluetooth: btmtk: Declare MT7920 (MT7961 1a) Bluetooth firmware (git-fixes).\n- Bluetooth: btmtk: Do not discard the subsystem reset timeout (git-fixes).\n- Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read() (stable-fixes).\n- Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path (git-fixes).\n- Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX (git-fixes).\n- Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event (git-fixes).\n- Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev (git-fixes).\n- Bluetooth: btrtl: Don't leak return code when parsing firmware format v2 (git-fixes).\n- Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() (git-fixes).\n- Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req() (stable-fixes).\n- Bluetooth: btusb: Fix UAF of btusb_data by rx_work (git-fixes).\n- Bluetooth: do not leak an hci_conn when a second LE connect is rejected (git-fixes).\n- Bluetooth: eir: Fix OOB read in eir_get_service_data() (git-fixes).\n- Bluetooth: hci_aml: validate firmware segment lengths (git-fixes).\n- Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378 (git-fixes).\n- Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_conn: fix the SCO setup context lifetime (git-fixes).\n- Bluetooth: hci_conn: hold conn reference in abort_conn_sync() (git-fixes).\n- Bluetooth: hci_conn: re-enable advertising only for peripheral role (git-fixes).\n- Bluetooth: hci_core: Fix race condition during device registration (git-fixes).\n- Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb (git-fixes).\n- Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection (git-fixes).\n- Bluetooth: hci_event: fix LE list UAF on reset (git-fixes).\n- Bluetooth: hci_event: validate LE Set CIG Parameters response (git-fixes).\n- Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout() (git-fixes).\n- Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request (git-fixes).\n- Bluetooth: hci_sync: Fix accept list UAF during suspend (git-fixes).\n- Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths (git-fixes).\n- Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists (stable-fixes).\n- Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync() (stable-fixes).\n- Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del() (git-fixes).\n- Bluetooth: hci_uart: Fix false success return in hci_uart_setup() (git-fixes).\n- Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync (git-fixes).\n- Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready (git-fixes).\n- Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM (git-fixes).\n- Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan (git-fixes).\n- Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect (git-fixes).\n- Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync (git-fixes).\n- Bluetooth: MGMT: free the HCI command when it is cancelled (git-fixes).\n- Bluetooth: MGMT: free the mesh send cancel command when it is cancelled (git-fixes).\n- Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255 (git-fixes).\n- Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update (git-fixes).\n- Bluetooth: MSFT: validate evt_prefix_len against the response length (git-fixes).\n- Bluetooth: qca: fix NVM tag length underflow in TLV parser (git-fixes).\n- Bluetooth: RFCOMM: serialize security confirmation handling (git-fixes).\n- Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept (git-fixes).\n- Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (git-fixes).\n- Bluetooth: virtio_bt: avoid OOB read of build info string (git-fixes).\n- bnxt_en: Check return value of bnxt_hwrm_vnic_cfg (jsc#PED-16798).\n- bnxt_en: Delay for 5 seconds after AER DPC for all chips (jsc#PED-16798).\n- bnxt_en: Don't assume XDP is never enabled in bnxt_init_dflt_ring_mode() (jsc#PED-16798).\n- bnxt_en: Drop pci_save_state() after pci_restore_state() (jsc#PED-16798).\n- bnxt_en: Implement XDP RSS hash metadata extraction (jsc#PED-16798).\n- bnxt_en: Implement XDP RSS hash metadata extraction for V3_CMP (jsc#PED-16798).\n- bnxt_en: Move bnxt_rss_ext_op into header (jsc#PED-16798).\n- bnxt_en: Refactor some basic ring setup and adjustment logic (jsc#PED-16798).\n- bnxt_en: Restore default stat ctxs for ULP when resource is available (jsc#PED-16798).\n- bnxt_en: Set bp-\u003emax_tpa according to what the FW supports (jsc#PED-16798).\n- bnxt_en: Use absolute target ns from ptp_clock_request (jsc#PED-16798).\n- bnxt_en: use bnxt_xdp_buff for xdp context (jsc#PED-16798).\n- bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation (git-fixes).\n- bus: mhi: host: Fix controller cleanup on EDL sysfs failure (git-fixes).\n- bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET (git-fixes).\n- bus: ti-sysc: Fix /chosen node reference leak (git-fixes).\n- cacheinfo: don't propagate DT/ACPI error when arch supplies info (arm64) (git-fixes).\n- can: j1939: add missing calls in NETDEV_UNREGISTER notification handler (git-fixes).\n- can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking (stable-fixes).\n- char: xilinx_hwicap: unregister class on init errors (git-fixes).\n- cleanup: add a scoped version of CLASS() (stable-fixes).\n- cleanup: fix scoped_class() (git-fixes).\n- compiler_types: Introduce __flex_counter() and family (bsc#1280139).\n- cpufreq: intel_pstate: Add and use hybrid_get_cpu_type() (bsc#1240957 bsc#1249104 bsc#1265220).\n- cpufreq: intel_pstate: Avoid SMP calls to get cpu-type (bsc#1240957 bsc#1249104 bsc#1265220).\n- cpufreq: intel_pstate: Fix hwp_get_cpu_scaling() (bsc#1240957 bsc#1249104 bsc#1265220).\n- cpufreq: intel_pstate: Use correct scaling factor on Raptor Lake-E (bsc#1240957 bsc#1249104 bsc#1265220).\n- cpufreq: intel_pstate: Use CPPC to get scaling factors (bsc#1240957 bsc#1249104 bsc#1265220).\n- cpufreq: intel_pstate: Use HYBRID_SCALING_FACTOR_ADL for Bartlett Lake (bsc#1240957 bsc#1249104 bsc#1265220).\n- crypto: aspeed - Propagate platform_get_irq() errors (git-fixes).\n- crypto: atmel-sha204a - fix heap info leak on I2C transfer failure (git-fixes).\n- crypto: atmel-tdes - use scatterlist length before DMA mapping (git-fixes).\n- crypto: ccm - Set rfc4309 maxauthsize from child (git-fixes).\n- crypto: ccp - Abort doing SEV INIT if SNP INIT fails (stable-fixes).\n- crypto: ccp - Add new SEV/SNP platform shutdown API (stable-fixes).\n- crypto: ccp - Always pass in an error pointer to __sev_platform_shutdown_locked() (git-fixes).\n- crypto: ccp - Fix __sev_snp_shutdown_locked (git-fixes).\n- crypto: ccp - Fix dereferencing uninitialized error pointer (git-fixes).\n- crypto: ccp - Fix memory leak in SEV INIT_EX path (git-fixes).\n- crypto: ccp - Fix possible deadlock in SEV init failure path (git-fixes).\n- crypto: ccp - Fix SNP panic notifier unregistration (git-fixes).\n- crypto: ccp - Move dev_info/err messages for SEV/SNP init and shutdown (stable-fixes).\n- crypto: ccp - Move SEV/SNP Platform initialization to KVM (stable-fixes).\n- crypto: ccp - Register SNP panic notifier only if SNP is enabled (stable-fixes).\n- crypto: ccp - Reset TMR size at SNP Shutdown (stable-fixes).\n- crypto: doc - Remove extra parenthesis (git-fixes).\n- crypto: hisilicon/sec2 - fix CCM algorithm long packet failure (git-fixes).\n- crypto: keembay - Fix AEAD unregister count in error path (git-fixes).\n- crypto: keembay - Initialize completion before requesting IRQ (git-fixes).\n- crypto: keembay - publish OF module alias for OCS AES/SM4 (git-fixes).\n- crypto: lskcipher - propagate errors from unaligned crypt (git-fixes).\n- crypto: mxs-dcp - fix source scatterlist length access (git-fixes).\n- crypto: qat - cancel work on re-enable SR-IOV timeout (git-fixes).\n- crypto: qat - clear AES key schedule from stack (git-fixes).\n- crypto: qce - fix CCM AAD buffer underallocation (git-fixes).\n- crypto: qce - fix error path in devm_qce_register_algs (git-fixes).\n- crypto: qcom-rng - Allow zero as a random number (git-fixes).\n- crypto: qcom-rng - Enable clock in hwrng case (git-fixes).\n- crypto: rk3288 - fail ahash requests on HASH idle timeout (git-fixes).\n- crypto: sa2ul - stop probe if context pool creation fails (git-fixes).\n- crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping (git-fixes).\n- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (stable-fixes).\n- crypto: tegra - fix rctx-\u003ecryptlen calculation in tegra_gcm_do_one_req() (git-fixes).\n- cxl/acpi: Fix CXL_ACPI and CXL_PMEM Kconfig tristate mismatch (git-fixes).\n- cxl: Adjust the startup priority of cxl_pmem to be higher (git-fixes).\n- default_gfp(): avoid using the \"newfangled\" __VA_OPT__ trick (bsc#1280139).\n- device property: fix infinite loop in fwnode_for_each_child_node() (git-fixes).\n- dm/amdgpu: fix malformed link_settings debugfs output (git-fixes).\n- dma-mapping: add __dma_from_device_group_begin()/end() (bsc#1267586).\n- dmaengine: dw-edma: Clear stale requests on termination (git-fixes).\n- dmaengine: dw-edma: Complete descriptors before pausing (git-fixes).\n- dmaengine: dw-edma: Fix HDMA channel status register access (git-fixes).\n- dmaengine: dw-edma: Initialize IRQ data before requesting IRQs (git-fixes).\n- dmaengine: dw-edma: Serialize abort state updates (git-fixes).\n- dmaengine: dw-edma: Serialize channel state checks (git-fixes).\n- dmaengine: dw-edma: Terminate all descriptors without callbacks (git-fixes).\n- dmaengine: fsl-edma: tracing: no ptr dereference during log output (git-fixes).\n- dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe (git-fixes).\n- dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure (git-fixes).\n- dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal (git-fixes).\n- dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers (git-fixes).\n- dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout (git-fixes).\n- dmaengine: zynqmp_dma: fix kernel doc for zynqmp_dma_remove() (git-fixes).\n- driver core: soc: Unregister bus on early device registration failure (git-fixes).\n- drivers/virt: pkvm: Fix end calculation in mmio_guard_ioremap_hook() (git-fixes).\n- Drivers: hv: Use meaningful errnos for hypercall status codes (git-fixes).\n- drm/amd/display: Add AV mute wait frames to dce110_set_avmute (stable-fixes).\n- drm/amd/display: avoid divide-by-zero in __is_lut_linear() (git-fixes).\n- drm/amd/display: Check for tg ops in dce110_set_avmute (git-fixes).\n- drm/amd/display: dce100: skip non-DP stream encoders for DP MST (stable-fixes).\n- drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix (git-fixes).\n- drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE (git-fixes).\n- drm/amd/display: fix division by zero in get_estimated_bw() (git-fixes).\n- drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank() (git-fixes).\n- drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames (stable-fixes).\n- drm/amd/display: Remove unused-but-set variable hubp from (git-fixes).\n- drm/amd/display: validate plane degamma LUT size for private color prop (git-fixes).\n- drm/amd/pm: adjust the visibility of pp_table sysfs node (stable-fixes).\n- drm/amd/pm: fix gpu metrics energy accumulator for smu 13.0.0/13.0.7 (git-fixes).\n- drm/amd/pm: fix smu14 power limit range calculation (stable-fixes).\n- drm/amd/pm: make pp_features read-only when scpm is enabled (stable-fixes).\n- drm/amd/pm: Use same metric table for APU (stable-fixes).\n- drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read (git-fixes).\n- drm/amdgpu/gfx6: Fixup emit_cntxcntl() (git-fixes).\n- drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets (git-fixes).\n- drm/amdgpu/gfx6: Use PFP on the compute queues too (git-fixes).\n- drm/amdgpu/gfx8: drop unecessary BUG_ON() (stable-fixes).\n- drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup (git-fixes).\n- drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup (git-fixes).\n- drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma7.0: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) (stable-fixes).\n- drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older (stable-fixes).\n- drm/amdgpu/vce: fix integer overflow in image size (stable-fixes).\n- drm/amdgpu/vcn4: avoid rereading IB param length (stable-fixes).\n- drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (git-fixes).\n- drm/amdgpu: cap GTT size to physical RAM on APUs (stable-fixes).\n- drm/amdgpu: check ASPM on the dGPU host link (git-fixes).\n- drm/amdgpu: disallow multiple FENCE chunks in one submit (git-fixes).\n- drm/amdgpu: fix aperture iounmap skipped on device removal (git-fixes).\n- drm/amdgpu: fix autosuspend cleanup during removal (git-fixes).\n- drm/amdgpu: fix bo-\u003epin leaking in amdgpu_bo_create_reserved (stable-fixes).\n- drm/amdgpu: fix division by zero with invalid uvd dimensions (stable-fixes).\n- drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (stable-fixes).\n- drm/amdgpu: fix nbif 6.3.1 l1 low power not functional (git-fixes).\n- drm/amdgpu: Fix UVD decode image min size calculation (stable-fixes).\n- drm/amdgpu: Fix UVD dpb min size calculation for H264 (stable-fixes).\n- drm/amdgpu: Fix UVD min buffer sizes (stable-fixes).\n- drm/amdgpu: Fix VCE 3 ring align_mask (git-fixes).\n- drm/amdgpu: Fix VFCT bus number matching with soft filter (stable-fixes).\n- drm/amdgpu: Implement insert_end for VCE 3 (git-fixes).\n- drm/amdgpu: invoke pm_genpd_remove() before freeing genpd (stable-fixes).\n- drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini (git-fixes).\n- drm/amdgpu: read TRUNCATE_COORD_MODE on gfx12 (git-fixes).\n- drm/amdgpu: reject oversized IBs with per-ring packet limits (stable-fixes).\n- drm/amdgpu: Reject UVD message with dimensions above 4096 (stable-fixes).\n- drm/amdgpu: Reject UVD message with invalid number of h265 refs (stable-fixes).\n- drm/amdgpu: remove unused function parameter (stable-fixes).\n- drm/amdgpu: restore UMD profile pstate after runtime resume (stable-fixes).\n- drm/amdgpu: validate GEM_CREATE domain combinations (stable-fixes).\n- drm/amdkfd: Check bounds in allocate_event_notification_slot (stable-fixes).\n- drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (stable-fixes).\n- drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE (stable-fixes).\n- drm/amdkfd: fix QID bit leak in pqm_create_queue() (stable-fixes).\n- drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore (git-fixes).\n- drm/amdkfd: Handle invalid event type in CRIU event restore (stable-fixes).\n- drm/amdkfd: Use kvcalloc to allocate arrays (stable-fixes).\n- drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure (git-fixes).\n- drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure (git-fixes).\n- drm/bridge: ps8640: propagate AUX transfer register errors (git-fixes).\n- drm/bridge: tc358767: clamp the reported AUX read size to the request (git-fixes).\n- drm/connector/hdmi: Fix out of bounds memory read (git-fixes).\n- drm/connector: Fix epoch_counter docs to reflect reality (git-fixes).\n- drm/drm_exec: fix up contended obj when num_objects is 0 (git-fixes).\n- drm/gud: NUL-terminate TV mode names read from the device (git-fixes).\n- drm/gud: validate TV mode names before creating enum property (git-fixes).\n- drm/hibmc: Fix list of formats on the primary plane (git-fixes).\n- drm/hibmc: Use drm_atomic_helper_check_plane_state() (git-fixes).\n- drm/i915/hdcp: check streams bounds before overflow (git-fixes).\n- drm/i915/hdcp: Move to using intel_display in intel_hdcp (stable-fixes).\n- drm/i915/hdcp: require monotonically increasing seq_num_v (git-fixes).\n- drm/i915/hdcp: Skip inactive MST connectors when building stream list (stable-fixes).\n- drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() (stable-fixes).\n- drm/i915/vrr: require valid min/max vfreq for VRR (git-fixes).\n- drm/i915: Fix memory leak in query_perf_config_list() (git-fixes).\n- drm/lima: call drm_mm_init() with a valid allocation range (git-fixes).\n- drm/msm/a6xx: Fix RBBM_CLOCK_CNTL3_TP0 value in a730_hwcg (git-fixes).\n- drm/msm/a6xx: Fix stale rpmh votes after suspend (git-fixes).\n- drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0) (git-fixes).\n- drm/msm/dsi: Drop dev_pm_opp_set_rate(0) (git-fixes).\n- drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value (git-fixes).\n- drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE (git-fixes).\n- drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op (git-fixes).\n- drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE (git-fixes).\n- drm/nouveau: unsubscribe the channel-kill event before the fence context (git-fixes).\n- drm/nouveau: Use write-combined maps for coherent (git-fixes).\n- drm/panel-edp: fix i2c adapter leak on probe failure (git-fixes).\n- drm/panel: samsung-s6d16d0: Power off on prepare failure (git-fixes).\n- drm/panthor: fix firmware control interface bounds checks (git-fixes).\n- drm/panthor: return PTR_ERR() from devm_drm_dev_alloc() (git-fixes).\n- drm/panthor: skip zero-sized firmware sections (git-fixes).\n- drm/radeon: fix autosuspend cleanup during teardown (git-fixes).\n- drm/radeon: fix r100_copy_blit for large BOs (stable-fixes).\n- drm/radeon: restore hardware polling in fence_is_signaled to fix performance regression (git-fixes).\n- drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format (git-fixes).\n- drm/ssd130x: fix column and row end address in partial updates for ssd132x (git-fixes).\n- drm/ssd130x: fix column and row end address in partial updates in ssd133x (git-fixes).\n- drm/sun4i: crtc: Propagate layer initialization error (git-fixes).\n- drm/sun4i: Drop node references while building component list (git-fixes).\n- drm/sun4i: dw-hdmi: Drop TCON TOP port reference (git-fixes).\n- drm/sun4i: fix refcount leak in sun4i_backend_init_sat() (git-fixes).\n- drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz (git-fixes).\n- drm/sun4i: hdmi: Don't leak sync polarity bits into packet control (git-fixes).\n- drm/sun4i: tcon: Drop remote endpoint reference (git-fixes).\n- drm/sun4i: tcon: Drop TCON TOP device reference (git-fixes).\n- drm/sun4i: tcon: Set output mux for DSI and LVDS (git-fixes).\n- drm/sun4i: vi scaler: Fix coefficient selection (git-fixes).\n- drm/tegra: dsi: Re-add clear enable register if DSI was powered by bootloader (git-fixes).\n- drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info (git-fixes).\n- drm/tve200: add OF module alias for autoloading (git-fixes).\n- drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() (git-fixes).\n- drm/xe/oa: Check managed mutex initialization errors (git-fixes).\n- drm/xe/oa: Fix sync entry leak on OA config emit failure (git-fixes).\n- drm/xe/oa: Remove sysfs entry on idr_alloc failure in xe_oa_add_config_ioctl() (git-fixes).\n- drm/xe: Introduce xe_gt_dbg_printer() (stable-fixes).\n- drm/xe: Order ring writes before ring tail updates (git-fixes).\n- drm/xe: Stub out new pagefault layer (stable-fixes).\n- drm/xe: tests: fix error message in xe_migrate_sanity_test() (git-fixes).\n- drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used (git-fixes).\n- drm: fix race between partial drm_dev_register() failure and ioctl (git-fixes).\n- drm: lcdif: Wait for vblank before disabling DMA (git-fixes).\n- drm: Remove unused header in drm_dumb_buffers.c (git-fixes).\n- efi: fix stale reference to efi_recover_from_page_fault() (git-fixes).\n- erspan: Initialize options_len before referencing options (bsc#1274727).\n- ethtool: rss: fix hkey leak when indir_size is 0 (git-fixes).\n- fbdev: bitblit: bound-check glyph index in bit_cursor() (git-fixes).\n- fbdev: core: Fix pointer desynchronization in fb_io_read() (git-fixes).\n- fbdev: kyro: Validate overlay viewport coordinates (git-fixes).\n- fbdev: omapfb: panel-dsi-cm: initialize lock before registering display (git-fixes).\n- fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device() (git-fixes).\n- fbdev: uvesafb: unregister connector callback on init failure (git-fixes).\n- fbdev: vfb: defer cleanup until the last reference (git-fixes).\n- firmware: arm_scmi: Avoid IDR updates while cleaning channels (git-fixes).\n- firmware: arm_scmi: Clean up channels on setup failure (git-fixes).\n- firmware: arm_scmi: Drop handle on protocol bind failures (git-fixes).\n- firmware: arm_scmi: Fix requested device removal race (git-fixes).\n- firmware: arm_scmi: Free transport channel on IDR failure (git-fixes).\n- firmware: arm_scmi: Protect device request lookup with RCU (git-fixes).\n- firmware: arm_scmi: Publish channel state before callbacks (git-fixes).\n- firmware: arm_scmi: Quiesce notifications before teardown (git-fixes).\n- firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context (git-fixes).\n- firmware: arm_scmi: Reject out of range DT protocol IDs (git-fixes).\n- firmware: arm_scmi: Roll back partial protocol table registration (git-fixes).\n- firmware: arm_scmi: Unregister device notifier before IDR teardown (git-fixes).\n- firmware: arm_scmi: Unrequest devices if driver registration fails (git-fixes).\n- firmware: arm_scmi: Unwind P2A receiver mailbox setup failure (git-fixes).\n- firmware: arm_scmi: Unwind TX receiver mailbox setup failure (git-fixes).\n- firmware: arm_scmi: Use channel ID for transport teardown (git-fixes).\n- firmware_loader: do not queue completed sysfs fallback requests (git-fixes).\n- fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write (git-fixes).\n- fpga: dfl: fme: add error handling (git-fixes).\n- fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration (git-fixes).\n- fuse: fix race between interrupt and resend (git-fixes).\n- gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind (git-fixes).\n- gpu: host1x: Avoid stack over-read in debug output helpers (git-fixes).\n- gpu: host1x: Fix offset calculation in trace_write_gather (git-fixes).\n- gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings (stable-fixes).\n- HID: asus: fix missing hid_is_usb() check (git-fixes).\n- HID: asus: simplify RGB init sequence (stable-fixes).\n- HID: bpf: serialize device reference release in struct_ops destroy path (git-fixes).\n- HID: core: fix number/pointer type confusion on long items (git-fixes).\n- HID: core: fix OOB read of field-\u003eusage in hid_set_field() (git-fixes).\n- HID: ft260: fix stack-use-after-return write in I2C read race (git-fixes).\n- HID: ft260: validate i2c input report length (stable-fixes).\n- HID: hyperv: validate initial device info bounds (git-fixes).\n- HID: i2c-hid: Fix \"(null)\" output when reading report descriptor fails (git-fixes).\n- HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure (git-fixes).\n- HID: lg4ff: validate report length before fixed offsets (git-fixes).\n- HID: logitech-dj: Fix maxfield check in DJ short report validation (git-fixes).\n- HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report (git-fixes).\n- HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write (stable-fixes).\n- HID: logitech-dj: Standardise hid_report_enum variable nomenclature (stable-fixes).\n- HID: magicmouse: do not keep a stale msc-\u003einput if no input is claimed (git-fixes).\n- HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C (git-fixes).\n- HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID (stable-fixes).\n- HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() (git-fixes).\n- HID: magicmouse: re-enable multitouch after reset-resume (git-fixes).\n- HID: mcp2221: validate report size in mcp2221_raw_event() (git-fixes).\n- HID: multitouch: reclassify HTIX5288 to WIN_8_FORCE_MULTI_INPUT_NSMU (git-fixes).\n- HID: nintendo: Fix imu_timestamp_us double increment per report (git-fixes).\n- HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() (git-fixes).\n- HID: nintendo: register input device after capabilities are set (git-fixes).\n- HID: nintendo: stop device IO before hid_hw_stop on probe failure (git-fixes).\n- HID: picolcd: clamp eeprom debugfs read to bytes actually received (git-fixes).\n- HID: pidff: Rework pidff_set_time() to fix warnings (stable-fixes).\n- HID: pidff: Use ARRAY_SIZE macro instead of sizeof (stable-fixes).\n- HID: rmi: fix OOB access with undersized RMI reports (git-fixes).\n- HID: roccat: bound device-supplied profile index (git-fixes).\n- HID: roccat: free buffered reports when destroying device (git-fixes).\n- HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature (git-fixes).\n- HID: sensor: custom: Fix field sysfs group cleanup on failure (git-fixes).\n- HID: sensor: custom: Fix use-after-free in enable_sensor (git-fixes).\n- HID: synchronize input before cleaning up a failed probe (git-fixes).\n- HID: tmff: Use 64-bit arithmetic for force feedback scaling (git-fixes).\n- HID: wacom: validate report length in wacom_intuos_pro2_bt_irq (git-fixes).\n- hwmon: (ads7828) Fix external VREF regulator handling (git-fixes).\n- hwmon: (applesmc) fix key backlight workqueue leak on register failure (git-fixes).\n- hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors (git-fixes).\n- hwmon: (chipcap2) fix channels in humidity alarm notifications (git-fixes).\n- hwmon: (coretemp) Fix core_data leak on CPUs without PTS (git-fixes).\n- hwmon: (corsair-cpro) Create debugfs entries after hwmon registration (git-fixes).\n- hwmon: (corsair-cpro) Remove debugfs entries when probe fails (git-fixes).\n- hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination (git-fixes).\n- hwmon: (gpio-fan) Fix use-after-free in alarm work (git-fixes).\n- hwmon: (gpio-fan) take fan_data-\u003elock in gpio_fan_shutdown() (git-fixes).\n- hwmon: (ina2xx) Add support for has_alerts configuration flag (stable-fixes).\n- hwmon: (ina2xx) Add support for INA234 (stable-fixes).\n- hwmon: (ina2xx) Add support for INA260 (stable-fixes).\n- hwmon: (ina2xx) Fix various overflow issues (git-fixes).\n- hwmon: (ina2xx) Make it easier to add more devices (stable-fixes).\n- hwmon: (ina2xx) Shift INA234 shunt and current registers (stable-fixes).\n- hwmon: (ina226) Add support for SY24655 (stable-fixes).\n- hwmon: (ltc4282) Avoid overflow in maximum power calculation (git-fixes).\n- hwmon: (ltc4282) Clamp negative current limits (git-fixes).\n- hwmon: (ltc4282) Fix parsing adi,current-limit-sense-microvolt (git-fixes).\n- hwmon: (ltc4282) Make sure clk_init_data is fully initialized (git-fixes).\n- hwmon: (max6621) fix negative temperature offset and crit readings (git-fixes).\n- hwmon: (max6621) fix temperature clamp range (git-fixes).\n- hwmon: (nzxt-smart2) Check return value of init_device() in probe (git-fixes).\n- hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS (git-fixes).\n- hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations (git-fixes).\n- hwmon: Switch back to struct platform_driver::remove() (stable-fixes).\n- hwrng: ks-sa - Fix runtime PM cleanup on registration failure (git-fixes).\n- hwrng: omap - Fix probe error path cleanup (git-fixes).\n- hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() (git-fixes).\n- i2c: core: fix debugfs UAF on adapter removal (git-fixes).\n- i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (git-fixes).\n- i2c: imx: separate atomic, dma and non-dma use case (stable-fixes).\n- i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure (git-fixes).\n- i2c: mux: Fix channel node leak on adapter add failure (git-fixes).\n- i2c: ocores: Disable clock on failed resume (git-fixes).\n- i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices (git-fixes).\n- i3c: dw: rename \"pclk\" to \"apb\" to match dt-binding (git-fixes).\n- i3c: master: Fix device_register() error path (git-fixes).\n- i3c: master: Fix info leak and UAF in device unregister path (git-fixes).\n- i3c: master: Fix potential UAF in i3c_device_uevent() (git-fixes).\n- i3c: master: svc: bound IBI payload to the requested max_payload_len (git-fixes).\n- ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink (git-fixes).\n- ieee802154: cc2520: fix FIFOP work use-after-free (git-fixes).\n- ieee802154: hwsim: serialize pib updates to fix double-free (git-fixes).\n- iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE (git-fixes).\n- iio: adc: max34408: add missing 'select REGMAP_I2C' to Kconfig (git-fixes).\n- iio: adc: pac1921: fix wrong channel used in trigger handler read (git-fixes).\n- iio: buffer: Fix potential use-after-free in anonymous buffer release (git-fixes).\n- iio: buffer: Make IIO DMA fence release RCU-safe (git-fixes).\n- iio: buffer: Tie IIO dma fence lock lifetime to the fence (git-fixes).\n- iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable (git-fixes).\n- iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF (git-fixes).\n- iio: chemical: sgp30: Handle IAQ thread creation failure (git-fixes).\n- iio: dac: m62332: Fix regulator reference count imbalance (git-fixes).\n- iio: gyro: mpu3050: fix sign of raw angular velocity readings (git-fixes).\n- iio: light: cm32181: return zero after writing calibscale (git-fixes).\n- iio: light: gp2ap002: Disable regulators on resume failure (git-fixes).\n- iio: light: gp2ap002: re-enable irq if runtime suspend fails (git-fixes).\n- iio: light: isl29028: return zero in write_raw() on success (git-fixes).\n- iio: light: ltrf216a: fix runtime PM reference leak in error path (git-fixes).\n- iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem() (git-fixes).\n- iio: light: opt4001: Fix power down clearing bits of the wrong register (git-fixes).\n- iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask (git-fixes).\n- iio: light: opt4001: Reject integration times with a non-zero seconds part (git-fixes).\n- iio: light: tsl2583: return zero in write_raw() on success (git-fixes).\n- iio: light: tsl2772: fix ALS calibscale readback (git-fixes).\n- iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure (git-fixes).\n- iio: pressure: dps310: fix NULL pointer dereference on ACPI probe (git-fixes).\n- iio: pressure: mpl115: Fix runtime PM cleanup (git-fixes).\n- iio: srf04: fix pm_runtime handling on probe error path (git-fixes).\n- iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() (git-fixes).\n- Input: atkbd - skip deactivate for HONOR ZQC-P (git-fixes).\n- Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard (stable-fixes).\n- Input: cs40l50-vibra - validate custom data from user space (git-fixes).\n- Input: evdev - fix information leak in evdev_pass_values() (stable-fixes).\n- Input: evdev - sanitize event type index when fetching event masks (stable-fixes).\n- Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet (git-fixes).\n- Input: focaltech - use signed coordinates to prevent underflow (git-fixes).\n- Input: hynitron_cstxxx - validate touch count and finger IDs (git-fixes).\n- Input: iforce - validate input packet lengths (stable-fixes).\n- Input: iqs5xx - validate firmware record destination span (git-fixes).\n- Input: mms114 - fix Y-resolution configuration (git-fixes).\n- Input: psxpad-spi - set driver data before use (git-fixes).\n- Input: reject inhibit and uninhibit requests on unregistering devices (git-fixes).\n- Input: sur40 - fix input device registration ordering (stable-fixes).\n- Input: sur40 - fix V4L error path cleanup (stable-fixes).\n- Input: synaptics-rmi4 - block s_input when F54 queue is busy (git-fixes).\n- Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer (git-fixes).\n- Input: synaptics-rmi4 - fix F55 transmitter electrode count typo (git-fixes).\n- Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue (git-fixes).\n- Input: synaptics-rmi4 - zero report size on F54 work error (git-fixes).\n- Input: xpad - add support for ZENAIM LEVERLESS (stable-fixes).\n- interconnect: Fix use after free in icc_get() and of_icc_get_by_index() (git-fixes).\n- io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item (git-fixes).\n- io_uring/net: Avoid msghdr on op_connect/op_bind async data (git-fixes).\n- iommu/arm-smmu-v3: Manage teardown with devm (stable-fixes).\n- ip_tunnel: Use ip_tunnel_info() helper instead of 'info + 1' (bsc#1274727).\n- ipmi: ipmb: validate write message length (git-fixes).\n- ipmi: si: Fix NULL pointer dereference after failed registration (git-fixes).\n- KVM: arm64: Ensure FFA ranges are page aligned (git-fixes).\n- KVM: arm64: Fix bounds checking in do_ffa_mem_reclaim() (git-fixes).\n- KVM: arm64: Fix sign-extension of MMIO loads (git-fixes).\n- KVM: arm64: vgic: Reset in_kernel on private IRQ allocation failure (git-fixes).\n- KVM: arm64: Zero out the stack initialized data in the FFA handler (git-fixes).\n- KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN (git-fixes).\n- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (git-fixes).\n- KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit (git-fixes).\n- KVM: nVMX: Service local TLB flushes on failed nested VM-Enter (git-fixes).\n- KVM: PPC: Book3S HV: Add support for compat CPU capabilities for KVM on PowerNV (bsc#1263864 ltc#217835).\n- KVM: PPC: Book3S HV: Implement compat CPU capability retrieval for KVM on PowerVM (bsc#1263864 ltc#217835).\n- KVM: PPC: Book3S HV: Validate arch_compat against host compatibility mode (bsc#1263864 ltc#217835).\n- KVM: PPC: Document KVM_PPC_GET_COMPAT_CAPS ioctl (bsc#1263864 ltc#217835).\n- KVM: PPC: Introduce KVM_CAP_PPC_COMPAT_CAPS and wire up ioctl (bsc#1263864 ltc#217835).\n- KVM: SEV: Use to_kvm_sev_info() for fetching kvm_sev_info struct (git-fixes).\n- KVM: SVM: Add support to initialize SEV/SNP functionality in KVM (bsc#1279887).\n- KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts (git-fixes).\n- KVM: SVM: Serialize accesses to the owner and mirror list with separate lock (git-fixes).\n- KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (git-fixes).\n- KVM: TDX: Account all non-transient page allocations for per-TD structures (git-fixes).\n- KVM: TDX: Fix x2APIC MSR handling in tdx_has_emulated_msr() (git-fixes).\n- KVM: VMX: Don't register posted interrupt wakeup handler if alloc_kvm_area() fails (git-fixes).\n- KVM: x86/hyperv: Check for NULL vCPU Hyper-V object in kvm_hv_get_tlb_flush_fifo() (git-fixes).\n- KVM: x86/hyperv: Ensure vCPU's Hyper-V object is initialized on cross-vCPU accesses (git-fixes).\n- KVM: x86/hyperv: Get target FIFO in hv_tlb_flush_enqueue(), not caller (git-fixes).\n- KVM: x86/mmu: Recover TDP MMU NX huge pages using MMU read lock (bsc#1271050).\n- KVM: x86/mmu: Rename kvm_tdp_mmu_zap_sp() to better indicate its purpose (bsc#1271050).\n- KVM: x86/mmu: Track possible NX huge pages separately for TDP vs. Shadow MMU (bsc#1271050).\n- KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page (git-fixes).\n- KVM: x86: Don't WARN if IRQ disappears because it was cleared from the PIC (git-fixes).\n- KVM: x86: Don't WARN if IRQ disappears when Xen emulation is enabled (git-fixes).\n- KVM: x86: Fix array_index_nospec() protection in kvm_vcpu_ioctl_x86_set_mce() (git-fixes).\n- KVM: x86: Fix emulated CPUID features being applied to wrong sub-leaf (git-fixes).\n- KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock (git-fixes).\n- leds: pca9532: Fix inverted GPIO output polarity (git-fixes).\n- leds: pca9532: Fix phantom device registration on missing hardware (git-fixes).\n- lib/string: fix memchr_inv() for large ranges (git-fixes).\n- lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() (git-fixes).\n- mac802154: fix data race and NULL deref on local-\u003eassoc_dev (git-fixes).\n- mac802154: fix netdev use-after-free in beacon worker (git-fixes).\n- mac802154: fix use-after-free of sdata via queued RX frames (git-fixes).\n- mailbox: pcc: Fix command timeout due to missed interrupt (git-fixes).\n- mailbox: qcom-cpucp: fix PREEMPT_RT self-deadlock in IRQ handler (git-fixes).\n- mailbox: qcom-cpucp: handle NULL data in send_data callback (git-fixes).\n- mailbox: qcom-ipcc: fix duplicate channel allocation across holes (git-fixes).\n- mailbox: rockchip: disable pclk on probe failure and unbind (git-fixes).\n- maple_tree: fix argument name in header (git-fixes).\n- md/raid1: create serial pool adding rdev to array with serialize_policy=1 (bsc#1272261).\n- media: airspy: Return queued buffers on start_streaming() failure (git-fixes).\n- media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref (git-fixes).\n- media: amphion: Remove obsolete frame_count check in venc_start_session (git-fixes).\n- media: bcm2835-unicam: Fix asc leaked in error/remove path (git-fixes).\n- media: cec-pin: Fix event FIFO ordering (git-fixes).\n- media: cec: disable delayed work before freeing an interrupted transmit (git-fixes).\n- media: cec: extron-da-hd-4k-plus: add sanity check (git-fixes).\n- media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash (git-fixes).\n- media: cec: Serialize exclusive follower delivery (git-fixes).\n- media: cec: stm32: prevent out-of-bounds write on RX overflow (git-fixes).\n- media: cedrus: clean up media device on probe failure (git-fixes).\n- media: cedrus: fix memory leak in cedrus_init_ctrls() (git-fixes).\n- media: chips-media: wave5: Guard bit depth check with initial_info_obtained (git-fixes).\n- media: chips-media: wave5: Move src_buf Removal to finish_encode (git-fixes).\n- media: cobalt: Avoid freeing ALSA private data twice (git-fixes).\n- media: cx231xx: fix devres lifetime (git-fixes).\n- media: cx231xx: reject geometry changes while the VBI queue is busy (git-fixes).\n- media: cx23885: add ioremap return check and cleanup (git-fixes).\n- media: cx23885: cancel NetUP CI work before teardown (git-fixes).\n- media: em28xx: defer audio-only extension registration (git-fixes).\n- media: em28xx: fix use-after-free of dev_next-\u003edevlist on disconnect (git-fixes).\n- media: go7007: defer the ALSA v4l2 put until card release (git-fixes).\n- media: hevc: add bounded tile-count helpers (git-fixes).\n- media: i2c: alvium: fix critical pointer access in alvium_ctrl_init (git-fixes).\n- media: i2c: alvium: Fix: Correct name of register in alvium_set_ctrl_auto_exposure (git-fixes).\n- media: i2c: imx219: Rename VTS to FRM_LENGTH (stable-fixes).\n- media: i2c: imx415: Return test pattern write errors (git-fixes).\n- media: i2c: ov02a10: fix endpoint parsing use-after-free (git-fixes).\n- media: i2c: ov7740: fix use-after-destroy in remove (git-fixes).\n- media: i2c: rdacm21: Fix missing media_entity_cleanup() (git-fixes).\n- media: imx219: Fix maximum frame length in lines (git-fixes).\n- media: intel/ipu6: fix async notifier cleanup leak on parse error (git-fixes).\n- media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for overlapping ranges (git-fixes).\n- media: ipu6: Do not free aux device pdata after init (git-fixes).\n- media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define (git-fixes).\n- media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define (git-fixes).\n- media: mc-entity: Add missing kerneldoc (git-fixes).\n- media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity (git-fixes).\n- media: meson: vdec: Fix memory leak in error path of vdec_open (git-fixes).\n- media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common (git-fixes).\n- media: msi2500: Return queued buffers on start_streaming() failure (git-fixes).\n- media: nuvoton: npcm-video: fix error handling in npcm_video_init() (git-fixes).\n- media: nuvoton: npcm-video: fix memory leaks in probe and remove (git-fixes).\n- media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe (git-fixes).\n- media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure (git-fixes).\n- media: nxp: imx8-isi: Correct color map between V4L2 and ISI (git-fixes).\n- media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path (git-fixes).\n- media: nxp: imx8-isi: Fix potential out-of-bounds issues (git-fixes).\n- media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding (git-fixes).\n- media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing (git-fixes).\n- media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks (git-fixes).\n- media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() (stable-fixes).\n- media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup (git-fixes).\n- media: platform: mtk-mdp3: Fix SCP device refcounting (git-fixes).\n- media: pwc: Drain fill_buf on start_streaming() failure (git-fixes).\n- media: pwc: Return queued buffers on start_streaming() failure (git-fixes).\n- media: qcom: camss: Fix RDI streaming for CSID GEN2 (git-fixes).\n- media: radio-si476x: Unregister v4l2_device on probe failure (git-fixes).\n- media: rc: sunxi-cir: Unregister rc device on probe failure (git-fixes).\n- media: rtl2832: fix use-after-free in rtl2832_remove() (git-fixes).\n- media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure (git-fixes).\n- media: rtl2832_sdr: Return queued buffers on start_streaming() failure (git-fixes).\n- media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak (git-fixes).\n- media: s2255: bound JPEG frame size before copying into the buffer (git-fixes).\n- media: s2255: check firmware size before reading trailing marker (git-fixes).\n- media: saa7134: Fix a possible memory leak in saa7134_video_init1 (git-fixes).\n- media: saa7164: fix cleanup on resource allocation failure (git-fixes).\n- media: stm32: dcmi: unregister notifier on probe failure (git-fixes).\n- media: sun4i-csi: Return queued buffers on start_streaming() failure (git-fixes).\n- media: tda18250: fix possible integer overflow (git-fixes).\n- media: tegra-video: vi: fix invalid u32 return value in format lookup (git-fixes).\n- media: usbtv: keep device alive while ALSA card exists (git-fixes).\n- media: v4l2-async: avoid deleting unlinked ASC entry on link error (git-fixes).\n- media: v4l2-async: Unregister sub-device if asc_list is empty (git-fixes).\n- media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() (git-fixes).\n- media: v4l2-ctrls: Allow unknown HDR10 white point and luminance (git-fixes).\n- media: v4l2-ctrls: validate AV1 tile counts (git-fixes).\n- media: v4l2-ctrls: validate HEVC tile counts (git-fixes).\n- media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link (git-fixes).\n- media: v4l2-h264: Fix memcmp() size in B1 reference list comparison (git-fixes).\n- media: v4l2-subdev: Fail {enable,disable}_streams and s_streaming nicely (git-fixes).\n- media: venus: fix payload size calculation in parse_raw_formats() (git-fixes).\n- media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() (git-fixes).\n- media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity (git-fixes).\n- media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer (git-fixes).\n- media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity (git-fixes).\n- media: vicodec: fix out-of-bounds write in FWHT encoder (git-fixes).\n- media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure (git-fixes).\n- media: vimc: fix pixel format lookup in enum_framesizes (git-fixes).\n- media: vivid: add vivid_update_reduced_fps() (git-fixes).\n- media: vivid: check for vb2_is_busy() when toggling caps (git-fixes).\n- media: vivid: fix cleanup bugs in vivid_init() (git-fixes).\n- media: zoran: Avoid freeing a registered video_device twice (git-fixes).\n- mei: pull kvfree out of spinlock (git-fixes).\n- mfd: iqs62x: Reject zero-length firmware records (git-fixes).\n- mfd: rave-sp: validate received frame payload lengths (git-fixes).\n- mfd: sm501: Fix potential memory leaks during remove (git-fixes).\n- misc: bcm-vk: Use acquire/release for msgq_inited (git-fixes).\n- misc: fastrpc: fix channel ctx ref leak when session alloc fails (git-fixes).\n- misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free (git-fixes).\n- misc: fastrpc: Remove buffer from list prior to unmap operation (git-fixes).\n- misc: fastrpc: take fl-\u003elock when moving mmaps on interrupted invoke (git-fixes).\n- misc: nsm: bound the device-reported response length (git-fixes).\n- misc: rtsx: add missing write register handling (git-fixes).\n- misc: sgi-gru: remove interrupt-context page-table walks (git-fixes).\n- misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() (git-fixes).\n- mkspec-dtb: Move DTS prefix into package list.\n- mkspec-dtb: Move provides-obsoletes to package list.\n- mkspec-dtb: Put per-architecture package lists into a hash.\n- mkspec-dtb: re-indent.\n- mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition (git-fixes).\n- mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit (git-fixes).\n- mmc: sdhci: unmap the bounce buffer before device release (git-fixes).\n- mmc: via-sdmmc: stop card-detect handling on probe failure (git-fixes).\n- mtd: afs: validate v2 image info bounds (git-fixes).\n- mtd: fix double free and WARN_ON in add_mtd_device() error paths (git-fixes).\n- mtd: mtdoops: free page bitmap when the backing MTD is removed (git-fixes).\n- mtd: mtdswap: Avoid freeing registered blktrans device twice (git-fixes).\n- mtd: mtdswap: remove debugfs stats file on teardown (git-fixes).\n- mtd: nand: mtk-ecc: stop on ECC idle timeouts (git-fixes).\n- mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() (git-fixes).\n- mtd: rawnand: validate ONFI extended parameter page sections (git-fixes).\n- mtd: spinand: fix direct mapping creation sizes (stable-fixes).\n- mtd: spinand: repeat reading in regular mode if continuous reading fails (stable-fixes).\n- mtd: spinand: try a regular dirmap if creating a dirmap for continuous reading fails (stable-fixes).\n- mtd: ubi: Release device reference on busy detach (git-fixes).\n- mtd: ubi: skip programming unused bits in ubi headers (stable-fixes).\n- net: Add options as a flexible array to struct ip_tunnel_info (bsc#1274727).\n- net: mana: Add debug knob to skip TX timeout recovery reset (git-fixes).\n- net: mana: Add handler for sriov configure (bsc#1272756).\n- net: mana: Cap MSI-X vectors to the device MSI-X table size (git-fixes).\n- net: mana: Extend RX CQE coalescing up to 8 packets (git-fixes).\n- net: mana: Fall back to scattered pages for GDMA queues (git-fixes).\n- net: mana: force full-page RX buffers via ethtool private flag (bsc#1269792).\n- net: mana: refactor mana_get_strings() and mana_get_sset_count() to use switch (bsc#1269792).\n- net: mana: Route ring-buffer access through offset-based helpers (git-fixes).\n- net: tap: set skb-\u003edev before parsing virtio net header in tap_get_user_xdp() (git-fixes bsc#1274550).\n- net: thunderbolt: Count delivered packets in rx_packets and rx_bytes (git-fixes).\n- net: thunderbolt: Mark the connection down when bringing it up fails (git-fixes).\n- net: thunderbolt: Release the Rx HopID that was handed out on mismatch (git-fixes).\n- net: thunderbolt: Tear down DMA paths before stopping the rings (git-fixes).\n- net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() (git-fixes).\n- net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow (git-fixes).\n- net: usb: ipheth: fix carrier_work UAF on disconnect (git-fixes).\n- net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition (git-fixes).\n- nfc: digital: clamp SENSF_RES length to the destination buffer (git-fixes).\n- nfc: digital: Do not dump a NULL response in command completion (git-fixes).\n- nfc: fdp: bound the device-reported read length and fix an skb leak (git-fixes).\n- nfc: llcp: avoid userspace overflow on invalid optlen (git-fixes).\n- nfc: llcp: bound SNL TLV parsing to the skb and add length checks (git-fixes).\n- nfc: llcp: bound the connect_sn TLV walk to the skb (git-fixes).\n- nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (git-fixes).\n- nfc: llcp: read llcp_sock-\u003elocal under the socket lock in getsockopt (git-fixes).\n- nfc: llcp: reject PDUs shorter than the LLCP header (git-fixes).\n- nfc: microread: validate target discovery payload lengths (git-fixes).\n- nfc: nci: fix double completion race in nci_data_exchange_complete (git-fixes).\n- nfc: nci: fix out-of-bounds write in nci_target_auto_activated() (git-fixes).\n- nfc: nci: fix uninit-value in the RF discover/activated NTF handlers (git-fixes).\n- nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing (git-fixes).\n- nfc: nci: free destination parameters when closing a connection (git-fixes).\n- nfc: pn533: hold a reference to the request skb during send_frame (git-fixes).\n- nfc: pn533: purge fragmented skbs during cleanup (git-fixes).\n- nfc: st21nfca: validate ATR_REQ length against the received frame (git-fixes).\n- nouveau/gem: reserve the bo in the info ioctl around the vma lookup (git-fixes).\n- nvme-tcp: fix usage of page_frag_cache (bsc#1267882).\n- nvmet-rdma: fix queue leak when connect backlog is exceeded (git-fixes).\n- of: fix out-of-bounds read in of_alias_scan() stem parser (git-fixes).\n- PCI/ASPM: Use pcie_capability_clear_and_set_word() for ASPM disable/restore (git-fixes).\n- PCI/proc: Avoid spurious runtime PM wakeup on config space accesses (git-fixes).\n- PCI/proc: Use file_ns_capable() when checking config space read access (git-fixes).\n- PCI/proc: Warn on writes to kernel-exclusive config space regions (git-fixes).\n- PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses (git-fixes).\n- PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] (git-fixes).\n- PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip (git-fixes).\n- PCI: j721e: Fix incorrect max_lanes for J7200 (git-fixes).\n- PCI: meson: Fix GPIO state while requesting PERST# (git-fixes).\n- PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts() (git-fixes).\n- PCI: plda: Fix use-after-free of event IRQs during teardown (git-fixes).\n- perf: Reject exited events as group leaders (git-fixes).\n- pinctrl: bcm2835: Don't remove an unregistered GPIO chip (git-fixes).\n- pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip (git-fixes).\n- pinctrl: rockchip: Reset the pin count when recalculating SoC data (git-fixes).\n- platform/chrome: cros_ec_debugfs: Clean up console log on probe failure (git-fixes).\n- platform/chrome: cros_ec_debugfs: Unregister panic notifier (git-fixes).\n- platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count (git-fixes).\n- platform/chrome: sensorhub: Bound the EC-reported sensor number (git-fixes).\n- platform/chrome: sensorhub: Fix dropped timestamp events and log spam (git-fixes).\n- platform/chrome: sensorhub: Fix memory overread in ring handler (git-fixes).\n- platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL (git-fixes).\n- platform/surface: acpi-notify: Check ACPI companion before use (git-fixes).\n- platform/x86/amd/hsmp: Reject negative power cap writes in hwmon (git-fixes).\n- platform/x86: asus-wmi: fix resource leaks on probe failure (git-fixes).\n- platform/x86: dell-privacy: Fix race condition (git-fixes).\n- platform/x86: dell-wmi-base: Fix resource leak on module load failure (git-fixes).\n- platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer (git-fixes).\n- platform/x86: dell-wmi-sysman: Fix instance ID bounds (git-fixes).\n- platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS (git-fixes).\n- platform/x86: hp-bioscfg: advance elem past consumed array elements (git-fixes).\n- platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() (git-fixes).\n- platform/x86: hp-bioscfg: fix heap OOB read on empty password write (git-fixes).\n- platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password (git-fixes).\n- platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() (git-fixes).\n- platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed (git-fixes).\n- platform/x86: hp-bioscfg: fix password encoding bounds check (git-fixes).\n- platform/x86: hp-bioscfg: warn on element type mismatch instead of failing (git-fixes).\n- platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path (git-fixes).\n- platform/x86: ISST: Add a NULL check for sst_inst (git-fixes).\n- platform/x86: ISST: Just allow 2 bits for SST feature enable (git-fixes).\n- platform/x86: ISST: Return error during profile addition (git-fixes).\n- platform/x86: ISST: Use PP level enable mask (git-fixes).\n- platform/x86: ISST: Validate level in perf mask ioctls (git-fixes).\n- platform/x86: ISST: Validate logical CPU id and clos id (git-fixes).\n- platform/x86: ISST: Validate parameter for core power state (git-fixes).\n- platform/x86: ISST: Validate parameter for frequency and priority (git-fixes).\n- platform/x86: ISST: Validate socket ID in clos_assoc ioctl (git-fixes).\n- PM: hibernate: Fix memory leak in snapshot_write_next() error path (git-fixes).\n- PM: sleep: Fix off-by-one in wakelocks number limit check (git-fixes).\n- power: supply: bd99954: Drop bad register fields (git-fixes).\n- power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address (git-fixes).\n- power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address (git-fixes).\n- power: supply: bq27xxx: bq27520g4: fix REG_TTES address (git-fixes).\n- power: supply: bq256xx: drain usb_work before freeing the charger (git-fixes).\n- power: supply: bq24257: fix use-after-free on remove (git-fixes).\n- power: supply: bq25890: Fix power_supply reference leak (git-fixes).\n- power: supply: charger-manager: register regulators before exposing sysfs (git-fixes).\n- power: supply: cros_usbpd-charger: bound the EC-reported port count (git-fixes).\n- power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS (git-fixes).\n- power: supply: isp1704_charger: cancel work on remove (git-fixes).\n- power: supply: lp8727: fix use-after-free in lp8727_release_irq() (git-fixes).\n- power: supply: lp8788-charger: fix use-after-free on remove (git-fixes).\n- power: supply: max17040: drop incorrect I2C functionality check (git-fixes).\n- power: supply: max17040: propagate register read errors (git-fixes).\n- power: supply: max17040: synchronize work cancellation on suspend (git-fixes).\n- power: supply: qcom_battmgr: terminate the strings from firmware (git-fixes).\n- power: supply: rt9455: quiesce delayed work before teardown (git-fixes).\n- power: supply: sbs-battery: Use a per-device serial number buffer (git-fixes).\n- power: supply: sc2731_charger: cancel work on remove (git-fixes).\n- power: supply: twl4030_charger: cancel workers via devm (git-fixes).\n- power: supply: ucs1002: fix use-after-free on remove (git-fixes).\n- powercap: intel_rapl_tpmi: Handle PMU registration failure during probe (git-fixes).\n- powerpc/dt_cpu_ftrs: Set CPU_FTR_P11_PVR for Power11 and later processors (bsc#1263864 ltc#217835).\n- powerpc/kexec_file: Use inclusive range checks in add_usable_mem() (git-fixes).\n- powerpc/pseries: Ensure vpa,slb_shadow \u0026 dtl are unregistered during crash (bsc#1271256).\n- powerpc/pseries: lparcfg - fix kbuf[] underflow (bsc#1274753 ltc#221289 bsc#1274754 ltc#221288 bsc#1274752\n  ltc#221290).\n- powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak (bsc#1274751 ltc#221105 bsc#1274750 ltc#221106).\n- powerpc/pseries: pci - logic bug (bsc#1274749 ltc#221282 bsc#1274755 ltc#221284 bsc#1274756 ltc#221283).\n- powerpc/rtas_pci: No hotplug on permanently removed device on pSeries (git-fixes).\n- powerpc: Replace __ASSEMBLY__ with __ASSEMBLER__ in non-uapi headers (bsc#1263864 ltc#217835).\n- powerpc: Replace __ASSEMBLY__ with __ASSEMBLER__ in uapi headers (bsc#1263864 ltc#217835).\n- ppdev: prevent overflow when setting port timeout (git-fixes).\n- rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() (git-fixes).\n- rapidio: clear mport-\u003enet when rio_add_net() fails (git-fixes).\n- rapidio: mport_cdev: fix use-after-free in dma_req_free() (git-fixes).\n- RDMA/bnxt_re: Avoid displaying the kernel pointer (git-fixes).\n- RDMA/bnxt_re: Proper rollback if the ioremap fails (git-fixes).\n- RDMA/irdma: Remove redundant legacy_mode checks (git-fixes).\n- RDMA/mana_ib: drain QP references after partial table insertion (git-fixes).\n- RDMA/mana_ib: unify QP lookup table (git-fixes).\n- RDMA/mlx5: Fix integer overflow of user QP buffer size (git-fixes).\n- regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer (git-fixes).\n- regulator: core: use system_freezable_wq for init complete work (git-fixes).\n- regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata (git-fixes).\n- regulator: qcom-refgen: correct the regulator type to CURRENT (git-fixes).\n- regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling (git-fixes).\n- remoteproc: qcom: Fix glink-\u003enode reference leak in qcom_add_glink_subdev (git-fixes).\n- remoteproc: qcom_q6v5_adsp: Fix reference leak for device node (git-fixes).\n- remoteproc: scp: Fix device reference leak on failed lookup (git-fixes).\n- Revert \"drm/amdgpu: fix aperture mapping leak\" (git-fixes).\n- Revert \"media: v4l2-dev: fix error handling in __video_register_device()\" (git-fixes).\n- Revert \"net: thunderbolt: Enable end-to-end flow control also in transmit\" (git-fixes).\n- Revert \"thermal/drivers/hwmon: Cleanup coding style a bit\" (stable-fixes).\n- Revert \"wifi: mt76: Disable napi when removing device\" (git-fixes).\n- rpmsg: core: Fix incorrect return value documentation (git-fixes).\n- rpmsg: glink: smem: order FIFO read after availability check (git-fixes).\n- rtc: gamecube: check return value of devm_rtc_register_device() (git-fixes).\n- rtc: pcf8563: fix clock provider leak on unbind (git-fixes).\n- rtc: pcf85363: Add error checking to regmap calls in probe() (git-fixes).\n- rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers (git-fixes).\n- rtc: rzn1: Fix weekday underflow when alarm crosses month boundary (git-fixes).\n- rtc: zynqmp: Return optional clock lookup errors (git-fixes).\n- s390/pkey: Check length in pkey_pckmo handler implementation (bsc#1270266).\n- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (bsc#1270267).\n- sched/psi: Create the psimon kthread outside of cgroup_mutex (bsc#1269134).\n- scsi: fnic: Abort timed-out NVMe LS requests (bsc#1236344).\n- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (bsc#1236344).\n- scsi: fnic: Add FDLS role handling for NVMe initiators (bsc#1236344).\n- scsi: fnic: Add the NVMe/FC transport path (bsc#1236344).\n- scsi: fnic: Advertise NVMe initiator service parameters (bsc#1236344).\n- scsi: fnic: Bump up version number (bsc#1236344).\n- scsi: fnic: Decode firmware role configuration (bsc#1236344).\n- scsi: fnic: Do not use GFP_ZERO for mempools (bsc#1236344).\n- scsi: fnic: Expose NVMe transport state in debugfs (bsc#1236344).\n- scsi: fnic: Handle NVMe LS frames in FDLS (bsc#1236344).\n- scsi: fnic: Make debug logging protocol independent (bsc#1236344).\n- scsi: fnic: Make fnic_queuecommand() easier to analyze (bsc#1236344).\n- scsi: fnic: Refactor in_remove flag and call to fnic_fcpio_reset() (bsc#1236344).\n- scsi: fnic: Remove a useless struct mempool forward declaration (bsc#1236344).\n- scsi: fnic: Rename fnic_scsi_fcpio_reset() (bsc#1236344).\n- scsi: fnic: Route completions and resets by initiator role (bsc#1236344).\n- scsi: fnic: Self-assignment of intr_time_type has no effect (bsc#1236344).\n- scsi: fnic: Send NVMe LS requests through FDLS (bsc#1236344).\n- scsi: fnic: Switch to use %ptSp (bsc#1236344).\n- scsi: fnic: Track NVMe transport statistics (bsc#1236344).\n- scsi: fnic: Use fnic_num for non-SCSI identifiers (bsc#1236344).\n- scsi: fnic: Use mempool for receive frames (bsc#1236344).\n- scsi: qla2xxx: Add support to report MPI FW state (bsc#1275737).\n- scsi: qla2xxx: Declare qla2xxx_mqueuecommand() static (bsc#1275737).\n- scsi: qla2xxx: Use nr_cpu_ids instead of NR_CPUS for qp_cpu_map allocation (bsc#1275737).\n- scsi: storvsc: Support manual scans for all Hyper-V targets (git-fixes).\n- sctp: avoid auth_enable sysctl UAF during netns teardown (git-fixes).\n- selftests/alsa: Fix the step check for INTEGER controls (git-fixes).\n- serial: 8250_dma: Clear stale RX state on shutdown (git-fixes).\n- serial: amba-pl011: unprepare console clock on unregister (git-fixes).\n- serial: core: clear freed pointers on uart_register_driver() failure (git-fixes).\n- serial: imx: serialize imx_uart_ports lifetime (git-fixes).\n- serial: ma35d1: Fix OF node reference leaks in console init (git-fixes).\n- serial: qcom-geni: do not advance stale DMA completions (git-fixes).\n- serial: qcom-geni: fix TX DMA buffer flush (git-fixes).\n- serial: sc16is7xx: enable THRI before filling TX FIFO (git-fixes).\n- serial: sc16is7xx: rename EFR mutex with generic name (stable-fixes).\n- serial: sc16is7xx: use guards for simple mutex locks (stable-fixes).\n- slab.h: disable completely broken overflow handling in flex allocations (bsc#1280139).\n- slab: Introduce kmalloc_flex() and family (bsc#1280139).\n- slab: Introduce kmalloc_obj() and family (bsc#1280139).\n- slab: recognize @GFP parameter as optional in kernel-doc (bsc#1280139).\n- smb/client: handle overlapping allocated ranges in fallocate (bsc#1274902).\n- smb: client: harden POSIX SID length parsing (bsc#1273557).\n- smb: client: require net admin for CIFS SWN netlink (bsc#1273966).\n- smb: client: resolve SWN tcon from live registrations (bsc#1273872).\n- soc: fsl: qe: check platform_driver_register() in qe_ic_of_init() (git-fixes).\n- soc: qcom: rpmh-rsc: manage PM notifiers with devres (git-fixes).\n- soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() (git-fixes).\n- software node: Fix software_node_get_reference_args() with index -1 (git-fixes).\n- soundwire: qcom: Fix port exhaustion check in stream_alloc_ports (git-fixes).\n- speakup: keyhelp: guard letter_offsets possible out-of-range indexing (git-fixes).\n- spi: bcm63xx-hsspi: disable clocks on resume failure (git-fixes).\n- spi: bcm63xx: disable clock on resume failure (git-fixes).\n- spi: bcmbca-hsspi: disable clocks on resume failure (git-fixes).\n- spi: davinci: switch to managed controller allocation (git-fixes).\n- spi: Fix DMA mapping ownership on partial map failure (git-fixes).\n- spi: img-spfi: don't disable runtime PM on DMA deferred probe (git-fixes).\n- spi: oc-tiny: switch to managed controller allocation (git-fixes).\n- spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX (git-fixes).\n- spi: spi-cadence: Move TX FIFO full busy-wait into FIFO (git-fixes).\n- spi: spi-cadence: supports transmission with bits_per_word of 16 and 32 (stable-fixes).\n- spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers (stable-fixes).\n- spi: sprd-adi: Fix probe succeeding without registering the controller (git-fixes).\n- staging: fbtft: Use sysfs_emit_at() to print to sysfs file (git-fixes).\n- staging: media: tegra-video: fix of_node_put() on VIP parse errors (git-fixes).\n- staging: media: tegra-video: vi: fix probe failure on skipped last port (git-fixes).\n- staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown (git-fixes).\n- staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() (git-fixes).\n- staging: rtl8723bs: fix missing shared-key auth challenge length check (git-fixes).\n- staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() (git-fixes).\n- staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() (git-fixes).\n- staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() (git-fixes).\n- staging: rtl8723bs: fix OOB read in WMM_param_handler() (git-fixes).\n- staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() (git-fixes).\n- staging: rtl8723bs: use kfree_sensitive() for key material (git-fixes).\n- staging: rtl8723bs: validate monitor transmit frame lengths (git-fixes).\n- staging: sm750fb: Add missing Kconfig dependency (git-fixes).\n- staging: sm750fb: gate dualview dataflow using g_dualview (git-fixes).\n- thermal/drivers/imx: Disable clock on runtime resume failure (git-fixes).\n- thermal/drivers/qoriq: Disable clock on resume failure (git-fixes).\n- thermal/drivers/rcar: Fix error checking in probe() (git-fixes).\n- thermal: intel: int3400: clean up ODVP on probe failures (git-fixes).\n- thermal: sysfs: switch to use scnprintf() to suppress truncation warning (git-fixes).\n- thunderbolt: Bound the DROM dual link port number before indexing sw-\u003eports (git-fixes).\n- thunderbolt: Fix bandwidth group reservation indexing (git-fixes).\n- thunderbolt: icm: Preserve USB4 proxy data-valid bit (git-fixes).\n- tlclk: if sscanf() fails, fall back to 0, not random value (git-fixes).\n- tpm: st33zp24: Return zero on status read failure (git-fixes).\n- tpm: st33zp24: Validate locality read result (git-fixes).\n- tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout (git-fixes).\n- tty: clear cdev pointer after cdev_add() failure (git-fixes).\n- tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 (git-fixes).\n- tty: skip cdev_del() when no cdev is registered (git-fixes).\n- uio: Fix stale info pointer in failed registration path (git-fixes).\n- usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() (git-fixes).\n- usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect (git-fixes).\n- usb: atm: usbatm: fix invalid ci_range initialization (git-fixes).\n- USB: c67x00: fix use-after-free in c67x00_add_iso_urb() (git-fixes).\n- usb: cdnsp: fix incorrect endian conversions for APB timeout register (git-fixes).\n- usb: core: Add lock to usb_wakeup_notification() (git-fixes).\n- usb: core: Add lock to usb_wakeup_notification() (stable-fixes).\n- usb: core: Strengthen error handling in hub_hub_status() (git-fixes).\n- usb: core: Strengthen error handling in hub_hub_status() (stable-fixes).\n- usb: core: sysfs: add lock to bos_descriptors_read() (stable-fixes).\n- usb: dwc2: add missing @remotewakeup kernel-doc parameter (git-fixes).\n- usb: dwc2: gadget: Exit partial power down state when changing USB pull-up (git-fixes).\n- usb: dwc3: clear forceRM when issuing EndTransfer (git-fixes).\n- usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition (git-fixes).\n- usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns() (git-fixes).\n- usb: fix UAF when probe runs concurrent to dyn ID removal (git-fixes).\n- usb: gadget: aspeed_udc: check endpoint DMA allocation (git-fixes).\n- usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed (git-fixes).\n- usb: gadget: configfs: fix out-of-bounds read of qw_sign (git-fixes).\n- usb: gadget: f_fs: Fix fence cleanup in ffs_dmabuf_transfer() error paths (git-fixes).\n- usb: gadget: f_fs: Prevent deadlock during ep0 read loop (git-fixes).\n- usb: gadget: f_midi: initialize work in f_midi_alloc() (git-fixes).\n- usb: gadget: f_ncm: Use unsigned int for ndp_index (git-fixes).\n- usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() (git-fixes).\n- usb: gadget: f_uac1_legacy: remove broken string configfs attributes (git-fixes).\n- usb: gadget: fix null pointer dereference in usb_put_function_instance() (git-fixes).\n- USB: gadget: fsl-udc: fix dev_printk() device (git-fixes).\n- usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs (git-fixes).\n- usb: gadget: midi2: remove default configfs groups on teardown (git-fixes).\n- usb: gadget: pch_udc: remove excess kernel-doc member for registered (git-fixes).\n- usb: gadget: r8a66597: avoid double free of ep0_req in probe error path (git-fixes).\n- usb: gadget: snps_udc_plat: clean up PHY on probe deferral (git-fixes).\n- usb: gadget: u_audio: Fix use-after-free on sound card disconnect (git-fixes).\n- usb: gadget: uac: validate rate list length before storing (git-fixes).\n- USB: gadget: Use str_enable_disable-like helpers (stable-fixes).\n- usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() (git-fixes).\n- usb: ljca: bound bank_num in ljca_enumerate_gpio() (git-fixes).\n- usb: mtu3: allow system suspend during active gadget connection (git-fixes).\n- usb: musb: omap2430: clean up probe error handling (stable-fixes).\n- usb: musb: omap2430: Do not put borrowed of_node in probe (git-fixes).\n- usb: musb: omap2430: Fix use-after-free in omap2430_probe() (git-fixes).\n- USB: phy: fsl-usb: fix missing static keywords (git-fixes).\n- usb: renesas_usbhs: Fix power-off ordering on unbind (git-fixes).\n- USB: serial: digi_acceleport: fix port registration order (git-fixes).\n- USB: serial: ftdi_sio: add support for E+H FXA291 (stable-fixes).\n- USB: serial: option: add TDTECH MT5710-CN (stable-fixes).\n- USB: serial: option: fix slab OOB read in interrupt URB callback (git-fixes).\n- USB: serial: spcp8x5: drop broken carrier detect support (git-fixes).\n- USB: storage: add NO_ATA_1X quirk for Longmai USB Key (stable-fixes).\n- usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop (git-fixes).\n- usb: typec: qcom-pmic-typec: drain cc_debounce_dwork if port_start() fails (git-fixes).\n- usb: typec: qcom-pmic: cancel reset_work on stop (git-fixes).\n- usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive() (git-fixes).\n- usb: typec: thunderbolt: Disable work before freeing tbt on remove (git-fixes).\n- usb: typec: ucsi: displayport: Fix OOB altmode array index (git-fixes).\n- usb: typec: ucsi: unregister debugfs entries on teardown (git-fixes).\n- usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion (git-fixes).\n- usb: usbfs: fix use-after-free of usb_device in usbdev_release() (git-fixes).\n- usb: usbtest: disable dynamic ID support (stable-fixes).\n- usb: xhci: Handle USB3 port events when there is one roothub (git-fixes).\n- vfs: Add a sysctl for automated deletion of dentry (bsc#1240890 bsc#1276586).\n- vt: add permission check for KDSKBMETA ioctl (stable-fixes).\n- vt: stabilize tty reference in kbd_keycode with tty_port_tty_get (stable-fixes).\n- w1: ds28e17: reject an oversize length on an I2C block read (git-fixes).\n- w1: ds2482: Fix signedness bug in ds2482_w1_triplet() (git-fixes).\n- watchdog: bd96801_wdt: Fix timeout for enabled WDG (git-fixes).\n- watchdog: fix hrtimer start when pretimeout is zero (git-fixes).\n- watchdog: msc313e: Avoid division by zero (git-fixes).\n- watchdog: msc313e: Enable clock before accessing hardware registers (git-fixes).\n- watchdog: msc313e: Fix clock leak and spurious timer in settimeout() (git-fixes).\n- watchdog: msc313e: Fix NULL pointer dereference in PM callbacks (git-fixes).\n- watchdog: msc313e: Fix spurious reset on suspend (git-fixes).\n- watchdog: msc313e: Fix undefined behavior (git-fixes).\n- watchdog: msc313e: Sync timeout value if WDT was running at boot (git-fixes).\n- watchdog: sunxi_wdt: preserve boot-enabled watchdog (git-fixes).\n- wifi: ath6kl: avoid buffer overreads in WMI event handlers (git-fixes).\n- wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets (git-fixes).\n- wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump (git-fixes).\n- wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() (git-fixes).\n- wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate (git-fixes).\n- wifi: ath11k: Correctly copy the hint BSSID in WMI scan request (git-fixes).\n- wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event() (git-fixes).\n- wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx() (git-fixes).\n- wifi: ath12k: Correctly copy the hint BSSID in WMI scan request (git-fixes).\n- wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() (git-fixes).\n- wifi: brcmfmac: fix P2P action frame handling without device vif (git-fixes).\n- wifi: brcmfmac: initialize SDIO data work before cleanup (git-fixes).\n- wifi: cfg80211: bound element ID read when checking non-inheritance (git-fixes).\n- wifi: cfg80211: cancel sched scan results work on unregister (git-fixes).\n- wifi: cfg80211: derive S1G beacon TSF from S1G fields (git-fixes).\n- wifi: cfg80211: reject unsupported PMSR FTM location requests (git-fixes).\n- wifi: cfg80211: validate PMSR FTM preamble range (git-fixes).\n- wifi: cfg80211: validate PMSR measurement type data (git-fixes).\n- wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() (git-fixes).\n- wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs (git-fixes).\n- wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments (git-fixes).\n- wifi: iwlwifi: mei: check SAP message length before reading it (git-fixes).\n- wifi: iwlwifi: mei: pass correct argument to function (git-fixes).\n- wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser (git-fixes).\n- wifi: libertas: fix memory leak in helper_firmware_cb() (git-fixes).\n- wifi: mac80211: disconnect on CSA to channel 0 (git-fixes).\n- wifi: mac80211: fix fils_discovery double free on alloc failure (git-fixes).\n- wifi: mac80211: fix per-STA profile length in cross-link CSA parsing (git-fixes).\n- wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure (git-fixes).\n- wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock (git-fixes).\n- wifi: mac80211: send TWT teardown to peer after setup TX failure (git-fixes).\n- wifi: mac80211: skip default WMM setup for AP_VLAN links (git-fixes).\n- wifi: mac80211: skip unused probe response countdown offsets (git-fixes).\n- wifi: mt76: check txfree done event on the WED hw path (git-fixes).\n- wifi: mt76: fix 4th chain ACK RSSI bitmask in sta_poll (git-fixes).\n- wifi: mt76: fix ER-SU 106-tone RU check in RX rate decode (git-fixes).\n- wifi: mt76: fix HE DCM max-RU capability encoding (git-fixes).\n- wifi: mt76: fix non-AQL packet accounting for MLO stations (git-fixes).\n- wifi: mt76: fix stranded frames in mt76_txq_schedule_pending (git-fixes).\n- wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length (git-fixes).\n- wifi: mt76: mt792x: Fix memory leak in SDIO TX path (git-fixes).\n- wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete (git-fixes).\n- wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex (git-fixes).\n- wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss (git-fixes).\n- wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear (git-fixes).\n- wifi: mt76: mt7915: fix double hif2 init on the non-WED path (git-fixes).\n- wifi: mt76: mt7915: fix ext PHY use-after-free on register error path (git-fixes).\n- wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986 (git-fixes).\n- wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie (git-fixes).\n- wifi: mt76: mt7915: release hif2 reference on probe IRQ failure (git-fixes).\n- wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement (git-fixes).\n- wifi: mt76: mt7915: unwind state on add_interface failure (git-fixes).\n- wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields (git-fixes).\n- wifi: mt76: mt7915: write RX header translation bit to the correct register (git-fixes).\n- wifi: mt76: mt7921: skip unknown CLC firmware records (git-fixes).\n- wifi: mt76: mt7921: validate CLC firmware records (git-fixes).\n- wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb (git-fixes).\n- wifi: mt76: mt7925: fix msg len mismatch between driver and firmware (git-fixes).\n- wifi: mt76: mt7925: update clc before setting sar power table (git-fixes).\n- wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config (git-fixes).\n- wifi: mt76: mt7996: don't report a zero TX bitrate (git-fixes).\n- wifi: mt76: mt7996: fix capability of EHT-MCS 15 in MRU (git-fixes).\n- wifi: mt76: mt7996: fix reg addr remap when addr is 0 (git-fixes).\n- wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV (git-fixes).\n- wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset (git-fixes).\n- wifi: mt76: mt7996: validate RX band_idx before dereferencing phys (git-fixes).\n- wifi: mt76: only consume the WO drop bit on WED v2 devices (git-fixes).\n- wifi: mt76: report data NSS for STBC frames in RX rate decode (git-fixes).\n- wifi: mwifiex: Detach sync cmd buffer on interrupted wait (git-fixes).\n- wifi: nl80211: free RNR data on MBSSID mismatch (git-fixes).\n- wifi: nl80211: validate nested MBSSID IE blobs (git-fixes).\n- wifi: p54: validate RX frame length in p54_rx_eeprom_readback() (git-fixes).\n- wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop (git-fixes).\n- wifi: rtl818x: initialize eeprom_93cx6 struct to zero (git-fixes).\n- wifi: rtlwifi: pci: fix error path in rtl_pci_probe() (git-fixes).\n- wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids (git-fixes).\n- wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars() (git-fixes).\n- wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() (git-fixes).\n- wifi: rtw88: pci: fix resource leak on failed NAPI setup (git-fixes).\n- wifi: rtw89: fix HE extended capability length check (git-fixes).\n- wifi: zd1211rw: reject secondary interfaces to prevent conflicts (git-fixes).\n- x86/virt/tdx: Print TDX module version during init (git-fixes).\n- x86/virt/tdx: Retrieve TDX module version (git-fixes).\n- xhci: dbgtty: Fix unregister on tty_alloc_driver() failure (git-fixes).\n- xhci: dbgtty: Fix unregister on tty_register_driver() failure (git-fixes).\n- xhci: fix lost bounce buffers on TDs spanning several ring segments (git-fixes).\n","status":"published","published":"2026-09-22T13:58:11Z","modified":"2026-09-30T18:23:11.377740347Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23902-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).\n- CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).\n- CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).\n- CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).\n- CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).\n- CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).\n- CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).\n- CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).\n- CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).\n- CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).\n- CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).\n- CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).\n- CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).\n- CVE-2026-43239: smb: client: prevent races in -\u003equery_interfaces() (bsc#1264444).\n- CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).\n- CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).\n- CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).\n- CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).\n- CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).\n- CVE-2026-43416: powerpc, perf: Check that current-\u003emm is alive before getting user callchain (bsc#1265121).\n- CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).\n- CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).\n- CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).\n- CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).\n- CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).\n- CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).\n- CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).\n- CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).\n- CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).\n- CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).\n- CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).\n- CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).\n- CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).\n- CVE-2026-52912: netfilter: nf_queue: hold bridge skb-\u003edev while queued (bsc#1269000).\n- CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).\n- CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).\n- CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).\n- CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).\n- CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).\n- CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).\n- CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).\n- CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).\n- CVE-2026-52991: sched/psi: fix race between file release and pressure write (bsc#1269134).\n- CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).\n- CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).\n- CVE-2026-53031: bpf: Validate node_id in arena_alloc_pages() (bsc#1269380).\n- CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).\n- CVE-2026-53034: bpf, sockmap: Fix af_unix null-ptr-deref in proto update (bsc#1269140).\n- CVE-2026-53048: gfs2: prevent NULL pointer dereference during unmount (bsc#1269162).\n- CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).\n- CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).\n- CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).\n- CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).\n- CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).\n- CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).\n- CVE-2026-53092: bpf: Fix linked reg delta tracking when src_reg == dst_reg (bsc#1269528).\n- CVE-2026-53094: bpf: Fix stale offload-\u003eprog pointer after constant blinding (bsc#1269965).\n- CVE-2026-53096: bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path (bsc#1269969).\n- CVE-2026-53109: powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy (bsc#1269417).\n- CVE-2026-53110: s390: always declare expoline thunks (bsc#1269985).\n- CVE-2026-53111: bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap (bsc#1269167).\n- CVE-2026-53114: perf: Extend the bit width of the arch-specific flag (bsc#1269999).\n- CVE-2026-53126: blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() (bsc#1269635).\n- CVE-2026-53129: fs/mbcache: cancel shrink work before destroying the cache (bsc#1269633).\n- CVE-2026-53142: drm/xe/display: fix oops in suspend/shutdown without display (bsc#1269402).\n- CVE-2026-53154: mm/hugetlb: restore reservation on error in hugetlb folio copy paths (bsc#1269665).\n- CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (bsc#1269306).\n- CVE-2026-53180: timers/migration: Fix livelock in tmigr_handle_remote_up() (bsc#1269888).\n- CVE-2026-53207: mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison (bsc#1269590).\n- CVE-2026-53219: netfilter: x_tables: avoid leaking percpu counter pointers (bsc#1269686).\n- CVE-2026-53220: netfilter: revalidate bridge ports (bsc#1269381).\n- CVE-2026-53223: net: guard timestamp cmsgs to real error queue skbs (bsc#1269301).\n- CVE-2026-53228: ipv6: sit: reload inner IPv6 header after GSO offloads (bsc#1269256).\n- CVE-2026-53238: netlabel: validate unlabeled address and mask attribute lengths (bsc#1269774).\n- CVE-2026-53264: net/sched: act_api: use RCU with deferred freeing for action lifecycle (bsc#1269238).\n- CVE-2026-53269: netfilter: synproxy: add mutex to guard hook reference counting (bsc#1269579).\n- CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).\n- CVE-2026-53291: ALSA: hda/conexant: Fix missing error check for jack detection (bsc#1269697).\n- CVE-2026-53309: ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison (bsc#1269815).\n- CVE-2026-53330: drm/amd/display: Fix out-of-bounds read in (bsc#1270090).\n- CVE-2026-53336: nvmem: layouts: onie-tlv: fix hang on unknown types (bsc#1270108).\n- CVE-2026-53337: net: bonding: fix NULL pointer dereference in bond_do_ioctl() (bsc#1270251).\n- CVE-2026-53341: fhandle: fix UAF due to unlocked -\u003emnt_ns read in may_decode_fh() (bsc#1270139).\n- CVE-2026-53353: hsr: Remove WARN_ONCE() in hsr_addr_is_self() (bsc#1270111).\n- CVE-2026-53365: vsock/virtio: fix zerocopy completion for multi-skb sends (bsc#1271365).\n- CVE-2026-63801: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (bsc#1272230).\n- CVE-2026-63803: hdlc_ppp: sync per-proto timers before freeing hdlc state (bsc#1272284).\n- CVE-2026-63804: gfs2: fix use-after-free in gfs2_qd_dealloc (bsc#1272287).\n- CVE-2026-63808: exfat: fix potential use-after-free in exfat_find_dir_entry() (bsc#1272260).\n- CVE-2026-63810: block: Avoid mounting the bdev pseudo-filesystem in userspace (bsc#1272297).\n- CVE-2026-63823: keys: Pin request_key_auth payload in instantiate paths (bsc#1272182).\n- CVE-2026-63828: apparmor: mediate the implicit connect of TCP fast open sendmsg (bsc#1272175).\n- CVE-2026-63860: RDMA/core: Prefer NLA_NUL_STRING (bsc#1272429).\n- CVE-2026-63865: bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks (bsc#1272486).\n- CVE-2026-63868: net: garp: fix unsigned integer underflow in garp_pdu_parse_attr (bsc#1272497).\n- CVE-2026-63879: drm/amdgpu: fix amdgpu_hmm_range_get_pages (bsc#1272569).\n- CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272385).\n- CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272390).\n- CVE-2026-63889: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (bsc#1272423).\n- CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).\n- CVE-2026-63891: thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() (bsc#1272641).\n- CVE-2026-63901: USB: serial: digi_acceleport: fix memory corruption with small endpoints (bsc#1272501).\n- CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1272904).\n- CVE-2026-63918: l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (bsc#1272905).\n- CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1272877).\n- CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1272918).\n- CVE-2026-63922,CVE-2026-63924: ipv6: exthdrs: refresh nh after handling HAO option (bsc#1272855).\n- CVE-2026-63925: macsec: fix replay protection at XPN lower-PN wrap (bsc#1273008).\n- CVE-2026-63926: bpf: sockmap: fix tail fragment offset in bpf_msg_push_data (bsc#1273019).\n- CVE-2026-63941: KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor (bsc#1272869).\n- CVE-2026-63969: ipv6: fix possible infinite loop in rt6_fill_node() (bsc#1272484).\n- CVE-2026-63970: vsock/virtio: bind uarg before filling zerocopy skb (bsc#1272673).\n- CVE-2026-63984: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (bsc#1272865).\n- CVE-2026-63985: ethtool: eeprom: add more safeties to EEPROM Netlink fallback (bsc#1272963).\n- CVE-2026-63986: ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on prepare failure (bsc#1272969).\n- CVE-2026-63987: ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES (bsc#1272971).\n- CVE-2026-63990: bonding: refuse to enslave CAN devices (bsc#1273027).\n- CVE-2026-63992: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (bsc#1272868).\n- CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847).\n- CVE-2026-63995: ethtool: cmis: validate start_cmd_payload_size from module (bsc#1273033).\n- CVE-2026-63996: ethtool: cmis: require exact CDB reply length (bsc#1273032).\n- CVE-2026-63997: ethtool: module: avoid leaking a netdev ref on module flash errors (bsc#1273036).\n- CVE-2026-63998: ethtool: module: call ethnl_ops_complete() on module flash errors (bsc#1273037).\n- CVE-2026-63999: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure (bsc#1273038).\n- CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273030).\n- CVE-2026-64002: ipv4: free net-\u003eipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (bsc#1273774).\n- CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782).\n- CVE-2026-64004: net/iucv: fix locking in .getsockopt (bsc#1273804).\n- CVE-2026-64005: net/smc: Do not re-initialize smc hashtables (bsc#1273831).\n- CVE-2026-64006: netfilter: nf_tables: fix dst corruption in same register operation (bsc#1273834).\n- CVE-2026-64007: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (bsc#1273105).\n- CVE-2026-64017: blk-mq: pop cached request if it is usable (bsc#1273770).\n- CVE-2026-64024: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (bsc#1273107).\n- CVE-2026-64033: RDMA/rtrs: Fix use-after-free in path file creation cleanup (bsc#1273134).\n- CVE-2026-64047: net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (bsc#1273060).\n- CVE-2026-64048: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (bsc#1273484).\n- CVE-2026-64052: block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user() (bsc#1272983).\n- CVE-2026-64053: block: don't overwrite bip_vcnt in bio_integrity_copy_user() (bsc#1272985).\n- CVE-2026-64054: net: shaper: reject duplicate leaves in GROUP request (bsc#1272894).\n- CVE-2026-64055: net: ethernet: cortina: Carry over frag counter (bsc#1272893).\n- CVE-2026-64056: net: ethernet: cortina: Make RX SKB per-port (bsc#1272502).\n- CVE-2026-64071: nvme-pci: fix use-after-free in nvme_free_host_mem() (bsc#1273486).\n- CVE-2026-64073: irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT (bsc#1273490).\n- CVE-2026-64088: batman-adv: tt: fix negative tt_buff_len (bsc#1273463).\n- CVE-2026-64089: batman-adv: tt: fix negative last_changeset_len (bsc#1272513).\n- CVE-2026-64093: batman-adv: tp_meter: directly shut down timer on cleanup (bsc#1273461).\n- CVE-2026-64099: drm/v3d: Fix use-after-free of CPU job query arrays on error path (bsc#1273465).\n- CVE-2026-64102: RDMA/siw: Reject MPA FPDU length underflow before signed receive math (bsc#1272516).\n- CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759).\n- CVE-2026-64109: af_unix: Fix UAF read of tail-\u003elen in unix_stream_data_wait() (bsc#1273748).\n- CVE-2026-64111: lsm: hold cred_guard_mutex for lsm_set_self_attr() (bsc#1273740).\n- CVE-2026-64112: rbd: eliminate a race in lock_dwork draining on unmap (bsc#1273741).\n- CVE-2026-64113: ixgbevf: fix use-after-free in VEPA multicast source pruning (bsc#1272262).\n- CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl \u003c 5 (bsc#1273742).\n- CVE-2026-64115: vsock/vmci: fix UAF when peer resets connection during handshake (bsc#1273745).\n- CVE-2026-64118: qed: fix double free in qed_cxt_tables_alloc() (bsc#1273749).\n- CVE-2026-64119: l2tp: use list_del_rcu in l2tp_session_unhash (bsc#1273746).\n- CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273743).\n- CVE-2026-64125: net: bcmgenet: keep RBUF EEE/PM disabled (bsc#1272346).\n- CVE-2026-64131: mm/memory: fix spurious warning when unmapping device-private/exclusive pages (bsc#1274063).\n- CVE-2026-64146: erofs: fix metabuf leak in inode xattr initialization (bsc#1273681).\n- CVE-2026-64147: pds_core: fix debugfs_lookup dentry leak and error handling (bsc#1273119).\n- CVE-2026-64148: pds_core: fix error handling in pdsc_devcmd_wait (bsc#1273956).\n- CVE-2026-64162: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (bsc#1272366).\n- CVE-2026-64164: btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() (bsc#1273957).\n- CVE-2026-64177: phonet/pep: disable BH around forwarded sk_receive_skb() (bsc#1272148).\n- CVE-2026-64179: net: wwan: iosm: fix potential memory leaks in ipc_imem_init() (bsc#1272149).\n- CVE-2026-64180: mm/memory_hotplug: fix memory block reference leak on remove (bsc#1273679).\n- CVE-2026-64184: mm/damon/sysfs-schemes: call missing mem_cgroup_iter_break() (bsc#1272199).\n- CVE-2026-64185: sysfs: don't remove existing directory on update failure (bsc#1272200).\n- CVE-2026-64190: net: team: fix NULL pointer dereference in team_xmit during mode change (bsc#1272210).\n- CVE-2026-64192: bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized (bsc#1272213).\n- CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899).\n- CVE-2026-64214: powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise()\n  (bsc#1272799).\n- CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272798).\n- CVE-2026-64222: octeontx2-pf: avoid double free of pool-\u003estack on AQ init failure (bsc#1272788).\n- CVE-2026-64224: octeontx2-pf: fix double free in rvu_rep_rsrc_init() (bsc#1272804).\n- CVE-2026-64225: octeontx2-af: CGX: add bounds check to cgx_speed_mbps index (bsc#1272786).\n- CVE-2026-64232: block: recompute nr_integrity_segments in blk_insert_cloned_request (bsc#1272791).\n- CVE-2026-64239: mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() (bsc#1273898).\n- CVE-2026-64244: drivers/base/memory: set mem-\u003ealtmap after successful device registration (bsc#1273812).\n- CVE-2026-64253: kernel/fork: clear PF_BLOCK_TS in copy_process() (bsc#1273904).\n- CVE-2026-64256: xfs: don't wrap around quota ids in dqiterate (bsc#1273271).\n- CVE-2026-64265: fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (bsc#1273947).\n- CVE-2026-64268: RDMA/siw: bound Read Response placement to the RREAD length (bsc#1273276).\n- CVE-2026-64269: RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg (bsc#1273280).\n- CVE-2026-64283: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values (bsc#1273870).\n- CVE-2026-64286: KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU (bsc#1274058).\n- CVE-2026-64287: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (bsc#1273325).\n- CVE-2026-64294: mm: do file ownership checks with the proper mount idmap (bsc#1273525).\n- CVE-2026-64296: exfat: bound uniname advance in exfat_find_dir_entry() (bsc#1273975).\n- CVE-2026-64298: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (bsc#1273550).\n- CVE-2026-64300: perf/aux: Fix page UAF in map_range() (bsc#1273852).\n- CVE-2026-64307: crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG) (bsc#1273567).\n- CVE-2026-64315: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1274028).\n- CVE-2026-64316: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1273598).\n- CVE-2026-64317: isofs: bound Rock Ridge symlink components to the SL record (bsc#1273936).\n- CVE-2026-64319: nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339).\n- CVE-2026-64320: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420).\n- CVE-2026-64321: nvme: target: rdma: fix ndev refcount leak on queue connect (bsc#1273864).\n- CVE-2026-64322: udf: validate sparing table length as an entry count, not a byte count (bsc#1273958).\n- CVE-2026-64323: udf: validate VAT header length against the VAT inode size (bsc#1273305).\n- CVE-2026-64326: block: skip sync_blockdev() on surprise removal in bdev_mark_dead() (bsc#1273312).\n- CVE-2026-64327: usb: gadget: f_fs: Initialize epfile-\u003ein early to fix endpoint direction checks (bsc#1273283).\n- CVE-2026-64354: bpf: Validate BTF repeated field counts before expansion (bsc#1274060).\n- CVE-2026-64355: bpf: Reject fragmented frames in devmap (bsc#1273422).\n- CVE-2026-64364: HID: multitouch: fix out-of-bounds bit access on mt_io_flags (bsc#1273495).\n- CVE-2026-64368: mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (bsc#1273997).\n- CVE-2026-64373: cpufreq: Fix hotplug-suspend race during reboot (bsc#1273776).\n- CVE-2026-64375: proc: protect ptrace_may_access() with exec_update_lock (FD links) (bsc#1273868).\n- CVE-2026-64378: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (bsc#1273603).\n- CVE-2026-64381: smb: client: Fix next buffer leak in receive_encrypted_standard() (bsc#1273860).\n- CVE-2026-64382: smb: client: fix double-free in SMB2_open() replay (bsc#1273291).\n- CVE-2026-64383: smb: client: fix double-free in SMB2_flush() replay (bsc#1273426).\n- CVE-2026-64384: smb: client: fix change notify replay double-free (bsc#1274541).\n- CVE-2026-64385: smb: client: fix double-free in SMB2_ioctl() replay (bsc#1274539).\n- CVE-2026-64386: smb: client: fix query_info() replay double-free (bsc#1274543).\n- CVE-2026-64387: smb: client: fix query directory replay double-free (bsc#1274545).\n- CVE-2026-64411: netfilter: ebtables: terminate table name before find_table_lock() (bsc#1274077).\n- CVE-2026-64412: netfilter: ebtables: module names must be null-terminated (bsc#1273780).\n- CVE-2026-64415: mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent softlockup (bsc#1273317).\n- CVE-2026-64416: mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless host (bsc#1273286).\n- CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction (bsc#1274274).\n- CVE-2026-64434: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref (bsc#1273880).\n- CVE-2026-64436: net: af_key: initialize alg_key_len for IPComp states (bsc#1274277).\n- CVE-2026-64450: tipc: fix out-of-bounds read in broadcast Gap ACK blocks (bsc#1273523).\n- CVE-2026-64452: 6lowpan: fix NHC entry use-after-free on error path (bsc#1273460).\n- CVE-2026-64458: mm/damon/ops-common: handle extreme intervals in damon_hot_score() (bsc#1273788).\n- CVE-2026-64463: usb: typec: tcpci_rt1711h: unregister TCPCI port with devres (bsc#1273273).\n- CVE-2026-64472: vfio/mlx5: Fix racy bitfields and tighten struct layout (bsc#1274075).\n- CVE-2026-64477: x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled (bsc#1274264).\n- CVE-2026-64507: bpf: Support for hardening against JIT spraying (bsc#1273999).\n- CVE-2026-64518: tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key() (bsc#1273524).\n- CVE-2026-64519: NFSD: Fix infinite loop in layout state revocation (bsc#1274252).\n- CVE-2026-64526: ethtool: tsconfig: fix missing ethnl_ops_complete() (bsc#1274052).\n- CVE-2026-64534: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error (bsc#1273803).\n- CVE-2026-64535: nvmet-tcp: Fix potential UAF when ddgst mismatch (bsc#1273809).\n- CVE-2026-64537: bridge: cfm: reject invalid CCM interval at configuration time (bsc#1273289).\n- CVE-2026-64538: ipv6: Fix null-ptr-deref in fib6_nh_mtu_change() (bsc#1273335).\n- CVE-2026-64541: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (bsc#1273303).\n- CVE-2026-64542: ipv6: ndisc: fix NULL deref in accept_untracked_na() (bsc#1273309).\n- CVE-2026-64543: tipc: fix use-after-free of the discoverer in tipc_disc_rcv() (bsc#1273311).\n- CVE-2026-64545: net, bpf: check master for NULL in xdp_master_redirect() (bsc#1273318).\n- CVE-2026-64548: bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() (bsc#1273337).\n- CVE-2026-64551: sctp: validate STALE_COOKIE cause length before reading staleness (bsc#1273813).\n- CVE-2026-64552: virtio-net: fix len check in receive_big() (bsc#1273323).\n- CVE-2026-64553: net: psample: fix info leak in PSAMPLE_ATTR_DATA (bsc#1273336).\n- CVE-2026-64554: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() (bsc#1273340).\n- CVE-2026-64555: KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops() (bsc#1273331).\n- CVE-2026-64556: perf/core: Detach event groups during remove_on_exec (bsc#1273251).\n- CVE-2026-64563: rhashtable: clear stale iter-\u003ep on table restart (bsc#1273995).\n- CVE-2026-64567: btrfs: reject free space cache with more entries than pages (bsc#1274006).\n- CVE-2026-64569: mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n (bsc#1274009).\n- CVE-2026-64572: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (bsc#1274014).\n- CVE-2026-64576: nexthop: initialize extack in nh_res_bucket_migrate() (bsc#1274030).\n- CVE-2026-64577: gtp: check skb_pull_data() return in gtp1u_send_echo_resp() (bsc#1274031).\n- CVE-2026-64579: xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert (bsc#1274036).\n- CVE-2026-64581: xfrm: fix sk_dst_cache double-free in xfrm_user_policy() (bsc#1274041).\n- CVE-2026-64582: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (bsc#1274040).\n- CVE-2026-64586: wifi: brcmfmac: drain bus_reset work on device removal (bsc#1274492).\n- CVE-2026-68082: libceph: fix two unsafe bare decodes in decode_lockers() (bsc#1274581).\n- CVE-2026-68086: mm/khugepaged: write all dirty file folios when collapsing (bsc#1274713).\n- CVE-2026-68096: audit: fix recursive locking deadlock in audit_dupe_exe() (bsc#1274730).\n- CVE-2026-68105: drm/amdgpu: Fix kernel panic during driver load failure (bsc#1274849).\n- CVE-2026-68116: vxlan: mdb: Fix source list corruption on a failed replace (bsc#1274876).\n- CVE-2026-68117: tipc: clear sock-\u003esk on the failed-insert path in tipc_sk_create() (bsc#1274881).\n- CVE-2026-68120: rtase: Workaround for TX hang caused by hardware packet parsing (bsc#1274887).\n- CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1274888).\n- CVE-2026-68123: openvswitch: fix GSO userspace truncation underflow (bsc#1275169).\n- CVE-2026-68124: mctp: serial: handle zero-length frames to prevent rx buffer overflow (bsc#1275192).\n- CVE-2026-68127: ila: reload IPv6 header after pskb_may_pull in checksum adjust (bsc#1275237).\n- CVE-2026-68128: ice: reject out-of-range ptype in ice_parser_profile_init (bsc#1275238).\n- CVE-2026-68129: gve: fix Rx queue stall on alloc failure (bsc#1275517).\n- CVE-2026-68132: super: fix emergency thaw deadlock on frozen block devices (bsc#1275553).\n- CVE-2026-68133: ice: fix PTP Call Trace during PTP release (bsc#1275555).\n- CVE-2026-68135: net: hip04: fix RX buffer leak on build_skb failure (bsc#1275557).\n- CVE-2026-68136: net: gro: fix double aggregation of flush-marked skbs (bsc#1275474).\n- CVE-2026-68138: net/sched: serialize qdisc_rtab_list against concurrent get/put (bsc#1274941).\n- CVE-2026-68139: net/mlx5e: Use sender devcom for MPV master-up (bsc#1275578).\n- CVE-2026-68141: net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() (bsc#1275094).\n- CVE-2026-68142: geneve: require CAP_NET_ADMIN in the device netns for changelink (bsc#1275582).\n- CVE-2026-68143: net: slip: serialize receive against buffer reallocation (bsc#1275583).\n- CVE-2026-68144: phonet: pep: fix use-after-free in pep_get_sb() (bsc#1275481).\n- CVE-2026-68145: iomap: fix out-of-bounds bitmap_set() with zero-length range (bsc#1275584).\n- CVE-2026-68148: fscrypt: Add missing superblock check in find_or_insert_direct_key() (bsc#1275588).\n- CVE-2026-68149: fs: preserve ACL_DONT_CACHE state in forget_cached_acl() (bsc#1275294).\n- CVE-2026-68152: amt: fix use-after-free in AMT delayed works (bsc#1275300).\n- CVE-2026-68153: libceph: remove debugfs files before client teardown (bsc#1275301).\n- CVE-2026-68154: libceph: reject zero bucket types in crush_decode (bsc#1275303).\n- CVE-2026-68155: libceph: Reject monmaps advertising zero monitors (bsc#1275304).\n- CVE-2026-68156: libceph: refresh auth-\u003eauthorizer_buf{,_len} after authorizer update (bsc#1275305).\n- CVE-2026-68157: libceph: guard missing CRUSH type name lookup (bsc#1275306).\n- CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1275307).\n- CVE-2026-68159: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (bsc#1275470).\n- CVE-2026-68161: sctp: close UDP tunnel sockets during netns teardown (bsc#1274892).\n- CVE-2026-68164: mm/damon/core: disallow overlapping input ranges for damon_set_regions() (bsc#1274955).\n- CVE-2026-68165: mm/damon/core: validate ranges in damon_set_regions() (bsc#1274927).\n- CVE-2026-68166: userfaultfd: prevent registration of special VMAs (bsc#1274930).\n- CVE-2026-68169: mptcp: pm: userspace: fix use-after-free in get_local_id (bsc#1274952).\n- CVE-2026-68183: firmware: stratix10-svc: fix memory leaks and list corruption bugs (bsc#1274957).\n- CVE-2026-68198: wifi: ath6kl: fix use-after-free in aggr_reset_state() (bsc#1274803).\n- CVE-2026-68205: media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() (bsc#1274934).\n- CVE-2026-68238: drm/amdgpu: Release VFCT ACPI table reference (bsc#1275704).\n- CVE-2026-68258: drm/amdkfd: Check bounds on CRIU restore queue type and mqd size (bsc#1275866).\n- CVE-2026-68267: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (bsc#1275139).\n- CVE-2026-68273: drm/amdgpu: Fix context pstate override handling (bsc#1275129).\n- CVE-2026-68284: bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() (bsc#1275970).\n- CVE-2026-68286: drop_monitor: perform u64_stats updates under IRQ-disabled section (bsc#1275973).\n- CVE-2026-68288: net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD (bsc#1275975).\n- CVE-2026-68289: tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() (bsc#1275976).\n- CVE-2026-68293: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (bsc#1275091).\n- CVE-2026-68294: net: qrtr: restrict socket creation to the initial network namespace (bsc#1275092).\n- CVE-2026-68296: net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM (bsc#1275045).\n- CVE-2026-68297: tipc: fix u16 MTU truncation in media and bearer MTU validation (bsc#1275040).\n- CVE-2026-68299: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (bsc#1275088).\n- CVE-2026-68300: sctp: auth: verify auth requirement when auth_chunk is NULL (bsc#1275083).\n- CVE-2026-68302: amt: re-read skb header pointers after every pull (bsc#1275081).\n- CVE-2026-68313: tipc: fix infinite loop in __tipc_nl_compat_dumpit (bsc#1274665).\n- CVE-2026-68315: sctp: validate stream count in sctp_process_strreset_inreq() (bsc#1274662).\n- CVE-2026-68319: pds_core: fix deadlock between reset thread and remove (bsc#1274657).\n- CVE-2026-68320: sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid (bsc#1274659).\n- CVE-2026-68321: net: txgbe: fix FDIR filter leak on remove (bsc#1274652).\n- CVE-2026-68322: rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled (bsc#1274656).\n- CVE-2026-68325: iommu/amd: Bound the early ACPI HID map (bsc#1274651).\n- CVE-2026-68328: nfp: Check resource mutex allocation (bsc#1274646).\n- CVE-2026-68329: iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() (bsc#1274645).\n- CVE-2026-68331: dpaa2-eth: put MAC endpoint device on disconnect (bsc#1274642).\n- CVE-2026-68333: dpaa2-switch: put MAC endpoint device on disconnect (bsc#1274644).\n- CVE-2026-68335: rds: drop incoming messages that cross network namespace boundaries (bsc#1274640).\n- CVE-2026-68336: bonding: fix devconf_all NULL dereference when IPv6 is disabled (bsc#1274639).\n- CVE-2026-68338: net/packet: avoid fanout hook re-registration after unregister (bsc#1274637).\n- CVE-2026-68375: bnxt_en: Handle partially initialized auxiliary devices (bsc#1274835).\n- CVE-2026-68377: net/sched: act_tunnel_key: Defer dst_release to RCU callback (bsc#1274831).\n- CVE-2026-68386: bpf, sockmap: Reject unhashed UDP sockets on sockmap update (bsc#1274814).\n- CVE-2026-68393: Bluetooth: hci_sync: extend conn_hash lookup critical sections (bsc#1274904).\n- CVE-2026-68395: ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered (bsc#1274900).\n- CVE-2026-68397: net/iucv: take a reference on the socket found in afiucv_hs_rcv() (bsc#1274898).\n- CVE-2026-68398: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF (bsc#1274908).\n- CVE-2026-68399: bpf: Fix UAF in sock clone early bailouts (bsc#1274897).\n- CVE-2026-68408: wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (bsc#1274709).\n- CVE-2026-68417: RDMA/siw: publish QP after initialization (bsc#1274696).\n- CVE-2026-68418: RDMA/irdma: Prevent user-triggered null deref on QP create (bsc#1274690).\n- CVE-2026-68419: RDMA/irdma: Prevent rereg_mr for non-mem regions (bsc#1274698).\n- CVE-2026-68422: btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() (bsc#1274706).\n- CVE-2026-68425: IB/mad: Drop unmatched RMPP responses before reassembly (bsc#1274700).\n- CVE-2026-68426: xfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment (bsc#1274705).\n- CVE-2026-68432: vxlan: require CAP_NET_ADMIN in the device netns for changelink (bsc#1274800).\n- CVE-2026-68433: libceph: bound get_version reply decode to front len (bsc#1274801).\n- CVE-2026-68442: btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps (bsc#1274773).\n- CVE-2026-68448: ovl: check access to copy_file_range source with src mounter creds (bsc#1274838).\n- CVE-2026-68450: btrfs: free mapping node on duplicate reloc root insert (bsc#1274834).\n- CVE-2026-68470: wifi: mac80211: validate extension-frame layout before RX (bsc#1276500).\n- CVE-2026-68480: x86/bugs: Make Safe-RET robust against interrupt injection (bsc#1274208).\n- CVE-2026-72017: net: macb: drop in-flight Tx SKBs on close (bsc#1276840).\n- CVE-2026-72019: macsec: don't read an unset MAC header in macsec_encrypt() (bsc#1276865).\n- CVE-2026-72020: ipvs: reset full ip_vs_seq structs in ip_vs_conn_new (bsc#1275506).\n- CVE-2026-72022: llc: fix SAP refcount leak in llc_ui_autobind() (bsc#1276785).\n- CVE-2026-72023: octeontx2-pf: fix SQB pointer leak on init failure (bsc#1276793).\n- CVE-2026-72032: net/mlx5: HWS, fix matcher leak on resize target setup failure (bsc#1276955).\n- CVE-2026-72034: fhandle: reject detached mounts in capable_wrt_mount() (bsc#1276957).\n- CVE-2026-72035: net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1276961).\n- CVE-2026-72036: net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1277034).\n- CVE-2026-72045: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (bsc#1277078).\n- CVE-2026-72046: gve: fix header buffer corruption with header-split and HW-GRO (bsc#1275519).\n- CVE-2026-72051: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276801).\n- CVE-2026-72052: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276803).\n- CVE-2026-72053: net: ipip: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276814).\n- CVE-2026-72054: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276818).\n- CVE-2026-72055: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276821).\n- CVE-2026-72061: net: sit: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277249).\n- CVE-2026-72069: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (bsc#1275528).\n- CVE-2026-72072: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (bsc#1277155).\n- CVE-2026-72083: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (bsc#1275535).\n- CVE-2026-72084: scsi: target: core: Generate correct identifiers for PR OUT transport IDs (bsc#1275540).\n- CVE-2026-72100: dm-integrity: fix a bug if the bio is out of limits (bsc#1277311).\n- CVE-2026-72101: dm-integrity: fix leaking uninitialized kernel memory (bsc#1276831).\n- CVE-2026-72103: dm: avoid leaking the caller's thread keyring via the table device file (bsc#1277315).\n- CVE-2026-72106: dm-ioctl: fix a possible overflow in list_version_get_info (bsc#1277321).\n- CVE-2026-72107: dm era: fix out-of-bounds memory access for non-zero start sector (bsc#1277349).\n- CVE-2026-72108: dm thin metadata: fix metadata snapshot consistency on commit failure (bsc#1277350).\n- CVE-2026-72132: NFS: Charge unstable writes by request size, not folio size (bsc#1277551).\n- CVE-2026-72136: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277574).\n- CVE-2026-72137: xfrm: nat_keepalive: avoid double free on send error (bsc#1275587).\n- CVE-2026-72161: ocfs2: add journal NULL check in ocfs2_checkpoint_inode() (bsc#1277233).\n- CVE-2026-72163: ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits (bsc#1277231).\n- CVE-2026-72164: ocfs2: avoid moving extents to occupied clusters (bsc#1277553).\n- CVE-2026-72176: mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error (bsc#1277230).\n- CVE-2026-72177: mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs() (bsc#1277227).\n- CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1275655).\n- CVE-2026-72221: sunrpc: wait for in-flight TLS handshake callback when cancel loses race (bsc#1275665).\n- CVE-2026-72222: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (bsc#1275669).\n- CVE-2026-72234: batman-adv: access unicast_ttvn skb-\u003edata only after skb realloc (bsc#1275672).\n- CVE-2026-72242: selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (bsc#1277655).\n- CVE-2026-72243: selinux: check connect-related permissions on TCP Fast Open (bsc#1277656).\n- CVE-2026-72251: netfilter: nf_nat_sip: reload possible stale data pointer (bsc#1275827).\n- CVE-2026-72254: netfilter: nft_fib: reject fib expression on the netdev egress hook (bsc#1277204).\n- CVE-2026-72280: KVM: arm64: nv: Drop bogus WARN for write to ZCR_EL2 (bsc#1277726).\n- CVE-2026-72282: KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers (bsc#1277728).\n- CVE-2026-72288: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (bsc#1275886).\n- CVE-2026-72289: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (bsc#1275905).\n- CVE-2026-72296: net: ife: require ETH_HLEN to be pullable in ife_decode() (bsc#1275923).\n- CVE-2026-72297: net: atm: reject out-of-range traffic classes in QoS validation (bsc#1277738).\n- CVE-2026-72306: vduse: Requeue failed read to send_list head (bsc#1277748).\n- CVE-2026-72307: mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() (bsc#1277160).\n- CVE-2026-72308: mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() (bsc#1277159).\n- CVE-2026-72317: SUNRPC: pin upper rpc_clnt across the TLS connect_worker (bsc#1275925).\n- CVE-2026-72323: ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (bsc#1275985).\n- CVE-2026-72325: perf/x86/amd/core: Avoid enabling BRS from the SVM reload path (bsc#1277761).\n- CVE-2026-72330: net/tls: Consume empty data records in tls_sw_read_sock() (bsc#1277764).\n- CVE-2026-72337: Bluetooth: 6lowpan: avoid untracked enable work (bsc#1277773).\n- CVE-2026-72339: qede: fix off-by-one in BD ring consumption on build_skb failure (bsc#1276006).\n- CVE-2026-72341: net/mlx5e: Fix publication race for priv-\u003echannel_stats[] (bsc#1277660).\n- CVE-2026-72342: net/mlx5e: Fix HV VHCA stats agent registration race (bsc#1277775).\n- CVE-2026-72343: net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation (bsc#1277776).\n- CVE-2026-72345: net/mlx5: LAG, Fix off-by-one in single-FDB error rollback (bsc#1277782).\n- CVE-2026-72347: netfilter: xt_connmark: reject invalid shift parameters (bsc#1277783).\n- CVE-2026-72350: netfilter: xt_u32: reject invalid shift counts (bsc#1277822).\n- CVE-2026-72366: netfs: Fix netfs_create_write_req() to handle async cache object creation (bsc#1276333).\n- CVE-2026-72379: fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid (bsc#1277818).\n- CVE-2026-72389: bridge: stp: Fix a potential use-after-free when deleting a bridge (bsc#1273869).\n- CVE-2026-72398: sctp: add INIT verification after cookie unpacking (bsc#1276381).\n- CVE-2026-72399: net: enetc: check the number of BDs needed for xdp_frame (bsc#1276553).\n- CVE-2026-72414: net: dsa: sja1105: round up PTP perout pin duration (bsc#1278039).\n- CVE-2026-72421: ipv4: fib: Don't ignore error route in local/main tables (bsc#1277023).\n- CVE-2026-72425: ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (bsc#1277120).\n- CVE-2026-72430: net/sched: act_ct: fix nf_connlabels leak on two error paths (bsc#1277118).\n- CVE-2026-72437: md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry (bsc#1277874).\n- CVE-2026-72438: md/raid10: fix writes_pending and barrier reference leaks on discard failures (bsc#1277115).\n- CVE-2026-72439: md/raid10: fix writes_pending leak on write request failures (bsc#1277876).\n- CVE-2026-72440: md/raid1: fix writes_pending and barrier reference leaks on write failures (bsc#1277114).\n- CVE-2026-72448: octeontx2-pf: Fix leak of SQ timestamp buffer on teardown (bsc#1277108).\n- CVE-2026-72450: xfrm: validate selector family and prefixlen during match (bsc#1278113).\n- CVE-2026-72459: apparmor: aa_label_alloc use aa_label_free on alloc failure (bsc#1277092).\n- CVE-2026-72460: apparmor: check label build before no_new_privs test (bsc#1277229).\n- CVE-2026-72464: xprtrdma: Post receive buffers after RPC completion (bsc#1277069).\n- CVE-2026-72466: xprtrdma: Fix bcall rep leak and unbounded peek (bsc#1277057).\n- CVE-2026-72467: xprtrdma: Check frwr_wp_create() during connect (bsc#1277059).\n- CVE-2026-72468: xprtrdma: Initialize re_id before removal registration (bsc#1277062).\n- CVE-2026-72469: xprtrdma: Fix ep kref imbalance on ADDR_CHANGE (bsc#1277047).\n- CVE-2026-72473: xprtrdma: Avoid 250 ms delay on backlog wakeup (bsc#1277037).\n- CVE-2026-72485: coresight: platform: defer connection counter increment until alloc succeeds (bsc#1276771).\n- CVE-2026-72487: PCI: Introduce named defines for PCI ROM (bsc#1276767).\n- CVE-2026-72488: soundwire: fix bug in sdw_add_element_group_count found by syzkaller (bsc#1276766).\n- CVE-2026-72494: RDMA/irdma: Replace waitqueue and flag with completion (bsc#1276941).\n- CVE-2026-72495: RDMA/bnxt_re: Avoid repeated requests to allocate WC pages (bsc#1276937).\n- CVE-2026-72497: RDMA/bnxt_re: Add a max slot check for SQ (bsc#1276913).\n- CVE-2026-72499: RDMA/bnxt_re: Free CQ toggle page after firmware teardown (bsc#1276551).\n- CVE-2026-72500: RDMA/bnxt_re: Free SRQ toggle page after firmware teardown (bsc#1276552).\n- CVE-2026-72501: RDMA/bnxt_re: Initialize dpi variable to zero (bsc#1276546).\n- CVE-2026-72502: tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) (bsc#1276542).\n- CVE-2026-74255: tipc: fix UAF in tipc_l2_send_msg() (bsc#1276547).\n- CVE-2026-74261: ALSA: seq: avoid stale FIFO cells during resize (bsc#1276528).\n- CVE-2026-74269: bnxt: fix head underflow on XDP head-grow (bsc#1276507).\n- CVE-2026-74270: handshake: Require admin permission for DONE command (bsc#1276512).\n- CVE-2026-74282: tipc: prevent snt_unacked underflow on CONN_ACK (bsc#1276473).\n- CVE-2026-74284: net/sched: sch_hfsc: Don't make class passive twice (bsc#1276468).\n- CVE-2026-74286: net: pfcp: allocate per-cpu tstats for PFCP netdevs (bsc#1276471).\n- CVE-2026-74296: RDMA/mlx5: Release the HW-provided UAR index rather than the SW one (bsc#1276452).\n- CVE-2026-74297: RDMA/mlx5: Fix undefined shift of user RQ WQE size (bsc#1276446).\n- CVE-2026-74307: ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT (bsc#1276905).\n- CVE-2026-74308: ext4: fix kernel BUG in ext4_write_inline_data_end (bsc#1276880).\n- CVE-2026-74313: vduse: hold vduse_lock across IDR lookup in open path (bsc#1276876).\n- CVE-2026-74316: NFSD: Handle layout stid in nfsd4_drop_revoked_stid() (bsc#1276870).\n- CVE-2026-74317: ixgbe: do not configure xps for XDP queues (bsc#1276866).\n- CVE-2026-74318: btrfs: fix deadlock cloning inline extent when using flushoncommit (bsc#1276864).\n- CVE-2026-74321: btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() (bsc#1277202).\n- CVE-2026-74334: RDMA/nldev: Fix locking when accessing mr-\u003epd (bsc#1277095).\n- CVE-2026-74345: RDMA/siw: Fix endpoint/socket association handling (bsc#1277285).\n- CVE-2026-74346: RDMA/irdma: Fix OOB read during CQ MR registration (bsc#1278155).\n- CVE-2026-74349: ocfs2: reject FITRIM ranges shorter than a cluster (bsc#1278180).\n- CVE-2026-74363: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs (bsc#1278070).\n- CVE-2026-74375: md: replace wait loop with wait_event() in md_handle_request() (bsc#1277649).\n- CVE-2026-74377: RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path (bsc#1278236).\n- CVE-2026-74378: RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe (bsc#1278233).\n- CVE-2026-74382: net/sched: cls_bpf: prevent unbounded recursion in offload rollback (bsc#1278240).\n- CVE-2026-74388: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data (bsc#1278253).\n- CVE-2026-74390: RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs (bsc#1278088).\n- CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277408).\n- CVE-2026-74395: RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference (bsc#1277077).\n- CVE-2026-74397: IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier (bsc#1278098).\n- CVE-2026-74406: vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive() (bsc#1276395).\n- CVE-2026-74464: net: openvswitch: fix skb leak on flow key update failure during ct (bsc#1277070).\n- CVE-2026-74474: vxlan: use pskb_network_may_pull() for transmit path header pulls (bsc#1276335).\n- CVE-2026-74475: vxlan: unclone skb head before modifying eth header in route_shortcircuit() (bsc#1276339).\n- CVE-2026-74476: veth: convert frag_list skbs before running XDP (bsc#1276341).\n- CVE-2026-74479: net: pktgen: fix proc entry use-after-free (bsc#1276354).\n- CVE-2026-74481: mm/page_reporting: use system_freezable_wq to fix UAF during suspend (bsc#1276355).\n- CVE-2026-74482: mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios (bsc#1276346).\n- CVE-2026-74495: igbvf: Fix leak in TX DMA error cleanup (bsc#1275864).\n- CVE-2026-74496: fou: Fix use-after-free in fou_create() (bsc#1275867).\n- CVE-2026-74510: Bluetooth: mgmt: fix UAF in pair command cancellation (bsc#1275950).\n- CVE-2026-74512: audit: fix potential use-after-free in audit_del_rule() (bsc#1275954).\n- CVE-2026-74513: dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister (bsc#1275956).\n- CVE-2026-74517: KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs (bsc#1276258).\n- CVE-2026-74518: mm/hugetlb: fix list corruption in allocate_file_region_entries() (bsc#1275798).\n- CVE-2026-74523: qede: sync udp_tunnel ports outside qede_lock in the recovery path (bsc#1275802).\n- CVE-2026-74527: octeontx2-af: Block VFs from clobbering special CGX PKIND state (bsc#1275805).\n- CVE-2026-74533: Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero (bsc#1275804).\n- CVE-2026-74534: Bluetooth: ISO: Fix data-race on iso_pi(sk) in socket and HCI event paths (bsc#1275801).\n- CVE-2026-74535: Bluetooth: ISO: avoid deadlocks in iso_sock_timeout (bsc#1275812).\n- CVE-2026-74536: Bluetooth: ISO: fix leaking sk after socket release (bsc#1275799).\n- CVE-2026-74537: Bluetooth: ISO: hold sk properly in iso_conn_ready (bsc#1275687).\n- CVE-2026-74545: rtase: fix double free of multi-frag skb on DMA map failure (bsc#1275679).\n- CVE-2026-74548: forcedeth: fix UAF of txrx_stats in nv_remove (bsc#1275695).\n- CVE-2026-74550: net: do not send ICMP/NDISC Redirects when peer allocation fails (bsc#1275688).\n- CVE-2026-74555: scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race (bsc#1275690).\n- CVE-2026-74556: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (bsc#1275696).\n- CVE-2026-74557: scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer (bsc#1275685).\n- CVE-2026-74563: rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() (bsc#1275574).\n- CVE-2026-74566: keys: make keyring key-chunk byte order agree with keyring_diff_objects() (bsc#1275566).\n- CVE-2026-74567: keys: fix out-of-bounds read in keyring_get_key_chunk() (bsc#1275569).\n- CVE-2026-74571: btrfs: skip global block reserve accounting for rescue mounts (bsc#1275561).\n- CVE-2026-74577: net: mpls: initialize rtm_tos in mpls_getroute() (bsc#1275572).\n- CVE-2026-74581: net: ipv6: clear suppressed fib6 rule result (bsc#1275782).\n- CVE-2026-74582: packet: use consistent hard_header_len in non-ring send paths (bsc#1275784).\n- CVE-2026-74584: RDMA/bnxt_re: zero shared page before exposing to userspace (bsc#1277066).\n- CVE-2026-74598: ipv6: fix Route Information option length validation (bsc#1277918).\n- CVE-2026-74610: tls: don't leave a full plaintext sk_msg ring unpushed (bsc#1277054).\n- CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277505).\n- CVE-2026-74615: vxlan: do not arm the ageing timer on a device that is down (bsc#1277901).\n- CVE-2026-74616: xdp: reject clones that overrun skb_shared_info tailroom (bsc#1277813).\n- CVE-2026-74622: net: atlantic: free RX pages of consumed but not refilled buffers (bsc#1277862).\n- CVE-2026-74644: mm/damon/ops-common: putback folios on invalid migrate nid (bsc#1277033).\n- CVE-2026-74665: net: fix skb length accounting after generic XDP frag adjustment (bsc#1277407).\n- CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277391).\n- CVE-2026-74695: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() (bsc#1276931).\n- CVE-2026-74705: udp: fix potential use-after-free in tunnel segmentation (bsc#1276922).\n- CVE-2026-74712: vdpa/mlx5: Fix buffer length in create_direct_keys() (bsc#1276577).\n- CVE-2026-74717: net/mlx5: fw_tracer, return NULL on create error (bsc#1276569).\n- CVE-2026-74719: net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()\n  (bsc#1276572).\n- CVE-2026-74722: btrfs: fix memory leak in btrfs_do_encoded_write() (bsc#1276561).\n- CVE-2026-74723: btrfs: lzo: reject inline extents without valid headers (bsc#1276562).\n- CVE-2026-74730: NFS: Pin the 'struct nfs_server' during a FREE_STATEID call (bsc#1276566).\n- CVE-2026-74737: net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG (bsc#1277898).\n- CVE-2026-74743: macvlan: inherit needed_headroom and needed_tailroom from lowerdev (bsc#1277908).\n- CVE-2026-74744: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (bsc#1278094).\n- CVE-2026-80529: xfs: don't swallow dquot recovery verification errors (bsc#1277688).\n- CVE-2026-80530: xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (bsc#1277668).\n- CVE-2026-80531: xfs: avoid UAF on sc-\u003etempip in xrep_tempfile_create (bsc#1277680).\n- CVE-2026-80533: xfs: don't walk off the end of a null sc-\u003esa.agi_bp in AGI repair (bsc#1277636).\n- CVE-2026-80534: xfs: fix ilock leak on error in xfs_dq_get_next_id (bsc#1277022).\n- CVE-2026-80535: xfs: don't double-lock when deleting a self-referential directory (bsc#1277641).\n- CVE-2026-80557: libceph: fix OOB read in decode_watchers() via missing bounds check (bsc#1277268).\n- CVE-2026-80558: libceph: Avoid using invalid osd indices from primary_temp (bsc#1277485).\n- CVE-2026-80561: libceph: fix multiple unsafe decodes in decode_locker() (bsc#1277265).\n- CVE-2026-80586: mptcp: options: reset DSS fields in case of unexpected size (bsc#1277328).\n- CVE-2026-80589: block: stop the timeout timer when releasing a never added disk (bsc#1277335).\n- CVE-2026-80590: inet: frags: strip GSO state from fragments before reassembly (bsc#1277275).\n- CVE-2026-80603: netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read (bsc#1278293).\n- CVE-2026-80609: qede: fix out-of-bounds check for cqe-\u003elen_list (bsc#1278334).\n- CVE-2026-80629: octeontx2-af: npc: Fix size of entry2cntr_map (bsc#1277308).\n- CVE-2026-80646: ipv6: guard against possible NULL deref in __in6_dev_stats_get() (bsc#1277513).\n- CVE-2026-80647: RDMA/hns: Fix warning in poll cq direct mode (bsc#1278331).\n- CVE-2026-80667: net/mlx5: LAG, MPESW, Fix missing complete() on devcom error (bsc#1278324).\n- CVE-2026-80681: vxlan: re-fetch eth header after route_shortcircuit() (bsc#1278416).\n- CVE-2026-80693: idpf: bound interrupt-vector register fill to the allocated array (bsc#1278395).\n- CVE-2026-80714: ipvs: do not propagate one-packet flag to synced conns (bsc#1277561).\n- CVE-2026-80721: Bluetooth: ISO: ensure no dangling hcon references in iso_conn (bsc#1277845).\n- CVE-2026-80727: x86/mce: Set up the polling timer before CMCI discovery (bsc#1278703).\n- CVE-2026-80731: net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (bsc#1278716).\n- CVE-2026-80737: serial: amba-pl011: synchronize DMA teardown (bsc#1279487).\n- CVE-2026-80739: net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock (bsc#1278733).\n- CVE-2026-80805: xfs: validate attr entry pointer before field access (bsc#1279580).\n- CVE-2026-80813: nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist() (bsc#1279537).\n- CVE-2026-80838: vxlan: keep the last remote linked during FDB flush (bsc#1279842).\n\nThe following non security issues were fixed:\n\n- accel/ivpu: Limit firmware log name prints to field size (git-fixes).\n- accel/ivpu: Validate firmware log buffer metadata (git-fixes).\n- accel/ivpu: Validate full buffer range in ivpu_to_cpu_addr (git-fixes).\n- accel/qaic: Address potential out-of-bounds read in resp_worker() (git-fixes).\n- accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() (git-fixes).\n- accessibility: speakup: unregister tty ldisc on later init failures (git-fixes).\n- ACPI: APEI: Fix ERST timeout unit conversion (git-fixes).\n- ACPI: battery: Adjust charging status validation check (git-fixes).\n- ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer (git-fixes).\n- ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root (git-fixes).\n- ACPI: pfr_update: fix stack buffer overflow in query_capability() (git-fixes).\n- ACPI: processor: idle: Expand _LPI package sanity checks (git-fixes).\n- ACPI: processor: validate MADT IOAPIC entry bounds (git-fixes).\n- ACPI: processor_idle: Mark LPI enter functions as __cpuidle (git-fixes).\n- ACPI: scan: fix bus ID cleanup on device_add() failures (git-fixes).\n- ACPI: video: Release PCI device reference after lookup (git-fixes).\n- ALSA: 6fire: bound the MIDI event length from the device (git-fixes).\n- ALSA: 6fire: Fix UAF at error handling during probe (stable-fixes).\n- ALSA: bcd2000: clear the URB pointers on disconnect (git-fixes).\n- ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev (git-fixes).\n- ALSA: caiaq: Fix potential double-free at error path (git-fixes).\n- ALSA: control: Don't add invalid kcontrols to LED layer (git-fixes).\n- ALSA: core: Fix use-after-free in snd_card_do_free() (git-fixes).\n- ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough (git-fixes).\n- ALSA: dummy: Check card index validity at probe (stable-fixes).\n- ALSA: dummy: Report a change when one capture switch channel moves (git-fixes).\n- ALSA: harmony: initialize locks before requesting IRQ (git-fixes).\n- ALSA: hda/ext: preserve PPLCCTL bits when clearing reset (git-fixes).\n- ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP r (stable-fixes).\n- ALSA: hda: Fix connection list comparison in proc output (git-fixes).\n- ALSA: hda: Report a change when only the channel status bytes move (git-fixes).\n- ALSA: hda: restore MFG widget enumeration after core split (git-fixes).\n- ALSA: hpi: Check transport errors during HPI6000 adapter initialization (git-fixes).\n- ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF (git-fixes).\n- ALSA: pcxhr: initialize mutexes before requesting threaded IRQ (git-fixes).\n- ALSA: rawmidi: Return the error from snd_rawmidi_input_params() (git-fixes).\n- ALSA: scarlett2: Use a private URB for the notification endpoint (git-fixes).\n- ALSA: seq: Don't leak the extension cell pointer in the bounce payload (git-fixes).\n- ALSA: seq: midi: Optimize event_input locking with RCU (git-fixes).\n- ALSA: seq: midi: Serialize input teardown with event_input (git-fixes).\n- ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion (git-fixes).\n- ALSA: usb-audio: Complete cleanup after system-resume errors (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() (git-fixes).\n- ALSA: usb-audio: fix OOB write on Type II inbound URBs (git-fixes).\n- ALSA: usb: Fix UAF at delayed release of MIDI2 EPs (git-fixes).\n- ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf (git-fixes).\n- ALSA: usbusx2y: validate URB actual_length in interrupt callback (git-fixes).\n- ALSA: usx2y: bound the hwdep mmap fault offset (git-fixes).\n- ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() (git-fixes).\n- apparmor: advertise the tcp fast open fix is applied (git-fixes).\n- ASoC: ab8500: Correct digital interface format setup (git-fixes).\n- ASoC: ab8500: Repair the DAPM capture graph (git-fixes).\n- ASoC: ab8500: Reset the audio block before configuring it (git-fixes).\n- ASoC: ab8500: Validate and program TDM slots correctly (git-fixes).\n- ASoC: adau1761: sort the register default table (git-fixes).\n- ASoC: amd: renoir: fix disable_pdm_interrupts() to clear mask bits (git-fixes).\n- ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC (git-fixes).\n- ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close() (git-fixes).\n- ASoC: apple: mca: increase SERDES reset delay (git-fixes).\n- ASoC: bcm: bcm63xx: Publish the OF module aliases (git-fixes).\n- ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses (git-fixes).\n- ASoC: cs35l33: drain threaded IRQ before runtime suspend (git-fixes).\n- ASoC: cs35l34: drain threaded IRQ before runtime suspend (git-fixes).\n- ASoC: cs35l41: sort the register default table (git-fixes).\n- ASoC: cs35l45: sort the register default table (git-fixes).\n- ASoC: cs4265: sort the register default table (git-fixes).\n- ASoC: cx2072x: sort the register default table (git-fixes).\n- ASoC: dapm: Fix off-by-one check on the second enum channel (git-fixes).\n- ASoC: fix unmet dependencies on PPC_BESTCOMM and SND_SOC_AC97_BUS (git-fixes).\n- ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready (git-fixes).\n- ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure (git-fixes).\n- ASoC: fsl_audmix: rework runtime PM handling in probe (git-fixes).\n- ASoC: fsl_easrc: sort the register default table (git-fixes).\n- ASoC: hdac_hda: Fix hlink refcount leak on component registration failure (git-fixes).\n- ASoC: Intel: avs: Clean up streams if their initialization fails (git-fixes).\n- ASoC: Intel: avs: Clean up the bus when fetching ML caps fails (git-fixes).\n- ASoC: Intel: avs: Do not ignore -ENOENT when loading a topology (git-fixes).\n- ASoC: Intel: avs: Fix unbalanced module reference count (git-fixes).\n- AsoC: intel: sst: fix PCI device reference leak on probe failure (git-fixes).\n- ASoC: Intel: SST: Publish the PCI module aliases (git-fixes).\n- ASoC: loongson: Fix error handling in ACPI property parsing (git-fixes).\n- ASoC: max9860: sort the register default table (git-fixes).\n- ASoC: mediatek: mt8183-afe-pcm: Shorten memif_data table using macros (stable-fixes).\n- ASoC: mediatek: mt8183-afe-pcm: Support \u003e32 bit DMA addresses (git-fixes).\n- ASoC: mediatek: mt8183-afe-pcm: use local `dev` pointer in driver callbacks (stable-fixes).\n- ASoC: mediatek: mt8183: Check runtime resume during probe (git-fixes).\n- ASoC: mediatek: mt8192-afe-pcm: Simplify probe() with local dev variable (stable-fixes).\n- ASoC: mediatek: mt8192: Check runtime resume during probe (git-fixes).\n- ASoC: meson: Keep link pointers valid on realloc failure (git-fixes).\n- ASoC: ml26124: sort the register default table (git-fixes).\n- ASoC: mt6351: Publish the OF module alias (git-fixes).\n- ASoC: pcm512x: sort the register default table (git-fixes).\n- ASoC: pxa: Use devm_clk_get_optional() for extclk clock (git-fixes).\n- ASoC: qcom: q6apm: keep the graph start count in sync with the DSP (git-fixes).\n- ASoC: rt274: sort the register default table (git-fixes).\n- ASoC: rt286: sort the register default table (git-fixes).\n- ASoC: rt298: sort the register default table (git-fixes).\n- ASoC: rt700-sdw: always drain jack work on remove (git-fixes).\n- ASoC: rt700: drop duplicate reg_default entry (git-fixes).\n- ASoC: rt700: sort the register default table (git-fixes).\n- ASoC: rt711-sdca: sort the register default tables (git-fixes).\n- ASoC: rt711: sort the register default table (git-fixes).\n- ASoC: rt712-sdca-dmic: sort the register default table (git-fixes).\n- ASoC: rt712-sdca-sdw: sort the register default table (git-fixes).\n- ASoC: rt715-sdca: drop duplicate reg_default entries (git-fixes).\n- ASoC: rt715-sdca: sort the register default tables (git-fixes).\n- ASoC: rt715: sort the register default table (git-fixes).\n- ASoC: rt1017-sdca-sdw: sort the register default table (git-fixes).\n- ASoC: rt1316-sdw: sort the register default table (git-fixes).\n- ASoC: rt1318-sdw: sort the register default table (git-fixes).\n- ASoC: rt1318: sort the register default table (git-fixes).\n- ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get (git-fixes).\n- ASoC: sgtl5000: sort the register default table (git-fixes).\n- ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() (git-fixes).\n- ASoC: SOF: validate topology volume range before allocation (git-fixes).\n- ASoC: sprd: validate compress buffer sizes against fixed allocations (git-fixes).\n- ASoC: sti-sas: sort the register default table (git-fixes).\n- ASoC: sti: initialize IRQ lock before requesting IRQ (git-fixes).\n- ASoC: tas2552: sort the register default table (git-fixes).\n- ASoC: tas2764: sort the register default table (git-fixes).\n- ASoC: tas2780: sort the register default table (git-fixes).\n- ASoC: tegra210_i2s: sort the register default table (git-fixes).\n- ASoC: tegra210_mixer: sort the register default table (git-fixes).\n- ASoC: tegra: Fix the MIXER enable default value (git-fixes).\n- ASoC: tegra: Sort MBDRC register defaults (git-fixes).\n- ASoC: xilinx: formatter_pcm: fix stream_data leak on open error (git-fixes).\n- ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers (git-fixes).\n- ata: ahci: work around lost interrupts on Marvell 88SE61xx (git-fixes).\n- batman-adv: bla: fix freeing of claims on meshif deletion (git-fixes).\n- batman-adv: bla: prevent CRC corruptions after claim flush (git-fixes).\n- batman-adv: dat: avoid unaligned fault in IP extraction (git-fixes).\n- batman-adv: fix stale receive device on merged fragments (git-fixes).\n- batman-adv: mcast: ensure unshared skb for multicast packets (git-fixes).\n- batman-adv: mcast: linearize skbuff for packet generation (git-fixes).\n- batman-adv: reject unrepresentable multicast TVLV offsets (git-fixes).\n- blk-mq: reinsert cached request to the list (bsc#1273770).\n- Bluetooth: btintel: bound firmware ID by TLV length (git-fixes).\n- Bluetooth: btintel: Fix diagnostics event detection (git-fixes).\n- Bluetooth: btintel: validate version TLV value lengths (git-fixes).\n- Bluetooth: btintel_pcie: Clear automask on spurious interrupts (git-fixes).\n- Bluetooth: btintel_pcie: fix tx_handle bounds off-by-one (git-fixes).\n- Bluetooth: btintel_pcie: validate packet_len before skb_put_data (git-fixes).\n- Bluetooth: btmtk: Declare MT7920 (MT7961 1a) Bluetooth firmware (git-fixes).\n- Bluetooth: btmtk: Do not discard the subsystem reset timeout (git-fixes).\n- Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read() (stable-fixes).\n- Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path (git-fixes).\n- Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX (git-fixes).\n- Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event (git-fixes).\n- Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev (git-fixes).\n- Bluetooth: btrtl: Don't leak return code when parsing firmware format v2 (git-fixes).\n- Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() (git-fixes).\n- Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req() (stable-fixes).\n- Bluetooth: btusb: Fix UAF of btusb_data by rx_work (git-fixes).\n- Bluetooth: do not leak an hci_conn when a second LE connect is rejected (git-fixes).\n- Bluetooth: eir: Fix OOB read in eir_get_service_data() (git-fixes).\n- Bluetooth: hci_aml: validate firmware segment lengths (git-fixes).\n- Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378 (git-fixes).\n- Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_conn: fix the SCO setup context lifetime (git-fixes).\n- Bluetooth: hci_conn: hold conn reference in abort_conn_sync() (git-fixes).\n- Bluetooth: hci_conn: re-enable advertising only for peripheral role (git-fixes).\n- Bluetooth: hci_core: Fix race condition during device registration (git-fixes).\n- Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb (git-fixes).\n- Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection (git-fixes).\n- Bluetooth: hci_event: fix LE list UAF on reset (git-fixes).\n- Bluetooth: hci_event: validate LE Set CIG Parameters response (git-fixes).\n- Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout() (git-fixes).\n- Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request (git-fixes).\n- Bluetooth: hci_sync: Fix accept list UAF during suspend (git-fixes).\n- Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths (git-fixes).\n- Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists (stable-fixes).\n- Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync() (stable-fixes).\n- Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del() (git-fixes).\n- Bluetooth: hci_uart: Fix false success return in hci_uart_setup() (git-fixes).\n- Bluetooth: ISO: do not force BT_LISTEN after a failed BIG sync (git-fixes).\n- Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready (git-fixes).\n- Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM (git-fixes).\n- Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan (git-fixes).\n- Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect (git-fixes).\n- Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync (git-fixes).\n- Bluetooth: MGMT: free the HCI command when it is cancelled (git-fixes).\n- Bluetooth: MGMT: free the mesh send cancel command when it is cancelled (git-fixes).\n- Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255 (git-fixes).\n- Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update (git-fixes).\n- Bluetooth: MSFT: validate evt_prefix_len against the response length (git-fixes).\n- Bluetooth: qca: fix NVM tag length underflow in TLV parser (git-fixes).\n- Bluetooth: RFCOMM: serialize security confirmation handling (git-fixes).\n- Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept (git-fixes).\n- Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (git-fixes).\n- Bluetooth: virtio_bt: avoid OOB read of build info string (git-fixes).\n- bnxt_en: Check return value of bnxt_hwrm_vnic_cfg (jsc#PED-16798).\n- bnxt_en: Delay for 5 seconds after AER DPC for all chips (jsc#PED-16798).\n- bnxt_en: Don't assume XDP is never enabled in bnxt_init_dflt_ring_mode() (jsc#PED-16798).\n- bnxt_en: Drop pci_save_state() after pci_restore_state() (jsc#PED-16798).\n- bnxt_en: Implement XDP RSS hash metadata extraction (jsc#PED-16798).\n- bnxt_en: Implement XDP RSS hash metadata extraction for V3_CMP (jsc#PED-16798).\n- bnxt_en: Move bnxt_rss_ext_op into header (jsc#PED-16798).\n- bnxt_en: Refactor some basic ring setup and adjustment logic (jsc#PED-16798).\n- bnxt_en: Restore default stat ctxs for ULP when resource is available (jsc#PED-16798).\n- bnxt_en: Set bp-\u003emax_tpa according to what the FW supports (jsc#PED-16798).\n- bnxt_en: Use absolute target ns from ptp_clock_request (jsc#PED-16798).\n- bnxt_en: use bnxt_xdp_buff for xdp context (jsc#PED-16798).\n- bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation (git-fixes).\n- bus: mhi: host: Fix controller cleanup on EDL sysfs failure (git-fixes).\n- bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET (git-fixes).\n- bus: ti-sysc: Fix /chosen node reference leak (git-fixes).\n- cacheinfo: don't propagate DT/ACPI error when arch supplies info (arm64) (git-fixes).\n- can: j1939: add missing calls in NETDEV_UNREGISTER notification handler (git-fixes).\n- can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking (stable-fixes).\n- char: xilinx_hwicap: unregister class on init errors (git-fixes).\n- cleanup: add a scoped version of CLASS() (stable-fixes).\n- cleanup: fix scoped_class() (git-fixes).\n- compiler_types: Introduce __flex_counter() and family (bsc#1280139).\n- cpufreq: intel_pstate: Add and use hybrid_get_cpu_type() (bsc#1240957 bsc#1249104 bsc#1265220).\n- cpufreq: intel_pstate: Avoid SMP calls to get cpu-type (bsc#1240957 bsc#1249104 bsc#1265220).\n- cpufreq: intel_pstate: Fix hwp_get_cpu_scaling() (bsc#1240957 bsc#1249104 bsc#1265220).\n- cpufreq: intel_pstate: Use correct scaling factor on Raptor Lake-E (bsc#1240957 bsc#1249104 bsc#1265220).\n- cpufreq: intel_pstate: Use CPPC to get scaling factors (bsc#1240957 bsc#1249104 bsc#1265220).\n- cpufreq: intel_pstate: Use HYBRID_SCALING_FACTOR_ADL for Bartlett Lake (bsc#1240957 bsc#1249104 bsc#1265220).\n- crypto: aspeed - Propagate platform_get_irq() errors (git-fixes).\n- crypto: atmel-sha204a - fix heap info leak on I2C transfer failure (git-fixes).\n- crypto: atmel-tdes - use scatterlist length before DMA mapping (git-fixes).\n- crypto: ccm - Set rfc4309 maxauthsize from child (git-fixes).\n- crypto: ccp - Abort doing SEV INIT if SNP INIT fails (stable-fixes).\n- crypto: ccp - Add new SEV/SNP platform shutdown API (stable-fixes).\n- crypto: ccp - Always pass in an error pointer to __sev_platform_shutdown_locked() (git-fixes).\n- crypto: ccp - Fix __sev_snp_shutdown_locked (git-fixes).\n- crypto: ccp - Fix dereferencing uninitialized error pointer (git-fixes).\n- crypto: ccp - Fix memory leak in SEV INIT_EX path (git-fixes).\n- crypto: ccp - Fix possible deadlock in SEV init failure path (git-fixes).\n- crypto: ccp - Fix SNP panic notifier unregistration (git-fixes).\n- crypto: ccp - Move dev_info/err messages for SEV/SNP init and shutdown (stable-fixes).\n- crypto: ccp - Move SEV/SNP Platform initialization to KVM (stable-fixes).\n- crypto: ccp - Register SNP panic notifier only if SNP is enabled (stable-fixes).\n- crypto: ccp - Reset TMR size at SNP Shutdown (stable-fixes).\n- crypto: doc - Remove extra parenthesis (git-fixes).\n- crypto: hisilicon/sec2 - fix CCM algorithm long packet failure (git-fixes).\n- crypto: keembay - Fix AEAD unregister count in error path (git-fixes).\n- crypto: keembay - Initialize completion before requesting IRQ (git-fixes).\n- crypto: keembay - publish OF module alias for OCS AES/SM4 (git-fixes).\n- crypto: lskcipher - propagate errors from unaligned crypt (git-fixes).\n- crypto: mxs-dcp - fix source scatterlist length access (git-fixes).\n- crypto: qat - cancel work on re-enable SR-IOV timeout (git-fixes).\n- crypto: qat - clear AES key schedule from stack (git-fixes).\n- crypto: qce - fix CCM AAD buffer underallocation (git-fixes).\n- crypto: qce - fix error path in devm_qce_register_algs (git-fixes).\n- crypto: qcom-rng - Allow zero as a random number (git-fixes).\n- crypto: qcom-rng - Enable clock in hwrng case (git-fixes).\n- crypto: rk3288 - fail ahash requests on HASH idle timeout (git-fixes).\n- crypto: sa2ul - stop probe if context pool creation fails (git-fixes).\n- crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping (git-fixes).\n- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (stable-fixes).\n- crypto: tegra - fix rctx-\u003ecryptlen calculation in tegra_gcm_do_one_req() (git-fixes).\n- cxl/acpi: Fix CXL_ACPI and CXL_PMEM Kconfig tristate mismatch (git-fixes).\n- cxl: Adjust the startup priority of cxl_pmem to be higher (git-fixes).\n- default_gfp(): avoid using the \"newfangled\" __VA_OPT__ trick (bsc#1280139).\n- device property: fix infinite loop in fwnode_for_each_child_node() (git-fixes).\n- dm/amdgpu: fix malformed link_settings debugfs output (git-fixes).\n- dma-mapping: add __dma_from_device_group_begin()/end() (bsc#1267586).\n- dmaengine: dw-edma: Clear stale requests on termination (git-fixes).\n- dmaengine: dw-edma: Complete descriptors before pausing (git-fixes).\n- dmaengine: dw-edma: Fix HDMA channel status register access (git-fixes).\n- dmaengine: dw-edma: Initialize IRQ data before requesting IRQs (git-fixes).\n- dmaengine: dw-edma: Serialize abort state updates (git-fixes).\n- dmaengine: dw-edma: Serialize channel state checks (git-fixes).\n- dmaengine: dw-edma: Terminate all descriptors without callbacks (git-fixes).\n- dmaengine: fsl-edma: tracing: no ptr dereference during log output (git-fixes).\n- dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe (git-fixes).\n- dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure (git-fixes).\n- dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal (git-fixes).\n- dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers (git-fixes).\n- dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout (git-fixes).\n- dmaengine: zynqmp_dma: fix kernel doc for zynqmp_dma_remove() (git-fixes).\n- driver core: soc: Unregister bus on early device registration failure (git-fixes).\n- drivers/virt: pkvm: Fix end calculation in mmio_guard_ioremap_hook() (git-fixes).\n- Drivers: hv: Use meaningful errnos for hypercall status codes (git-fixes).\n- drm/amd/display: Add AV mute wait frames to dce110_set_avmute (stable-fixes).\n- drm/amd/display: avoid divide-by-zero in __is_lut_linear() (git-fixes).\n- drm/amd/display: Check for tg ops in dce110_set_avmute (git-fixes).\n- drm/amd/display: dce100: skip non-DP stream encoders for DP MST (stable-fixes).\n- drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix (git-fixes).\n- drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE (git-fixes).\n- drm/amd/display: fix division by zero in get_estimated_bw() (git-fixes).\n- drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank() (git-fixes).\n- drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames (stable-fixes).\n- drm/amd/display: Remove unused-but-set variable hubp from (git-fixes).\n- drm/amd/display: validate plane degamma LUT size for private color prop (git-fixes).\n- drm/amd/pm: adjust the visibility of pp_table sysfs node (stable-fixes).\n- drm/amd/pm: fix gpu metrics energy accumulator for smu 13.0.0/13.0.7 (git-fixes).\n- drm/amd/pm: fix smu14 power limit range calculation (stable-fixes).\n- drm/amd/pm: make pp_features read-only when scpm is enabled (stable-fixes).\n- drm/amd/pm: Use same metric table for APU (stable-fixes).\n- drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read (git-fixes).\n- drm/amdgpu/gfx6: Fixup emit_cntxcntl() (git-fixes).\n- drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets (git-fixes).\n- drm/amdgpu/gfx6: Use PFP on the compute queues too (git-fixes).\n- drm/amdgpu/gfx8: drop unecessary BUG_ON() (stable-fixes).\n- drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup (git-fixes).\n- drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup (git-fixes).\n- drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/sdma7.0: replace BUG_ON() with WARN_ON() (stable-fixes).\n- drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) (stable-fixes).\n- drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older (stable-fixes).\n- drm/amdgpu/vce: fix integer overflow in image size (stable-fixes).\n- drm/amdgpu/vcn4: avoid rereading IB param length (stable-fixes).\n- drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (git-fixes).\n- drm/amdgpu: cap GTT size to physical RAM on APUs (stable-fixes).\n- drm/amdgpu: check ASPM on the dGPU host link (git-fixes).\n- drm/amdgpu: disallow multiple FENCE chunks in one submit (git-fixes).\n- drm/amdgpu: fix aperture iounmap skipped on device removal (git-fixes).\n- drm/amdgpu: fix autosuspend cleanup during removal (git-fixes).\n- drm/amdgpu: fix bo-\u003epin leaking in amdgpu_bo_create_reserved (stable-fixes).\n- drm/amdgpu: fix division by zero with invalid uvd dimensions (stable-fixes).\n- drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (stable-fixes).\n- drm/amdgpu: fix nbif 6.3.1 l1 low power not functional (git-fixes).\n- drm/amdgpu: Fix UVD decode image min size calculation (stable-fixes).\n- drm/amdgpu: Fix UVD dpb min size calculation for H264 (stable-fixes).\n- drm/amdgpu: Fix UVD min buffer sizes (stable-fixes).\n- drm/amdgpu: Fix VCE 3 ring align_mask (git-fixes).\n- drm/amdgpu: Fix VFCT bus number matching with soft filter (stable-fixes).\n- drm/amdgpu: Implement insert_end for VCE 3 (git-fixes).\n- drm/amdgpu: invoke pm_genpd_remove() before freeing genpd (stable-fixes).\n- drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini (git-fixes).\n- drm/amdgpu: read TRUNCATE_COORD_MODE on gfx12 (git-fixes).\n- drm/amdgpu: reject oversized IBs with per-ring packet limits (stable-fixes).\n- drm/amdgpu: Reject UVD message with dimensions above 4096 (stable-fixes).\n- drm/amdgpu: Reject UVD message with invalid number of h265 refs (stable-fixes).\n- drm/amdgpu: remove unused function parameter (stable-fixes).\n- drm/amdgpu: restore UMD profile pstate after runtime resume (stable-fixes).\n- drm/amdgpu: validate GEM_CREATE domain combinations (stable-fixes).\n- drm/amdkfd: Check bounds in allocate_event_notification_slot (stable-fixes).\n- drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (stable-fixes).\n- drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE (stable-fixes).\n- drm/amdkfd: fix QID bit leak in pqm_create_queue() (stable-fixes).\n- drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore (git-fixes).\n- drm/amdkfd: Handle invalid event type in CRIU event restore (stable-fixes).\n- drm/amdkfd: Use kvcalloc to allocate arrays (stable-fixes).\n- drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure (git-fixes).\n- drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure (git-fixes).\n- drm/bridge: ps8640: propagate AUX transfer register errors (git-fixes).\n- drm/bridge: tc358767: clamp the reported AUX read size to the request (git-fixes).\n- drm/connector/hdmi: Fix out of bounds memory read (git-fixes).\n- drm/connector: Fix epoch_counter docs to reflect reality (git-fixes).\n- drm/drm_exec: fix up contended obj when num_objects is 0 (git-fixes).\n- drm/gud: NUL-terminate TV mode names read from the device (git-fixes).\n- drm/gud: validate TV mode names before creating enum property (git-fixes).\n- drm/hibmc: Fix list of formats on the primary plane (git-fixes).\n- drm/hibmc: Use drm_atomic_helper_check_plane_state() (git-fixes).\n- drm/i915/hdcp: check streams bounds before overflow (git-fixes).\n- drm/i915/hdcp: Move to using intel_display in intel_hdcp (stable-fixes).\n- drm/i915/hdcp: require monotonically increasing seq_num_v (git-fixes).\n- drm/i915/hdcp: Skip inactive MST connectors when building stream list (stable-fixes).\n- drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() (stable-fixes).\n- drm/i915/vrr: require valid min/max vfreq for VRR (git-fixes).\n- drm/i915: Fix memory leak in query_perf_config_list() (git-fixes).\n- drm/lima: call drm_mm_init() with a valid allocation range (git-fixes).\n- drm/msm/a6xx: Fix RBBM_CLOCK_CNTL3_TP0 value in a730_hwcg (git-fixes).\n- drm/msm/a6xx: Fix stale rpmh votes after suspend (git-fixes).\n- drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0) (git-fixes).\n- drm/msm/dsi: Drop dev_pm_opp_set_rate(0) (git-fixes).\n- drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value (git-fixes).\n- drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE (git-fixes).\n- drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op (git-fixes).\n- drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE (git-fixes).\n- drm/nouveau: unsubscribe the channel-kill event before the fence context (git-fixes).\n- drm/nouveau: Use write-combined maps for coherent (git-fixes).\n- drm/panel-edp: fix i2c adapter leak on probe failure (git-fixes).\n- drm/panel: samsung-s6d16d0: Power off on prepare failure (git-fixes).\n- drm/panthor: fix firmware control interface bounds checks (git-fixes).\n- drm/panthor: return PTR_ERR() from devm_drm_dev_alloc() (git-fixes).\n- drm/panthor: skip zero-sized firmware sections (git-fixes).\n- drm/radeon: fix autosuspend cleanup during teardown (git-fixes).\n- drm/radeon: fix r100_copy_blit for large BOs (stable-fixes).\n- drm/radeon: restore hardware polling in fence_is_signaled to fix performance regression (git-fixes).\n- drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format (git-fixes).\n- drm/ssd130x: fix column and row end address in partial updates for ssd132x (git-fixes).\n- drm/ssd130x: fix column and row end address in partial updates in ssd133x (git-fixes).\n- drm/sun4i: crtc: Propagate layer initialization error (git-fixes).\n- drm/sun4i: Drop node references while building component list (git-fixes).\n- drm/sun4i: dw-hdmi: Drop TCON TOP port reference (git-fixes).\n- drm/sun4i: fix refcount leak in sun4i_backend_init_sat() (git-fixes).\n- drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz (git-fixes).\n- drm/sun4i: hdmi: Don't leak sync polarity bits into packet control (git-fixes).\n- drm/sun4i: tcon: Drop remote endpoint reference (git-fixes).\n- drm/sun4i: tcon: Drop TCON TOP device reference (git-fixes).\n- drm/sun4i: tcon: Set output mux for DSI and LVDS (git-fixes).\n- drm/sun4i: vi scaler: Fix coefficient selection (git-fixes).\n- drm/tegra: dsi: Re-add clear enable register if DSI was powered by bootloader (git-fixes).\n- drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info (git-fixes).\n- drm/tve200: add OF module alias for autoloading (git-fixes).\n- drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() (git-fixes).\n- drm/xe/oa: Check managed mutex initialization errors (git-fixes).\n- drm/xe/oa: Fix sync entry leak on OA config emit failure (git-fixes).\n- drm/xe/oa: Remove sysfs entry on idr_alloc failure in xe_oa_add_config_ioctl() (git-fixes).\n- drm/xe: Introduce xe_gt_dbg_printer() (stable-fixes).\n- drm/xe: Order ring writes before ring tail updates (git-fixes).\n- drm/xe: Stub out new pagefault layer (stable-fixes).\n- drm/xe: tests: fix error message in xe_migrate_sanity_test() (git-fixes).\n- drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used (git-fixes).\n- drm: fix race between partial drm_dev_register() failure and ioctl (git-fixes).\n- drm: lcdif: Wait for vblank before disabling DMA (git-fixes).\n- drm: Remove unused header in drm_dumb_buffers.c (git-fixes).\n- efi: fix stale reference to efi_recover_from_page_fault() (git-fixes).\n- erspan: Initialize options_len before referencing options (bsc#1274727).\n- ethtool: rss: fix hkey leak when indir_size is 0 (git-fixes).\n- fbdev: bitblit: bound-check glyph index in bit_cursor() (git-fixes).\n- fbdev: core: Fix pointer desynchronization in fb_io_read() (git-fixes).\n- fbdev: kyro: Validate overlay viewport coordinates (git-fixes).\n- fbdev: omapfb: panel-dsi-cm: initialize lock before registering display (git-fixes).\n- fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device() (git-fixes).\n- fbdev: uvesafb: unregister connector callback on init failure (git-fixes).\n- fbdev: vfb: defer cleanup until the last reference (git-fixes).\n- firmware: arm_scmi: Avoid IDR updates while cleaning channels (git-fixes).\n- firmware: arm_scmi: Clean up channels on setup failure (git-fixes).\n- firmware: arm_scmi: Drop handle on protocol bind failures (git-fixes).\n- firmware: arm_scmi: Fix requested device removal race (git-fixes).\n- firmware: arm_scmi: Free transport channel on IDR failure (git-fixes).\n- firmware: arm_scmi: Protect device request lookup with RCU (git-fixes).\n- firmware: arm_scmi: Publish channel state before callbacks (git-fixes).\n- firmware: arm_scmi: Quiesce notifications before teardown (git-fixes).\n- firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context (git-fixes).\n- firmware: arm_scmi: Reject out of range DT protocol IDs (git-fixes).\n- firmware: arm_scmi: Roll back partial protocol table registration (git-fixes).\n- firmware: arm_scmi: Unregister device notifier before IDR teardown (git-fixes).\n- firmware: arm_scmi: Unrequest devices if driver registration fails (git-fixes).\n- firmware: arm_scmi: Unwind P2A receiver mailbox setup failure (git-fixes).\n- firmware: arm_scmi: Unwind TX receiver mailbox setup failure (git-fixes).\n- firmware: arm_scmi: Use channel ID for transport teardown (git-fixes).\n- firmware_loader: do not queue completed sysfs fallback requests (git-fixes).\n- fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write (git-fixes).\n- fpga: dfl: fme: add error handling (git-fixes).\n- fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration (git-fixes).\n- fuse: fix race between interrupt and resend (git-fixes).\n- gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind (git-fixes).\n- gpu: host1x: Avoid stack over-read in debug output helpers (git-fixes).\n- gpu: host1x: Fix offset calculation in trace_write_gather (git-fixes).\n- gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings (stable-fixes).\n- HID: asus: fix missing hid_is_usb() check (git-fixes).\n- HID: asus: simplify RGB init sequence (stable-fixes).\n- HID: bpf: serialize device reference release in struct_ops destroy path (git-fixes).\n- HID: core: fix number/pointer type confusion on long items (git-fixes).\n- HID: core: fix OOB read of field-\u003eusage in hid_set_field() (git-fixes).\n- HID: ft260: fix stack-use-after-return write in I2C read race (git-fixes).\n- HID: ft260: validate i2c input report length (stable-fixes).\n- HID: hyperv: validate initial device info bounds (git-fixes).\n- HID: i2c-hid: Fix \"(null)\" output when reading report descriptor fails (git-fixes).\n- HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure (git-fixes).\n- HID: lg4ff: validate report length before fixed offsets (git-fixes).\n- HID: logitech-dj: Fix maxfield check in DJ short report validation (git-fixes).\n- HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report (git-fixes).\n- HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write (stable-fixes).\n- HID: logitech-dj: Standardise hid_report_enum variable nomenclature (stable-fixes).\n- HID: magicmouse: do not keep a stale msc-\u003einput if no input is claimed (git-fixes).\n- HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C (git-fixes).\n- HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID (stable-fixes).\n- HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() (git-fixes).\n- HID: magicmouse: re-enable multitouch after reset-resume (git-fixes).\n- HID: mcp2221: validate report size in mcp2221_raw_event() (git-fixes).\n- HID: multitouch: reclassify HTIX5288 to WIN_8_FORCE_MULTI_INPUT_NSMU (git-fixes).\n- HID: nintendo: Fix imu_timestamp_us double increment per report (git-fixes).\n- HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() (git-fixes).\n- HID: nintendo: register input device after capabilities are set (git-fixes).\n- HID: nintendo: stop device IO before hid_hw_stop on probe failure (git-fixes).\n- HID: picolcd: clamp eeprom debugfs read to bytes actually received (git-fixes).\n- HID: pidff: Rework pidff_set_time() to fix warnings (stable-fixes).\n- HID: pidff: Use ARRAY_SIZE macro instead of sizeof (stable-fixes).\n- HID: rmi: fix OOB access with undersized RMI reports (git-fixes).\n- HID: roccat: bound device-supplied profile index (git-fixes).\n- HID: roccat: free buffered reports when destroying device (git-fixes).\n- HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature (git-fixes).\n- HID: sensor: custom: Fix field sysfs group cleanup on failure (git-fixes).\n- HID: sensor: custom: Fix use-after-free in enable_sensor (git-fixes).\n- HID: synchronize input before cleaning up a failed probe (git-fixes).\n- HID: tmff: Use 64-bit arithmetic for force feedback scaling (git-fixes).\n- HID: wacom: validate report length in wacom_intuos_pro2_bt_irq (git-fixes).\n- hwmon: (ads7828) Fix external VREF regulator handling (git-fixes).\n- hwmon: (applesmc) fix key backlight workqueue leak on register failure (git-fixes).\n- hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors (git-fixes).\n- hwmon: (chipcap2) fix channels in humidity alarm notifications (git-fixes).\n- hwmon: (coretemp) Fix core_data leak on CPUs without PTS (git-fixes).\n- hwmon: (corsair-cpro) Create debugfs entries after hwmon registration (git-fixes).\n- hwmon: (corsair-cpro) Remove debugfs entries when probe fails (git-fixes).\n- hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination (git-fixes).\n- hwmon: (gpio-fan) Fix use-after-free in alarm work (git-fixes).\n- hwmon: (gpio-fan) take fan_data-\u003elock in gpio_fan_shutdown() (git-fixes).\n- hwmon: (ina2xx) Add support for has_alerts configuration flag (stable-fixes).\n- hwmon: (ina2xx) Add support for INA234 (stable-fixes).\n- hwmon: (ina2xx) Add support for INA260 (stable-fixes).\n- hwmon: (ina2xx) Fix various overflow issues (git-fixes).\n- hwmon: (ina2xx) Make it easier to add more devices (stable-fixes).\n- hwmon: (ina2xx) Shift INA234 shunt and current registers (stable-fixes).\n- hwmon: (ina226) Add support for SY24655 (stable-fixes).\n- hwmon: (ltc4282) Avoid overflow in maximum power calculation (git-fixes).\n- hwmon: (ltc4282) Clamp negative current limits (git-fixes).\n- hwmon: (ltc4282) Fix parsing adi,current-limit-sense-microvolt (git-fixes).\n- hwmon: (ltc4282) Make sure clk_init_data is fully initialized (git-fixes).\n- hwmon: (max6621) fix negative temperature offset and crit readings (git-fixes).\n- hwmon: (max6621) fix temperature clamp range (git-fixes).\n- hwmon: (nzxt-smart2) Check return value of init_device() in probe (git-fixes).\n- hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS (git-fixes).\n- hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations (git-fixes).\n- hwmon: Switch back to struct platform_driver::remove() (stable-fixes).\n- hwrng: ks-sa - Fix runtime PM cleanup on registration failure (git-fixes).\n- hwrng: omap - Fix probe error path cleanup (git-fixes).\n- hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() (git-fixes).\n- i2c: core: fix debugfs UAF on adapter removal (git-fixes).\n- i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (git-fixes).\n- i2c: imx: separate atomic, dma and non-dma use case (stable-fixes).\n- i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure (git-fixes).\n- i2c: mux: Fix channel node leak on adapter add failure (git-fixes).\n- i2c: ocores: Disable clock on failed resume (git-fixes).\n- i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices (git-fixes).\n- i3c: dw: rename \"pclk\" to \"apb\" to match dt-binding (git-fixes).\n- i3c: master: Fix device_register() error path (git-fixes).\n- i3c: master: Fix info leak and UAF in device unregister path (git-fixes).\n- i3c: master: Fix potential UAF in i3c_device_uevent() (git-fixes).\n- i3c: master: svc: bound IBI payload to the requested max_payload_len (git-fixes).\n- ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink (git-fixes).\n- ieee802154: cc2520: fix FIFOP work use-after-free (git-fixes).\n- ieee802154: hwsim: serialize pib updates to fix double-free (git-fixes).\n- iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE (git-fixes).\n- iio: adc: max34408: add missing 'select REGMAP_I2C' to Kconfig (git-fixes).\n- iio: adc: pac1921: fix wrong channel used in trigger handler read (git-fixes).\n- iio: buffer: Fix potential use-after-free in anonymous buffer release (git-fixes).\n- iio: buffer: Make IIO DMA fence release RCU-safe (git-fixes).\n- iio: buffer: Tie IIO dma fence lock lifetime to the fence (git-fixes).\n- iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable (git-fixes).\n- iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF (git-fixes).\n- iio: chemical: sgp30: Handle IAQ thread creation failure (git-fixes).\n- iio: dac: m62332: Fix regulator reference count imbalance (git-fixes).\n- iio: gyro: mpu3050: fix sign of raw angular velocity readings (git-fixes).\n- iio: light: cm32181: return zero after writing calibscale (git-fixes).\n- iio: light: gp2ap002: Disable regulators on resume failure (git-fixes).\n- iio: light: gp2ap002: re-enable irq if runtime suspend fails (git-fixes).\n- iio: light: isl29028: return zero in write_raw() on success (git-fixes).\n- iio: light: ltrf216a: fix runtime PM reference leak in error path (git-fixes).\n- iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem() (git-fixes).\n- iio: light: opt4001: Fix power down clearing bits of the wrong register (git-fixes).\n- iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask (git-fixes).\n- iio: light: opt4001: Reject integration times with a non-zero seconds part (git-fixes).\n- iio: light: tsl2583: return zero in write_raw() on success (git-fixes).\n- iio: light: tsl2772: fix ALS calibscale readback (git-fixes).\n- iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure (git-fixes).\n- iio: pressure: dps310: fix NULL pointer dereference on ACPI probe (git-fixes).\n- iio: pressure: mpl115: Fix runtime PM cleanup (git-fixes).\n- iio: srf04: fix pm_runtime handling on probe error path (git-fixes).\n- iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() (git-fixes).\n- Input: atkbd - skip deactivate for HONOR ZQC-P (git-fixes).\n- Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard (stable-fixes).\n- Input: cs40l50-vibra - validate custom data from user space (git-fixes).\n- Input: evdev - fix information leak in evdev_pass_values() (stable-fixes).\n- Input: evdev - sanitize event type index when fetching event masks (stable-fixes).\n- Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet (git-fixes).\n- Input: focaltech - use signed coordinates to prevent underflow (git-fixes).\n- Input: hynitron_cstxxx - validate touch count and finger IDs (git-fixes).\n- Input: iforce - validate input packet lengths (stable-fixes).\n- Input: iqs5xx - validate firmware record destination span (git-fixes).\n- Input: mms114 - fix Y-resolution configuration (git-fixes).\n- Input: psxpad-spi - set driver data before use (git-fixes).\n- Input: reject inhibit and uninhibit requests on unregistering devices (git-fixes).\n- Input: sur40 - fix input device registration ordering (stable-fixes).\n- Input: sur40 - fix V4L error path cleanup (stable-fixes).\n- Input: synaptics-rmi4 - block s_input when F54 queue is busy (git-fixes).\n- Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer (git-fixes).\n- Input: synaptics-rmi4 - fix F55 transmitter electrode count typo (git-fixes).\n- Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue (git-fixes).\n- Input: synaptics-rmi4 - zero report size on F54 work error (git-fixes).\n- Input: xpad - add support for ZENAIM LEVERLESS (stable-fixes).\n- interconnect: Fix use after free in icc_get() and of_icc_get_by_index() (git-fixes).\n- io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item (git-fixes).\n- io_uring/net: Avoid msghdr on op_connect/op_bind async data (git-fixes).\n- iommu/arm-smmu-v3: Manage teardown with devm (stable-fixes).\n- ip_tunnel: Use ip_tunnel_info() helper instead of 'info + 1' (bsc#1274727).\n- ipmi: ipmb: validate write message length (git-fixes).\n- ipmi: si: Fix NULL pointer dereference after failed registration (git-fixes).\n- KVM: arm64: Ensure FFA ranges are page aligned (git-fixes).\n- KVM: arm64: Fix bounds checking in do_ffa_mem_reclaim() (git-fixes).\n- KVM: arm64: Fix sign-extension of MMIO loads (git-fixes).\n- KVM: arm64: vgic: Reset in_kernel on private IRQ allocation failure (git-fixes).\n- KVM: arm64: Zero out the stack initialized data in the FFA handler (git-fixes).\n- KVM: nSVM: Always inject a #GP if mapping VMCB12 fails on nested VMRUN (git-fixes).\n- KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (git-fixes).\n- KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit (git-fixes).\n- KVM: nVMX: Service local TLB flushes on failed nested VM-Enter (git-fixes).\n- KVM: PPC: Book3S HV: Add support for compat CPU capabilities for KVM on PowerNV (bsc#1263864 ltc#217835).\n- KVM: PPC: Book3S HV: Implement compat CPU capability retrieval for KVM on PowerVM (bsc#1263864 ltc#217835).\n- KVM: PPC: Book3S HV: Validate arch_compat against host compatibility mode (bsc#1263864 ltc#217835).\n- KVM: PPC: Document KVM_PPC_GET_COMPAT_CAPS ioctl (bsc#1263864 ltc#217835).\n- KVM: PPC: Introduce KVM_CAP_PPC_COMPAT_CAPS and wire up ioctl (bsc#1263864 ltc#217835).\n- KVM: SEV: Use to_kvm_sev_info() for fetching kvm_sev_info struct (git-fixes).\n- KVM: SVM: Add support to initialize SEV/SNP functionality in KVM (bsc#1279887).\n- KVM: SVM: Explicitly mark vmcb01 dirty after modifying VMCB intercepts (git-fixes).\n- KVM: SVM: Serialize accesses to the owner and mirror list with separate lock (git-fixes).\n- KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (git-fixes).\n- KVM: TDX: Account all non-transient page allocations for per-TD structures (git-fixes).\n- KVM: TDX: Fix x2APIC MSR handling in tdx_has_emulated_msr() (git-fixes).\n- KVM: VMX: Don't register posted interrupt wakeup handler if alloc_kvm_area() fails (git-fixes).\n- KVM: x86/hyperv: Check for NULL vCPU Hyper-V object in kvm_hv_get_tlb_flush_fifo() (git-fixes).\n- KVM: x86/hyperv: Ensure vCPU's Hyper-V object is initialized on cross-vCPU accesses (git-fixes).\n- KVM: x86/hyperv: Get target FIFO in hv_tlb_flush_enqueue(), not caller (git-fixes).\n- KVM: x86/mmu: Recover TDP MMU NX huge pages using MMU read lock (bsc#1271050).\n- KVM: x86/mmu: Rename kvm_tdp_mmu_zap_sp() to better indicate its purpose (bsc#1271050).\n- KVM: x86/mmu: Track possible NX huge pages separately for TDP vs. Shadow MMU (bsc#1271050).\n- KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page (git-fixes).\n- KVM: x86: Don't WARN if IRQ disappears because it was cleared from the PIC (git-fixes).\n- KVM: x86: Don't WARN if IRQ disappears when Xen emulation is enabled (git-fixes).\n- KVM: x86: Fix array_index_nospec() protection in kvm_vcpu_ioctl_x86_set_mce() (git-fixes).\n- KVM: x86: Fix emulated CPUID features being applied to wrong sub-leaf (git-fixes).\n- KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock (git-fixes).\n- leds: pca9532: Fix inverted GPIO output polarity (git-fixes).\n- leds: pca9532: Fix phantom device registration on missing hardware (git-fixes).\n- lib/string: fix memchr_inv() for large ranges (git-fixes).\n- lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() (git-fixes).\n- mac802154: fix data race and NULL deref on local-\u003eassoc_dev (git-fixes).\n- mac802154: fix netdev use-after-free in beacon worker (git-fixes).\n- mac802154: fix use-after-free of sdata via queued RX frames (git-fixes).\n- mailbox: pcc: Fix command timeout due to missed interrupt (git-fixes).\n- mailbox: qcom-cpucp: fix PREEMPT_RT self-deadlock in IRQ handler (git-fixes).\n- mailbox: qcom-cpucp: handle NULL data in send_data callback (git-fixes).\n- mailbox: qcom-ipcc: fix duplicate channel allocation across holes (git-fixes).\n- mailbox: rockchip: disable pclk on probe failure and unbind (git-fixes).\n- maple_tree: fix argument name in header (git-fixes).\n- md/raid1: create serial pool adding rdev to array with serialize_policy=1 (bsc#1272261).\n- media: airspy: Return queued buffers on start_streaming() failure (git-fixes).\n- media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref (git-fixes).\n- media: amphion: Remove obsolete frame_count check in venc_start_session (git-fixes).\n- media: bcm2835-unicam: Fix asc leaked in error/remove path (git-fixes).\n- media: cec-pin: Fix event FIFO ordering (git-fixes).\n- media: cec: disable delayed work before freeing an interrupted transmit (git-fixes).\n- media: cec: extron-da-hd-4k-plus: add sanity check (git-fixes).\n- media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash (git-fixes).\n- media: cec: Serialize exclusive follower delivery (git-fixes).\n- media: cec: stm32: prevent out-of-bounds write on RX overflow (git-fixes).\n- media: cedrus: clean up media device on probe failure (git-fixes).\n- media: cedrus: fix memory leak in cedrus_init_ctrls() (git-fixes).\n- media: chips-media: wave5: Guard bit depth check with initial_info_obtained (git-fixes).\n- media: chips-media: wave5: Move src_buf Removal to finish_encode (git-fixes).\n- media: cobalt: Avoid freeing ALSA private data twice (git-fixes).\n- media: cx231xx: fix devres lifetime (git-fixes).\n- media: cx231xx: reject geometry changes while the VBI queue is busy (git-fixes).\n- media: cx23885: add ioremap return check and cleanup (git-fixes).\n- media: cx23885: cancel NetUP CI work before teardown (git-fixes).\n- media: em28xx: defer audio-only extension registration (git-fixes).\n- media: em28xx: fix use-after-free of dev_next-\u003edevlist on disconnect (git-fixes).\n- media: go7007: defer the ALSA v4l2 put until card release (git-fixes).\n- media: hevc: add bounded tile-count helpers (git-fixes).\n- media: i2c: alvium: fix critical pointer access in alvium_ctrl_init (git-fixes).\n- media: i2c: alvium: Fix: Correct name of register in alvium_set_ctrl_auto_exposure (git-fixes).\n- media: i2c: imx219: Rename VTS to FRM_LENGTH (stable-fixes).\n- media: i2c: imx415: Return test pattern write errors (git-fixes).\n- media: i2c: ov02a10: fix endpoint parsing use-after-free (git-fixes).\n- media: i2c: ov7740: fix use-after-destroy in remove (git-fixes).\n- media: i2c: rdacm21: Fix missing media_entity_cleanup() (git-fixes).\n- media: imx219: Fix maximum frame length in lines (git-fixes).\n- media: intel/ipu6: fix async notifier cleanup leak on parse error (git-fixes).\n- media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for overlapping ranges (git-fixes).\n- media: ipu6: Do not free aux device pdata after init (git-fixes).\n- media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define (git-fixes).\n- media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define (git-fixes).\n- media: mc-entity: Add missing kerneldoc (git-fixes).\n- media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity (git-fixes).\n- media: meson: vdec: Fix memory leak in error path of vdec_open (git-fixes).\n- media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common (git-fixes).\n- media: msi2500: Return queued buffers on start_streaming() failure (git-fixes).\n- media: nuvoton: npcm-video: fix error handling in npcm_video_init() (git-fixes).\n- media: nuvoton: npcm-video: fix memory leaks in probe and remove (git-fixes).\n- media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe (git-fixes).\n- media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure (git-fixes).\n- media: nxp: imx8-isi: Correct color map between V4L2 and ISI (git-fixes).\n- media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path (git-fixes).\n- media: nxp: imx8-isi: Fix potential out-of-bounds issues (git-fixes).\n- media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding (git-fixes).\n- media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing (git-fixes).\n- media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks (git-fixes).\n- media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() (stable-fixes).\n- media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup (git-fixes).\n- media: platform: mtk-mdp3: Fix SCP device refcounting (git-fixes).\n- media: pwc: Drain fill_buf on start_streaming() failure (git-fixes).\n- media: pwc: Return queued buffers on start_streaming() failure (git-fixes).\n- media: qcom: camss: Fix RDI streaming for CSID GEN2 (git-fixes).\n- media: radio-si476x: Unregister v4l2_device on probe failure (git-fixes).\n- media: rc: sunxi-cir: Unregister rc device on probe failure (git-fixes).\n- media: rtl2832: fix use-after-free in rtl2832_remove() (git-fixes).\n- media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure (git-fixes).\n- media: rtl2832_sdr: Return queued buffers on start_streaming() failure (git-fixes).\n- media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak (git-fixes).\n- media: s2255: bound JPEG frame size before copying into the buffer (git-fixes).\n- media: s2255: check firmware size before reading trailing marker (git-fixes).\n- media: saa7134: Fix a possible memory leak in saa7134_video_init1 (git-fixes).\n- media: saa7164: fix cleanup on resource allocation failure (git-fixes).\n- media: stm32: dcmi: unregister notifier on probe failure (git-fixes).\n- media: sun4i-csi: Return queued buffers on start_streaming() failure (git-fixes).\n- media: tda18250: fix possible integer overflow (git-fixes).\n- media: tegra-video: vi: fix invalid u32 return value in format lookup (git-fixes).\n- media: usbtv: keep device alive while ALSA card exists (git-fixes).\n- media: v4l2-async: avoid deleting unlinked ASC entry on link error (git-fixes).\n- media: v4l2-async: Unregister sub-device if asc_list is empty (git-fixes).\n- media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete() (git-fixes).\n- media: v4l2-ctrls: Allow unknown HDR10 white point and luminance (git-fixes).\n- media: v4l2-ctrls: validate AV1 tile counts (git-fixes).\n- media: v4l2-ctrls: validate HEVC tile counts (git-fixes).\n- media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link (git-fixes).\n- media: v4l2-h264: Fix memcmp() size in B1 reference list comparison (git-fixes).\n- media: v4l2-subdev: Fail {enable,disable}_streams and s_streaming nicely (git-fixes).\n- media: venus: fix payload size calculation in parse_raw_formats() (git-fixes).\n- media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() (git-fixes).\n- media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity (git-fixes).\n- media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer (git-fixes).\n- media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity (git-fixes).\n- media: vicodec: fix out-of-bounds write in FWHT encoder (git-fixes).\n- media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure (git-fixes).\n- media: vimc: fix pixel format lookup in enum_framesizes (git-fixes).\n- media: vivid: add vivid_update_reduced_fps() (git-fixes).\n- media: vivid: check for vb2_is_busy() when toggling caps (git-fixes).\n- media: vivid: fix cleanup bugs in vivid_init() (git-fixes).\n- media: zoran: Avoid freeing a registered video_device twice (git-fixes).\n- mei: pull kvfree out of spinlock (git-fixes).\n- mfd: iqs62x: Reject zero-length firmware records (git-fixes).\n- mfd: rave-sp: validate received frame payload lengths (git-fixes).\n- mfd: sm501: Fix potential memory leaks during remove (git-fixes).\n- misc: bcm-vk: Use acquire/release for msgq_inited (git-fixes).\n- misc: fastrpc: fix channel ctx ref leak when session alloc fails (git-fixes).\n- misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free (git-fixes).\n- misc: fastrpc: Remove buffer from list prior to unmap operation (git-fixes).\n- misc: fastrpc: take fl-\u003elock when moving mmaps on interrupted invoke (git-fixes).\n- misc: nsm: bound the device-reported response length (git-fixes).\n- misc: rtsx: add missing write register handling (git-fixes).\n- misc: sgi-gru: remove interrupt-context page-table walks (git-fixes).\n- misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() (git-fixes).\n- mkspec-dtb: Move DTS prefix into package list.\n- mkspec-dtb: Move provides-obsoletes to package list.\n- mkspec-dtb: Put per-architecture package lists into a hash.\n- mkspec-dtb: re-indent.\n- mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition (git-fixes).\n- mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit (git-fixes).\n- mmc: sdhci: unmap the bounce buffer before device release (git-fixes).\n- mmc: via-sdmmc: stop card-detect handling on probe failure (git-fixes).\n- mtd: afs: validate v2 image info bounds (git-fixes).\n- mtd: fix double free and WARN_ON in add_mtd_device() error paths (git-fixes).\n- mtd: mtdoops: free page bitmap when the backing MTD is removed (git-fixes).\n- mtd: mtdswap: Avoid freeing registered blktrans device twice (git-fixes).\n- mtd: mtdswap: remove debugfs stats file on teardown (git-fixes).\n- mtd: nand: mtk-ecc: stop on ECC idle timeouts (git-fixes).\n- mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() (git-fixes).\n- mtd: rawnand: validate ONFI extended parameter page sections (git-fixes).\n- mtd: spinand: fix direct mapping creation sizes (stable-fixes).\n- mtd: spinand: repeat reading in regular mode if continuous reading fails (stable-fixes).\n- mtd: spinand: try a regular dirmap if creating a dirmap for continuous reading fails (stable-fixes).\n- mtd: ubi: Release device reference on busy detach (git-fixes).\n- mtd: ubi: skip programming unused bits in ubi headers (stable-fixes).\n- net: Add options as a flexible array to struct ip_tunnel_info (bsc#1274727).\n- net: mana: Add debug knob to skip TX timeout recovery reset (git-fixes).\n- net: mana: Add handler for sriov configure (bsc#1272756).\n- net: mana: Cap MSI-X vectors to the device MSI-X table size (git-fixes).\n- net: mana: Extend RX CQE coalescing up to 8 packets (git-fixes).\n- net: mana: Fall back to scattered pages for GDMA queues (git-fixes).\n- net: mana: force full-page RX buffers via ethtool private flag (bsc#1269792).\n- net: mana: refactor mana_get_strings() and mana_get_sset_count() to use switch (bsc#1269792).\n- net: mana: Route ring-buffer access through offset-based helpers (git-fixes).\n- net: tap: set skb-\u003edev before parsing virtio net header in tap_get_user_xdp() (git-fixes bsc#1274550).\n- net: thunderbolt: Count delivered packets in rx_packets and rx_bytes (git-fixes).\n- net: thunderbolt: Mark the connection down when bringing it up fails (git-fixes).\n- net: thunderbolt: Release the Rx HopID that was handed out on mismatch (git-fixes).\n- net: thunderbolt: Tear down DMA paths before stopping the rings (git-fixes).\n- net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() (git-fixes).\n- net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow (git-fixes).\n- net: usb: ipheth: fix carrier_work UAF on disconnect (git-fixes).\n- net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition (git-fixes).\n- nfc: digital: clamp SENSF_RES length to the destination buffer (git-fixes).\n- nfc: digital: Do not dump a NULL response in command completion (git-fixes).\n- nfc: fdp: bound the device-reported read length and fix an skb leak (git-fixes).\n- nfc: llcp: avoid userspace overflow on invalid optlen (git-fixes).\n- nfc: llcp: bound SNL TLV parsing to the skb and add length checks (git-fixes).\n- nfc: llcp: bound the connect_sn TLV walk to the skb (git-fixes).\n- nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (git-fixes).\n- nfc: llcp: read llcp_sock-\u003elocal under the socket lock in getsockopt (git-fixes).\n- nfc: llcp: reject PDUs shorter than the LLCP header (git-fixes).\n- nfc: microread: validate target discovery payload lengths (git-fixes).\n- nfc: nci: fix double completion race in nci_data_exchange_complete (git-fixes).\n- nfc: nci: fix out-of-bounds write in nci_target_auto_activated() (git-fixes).\n- nfc: nci: fix uninit-value in the RF discover/activated NTF handlers (git-fixes).\n- nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing (git-fixes).\n- nfc: nci: free destination parameters when closing a connection (git-fixes).\n- nfc: pn533: hold a reference to the request skb during send_frame (git-fixes).\n- nfc: pn533: purge fragmented skbs during cleanup (git-fixes).\n- nfc: st21nfca: validate ATR_REQ length against the received frame (git-fixes).\n- nouveau/gem: reserve the bo in the info ioctl around the vma lookup (git-fixes).\n- nvme-tcp: fix usage of page_frag_cache (bsc#1267882).\n- nvmet-rdma: fix queue leak when connect backlog is exceeded (git-fixes).\n- of: fix out-of-bounds read in of_alias_scan() stem parser (git-fixes).\n- PCI/ASPM: Use pcie_capability_clear_and_set_word() for ASPM disable/restore (git-fixes).\n- PCI/proc: Avoid spurious runtime PM wakeup on config space accesses (git-fixes).\n- PCI/proc: Use file_ns_capable() when checking config space read access (git-fixes).\n- PCI/proc: Warn on writes to kernel-exclusive config space regions (git-fixes).\n- PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses (git-fixes).\n- PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] (git-fixes).\n- PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip (git-fixes).\n- PCI: j721e: Fix incorrect max_lanes for J7200 (git-fixes).\n- PCI: meson: Fix GPIO state while requesting PERST# (git-fixes).\n- PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts() (git-fixes).\n- PCI: plda: Fix use-after-free of event IRQs during teardown (git-fixes).\n- perf: Reject exited events as group leaders (git-fixes).\n- pinctrl: bcm2835: Don't remove an unregistered GPIO chip (git-fixes).\n- pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip (git-fixes).\n- pinctrl: rockchip: Reset the pin count when recalculating SoC data (git-fixes).\n- platform/chrome: cros_ec_debugfs: Clean up console log on probe failure (git-fixes).\n- platform/chrome: cros_ec_debugfs: Unregister panic notifier (git-fixes).\n- platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count (git-fixes).\n- platform/chrome: sensorhub: Bound the EC-reported sensor number (git-fixes).\n- platform/chrome: sensorhub: Fix dropped timestamp events and log spam (git-fixes).\n- platform/chrome: sensorhub: Fix memory overread in ring handler (git-fixes).\n- platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL (git-fixes).\n- platform/surface: acpi-notify: Check ACPI companion before use (git-fixes).\n- platform/x86/amd/hsmp: Reject negative power cap writes in hwmon (git-fixes).\n- platform/x86: asus-wmi: fix resource leaks on probe failure (git-fixes).\n- platform/x86: dell-privacy: Fix race condition (git-fixes).\n- platform/x86: dell-wmi-base: Fix resource leak on module load failure (git-fixes).\n- platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer (git-fixes).\n- platform/x86: dell-wmi-sysman: Fix instance ID bounds (git-fixes).\n- platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS (git-fixes).\n- platform/x86: hp-bioscfg: advance elem past consumed array elements (git-fixes).\n- platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() (git-fixes).\n- platform/x86: hp-bioscfg: fix heap OOB read on empty password write (git-fixes).\n- platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password (git-fixes).\n- platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() (git-fixes).\n- platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed (git-fixes).\n- platform/x86: hp-bioscfg: fix password encoding bounds check (git-fixes).\n- platform/x86: hp-bioscfg: warn on element type mismatch instead of failing (git-fixes).\n- platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path (git-fixes).\n- platform/x86: ISST: Add a NULL check for sst_inst (git-fixes).\n- platform/x86: ISST: Just allow 2 bits for SST feature enable (git-fixes).\n- platform/x86: ISST: Return error during profile addition (git-fixes).\n- platform/x86: ISST: Use PP level enable mask (git-fixes).\n- platform/x86: ISST: Validate level in perf mask ioctls (git-fixes).\n- platform/x86: ISST: Validate logical CPU id and clos id (git-fixes).\n- platform/x86: ISST: Validate parameter for core power state (git-fixes).\n- platform/x86: ISST: Validate parameter for frequency and priority (git-fixes).\n- platform/x86: ISST: Validate socket ID in clos_assoc ioctl (git-fixes).\n- PM: hibernate: Fix memory leak in snapshot_write_next() error path (git-fixes).\n- PM: sleep: Fix off-by-one in wakelocks number limit check (git-fixes).\n- power: supply: bd99954: Drop bad register fields (git-fixes).\n- power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address (git-fixes).\n- power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address (git-fixes).\n- power: supply: bq27xxx: bq27520g4: fix REG_TTES address (git-fixes).\n- power: supply: bq256xx: drain usb_work before freeing the charger (git-fixes).\n- power: supply: bq24257: fix use-after-free on remove (git-fixes).\n- power: supply: bq25890: Fix power_supply reference leak (git-fixes).\n- power: supply: charger-manager: register regulators before exposing sysfs (git-fixes).\n- power: supply: cros_usbpd-charger: bound the EC-reported port count (git-fixes).\n- power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS (git-fixes).\n- power: supply: isp1704_charger: cancel work on remove (git-fixes).\n- power: supply: lp8727: fix use-after-free in lp8727_release_irq() (git-fixes).\n- power: supply: lp8788-charger: fix use-after-free on remove (git-fixes).\n- power: supply: max17040: drop incorrect I2C functionality check (git-fixes).\n- power: supply: max17040: propagate register read errors (git-fixes).\n- power: supply: max17040: synchronize work cancellation on suspend (git-fixes).\n- power: supply: qcom_battmgr: terminate the strings from firmware (git-fixes).\n- power: supply: rt9455: quiesce delayed work before teardown (git-fixes).\n- power: supply: sbs-battery: Use a per-device serial number buffer (git-fixes).\n- power: supply: sc2731_charger: cancel work on remove (git-fixes).\n- power: supply: twl4030_charger: cancel workers via devm (git-fixes).\n- power: supply: ucs1002: fix use-after-free on remove (git-fixes).\n- powercap: intel_rapl_tpmi: Handle PMU registration failure during probe (git-fixes).\n- powerpc/dt_cpu_ftrs: Set CPU_FTR_P11_PVR for Power11 and later processors (bsc#1263864 ltc#217835).\n- powerpc/kexec_file: Use inclusive range checks in add_usable_mem() (git-fixes).\n- powerpc/pseries: Ensure vpa,slb_shadow \u0026 dtl are unregistered during crash (bsc#1271256).\n- powerpc/pseries: lparcfg - fix kbuf[] underflow (bsc#1274753 ltc#221289 bsc#1274754 ltc#221288 bsc#1274752\n  ltc#221290).\n- powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak (bsc#1274751 ltc#221105 bsc#1274750 ltc#221106).\n- powerpc/pseries: pci - logic bug (bsc#1274749 ltc#221282 bsc#1274755 ltc#221284 bsc#1274756 ltc#221283).\n- powerpc/rtas_pci: No hotplug on permanently removed device on pSeries (git-fixes).\n- powerpc: Replace __ASSEMBLY__ with __ASSEMBLER__ in non-uapi headers (bsc#1263864 ltc#217835).\n- powerpc: Replace __ASSEMBLY__ with __ASSEMBLER__ in uapi headers (bsc#1263864 ltc#217835).\n- ppdev: prevent overflow when setting port timeout (git-fixes).\n- rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() (git-fixes).\n- rapidio: clear mport-\u003enet when rio_add_net() fails (git-fixes).\n- rapidio: mport_cdev: fix use-after-free in dma_req_free() (git-fixes).\n- RDMA/bnxt_re: Avoid displaying the kernel pointer (git-fixes).\n- RDMA/bnxt_re: Proper rollback if the ioremap fails (git-fixes).\n- RDMA/irdma: Remove redundant legacy_mode checks (git-fixes).\n- RDMA/mana_ib: drain QP references after partial table insertion (git-fixes).\n- RDMA/mana_ib: unify QP lookup table (git-fixes).\n- RDMA/mlx5: Fix integer overflow of user QP buffer size (git-fixes).\n- regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer (git-fixes).\n- regulator: core: use system_freezable_wq for init complete work (git-fixes).\n- regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata (git-fixes).\n- regulator: qcom-refgen: correct the regulator type to CURRENT (git-fixes).\n- regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling (git-fixes).\n- remoteproc: qcom: Fix glink-\u003enode reference leak in qcom_add_glink_subdev (git-fixes).\n- remoteproc: qcom_q6v5_adsp: Fix reference leak for device node (git-fixes).\n- remoteproc: scp: Fix device reference leak on failed lookup (git-fixes).\n- Revert \"drm/amdgpu: fix aperture mapping leak\" (git-fixes).\n- Revert \"media: v4l2-dev: fix error handling in __video_register_device()\" (git-fixes).\n- Revert \"net: thunderbolt: Enable end-to-end flow control also in transmit\" (git-fixes).\n- Revert \"thermal/drivers/hwmon: Cleanup coding style a bit\" (stable-fixes).\n- Revert \"wifi: mt76: Disable napi when removing device\" (git-fixes).\n- rpmsg: core: Fix incorrect return value documentation (git-fixes).\n- rpmsg: glink: smem: order FIFO read after availability check (git-fixes).\n- rtc: gamecube: check return value of devm_rtc_register_device() (git-fixes).\n- rtc: pcf8563: fix clock provider leak on unbind (git-fixes).\n- rtc: pcf85363: Add error checking to regmap calls in probe() (git-fixes).\n- rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers (git-fixes).\n- rtc: rzn1: Fix weekday underflow when alarm crosses month boundary (git-fixes).\n- rtc: zynqmp: Return optional clock lookup errors (git-fixes).\n- s390/pkey: Check length in pkey_pckmo handler implementation (bsc#1270266).\n- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (bsc#1270267).\n- sched/psi: Create the psimon kthread outside of cgroup_mutex (bsc#1269134).\n- scsi: fnic: Abort timed-out NVMe LS requests (bsc#1236344).\n- scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (bsc#1236344).\n- scsi: fnic: Add FDLS role handling for NVMe initiators (bsc#1236344).\n- scsi: fnic: Add the NVMe/FC transport path (bsc#1236344).\n- scsi: fnic: Advertise NVMe initiator service parameters (bsc#1236344).\n- scsi: fnic: Bump up version number (bsc#1236344).\n- scsi: fnic: Decode firmware role configuration (bsc#1236344).\n- scsi: fnic: Do not use GFP_ZERO for mempools (bsc#1236344).\n- scsi: fnic: Expose NVMe transport state in debugfs (bsc#1236344).\n- scsi: fnic: Handle NVMe LS frames in FDLS (bsc#1236344).\n- scsi: fnic: Make debug logging protocol independent (bsc#1236344).\n- scsi: fnic: Make fnic_queuecommand() easier to analyze (bsc#1236344).\n- scsi: fnic: Refactor in_remove flag and call to fnic_fcpio_reset() (bsc#1236344).\n- scsi: fnic: Remove a useless struct mempool forward declaration (bsc#1236344).\n- scsi: fnic: Rename fnic_scsi_fcpio_reset() (bsc#1236344).\n- scsi: fnic: Route completions and resets by initiator role (bsc#1236344).\n- scsi: fnic: Self-assignment of intr_time_type has no effect (bsc#1236344).\n- scsi: fnic: Send NVMe LS requests through FDLS (bsc#1236344).\n- scsi: fnic: Switch to use %ptSp (bsc#1236344).\n- scsi: fnic: Track NVMe transport statistics (bsc#1236344).\n- scsi: fnic: Use fnic_num for non-SCSI identifiers (bsc#1236344).\n- scsi: fnic: Use mempool for receive frames (bsc#1236344).\n- scsi: qla2xxx: Add support to report MPI FW state (bsc#1275737).\n- scsi: qla2xxx: Declare qla2xxx_mqueuecommand() static (bsc#1275737).\n- scsi: qla2xxx: Use nr_cpu_ids instead of NR_CPUS for qp_cpu_map allocation (bsc#1275737).\n- scsi: storvsc: Support manual scans for all Hyper-V targets (git-fixes).\n- sctp: avoid auth_enable sysctl UAF during netns teardown (git-fixes).\n- selftests/alsa: Fix the step check for INTEGER controls (git-fixes).\n- serial: 8250_dma: Clear stale RX state on shutdown (git-fixes).\n- serial: amba-pl011: unprepare console clock on unregister (git-fixes).\n- serial: core: clear freed pointers on uart_register_driver() failure (git-fixes).\n- serial: imx: serialize imx_uart_ports lifetime (git-fixes).\n- serial: ma35d1: Fix OF node reference leaks in console init (git-fixes).\n- serial: qcom-geni: do not advance stale DMA completions (git-fixes).\n- serial: qcom-geni: fix TX DMA buffer flush (git-fixes).\n- serial: sc16is7xx: enable THRI before filling TX FIFO (git-fixes).\n- serial: sc16is7xx: rename EFR mutex with generic name (stable-fixes).\n- serial: sc16is7xx: use guards for simple mutex locks (stable-fixes).\n- slab.h: disable completely broken overflow handling in flex allocations (bsc#1280139).\n- slab: Introduce kmalloc_flex() and family (bsc#1280139).\n- slab: Introduce kmalloc_obj() and family (bsc#1280139).\n- slab: recognize @GFP parameter as optional in kernel-doc (bsc#1280139).\n- smb/client: handle overlapping allocated ranges in fallocate (bsc#1274902).\n- smb: client: harden POSIX SID length parsing (bsc#1273557).\n- smb: client: require net admin for CIFS SWN netlink (bsc#1273966).\n- smb: client: resolve SWN tcon from live registrations (bsc#1273872).\n- soc: fsl: qe: check platform_driver_register() in qe_ic_of_init() (git-fixes).\n- soc: qcom: rpmh-rsc: manage PM notifiers with devres (git-fixes).\n- soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() (git-fixes).\n- software node: Fix software_node_get_reference_args() with index -1 (git-fixes).\n- soundwire: qcom: Fix port exhaustion check in stream_alloc_ports (git-fixes).\n- speakup: keyhelp: guard letter_offsets possible out-of-range indexing (git-fixes).\n- spi: bcm63xx-hsspi: disable clocks on resume failure (git-fixes).\n- spi: bcm63xx: disable clock on resume failure (git-fixes).\n- spi: bcmbca-hsspi: disable clocks on resume failure (git-fixes).\n- spi: davinci: switch to managed controller allocation (git-fixes).\n- spi: Fix DMA mapping ownership on partial map failure (git-fixes).\n- spi: img-spfi: don't disable runtime PM on DMA deferred probe (git-fixes).\n- spi: oc-tiny: switch to managed controller allocation (git-fixes).\n- spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX (git-fixes).\n- spi: spi-cadence: Move TX FIFO full busy-wait into FIFO (git-fixes).\n- spi: spi-cadence: supports transmission with bits_per_word of 16 and 32 (stable-fixes).\n- spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers (stable-fixes).\n- spi: sprd-adi: Fix probe succeeding without registering the controller (git-fixes).\n- staging: fbtft: Use sysfs_emit_at() to print to sysfs file (git-fixes).\n- staging: media: tegra-video: fix of_node_put() on VIP parse errors (git-fixes).\n- staging: media: tegra-video: vi: fix probe failure on skipped last port (git-fixes).\n- staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown (git-fixes).\n- staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() (git-fixes).\n- staging: rtl8723bs: fix missing shared-key auth challenge length check (git-fixes).\n- staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() (git-fixes).\n- staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() (git-fixes).\n- staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() (git-fixes).\n- staging: rtl8723bs: fix OOB read in WMM_param_handler() (git-fixes).\n- staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() (git-fixes).\n- staging: rtl8723bs: use kfree_sensitive() for key material (git-fixes).\n- staging: rtl8723bs: validate monitor transmit frame lengths (git-fixes).\n- staging: sm750fb: Add missing Kconfig dependency (git-fixes).\n- staging: sm750fb: gate dualview dataflow using g_dualview (git-fixes).\n- thermal/drivers/imx: Disable clock on runtime resume failure (git-fixes).\n- thermal/drivers/qoriq: Disable clock on resume failure (git-fixes).\n- thermal/drivers/rcar: Fix error checking in probe() (git-fixes).\n- thermal: intel: int3400: clean up ODVP on probe failures (git-fixes).\n- thermal: sysfs: switch to use scnprintf() to suppress truncation warning (git-fixes).\n- thunderbolt: Bound the DROM dual link port number before indexing sw-\u003eports (git-fixes).\n- thunderbolt: Fix bandwidth group reservation indexing (git-fixes).\n- thunderbolt: icm: Preserve USB4 proxy data-valid bit (git-fixes).\n- tlclk: if sscanf() fails, fall back to 0, not random value (git-fixes).\n- tpm: st33zp24: Return zero on status read failure (git-fixes).\n- tpm: st33zp24: Validate locality read result (git-fixes).\n- tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout (git-fixes).\n- tty: clear cdev pointer after cdev_add() failure (git-fixes).\n- tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 (git-fixes).\n- tty: skip cdev_del() when no cdev is registered (git-fixes).\n- uio: Fix stale info pointer in failed registration path (git-fixes).\n- usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() (git-fixes).\n- usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect (git-fixes).\n- usb: atm: usbatm: fix invalid ci_range initialization (git-fixes).\n- USB: c67x00: fix use-after-free in c67x00_add_iso_urb() (git-fixes).\n- usb: cdnsp: fix incorrect endian conversions for APB timeout register (git-fixes).\n- usb: core: Add lock to usb_wakeup_notification() (git-fixes).\n- usb: core: Add lock to usb_wakeup_notification() (stable-fixes).\n- usb: core: Strengthen error handling in hub_hub_status() (git-fixes).\n- usb: core: Strengthen error handling in hub_hub_status() (stable-fixes).\n- usb: core: sysfs: add lock to bos_descriptors_read() (stable-fixes).\n- usb: dwc2: add missing @remotewakeup kernel-doc parameter (git-fixes).\n- usb: dwc2: gadget: Exit partial power down state when changing USB pull-up (git-fixes).\n- usb: dwc3: clear forceRM when issuing EndTransfer (git-fixes).\n- usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition (git-fixes).\n- usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns() (git-fixes).\n- usb: fix UAF when probe runs concurrent to dyn ID removal (git-fixes).\n- usb: gadget: aspeed_udc: check endpoint DMA allocation (git-fixes).\n- usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed (git-fixes).\n- usb: gadget: configfs: fix out-of-bounds read of qw_sign (git-fixes).\n- usb: gadget: f_fs: Fix fence cleanup in ffs_dmabuf_transfer() error paths (git-fixes).\n- usb: gadget: f_fs: Prevent deadlock during ep0 read loop (git-fixes).\n- usb: gadget: f_midi: initialize work in f_midi_alloc() (git-fixes).\n- usb: gadget: f_ncm: Use unsigned int for ndp_index (git-fixes).\n- usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() (git-fixes).\n- usb: gadget: f_uac1_legacy: remove broken string configfs attributes (git-fixes).\n- usb: gadget: fix null pointer dereference in usb_put_function_instance() (git-fixes).\n- USB: gadget: fsl-udc: fix dev_printk() device (git-fixes).\n- usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs (git-fixes).\n- usb: gadget: midi2: remove default configfs groups on teardown (git-fixes).\n- usb: gadget: pch_udc: remove excess kernel-doc member for registered (git-fixes).\n- usb: gadget: r8a66597: avoid double free of ep0_req in probe error path (git-fixes).\n- usb: gadget: snps_udc_plat: clean up PHY on probe deferral (git-fixes).\n- usb: gadget: u_audio: Fix use-after-free on sound card disconnect (git-fixes).\n- usb: gadget: uac: validate rate list length before storing (git-fixes).\n- USB: gadget: Use str_enable_disable-like helpers (stable-fixes).\n- usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() (git-fixes).\n- usb: ljca: bound bank_num in ljca_enumerate_gpio() (git-fixes).\n- usb: mtu3: allow system suspend during active gadget connection (git-fixes).\n- usb: musb: omap2430: clean up probe error handling (stable-fixes).\n- usb: musb: omap2430: Do not put borrowed of_node in probe (git-fixes).\n- usb: musb: omap2430: Fix use-after-free in omap2430_probe() (git-fixes).\n- USB: phy: fsl-usb: fix missing static keywords (git-fixes).\n- usb: renesas_usbhs: Fix power-off ordering on unbind (git-fixes).\n- USB: serial: digi_acceleport: fix port registration order (git-fixes).\n- USB: serial: ftdi_sio: add support for E+H FXA291 (stable-fixes).\n- USB: serial: option: add TDTECH MT5710-CN (stable-fixes).\n- USB: serial: option: fix slab OOB read in interrupt URB callback (git-fixes).\n- USB: serial: spcp8x5: drop broken carrier detect support (git-fixes).\n- USB: storage: add NO_ATA_1X quirk for Longmai USB Key (stable-fixes).\n- usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop (git-fixes).\n- usb: typec: qcom-pmic-typec: drain cc_debounce_dwork if port_start() fails (git-fixes).\n- usb: typec: qcom-pmic: cancel reset_work on stop (git-fixes).\n- usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive() (git-fixes).\n- usb: typec: thunderbolt: Disable work before freeing tbt on remove (git-fixes).\n- usb: typec: ucsi: displayport: Fix OOB altmode array index (git-fixes).\n- usb: typec: ucsi: unregister debugfs entries on teardown (git-fixes).\n- usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion (git-fixes).\n- usb: usbfs: fix use-after-free of usb_device in usbdev_release() (git-fixes).\n- usb: usbtest: disable dynamic ID support (stable-fixes).\n- usb: xhci: Handle USB3 port events when there is one roothub (git-fixes).\n- vfs: Add a sysctl for automated deletion of dentry (bsc#1240890 bsc#1276586).\n- vt: add permission check for KDSKBMETA ioctl (stable-fixes).\n- vt: stabilize tty reference in kbd_keycode with tty_port_tty_get (stable-fixes).\n- w1: ds28e17: reject an oversize length on an I2C block read (git-fixes).\n- w1: ds2482: Fix signedness bug in ds2482_w1_triplet() (git-fixes).\n- watchdog: bd96801_wdt: Fix timeout for enabled WDG (git-fixes).\n- watchdog: fix hrtimer start when pretimeout is zero (git-fixes).\n- watchdog: msc313e: Avoid division by zero (git-fixes).\n- watchdog: msc313e: Enable clock before accessing hardware registers (git-fixes).\n- watchdog: msc313e: Fix clock leak and spurious timer in settimeout() (git-fixes).\n- watchdog: msc313e: Fix NULL pointer dereference in PM callbacks (git-fixes).\n- watchdog: msc313e: Fix spurious reset on suspend (git-fixes).\n- watchdog: msc313e: Fix undefined behavior (git-fixes).\n- watchdog: msc313e: Sync timeout value if WDT was running at boot (git-fixes).\n- watchdog: sunxi_wdt: preserve boot-enabled watchdog (git-fixes).\n- wifi: ath6kl: avoid buffer overreads in WMI event handlers (git-fixes).\n- wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets (git-fixes).\n- wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump (git-fixes).\n- wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() (git-fixes).\n- wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate (git-fixes).\n- wifi: ath11k: Correctly copy the hint BSSID in WMI scan request (git-fixes).\n- wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event() (git-fixes).\n- wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx() (git-fixes).\n- wifi: ath12k: Correctly copy the hint BSSID in WMI scan request (git-fixes).\n- wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() (git-fixes).\n- wifi: brcmfmac: fix P2P action frame handling without device vif (git-fixes).\n- wifi: brcmfmac: initialize SDIO data work before cleanup (git-fixes).\n- wifi: cfg80211: bound element ID read when checking non-inheritance (git-fixes).\n- wifi: cfg80211: cancel sched scan results work on unregister (git-fixes).\n- wifi: cfg80211: derive S1G beacon TSF from S1G fields (git-fixes).\n- wifi: cfg80211: reject unsupported PMSR FTM location requests (git-fixes).\n- wifi: cfg80211: validate PMSR FTM preamble range (git-fixes).\n- wifi: cfg80211: validate PMSR measurement type data (git-fixes).\n- wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() (git-fixes).\n- wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs (git-fixes).\n- wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments (git-fixes).\n- wifi: iwlwifi: mei: check SAP message length before reading it (git-fixes).\n- wifi: iwlwifi: mei: pass correct argument to function (git-fixes).\n- wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser (git-fixes).\n- wifi: libertas: fix memory leak in helper_firmware_cb() (git-fixes).\n- wifi: mac80211: disconnect on CSA to channel 0 (git-fixes).\n- wifi: mac80211: fix fils_discovery double free on alloc failure (git-fixes).\n- wifi: mac80211: fix per-STA profile length in cross-link CSA parsing (git-fixes).\n- wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure (git-fixes).\n- wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock (git-fixes).\n- wifi: mac80211: send TWT teardown to peer after setup TX failure (git-fixes).\n- wifi: mac80211: skip default WMM setup for AP_VLAN links (git-fixes).\n- wifi: mac80211: skip unused probe response countdown offsets (git-fixes).\n- wifi: mt76: check txfree done event on the WED hw path (git-fixes).\n- wifi: mt76: fix 4th chain ACK RSSI bitmask in sta_poll (git-fixes).\n- wifi: mt76: fix ER-SU 106-tone RU check in RX rate decode (git-fixes).\n- wifi: mt76: fix HE DCM max-RU capability encoding (git-fixes).\n- wifi: mt76: fix non-AQL packet accounting for MLO stations (git-fixes).\n- wifi: mt76: fix stranded frames in mt76_txq_schedule_pending (git-fixes).\n- wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length (git-fixes).\n- wifi: mt76: mt792x: Fix memory leak in SDIO TX path (git-fixes).\n- wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete (git-fixes).\n- wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex (git-fixes).\n- wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss (git-fixes).\n- wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear (git-fixes).\n- wifi: mt76: mt7915: fix double hif2 init on the non-WED path (git-fixes).\n- wifi: mt76: mt7915: fix ext PHY use-after-free on register error path (git-fixes).\n- wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986 (git-fixes).\n- wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie (git-fixes).\n- wifi: mt76: mt7915: release hif2 reference on probe IRQ failure (git-fixes).\n- wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement (git-fixes).\n- wifi: mt76: mt7915: unwind state on add_interface failure (git-fixes).\n- wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields (git-fixes).\n- wifi: mt76: mt7915: write RX header translation bit to the correct register (git-fixes).\n- wifi: mt76: mt7921: skip unknown CLC firmware records (git-fixes).\n- wifi: mt76: mt7921: validate CLC firmware records (git-fixes).\n- wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb (git-fixes).\n- wifi: mt76: mt7925: fix msg len mismatch between driver and firmware (git-fixes).\n- wifi: mt76: mt7925: update clc before setting sar power table (git-fixes).\n- wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config (git-fixes).\n- wifi: mt76: mt7996: don't report a zero TX bitrate (git-fixes).\n- wifi: mt76: mt7996: fix capability of EHT-MCS 15 in MRU (git-fixes).\n- wifi: mt76: mt7996: fix reg addr remap when addr is 0 (git-fixes).\n- wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV (git-fixes).\n- wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset (git-fixes).\n- wifi: mt76: mt7996: validate RX band_idx before dereferencing phys (git-fixes).\n- wifi: mt76: only consume the WO drop bit on WED v2 devices (git-fixes).\n- wifi: mt76: report data NSS for STBC frames in RX rate decode (git-fixes).\n- wifi: mwifiex: Detach sync cmd buffer on interrupted wait (git-fixes).\n- wifi: nl80211: free RNR data on MBSSID mismatch (git-fixes).\n- wifi: nl80211: validate nested MBSSID IE blobs (git-fixes).\n- wifi: p54: validate RX frame length in p54_rx_eeprom_readback() (git-fixes).\n- wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop (git-fixes).\n- wifi: rtl818x: initialize eeprom_93cx6 struct to zero (git-fixes).\n- wifi: rtlwifi: pci: fix error path in rtl_pci_probe() (git-fixes).\n- wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids (git-fixes).\n- wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars() (git-fixes).\n- wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() (git-fixes).\n- wifi: rtw88: pci: fix resource leak on failed NAPI setup (git-fixes).\n- wifi: rtw89: fix HE extended capability length check (git-fixes).\n- wifi: zd1211rw: reject secondary interfaces to prevent conflicts (git-fixes).\n- x86/virt/tdx: Print TDX module version during init (git-fixes).\n- x86/virt/tdx: Retrieve TDX module version (git-fixes).\n- xhci: dbgtty: Fix unregister on tty_alloc_driver() failure (git-fixes).\n- xhci: dbgtty: Fix unregister on tty_register_driver() failure (git-fixes).\n- xhci: fix lost bounce buffers on TDs spanning several ring segments (git-fixes).\n","status":"published","published":"2026-09-22T14:23:31Z","modified":"2026-09-30T18:23:12.126873614Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:4120-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1235944).\n- CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).\n- CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).\n- CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).\n- CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).\n- CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).\n- CVE-2026-31658: net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() (bsc#1263052).\n- CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).\n- CVE-2026-43014: net: macb: properly unregister fixed rate clocks (bsc#1264012).\n- CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010).\n- CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).\n- CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).\n- CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).\n- CVE-2026-43213: wifi: rtw89: pci: validate sequence number of TX release report (bsc#1264643).\n- CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).\n- CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).\n- CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).\n- CVE-2026-43386: staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie (bsc#1264740).\n- CVE-2026-43416: powerpc, perf: Check that current-\u003emm is alive before getting user callchain (bsc#1265121).\n- CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).\n- CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).\n- CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).\n- CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).\n- CVE-2026-46078: erofs: fix the out-of-bounds nameoff handling for trailing dirents (bsc#1267505).\n- CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).\n- CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).\n- CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).\n- CVE-2026-46127: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() (bsc#1267236).\n- CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).\n- CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).\n- CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).\n- CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).\n- CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).\n- CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).\n- CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).\n- CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).\n- CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).\n- CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).\n- CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).\n- CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).\n- CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).\n- CVE-2026-53034: bpf, sockmap: Fix af_unix null-ptr-deref in proto update (bsc#1269140).\n- CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).\n- CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).\n- CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).\n- CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).\n- CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).\n- CVE-2026-53094: bpf: Fix stale offload-\u003eprog pointer after constant blinding (bsc#1269965).\n- CVE-2026-53096: bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path (bsc#1269969).\n- CVE-2026-53110: selftests/bpf: Add ASSERT_OK_FD macro (bsc#1269985).\n- CVE-2026-53111: bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap (bsc#1269167).\n- CVE-2026-53126: blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() (bsc#1269635).\n- CVE-2026-53142: drm/xe/display: fix oops in suspend/shutdown without display (bsc#1269402).\n- CVE-2026-53154: mm/hugetlb: restore reservation on error in hugetlb folio copy paths (bsc#1269665).\n- CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (bsc#1269306).\n- CVE-2026-53180: timers/migration: Fix livelock in tmigr_handle_remote_up() (bsc#1269888).\n- CVE-2026-53207: mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison (bsc#1269590).\n- CVE-2026-53219: netfilter: x_tables: avoid leaking percpu counter pointers (bsc#1269686).\n- CVE-2026-53220: netfilter: revalidate bridge ports (bsc#1269381).\n- CVE-2026-53223: net: guard timestamp cmsgs to real error queue skbs (bsc#1269301).\n- CVE-2026-53228: ipv6: sit: reload inner IPv6 header after GSO offloads (bsc#1269256).\n- CVE-2026-53238: netlabel: validate unlabeled address and mask attribute lengths (bsc#1269774).\n- CVE-2026-53260: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req() (bsc#1269731).\n- CVE-2026-53263: 6lowpan: fix off-by-one in multicast context address compression (bsc#1269647).\n- CVE-2026-53264: net/sched: act_api: use RCU with deferred freeing for action lifecycle (bsc#1269238).\n- CVE-2026-53269: netfilter: synproxy: add mutex to guard hook reference counting (bsc#1269579).\n- CVE-2026-53273: tee: optee: prevent use-after-free when the client exits before the supplicant (bsc#1269713).\n- CVE-2026-53309: ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison (bsc#1269815).\n- CVE-2026-53330: drm/amd/display: Fix out-of-bounds read in (bsc#1270090).\n- CVE-2026-53336: nvmem: layouts: onie-tlv: fix hang on unknown types (bsc#1270108).\n- CVE-2026-53337: net: bonding: fix NULL pointer dereference in bond_do_ioctl() (bsc#1270251).\n- CVE-2026-53353: hsr: Remove WARN_ONCE() in hsr_addr_is_self() (bsc#1270111).\n- CVE-2026-53365: vsock/virtio: fix zerocopy completion for multi-skb sends (bsc#1271365).\n- CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830).\n- CVE-2026-63801: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (bsc#1272230).\n- CVE-2026-63808: exfat: fix potential use-after-free in exfat_find_dir_entry() (bsc#1272260).\n- CVE-2026-63810: block: Avoid mounting the bdev pseudo-filesystem in userspace (bsc#1272297).\n- CVE-2026-63823: keys: Pin request_key_auth payload in instantiate paths (bsc#1272182).\n- CVE-2026-63827: apparmor: fix use-after-free in rawdata dedup loop (bsc#1272179).\n- CVE-2026-63828: apparmor: mediate the implicit connect of TCP fast open sendmsg (bsc#1272175).\n- CVE-2026-63860: RDMA/core: Prefer NLA_NUL_STRING (bsc#1272429).\n- CVE-2026-63865: bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks (bsc#1272486).\n- CVE-2026-63868: net: garp: fix unsigned integer underflow in garp_pdu_parse_attr (bsc#1272497).\n- CVE-2026-63879: drm/amdgpu: fix amdgpu_hmm_range_get_pages (bsc#1272569).\n- CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).\n- CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272385).\n- CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272390).\n- CVE-2026-63889: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (bsc#1272423).\n- CVE-2026-63891: thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() (bsc#1272641).\n- CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1272877).\n- CVE-2026-63923: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (bsc#1273005).\n- CVE-2026-63925: macsec: fix replay protection at XPN lower-PN wrap (bsc#1273008).\n- CVE-2026-63926: bpf: sockmap: fix tail fragment offset in bpf_msg_push_data (bsc#1273019).\n- CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1272662).\n- CVE-2026-63969: ipv6: fix possible infinite loop in rt6_fill_node() (bsc#1272484).\n- CVE-2026-63970: vsock/virtio: bind uarg before filling zerocopy skb (bsc#1272673).\n- CVE-2026-63980: net/handshake: Use spin_lock_bh for hn_lock (bsc#1273028).\n- CVE-2026-63985: ethtool: eeprom: add more safeties to EEPROM Netlink fallback (bsc#1272963).\n- CVE-2026-63990: bonding: refuse to enslave CAN devices (bsc#1273027).\n- CVE-2026-63992: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (bsc#1272868).\n- CVE-2026-63995: ethtool: cmis: validate start_cmd_payload_size from module (bsc#1273033).\n- CVE-2026-63996: ethtool: cmis: require exact CDB reply length (bsc#1273032).\n- CVE-2026-63997: ethtool: module: avoid leaking a netdev ref on module flash errors (bsc#1273036).\n- CVE-2026-63998: ethtool: module: call ethnl_ops_complete() on module flash errors (bsc#1273037).\n- CVE-2026-63999: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure (bsc#1273038).\n- CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273030).\n- CVE-2026-64001: ALSA: pcm: oss: Fix setup list UAF on proc write error (bsc#1273734).\n- CVE-2026-64002: ipv4: free net-\u003eipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (bsc#1273774).\n- CVE-2026-64004: net/iucv: fix locking in .getsockopt (bsc#1273804).\n- CVE-2026-64005: net/smc: Do not re-initialize smc hashtables (bsc#1273831).\n- CVE-2026-64006: netfilter: nf_tables: fix dst corruption in same register operation (bsc#1273834).\n- CVE-2026-64007: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (bsc#1273105).\n- CVE-2026-64010: nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (bsc#1273882).\n- CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1273891).\n- CVE-2026-64015: security/keys: fix missed RCU read section on lookup (bsc#1273762).\n- CVE-2026-64029: ALSA: seq: Serialize UMP output teardown with event_input (bsc#1273766).\n- CVE-2026-64033: RDMA/rtrs: Fix use-after-free in path file creation cleanup (bsc#1273134).\n- CVE-2026-64047: net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (bsc#1273060).\n- CVE-2026-64048: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (bsc#1273484).\n- CVE-2026-64052: block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user() (bsc#1272983).\n- CVE-2026-64055: net: ethernet: cortina: Drop half-assembled SKB (bsc#1272893).\n- CVE-2026-64056: net: ethernet: cortina: Make RX SKB per-port (bsc#1272502 bsc#1272893).\n- CVE-2026-64073: irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT (bsc#1273490).\n- CVE-2026-64098: drm/virtio: use uninterruptible resv lock for plane updates (bsc#1273488).\n- CVE-2026-64099: drm/v3d: Fix use-after-free of CPU job query arrays on error path (bsc#1273465).\n- CVE-2026-64102: RDMA/siw: Reject MPA FPDU length underflow before signed receive math (bsc#1272516).\n- CVE-2026-64109: af_unix: Peek the queue synchronized (bsc#1273748).\n- CVE-2026-64112: rbd: eliminate a race in lock_dwork draining on unmap (bsc#1273741).\n- CVE-2026-64113: ixgbevf: fix use-after-free in VEPA multicast source pruning (bsc#1272262).\n- CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl \u003c 5 (bsc#1273742).\n- CVE-2026-64115: vsock/vmci: fix UAF when peer resets connection during handshake (bsc#1273745).\n- CVE-2026-64118: qed: fix double free in qed_cxt_tables_alloc() (bsc#1273749).\n- CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273743).\n- CVE-2026-64125: net: bcmgenet: keep RBUF EEE/PM disabled (bsc#1272346).\n- CVE-2026-64131: mm/memory: fix spurious warning when unmapping device-private/exclusive pages (bsc#1274063).\n- CVE-2026-64136: smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (bsc#1272351).\n- CVE-2026-64146: erofs: fix metabuf leak in inode xattr initialization (bsc#1273681).\n- CVE-2026-64148: pds_core: check health in devcmd wait (bsc#1273956).\n- CVE-2026-64164: btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() (bsc#1273957).\n- CVE-2026-64180: mm/memory_hotplug: fix memory block reference leak on remove (bsc#1273679).\n- CVE-2026-64185: sysfs: don't remove existing directory on update failure (bsc#1272200).\n- CVE-2026-64188: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() (bsc#1272150).\n- CVE-2026-64190: net: team: fix NULL pointer dereference in team_xmit during mode change (bsc#1272210).\n- CVE-2026-64192: bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized (bsc#1272213).\n- CVE-2026-64214: powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise()\n  (bsc#1272799).\n- CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272798).\n- CVE-2026-64222: octeontx2-pf: avoid double free of pool-\u003estack on AQ init failure (bsc#1272788).\n- CVE-2026-64224: octeontx2-pf: fix double free in rvu_rep_rsrc_init() (bsc#1272804).\n- CVE-2026-64225: octeontx2-af: CGX: add bounds check to cgx_speed_mbps index (bsc#1272786).\n- CVE-2026-64244: drivers/base/memory: set mem-\u003ealtmap after successful device registration (bsc#1273812).\n- CVE-2026-64245: fbdev: modedb: fix a possible UAF in fb_find_mode() (bsc#1273905).\n- CVE-2026-64268: RDMA/siw: bound Read Response placement to the RREAD length (bsc#1273276).\n- CVE-2026-64269: RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg (bsc#1273280).\n- CVE-2026-64286: KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU (bsc#1274058).\n- CVE-2026-64287: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (bsc#1273325).\n- CVE-2026-64294: mm: do file ownership checks with the proper mount idmap (bsc#1273525).\n- CVE-2026-64296: exfat: bound uniname advance in exfat_find_dir_entry() (bsc#1273975).\n- CVE-2026-64304: crypto: qat - validate RSA CRT component lengths (bsc#1273944).\n- CVE-2026-64312: crypto: pcrypt - restore callback for non-parallel fallback (bsc#1273968).\n- CVE-2026-64315: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1274028).\n- CVE-2026-64316: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1273598).\n- CVE-2026-64317: isofs: bound Rock Ridge symlink components to the SL record (bsc#1273936).\n- CVE-2026-64322: udf: validate sparing table length as an entry count, not a byte count (bsc#1273958).\n- CVE-2026-64323: udf: validate VAT header length against the VAT inode size (bsc#1273305).\n- CVE-2026-64355: bpf: Reject fragmented frames in devmap (bsc#1273422).\n- CVE-2026-64375: proc: protect ptrace_may_access() with exec_update_lock (FD links) (bsc#1273868).\n- CVE-2026-64378: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (bsc#1273603).\n- CVE-2026-64381: smb: client: Fix next buffer leak in receive_encrypted_standard() (bsc#1273860).\n- CVE-2026-64382: smb: client: fix double-free in SMB2_open() replay (bsc#1273291).\n- CVE-2026-64383: smb: client: fix double-free in SMB2_flush() replay (bsc#1273426).\n- CVE-2026-64384: smb: client: fix change notify replay double-free (bsc#1274541).\n- CVE-2026-64385: smb: client: fix double-free in SMB2_ioctl() replay (bsc#1274539).\n- CVE-2026-64386: smb: client: fix query_info() replay double-free (bsc#1274543).\n- CVE-2026-64387: smb: client: fix query directory replay double-free (bsc#1274545).\n- CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).\n- CVE-2026-64411: netfilter: ebtables: terminate table name before find_table_lock() (bsc#1274077).\n- CVE-2026-64412: netfilter: ebtables: module names must be null-terminated (bsc#1273780).\n- CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction (bsc#1274274).\n- CVE-2026-64434: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref (bsc#1273880).\n- CVE-2026-64436: net: af_key: initialize alg_key_len for IPComp states (bsc#1274277).\n- CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).\n- CVE-2026-64450: tipc: fix out-of-bounds read in broadcast Gap ACK blocks (bsc#1273523).\n- CVE-2026-64452: 6lowpan: fix NHC entry use-after-free on error path (bsc#1273460).\n- CVE-2026-64463: usb: typec: tcpci_rt1711h: unregister TCPCI port with devres (bsc#1273273).\n- CVE-2026-64472: vfio/mlx5: Fix racy bitfields and tighten struct layout (bsc#1274075).\n- CVE-2026-64477: x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled (bsc#1274264).\n- CVE-2026-64481: ALSA: hda/cs35l41: Fix firmware load work teardown (bsc#1274547).\n- CVE-2026-64515: wifi: mac80211: fix MLE defragmentation (bsc#1273859).\n- CVE-2026-64537: bridge: cfm: reject invalid CCM interval at configuration time (bsc#1273289).\n- CVE-2026-64538: ipv6: Fix null-ptr-deref in fib6_nh_mtu_change() (bsc#1273335).\n- CVE-2026-64541: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (bsc#1273303).\n- CVE-2026-64543: tipc: fix use-after-free of the discoverer in tipc_disc_rcv() (bsc#1273311).\n- CVE-2026-64545: net, bpf: check master for NULL in xdp_master_redirect() (bsc#1273318).\n- CVE-2026-64548: bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() (bsc#1273337).\n- CVE-2026-64551: sctp: validate STALE_COOKIE cause length before reading staleness (bsc#1273813).\n- CVE-2026-64552: virtio-net: fix len check in receive_big() (bsc#1273323).\n- CVE-2026-64553: net: psample: fix info leak in PSAMPLE_ATTR_DATA (bsc#1273336).\n- CVE-2026-64554: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() (bsc#1273340).\n- CVE-2026-64562: KVM: nVMX: Hide shadow VMCS right after VMCLEAR (bsc#1273930).\n- CVE-2026-64563: rhashtable: clear stale iter-\u003ep on table restart (bsc#1273995).\n- CVE-2026-64567: btrfs: reject free space cache with more entries than pages (bsc#1274006).\n- CVE-2026-64569: mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n (bsc#1274009).\n- CVE-2026-64572: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (bsc#1274014).\n- CVE-2026-64576: nexthop: initialize extack in nh_res_bucket_migrate() (bsc#1274030).\n- CVE-2026-64577: gtp: check skb_pull_data() return in gtp1u_send_echo_resp() (bsc#1274031).\n- CVE-2026-64581: xfrm: fix sk_dst_cache double-free in xfrm_user_policy() (bsc#1274041).\n- CVE-2026-64582: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (bsc#1274040).\n- CVE-2026-64593: btrfs: do not trim a device which is not writeable (bsc#1274497).\n- CVE-2026-64597: smb: client: fix double-free in SMB2_close() replay (bsc#1274297).\n- CVE-2026-64598: smb/client: Fix error code in smb2_aead_req_alloc() (bsc#1274298).\n- CVE-2026-68081: KVM: nVMX: Add helper to put (unmap) vmcs12 pages (bsc#1274580).\n- CVE-2026-68082: libceph: fix two unsafe bare decodes in decode_lockers() (bsc#1274581).\n- CVE-2026-68086: mm/khugepaged: write all dirty file folios when collapsing (bsc#1274713).\n- CVE-2026-68105: drm/amdgpu: Fix kernel panic during driver load failure (bsc#1274849).\n- CVE-2026-68116: vxlan: mdb: Fix source list corruption on a failed replace (bsc#1274876).\n- CVE-2026-68117: tipc: clear sock-\u003esk on the failed-insert path in tipc_sk_create() (bsc#1274881).\n- CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1274888).\n- CVE-2026-68123: openvswitch: fix GSO userspace truncation underflow (bsc#1275169).\n- CVE-2026-68124: mctp: serial: handle zero-length frames to prevent rx buffer overflow (bsc#1275192).\n- CVE-2026-68127: ila: reload IPv6 header after pskb_may_pull in checksum adjust (bsc#1275237).\n- CVE-2026-68129: gve: fix Rx queue stall on alloc failure (bsc#1275517).\n- CVE-2026-68132: super: fix emergency thaw deadlock on frozen block devices (bsc#1275553).\n- CVE-2026-68135: net: hip04: fix RX buffer leak on build_skb failure (bsc#1275557).\n- CVE-2026-68136: net: gro: fix double aggregation of flush-marked skbs (bsc#1275474).\n- CVE-2026-68138: net/sched: serialize qdisc_rtab_list against concurrent get/put (bsc#1274941).\n- CVE-2026-68139: net/mlx5e: Use sender devcom for MPV master-up (bsc#1275578).\n- CVE-2026-68142: geneve: require CAP_NET_ADMIN in the device netns for changelink (bsc#1275582).\n- CVE-2026-68143: net: slip: serialize receive against buffer reallocation (bsc#1275583).\n- CVE-2026-68145: iomap: fix out-of-bounds bitmap_set() with zero-length range (bsc#1275584).\n- CVE-2026-68149: fs: preserve ACL_DONT_CACHE state in forget_cached_acl() (bsc#1275294).\n- CVE-2026-68152: amt: fix use-after-free in AMT delayed works (bsc#1275300).\n- CVE-2026-68153: libceph: remove debugfs files before client teardown (bsc#1275301).\n- CVE-2026-68154: libceph: reject zero bucket types in crush_decode (bsc#1275303).\n- CVE-2026-68155: libceph: Reject monmaps advertising zero monitors (bsc#1275304).\n- CVE-2026-68156: libceph: refresh auth-\u003eauthorizer_buf{,_len} after authorizer update (bsc#1275305).\n- CVE-2026-68157: libceph: guard missing CRUSH type name lookup (bsc#1275306).\n- CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1275307).\n- CVE-2026-68159: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (bsc#1275470).\n- CVE-2026-68160: ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() (bsc#1275472).\n- CVE-2026-68161: sctp: close UDP tunnel sockets during netns teardown (bsc#1274892).\n- CVE-2026-68166: userfaultfd: prevent registration of special VMAs (bsc#1274930).\n- CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275161).\n- CVE-2026-68205: media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() (bsc#1274934).\n- CVE-2026-68238: drm/amdgpu: Release VFCT ACPI table reference (bsc#1275704).\n- CVE-2026-68247: drm/i915/bios: range check LFP Data Block panel_type2 (bsc#1275817).\n- CVE-2026-68254: drm/i915/vrr: require valid min/max vfreq for VRR (bsc#1275150).\n- CVE-2026-68267: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (bsc#1275139).\n- CVE-2026-68284: bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() (bsc#1275970).\n- CVE-2026-68286: drop_monitor: perform u64_stats updates under IRQ-disabled section (bsc#1275973).\n- CVE-2026-68288: net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD (bsc#1275975).\n- CVE-2026-68289: tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() (bsc#1275976).\n- CVE-2026-68293: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (bsc#1275091).\n- CVE-2026-68297: tipc: fix u16 MTU truncation in media and bearer MTU validation (bsc#1275040).\n- CVE-2026-68299: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (bsc#1275088).\n- CVE-2026-68300: sctp: auth: verify auth requirement when auth_chunk is NULL (bsc#1275083).\n- CVE-2026-68302: amt: re-read skb header pointers after every pull (bsc#1275081).\n- CVE-2026-68312: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (bsc#1274663).\n- CVE-2026-68313: tipc: fix infinite loop in __tipc_nl_compat_dumpit (bsc#1274665).\n- CVE-2026-68315: sctp: validate stream count in sctp_process_strreset_inreq() (bsc#1274662).\n- CVE-2026-68320: sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid (bsc#1274659).\n- CVE-2026-68322: rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled (bsc#1274656).\n- CVE-2026-68324: iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() (bsc#1274649).\n- CVE-2026-68325: iommu/amd: Bound the early ACPI HID map (bsc#1274651).\n- CVE-2026-68328: nfp: Check resource mutex allocation (bsc#1274646).\n- CVE-2026-68329: iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() (bsc#1274645).\n- CVE-2026-68331: dpaa2-eth: put MAC endpoint device on disconnect (bsc#1274642).\n- CVE-2026-68333: dpaa2-switch: put MAC endpoint device on disconnect (bsc#1274644).\n- CVE-2026-68335: rds: drop incoming messages that cross network namespace boundaries (bsc#1274640).\n- CVE-2026-68336: bonding: fix devconf_all NULL dereference when IPv6 is disabled (bsc#1274639).\n- CVE-2026-68343: smb: client: validate DFS referral PathConsumed (bsc#1274629).\n- CVE-2026-68375: bnxt_en: Handle partially initialized auxiliary devices (bsc#1274835).\n- CVE-2026-68377: net/sched: act_tunnel_key: Defer dst_release to RCU callback (bsc#1274831).\n- CVE-2026-68386: bpf, sockmap: Reject unhashed UDP sockets on sockmap update (bsc#1274814).\n- CVE-2026-68397: net/iucv: take a reference on the socket found in afiucv_hs_rcv() (bsc#1274898).\n- CVE-2026-68398: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF (bsc#1274908).\n- CVE-2026-68408: wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (bsc#1274709).\n- CVE-2026-68417: RDMA/siw: publish QP after initialization (bsc#1274696).\n- CVE-2026-68418: RDMA/irdma: Prevent user-triggered null deref on QP create (bsc#1274690).\n- CVE-2026-68419: RDMA/irdma: Prevent rereg_mr for non-mem regions (bsc#1274698).\n- CVE-2026-68422: btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() (bsc#1274706).\n- CVE-2026-68425: IB/mad: Drop unmatched RMPP responses before reassembly (bsc#1274700).\n- CVE-2026-68426: xfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment (bsc#1274705).\n- CVE-2026-68432: vxlan: require CAP_NET_ADMIN in the device netns for changelink (bsc#1274800).\n- CVE-2026-68433: libceph: bound get_version reply decode to front len (bsc#1274801).\n- CVE-2026-68450: btrfs: free mapping node on duplicate reloc root insert (bsc#1274834).\n- CVE-2026-68470: wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (bsc#1276500).\n- CVE-2026-68480: x86/bugs: Make Safe-RET robust against interrupt injection (bsc#1274208).\n- CVE-2026-72020: ipvs: reset full ip_vs_seq structs in ip_vs_conn_new (bsc#1275506).\n- CVE-2026-72032: net/mlx5: HWS, fix matcher leak on resize target setup failure (bsc#1276955).\n- CVE-2026-72035: net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1276961).\n- CVE-2026-72036: net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1277034).\n- CVE-2026-72046: gve: fix header buffer corruption with header-split and HW-GRO (bsc#1275519).\n- CVE-2026-72069: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (bsc#1275528).\n- CVE-2026-72072: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (bsc#1277155).\n- CVE-2026-72083: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (bsc#1275535).\n- CVE-2026-72084: scsi: target: Bound PR-OUT TransportID parsing to the received buffer (bsc#1275540).\n- CVE-2026-72123: can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (bsc#1277523).\n- CVE-2026-72132: NFS: Charge unstable writes by request size, not folio size (bsc#1277551).\n- CVE-2026-72221: sunrpc: wait for in-flight TLS handshake callback when cancel loses race (bsc#1275665).\n- CVE-2026-72222: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (bsc#1275669).\n- CVE-2026-72251: netfilter: nf_nat_sip: reload possible stale data pointer (bsc#1275827).\n- CVE-2026-72254: netfilter: nft_fib: reject fib expression on the netdev egress hook (bsc#1277204).\n- CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (bsc#1277678).\n- CVE-2026-72288: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (bsc#1275886).\n- CVE-2026-72289: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (bsc#1275905).\n- CVE-2026-72296: net: ife: require ETH_HLEN to be pullable in ife_decode() (bsc#1275923).\n- CVE-2026-72307: mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() (bsc#1277160).\n- CVE-2026-72308: mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() (bsc#1277159).\n- CVE-2026-72317: SUNRPC: pin upper rpc_clnt across the TLS connect_worker (bsc#1275925).\n- CVE-2026-72341: net/mlx5e: Fix publication race for priv-\u003echannel_stats[] (bsc#1277660).\n- CVE-2026-72342: net/mlx5e: Fix HV VHCA stats agent registration race (bsc#1277775).\n- CVE-2026-72343: net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation (bsc#1277776).\n- CVE-2026-72389: bridge: stp: Fix a potential use-after-free when deleting a bridge (bsc#1273869).\n- CVE-2026-72463: xfrm: Fix dev use-after-free in xfrm async resumption (bsc#1268276 bsc#1277064).\n- CVE-2026-72464: xprtrdma: Remove temp allocation of rpcrdma_rep objects (bsc#1277069).\n- CVE-2026-72466: xprtrdma: Fix bcall rep leak and unbounded peek (bsc#1277057).\n- CVE-2026-72467: xprtrdma: Check frwr_wp_create() during connect (bsc#1277059).\n- CVE-2026-72469: xprtrdma: Fix ep kref imbalance on ADDR_CHANGE (bsc#1277047).\n- CVE-2026-72473: xprtrdma: Avoid 250 ms delay on backlog wakeup (bsc#1277037).\n- CVE-2026-72494: RDMA/irdma: Replace waitqueue and flag with completion (bsc#1276941).\n- CVE-2026-72495: RDMA/bnxt_re: Avoid repeated requests to allocate WC pages (bsc#1276937).\n- CVE-2026-72496: RDMA/bnxt_re: Proper rollback if the ioremap fails (bsc#1276943).\n- CVE-2026-72497: RDMA/bnxt_re: Add a max slot check for SQ (bsc#1276913).\n- CVE-2026-72498: RDMA/bnxt_re: Avoid displaying the kernel pointer (bsc#1276912).\n- CVE-2026-72499: RDMA/bnxt_re: Free CQ toggle page after firmware teardown (bsc#1276551).\n- CVE-2026-72500: RDMA/bnxt_re: Free SRQ toggle page after firmware teardown (bsc#1276552).\n- CVE-2026-72501: RDMA/bnxt_re: Initialize dpi variable to zero (bsc#1276546).\n- CVE-2026-72502: tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) (bsc#1276542).\n- CVE-2026-74269: bnxt: fix head underflow on XDP head-grow (bsc#1276507).\n- CVE-2026-74296: RDMA/mlx5: Release the HW-provided UAR index rather than the SW one (bsc#1276452).\n- CVE-2026-74297: RDMA/mlx5: Fix undefined shift of user RQ WQE size (bsc#1276446).\n- CVE-2026-74318: btrfs: fix deadlock cloning inline extent when using flushoncommit (bsc#1276864).\n- CVE-2026-74321: btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() (bsc#1277202).\n- CVE-2026-74334: RDMA/nldev: Fix locking when accessing mr-\u003epd (bsc#1277095).\n- CVE-2026-74345: RDMA/siw: Fix endpoint/socket association handling (bsc#1277285).\n- CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277408).\n- CVE-2026-74395: RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference (bsc#1277077).\n- CVE-2026-74454: drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO (bsc#1277073).\n- CVE-2026-74474: vxlan: use pskb_network_may_pull() for transmit path header pulls (bsc#1276335).\n- CVE-2026-74481: mm/page_reporting: use system_freezable_wq to fix UAF during suspend (bsc#1276355).\n- CVE-2026-74482: mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios (bsc#1276346).\n- CVE-2026-74488: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (bsc#1276350).\n- CVE-2026-74495: igbvf: Fix leak in TX DMA error cleanup (bsc#1275864).\n- CVE-2026-74496: fou: Fix use-after-free in fou_create() (bsc#1275867).\n- CVE-2026-74509: Bluetooth: hci_sync: Fix advertising data UAFs (bsc#1275946).\n- CVE-2026-74510: Bluetooth: mgmt: fix UAF in pair command cancellation (bsc#1275950).\n- CVE-2026-74512: audit: fix potential use-after-free in audit_del_rule() (bsc#1275954).\n- CVE-2026-74516: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (bsc#1275797).\n- CVE-2026-74518: mm/hugetlb: fix list corruption in allocate_file_region_entries() (bsc#1275798).\n- CVE-2026-74527: octeontx2-af: Block VFs from clobbering special CGX PKIND state (bsc#1275805).\n- CVE-2026-74537: Bluetooth: ISO: hold sk properly in iso_conn_ready (bsc#1275687).\n- CVE-2026-74548: forcedeth: fix UAF of txrx_stats in nv_remove (bsc#1275695).\n- CVE-2026-74550: net: do not send ICMP/NDISC Redirects when peer allocation fails (bsc#1275688).\n- CVE-2026-74556: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (bsc#1275696).\n- CVE-2026-74563: rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() (bsc#1275574).\n- CVE-2026-74566: keys: make keyring key-chunk byte order agree with keyring_diff_objects() (bsc#1275566).\n- CVE-2026-74567: keys: fix out-of-bounds read in keyring_get_key_chunk() (bsc#1275569).\n- CVE-2026-74571: btrfs: skip global block reserve accounting for rescue mounts (bsc#1275561).\n- CVE-2026-74577: net: mpls: initialize rtm_tos in mpls_getroute() (bsc#1275572).\n- CVE-2026-74581: net: ipv6: clear suppressed fib6 rule result (bsc#1275782).\n- CVE-2026-74582: packet: use consistent hard_header_len in non-ring send paths (bsc#1275784).\n- CVE-2026-74584: RDMA/bnxt_re: zero shared page before exposing to userspace (bsc#1277066).\n- CVE-2026-74610: tls: don't leave a full plaintext sk_msg ring unpushed (bsc#1277054).\n- CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277391).\n- CVE-2026-74692: net/smc: fix TOCTOU race between smc_listen_out() and listener close (bsc#1276927).\n- CVE-2026-74694: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length (bsc#1277625).\n- CVE-2026-74695: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() (bsc#1276931).\n- CVE-2026-74712: vdpa/mlx5: Fix buffer length in create_direct_keys() (bsc#1276577).\n- CVE-2026-74717: net/mlx5: fw_tracer, return NULL on create error (bsc#1276569).\n- CVE-2026-74722: btrfs: fix memory leak in btrfs_do_encoded_write() (bsc#1276561).\n- CVE-2026-80529: xfs: don't swallow dquot recovery verification errors (bsc#1277688).\n- CVE-2026-80534: xfs: fix ilock leak on error in xfs_dq_get_next_id (bsc#1277022).\n- CVE-2026-80590: inet: frags: strip GSO state from fragments before reassembly (bsc#1277275).\n- CVE-2026-80654: soc: xilinx: Shutdown and free rx mailbox channel (bsc#1277516).\n\nThe following non security issues were fixed:\n\n- accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() (git-fixes).\n- accessibility: speakup: unregister tty ldisc on later init failures (git-fixes).\n- ACPI: APEI: Fix ERST timeout unit conversion (git-fixes).\n- ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer (git-fixes).\n- ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root (git-fixes).\n- ACPI: pfr_update: fix stack buffer overflow in query_capability() (git-fixes).\n- ACPI: processor: idle: Expand _LPI package sanity checks (git-fixes).\n- ACPI: processor: validate MADT IOAPIC entry bounds (git-fixes).\n- ACPI: scan: fix bus ID cleanup on device_add() failures (git-fixes).\n- ACPI: video: Release PCI device reference after lookup (git-fixes).\n- add my missing Reviewed-by: tag.\n- ALSA: 6fire: bound the MIDI event length from the device (git-fixes).\n- ALSA: 6fire: Fix UAF at error handling during probe (stable-fixes).\n- ALSA: bcd2000: clear the URB pointers on disconnect (git-fixes).\n- ALSA: control: Don't add invalid kcontrols to LED layer (git-fixes).\n- ALSA: core: Fix use-after-free in snd_card_do_free() (git-fixes).\n- ALSA: dummy: Check card index validity at probe (stable-fixes).\n- ALSA: hda/ext: preserve PPLCCTL bits when clearing reset (git-fixes).\n- ALSA: hda: Fix connection list comparison in proc output (git-fixes).\n- ALSA: hpi: Check transport errors during HPI6000 adapter initialization (git-fixes).\n- ALSA: pcxhr: initialize mutexes before requesting threaded IRQ (git-fixes).\n- ALSA: scarlett2: Use a private URB for the notification endpoint (git-fixes).\n- ALSA: seq: Don't leak the extension cell pointer in the bounce payload (git-fixes).\n- ALSA: seq: midi: Optimize event_input locking with RCU (git-fixes).\n- ALSA: seq: midi: Serialize input teardown with event_input (git-fixes).\n- ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion (git-fixes).\n- ALSA: usb-audio: Complete cleanup after system-resume errors (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() (git-fixes).\n- ALSA: usb-audio: fix OOB write on Type II inbound URBs (git-fixes).\n- ALSA: usb: Fix UAF at delayed release of MIDI2 EPs (git-fixes).\n- ALSA: usx2y: bound the hwdep mmap fault offset (git-fixes).\n- ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() (git-fixes).\n- apparmor: advertise the tcp fast open fix is applied (git-fixes).\n- arm64: Exclude nohz_full CPUs from 32bits el0 support (bsc#1269313).\n- ASoC: adau1761: sort the register default table (git-fixes).\n- ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC (git-fixes).\n- ASoC: apple: mca: increase SERDES reset delay (git-fixes).\n- ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses (git-fixes).\n- ASoC: cs35l33: drain threaded IRQ before runtime suspend (git-fixes).\n- ASoC: cs35l34: drain threaded IRQ before runtime suspend (git-fixes).\n- ASoC: cs35l41: sort the register default table (git-fixes).\n- ASoC: cs35l45: sort the register default table (git-fixes).\n- ASoC: cs4265: sort the register default table (git-fixes).\n- ASoC: cx2072x: sort the register default table (git-fixes).\n- ASoC: dapm: Fix off-by-one check on the second enum channel (git-fixes).\n- ASoC: fix unmet dependencies on PPC_BESTCOMM and SND_SOC_AC97_BUS (git-fixes).\n- ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready (git-fixes).\n- ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure (git-fixes).\n- ASoC: fsl_audmix: rework runtime PM handling in probe (git-fixes).\n- ASoC: fsl_easrc: sort the register default table (git-fixes).\n- ASoC: hdac_hda: Fix hlink refcount leak on component registration failure (git-fixes).\n- AsoC: intel: sst: fix PCI device reference leak on probe failure (git-fixes).\n- ASoC: max9860: sort the register default table (git-fixes).\n- ASoC: meson: Keep link pointers valid on realloc failure (git-fixes).\n- ASoC: ml26124: sort the register default table (git-fixes).\n- ASoC: pcm512x: sort the register default table (git-fixes).\n- ASoC: pxa: Use devm_clk_get_optional() for extclk clock (git-fixes).\n- ASoC: qcom: q6apm: keep the graph start count in sync with the DSP (git-fixes).\n- ASoC: rt274: sort the register default table (git-fixes).\n- ASoC: rt286: sort the register default table (git-fixes).\n- ASoC: rt298: sort the register default table (git-fixes).\n- ASoC: rt700-sdw: always drain jack work on remove (git-fixes).\n- ASoC: rt700: drop duplicate reg_default entry (git-fixes).\n- ASoC: rt700: sort the register default table (git-fixes).\n- ASoC: rt711-sdca: sort the register default tables (git-fixes).\n- ASoC: rt711: sort the register default table (git-fixes).\n- ASoC: rt712-sdca-dmic: sort the register default table (git-fixes).\n- ASoC: rt712-sdca-sdw: sort the register default table (git-fixes).\n- ASoC: rt715-sdca: drop duplicate reg_default entries (git-fixes).\n- ASoC: rt715-sdca: sort the register default tables (git-fixes).\n- ASoC: rt715: sort the register default table (git-fixes).\n- ASoC: rt1017-sdca-sdw: sort the register default table (git-fixes).\n- ASoC: rt1316-sdw: sort the register default table (git-fixes).\n- ASoC: rt1318-sdw: sort the register default table (git-fixes).\n- ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get (git-fixes).\n- ASoC: sgtl5000: sort the register default table (git-fixes).\n- ASoC: SOF: pcm: Move period/buffer configuration print after platform open (stable-fixes).\n- ASoC: sof: pcm: use snd_pcm_direction_name() (stable-fixes).\n- ASoC: SOF: Relocate and rework functionality for PCM stream freeing (stable-fixes).\n- ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() (git-fixes).\n- ASoC: SOF: validate topology volume range before allocation (git-fixes).\n- ASoC: sti-sas: sort the register default table (git-fixes).\n- ASoC: tas2552: sort the register default table (git-fixes).\n- ASoC: tas2764: sort the register default table (git-fixes).\n- ASoC: tas2780: sort the register default table (git-fixes).\n- ASoC: tegra210_i2s: sort the register default table (git-fixes).\n- ASoC: tegra210_mixer: sort the register default table (git-fixes).\n- ASoC: tegra: Fix the MIXER enable default value (git-fixes).\n- ASoC: tegra: Sort MBDRC register defaults (git-fixes).\n- ASoC: xilinx: formatter_pcm: fix stream_data leak on open error (git-fixes).\n- ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers (git-fixes).\n- batman-adv: bla: fix freeing of claims on meshif deletion (git-fixes).\n- batman-adv: bla: prevent CRC corruptions after claim flush (git-fixes).\n- batman-adv: dat: avoid unaligned fault in IP extraction (git-fixes).\n- batman-adv: fix stale receive device on merged fragments (git-fixes).\n- Bluetooth: btintel: Fix diagnostics event detection (git-fixes).\n- Bluetooth: btmtk: Do not discard the subsystem reset timeout (git-fixes).\n- Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read() (stable-fixes).\n- Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path (git-fixes).\n- Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX (git-fixes).\n- Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event (git-fixes).\n- Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() (git-fixes).\n- Bluetooth: do not leak an hci_conn when a second LE connect is rejected (git-fixes).\n- Bluetooth: eir: Fix OOB read in eir_get_service_data() (git-fixes).\n- Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378 (git-fixes).\n- Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_conn: fix the SCO setup context lifetime (git-fixes).\n- Bluetooth: hci_conn: hold conn reference in abort_conn_sync() (git-fixes).\n- Bluetooth: hci_conn: re-enable advertising only for peripheral role (git-fixes).\n- Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb (git-fixes).\n- Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection (git-fixes).\n- Bluetooth: hci_event: fix LE list UAF on reset (git-fixes).\n- Bluetooth: hci_event: validate LE Set CIG Parameters response (git-fixes).\n- Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request (git-fixes).\n- Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths (git-fixes).\n- Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists (stable-fixes).\n- Bluetooth: hci_uart: Fix false success return in hci_uart_setup() (git-fixes).\n- Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready (git-fixes).\n- Bluetooth: MGMT: free the mesh send cancel command when it is cancelled (git-fixes).\n- Bluetooth: MSFT: validate evt_prefix_len against the response length (git-fixes).\n- Bluetooth: RFCOMM: serialize security confirmation handling (git-fixes).\n- Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept (git-fixes).\n- Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (git-fixes).\n- Bluetooth: virtio_bt: avoid OOB read of build info string (git-fixes).\n- bnxt_en: Adjust TX rings if reservation is less than requested (jsc#PED-16798).\n- bnxt_en: Delay for 5 seconds after AER DPC for all chips (jsc#PED-16798).\n- bnxt_en: Don't assume XDP is never enabled in bnxt_init_dflt_ring_mode() (jsc#PED-16798).\n- bnxt_en: Drop pci_save_state() after pci_restore_state() (jsc#PED-16798).\n- bnxt_en: Implement XDP RSS hash metadata extraction (jsc#PED-16798).\n- bnxt_en: Implement XDP RSS hash metadata extraction for V3_CMP (jsc#PED-16798).\n- bnxt_en: Move bnxt_rss_ext_op into header (jsc#PED-16798).\n- bnxt_en: Refactor some basic ring setup and adjustment logic (jsc#PED-16798).\n- bnxt_en: Restore default stat ctxs for ULP when resource is available (jsc#PED-16798).\n- bnxt_en: Set bp-\u003emax_tpa according to what the FW supports (jsc#PED-16798).\n- bnxt_en: Use absolute target ns from ptp_clock_request (jsc#PED-16798).\n- bnxt_en: use bnxt_xdp_buff for xdp context (jsc#PED-16798).\n- bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation (git-fixes).\n- bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET (git-fixes).\n- bus: ti-sysc: Fix /chosen node reference leak (git-fixes).\n- cacheinfo: don't propagate DT/ACPI error when arch supplies info (arm64) (git-fixes).\n- can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking (stable-fixes).\n- cpufreq: intel_pstate: Use correct scaling factor on Raptor Lake-E (bsc#1240957 bsc#1249104 bsc#1265220).\n- cpufreq: intel_pstate: Use CPPC to get scaling factors (bsc#1240957 bsc#1249104 bsc#1265220).\n- cpufreq: intel_pstate: Use HYBRID_SCALING_FACTOR_ADL for Bartlett Lake (bsc#1240957 bsc#1249104 bsc#1265220).\n- crypto: aspeed - Propagate platform_get_irq() errors (git-fixes).\n- crypto: atmel-sha204a - fix heap info leak on I2C transfer failure (git-fixes).\n- crypto: atmel-tdes - use scatterlist length before DMA mapping (git-fixes).\n- crypto: ccm - Set rfc4309 maxauthsize from child (git-fixes).\n- crypto: ccp - Fix memory leak in SEV INIT_EX path (git-fixes).\n- crypto: ccp - Fix possible deadlock in SEV init failure path (git-fixes).\n- crypto: doc - Remove extra parenthesis (git-fixes).\n- crypto: hisilicon/sec2 - fix CCM algorithm long packet failure (git-fixes).\n- crypto: keembay - Initialize completion before requesting IRQ (git-fixes).\n- crypto: keembay - publish OF module alias for OCS AES/SM4 (git-fixes).\n- crypto: mxs-dcp - fix source scatterlist length access (git-fixes).\n- crypto: qat - cancel work on re-enable SR-IOV timeout (git-fixes).\n- crypto: qat - clear AES key schedule from stack (git-fixes).\n- crypto: qce - fix CCM AAD buffer underallocation (git-fixes).\n- crypto: qce - fix error path in devm_qce_register_algs (git-fixes).\n- crypto: rk3288 - fail ahash requests on HASH idle timeout (git-fixes).\n- crypto: sa2ul - stop probe if context pool creation fails (git-fixes).\n- crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping (git-fixes).\n- device property: fix infinite loop in fwnode_for_each_child_node() (git-fixes).\n- dmaengine: dw-edma: Clear stale requests on termination (git-fixes).\n- dmaengine: dw-edma: Complete descriptors before pausing (git-fixes).\n- dmaengine: dw-edma: Initialize IRQ data before requesting IRQs (git-fixes).\n- dmaengine: dw-edma: Serialize abort state updates (git-fixes).\n- dmaengine: dw-edma: Serialize channel state checks (git-fixes).\n- dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe (git-fixes).\n- dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure (git-fixes).\n- dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal (git-fixes).\n- dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers (git-fixes).\n- dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout (git-fixes).\n- driver core: soc: Unregister bus on early device registration failure (git-fixes).\n- drm/amd/display: Add AV mute wait frames to dce110_set_avmute (stable-fixes).\n- drm/amd/display: avoid divide-by-zero in __is_lut_linear() (git-fixes).\n- drm/amd/display: Check for tg ops in dce110_set_avmute (git-fixes).\n- drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix (git-fixes).\n- drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE (git-fixes).\n- drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank() (git-fixes).\n- drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames (stable-fixes).\n- drm/amd/display: Remove unused-but-set variable hubp from (git-fixes).\n- drm/amd/display: validate plane degamma LUT size for private color prop (git-fixes).\n- drm/amd/pm: adjust the visibility of pp_table sysfs node (stable-fixes).\n- drm/amd/pm: Use same metric table for APU (stable-fixes).\n- drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read (git-fixes).\n- drm/amdgpu/gfx6: Fixup emit_cntxcntl() (git-fixes).\n- drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets (git-fixes).\n- drm/amdgpu/gfx6: Use PFP on the compute queues too (git-fixes).\n- drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup (git-fixes).\n- drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup (git-fixes).\n- drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (git-fixes).\n- drm/amdgpu: cap GTT size to physical RAM on APUs (stable-fixes).\n- drm/amdgpu: check ASPM on the dGPU host link (git-fixes).\n- drm/amdgpu: disallow multiple FENCE chunks in one submit (git-fixes).\n- drm/amdgpu: fix aperture iounmap skipped on device removal (git-fixes).\n- drm/amdgpu: fix autosuspend cleanup during removal (git-fixes).\n- drm/amdgpu: fix nbif 6.3.1 l1 low power not functional (git-fixes).\n- drm/amdgpu: Fix UVD decode image min size calculation (stable-fixes).\n- drm/amdgpu: Fix UVD dpb min size calculation for H264 (stable-fixes).\n- drm/amdgpu: Fix UVD min buffer sizes (stable-fixes).\n- drm/amdgpu: Fix VCE 3 ring align_mask (git-fixes).\n- drm/amdgpu: Implement insert_end for VCE 3 (git-fixes).\n- drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini (git-fixes).\n- drm/amdgpu: read TRUNCATE_COORD_MODE on gfx12 (git-fixes).\n- drm/amdgpu: reject oversized IBs with per-ring packet limits (stable-fixes).\n- drm/amdgpu: Reject UVD message with dimensions above 4096 (stable-fixes).\n- drm/amdgpu: Reject UVD message with invalid number of h265 refs (stable-fixes).\n- drm/amdgpu: remove unused function parameter (stable-fixes).\n- drm/amdgpu: restore UMD profile pstate after runtime resume (stable-fixes).\n- drm/amdgpu: validate GEM_CREATE domain combinations (stable-fixes).\n- drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE (stable-fixes).\n- drm/amdkfd: fix QID bit leak in pqm_create_queue() (stable-fixes).\n- drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore (git-fixes).\n- drm/amdkfd: Handle invalid event type in CRIU event restore (stable-fixes).\n- drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure (git-fixes).\n- drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure (git-fixes).\n- drm/bridge: ps8640: propagate AUX transfer register errors (git-fixes).\n- drm/bridge: tc358767: clamp the reported AUX read size to the request (git-fixes).\n- drm/connector/hdmi: Fix out of bounds memory read (git-fixes).\n- drm/connector: Fix epoch_counter docs to reflect reality (git-fixes).\n- drm/hibmc: Fix list of formats on the primary plane (git-fixes).\n- drm/hibmc: Use drm_atomic_helper_check_plane_state() (git-fixes).\n- drm/i915/fbc: Extract intel_fbc_has_fences() (stable-fixes).\n- drm/i915/hdcp: check streams bounds before overflow (git-fixes).\n- drm/i915/hdcp: Move to using intel_display in intel_hdcp (stable-fixes).\n- drm/i915/hdcp: require monotonically increasing seq_num_v (git-fixes).\n- drm/i915/hdcp: Skip inactive MST connectors when building stream list (stable-fixes).\n- drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() (stable-fixes).\n- drm/i915/vrr: require valid min/max vfreq for VRR (git-fixes).\n- drm/lima: call drm_mm_init() with a valid allocation range (git-fixes).\n- drm/msm/a6xx: Fix RBBM_CLOCK_CNTL3_TP0 value in a730_hwcg (git-fixes).\n- drm/msm/a6xx: Fix stale rpmh votes after suspend (git-fixes).\n- drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0) (git-fixes).\n- drm/msm/dsi: Drop dev_pm_opp_set_rate(0) (git-fixes).\n- drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value (git-fixes).\n- drm/panel-edp: fix i2c adapter leak on probe failure (git-fixes).\n- drm/panel: samsung-s6d16d0: Power off on prepare failure (git-fixes).\n- drm/panthor: fix firmware control interface bounds checks (git-fixes).\n- drm/panthor: return PTR_ERR() from devm_drm_dev_alloc() (git-fixes).\n- drm/panthor: skip zero-sized firmware sections (git-fixes).\n- drm/radeon: fix autosuspend cleanup during teardown (git-fixes).\n- drm/radeon: restore hardware polling in fence_is_signaled to fix performance regression (git-fixes).\n- drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format (git-fixes).\n- drm/ssd130x: fix column and row end address in partial updates for ssd132x (git-fixes).\n- drm/ssd130x: fix column and row end address in partial updates in ssd133x (git-fixes).\n- drm/sun4i: crtc: Propagate layer initialization error (git-fixes).\n- drm/sun4i: Drop node references while building component list (git-fixes).\n- drm/sun4i: dw-hdmi: Drop TCON TOP port reference (git-fixes).\n- drm/sun4i: fix refcount leak in sun4i_backend_init_sat() (git-fixes).\n- drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz (git-fixes).\n- drm/sun4i: hdmi: Don't leak sync polarity bits into packet control (git-fixes).\n- drm/sun4i: tcon: Drop remote endpoint reference (git-fixes).\n- drm/sun4i: tcon: Drop TCON TOP device reference (git-fixes).\n- drm/sun4i: tcon: Set output mux for DSI and LVDS (git-fixes).\n- drm/sun4i: vi scaler: Fix coefficient selection (git-fixes).\n- drm/tegra: dsi: Re-add clear enable register if DSI was powered by bootloader (git-fixes).\n- drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info (git-fixes).\n- drm/tve200: add OF module alias for autoloading (git-fixes).\n- drm/xe/oa: Check managed mutex initialization errors (git-fixes).\n- drm/xe/oa: Fix sync entry leak on OA config emit failure (git-fixes).\n- drm/xe: Introduce xe_gt_dbg_printer() (stable-fixes).\n- drm/xe: Order ring writes before ring tail updates (git-fixes).\n- drm/xe: Stub out new pagefault layer (stable-fixes).\n- drm/xe: tests: fix error message in xe_migrate_sanity_test() (git-fixes).\n- drm: fix race between partial drm_dev_register() failure and ioctl (git-fixes).\n- drm: lcdif: Wait for vblank before disabling DMA (git-fixes).\n- drm: Remove unused header in drm_dumb_buffers.c (git-fixes).\n- ethtool: rss: fix hkey leak when indir_size is 0 (git-fixes).\n- fbdev: bitblit: bound-check glyph index in bit_cursor() (git-fixes).\n- fbdev: core: Fix pointer desynchronization in fb_io_read() (git-fixes).\n- fbdev: kyro: Validate overlay viewport coordinates (git-fixes).\n- fbdev: omapfb: panel-dsi-cm: initialize lock before registering display (git-fixes).\n- fbdev: ssd1307fb: defer I2C transfers from damage callbacks (git-fixes).\n- fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device() (git-fixes).\n- fbdev: uvesafb: unregister connector callback on init failure (git-fixes).\n- firmware: arm_scmi: Avoid IDR updates while cleaning channels (git-fixes).\n- firmware: arm_scmi: Drop handle on protocol bind failures (git-fixes).\n- firmware: arm_scmi: Fix requested device removal race (git-fixes).\n- firmware: arm_scmi: Free transport channel on IDR failure (git-fixes).\n- firmware: arm_scmi: Protect device request lookup with RCU (git-fixes).\n- firmware: arm_scmi: Reject out of range DT protocol IDs (git-fixes).\n- firmware: arm_scmi: Unregister device notifier before IDR teardown (git-fixes).\n- firmware: arm_scmi: Use channel ID for transport teardown (git-fixes).\n- firmware_loader: do not queue completed sysfs fallback requests (git-fixes).\n- fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write (git-fixes).\n- fpga: dfl: fme: add error handling (git-fixes).\n- fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration (git-fixes).\n- gpu: host1x: Avoid stack over-read in debug output helpers (git-fixes).\n- gpu: host1x: Fix offset calculation in trace_write_gather (git-fixes).\n- HID: core: fix number/pointer type confusion on long items (git-fixes).\n- HID: core: fix OOB read of field-\u003eusage in hid_set_field() (git-fixes).\n- HID: hyperv: validate initial device info bounds (git-fixes).\n- HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure (git-fixes).\n- HID: lg4ff: validate report length before fixed offsets (git-fixes).\n- HID: logitech-dj: Fix maxfield check in DJ short report validation (git-fixes).\n- HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report (git-fixes).\n- HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write (stable-fixes).\n- HID: logitech-dj: Standardise hid_report_enum variable nomenclature (stable-fixes).\n- HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID (stable-fixes).\n- HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() (git-fixes).\n- HID: mcp2221: validate report size in mcp2221_raw_event() (git-fixes).\n- HID: nintendo: Fix imu_timestamp_us double increment per report (git-fixes).\n- HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() (git-fixes).\n- HID: picolcd: clamp eeprom debugfs read to bytes actually received (git-fixes).\n- HID: roccat: bound device-supplied profile index (git-fixes).\n- HID: roccat: free buffered reports when destroying device (git-fixes).\n- HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature (git-fixes).\n- HID: sensor: custom: Fix field sysfs group cleanup on failure (git-fixes).\n- HID: sensor: custom: Fix use-after-free in enable_sensor (git-fixes).\n- HID: tmff: Use 64-bit arithmetic for force feedback scaling (git-fixes).\n- hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination (git-fixes).\n- hwmon: (lm25066) Use i2c_get_match_data() (stable-fixes).\n- hwmon: (max6621) fix negative temperature offset and crit readings (git-fixes).\n- hwmon: (max6621) fix temperature clamp range (git-fixes).\n- hwmon: (nzxt-smart2) Check return value of init_device() in probe (git-fixes).\n- hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations (git-fixes).\n- hwrng: ks-sa - Fix runtime PM cleanup on registration failure (git-fixes).\n- hwrng: omap - Fix probe error path cleanup (git-fixes).\n- hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() (git-fixes).\n- i2c: bcm-iproc: remove printout on handled timeouts (stable-fixes).\n- i2c: core: fix debugfs UAF on adapter removal (git-fixes).\n- i2c: iproc: reset bus after timeout if START_BUSY is stuck (git-fixes).\n- i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure (git-fixes).\n- i2c: mux: Fix channel node leak on adapter add failure (git-fixes).\n- i2c: ocores: Disable clock on failed resume (git-fixes).\n- i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices (git-fixes).\n- i3c: master: Fix device_register() error path (git-fixes).\n- i3c: master: Fix info leak and UAF in device unregister path (git-fixes).\n- i3c: master: Fix potential UAF in i3c_device_uevent() (git-fixes).\n- i3c: master: svc: bound IBI payload to the requested max_payload_len (git-fixes).\n- ibmvnic: Only record tx completed bytes once per handler (bsc#1274620).\n- iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE (git-fixes).\n- iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable (git-fixes).\n- iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF (git-fixes).\n- iio: chemical: sgp30: Handle IAQ thread creation failure (git-fixes).\n- iio: dac: m62332: Fix regulator reference count imbalance (git-fixes).\n- iio: gyro: mpu3050: fix sign of raw angular velocity readings (git-fixes).\n- iio: light: cm32181: return zero after writing calibscale (git-fixes).\n- iio: light: gp2ap002: Disable regulators on resume failure (git-fixes).\n- iio: light: gp2ap002: re-enable irq if runtime suspend fails (git-fixes).\n- iio: light: isl29028: return zero in write_raw() on success (git-fixes).\n- iio: light: tsl2583: return zero in write_raw() on success (git-fixes).\n- iio: light: tsl2772: fix ALS calibscale readback (git-fixes).\n- iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure (git-fixes).\n- iio: pressure: dps310: fix NULL pointer dereference on ACPI probe (git-fixes).\n- iio: pressure: mpl115: Fix runtime PM cleanup (git-fixes).\n- iio: srf04: fix pm_runtime handling on probe error path (git-fixes).\n- iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() (git-fixes).\n- Input: atkbd - skip deactivate for HONOR ZQC-P (git-fixes).\n- Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard (stable-fixes).\n- Input: evdev - fix information leak in evdev_pass_values() (stable-fixes).\n- Input: evdev - sanitize event type index when fetching event masks (stable-fixes).\n- Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet (git-fixes).\n- Input: focaltech - use signed coordinates to prevent underflow (git-fixes).\n- Input: hynitron_cstxxx - validate touch count and finger IDs (git-fixes).\n- Input: iforce - validate input packet lengths (stable-fixes).\n- Input: iqs5xx - validate firmware record destination span (git-fixes).\n- Input: mms114 - fix Y-resolution configuration (git-fixes).\n- Input: psxpad-spi - set driver data before use (git-fixes).\n- Input: sur40 - fix input device registration ordering (stable-fixes).\n- Input: sur40 - fix V4L error path cleanup (stable-fixes).\n- Input: synaptics-rmi4 - block s_input when F54 queue is busy (git-fixes).\n- Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer (git-fixes).\n- Input: synaptics-rmi4 - fix F55 transmitter electrode count typo (git-fixes).\n- Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue (git-fixes).\n- Input: synaptics-rmi4 - zero report size on F54 work error (git-fixes).\n- Input: xpad - add support for ZENAIM LEVERLESS (stable-fixes).\n- interconnect: Fix use after free in icc_get() and of_icc_get_by_index() (git-fixes).\n- ipmi: ipmb: validate write message length (git-fixes).\n- ipmi: si: Fix NULL pointer dereference after failed registration (git-fixes).\n- kthread: Default affine kthread to its preferred NUMA node (bsc#1269313).\n- kthread: Make sure kthread hasn't started while binding it (bsc#1269313).\n- KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes).\n- KVM: PPC: Book3S HV: Add support for compat CPU capabilities for KVM on PowerNV (bsc#1263864 ltc#217835).\n- KVM: PPC: Book3S HV: Implement compat CPU capability retrieval for KVM on PowerVM (bsc#1263864 ltc#217835).\n- KVM: PPC: Book3S HV: Validate arch_compat against host compatibility mode (bsc#1263864 ltc#217835).\n- KVM: PPC: Document KVM_PPC_GET_COMPAT_CAPS ioctl (bsc#1263864 ltc#217835).\n- KVM: PPC: Introduce KVM_CAP_PPC_COMPAT_CAPS and wire up ioctl (bsc#1263864 ltc#217835).\n- KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page (git-fixes).\n- leds: pca9532: Fix inverted GPIO output polarity (git-fixes).\n- leds: pca9532: Fix phantom device registration on missing hardware (git-fixes).\n- lib/string: fix memchr_inv() for large ranges (git-fixes).\n- lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() (git-fixes).\n- mailbox: qcom-ipcc: fix duplicate channel allocation across holes (git-fixes).\n- mailbox: rockchip: disable pclk on probe failure and unbind (git-fixes).\n- maple_tree: fix argument name in header (git-fixes).\n- md/raid1: create serial pool adding rdev to array with serialize_policy=1 (bsc#1272261).\n- media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref (git-fixes).\n- media: amphion: Remove obsolete frame_count check in venc_start_session (git-fixes).\n- media: cec-pin: Fix event FIFO ordering (git-fixes).\n- media: cec: disable delayed work before freeing an interrupted transmit (git-fixes).\n- media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash (git-fixes).\n- media: cec: Serialize exclusive follower delivery (git-fixes).\n- media: cec: stm32: prevent out-of-bounds write on RX overflow (git-fixes).\n- media: cedrus: fix memory leak in cedrus_init_ctrls() (git-fixes).\n- media: cobalt: Avoid freeing ALSA private data twice (git-fixes).\n- media: cx231xx: reject geometry changes while the VBI queue is busy (git-fixes).\n- media: cx23885: cancel NetUP CI work before teardown (git-fixes).\n- media: em28xx: defer audio-only extension registration (git-fixes).\n- media: em28xx: fix use-after-free of dev_next-\u003edevlist on disconnect (git-fixes).\n- media: go7007: defer the ALSA v4l2 put until card release (git-fixes).\n- media: i2c: imx219: Rename VTS to FRM_LENGTH (stable-fixes).\n- media: i2c: ov02a10: fix endpoint parsing use-after-free (git-fixes).\n- media: i2c: ov7740: fix use-after-destroy in remove (git-fixes).\n- media: i2c: rdacm21: Fix missing media_entity_cleanup() (git-fixes).\n- media: imx219: Fix maximum frame length in lines (git-fixes).\n- media: intel/ipu6: fix async notifier cleanup leak on parse error (git-fixes).\n- media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define (git-fixes).\n- media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define (git-fixes).\n- media: mc-entity: Add missing kerneldoc (git-fixes).\n- media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common (git-fixes).\n- media: nxp: imx8-isi: Correct color map between V4L2 and ISI (git-fixes).\n- media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing (git-fixes).\n- media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks (git-fixes).\n- media: rc: sunxi-cir: Unregister rc device on probe failure (git-fixes).\n- media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure (git-fixes).\n- media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak (git-fixes).\n- media: s2255: bound JPEG frame size before copying into the buffer (git-fixes).\n- media: s2255: check firmware size before reading trailing marker (git-fixes).\n- media: saa7164: fix cleanup on resource allocation failure (git-fixes).\n- media: tda18250: fix possible integer overflow (git-fixes).\n- media: usbtv: keep device alive while ALSA card exists (git-fixes).\n- media: v4l2-async: avoid deleting unlinked ASC entry on link error (git-fixes).\n- media: v4l2-async: Unregister sub-device if asc_list is empty (git-fixes).\n- media: v4l2-ctrls: Allow unknown HDR10 white point and luminance (git-fixes).\n- media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link (git-fixes).\n- media: venus: fix payload size calculation in parse_raw_formats() (git-fixes).\n- media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() (git-fixes).\n- media: vicodec: fix out-of-bounds write in FWHT encoder (git-fixes).\n- media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure (git-fixes).\n- media: vimc: fix pixel format lookup in enum_framesizes (git-fixes).\n- media: zoran: Avoid freeing a registered video_device twice (git-fixes).\n- mei: pull kvfree out of spinlock (git-fixes).\n- mfd: iqs62x: Reject zero-length firmware records (git-fixes).\n- mfd: rave-sp: validate received frame payload lengths (git-fixes).\n- misc: bcm-vk: Use acquire/release for msgq_inited (git-fixes).\n- misc: fastrpc: fix channel ctx ref leak when session alloc fails (git-fixes).\n- misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free (git-fixes).\n- misc: fastrpc: Remove buffer from list prior to unmap operation (git-fixes).\n- misc: fastrpc: take fl-\u003elock when moving mmaps on interrupted invoke (git-fixes).\n- misc: rtsx: add missing write register handling (git-fixes).\n- misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() (git-fixes).\n- mkspec-dtb: Move DTS prefix into package list.\n- mkspec-dtb: Move provides-obsoletes to package list.\n- mkspec-dtb: Put per-architecture package lists into a hash.\n- mkspec-dtb: re-indent.\n- mm: Create/affine kcompactd to its preferred node (bsc#1269313).\n- mm: Create/affine kswapd to its preferred node (bsc#1269313).\n- mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit (git-fixes).\n- mmc: sdhci: unmap the bounce buffer before device release (git-fixes).\n- mmc: via-sdmmc: stop card-detect handling on probe failure (git-fixes).\n- mtd: afs: validate v2 image info bounds (git-fixes).\n- mtd: mtdoops: free page bitmap when the backing MTD is removed (git-fixes).\n- mtd: mtdswap: Avoid freeing registered blktrans device twice (git-fixes).\n- mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() (git-fixes).\n- mtd: rawnand: validate ONFI extended parameter page sections (git-fixes).\n- net: mana: Add debug knob to skip TX timeout recovery reset (git-fixes).\n- net: mana: Add handler for sriov configure (bsc#1272756).\n- net: mana: Cap MSI-X vectors to the device MSI-X table size (git-fixes).\n- net: mana: Extend RX CQE coalescing up to 8 packets (git-fixes).\n- net: mana: Fall back to scattered pages for GDMA queues (git-fixes).\n- net: mana: force full-page RX buffers via ethtool private flag (bsc#1269792).\n- net: mana: refactor mana_get_strings() and mana_get_sset_count() to use switch (bsc#1269792).\n- net: mana: Route ring-buffer access through offset-based helpers (git-fixes).\n- net: tap: set skb-\u003edev before parsing virtio net header in tap_get_user_xdp() (git-fixes bsc#1274550).\n- net: thunderbolt: Count delivered packets in rx_packets and rx_bytes (git-fixes).\n- net: thunderbolt: Mark the connection down when bringing it up fails (git-fixes).\n- net: thunderbolt: Release the Rx HopID that was handed out on mismatch (git-fixes).\n- net: thunderbolt: Tear down DMA paths before stopping the rings (git-fixes).\n- net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() (git-fixes).\n- net: usb: ipheth: fix carrier_work UAF on disconnect (git-fixes).\n- nfc: digital: clamp SENSF_RES length to the destination buffer (git-fixes).\n- nfc: digital: Do not dump a NULL response in command completion (git-fixes).\n- nfc: fdp: bound the device-reported read length and fix an skb leak (git-fixes).\n- nfc: llcp: avoid userspace overflow on invalid optlen (git-fixes).\n- nfc: llcp: bound SNL TLV parsing to the skb and add length checks (git-fixes).\n- nfc: llcp: bound the connect_sn TLV walk to the skb (git-fixes).\n- nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (git-fixes).\n- nfc: llcp: read llcp_sock-\u003elocal under the socket lock in getsockopt (git-fixes).\n- nfc: llcp: reject PDUs shorter than the LLCP header (git-fixes).\n- nfc: microread: validate target discovery payload lengths (git-fixes).\n- nfc: nci: fix double completion race in nci_data_exchange_complete (git-fixes).\n- nfc: nci: fix out-of-bounds write in nci_target_auto_activated() (git-fixes).\n- nfc: nci: fix uninit-value in the RF discover/activated NTF handlers (git-fixes).\n- nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing (git-fixes).\n- nfc: nci: free destination parameters when closing a connection (git-fixes).\n- nfc: pn533: hold a reference to the request skb during send_frame (git-fixes).\n- nfc: pn533: purge fragmented skbs during cleanup (git-fixes).\n- nfc: st21nfca: validate ATR_REQ length against the received frame (git-fixes).\n- nouveau/gem: reserve the bo in the info ioctl around the vma lookup (git-fixes).\n- of: fix out-of-bounds read in of_alias_scan() stem parser (git-fixes).\n- PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] (git-fixes).\n- PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk (git-fixes).\n- PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip (git-fixes).\n- PCI: j721e: Fix incorrect max_lanes for J7200 (git-fixes).\n- PCI: meson: Fix GPIO state while requesting PERST# (git-fixes).\n- phy: qcom: qmp-combo: Correct pre-emphasis table for QMP v4 DP PHYs (git-fixes).\n- phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend (git-fixes).\n- phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table (git-fixes).\n- phy: sunplus: fix error handling in sp_uphy_init() (git-fixes).\n- pinctrl: bcm2835: Don't remove an unregistered GPIO chip (git-fixes).\n- pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip (git-fixes).\n- pinctrl: rockchip: Reset the pin count when recalculating SoC data (git-fixes).\n- platform/chrome: cros_ec_debugfs: Clean up console log on probe failure (git-fixes).\n- platform/chrome: cros_ec_debugfs: Unregister panic notifier (git-fixes).\n- platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count (git-fixes).\n- platform/chrome: sensorhub: Bound the EC-reported sensor number (git-fixes).\n- platform/chrome: sensorhub: Fix dropped timestamp events and log spam (git-fixes).\n- platform/chrome: sensorhub: Fix memory overread in ring handler (git-fixes).\n- platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL (git-fixes).\n- platform/surface: acpi-notify: Check ACPI companion before use (git-fixes).\n- platform/x86/amd/hsmp: Reject negative power cap writes in hwmon (git-fixes).\n- platform/x86: dell-privacy: Fix race condition (git-fixes).\n- platform/x86: dell-wmi-base: Fix resource leak on module load failure (git-fixes).\n- platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer (git-fixes).\n- platform/x86: dell-wmi-sysman: Fix instance ID bounds (git-fixes).\n- platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS (git-fixes).\n- platform/x86: hp-bioscfg: advance elem past consumed array elements (git-fixes).\n- platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() (git-fixes).\n- platform/x86: hp-bioscfg: fix heap OOB read on empty password write (git-fixes).\n- platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password (git-fixes).\n- platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() (git-fixes).\n- platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed (git-fixes).\n- platform/x86: hp-bioscfg: fix password encoding bounds check (git-fixes).\n- platform/x86: hp-bioscfg: warn on element type mismatch instead of failing (git-fixes).\n- platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path (git-fixes).\n- platform/x86: ISST: Add a NULL check for sst_inst (git-fixes).\n- platform/x86: ISST: Just allow 2 bits for SST feature enable (git-fixes).\n- platform/x86: ISST: Return error during profile addition (git-fixes).\n- platform/x86: ISST: Use PP level enable mask (git-fixes).\n- platform/x86: ISST: Validate level in perf mask ioctls (git-fixes).\n- platform/x86: ISST: Validate logical CPU id and clos id (git-fixes).\n- platform/x86: ISST: Validate parameter for core power state (git-fixes).\n- platform/x86: ISST: Validate socket ID in clos_assoc ioctl (git-fixes).\n- PM: sleep: Fix off-by-one in wakelocks number limit check (git-fixes).\n- power: supply: bd99954: Drop bad register fields (git-fixes).\n- power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address (git-fixes).\n- power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address (git-fixes).\n- power: supply: bq27xxx: bq27520g4: fix REG_TTES address (git-fixes).\n- power: supply: bq256xx: drain usb_work before freeing the charger (git-fixes).\n- power: supply: bq24257: fix use-after-free on remove (git-fixes).\n- power: supply: bq25890: Fix power_supply reference leak (git-fixes).\n- power: supply: cros_usbpd-charger: bound the EC-reported port count (git-fixes).\n- power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS (git-fixes).\n- power: supply: isp1704_charger: cancel work on remove (git-fixes).\n- power: supply: lp8727: fix use-after-free in lp8727_release_irq() (git-fixes).\n- power: supply: max17040: drop incorrect I2C functionality check (git-fixes).\n- power: supply: max17040: synchronize work cancellation on suspend (git-fixes).\n- power: supply: qcom_battmgr: terminate the strings from firmware (git-fixes).\n- power: supply: rt9455: quiesce delayed work before teardown (git-fixes).\n- power: supply: sbs-battery: Use a per-device serial number buffer (git-fixes).\n- power: supply: twl4030_charger: cancel workers via devm (git-fixes).\n- power: supply: ucs1002: fix use-after-free on remove (git-fixes).\n- powercap: intel_rapl_tpmi: Handle PMU registration failure during probe (git-fixes).\n- powerpc/dt_cpu_ftrs: Set CPU_FTR_P11_PVR for Power11 and later processors (bsc#1263864 ltc#217835).\n- powerpc/pseries: Ensure vpa,slb_shadow \u0026 dtl are unregistered during crash (bsc#1271256).\n- powerpc/pseries: lparcfg - fix kbuf[] underflow (bsc#1274753 ltc#221289 bsc#1274754 ltc#221288 bsc#1274752\n  ltc#221290).\n- powerpc/pseries: pci - logic bug (bsc#1274749 ltc#221282 bsc#1274755 ltc#221284 bsc#1274756 ltc#221283).\n- powerpc: Replace __ASSEMBLY__ with __ASSEMBLER__ in non-uapi headers (bsc#1263864 ltc#217835).\n- powerpc: Replace __ASSEMBLY__ with __ASSEMBLER__ in uapi headers (bsc#1263864 ltc#217835).\n- ppdev: prevent overflow when setting port timeout (git-fixes).\n- qede: fix out-of-bounds check for cqe-\u003elen_list (git-fixes).\n- rapidio: clear mport-\u003enet when rio_add_net() fails (git-fixes).\n- rapidio: mport_cdev: fix use-after-free in dma_req_free() (git-fixes).\n- RDMA/irdma: Remove redundant legacy_mode checks (git-fixes).\n- RDMA/mana_ib: drain QP references after partial table insertion (git-fixes).\n- RDMA/mana_ib: unify QP lookup table (git-fixes).\n- RDMA/mlx5: Fix integer overflow of user QP buffer size (git-fixes).\n- regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer (git-fixes).\n- regulator: core: use system_freezable_wq for init complete work (git-fixes).\n- regulator: devres: add API for reference voltage supplies (stable-fixes).\n- regulator: devres: fix devm_regulator_get_enable_read_voltage() return (git-fixes).\n- regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata (git-fixes).\n- regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling (git-fixes).\n- remoteproc: qcom: Fix glink-\u003enode reference leak in qcom_add_glink_subdev (git-fixes).\n- remoteproc: qcom_q6v5_adsp: Fix reference leak for device node (git-fixes).\n- remoteproc: scp: Fix device reference leak on failed lookup (git-fixes).\n- Revert 'drm/amdgpu: fix aperture mapping leak' (git-fixes).\n- Revert 'media: v4l2-dev: fix error handling in __video_register_device()' (git-fixes).\n- Revert 'thermal/drivers/hwmon: Cleanup coding style a bit' (stable-fixes).\n- rpmsg: core: Fix incorrect return value documentation (git-fixes).\n- rpmsg: glink: smem: order FIFO read after availability check (git-fixes).\n- rtc: gamecube: check return value of devm_rtc_register_device() (git-fixes).\n- rtc: pcf8563: fix clock provider leak on unbind (git-fixes).\n- rtc: pcf85363: Add error checking to regmap calls in probe() (git-fixes).\n- rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers (git-fixes).\n- rtc: rzn1: Fix weekday underflow when alarm crosses month boundary (git-fixes).\n- rtc: zynqmp: Return optional clock lookup errors (git-fixes).\n- sched,arm64: Handle CPU isolation on last resort fallback rq (bsc#1269313).\n- scsi: fnic: Abort timed-out NVMe LS requests (bsc#1236344).\n- scsi: fnic: Add FDLS role handling for NVMe initiators (bsc#1236344).\n- scsi: fnic: Add the NVMe/FC transport path (bsc#1236344).\n- scsi: fnic: Advertise NVMe initiator service parameters (bsc#1236344).\n- scsi: fnic: Bump up version number (bsc#1236344).\n- scsi: fnic: Decode firmware role configuration (bsc#1236344).\n- scsi: fnic: Do not use GFP_ZERO for mempools (bsc#1236344).\n- scsi: fnic: Expose NVMe transport state in debugfs (bsc#1236344).\n- scsi: fnic: Handle NVMe LS frames in FDLS (bsc#1236344).\n- scsi: fnic: Make debug logging protocol independent (bsc#1236344).\n- scsi: fnic: Make fnic_queuecommand() easier to analyze (bsc#1236344).\n- scsi: fnic: Refactor in_remove flag and call to fnic_fcpio_reset() (bsc#1236344).\n- scsi: fnic: Remove a useless struct mempool forward declaration (bsc#1236344).\n- scsi: fnic: Rename fnic_scsi_fcpio_reset() (bsc#1236344).\n- scsi: fnic: Route completions and resets by initiator role (bsc#1236344).\n- scsi: fnic: Self-assignment of intr_time_type has no effect (bsc#1236344).\n- scsi: fnic: Send NVMe LS requests through FDLS (bsc#1236344).\n- scsi: fnic: Switch to use %ptSp (bsc#1236344).\n- scsi: fnic: Track NVMe transport statistics (bsc#1236344).\n- scsi: fnic: Use fnic_num for non-SCSI identifiers (bsc#1236344).\n- scsi: fnic: Use mempool for receive frames (bsc#1236344).\n- scsi: qla2xxx: Declare qla2xxx_mqueuecommand() static (bsc#1275737).\n- scsi: qla2xxx: Use nr_cpu_ids instead of NR_CPUS for qp_cpu_map allocation (bsc#1275737).\n- scsi: storvsc: Support manual scans for all Hyper-V targets (git-fixes).\n- sctp: avoid auth_enable sysctl UAF during netns teardown (git-fixes).\n- serial: 8250_dma: Clear stale RX state on shutdown (git-fixes).\n- serial: amba-pl011: unprepare console clock on unregister (git-fixes).\n- serial: core: clear freed pointers on uart_register_driver() failure (git-fixes).\n- serial: qcom-geni: fix TX DMA buffer flush (git-fixes).\n- serial: sc16is7xx: fix copy-paste errors in EFR_SWFLOWx_BIT constants (stable-fixes).\n- smb/client: handle overlapping allocated ranges in fallocate (bsc#1274902).\n- smb: client: reject overlapping data areas in SMB2 responses (git-fixes).\n- smb: client: require net admin for CIFS SWN netlink (bsc#1273966).\n- smb: client: resolve SWN tcon from live registrations (bsc#1273872).\n- soc: fsl: qe: check platform_driver_register() in qe_ic_of_init() (git-fixes).\n- soc: qcom: rpmh-rsc: manage PM notifiers with devres (git-fixes).\n- soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() (git-fixes).\n- software node: Fix software_node_get_reference_args() with index -1 (git-fixes).\n- soundwire: qcom: Fix port exhaustion check in stream_alloc_ports (git-fixes).\n- speakup: keyhelp: guard letter_offsets possible out-of-range indexing (git-fixes).\n- spi: img-spfi: don't disable runtime PM on DMA deferred probe (git-fixes).\n- spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers (stable-fixes).\n- spi: sprd-adi: Fix probe succeeding without registering the controller (git-fixes).\n- staging: fbtft: Use sysfs_emit_at() to print to sysfs file (git-fixes).\n- staging: media: tegra-video: fix of_node_put() on VIP parse errors (git-fixes).\n- staging: media: tegra-video: vi: fix probe failure on skipped last port (git-fixes).\n- staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown (git-fixes).\n- staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() (git-fixes).\n- staging: rtl8723bs: fix missing shared-key auth challenge length check (git-fixes).\n- staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() (git-fixes).\n- staging: rtl8723bs: fix OOB read in WMM_param_handler() (git-fixes).\n- staging: rtl8723bs: use kfree_sensitive() for key material (git-fixes).\n- staging: rtl8723bs: validate monitor transmit frame lengths (git-fixes).\n- staging: sm750fb: gate dualview dataflow using g_dualview (git-fixes).\n- thermal/drivers/imx: Disable clock on runtime resume failure (git-fixes).\n- thermal/drivers/qoriq: Disable clock on resume failure (git-fixes).\n- thermal: intel: int3400: clean up ODVP on probe failures (git-fixes).\n- thunderbolt: Bound the DROM dual link port number before indexing sw-\u003eports (git-fixes).\n- thunderbolt: Fix bandwidth group reservation indexing (git-fixes).\n- thunderbolt: icm: Preserve USB4 proxy data-valid bit (git-fixes).\n- tlclk: if sscanf() fails, fall back to 0, not random value (git-fixes).\n- tpm: st33zp24: Return zero on status read failure (git-fixes).\n- tpm: st33zp24: Validate locality read result (git-fixes).\n- tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout (git-fixes).\n- tty: clear cdev pointer after cdev_add() failure (git-fixes).\n- tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 (git-fixes).\n- tty: skip cdev_del() when no cdev is registered (git-fixes).\n- uaccess: add copy_struct_to_user helper (bsc#1263864 ltc#217835).\n- uaccess: fix ignored_trailing logic in copy_struct_to_user() (bsc#1263864 ltc#217835).\n- uio: Fix stale info pointer in failed registration path (git-fixes).\n- usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() (git-fixes).\n- usb: atm: usbatm: fix invalid ci_range initialization (git-fixes).\n- USB: c67x00: fix use-after-free in c67x00_add_iso_urb() (git-fixes).\n- usb: cdnsp: fix incorrect endian conversions for APB timeout register (git-fixes).\n- usb: dwc2: add missing @remotewakeup kernel-doc parameter (git-fixes).\n- usb: dwc2: gadget: Exit partial power down state when changing USB pull-up (git-fixes).\n- usb: gadget: configfs: fix out-of-bounds read of qw_sign (git-fixes).\n- usb: gadget: f_fs: Prevent deadlock during ep0 read loop (git-fixes).\n- usb: gadget: f_ncm: Use unsigned int for ndp_index (git-fixes).\n- usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() (git-fixes).\n- usb: gadget: f_uac1_legacy: remove broken string configfs attributes (git-fixes).\n- usb: gadget: pch_udc: remove excess kernel-doc member for registered (git-fixes).\n- usb: gadget: r8a66597: avoid double free of ep0_req in probe error path (git-fixes).\n- usb: gadget: snps_udc_plat: clean up PHY on probe deferral (git-fixes).\n- usb: gadget: u_audio: Fix use-after-free on sound card disconnect (git-fixes).\n- usb: gadget: uac: validate rate list length before storing (git-fixes).\n- usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() (git-fixes).\n- usb: mtu3: allow system suspend during active gadget connection (git-fixes).\n- usb: musb: omap2430: clean up probe error handling (stable-fixes).\n- USB: phy: fsl-usb: fix missing static keywords (git-fixes).\n- usb: renesas_usbhs: Fix power-off ordering on unbind (git-fixes).\n- USB: serial: digi_acceleport: fix port registration order (git-fixes).\n- USB: serial: ftdi_sio: add support for E+H FXA291 (stable-fixes).\n- USB: serial: option: add TDTECH MT5710-CN (stable-fixes).\n- USB: serial: option: fix slab OOB read in interrupt URB callback (git-fixes).\n- USB: serial: spcp8x5: drop broken carrier detect support (git-fixes).\n- USB: storage: add NO_ATA_1X quirk for Longmai USB Key (stable-fixes).\n- usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive() (git-fixes).\n- usb: typec: ucsi: unregister debugfs entries on teardown (git-fixes).\n- usb: usbfs: fix use-after-free of usb_device in usbdev_release() (git-fixes).\n- usb: xhci: Handle USB3 port events when there is one roothub (git-fixes).\n- vt: add permission check for KDSKBMETA ioctl (stable-fixes).\n- vt: stabilize tty reference in kbd_keycode with tty_port_tty_get (stable-fixes).\n- w1: ds28e17: reject an oversize length on an I2C block read (git-fixes).\n- w1: ds2482: Fix signedness bug in ds2482_w1_triplet() (git-fixes).\n- wifi: ath6kl: avoid buffer overreads in WMI event handlers (git-fixes).\n- wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets (git-fixes).\n- wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump (git-fixes).\n- wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() (git-fixes).\n- wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate (git-fixes).\n- wifi: ath11k: Correctly copy the hint BSSID in WMI scan request (git-fixes).\n- wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx() (git-fixes).\n- wifi: ath12k: Correctly copy the hint BSSID in WMI scan request (git-fixes).\n- wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() (git-fixes).\n- wifi: brcmfmac: fix P2P action frame handling without device vif (git-fixes).\n- wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs (git-fixes).\n- wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments (git-fixes).\n- wifi: iwlwifi: mei: check SAP message length before reading it (git-fixes).\n- wifi: iwlwifi: mei: pass correct argument to function (git-fixes).\n- wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser (git-fixes).\n- wifi: mac80211: disconnect on CSA to channel 0 (git-fixes).\n- wifi: mac80211: fix multi-link element inheritance (git-fixes).\n- wifi: mac80211: fix per-STA profile length in cross-link CSA parsing (git-fixes).\n- wifi: mac80211: send TWT teardown to peer after setup TX failure (git-fixes).\n- wifi: mac80211: skip default WMM setup for AP_VLAN links (git-fixes).\n- wifi: mac80211: skip unused probe response countdown offsets (git-fixes).\n- wifi: mt76: fix 4th chain ACK RSSI bitmask in sta_poll (git-fixes).\n- wifi: mt76: fix ER-SU 106-tone RU check in RX rate decode (git-fixes).\n- wifi: mt76: fix HE DCM max-RU capability encoding (git-fixes).\n- wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length (git-fixes).\n- wifi: mt76: mt792x: Fix memory leak in SDIO TX path (git-fixes).\n- wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex (git-fixes).\n- wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss (git-fixes).\n- wifi: mt76: mt7915: fix double hif2 init on the non-WED path (git-fixes).\n- wifi: mt76: mt7915: fix ext PHY use-after-free on register error path (git-fixes).\n- wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986 (git-fixes).\n- wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie (git-fixes).\n- wifi: mt76: mt7915: release hif2 reference on probe IRQ failure (git-fixes).\n- wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement (git-fixes).\n- wifi: mt76: mt7915: unwind state on add_interface failure (git-fixes).\n- wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields (git-fixes).\n- wifi: mt76: mt7915: write RX header translation bit to the correct register (git-fixes).\n- wifi: mt76: mt7921: validate CLC firmware records (git-fixes).\n- wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb (git-fixes).\n- wifi: mt76: mt7925: fix msg len mismatch between driver and firmware (git-fixes).\n- wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config (git-fixes).\n- wifi: mt76: mt7996: don't report a zero TX bitrate (git-fixes).\n- wifi: mt76: mt7996: fix capability of EHT-MCS 15 in MRU (git-fixes).\n- wifi: mt76: mt7996: fix reg addr remap when addr is 0 (git-fixes).\n- wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV (git-fixes).\n- wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset (git-fixes).\n- wifi: mt76: mt7996: validate RX band_idx before dereferencing phys (git-fixes).\n- wifi: mt76: report data NSS for STBC frames in RX rate decode (git-fixes).\n- wifi: mwifiex: Detach sync cmd buffer on interrupted wait (git-fixes).\n- wifi: rtl818x: initialize eeprom_93cx6 struct to zero (git-fixes).\n- wifi: rtlwifi: pci: fix error path in rtl_pci_probe() (git-fixes).\n- wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() (git-fixes).\n- wifi: rtw89: fix HE extended capability length check (git-fixes).\n- wifi: zd1211rw: reject secondary interfaces to prevent conflicts (git-fixes).\n- x86/bugs: Clarify that syscall hardening isn't a BHI mitigation (git-fixes).\n- x86/cpu: Add CPU model number for Bartlett Lake CPUs with Raptor Cove cores (bsc#1240957 bsc#1249104 bsc#1265220).\n- xhci: dbgtty: Fix unregister on tty_alloc_driver() failure (git-fixes).\n- xhci: dbgtty: Fix unregister on tty_register_driver() failure (git-fixes).\n","status":"published","published":"2026-09-10T09:31:34Z","modified":"2026-09-14T18:23:14.868358938Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4254-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues:\n\nThe following security issues were fixed:\n\n- CVE-2024-57841,CVE-2026-53260: net: fix memory leak in tcp_conn_request() (bsc#1235944 bsc#1269731).\n- CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).\n- CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).\n- CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).\n- CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).\n- CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).\n- CVE-2026-31658: net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() (bsc#1263052).\n- CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).\n- CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).\n- CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).\n- CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).\n- CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).\n- CVE-2026-43213: wifi: rtw89: pci: validate sequence number of TX release report (bsc#1264643).\n- CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).\n- CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).\n- CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).\n- CVE-2026-43386: staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie (bsc#1264740).\n- CVE-2026-43416: powerpc, perf: Check that current-\u003emm is alive before getting user callchain (bsc#1265121).\n- CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).\n- CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).\n- CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).\n- CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).\n- CVE-2026-46078: erofs: fix the out-of-bounds nameoff handling for trailing dirents (bsc#1267505).\n- CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).\n- CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).\n- CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).\n- CVE-2026-46127: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() (bsc#1267236).\n- CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).\n- CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).\n- CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).\n- CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).\n- CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).\n- CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).\n- CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).\n- CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).\n- CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).\n- CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).\n- CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).\n- CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).\n- CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).\n- CVE-2026-53034: bpf, sockmap: Fix af_unix null-ptr-deref in proto update (bsc#1269140).\n- CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).\n- CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).\n- CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).\n- CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).\n- CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).\n- CVE-2026-53094: bpf: Fix stale offload-\u003eprog pointer after constant blinding (bsc#1269965).\n- CVE-2026-53096: bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path (bsc#1269969).\n- CVE-2026-53110: selftests/bpf: Add ASSERT_OK_FD macro (bsc#1269985).\n- CVE-2026-53111: bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap (bsc#1269167).\n- CVE-2026-53126: blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() (bsc#1269635).\n- CVE-2026-53142: drm/xe/display: fix oops in suspend/shutdown without display (bsc#1269402).\n- CVE-2026-53154: mm/hugetlb: restore reservation on error in hugetlb folio copy paths (bsc#1269665).\n- CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (bsc#1269306).\n- CVE-2026-53180: timers/migration: Fix livelock in tmigr_handle_remote_up() (bsc#1269888).\n- CVE-2026-53207: mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison (bsc#1269590).\n- CVE-2026-53219: netfilter: x_tables: avoid leaking percpu counter pointers (bsc#1269686).\n- CVE-2026-53220: netfilter: revalidate bridge ports (bsc#1269381).\n- CVE-2026-53223: net: guard timestamp cmsgs to real error queue skbs (bsc#1269301).\n- CVE-2026-53228: ipv6: sit: reload inner IPv6 header after GSO offloads (bsc#1269256).\n- CVE-2026-53238: netlabel: validate unlabeled address and mask attribute lengths (bsc#1269774).\n- CVE-2026-53263: 6lowpan: fix off-by-one in multicast context address compression (bsc#1269647).\n- CVE-2026-53264: net/sched: act_api: use RCU with deferred freeing for action lifecycle (bsc#1269238).\n- CVE-2026-53269: netfilter: synproxy: add mutex to guard hook reference counting (bsc#1269579).\n- CVE-2026-53273: tee: optee: prevent use-after-free when the client exits before the supplicant (bsc#1269713).\n- CVE-2026-53309: ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison (bsc#1269815).\n- CVE-2026-53330: drm/amd/display: Fix out-of-bounds read in (bsc#1270090).\n- CVE-2026-53336: nvmem: layouts: onie-tlv: fix hang on unknown types (bsc#1270108).\n- CVE-2026-53337: net: bonding: fix NULL pointer dereference in bond_do_ioctl() (bsc#1270251).\n- CVE-2026-53353: hsr: Remove WARN_ONCE() in hsr_addr_is_self() (bsc#1270111).\n- CVE-2026-53365: vsock/virtio: fix zerocopy completion for multi-skb sends (bsc#1271365).\n- CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830).\n- CVE-2026-63801: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (bsc#1272230).\n- CVE-2026-63808: exfat: fix potential use-after-free in exfat_find_dir_entry() (bsc#1272260).\n- CVE-2026-63810: block: Avoid mounting the bdev pseudo-filesystem in userspace (bsc#1272297).\n- CVE-2026-63823: keys: Pin request_key_auth payload in instantiate paths (bsc#1272182).\n- CVE-2026-63827: apparmor: fix use-after-free in rawdata dedup loop (bsc#1272179).\n- CVE-2026-63828: apparmor: mediate the implicit connect of TCP fast open sendmsg (bsc#1272175).\n- CVE-2026-63860: RDMA/core: Prefer NLA_NUL_STRING (bsc#1272429).\n- CVE-2026-63865: bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks (bsc#1272486).\n- CVE-2026-63868: net: garp: fix unsigned integer underflow in garp_pdu_parse_attr (bsc#1272497).\n- CVE-2026-63879: drm/amdgpu: fix amdgpu_hmm_range_get_pages (bsc#1272569).\n- CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).\n- CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272385).\n- CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272390).\n- CVE-2026-63889: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (bsc#1272423).\n- CVE-2026-63891: thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() (bsc#1272641).\n- CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1272877).\n- CVE-2026-63923: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (bsc#1273005).\n- CVE-2026-63925: macsec: fix replay protection at XPN lower-PN wrap (bsc#1273008).\n- CVE-2026-63926: bpf: sockmap: fix tail fragment offset in bpf_msg_push_data (bsc#1273019).\n- CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1272662).\n- CVE-2026-63969: ipv6: fix possible infinite loop in rt6_fill_node() (bsc#1272484).\n- CVE-2026-63970: vsock/virtio: bind uarg before filling zerocopy skb (bsc#1272673).\n- CVE-2026-63980: net/handshake: Use spin_lock_bh for hn_lock (bsc#1273028).\n- CVE-2026-63985: ethtool: eeprom: add more safeties to EEPROM Netlink fallback (bsc#1272963).\n- CVE-2026-63990: bonding: refuse to enslave CAN devices (bsc#1273027).\n- CVE-2026-63992: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (bsc#1272868).\n- CVE-2026-63995: ethtool: cmis: validate start_cmd_payload_size from module (bsc#1273033).\n- CVE-2026-63996: ethtool: cmis: require exact CDB reply length (bsc#1273032).\n- CVE-2026-63997: ethtool: module: avoid leaking a netdev ref on module flash errors (bsc#1273036).\n- CVE-2026-63998: ethtool: module: call ethnl_ops_complete() on module flash errors (bsc#1273037).\n- CVE-2026-63999: ethtool: rss: fix indir_table and hkey leak on get_rxfh failure (bsc#1273038).\n- CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273030).\n- CVE-2026-64001: ALSA: pcm: oss: Fix setup list UAF on proc write error (bsc#1273734).\n- CVE-2026-64002: ipv4: free net-\u003eipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (bsc#1273774).\n- CVE-2026-64004: net/iucv: fix locking in .getsockopt (bsc#1273804).\n- CVE-2026-64005: net/smc: Do not re-initialize smc hashtables (bsc#1273831).\n- CVE-2026-64006: netfilter: nf_tables: fix dst corruption in same register operation (bsc#1273834).\n- CVE-2026-64007: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (bsc#1273105).\n- CVE-2026-64010: nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (bsc#1273882).\n- CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1273891).\n- CVE-2026-64015: security/keys: fix missed RCU read section on lookup (bsc#1273762).\n- CVE-2026-64029: ALSA: seq: Serialize UMP output teardown with event_input (bsc#1273766).\n- CVE-2026-64033: RDMA/rtrs: Fix use-after-free in path file creation cleanup (bsc#1273134).\n- CVE-2026-64047: net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (bsc#1273060).\n- CVE-2026-64048: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (bsc#1273484).\n- CVE-2026-64052: block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user() (bsc#1272983).\n- CVE-2026-64055,CVE-2026-64056: net: ethernet: cortina: Make RX SKB per-port (bsc#1272502 bsc#1272893).\n- CVE-2026-64055: net: ethernet: cortina: Drop half-assembled SKB (bsc#1272893).\n- CVE-2026-64073: irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT (bsc#1273490).\n- CVE-2026-64098: drm/virtio: use uninterruptible resv lock for plane updates (bsc#1273488).\n- CVE-2026-64099: drm/v3d: Fix use-after-free of CPU job query arrays on error path (bsc#1273465).\n- CVE-2026-64102: RDMA/siw: Reject MPA FPDU length underflow before signed receive math (bsc#1272516).\n- CVE-2026-64109: af_unix: Peek the queue synchronized (bsc#1273748).\n- CVE-2026-64112: rbd: eliminate a race in lock_dwork draining on unmap (bsc#1273741).\n- CVE-2026-64113: ixgbevf: fix use-after-free in VEPA multicast source pruning (bsc#1272262).\n- CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl \u003c 5 (bsc#1273742).\n- CVE-2026-64115: vsock/vmci: fix UAF when peer resets connection during handshake (bsc#1273745).\n- CVE-2026-64118: qed: fix double free in qed_cxt_tables_alloc() (bsc#1273749).\n- CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273743).\n- CVE-2026-64125: net: bcmgenet: keep RBUF EEE/PM disabled (bsc#1272346).\n- CVE-2026-64131: mm/memory: fix spurious warning when unmapping device-private/exclusive pages (bsc#1274063).\n- CVE-2026-64136: smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (bsc#1272351).\n- CVE-2026-64146: erofs: fix metabuf leak in inode xattr initialization (bsc#1273681).\n- CVE-2026-64148: pds_core: check health in devcmd wait (bsc#1273956).\n- CVE-2026-64164: btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() (bsc#1273957).\n- CVE-2026-64180: mm/memory_hotplug: fix memory block reference leak on remove (bsc#1273679).\n- CVE-2026-64185: sysfs: don't remove existing directory on update failure (bsc#1272200).\n- CVE-2026-64188: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() (bsc#1272150).\n- CVE-2026-64190: net: team: fix NULL pointer dereference in team_xmit during mode change (bsc#1272210).\n- CVE-2026-64192: bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized (bsc#1272213).\n- CVE-2026-64214: powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise()\n  (bsc#1272799).\n- CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272798).\n- CVE-2026-64222: octeontx2-pf: avoid double free of pool-\u003estack on AQ init failure (bsc#1272788).\n- CVE-2026-64224: octeontx2-pf: fix double free in rvu_rep_rsrc_init() (bsc#1272804).\n- CVE-2026-64225: octeontx2-af: CGX: add bounds check to cgx_speed_mbps index (bsc#1272786).\n- CVE-2026-64244: drivers/base/memory: set mem-\u003ealtmap after successful device registration (bsc#1273812).\n- CVE-2026-64245: fbdev: modedb: fix a possible UAF in fb_find_mode() (bsc#1273905).\n- CVE-2026-64268: RDMA/siw: bound Read Response placement to the RREAD length (bsc#1273276).\n- CVE-2026-64269: RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg (bsc#1273280).\n- CVE-2026-64286: KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU (bsc#1274058).\n- CVE-2026-64287: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (bsc#1273325).\n- CVE-2026-64294: mm: do file ownership checks with the proper mount idmap (bsc#1273525).\n- CVE-2026-64296: exfat: bound uniname advance in exfat_find_dir_entry() (bsc#1273975).\n- CVE-2026-64304: crypto: qat - validate RSA CRT component lengths (bsc#1273944).\n- CVE-2026-64312: crypto: pcrypt - restore callback for non-parallel fallback (bsc#1273968).\n- CVE-2026-64315: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1274028).\n- CVE-2026-64316: crypto: caam - use print_hex_dump_devel to guard key hex dumps (bsc#1273598).\n- CVE-2026-64317: isofs: bound Rock Ridge symlink components to the SL record (bsc#1273936).\n- CVE-2026-64322: udf: validate sparing table length as an entry count, not a byte count (bsc#1273958).\n- CVE-2026-64323: udf: validate VAT header length against the VAT inode size (bsc#1273305).\n- CVE-2026-64355: bpf: Reject fragmented frames in devmap (bsc#1273422).\n- CVE-2026-64375: proc: protect ptrace_may_access() with exec_update_lock (FD links) (bsc#1273868).\n- CVE-2026-64378: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (bsc#1273603).\n- CVE-2026-64381: smb: client: Fix next buffer leak in receive_encrypted_standard() (bsc#1273860).\n- CVE-2026-64382: smb: client: fix double-free in SMB2_open() replay (bsc#1273291).\n- CVE-2026-64383: smb: client: fix double-free in SMB2_flush() replay (bsc#1273426).\n- CVE-2026-64384: smb: client: fix change notify replay double-free (bsc#1274541).\n- CVE-2026-64385: smb: client: fix double-free in SMB2_ioctl() replay (bsc#1274539).\n- CVE-2026-64386: smb: client: fix query_info() replay double-free (bsc#1274543).\n- CVE-2026-64387: smb: client: fix query directory replay double-free (bsc#1274545).\n- CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).\n- CVE-2026-64411: netfilter: ebtables: terminate table name before find_table_lock() (bsc#1274077).\n- CVE-2026-64412: netfilter: ebtables: module names must be null-terminated (bsc#1273780).\n- CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction (bsc#1274274).\n- CVE-2026-64434: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref (bsc#1273880).\n- CVE-2026-64436: net: af_key: initialize alg_key_len for IPComp states (bsc#1274277).\n- CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).\n- CVE-2026-64450: tipc: fix out-of-bounds read in broadcast Gap ACK blocks (bsc#1273523).\n- CVE-2026-64452: 6lowpan: fix NHC entry use-after-free on error path (bsc#1273460).\n- CVE-2026-64463: usb: typec: tcpci_rt1711h: unregister TCPCI port with devres (bsc#1273273).\n- CVE-2026-64472: vfio/mlx5: Fix racy bitfields and tighten struct layout (bsc#1274075).\n- CVE-2026-64477: x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled (bsc#1274264).\n- CVE-2026-64481: ALSA: hda/cs35l41: Fix firmware load work teardown (bsc#1274547).\n- CVE-2026-64515: wifi: mac80211: fix MLE defragmentation (bsc#1273859).\n- CVE-2026-64537: bridge: cfm: reject invalid CCM interval at configuration time (bsc#1273289).\n- CVE-2026-64538: ipv6: Fix null-ptr-deref in fib6_nh_mtu_change() (bsc#1273335).\n- CVE-2026-64541: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (bsc#1273303).\n- CVE-2026-64543: tipc: fix use-after-free of the discoverer in tipc_disc_rcv() (bsc#1273311).\n- CVE-2026-64545: net, bpf: check master for NULL in xdp_master_redirect() (bsc#1273318).\n- CVE-2026-64548: bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() (bsc#1273337).\n- CVE-2026-64551: sctp: validate STALE_COOKIE cause length before reading staleness (bsc#1273813).\n- CVE-2026-64552: virtio-net: fix len check in receive_big() (bsc#1273323).\n- CVE-2026-64553: net: psample: fix info leak in PSAMPLE_ATTR_DATA (bsc#1273336).\n- CVE-2026-64554: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() (bsc#1273340).\n- CVE-2026-64562: KVM: nVMX: Hide shadow VMCS right after VMCLEAR (bsc#1273930).\n- CVE-2026-64563: rhashtable: clear stale iter-\u003ep on table restart (bsc#1273995).\n- CVE-2026-64567: btrfs: reject free space cache with more entries than pages (bsc#1274006).\n- CVE-2026-64569: mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n (bsc#1274009).\n- CVE-2026-64572: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (bsc#1274014).\n- CVE-2026-64576: nexthop: initialize extack in nh_res_bucket_migrate() (bsc#1274030).\n- CVE-2026-64577: gtp: check skb_pull_data() return in gtp1u_send_echo_resp() (bsc#1274031).\n- CVE-2026-64581: xfrm: fix sk_dst_cache double-free in xfrm_user_policy() (bsc#1274041).\n- CVE-2026-64582: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (bsc#1274040).\n- CVE-2026-64593: btrfs: do not trim a device which is not writeable (bsc#1274497).\n- CVE-2026-64597: smb: client: fix double-free in SMB2_close() replay (bsc#1274297).\n- CVE-2026-64598: smb/client: Fix error code in smb2_aead_req_alloc() (bsc#1274298).\n- CVE-2026-68081: KVM: nVMX: Add helper to put (unmap) vmcs12 pages (bsc#1274580).\n- CVE-2026-68082: libceph: fix two unsafe bare decodes in decode_lockers() (bsc#1274581).\n- CVE-2026-68086: mm/khugepaged: write all dirty file folios when collapsing (bsc#1274713).\n- CVE-2026-68105: drm/amdgpu: Fix kernel panic during driver load failure (bsc#1274849).\n- CVE-2026-68116: vxlan: mdb: Fix source list corruption on a failed replace (bsc#1274876).\n- CVE-2026-68117: tipc: clear sock-\u003esk on the failed-insert path in tipc_sk_create() (bsc#1274881).\n- CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1274888).\n- CVE-2026-68123: openvswitch: fix GSO userspace truncation underflow (bsc#1275169).\n- CVE-2026-68124: mctp: serial: handle zero-length frames to prevent rx buffer overflow (bsc#1275192).\n- CVE-2026-68127: ila: reload IPv6 header after pskb_may_pull in checksum adjust (bsc#1275237).\n- CVE-2026-68129: gve: fix Rx queue stall on alloc failure (bsc#1275517).\n- CVE-2026-68132: super: fix emergency thaw deadlock on frozen block devices (bsc#1275553).\n- CVE-2026-68135: net: hip04: fix RX buffer leak on build_skb failure (bsc#1275557).\n- CVE-2026-68136: net: gro: fix double aggregation of flush-marked skbs (bsc#1275474).\n- CVE-2026-68138: net/sched: serialize qdisc_rtab_list against concurrent get/put (bsc#1274941).\n- CVE-2026-68139: net/mlx5e: Use sender devcom for MPV master-up (bsc#1275578).\n- CVE-2026-68142: geneve: require CAP_NET_ADMIN in the device netns for changelink (bsc#1275582).\n- CVE-2026-68143: net: slip: serialize receive against buffer reallocation (bsc#1275583).\n- CVE-2026-68145: iomap: fix out-of-bounds bitmap_set() with zero-length range (bsc#1275584).\n- CVE-2026-68149: fs: preserve ACL_DONT_CACHE state in forget_cached_acl() (bsc#1275294).\n- CVE-2026-68152: amt: fix use-after-free in AMT delayed works (bsc#1275300).\n- CVE-2026-68153: libceph: remove debugfs files before client teardown (bsc#1275301).\n- CVE-2026-68154: libceph: reject zero bucket types in crush_decode (bsc#1275303).\n- CVE-2026-68155: libceph: Reject monmaps advertising zero monitors (bsc#1275304).\n- CVE-2026-68156: libceph: refresh auth-\u003eauthorizer_buf{,_len} after authorizer update (bsc#1275305).\n- CVE-2026-68157: libceph: guard missing CRUSH type name lookup (bsc#1275306).\n- CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1275307).\n- CVE-2026-68159: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (bsc#1275470).\n- CVE-2026-68160: ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() (bsc#1275472).\n- CVE-2026-68161: sctp: close UDP tunnel sockets during netns teardown (bsc#1274892).\n- CVE-2026-68166: userfaultfd: prevent registration of special VMAs (bsc#1274930).\n- CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275161).\n- CVE-2026-68205: media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() (bsc#1274934).\n- CVE-2026-68238: drm/amdgpu: Release VFCT ACPI table reference (bsc#1275704).\n- CVE-2026-68247: drm/i915/bios: range check LFP Data Block panel_type2 (bsc#1275817).\n- CVE-2026-68254: drm/i915/vrr: require valid min/max vfreq for VRR (bsc#1275150).\n- CVE-2026-68267: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (bsc#1275139).\n- CVE-2026-68284: bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() (bsc#1275970).\n- CVE-2026-68286: drop_monitor: perform u64_stats updates under IRQ-disabled section (bsc#1275973).\n- CVE-2026-68288: net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD (bsc#1275975).\n- CVE-2026-68289: tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() (bsc#1275976).\n- CVE-2026-68293: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (bsc#1275091).\n- CVE-2026-68297: tipc: fix u16 MTU truncation in media and bearer MTU validation (bsc#1275040).\n- CVE-2026-68299: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (bsc#1275088).\n- CVE-2026-68300: sctp: auth: verify auth requirement when auth_chunk is NULL (bsc#1275083).\n- CVE-2026-68302: amt: re-read skb header pointers after every pull (bsc#1275081).\n- CVE-2026-68312: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (bsc#1274663).\n- CVE-2026-68313: tipc: fix infinite loop in __tipc_nl_compat_dumpit (bsc#1274665).\n- CVE-2026-68315: sctp: validate stream count in sctp_process_strreset_inreq() (bsc#1274662).\n- CVE-2026-68320: sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid (bsc#1274659).\n- CVE-2026-68322: rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled (bsc#1274656).\n- CVE-2026-68324: iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() (bsc#1274649).\n- CVE-2026-68325: iommu/amd: Bound the early ACPI HID map (bsc#1274651).\n- CVE-2026-68328: nfp: Check resource mutex allocation (bsc#1274646).\n- CVE-2026-68329: iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() (bsc#1274645).\n- CVE-2026-68331: dpaa2-eth: put MAC endpoint device on disconnect (bsc#1274642).\n- CVE-2026-68333: dpaa2-switch: put MAC endpoint device on disconnect (bsc#1274644).\n- CVE-2026-68335: rds: drop incoming messages that cross network namespace boundaries (bsc#1274640).\n- CVE-2026-68336: bonding: fix devconf_all NULL dereference when IPv6 is disabled (bsc#1274639).\n- CVE-2026-68343: smb: client: validate DFS referral PathConsumed (bsc#1274629).\n- CVE-2026-68375: bnxt_en: Handle partially initialized auxiliary devices (bsc#1274835).\n- CVE-2026-68377: net/sched: act_tunnel_key: Defer dst_release to RCU callback (bsc#1274831).\n- CVE-2026-68386: bpf, sockmap: Reject unhashed UDP sockets on sockmap update (bsc#1274814).\n- CVE-2026-68397: net/iucv: take a reference on the socket found in afiucv_hs_rcv() (bsc#1274898).\n- CVE-2026-68398: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF (bsc#1274908).\n- CVE-2026-68408: wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (bsc#1274709).\n- CVE-2026-68417: RDMA/siw: publish QP after initialization (bsc#1274696).\n- CVE-2026-68418: RDMA/irdma: Prevent user-triggered null deref on QP create (bsc#1274690).\n- CVE-2026-68419: RDMA/irdma: Prevent rereg_mr for non-mem regions (bsc#1274698).\n- CVE-2026-68422: btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() (bsc#1274706).\n- CVE-2026-68425: IB/mad: Drop unmatched RMPP responses before reassembly (bsc#1274700).\n- CVE-2026-68426: xfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment (bsc#1274705).\n- CVE-2026-68432: vxlan: require CAP_NET_ADMIN in the device netns for changelink (bsc#1274800).\n- CVE-2026-68433: libceph: bound get_version reply decode to front len (bsc#1274801).\n- CVE-2026-68450: btrfs: free mapping node on duplicate reloc root insert (bsc#1274834).\n- CVE-2026-68470: wifi: cfg80211/mac80211: correctly parse S1G beacon optional elements (bsc#1276500).\n- CVE-2026-68480: x86/bugs: Make Safe-RET robust against interrupt injection (bsc#1274208).\n- CVE-2026-72020: ipvs: reset full ip_vs_seq structs in ip_vs_conn_new (bsc#1275506).\n- CVE-2026-72032: net/mlx5: HWS, fix matcher leak on resize target setup failure (bsc#1276955).\n- CVE-2026-72035: net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1276961).\n- CVE-2026-72036: net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1277034).\n- CVE-2026-72046: gve: fix header buffer corruption with header-split and HW-GRO (bsc#1275519).\n- CVE-2026-72069: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (bsc#1275528).\n- CVE-2026-72072: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (bsc#1277155).\n- CVE-2026-72083: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (bsc#1275535).\n- CVE-2026-72084: scsi: target: Bound PR-OUT TransportID parsing to the received buffer (bsc#1275540).\n- CVE-2026-72123: can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (bsc#1277523).\n- CVE-2026-72132: NFS: Charge unstable writes by request size, not folio size (bsc#1277551).\n- CVE-2026-72221: sunrpc: wait for in-flight TLS handshake callback when cancel loses race (bsc#1275665).\n- CVE-2026-72222: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (bsc#1275669).\n- CVE-2026-72251: netfilter: nf_nat_sip: reload possible stale data pointer (bsc#1275827).\n- CVE-2026-72254: netfilter: nft_fib: reject fib expression on the netdev egress hook (bsc#1277204).\n- CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (bsc#1277678).\n- CVE-2026-72288: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (bsc#1275886).\n- CVE-2026-72289: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (bsc#1275905).\n- CVE-2026-72296: net: ife: require ETH_HLEN to be pullable in ife_decode() (bsc#1275923).\n- CVE-2026-72307: mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() (bsc#1277160).\n- CVE-2026-72308: mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() (bsc#1277159).\n- CVE-2026-72317: SUNRPC: pin upper rpc_clnt across the TLS connect_worker (bsc#1275925).\n- CVE-2026-72341: net/mlx5e: Fix publication race for priv-\u003echannel_stats[] (bsc#1277660).\n- CVE-2026-72342: net/mlx5e: Fix HV VHCA stats agent registration race (bsc#1277775).\n- CVE-2026-72343: net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation (bsc#1277776).\n- CVE-2026-72389: bridge: stp: Fix a potential use-after-free when deleting a bridge (bsc#1273869).\n- CVE-2026-72463: xfrm: Fix dev use-after-free in xfrm async resumption (bsc#1268276 bsc#1277064).\n- CVE-2026-72464: xprtrdma: Remove temp allocation of rpcrdma_rep objects (bsc#1277069).\n- CVE-2026-72466: xprtrdma: Fix bcall rep leak and unbounded peek (bsc#1277057).\n- CVE-2026-72467: xprtrdma: Check frwr_wp_create() during connect (bsc#1277059).\n- CVE-2026-72469: xprtrdma: Fix ep kref imbalance on ADDR_CHANGE (bsc#1277047).\n- CVE-2026-72473: xprtrdma: Avoid 250 ms delay on backlog wakeup (bsc#1277037).\n- CVE-2026-72494: RDMA/irdma: Replace waitqueue and flag with completion (bsc#1276941).\n- CVE-2026-72495: RDMA/bnxt_re: Avoid repeated requests to allocate WC pages (bsc#1276937).\n- CVE-2026-72496: RDMA/bnxt_re: Proper rollback if the ioremap fails (bsc#1276943).\n- CVE-2026-72497: RDMA/bnxt_re: Add a max slot check for SQ (bsc#1276913).\n- CVE-2026-72498: RDMA/bnxt_re: Avoid displaying the kernel pointer (bsc#1276912).\n- CVE-2026-72499: RDMA/bnxt_re: Free CQ toggle page after firmware teardown (bsc#1276551).\n- CVE-2026-72500: RDMA/bnxt_re: Free SRQ toggle page after firmware teardown (bsc#1276552).\n- CVE-2026-72501: RDMA/bnxt_re: Initialize dpi variable to zero (bsc#1276546).\n- CVE-2026-72502: tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) (bsc#1276542).\n- CVE-2026-74269: bnxt: fix head underflow on XDP head-grow (bsc#1276507).\n- CVE-2026-74296: RDMA/mlx5: Release the HW-provided UAR index rather than the SW one (bsc#1276452).\n- CVE-2026-74297: RDMA/mlx5: Fix undefined shift of user RQ WQE size (bsc#1276446).\n- CVE-2026-74318: btrfs: fix deadlock cloning inline extent when using flushoncommit (bsc#1276864).\n- CVE-2026-74321: btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() (bsc#1277202).\n- CVE-2026-74334: RDMA/nldev: Fix locking when accessing mr-\u003epd (bsc#1277095).\n- CVE-2026-74345: RDMA/siw: Fix endpoint/socket association handling (bsc#1277285).\n- CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277408).\n- CVE-2026-74395: RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference (bsc#1277077).\n- CVE-2026-74454: drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO (bsc#1277073).\n- CVE-2026-74474: vxlan: use pskb_network_may_pull() for transmit path header pulls (bsc#1276335).\n- CVE-2026-74481: mm/page_reporting: use system_freezable_wq to fix UAF during suspend (bsc#1276355).\n- CVE-2026-74482: mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios (bsc#1276346).\n- CVE-2026-74488: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (bsc#1276350).\n- CVE-2026-74495: igbvf: Fix leak in TX DMA error cleanup (bsc#1275864).\n- CVE-2026-74496: fou: Fix use-after-free in fou_create() (bsc#1275867).\n- CVE-2026-74509: Bluetooth: hci_sync: Fix advertising data UAFs (bsc#1275946).\n- CVE-2026-74510: Bluetooth: mgmt: fix UAF in pair command cancellation (bsc#1275950).\n- CVE-2026-74512: audit: fix potential use-after-free in audit_del_rule() (bsc#1275954).\n- CVE-2026-74516: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (bsc#1275797).\n- CVE-2026-74518: mm/hugetlb: fix list corruption in allocate_file_region_entries() (bsc#1275798).\n- CVE-2026-74527: octeontx2-af: Block VFs from clobbering special CGX PKIND state (bsc#1275805).\n- CVE-2026-74537: Bluetooth: ISO: hold sk properly in iso_conn_ready (bsc#1275687).\n- CVE-2026-74548: forcedeth: fix UAF of txrx_stats in nv_remove (bsc#1275695).\n- CVE-2026-74550: net: do not send ICMP/NDISC Redirects when peer allocation fails (bsc#1275688).\n- CVE-2026-74556: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (bsc#1275696).\n- CVE-2026-74563: rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() (bsc#1275574).\n- CVE-2026-74566: keys: make keyring key-chunk byte order agree with keyring_diff_objects() (bsc#1275566).\n- CVE-2026-74567: keys: fix out-of-bounds read in keyring_get_key_chunk() (bsc#1275569).\n- CVE-2026-74571: btrfs: skip global block reserve accounting for rescue mounts (bsc#1275561).\n- CVE-2026-74577: net: mpls: initialize rtm_tos in mpls_getroute() (bsc#1275572).\n- CVE-2026-74581: net: ipv6: clear suppressed fib6 rule result (bsc#1275782).\n- CVE-2026-74582: packet: use consistent hard_header_len in non-ring send paths (bsc#1275784).\n- CVE-2026-74584: RDMA/bnxt_re: zero shared page before exposing to userspace (bsc#1277066).\n- CVE-2026-74610: tls: don't leave a full plaintext sk_msg ring unpushed (bsc#1277054).\n- CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277391).\n- CVE-2026-74692: net/smc: fix TOCTOU race between smc_listen_out() and listener close (bsc#1276927).\n- CVE-2026-74694: net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length (bsc#1277625).\n- CVE-2026-74695: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() (bsc#1276931).\n- CVE-2026-74712: vdpa/mlx5: Fix buffer length in create_direct_keys() (bsc#1276577).\n- CVE-2026-74717: net/mlx5: fw_tracer, return NULL on create error (bsc#1276569).\n- CVE-2026-74722: btrfs: fix memory leak in btrfs_do_encoded_write() (bsc#1276561).\n- CVE-2026-80529: xfs: don't swallow dquot recovery verification errors (bsc#1277688).\n- CVE-2026-80534: xfs: fix ilock leak on error in xfs_dq_get_next_id (bsc#1277022).\n- CVE-2026-80590: inet: frags: strip GSO state from fragments before reassembly (bsc#1277275).\n- CVE-2026-80654: soc: xilinx: Shutdown and free rx mailbox channel (bsc#1277516).\n- CVE-2026-90082: net: mana: Cap MSI-X vectors to the device MSI-X table size \n\nThe following non security issues were fixed:\n\n- accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() (git-fixes).\n- accessibility: speakup: unregister tty ldisc on later init failures (git-fixes).\n- ACPI: APEI: Fix ERST timeout unit conversion (git-fixes).\n- ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer (git-fixes).\n- ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root (git-fixes).\n- ACPI: pfr_update: fix stack buffer overflow in query_capability() (git-fixes).\n- ACPI: processor: idle: Expand _LPI package sanity checks (git-fixes).\n- ACPI: processor: validate MADT IOAPIC entry bounds (git-fixes).\n- ACPI: scan: fix bus ID cleanup on device_add() failures (git-fixes).\n- ACPI: video: Release PCI device reference after lookup (git-fixes).\n- add my missing Reviewed-by: tag.\n- ALSA: 6fire: bound the MIDI event length from the device (git-fixes).\n- ALSA: 6fire: Fix UAF at error handling during probe (stable-fixes).\n- ALSA: bcd2000: clear the URB pointers on disconnect (git-fixes).\n- ALSA: control: Don't add invalid kcontrols to LED layer (git-fixes).\n- ALSA: core: Fix use-after-free in snd_card_do_free() (git-fixes).\n- ALSA: dummy: Check card index validity at probe (stable-fixes).\n- ALSA: hda/ext: preserve PPLCCTL bits when clearing reset (git-fixes).\n- ALSA: hda: Fix connection list comparison in proc output (git-fixes).\n- ALSA: hpi: Check transport errors during HPI6000 adapter initialization (git-fixes).\n- ALSA: pcxhr: initialize mutexes before requesting threaded IRQ (git-fixes).\n- ALSA: scarlett2: Use a private URB for the notification endpoint (git-fixes).\n- ALSA: seq: Don't leak the extension cell pointer in the bounce payload (git-fixes).\n- ALSA: seq: midi: Optimize event_input locking with RCU (git-fixes).\n- ALSA: seq: midi: Serialize input teardown with event_input (git-fixes).\n- ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion (git-fixes).\n- ALSA: usb-audio: Complete cleanup after system-resume errors (git-fixes).\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() (git-fixes).\n- ALSA: usb-audio: fix OOB write on Type II inbound URBs (git-fixes).\n- ALSA: usb: Fix UAF at delayed release of MIDI2 EPs (git-fixes).\n- ALSA: usx2y: bound the hwdep mmap fault offset (git-fixes).\n- ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() (git-fixes).\n- apparmor: advertise the tcp fast open fix is applied (git-fixes).\n- arm64: Exclude nohz_full CPUs from 32bits el0 support (bsc#1269313).\n- ASoC: adau1761: sort the register default table (git-fixes).\n- ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC (git-fixes).\n- ASoC: apple: mca: increase SERDES reset delay (git-fixes).\n- ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses (git-fixes).\n- ASoC: cs35l33: drain threaded IRQ before runtime suspend (git-fixes).\n- ASoC: cs35l34: drain threaded IRQ before runtime suspend (git-fixes).\n- ASoC: cs35l41: sort the register default table (git-fixes).\n- ASoC: cs35l45: sort the register default table (git-fixes).\n- ASoC: cs4265: sort the register default table (git-fixes).\n- ASoC: cx2072x: sort the register default table (git-fixes).\n- ASoC: dapm: Fix off-by-one check on the second enum channel (git-fixes).\n- ASoC: fix unmet dependencies on PPC_BESTCOMM and SND_SOC_AC97_BUS (git-fixes).\n- ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready (git-fixes).\n- ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure (git-fixes).\n- ASoC: fsl_audmix: rework runtime PM handling in probe (git-fixes).\n- ASoC: fsl_easrc: sort the register default table (git-fixes).\n- ASoC: hdac_hda: Fix hlink refcount leak on component registration failure (git-fixes).\n- AsoC: intel: sst: fix PCI device reference leak on probe failure (git-fixes).\n- ASoC: max9860: sort the register default table (git-fixes).\n- ASoC: meson: Keep link pointers valid on realloc failure (git-fixes).\n- ASoC: ml26124: sort the register default table (git-fixes).\n- ASoC: pcm512x: sort the register default table (git-fixes).\n- ASoC: pxa: Use devm_clk_get_optional() for extclk clock (git-fixes).\n- ASoC: qcom: q6apm: keep the graph start count in sync with the DSP (git-fixes).\n- ASoC: rt274: sort the register default table (git-fixes).\n- ASoC: rt286: sort the register default table (git-fixes).\n- ASoC: rt298: sort the register default table (git-fixes).\n- ASoC: rt700-sdw: always drain jack work on remove (git-fixes).\n- ASoC: rt700: drop duplicate reg_default entry (git-fixes).\n- ASoC: rt700: sort the register default table (git-fixes).\n- ASoC: rt711-sdca: sort the register default tables (git-fixes).\n- ASoC: rt711: sort the register default table (git-fixes).\n- ASoC: rt712-sdca-dmic: sort the register default table (git-fixes).\n- ASoC: rt712-sdca-sdw: sort the register default table (git-fixes).\n- ASoC: rt715-sdca: drop duplicate reg_default entries (git-fixes).\n- ASoC: rt715-sdca: sort the register default tables (git-fixes).\n- ASoC: rt715: sort the register default table (git-fixes).\n- ASoC: rt1017-sdca-sdw: sort the register default table (git-fixes).\n- ASoC: rt1316-sdw: sort the register default table (git-fixes).\n- ASoC: rt1318-sdw: sort the register default table (git-fixes).\n- ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get (git-fixes).\n- ASoC: sgtl5000: sort the register default table (git-fixes).\n- ASoC: SOF: pcm: Move period/buffer configuration print after platform open (stable-fixes).\n- ASoC: sof: pcm: use snd_pcm_direction_name() (stable-fixes).\n- ASoC: SOF: Relocate and rework functionality for PCM stream freeing (stable-fixes).\n- ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() (git-fixes).\n- ASoC: SOF: validate topology volume range before allocation (git-fixes).\n- ASoC: sti-sas: sort the register default table (git-fixes).\n- ASoC: tas2552: sort the register default table (git-fixes).\n- ASoC: tas2764: sort the register default table (git-fixes).\n- ASoC: tas2780: sort the register default table (git-fixes).\n- ASoC: tegra210_i2s: sort the register default table (git-fixes).\n- ASoC: tegra210_mixer: sort the register default table (git-fixes).\n- ASoC: tegra: Fix the MIXER enable default value (git-fixes).\n- ASoC: tegra: Sort MBDRC register defaults (git-fixes).\n- ASoC: xilinx: formatter_pcm: fix stream_data leak on open error (git-fixes).\n- ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers (git-fixes).\n- batman-adv: bla: fix freeing of claims on meshif deletion (git-fixes).\n- batman-adv: bla: prevent CRC corruptions after claim flush (git-fixes).\n- batman-adv: dat: avoid unaligned fault in IP extraction (git-fixes).\n- batman-adv: fix stale receive device on merged fragments (git-fixes).\n- Bluetooth: btintel: Fix diagnostics event detection (git-fixes).\n- Bluetooth: btmtk: Do not discard the subsystem reset timeout (git-fixes).\n- Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read() (stable-fixes).\n- Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path (git-fixes).\n- Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX (git-fixes).\n- Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event (git-fixes).\n- Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() (git-fixes).\n- Bluetooth: do not leak an hci_conn when a second LE connect is rejected (git-fixes).\n- Bluetooth: eir: Fix OOB read in eir_get_service_data() (git-fixes).\n- Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378 (git-fixes).\n- Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_conn: fix the SCO setup context lifetime (git-fixes).\n- Bluetooth: hci_conn: hold conn reference in abort_conn_sync() (git-fixes).\n- Bluetooth: hci_conn: re-enable advertising only for peripheral role (git-fixes).\n- Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb (git-fixes).\n- Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection (git-fixes).\n- Bluetooth: hci_event: fix LE list UAF on reset (git-fixes).\n- Bluetooth: hci_event: validate LE Set CIG Parameters response (git-fixes).\n- Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative (git-fixes).\n- Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request (git-fixes).\n- Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths (git-fixes).\n- Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists (stable-fixes).\n- Bluetooth: hci_uart: Fix false success return in hci_uart_setup() (git-fixes).\n- Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready (git-fixes).\n- Bluetooth: MGMT: free the mesh send cancel command when it is cancelled (git-fixes).\n- Bluetooth: MSFT: validate evt_prefix_len against the response length (git-fixes).\n- Bluetooth: RFCOMM: serialize security confirmation handling (git-fixes).\n- Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept (git-fixes).\n- Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (git-fixes).\n- Bluetooth: virtio_bt: avoid OOB read of build info string (git-fixes).\n- bnxt_en: Adjust TX rings if reservation is less than requested (jsc#PED-16798).\n- bnxt_en: Delay for 5 seconds after AER DPC for all chips (jsc#PED-16798).\n- bnxt_en: Don't assume XDP is never enabled in bnxt_init_dflt_ring_mode() (jsc#PED-16798).\n- bnxt_en: Drop pci_save_state() after pci_restore_state() (jsc#PED-16798).\n- bnxt_en: Implement XDP RSS hash metadata extraction (jsc#PED-16798).\n- bnxt_en: Implement XDP RSS hash metadata extraction for V3_CMP (jsc#PED-16798).\n- bnxt_en: Move bnxt_rss_ext_op into header (jsc#PED-16798).\n- bnxt_en: Refactor some basic ring setup and adjustment logic (jsc#PED-16798).\n- bnxt_en: Restore default stat ctxs for ULP when resource is available (jsc#PED-16798).\n- bnxt_en: Set bp-\u003emax_tpa according to what the FW supports (jsc#PED-16798).\n- bnxt_en: Use absolute target ns from ptp_clock_request (jsc#PED-16798).\n- bnxt_en: use bnxt_xdp_buff for xdp context (jsc#PED-16798).\n- bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation (git-fixes).\n- bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET (git-fixes).\n- bus: ti-sysc: Fix /chosen node reference leak (git-fixes).\n- cacheinfo: don't propagate DT/ACPI error when arch supplies info (arm64) (git-fixes).\n- can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking (stable-fixes).\n- cpufreq: intel_pstate: Use correct scaling factor on Raptor Lake-E (bsc#1240957 bsc#1249104 bsc#1265220).\n- cpufreq: intel_pstate: Use CPPC to get scaling factors (bsc#1240957 bsc#1249104 bsc#1265220).\n- cpufreq: intel_pstate: Use HYBRID_SCALING_FACTOR_ADL for Bartlett Lake (bsc#1240957 bsc#1249104 bsc#1265220).\n- crypto: aspeed - Propagate platform_get_irq() errors (git-fixes).\n- crypto: atmel-sha204a - fix heap info leak on I2C transfer failure (git-fixes).\n- crypto: atmel-tdes - use scatterlist length before DMA mapping (git-fixes).\n- crypto: ccm - Set rfc4309 maxauthsize from child (git-fixes).\n- crypto: ccp - Fix memory leak in SEV INIT_EX path (git-fixes).\n- crypto: ccp - Fix possible deadlock in SEV init failure path (git-fixes).\n- crypto: doc - Remove extra parenthesis (git-fixes).\n- crypto: hisilicon/sec2 - fix CCM algorithm long packet failure (git-fixes).\n- crypto: keembay - Initialize completion before requesting IRQ (git-fixes).\n- crypto: keembay - publish OF module alias for OCS AES/SM4 (git-fixes).\n- crypto: mxs-dcp - fix source scatterlist length access (git-fixes).\n- crypto: qat - cancel work on re-enable SR-IOV timeout (git-fixes).\n- crypto: qat - clear AES key schedule from stack (git-fixes).\n- crypto: qce - fix CCM AAD buffer underallocation (git-fixes).\n- crypto: qce - fix error path in devm_qce_register_algs (git-fixes).\n- crypto: rk3288 - fail ahash requests on HASH idle timeout (git-fixes).\n- crypto: sa2ul - stop probe if context pool creation fails (git-fixes).\n- crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping (git-fixes).\n- device property: fix infinite loop in fwnode_for_each_child_node() (git-fixes).\n- dmaengine: dw-edma: Clear stale requests on termination (git-fixes).\n- dmaengine: dw-edma: Complete descriptors before pausing (git-fixes).\n- dmaengine: dw-edma: Initialize IRQ data before requesting IRQs (git-fixes).\n- dmaengine: dw-edma: Serialize abort state updates (git-fixes).\n- dmaengine: dw-edma: Serialize channel state checks (git-fixes).\n- dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe (git-fixes).\n- dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure (git-fixes).\n- dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal (git-fixes).\n- dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers (git-fixes).\n- dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout (git-fixes).\n- driver core: soc: Unregister bus on early device registration failure (git-fixes).\n- drm/amd/display: Add AV mute wait frames to dce110_set_avmute (stable-fixes).\n- drm/amd/display: avoid divide-by-zero in __is_lut_linear() (git-fixes).\n- drm/amd/display: Check for tg ops in dce110_set_avmute (git-fixes).\n- drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix (git-fixes).\n- drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE (git-fixes).\n- drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank() (git-fixes).\n- drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames (stable-fixes).\n- drm/amd/display: Remove unused-but-set variable hubp from (git-fixes).\n- drm/amd/display: validate plane degamma LUT size for private color prop (git-fixes).\n- drm/amd/pm: adjust the visibility of pp_table sysfs node (stable-fixes).\n- drm/amd/pm: Use same metric table for APU (stable-fixes).\n- drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read (git-fixes).\n- drm/amdgpu/gfx6: Fixup emit_cntxcntl() (git-fixes).\n- drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets (git-fixes).\n- drm/amdgpu/gfx6: Use PFP on the compute queues too (git-fixes).\n- drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup (git-fixes).\n- drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup (git-fixes).\n- drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (git-fixes).\n- drm/amdgpu: cap GTT size to physical RAM on APUs (stable-fixes).\n- drm/amdgpu: check ASPM on the dGPU host link (git-fixes).\n- drm/amdgpu: disallow multiple FENCE chunks in one submit (git-fixes).\n- drm/amdgpu: fix aperture iounmap skipped on device removal (git-fixes).\n- drm/amdgpu: fix autosuspend cleanup during removal (git-fixes).\n- drm/amdgpu: fix nbif 6.3.1 l1 low power not functional (git-fixes).\n- drm/amdgpu: Fix UVD decode image min size calculation (stable-fixes).\n- drm/amdgpu: Fix UVD dpb min size calculation for H264 (stable-fixes).\n- drm/amdgpu: Fix UVD min buffer sizes (stable-fixes).\n- drm/amdgpu: Fix VCE 3 ring align_mask (git-fixes).\n- drm/amdgpu: Implement insert_end for VCE 3 (git-fixes).\n- drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini (git-fixes).\n- drm/amdgpu: read TRUNCATE_COORD_MODE on gfx12 (git-fixes).\n- drm/amdgpu: reject oversized IBs with per-ring packet limits (stable-fixes).\n- drm/amdgpu: Reject UVD message with dimensions above 4096 (stable-fixes).\n- drm/amdgpu: Reject UVD message with invalid number of h265 refs (stable-fixes).\n- drm/amdgpu: remove unused function parameter (stable-fixes).\n- drm/amdgpu: restore UMD profile pstate after runtime resume (stable-fixes).\n- drm/amdgpu: validate GEM_CREATE domain combinations (stable-fixes).\n- drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE (stable-fixes).\n- drm/amdkfd: fix QID bit leak in pqm_create_queue() (stable-fixes).\n- drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore (git-fixes).\n- drm/amdkfd: Handle invalid event type in CRIU event restore (stable-fixes).\n- drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure (git-fixes).\n- drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure (git-fixes).\n- drm/bridge: ps8640: propagate AUX transfer register errors (git-fixes).\n- drm/bridge: tc358767: clamp the reported AUX read size to the request (git-fixes).\n- drm/connector/hdmi: Fix out of bounds memory read (git-fixes).\n- drm/connector: Fix epoch_counter docs to reflect reality (git-fixes).\n- drm/hibmc: Fix list of formats on the primary plane (git-fixes).\n- drm/hibmc: Use drm_atomic_helper_check_plane_state() (git-fixes).\n- drm/i915/fbc: Extract intel_fbc_has_fences() (stable-fixes).\n- drm/i915/hdcp: check streams bounds before overflow (git-fixes).\n- drm/i915/hdcp: Move to using intel_display in intel_hdcp (stable-fixes).\n- drm/i915/hdcp: require monotonically increasing seq_num_v (git-fixes).\n- drm/i915/hdcp: Skip inactive MST connectors when building stream list (stable-fixes).\n- drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() (stable-fixes).\n- drm/i915/vrr: require valid min/max vfreq for VRR (git-fixes).\n- drm/lima: call drm_mm_init() with a valid allocation range (git-fixes).\n- drm/msm/a6xx: Fix RBBM_CLOCK_CNTL3_TP0 value in a730_hwcg (git-fixes).\n- drm/msm/a6xx: Fix stale rpmh votes after suspend (git-fixes).\n- drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0) (git-fixes).\n- drm/msm/dsi: Drop dev_pm_opp_set_rate(0) (git-fixes).\n- drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value (git-fixes).\n- drm/panel-edp: fix i2c adapter leak on probe failure (git-fixes).\n- drm/panel: samsung-s6d16d0: Power off on prepare failure (git-fixes).\n- drm/panthor: fix firmware control interface bounds checks (git-fixes).\n- drm/panthor: return PTR_ERR() from devm_drm_dev_alloc() (git-fixes).\n- drm/panthor: skip zero-sized firmware sections (git-fixes).\n- drm/radeon: fix autosuspend cleanup during teardown (git-fixes).\n- drm/radeon: restore hardware polling in fence_is_signaled to fix performance regression (git-fixes).\n- drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format (git-fixes).\n- drm/ssd130x: fix column and row end address in partial updates for ssd132x (git-fixes).\n- drm/ssd130x: fix column and row end address in partial updates in ssd133x (git-fixes).\n- drm/sun4i: crtc: Propagate layer initialization error (git-fixes).\n- drm/sun4i: Drop node references while building component list (git-fixes).\n- drm/sun4i: dw-hdmi: Drop TCON TOP port reference (git-fixes).\n- drm/sun4i: fix refcount leak in sun4i_backend_init_sat() (git-fixes).\n- drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz (git-fixes).\n- drm/sun4i: hdmi: Don't leak sync polarity bits into packet control (git-fixes).\n- drm/sun4i: tcon: Drop remote endpoint reference (git-fixes).\n- drm/sun4i: tcon: Drop TCON TOP device reference (git-fixes).\n- drm/sun4i: tcon: Set output mux for DSI and LVDS (git-fixes).\n- drm/sun4i: vi scaler: Fix coefficient selection (git-fixes).\n- drm/tegra: dsi: Re-add clear enable register if DSI was powered by bootloader (git-fixes).\n- drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info (git-fixes).\n- drm/tve200: add OF module alias for autoloading (git-fixes).\n- drm/xe/oa: Check managed mutex initialization errors (git-fixes).\n- drm/xe/oa: Fix sync entry leak on OA config emit failure (git-fixes).\n- drm/xe: Introduce xe_gt_dbg_printer() (stable-fixes).\n- drm/xe: Order ring writes before ring tail updates (git-fixes).\n- drm/xe: Stub out new pagefault layer (stable-fixes).\n- drm/xe: tests: fix error message in xe_migrate_sanity_test() (git-fixes).\n- drm: fix race between partial drm_dev_register() failure and ioctl (git-fixes).\n- drm: lcdif: Wait for vblank before disabling DMA (git-fixes).\n- drm: Remove unused header in drm_dumb_buffers.c (git-fixes).\n- ethtool: rss: fix hkey leak when indir_size is 0 (git-fixes).\n- fbdev: bitblit: bound-check glyph index in bit_cursor() (git-fixes).\n- fbdev: core: Fix pointer desynchronization in fb_io_read() (git-fixes).\n- fbdev: kyro: Validate overlay viewport coordinates (git-fixes).\n- fbdev: omapfb: panel-dsi-cm: initialize lock before registering display (git-fixes).\n- fbdev: ssd1307fb: defer I2C transfers from damage callbacks (git-fixes).\n- fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device() (git-fixes).\n- fbdev: uvesafb: unregister connector callback on init failure (git-fixes).\n- firmware: arm_scmi: Avoid IDR updates while cleaning channels (git-fixes).\n- firmware: arm_scmi: Drop handle on protocol bind failures (git-fixes).\n- firmware: arm_scmi: Fix requested device removal race (git-fixes).\n- firmware: arm_scmi: Free transport channel on IDR failure (git-fixes).\n- firmware: arm_scmi: Protect device request lookup with RCU (git-fixes).\n- firmware: arm_scmi: Reject out of range DT protocol IDs (git-fixes).\n- firmware: arm_scmi: Unregister device notifier before IDR teardown (git-fixes).\n- firmware: arm_scmi: Use channel ID for transport teardown (git-fixes).\n- firmware_loader: do not queue completed sysfs fallback requests (git-fixes).\n- fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write (git-fixes).\n- fpga: dfl: fme: add error handling (git-fixes).\n- fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration (git-fixes).\n- gpu: host1x: Avoid stack over-read in debug output helpers (git-fixes).\n- gpu: host1x: Fix offset calculation in trace_write_gather (git-fixes).\n- HID: core: fix number/pointer type confusion on long items (git-fixes).\n- HID: core: fix OOB read of field-\u003eusage in hid_set_field() (git-fixes).\n- HID: hyperv: validate initial device info bounds (git-fixes).\n- HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure (git-fixes).\n- HID: lg4ff: validate report length before fixed offsets (git-fixes).\n- HID: logitech-dj: Fix maxfield check in DJ short report validation (git-fixes).\n- HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report (git-fixes).\n- HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write (stable-fixes).\n- HID: logitech-dj: Standardise hid_report_enum variable nomenclature (stable-fixes).\n- HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID (stable-fixes).\n- HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() (git-fixes).\n- HID: mcp2221: validate report size in mcp2221_raw_event() (git-fixes).\n- HID: nintendo: Fix imu_timestamp_us double increment per report (git-fixes).\n- HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() (git-fixes).\n- HID: picolcd: clamp eeprom debugfs read to bytes actually received (git-fixes).\n- HID: roccat: bound device-supplied profile index (git-fixes).\n- HID: roccat: free buffered reports when destroying device (git-fixes).\n- HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature (git-fixes).\n- HID: sensor: custom: Fix field sysfs group cleanup on failure (git-fixes).\n- HID: sensor: custom: Fix use-after-free in enable_sensor (git-fixes).\n- HID: tmff: Use 64-bit arithmetic for force feedback scaling (git-fixes).\n- hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination (git-fixes).\n- hwmon: (lm25066) Use i2c_get_match_data() (stable-fixes).\n- hwmon: (max6621) fix negative temperature offset and crit readings (git-fixes).\n- hwmon: (max6621) fix temperature clamp range (git-fixes).\n- hwmon: (nzxt-smart2) Check return value of init_device() in probe (git-fixes).\n- hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations (git-fixes).\n- hwrng: ks-sa - Fix runtime PM cleanup on registration failure (git-fixes).\n- hwrng: omap - Fix probe error path cleanup (git-fixes).\n- hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() (git-fixes).\n- i2c: bcm-iproc: remove printout on handled timeouts (stable-fixes).\n- i2c: core: fix debugfs UAF on adapter removal (git-fixes).\n- i2c: iproc: reset bus after timeout if START_BUSY is stuck (git-fixes).\n- i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure (git-fixes).\n- i2c: mux: Fix channel node leak on adapter add failure (git-fixes).\n- i2c: ocores: Disable clock on failed resume (git-fixes).\n- i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices (git-fixes).\n- i3c: master: Fix device_register() error path (git-fixes).\n- i3c: master: Fix info leak and UAF in device unregister path (git-fixes).\n- i3c: master: Fix potential UAF in i3c_device_uevent() (git-fixes).\n- i3c: master: svc: bound IBI payload to the requested max_payload_len (git-fixes).\n- ibmvnic: Only record tx completed bytes once per handler (bsc#1274620).\n- iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE (git-fixes).\n- iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable (git-fixes).\n- iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF (git-fixes).\n- iio: chemical: sgp30: Handle IAQ thread creation failure (git-fixes).\n- iio: dac: m62332: Fix regulator reference count imbalance (git-fixes).\n- iio: gyro: mpu3050: fix sign of raw angular velocity readings (git-fixes).\n- iio: light: cm32181: return zero after writing calibscale (git-fixes).\n- iio: light: gp2ap002: Disable regulators on resume failure (git-fixes).\n- iio: light: gp2ap002: re-enable irq if runtime suspend fails (git-fixes).\n- iio: light: isl29028: return zero in write_raw() on success (git-fixes).\n- iio: light: tsl2583: return zero in write_raw() on success (git-fixes).\n- iio: light: tsl2772: fix ALS calibscale readback (git-fixes).\n- iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure (git-fixes).\n- iio: pressure: dps310: fix NULL pointer dereference on ACPI probe (git-fixes).\n- iio: pressure: mpl115: Fix runtime PM cleanup (git-fixes).\n- iio: srf04: fix pm_runtime handling on probe error path (git-fixes).\n- iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() (git-fixes).\n- Input: atkbd - skip deactivate for HONOR ZQC-P (git-fixes).\n- Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard (stable-fixes).\n- Input: evdev - fix information leak in evdev_pass_values() (stable-fixes).\n- Input: evdev - sanitize event type index when fetching event masks (stable-fixes).\n- Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet (git-fixes).\n- Input: focaltech - use signed coordinates to prevent underflow (git-fixes).\n- Input: hynitron_cstxxx - validate touch count and finger IDs (git-fixes).\n- Input: iforce - validate input packet lengths (stable-fixes).\n- Input: iqs5xx - validate firmware record destination span (git-fixes).\n- Input: mms114 - fix Y-resolution configuration (git-fixes).\n- Input: psxpad-spi - set driver data before use (git-fixes).\n- Input: sur40 - fix input device registration ordering (stable-fixes).\n- Input: sur40 - fix V4L error path cleanup (stable-fixes).\n- Input: synaptics-rmi4 - block s_input when F54 queue is busy (git-fixes).\n- Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer (git-fixes).\n- Input: synaptics-rmi4 - fix F55 transmitter electrode count typo (git-fixes).\n- Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue (git-fixes).\n- Input: synaptics-rmi4 - zero report size on F54 work error (git-fixes).\n- Input: xpad - add support for ZENAIM LEVERLESS (stable-fixes).\n- interconnect: Fix use after free in icc_get() and of_icc_get_by_index() (git-fixes).\n- ipmi: ipmb: validate write message length (git-fixes).\n- ipmi: si: Fix NULL pointer dereference after failed registration (git-fixes).\n- kthread: Default affine kthread to its preferred NUMA node (bsc#1269313).\n- kthread: Make sure kthread hasn't started while binding it (bsc#1269313).\n- KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes).\n- KVM: PPC: Book3S HV: Add support for compat CPU capabilities for KVM on PowerNV (bsc#1263864 ltc#217835).\n- KVM: PPC: Book3S HV: Implement compat CPU capability retrieval for KVM on PowerVM (bsc#1263864 ltc#217835).\n- KVM: PPC: Book3S HV: Validate arch_compat against host compatibility mode (bsc#1263864 ltc#217835).\n- KVM: PPC: Document KVM_PPC_GET_COMPAT_CAPS ioctl (bsc#1263864 ltc#217835).\n- KVM: PPC: Introduce KVM_CAP_PPC_COMPAT_CAPS and wire up ioctl (bsc#1263864 ltc#217835).\n- KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page (git-fixes).\n- leds: pca9532: Fix inverted GPIO output polarity (git-fixes).\n- leds: pca9532: Fix phantom device registration on missing hardware (git-fixes).\n- lib/string: fix memchr_inv() for large ranges (git-fixes).\n- lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() (git-fixes).\n- mailbox: qcom-ipcc: fix duplicate channel allocation across holes (git-fixes).\n- mailbox: rockchip: disable pclk on probe failure and unbind (git-fixes).\n- maple_tree: fix argument name in header (git-fixes).\n- md/raid1: create serial pool adding rdev to array with serialize_policy=1 (bsc#1272261).\n- media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref (git-fixes).\n- media: amphion: Remove obsolete frame_count check in venc_start_session (git-fixes).\n- media: cec-pin: Fix event FIFO ordering (git-fixes).\n- media: cec: disable delayed work before freeing an interrupted transmit (git-fixes).\n- media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash (git-fixes).\n- media: cec: Serialize exclusive follower delivery (git-fixes).\n- media: cec: stm32: prevent out-of-bounds write on RX overflow (git-fixes).\n- media: cedrus: fix memory leak in cedrus_init_ctrls() (git-fixes).\n- media: cobalt: Avoid freeing ALSA private data twice (git-fixes).\n- media: cx231xx: reject geometry changes while the VBI queue is busy (git-fixes).\n- media: cx23885: cancel NetUP CI work before teardown (git-fixes).\n- media: em28xx: defer audio-only extension registration (git-fixes).\n- media: em28xx: fix use-after-free of dev_next-\u003edevlist on disconnect (git-fixes).\n- media: go7007: defer the ALSA v4l2 put until card release (git-fixes).\n- media: i2c: imx219: Rename VTS to FRM_LENGTH (stable-fixes).\n- media: i2c: ov02a10: fix endpoint parsing use-after-free (git-fixes).\n- media: i2c: ov7740: fix use-after-destroy in remove (git-fixes).\n- media: i2c: rdacm21: Fix missing media_entity_cleanup() (git-fixes).\n- media: imx219: Fix maximum frame length in lines (git-fixes).\n- media: intel/ipu6: fix async notifier cleanup leak on parse error (git-fixes).\n- media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define (git-fixes).\n- media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define (git-fixes).\n- media: mc-entity: Add missing kerneldoc (git-fixes).\n- media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common (git-fixes).\n- media: nxp: imx8-isi: Correct color map between V4L2 and ISI (git-fixes).\n- media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing (git-fixes).\n- media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks (git-fixes).\n- media: rc: sunxi-cir: Unregister rc device on probe failure (git-fixes).\n- media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure (git-fixes).\n- media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak (git-fixes).\n- media: s2255: bound JPEG frame size before copying into the buffer (git-fixes).\n- media: s2255: check firmware size before reading trailing marker (git-fixes).\n- media: saa7164: fix cleanup on resource allocation failure (git-fixes).\n- media: tda18250: fix possible integer overflow (git-fixes).\n- media: usbtv: keep device alive while ALSA card exists (git-fixes).\n- media: v4l2-async: avoid deleting unlinked ASC entry on link error (git-fixes).\n- media: v4l2-async: Unregister sub-device if asc_list is empty (git-fixes).\n- media: v4l2-ctrls: Allow unknown HDR10 white point and luminance (git-fixes).\n- media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link (git-fixes).\n- media: venus: fix payload size calculation in parse_raw_formats() (git-fixes).\n- media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() (git-fixes).\n- media: vicodec: fix out-of-bounds write in FWHT encoder (git-fixes).\n- media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure (git-fixes).\n- media: vimc: fix pixel format lookup in enum_framesizes (git-fixes).\n- media: zoran: Avoid freeing a registered video_device twice (git-fixes).\n- mei: pull kvfree out of spinlock (git-fixes).\n- mfd: iqs62x: Reject zero-length firmware records (git-fixes).\n- mfd: rave-sp: validate received frame payload lengths (git-fixes).\n- misc: bcm-vk: Use acquire/release for msgq_inited (git-fixes).\n- misc: fastrpc: fix channel ctx ref leak when session alloc fails (git-fixes).\n- misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free (git-fixes).\n- misc: fastrpc: Remove buffer from list prior to unmap operation (git-fixes).\n- misc: fastrpc: take fl-\u003elock when moving mmaps on interrupted invoke (git-fixes).\n- misc: rtsx: add missing write register handling (git-fixes).\n- misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() (git-fixes).\n- mkspec-dtb: Move DTS prefix into package list.\n- mkspec-dtb: Move provides-obsoletes to package list.\n- mkspec-dtb: Put per-architecture package lists into a hash.\n- mkspec-dtb: re-indent.\n- mm: Create/affine kcompactd to its preferred node (bsc#1269313).\n- mm: Create/affine kswapd to its preferred node (bsc#1269313).\n- mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit (git-fixes).\n- mmc: sdhci: unmap the bounce buffer before device release (git-fixes).\n- mmc: via-sdmmc: stop card-detect handling on probe failure (git-fixes).\n- mtd: afs: validate v2 image info bounds (git-fixes).\n- mtd: mtdoops: free page bitmap when the backing MTD is removed (git-fixes).\n- mtd: mtdswap: Avoid freeing registered blktrans device twice (git-fixes).\n- mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() (git-fixes).\n- mtd: rawnand: validate ONFI extended parameter page sections (git-fixes).\n- net: mana: Add debug knob to skip TX timeout recovery reset (git-fixes).\n- net: mana: Add handler for sriov configure (bsc#1272756).\n- net: mana: Cap MSI-X vectors to the device MSI-X table size (git-fixes).\n- net: mana: Extend RX CQE coalescing up to 8 packets (git-fixes).\n- net: mana: Fall back to scattered pages for GDMA queues (git-fixes).\n- net: mana: force full-page RX buffers via ethtool private flag (bsc#1269792).\n- net: mana: refactor mana_get_strings() and mana_get_sset_count() to use switch (bsc#1269792).\n- net: mana: Route ring-buffer access through offset-based helpers (git-fixes).\n- net: tap: set skb-\u003edev before parsing virtio net header in tap_get_user_xdp() (git-fixes bsc#1274550).\n- net: thunderbolt: Count delivered packets in rx_packets and rx_bytes (git-fixes).\n- net: thunderbolt: Mark the connection down when bringing it up fails (git-fixes).\n- net: thunderbolt: Release the Rx HopID that was handed out on mismatch (git-fixes).\n- net: thunderbolt: Tear down DMA paths before stopping the rings (git-fixes).\n- net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() (git-fixes).\n- net: usb: ipheth: fix carrier_work UAF on disconnect (git-fixes).\n- nfc: digital: clamp SENSF_RES length to the destination buffer (git-fixes).\n- nfc: digital: Do not dump a NULL response in command completion (git-fixes).\n- nfc: fdp: bound the device-reported read length and fix an skb leak (git-fixes).\n- nfc: llcp: avoid userspace overflow on invalid optlen (git-fixes).\n- nfc: llcp: bound SNL TLV parsing to the skb and add length checks (git-fixes).\n- nfc: llcp: bound the connect_sn TLV walk to the skb (git-fixes).\n- nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (git-fixes).\n- nfc: llcp: read llcp_sock-\u003elocal under the socket lock in getsockopt (git-fixes).\n- nfc: llcp: reject PDUs shorter than the LLCP header (git-fixes).\n- nfc: microread: validate target discovery payload lengths (git-fixes).\n- nfc: nci: fix double completion race in nci_data_exchange_complete (git-fixes).\n- nfc: nci: fix out-of-bounds write in nci_target_auto_activated() (git-fixes).\n- nfc: nci: fix uninit-value in the RF discover/activated NTF handlers (git-fixes).\n- nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing (git-fixes).\n- nfc: nci: free destination parameters when closing a connection (git-fixes).\n- nfc: pn533: hold a reference to the request skb during send_frame (git-fixes).\n- nfc: pn533: purge fragmented skbs during cleanup (git-fixes).\n- nfc: st21nfca: validate ATR_REQ length against the received frame (git-fixes).\n- nouveau/gem: reserve the bo in the info ioctl around the vma lookup (git-fixes).\n- of: fix out-of-bounds read in of_alias_scan() stem parser (git-fixes).\n- PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] (git-fixes).\n- PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk (git-fixes).\n- PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip (git-fixes).\n- PCI: j721e: Fix incorrect max_lanes for J7200 (git-fixes).\n- PCI: meson: Fix GPIO state while requesting PERST# (git-fixes).\n- phy: qcom: qmp-combo: Correct pre-emphasis table for QMP v4 DP PHYs (git-fixes).\n- phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend (git-fixes).\n- phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table (git-fixes).\n- phy: sunplus: fix error handling in sp_uphy_init() (git-fixes).\n- pinctrl: bcm2835: Don't remove an unregistered GPIO chip (git-fixes).\n- pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 (git-fixes).\n- pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip (git-fixes).\n- pinctrl: rockchip: Reset the pin count when recalculating SoC data (git-fixes).\n- platform/chrome: cros_ec_debugfs: Clean up console log on probe failure (git-fixes).\n- platform/chrome: cros_ec_debugfs: Unregister panic notifier (git-fixes).\n- platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count (git-fixes).\n- platform/chrome: sensorhub: Bound the EC-reported sensor number (git-fixes).\n- platform/chrome: sensorhub: Fix dropped timestamp events and log spam (git-fixes).\n- platform/chrome: sensorhub: Fix memory overread in ring handler (git-fixes).\n- platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL (git-fixes).\n- platform/surface: acpi-notify: Check ACPI companion before use (git-fixes).\n- platform/x86/amd/hsmp: Reject negative power cap writes in hwmon (git-fixes).\n- platform/x86: dell-privacy: Fix race condition (git-fixes).\n- platform/x86: dell-wmi-base: Fix resource leak on module load failure (git-fixes).\n- platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer (git-fixes).\n- platform/x86: dell-wmi-sysman: Fix instance ID bounds (git-fixes).\n- platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS (git-fixes).\n- platform/x86: hp-bioscfg: advance elem past consumed array elements (git-fixes).\n- platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() (git-fixes).\n- platform/x86: hp-bioscfg: fix heap OOB read on empty password write (git-fixes).\n- platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password (git-fixes).\n- platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() (git-fixes).\n- platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed (git-fixes).\n- platform/x86: hp-bioscfg: fix password encoding bounds check (git-fixes).\n- platform/x86: hp-bioscfg: warn on element type mismatch instead of failing (git-fixes).\n- platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path (git-fixes).\n- platform/x86: ISST: Add a NULL check for sst_inst (git-fixes).\n- platform/x86: ISST: Just allow 2 bits for SST feature enable (git-fixes).\n- platform/x86: ISST: Return error during profile addition (git-fixes).\n- platform/x86: ISST: Use PP level enable mask (git-fixes).\n- platform/x86: ISST: Validate level in perf mask ioctls (git-fixes).\n- platform/x86: ISST: Validate logical CPU id and clos id (git-fixes).\n- platform/x86: ISST: Validate parameter for core power state (git-fixes).\n- platform/x86: ISST: Validate socket ID in clos_assoc ioctl (git-fixes).\n- PM: sleep: Fix off-by-one in wakelocks number limit check (git-fixes).\n- power: supply: bd99954: Drop bad register fields (git-fixes).\n- power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address (git-fixes).\n- power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address (git-fixes).\n- power: supply: bq27xxx: bq27520g4: fix REG_TTES address (git-fixes).\n- power: supply: bq256xx: drain usb_work before freeing the charger (git-fixes).\n- power: supply: bq24257: fix use-after-free on remove (git-fixes).\n- power: supply: bq25890: Fix power_supply reference leak (git-fixes).\n- power: supply: cros_usbpd-charger: bound the EC-reported port count (git-fixes).\n- power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS (git-fixes).\n- power: supply: isp1704_charger: cancel work on remove (git-fixes).\n- power: supply: lp8727: fix use-after-free in lp8727_release_irq() (git-fixes).\n- power: supply: max17040: drop incorrect I2C functionality check (git-fixes).\n- power: supply: max17040: synchronize work cancellation on suspend (git-fixes).\n- power: supply: qcom_battmgr: terminate the strings from firmware (git-fixes).\n- power: supply: rt9455: quiesce delayed work before teardown (git-fixes).\n- power: supply: sbs-battery: Use a per-device serial number buffer (git-fixes).\n- power: supply: twl4030_charger: cancel workers via devm (git-fixes).\n- power: supply: ucs1002: fix use-after-free on remove (git-fixes).\n- powercap: intel_rapl_tpmi: Handle PMU registration failure during probe (git-fixes).\n- powerpc/dt_cpu_ftrs: Set CPU_FTR_P11_PVR for Power11 and later processors (bsc#1263864 ltc#217835).\n- powerpc/pseries: Ensure vpa,slb_shadow \u0026 dtl are unregistered during crash (bsc#1271256).\n- powerpc/pseries: lparcfg - fix kbuf[] underflow (bsc#1274753 ltc#221289 bsc#1274754 ltc#221288 bsc#1274752\n  ltc#221290).\n- powerpc/pseries: pci - logic bug (bsc#1274749 ltc#221282 bsc#1274755 ltc#221284 bsc#1274756 ltc#221283).\n- powerpc: Replace __ASSEMBLY__ with __ASSEMBLER__ in non-uapi headers (bsc#1263864 ltc#217835).\n- powerpc: Replace __ASSEMBLY__ with __ASSEMBLER__ in uapi headers (bsc#1263864 ltc#217835).\n- ppdev: prevent overflow when setting port timeout (git-fixes).\n- qede: fix out-of-bounds check for cqe-\u003elen_list (git-fixes).\n- rapidio: clear mport-\u003enet when rio_add_net() fails (git-fixes).\n- rapidio: mport_cdev: fix use-after-free in dma_req_free() (git-fixes).\n- RDMA/irdma: Remove redundant legacy_mode checks (git-fixes).\n- RDMA/mana_ib: drain QP references after partial table insertion (git-fixes).\n- RDMA/mana_ib: unify QP lookup table (git-fixes).\n- RDMA/mlx5: Fix integer overflow of user QP buffer size (git-fixes).\n- regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer (git-fixes).\n- regulator: core: use system_freezable_wq for init complete work (git-fixes).\n- regulator: devres: add API for reference voltage supplies (stable-fixes).\n- regulator: devres: fix devm_regulator_get_enable_read_voltage() return (git-fixes).\n- regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata (git-fixes).\n- regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling (git-fixes).\n- remoteproc: qcom: Fix glink-\u003enode reference leak in qcom_add_glink_subdev (git-fixes).\n- remoteproc: qcom_q6v5_adsp: Fix reference leak for device node (git-fixes).\n- remoteproc: scp: Fix device reference leak on failed lookup (git-fixes).\n- Revert 'drm/amdgpu: fix aperture mapping leak' (git-fixes).\n- Revert 'media: v4l2-dev: fix error handling in __video_register_device()' (git-fixes).\n- Revert 'thermal/drivers/hwmon: Cleanup coding style a bit' (stable-fixes).\n- rpmsg: core: Fix incorrect return value documentation (git-fixes).\n- rpmsg: glink: smem: order FIFO read after availability check (git-fixes).\n- rtc: gamecube: check return value of devm_rtc_register_device() (git-fixes).\n- rtc: pcf8563: fix clock provider leak on unbind (git-fixes).\n- rtc: pcf85363: Add error checking to regmap calls in probe() (git-fixes).\n- rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers (git-fixes).\n- rtc: rzn1: Fix weekday underflow when alarm crosses month boundary (git-fixes).\n- rtc: zynqmp: Return optional clock lookup errors (git-fixes).\n- sched,arm64: Handle CPU isolation on last resort fallback rq (bsc#1269313).\n- scsi: fnic: Abort timed-out NVMe LS requests (bsc#1236344).\n- scsi: fnic: Add FDLS role handling for NVMe initiators (bsc#1236344).\n- scsi: fnic: Add the NVMe/FC transport path (bsc#1236344).\n- scsi: fnic: Advertise NVMe initiator service parameters (bsc#1236344).\n- scsi: fnic: Bump up version number (bsc#1236344).\n- scsi: fnic: Decode firmware role configuration (bsc#1236344).\n- scsi: fnic: Do not use GFP_ZERO for mempools (bsc#1236344).\n- scsi: fnic: Expose NVMe transport state in debugfs (bsc#1236344).\n- scsi: fnic: Handle NVMe LS frames in FDLS (bsc#1236344).\n- scsi: fnic: Make debug logging protocol independent (bsc#1236344).\n- scsi: fnic: Make fnic_queuecommand() easier to analyze (bsc#1236344).\n- scsi: fnic: Refactor in_remove flag and call to fnic_fcpio_reset() (bsc#1236344).\n- scsi: fnic: Remove a useless struct mempool forward declaration (bsc#1236344).\n- scsi: fnic: Rename fnic_scsi_fcpio_reset() (bsc#1236344).\n- scsi: fnic: Route completions and resets by initiator role (bsc#1236344).\n- scsi: fnic: Self-assignment of intr_time_type has no effect (bsc#1236344).\n- scsi: fnic: Send NVMe LS requests through FDLS (bsc#1236344).\n- scsi: fnic: Switch to use %ptSp (bsc#1236344).\n- scsi: fnic: Track NVMe transport statistics (bsc#1236344).\n- scsi: fnic: Use fnic_num for non-SCSI identifiers (bsc#1236344).\n- scsi: fnic: Use mempool for receive frames (bsc#1236344).\n- scsi: qla2xxx: Declare qla2xxx_mqueuecommand() static (bsc#1275737).\n- scsi: qla2xxx: Use nr_cpu_ids instead of NR_CPUS for qp_cpu_map allocation (bsc#1275737).\n- scsi: storvsc: Support manual scans for all Hyper-V targets (git-fixes).\n- sctp: avoid auth_enable sysctl UAF during netns teardown (git-fixes).\n- serial: 8250_dma: Clear stale RX state on shutdown (git-fixes).\n- serial: amba-pl011: unprepare console clock on unregister (git-fixes).\n- serial: core: clear freed pointers on uart_register_driver() failure (git-fixes).\n- serial: qcom-geni: fix TX DMA buffer flush (git-fixes).\n- serial: sc16is7xx: fix copy-paste errors in EFR_SWFLOWx_BIT constants (stable-fixes).\n- smb/client: handle overlapping allocated ranges in fallocate (bsc#1274902).\n- smb: client: reject overlapping data areas in SMB2 responses (git-fixes).\n- smb: client: require net admin for CIFS SWN netlink (bsc#1273966).\n- smb: client: resolve SWN tcon from live registrations (bsc#1273872).\n- soc: fsl: qe: check platform_driver_register() in qe_ic_of_init() (git-fixes).\n- soc: qcom: rpmh-rsc: manage PM notifiers with devres (git-fixes).\n- soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() (git-fixes).\n- software node: Fix software_node_get_reference_args() with index -1 (git-fixes).\n- soundwire: qcom: Fix port exhaustion check in stream_alloc_ports (git-fixes).\n- speakup: keyhelp: guard letter_offsets possible out-of-range indexing (git-fixes).\n- spi: img-spfi: don't disable runtime PM on DMA deferred probe (git-fixes).\n- spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers (stable-fixes).\n- spi: sprd-adi: Fix probe succeeding without registering the controller (git-fixes).\n- staging: fbtft: Use sysfs_emit_at() to print to sysfs file (git-fixes).\n- staging: media: tegra-video: fix of_node_put() on VIP parse errors (git-fixes).\n- staging: media: tegra-video: vi: fix probe failure on skipped last port (git-fixes).\n- staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown (git-fixes).\n- staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() (git-fixes).\n- staging: rtl8723bs: fix missing shared-key auth challenge length check (git-fixes).\n- staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() (git-fixes).\n- staging: rtl8723bs: fix OOB read in WMM_param_handler() (git-fixes).\n- staging: rtl8723bs: use kfree_sensitive() for key material (git-fixes).\n- staging: rtl8723bs: validate monitor transmit frame lengths (git-fixes).\n- staging: sm750fb: gate dualview dataflow using g_dualview (git-fixes).\n- thermal/drivers/imx: Disable clock on runtime resume failure (git-fixes).\n- thermal/drivers/qoriq: Disable clock on resume failure (git-fixes).\n- thermal: intel: int3400: clean up ODVP on probe failures (git-fixes).\n- thunderbolt: Bound the DROM dual link port number before indexing sw-\u003eports (git-fixes).\n- thunderbolt: Fix bandwidth group reservation indexing (git-fixes).\n- thunderbolt: icm: Preserve USB4 proxy data-valid bit (git-fixes).\n- tlclk: if sscanf() fails, fall back to 0, not random value (git-fixes).\n- tpm: st33zp24: Return zero on status read failure (git-fixes).\n- tpm: st33zp24: Validate locality read result (git-fixes).\n- tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout (git-fixes).\n- tty: clear cdev pointer after cdev_add() failure (git-fixes).\n- tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 (git-fixes).\n- tty: skip cdev_del() when no cdev is registered (git-fixes).\n- uaccess: add copy_struct_to_user helper (bsc#1263864 ltc#217835).\n- uaccess: fix ignored_trailing logic in copy_struct_to_user() (bsc#1263864 ltc#217835).\n- uio: Fix stale info pointer in failed registration path (git-fixes).\n- usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() (git-fixes).\n- usb: atm: usbatm: fix invalid ci_range initialization (git-fixes).\n- USB: c67x00: fix use-after-free in c67x00_add_iso_urb() (git-fixes).\n- usb: cdnsp: fix incorrect endian conversions for APB timeout register (git-fixes).\n- usb: dwc2: add missing @remotewakeup kernel-doc parameter (git-fixes).\n- usb: dwc2: gadget: Exit partial power down state when changing USB pull-up (git-fixes).\n- usb: gadget: configfs: fix out-of-bounds read of qw_sign (git-fixes).\n- usb: gadget: f_fs: Prevent deadlock during ep0 read loop (git-fixes).\n- usb: gadget: f_ncm: Use unsigned int for ndp_index (git-fixes).\n- usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() (git-fixes).\n- usb: gadget: f_uac1_legacy: remove broken string configfs attributes (git-fixes).\n- usb: gadget: pch_udc: remove excess kernel-doc member for registered (git-fixes).\n- usb: gadget: r8a66597: avoid double free of ep0_req in probe error path (git-fixes).\n- usb: gadget: snps_udc_plat: clean up PHY on probe deferral (git-fixes).\n- usb: gadget: u_audio: Fix use-after-free on sound card disconnect (git-fixes).\n- usb: gadget: uac: validate rate list length before storing (git-fixes).\n- usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() (git-fixes).\n- usb: mtu3: allow system suspend during active gadget connection (git-fixes).\n- usb: musb: omap2430: clean up probe error handling (stable-fixes).\n- USB: phy: fsl-usb: fix missing static keywords (git-fixes).\n- usb: renesas_usbhs: Fix power-off ordering on unbind (git-fixes).\n- USB: serial: digi_acceleport: fix port registration order (git-fixes).\n- USB: serial: ftdi_sio: add support for E+H FXA291 (stable-fixes).\n- USB: serial: option: add TDTECH MT5710-CN (stable-fixes).\n- USB: serial: option: fix slab OOB read in interrupt URB callback (git-fixes).\n- USB: serial: spcp8x5: drop broken carrier detect support (git-fixes).\n- USB: storage: add NO_ATA_1X quirk for Longmai USB Key (stable-fixes).\n- usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive() (git-fixes).\n- usb: typec: ucsi: unregister debugfs entries on teardown (git-fixes).\n- usb: usbfs: fix use-after-free of usb_device in usbdev_release() (git-fixes).\n- usb: xhci: Handle USB3 port events when there is one roothub (git-fixes).\n- vt: add permission check for KDSKBMETA ioctl (stable-fixes).\n- vt: stabilize tty reference in kbd_keycode with tty_port_tty_get (stable-fixes).\n- w1: ds28e17: reject an oversize length on an I2C block read (git-fixes).\n- w1: ds2482: Fix signedness bug in ds2482_w1_triplet() (git-fixes).\n- wifi: ath6kl: avoid buffer overreads in WMI event handlers (git-fixes).\n- wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets (git-fixes).\n- wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump (git-fixes).\n- wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() (git-fixes).\n- wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate (git-fixes).\n- wifi: ath11k: Correctly copy the hint BSSID in WMI scan request (git-fixes).\n- wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx() (git-fixes).\n- wifi: ath12k: Correctly copy the hint BSSID in WMI scan request (git-fixes).\n- wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() (git-fixes).\n- wifi: brcmfmac: fix P2P action frame handling without device vif (git-fixes).\n- wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs (git-fixes).\n- wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments (git-fixes).\n- wifi: iwlwifi: mei: check SAP message length before reading it (git-fixes).\n- wifi: iwlwifi: mei: pass correct argument to function (git-fixes).\n- wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser (git-fixes).\n- wifi: mac80211: disconnect on CSA to channel 0 (git-fixes).\n- wifi: mac80211: fix multi-link element inheritance (git-fixes).\n- wifi: mac80211: fix per-STA profile length in cross-link CSA parsing (git-fixes).\n- wifi: mac80211: send TWT teardown to peer after setup TX failure (git-fixes).\n- wifi: mac80211: skip default WMM setup for AP_VLAN links (git-fixes).\n- wifi: mac80211: skip unused probe response countdown offsets (git-fixes).\n- wifi: mt76: fix 4th chain ACK RSSI bitmask in sta_poll (git-fixes).\n- wifi: mt76: fix ER-SU 106-tone RU check in RX rate decode (git-fixes).\n- wifi: mt76: fix HE DCM max-RU capability encoding (git-fixes).\n- wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length (git-fixes).\n- wifi: mt76: mt792x: Fix memory leak in SDIO TX path (git-fixes).\n- wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex (git-fixes).\n- wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss (git-fixes).\n- wifi: mt76: mt7915: fix double hif2 init on the non-WED path (git-fixes).\n- wifi: mt76: mt7915: fix ext PHY use-after-free on register error path (git-fixes).\n- wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986 (git-fixes).\n- wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie (git-fixes).\n- wifi: mt76: mt7915: release hif2 reference on probe IRQ failure (git-fixes).\n- wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement (git-fixes).\n- wifi: mt76: mt7915: unwind state on add_interface failure (git-fixes).\n- wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields (git-fixes).\n- wifi: mt76: mt7915: write RX header translation bit to the correct register (git-fixes).\n- wifi: mt76: mt7921: validate CLC firmware records (git-fixes).\n- wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb (git-fixes).\n- wifi: mt76: mt7925: fix msg len mismatch between driver and firmware (git-fixes).\n- wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config (git-fixes).\n- wifi: mt76: mt7996: don't report a zero TX bitrate (git-fixes).\n- wifi: mt76: mt7996: fix capability of EHT-MCS 15 in MRU (git-fixes).\n- wifi: mt76: mt7996: fix reg addr remap when addr is 0 (git-fixes).\n- wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV (git-fixes).\n- wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset (git-fixes).\n- wifi: mt76: mt7996: validate RX band_idx before dereferencing phys (git-fixes).\n- wifi: mt76: report data NSS for STBC frames in RX rate decode (git-fixes).\n- wifi: mwifiex: Detach sync cmd buffer on interrupted wait (git-fixes).\n- wifi: rtl818x: initialize eeprom_93cx6 struct to zero (git-fixes).\n- wifi: rtlwifi: pci: fix error path in rtl_pci_probe() (git-fixes).\n- wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() (git-fixes).\n- wifi: rtw89: fix HE extended capability length check (git-fixes).\n- wifi: zd1211rw: reject secondary interfaces to prevent conflicts (git-fixes).\n- x86/bugs: Clarify that syscall hardening isn't a BHI mitigation (git-fixes).\n- x86/cpu: Add CPU model number for Bartlett Lake CPUs with Raptor Cove cores (bsc#1240957 bsc#1249104 bsc#1265220).\n- xhci: dbgtty: Fix unregister on tty_alloc_driver() failure (git-fixes).\n- xhci: dbgtty: Fix unregister on tty_register_driver() failure (git-fixes).\n","status":"published","published":"2026-10-07T22:31:36Z","modified":"2026-10-08T19:27:38.397282936Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}