{"id":"CVE-2026-31736","aliases":["BELL-CVE-2026-31736","DEBIAN-CVE-2026-31736","EUVD-2026-26549","GHSA-pp62-pwj6-ppp4","SUSE-SU-2026:22043-1","SUSE-SU-2026:22048-1","SUSE-SU-2026:22076-1","SUSE-SU-2026:22087-1","UBUNTU-CVE-2026-31736","openSUSE-SU-2026:20912-1"],"status":"published","title":"net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled\n\nIf the gmac0 is disabled, the precheck for a valid ingress device will\ncause a NULL pointer deref and crash the system. This happens because\neth-\u003enetdev[0] will be NULL but the code will directly try to access\nnetdev_ops.\n\nInstead of just checking for the first net_device, it must be checked if\nany of the mtk_eth net_devices is matching the netdev_ops of the ingress\ndevice.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00122,"percentile":0.02,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2026-05-01T14:14:33Z","modified":"2026-11-11T09:37:17Z","fixes":[{"ecosystem":"Alpaquita:25","package":"linux-lts","fixed_in":["6.12.81-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"linux-lts","fixed_in":["6.18.35-r1"],"sources":["osv"]},{"ecosystem":"Linux","package":"Kernel","fixed_in":["6.12.81","6.18.22","6.19.12"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["6.12.85-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["6.19.12-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"linux-nvidia","fixed_in":["7.0.0-1006.6"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:25","package":"linux-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.12.80-r0"},{"fixed":"6.12.81-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"linux-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.12.92-r1"},{"fixed":"6.18.35-r1"}]}]},{"source":"osv","ecosystem":"Linux","package":"Kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.11.0"},{"fixed":"6.12.81"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.22"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"6.19.12"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.85-1"}]}],"versions":["6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.57-1","6.12.57-1~bpo12+1","6.12.63-1","6.12.63-1~bpo12+1","6.12.69-1","6.12.69-1~bpo12+1","6.12.73-1","6.12.73-1~bpo12+1","6.12.74-1","6.12.74-2","6.12.74-2~bpo12+1","6.12.85-1~bpo12+1"]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.19.12-1"}]}],"versions":["6.12.100-1","6.12.101-1","6.12.105-1","6.12.107-1","6.12.111-1","6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.57-1","6.12.57-1~bpo12+1","6.12.63-1","6.12.63-1~bpo12+1","6.12.69-1","6.12.69-1~bpo12+1","6.12.73-1","6.12.73-1~bpo12+1","6.12.74-1","6.12.74-2","6.12.74-2~bpo12+1","6.12.85-1","6.12.85-1~bpo12+1","6.12.86-1","6.12.86-1~bpo12+1","6.12.88-1","6.12.88-1~bpo12+1","6.12.90-1","6.12.90-1~bpo12+1","6.12.90-2","6.12.90-2~bpo12+1","6.12.94-1","6.12.94-1~bpo12+1","6.12.95-1","6.12.95-1~bpo12+1","6.12.96-1","6.13.10-1~exp1","6.13.11-1~exp1","6.13.2-1~exp1","6.13.3-1~exp1","6.13.4-1~exp1","6.13.5-1~exp1","6.13.6-1~exp1","6.13.7-1~exp1","6.13.8-1~exp1","6.13.9-1~exp1","6.13~rc6-1~exp1","6.13~rc7-1~exp1","6.14.3-1~exp1","6.14.5-1~exp1","6.14.6-1~exp1","6.15-1~exp1","6.15.1-1~exp1","6.15.2-1~exp1","6.15.3-1~exp1","6.15.4-1~exp1","6.15.5-1~exp1","6.15.6-1~exp1","6.15~rc7-1~exp1","6.16-1~exp1","6.16.1-1~exp1","6.16.10-1","6.16.11-1","6.16.12-1","6.16.12-1~bpo13+1","6.16.12-2","6.16.3-1","6.16.3-1~bpo13+1","6.16.5-1","6.16.6-1","6.16.7-1","6.16.8-1","6.16.9-1","6.16~rc7-1~exp1","6.17.10-1","6.17.11-1","6.17.12-1","6.17.13-1","6.17.13-1~bpo13+1","6.17.2-1~exp1","6.17.5-1~exp1","6.17.6-1","6.17.7-1","6.17.7-2","6.17.8-1","6.17.8-1~bpo13+1","6.17.9-1","6.18.1-1~exp1","6.18.10-1","6.18.12-1","6.18.12-1~bpo13+1","6.18.13-1","6.18.14-1","6.18.15-1","6.18.15-1~bpo13+1","6.18.2-1~exp1","6.18.3-1","6.18.5-1","6.18.5-1~bpo13+1","6.18.8-1","6.18.9-1","6.18.9-1~bpo13+1","6.18~rc4-1~exp1","6.18~rc4-1~exp2","6.18~rc5-1~exp1","6.18~rc6-1~exp1","6.18~rc7-1~exp1","6.19-1~exp1","6.19.10-1","6.19.10-1~bpo13+1","6.19.11-1","6.19.11-1~bpo13+1","6.19.2-1~exp1","6.19.3-1~exp1","6.19.4-1~exp1","6.19.5-1~exp1","6.19.6-1","6.19.6-2","6.19.6-2~bpo13+1","6.19.8-1","6.19.8-1~bpo13+1","6.19~rc4-1~exp1","6.19~rc5-1~exp1","6.19~rc6-1~exp1","6.19~rc7-1~exp1","6.19~rc8-1~exp1"]},{"source":"osv","ecosystem":"SUSE:Linux Micro Extras 6.2","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Micro Extras 6.2","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1.160000.2.15"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1.160000.2.15"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1.160000.2.15"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.0-160000.34.1"}]}],"bundled":38},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.0-28.30~16.04.1","4.8.0-30.32~16.04.1","4.8.0-32.34~16.04.1","4.8.0-34.36~16.04.1","4.10.0-14.16~16.04.1","4.10.0-19.21~16.04.1","4.10.0-20.22~16.04.1","4.10.0-21.23~16.04.1","4.10.0-22.24~16.04.1","4.10.0-24.28~16.04.1","4.10.0-26.30~16.04.1","4.11.0-13.19~16.04.1","4.11.0-14.20~16.04.1","4.13.0-16.19~16.04.3","4.13.0-17.20~16.04.1","4.13.0-19.22~16.04.1","4.13.0-21.24~16.04.1","4.13.0-25.29~16.04.2","4.15.0-13.14~16.04.1","4.15.0-15.16~16.04.1","4.15.0-20.21~16.04.1","4.15.0-22.24~16.04.1","4.15.0-23.25~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1021.24~18.04.1","5.0.0-1022.25~18.04.1","5.0.0-1023.26~18.04.1","5.0.0-1024.27~18.04.1","5.0.0-1025.28","5.0.0-1027.30"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1019.21~18.04.1","5.3.0-1023.25~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.2","5.3.0-1033.35","5.3.0-1034.36","5.3.0-1035.37"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.2","4.15.0-1003.3","4.15.0-1004.4","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1012.12","4.15.0-1013.13","4.15.0-1014.14","4.15.0-1018.18","4.15.0-1019.19","4.15.0-1021.21","4.15.0-1022.23","4.15.0-1023.24","4.15.0-1025.26","4.15.0-1028.29","4.15.0-1030.31","4.15.0-1031.32","4.15.0-1032.33","4.15.0-1035.36","4.15.0-1036.38","4.15.0-1037.39","4.18.0-1011.11~18.04.1","4.18.0-1013.13~18.04.1","4.18.0-1014.14~18.04.1","4.18.0-1018.18~18.04.1","4.18.0-1019.19~18.04.1","4.18.0-1020.20~18.04.1","4.18.0-1023.24~18.04.1","4.18.0-1024.25~18.04.1","4.18.0-1025.27~18.04.1","5.0.0-1014.14~18.04.1","5.0.0-1016.17~18.04.1","5.0.0-1018.19~18.04.1","5.0.0-1020.21~18.04.1","5.0.0-1022.23~18.04.1","5.0.0-1023.24~18.04.1","5.0.0-1025.27~18.04.1","5.0.0-1027.29~18.04.1","5.0.0-1028.30~18.04.1","5.0.0-1029.31~18.04.1","5.0.0-1031.33","5.0.0-1032.34","5.0.0-1035.37","5.0.0-1036.38"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8~18.04.1","5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1019.20~18.04.1","5.3.0-1020.21~18.04.1","5.3.0-1022.23~18.04.1","5.3.0-1028.29~18.04.1","5.3.0-1031.32~18.04.1","5.3.0-1032.33~18.04.1","5.3.0-1034.35~18.04.1","5.3.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-1006.6~18.04.1","4.18.0-1007.7~18.04.1","4.18.0-1008.8~18.04.1","5.0.0-1012.12~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1001.1","4.15.0-1003.3","4.15.0-1005.5","4.15.0-1006.6","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1010.10","4.15.0-1014.14","4.15.0-1015.15","4.15.0-1017.18","4.15.0-1018.19","4.15.0-1019.20","4.15.0-1021.22","4.15.0-1023.24","4.15.0-1024.25","4.15.0-1025.26","4.15.0-1026.27","4.15.0-1027.28","4.15.0-1028.29","4.15.0-1029.31","4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1042.45","4.15.0-1044.70","5.0.0-1020.20~18.04.1","5.0.0-1021.21~18.04.1","5.0.0-1025.26~18.04.1","5.0.0-1026.27~18.04.1","5.0.0-1028.29~18.04.1","5.0.0-1029.30~18.04.1","5.0.0-1031.32","5.0.0-1033.34","5.0.0-1034.35"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1020.22~18.04.1","5.3.0-1026.28~18.04.1","5.3.0-1029.31~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-4.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1041.43","4.15.0-1042.44","4.15.0-1044.46","4.15.0-1045.48","4.15.0-1046.49","4.15.0-1048.51","4.15.0-1049.52","4.15.0-1050.53","4.15.0-1052.55","4.15.0-1055.58","4.15.0-1057.60","4.15.0-1058.61","4.15.0-1059.62","4.15.0-1063.66","4.15.0-1064.67","4.15.0-1066.69","4.15.0-1067.70","4.15.0-1069.72","4.15.0-1070.73","4.15.0-1072.76","4.15.0-1073.78","4.15.0-1074.79","4.15.0-1076.81","4.15.0-1077.82","4.15.0-1078.83","4.15.0-1079.84"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1025.25~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.31~18.04.1","5.4.0-1030.32~18.04.1","5.4.0-1032.34~18.04.1","5.4.0-1033.35~18.04.1","5.4.0-1035.37~18.04.1","5.4.0-1036.38~18.04.1","5.4.0-1037.39~18.04.1","5.4.0-1039.41~18.04.1","5.4.0-1040.42~18.04.1","5.4.0-1042.44~18.04.1","5.4.0-1043.45~18.04.1","5.4.0-1044.46~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1","5.4.0-1052.55~18.04.1","5.4.0-1053.56~18.04.1","5.4.0-1054.57~18.04.1","5.4.0-1055.58~18.04.1","5.4.0-1056.59~18.04.1","5.4.0-1057.60~18.04.1","5.4.0-1059.62~18.04.1","5.4.0-1061.64~18.04.1","5.4.0-1062.65~18.04.1","5.4.0-1063.66~18.04.1","5.4.0-1065.68~18.04.1","5.4.0-1066.69~18.04.1","5.4.0-1067.70~18.04.1","5.4.0-1068.71~18.04.1","5.4.0-1071.76~18.04.3","5.4.0-1072.77~18.04.1","5.4.0-1074.79~18.04.1","5.4.0-1076.82~18.04.1","5.4.0-1078.84~18.04.1","5.4.0-1080.86~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gkeop-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1001.1","5.4.0-1003.3","5.4.0-1004.5","5.4.0-1005.6","5.4.0-1007.8~18.04.1","5.4.0-1008.9~18.04.1","5.4.0-1009.10~18.04.1","5.4.0-1010.11~18.04.1","5.4.0-1011.12~18.04.2","5.4.0-1012.13~18.04.1","5.4.0-1013.14~18.04.1","5.4.0-1014.15~18.04.1","5.4.0-1015.16~18.04.1","5.4.0-1016.17~18.04.1","5.4.0-1018.19~18.04.1","5.4.0-1021.22~18.04.1","5.4.0-1022.23~18.04.1","5.4.0-1023.24~18.04.1","5.4.0-1024.25~18.04.1","5.4.0-1025.26~18.04.1","5.4.0-1026.27~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.30~18.04.2","5.4.0-1031.32~18.04.1","5.4.0-1032.33~18.04.1","5.4.0-1033.34~18.04.1","5.4.0-1034.35~18.04.1","5.4.0-1036.37~18.04.1","5.4.0-1037.38~18.04.1","5.4.0-1038.39~18.04.1","5.4.0-1039.40~18.04.1","5.4.0-1040.41~18.04.1","5.4.0-1043.44~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1048.51~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-13.14~18.04.1","4.18.0-14.15~18.04.1","4.18.0-15.16~18.04.1","4.18.0-16.17~18.04.1","4.18.0-17.18~18.04.1","4.18.0-18.19~18.04.1","4.18.0-20.21~18.04.1","4.18.0-21.22~18.04.1","4.18.0-22.23~18.04.1","4.18.0-24.25~18.04.1","4.18.0-25.26~18.04.1","5.0.0-23.24~18.04.1","5.0.0-25.26~18.04.1","5.0.0-27.28~18.04.1","5.0.0-29.31~18.04.1","5.0.0-31.33~18.04.1","5.0.0-32.34~18.04.2","5.0.0-35.38~18.04.1","5.0.0-36.39~18.04.1","5.0.0-37.40~18.04.1","5.3.0-26.28~18.04.1","5.3.0-28.30~18.04.1","5.3.0-40.32~18.04.1","5.3.0-42.34~18.04.1","5.3.0-45.37~18.04.1","5.3.0-46.38~18.04.1","5.3.0-51.44~18.04.2","5.3.0-53.47~18.04.1","5.3.0-59.53~18.04.1","5.3.0-61.55~18.04.1","5.3.0-62.56~18.04.1","5.3.0-64.58~18.04.1","5.3.0-65.59","5.3.0-66.60","5.3.0-67.61","5.3.0-68.63","5.3.0-69.65","5.3.0-70.66","5.3.0-72.68","5.3.0-73.69","5.3.0-74.70","5.3.0-75.71","5.3.0-76.72"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-15.16~18.04.1","5.0.0-16.17~18.04.1","5.0.0-17.18~18.04.1","5.0.0-19.20~18.04.1","5.0.0-20.21~18.04.1","5.3.0-19.20~18.04.2","5.3.0-22.24~18.04.1","5.3.0-23.25~18.04.1","5.3.0-23.25~18.04.2","5.3.0-24.26~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.3","4.15.0-1004.5","4.15.0-1006.9","4.15.0-1008.11","4.15.0-1009.12","4.15.0-1012.15","4.15.0-1013.16","4.15.0-1015.18","4.15.0-1017.20","4.15.0-1018.21","4.15.0-1021.24","4.15.0-1024.29","4.15.0-1026.31","4.15.0-1028.33","4.15.0-1030.35","4.15.0-1033.38","4.15.0-1034.39","4.15.0-1035.40","4.15.0-1036.41","4.15.0-1038.43","4.15.0-1039.44","4.15.0-1043.48","4.15.0-1045.50","4.15.0-1050.57","4.15.0-1056.65","4.15.0-1057.66","4.15.0-1059.68","4.15.0-1063.72","4.15.0-1064.73","4.15.0-1065.75","4.15.0-1066.76","4.15.0-1067.77","4.15.0-1069.79","4.15.0-1073.83","4.15.0-1076.86","4.15.0-1079.89","4.15.0-1080.90","4.15.0-1081.91","4.15.0-1087.97","4.15.0-1090.100","4.15.0-1091.101","4.15.0-1093.103","4.15.0-1094.104","4.15.0-1096.106","4.15.0-1097.107","4.15.0-1099.109","4.15.0-1100.110","4.15.0-1101.112","4.15.0-1102.113","4.15.0-1103.114"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1007.12~18.04.1","5.0.0-1008.13~18.04.1","5.0.0-1009.14~18.04.1","5.0.0-1010.15~18.04.1","5.0.0-1011.16","5.0.0-1013.18","5.0.0-1014.19"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1011.12~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.18~18.04.1","5.3.0-1018.20~18.04.1","5.3.0-1024.26~18.04.1","5.3.0-1027.29~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.9~20.04.2","5.11.0-1014.15~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.2","5.11.0-1021.22~20.04.2","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.2","5.13.0-1011.12~20.04.1","5.13.0-1012.13~20.04.1","5.13.0-1014.15~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1019.21~20.04.1","5.13.0-1021.23~20.04.2","5.13.0-1022.24~20.04.1","5.13.0-1023.25~20.04.1","5.13.0-1025.27~20.04.1","5.13.0-1028.31~20.04.1","5.13.0-1029.32~20.04.1","5.13.0-1031.35~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1041.43~20.04.1","5.8.0-1042.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1007.7~20.04.2","5.11.0-1012.13~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10~20.04.2","5.13.0-1012.14~20.04.1","5.13.0-1013.15~20.04.1","5.13.0-1014.16~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1021.24~20.04.1","5.13.0-1022.26~20.04.1","5.13.0-1023.27~20.04.1","5.13.0-1025.29~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1029.34~20.04.1","5.13.0-1031.37~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1033.35~20.04.1","5.8.0-1036.38~20.04.1","5.8.0-1039.42~20.04.1","5.8.0-1040.43~20.04.1","5.8.0-1041.44~20.04.1","5.8.0-1042.45~20.04.1","5.8.0-1043.46~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1063.66+cvm2.2","5.4.0-1063.66+cvm3.2","5.4.0-1064.67+cvm1.1","5.4.0-1065.68+cvm2.1","5.4.0-1067.70+cvm1.1","5.4.0-1068.71+cvm1.1","5.4.0-1069.72+cvm1.1","5.4.0-1070.73+cvm1.1","5.4.0-1072.75+cvm1.1","5.4.0-1073.76+cvm1.1","5.4.0-1074.77+cvm1.1","5.4.0-1076.79+cvm1.1","5.4.0-1078.81+cvm1.1","5.4.0-1080.83+cvm1.1","5.4.0-1083.87+cvm1.1","5.4.0-1085.90+cvm1.1","5.4.0-1085.90+cvm2.1","5.4.0-1086.91+cvm1.1","5.4.0-1089.94+cvm1.2","5.4.0-1090.95+cvm1.1","5.4.0-1091.96+cvm1.1","5.4.0-1092.97+cvm1.1","5.4.0-1095.101+cvm1.1","5.4.0-1098.104+cvm1.1","5.4.0-1100.106+cvm1.1","5.4.0-1103.109+cvm1.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.10~20.04.1","5.11.0-1014.16~20.04.1","5.11.0-1017.19~20.04.1","5.11.0-1018.20~20.04.2","5.11.0-1020.22~20.04.1","5.11.0-1021.23~20.04.1","5.11.0-1022.24~20.04.1","5.11.0-1023.25~20.04.1","5.11.0-1024.26~20.04.1","5.11.0-1026.29~20.04.1","5.11.0-1028.32~20.04.1","5.11.0-1029.33~20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.3","5.13.0-1012.15~20.04.1","5.13.0-1013.16~20.04.1","5.13.0-1015.18~20.04.1","5.13.0-1019.23~20.04.1","5.13.0-1021.25~20.04.1","5.13.0-1023.28~20.04.1","5.13.0-1024.29~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1030.36~20.04.1","5.13.0-1031.37~20.04.1","5.13.0-1033.40~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1032.34~20.04.1","5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1039.41"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1033.35","5.4.0-1035.37","5.4.0-1036.38","5.4.0-1037.39","5.4.0-1039.41","5.4.0-1041.43","5.4.0-1042.44","5.4.0-1043.45","5.4.0-1044.46","5.4.0-1046.48","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1055.58","5.4.0-1056.59","5.4.0-1057.60","5.4.0-1059.62","5.4.0-1061.64","5.4.0-1062.65","5.4.0-1063.66","5.4.0-1065.68","5.4.0-1066.69","5.4.0-1067.70","5.4.0-1068.71","5.4.0-1071.76","5.4.0-1072.77","5.4.0-1074.79","5.4.0-1076.82","5.4.0-1078.84","5.4.0-1080.86","5.4.0-1081.87","5.4.0-1083.89","5.4.0-1084.90","5.4.0-1086.93","5.4.0-1087.94","5.4.0-1090.97","5.4.0-1091.98","5.4.0-1094.101","5.4.0-1095.102","5.4.0-1096.103","5.4.0-1097.104","5.4.0-1098.105","5.4.0-1099.106","5.4.0-1100.107","5.4.0-1101.108","5.4.0-1102.109","5.4.0-1103.110","5.4.0-1104.111","5.4.0-1105.112"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1011.14~20.04.1","5.15.0-1014.17~20.04.1","5.15.0-1015.18~20.04.1","5.15.0-1016.19~20.04.1","5.15.0-1019.23~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1023.28~20.04.2","5.15.0-1027.32~20.04.1","5.15.0-1028.33~20.04.1","5.15.0-1029.34~20.04.1","5.15.0-1031.36~20.04.1","5.15.0-1032.37~20.04.1","5.15.0-1033.38~20.04.1","5.15.0-1034.39~20.04.1","5.15.0-1036.41~20.04.1","5.15.0-1037.42~20.04.1","5.15.0-1038.43~20.04.1","5.15.0-1039.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1008.9","5.4.0-1009.10","5.4.0-1010.11","5.4.0-1011.12","5.4.0-1012.13","5.4.0-1013.14","5.4.0-1014.15","5.4.0-1015.16","5.4.0-1016.17","5.4.0-1018.19","5.4.0-1021.22","5.4.0-1022.23","5.4.0-1023.24","5.4.0-1024.25","5.4.0-1025.26","5.4.0-1026.27","5.4.0-1027.28","5.4.0-1029.30","5.4.0-1031.32","5.4.0-1032.33","5.4.0-1033.34","5.4.0-1034.35","5.4.0-1036.37","5.4.0-1037.38","5.4.0-1038.39","5.4.0-1039.40","5.4.0-1040.41","5.4.0-1043.44","5.4.0-1046.48","5.4.0-1048.51","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1056.60","5.4.0-1057.61","5.4.0-1060.64","5.4.0-1061.65","5.4.0-1062.66","5.4.0-1064.68","5.4.0-1065.69","5.4.0-1066.70","5.4.0-1067.71","5.4.0-1068.72","5.4.0-1069.73","5.4.0-1070.74","5.4.0-1071.75","5.4.0-1072.76","5.4.0-1073.77","5.4.0-1074.78","5.4.0-1075.79","5.4.0-1076.80","5.4.0-1077.81","5.4.0-1078.82","5.4.0-1079.83","5.4.0-1080.84","5.4.0-1081.85","5.4.0-1083.87","5.4.0-1084.88","5.4.0-1085.89","5.4.0-1086.90","5.4.0-1087.91","5.4.0-1088.92","5.4.0-1089.93","5.4.0-1090.94","5.4.0-1091.95","5.4.0-1092.96","5.4.0-1093.97","5.4.0-1094.98","5.4.0-1095.99","5.4.0-1096.100","5.4.0-1097.101","5.4.0-1098.102","5.4.0-1099.103","5.4.0-1100.104","5.4.0-1101.105","5.4.0-1102.106"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gkeop-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1003.5~20.04.2","5.15.0-1005.7~20.04.1","5.15.0-1007.10~20.04.1","5.15.0-1008.12~20.04.1","5.15.0-1011.15~20.04.2","5.15.0-1012.16~20.04.1","5.15.0-1013.17~20.04.1","5.15.0-1015.19~20.04.1","5.15.0-1016.21~20.04.1","5.15.0-1017.22~20.04.1","5.15.0-1018.23~20.04.1","5.15.0-1019.24~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1021.26~20.04.1","5.15.0-1022.27~20.04.1","5.15.0-1023.28~20.04.1","5.15.0-1024.29~20.04.1","5.15.0-1025.30~20.04.1","5.15.0-1026.31~20.04.1","5.15.0-1027.32~20.04.1","5.15.0-1028.33~20.04.1","5.15.0-1030.35~20.04.1","5.15.0-1031.37~20.04.1","5.15.0-1032.38~20.04.1","5.15.0-1033.39~20.04.1","5.15.0-1034.40~20.04.1","5.15.0-1035.41~20.04.1","5.15.0-1036.42~20.04.1","5.15.0-1037.43~20.04.1","5.15.0-1038.44~20.04.1","5.15.0-1039.45~20.04.1","5.15.0-1040.46~20.04.1","5.15.0-1043.50~20.04.1","5.15.0-1044.51~20.04.1","5.15.0-1045.52~20.04.1","5.15.0-1046.53~20.04.1","5.15.0-1047.54~20.04.1","5.15.0-1048.55~20.04.1","5.15.0-1049.56~20.04.1","5.15.0-1050.57~20.04.1","5.15.0-1051.58~20.04.1","5.15.0-1052.59~20.04.1","5.15.0-1053.60~20.04.1","5.15.0-1054.61~20.04.1","5.15.0-1055.62~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-22.23~20.04.1","5.11.0-25.27~20.04.1","5.11.0-27.29~20.04.1","5.11.0-34.36~20.04.1","5.11.0-36.40~20.04.1","5.11.0-37.41~20.04.2","5.11.0-38.42~20.04.1","5.11.0-40.44~20.04.2","5.11.0-41.45~20.04.1","5.11.0-43.47~20.04.2","5.11.0-44.48~20.04.2","5.11.0-46.51~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-21.21~20.04.1","5.13.0-22.22~20.04.1","5.13.0-23.23~20.04.2","5.13.0-25.26~20.04.1","5.13.0-27.29~20.04.1","5.13.0-28.31~20.04.1","5.13.0-30.33~20.04.1","5.13.0-35.40~20.04.1","5.13.0-37.42~20.04.1","5.13.0-39.44~20.04.1","5.13.0-40.45~20.04.1","5.13.0-41.46~20.04.1","5.13.0-44.49~20.04.1","5.13.0-48.54~20.04.1","5.13.0-51.58~20.04.1","5.13.0-52.59~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-23.24~20.04.1","5.8.0-25.26~20.04.1","5.8.0-28.30~20.04.1","5.8.0-29.31~20.04.1","5.8.0-31.33~20.04.1","5.8.0-33.36~20.04.1","5.8.0-34.37~20.04.2","5.8.0-36.40~20.04.1","5.8.0-38.43~20.04.1","5.8.0-40.45~20.04.1","5.8.0-41.46~20.04.1","5.8.0-43.49~20.04.1","5.8.0-44.50~20.04.1","5.8.0-45.51~20.04.1","5.8.0-48.54~20.04.1","5.8.0-49.55~20.04.1","5.8.0-50.56~20.04.1","5.8.0-53.60~20.04.1","5.8.0-55.62~20.04.1","5.8.0-59.66~20.04.1","5.8.0-63.71~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-intel-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1007.7","5.13.0-1008.8","5.13.0-1009.9","5.13.0-1010.10","5.13.0-1011.11","5.13.0-1014.15","5.13.0-1017.19"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.10.0-1008.9","5.10.0-1011.12","5.10.0-1013.14","5.10.0-1014.15","5.10.0-1016.17","5.10.0-1017.18","5.10.0-1019.20","5.10.0-1021.22","5.10.0-1022.23","5.10.0-1023.24","5.10.0-1025.26","5.10.0-1026.27","5.10.0-1029.30","5.10.0-1032.33","5.10.0-1033.34","5.10.0-1034.35","5.10.0-1038.40","5.10.0-1044.46","5.10.0-1045.47","5.10.0-1049.51","5.10.0-1050.52","5.10.0-1051.53","5.10.0-1052.54","5.10.0-1053.55","5.10.0-1055.58","5.10.0-1057.61"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10","5.13.0-1010.11","5.13.0-1012.16","5.13.0-1014.18","5.13.0-1017.21","5.13.0-1019.23","5.13.0-1020.24","5.13.0-1021.25","5.13.0-1022.26","5.13.0-1026.32","5.13.0-1028.35","5.13.0-1029.36"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.14.0-1004.4","5.14.0-1005.5","5.14.0-1007.7","5.14.0-1008.8","5.14.0-1010.10","5.14.0-1011.11","5.14.0-1013.13","5.14.0-1018.19","5.14.0-1020.22","5.14.0-1022.24","5.14.0-1024.26","5.14.0-1027.30","5.14.0-1029.32","5.14.0-1031.34","5.14.0-1032.35","5.14.0-1033.36","5.14.0-1034.37","5.14.0-1036.40","5.14.0-1038.42","5.14.0-1042.47","5.14.0-1044.49","5.14.0-1045.51","5.14.0-1046.53","5.14.0-1047.54","5.14.0-1048.55","5.14.0-1049.56","5.14.0-1050.57","5.14.0-1051.58","5.14.0-1052.59","5.14.0-1054.61","5.14.0-1055.62","5.14.0-1056.63","5.14.0-1057.64","5.14.0-1058.66","5.14.0-1059.67"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.6.0-1007.7","5.6.0-1008.8","5.6.0-1010.10","5.6.0-1011.11","5.6.0-1013.13","5.6.0-1017.17","5.6.0-1018.18","5.6.0-1020.20","5.6.0-1021.21","5.6.0-1023.23","5.6.0-1026.26","5.6.0-1027.27","5.6.0-1028.28","5.6.0-1031.32","5.6.0-1032.33","5.6.0-1033.35","5.6.0-1034.36","5.6.0-1035.37","5.6.0-1036.39","5.6.0-1039.43","5.6.0-1042.46","5.6.0-1047.51","5.6.0-1048.52","5.6.0-1050.54","5.6.0-1052.56","5.6.0-1053.57","5.6.0-1054.58","5.6.0-1055.59","5.6.0-1056.60"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1008.8~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1011.13~20.04.2","5.13.0-1015.19~20.04.1","5.13.0-1016.20~20.04.1","5.13.0-1018.22~20.04.1","5.13.0-1021.26~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1030.35~20.04.1","5.13.0-1033.39~20.04.1","5.13.0-1034.40~20.04.1","5.13.0-1036.43~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1031.32~20.04.2","5.8.0-1033.34~20.04.1","5.8.0-1034.35~20.04.2","5.8.0-1037.38~20.04.1","5.8.0-1038.39~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8","5.3.0-1014.16","5.3.0-1015.17","5.3.0-1017.19","5.4.0-1004.4","5.4.0-1006.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-24.28","5.4.0-26.30","5.4.0-27.31","5.4.0-28.32","5.4.0-30.34","5.4.0-31.35","5.4.0-33.37","5.4.0-34.38","5.4.0-36.41","5.4.0-37.42","5.4.0-39.44","5.4.0-40.45"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1018.19~20.04.2","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1024.25~20.04.1","5.11.0-1026.28~20.04.1","5.11.0-1028.31~20.04.1","5.11.0-1029.32~20.04.1","5.11.0-1030.34","5.11.0-1031.35"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-14.16~20.04.1","5.8.0-14.16~20.04.3","5.8.0-16.18~20.04.1","5.8.0-17.19~20.04.1","5.8.0-18.20~20.04.1","5.8.0-20.22~20.04.1","5.8.0-22.24~20.04.1","5.8.0-25.27~20.04.1","5.8.0-26.28~20.04.1","5.8.0-29.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-allwinner-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1007.7~22.04.1","5.19.0-1009.9~22.04.1","5.19.0-1010.10~22.04.1","5.19.0-1011.11~22.04.1","5.19.0-1012.12~22.04.1","5.19.0-1013.13~22.04.1","5.19.0-1014.14~22.04.1","5.19.0-1015.15~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1019.20~22.04.1","5.19.0-1020.21~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1026.27~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1029.30~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1008.8~22.04.1","6.5.0-1010.10~22.04.1","6.5.0-1011.11~22.04.1","6.5.0-1012.12~22.04.1","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.2","6.5.0-1018.18~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1021.21~22.04.1","6.5.0-1022.22~22.04.1","6.5.0-1023.23~22.04.1","6.5.0-1024.24~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.21~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1025.28~22.04.1","5.19.0-1026.29~22.04.1","5.19.0-1027.30~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1","6.2.0-1019.19~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.7~22.04.1","6.5.0-1009.9~22.04.1","6.5.0-1010.10~22.04.1","6.5.0-1011.11~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.1","6.5.0-1018.19~22.04.2","6.5.0-1019.20~22.04.1","6.5.0-1021.22~22.04.1","6.5.0-1022.23~22.04.1","6.5.0-1023.24~22.04.1","6.5.0-1024.25~22.04.1","6.5.0-1025.26~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1025.28~22.04.1.1","5.19.0-1026.29~22.04.1.1","5.19.0-1027.30~22.04.2.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1.1","6.2.0-1009.9~22.04.3.1","6.2.0-1011.11~22.04.1.1","6.2.0-1012.12~22.04.1.1","6.2.0-1014.14~22.04.1.1","6.2.0-1015.15~22.04.1.1","6.2.0-1016.16~22.04.1.1","6.2.0-1017.17~22.04.1.1","6.2.0-1018.18~22.04.1.1","6.2.0-1019.19~22.04.1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.22~22.04.2","5.19.0-1021.23~22.04.1","5.19.0-1022.24~22.04.1","5.19.0-1024.26~22.04.1","5.19.0-1025.27~22.04.1","5.19.0-1026.28~22.04.1","5.19.0-1027.29~22.04.1","5.19.0-1030.32~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1011.11~22.04.3","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1016.18~22.04.1","6.2.0-1017.19~22.04.1","6.2.0-1018.20~22.04.1","6.2.0-1019.21~22.04.1","6.2.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1010.10~22.04.3","6.5.0-1011.11~22.04.1","6.5.0-1013.13~22.04.1","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.1","6.5.0-1018.18~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1022.24~22.04.1","6.5.0-1023.25~22.04.1","6.5.0-1024.26~22.04.1","6.5.0-1025.27~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-28.29~22.04.1","5.19.0-32.33~22.04.1","5.19.0-35.36~22.04.1","5.19.0-38.39~22.04.1","5.19.0-40.41~22.04.1","5.19.0-41.42~22.04.1","5.19.0-42.43~22.04.1","5.19.0-43.44~22.04.1","5.19.0-45.46~22.04.1","5.19.0-46.47~22.04.1","5.19.0-50.50"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-25.25~22.04.2","6.2.0-26.26~22.04.1","6.2.0-31.31~22.04.1","6.2.0-32.32~22.04.1","6.2.0-33.33~22.04.1","6.2.0-34.34~22.04.1","6.2.0-35.35~22.04.1","6.2.0-36.37~22.04.1","6.2.0-37.38~22.04.1","6.2.0-39.40~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-14.14~22.04.1","6.5.0-15.15~22.04.1","6.5.0-17.17~22.04.1","6.5.0-18.18~22.04.1","6.5.0-21.21~22.04.1","6.5.0-25.25~22.04.1","6.5.0-26.26~22.04.1","6.5.0-27.28~22.04.1","6.5.0-28.29~22.04.1","6.5.0-35.35~22.04.1","6.5.0-41.41~22.04.2","6.5.0-44.44~22.04.1","6.5.0-45.45~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-intel-iot-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1073.75"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1030.30"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-14.14.1~22.04.1","6.5.0-15.15.1.1~22.04.1","6.5.0-17.17.1.1.1~22.04.1","6.5.0-21.21.1~22.04.1","6.5.0-25.25.1~22.04.1","6.5.0-26.26.1~22.04.1","6.5.0-27.28.1~22.04.1","6.5.0-28.29.1~22.04.1","6.5.0-35.35.1~22.04.1","6.5.0-41.41.1~22.04.1","6.5.0-42.42.1~22.04.1","6.5.0-44.44.1~22.04.1","6.5.0-45.45.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1003.3~22.04.1","6.2.0-1009.9","6.2.0-1010.10","6.2.0-1011.11","6.2.0-1012.12","6.2.0-1013.13","6.2.0-1015.15"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1004.4","6.5.0-1007.7","6.5.0-1013.13","6.5.0-1014.14","6.5.0-1015.15","6.5.0-1018.18","6.5.0-1019.19","6.5.0-1021.22","6.5.0-1022.23","6.5.0-1023.24","6.5.0-1024.25"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-5.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.17.0-1003.3","5.17.0-1004.4","5.17.0-1006.6","5.17.0-1011.12","5.17.0-1012.13","5.17.0-1013.14","5.17.0-1014.15","5.17.0-1015.16","5.17.0-1016.17","5.17.0-1017.18","5.17.0-1018.19","5.17.0-1019.20","5.17.0-1020.21","5.17.0-1021.22","5.17.0-1024.25","5.17.0-1025.26","5.17.0-1026.27","5.17.0-1027.28","5.17.0-1028.29","5.17.0-1029.30","5.17.0-1030.31","5.17.0-1031.32","5.17.0-1032.33","5.17.0-1033.34","5.17.0-1034.35","5.17.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.0-1006.6","6.0.0-1007.7","6.0.0-1008.8","6.0.0-1009.9","6.0.0-1010.10","6.0.0-1011.11","6.0.0-1012.12","6.0.0-1013.13","6.0.0-1014.14","6.0.0-1015.15","6.0.0-1016.16","6.0.0-1017.17","6.0.0-1018.18","6.0.0-1019.19","6.0.0-1020.20","6.0.0-1021.21"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.0-1004.4","6.1.0-1006.6","6.1.0-1007.7","6.1.0-1008.8","6.1.0-1009.9","6.1.0-1010.10","6.1.0-1012.12","6.1.0-1013.13","6.1.0-1014.14","6.1.0-1015.15","6.1.0-1016.16","6.1.0-1017.17","6.1.0-1019.19","6.1.0-1020.20","6.1.0-1021.21","6.1.0-1022.22","6.1.0-1023.23","6.1.0-1024.24","6.1.0-1025.25","6.1.0-1026.26","6.1.0-1027.27","6.1.0-1028.28","6.1.0-1029.29","6.1.0-1033.33","6.1.0-1034.34","6.1.0-1035.35","6.1.0-1036.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1003.3","6.5.0-1004.4","6.5.0-1006.6","6.5.0-1007.7","6.5.0-1008.8","6.5.0-1009.10","6.5.0-1011.12","6.5.0-1013.14","6.5.0-1014.15","6.5.0-1015.16","6.5.0-1016.17","6.5.0-1018.19","6.5.0-1019.20","6.5.0-1020.21","6.5.0-1022.23","6.5.0-1023.24","6.5.0-1024.25","6.5.0-1025.26","6.5.0-1027.28"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1013.13~22.04.4","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1018.18~22.04.1","6.5.0-1019.19~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1021.21~22.04.1","6.5.0-1023.23~22.04.1","6.5.0-1024.24~22.04.1","6.5.0-1025.25~22.04.1","6.5.0-1026.26~22.04.1","6.5.0-1027.27~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1032.35"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1004.4","5.13.0-1006.6+22.04.1","5.13.0-1007.7+22.04.1","5.13.0-1010.11+22.04.1","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1006.6","5.15.0-1007.7","5.15.0-1008.8","5.15.0-1011.12","5.15.0-1012.13","5.15.0-1014.16","5.15.0-1015.17","5.15.0-1016.18","5.15.0-1017.19","5.15.0-1018.21","5.15.0-1019.22","5.15.0-1020.23","5.15.0-1022.26","5.15.0-1023.27","5.15.0-1026.30","5.15.0-1027.31","5.15.0-1028.32"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1012.13~22.04.1","5.19.0-1015.16~22.04.1","5.19.0-1016.17~22.04.1","5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1","5.19.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-17.17.1.1~22.04.1","6.5.0-21.21.1~22.04.1","6.5.0-25.25.1~22.04.1","6.5.0-26.26.1~22.04.1","6.5.0-27.28.1~22.04.1","6.5.0-28.29.1~22.04.1","6.5.0-35.35.1~22.04.1","6.5.0-40.40.1~22.04.1","6.5.0-42.42.1~22.04.1","6.5.0-45.45.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1014.16~22.04.1","5.19.0-1015.17~22.04.1","5.19.0-1016.18~22.04.1","5.19.0-1017.19~22.04.1","5.19.0-1018.20~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1006.7~22.04.1","6.2.0-1007.8~22.04.1","6.2.0-1009.10~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.8~22.04.1","6.5.0-1008.9~22.04.1","6.5.0-1009.10~22.04.1","6.5.0-1010.11~22.04.1","6.5.0-1011.12~22.04.1","6.5.0-1012.13~22.04.1","6.5.0-1014.15~22.04.1","6.5.0-1015.16~22.04.1","6.5.0-1016.17~22.04.1","6.5.0-1017.18~22.04.1","6.5.0-1018.19~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1009.9~24.04.1","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1016.16~24.04.1","6.14.0-1017.17~24.04.1","6.14.0-1018.18~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-aws-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1005.5~24.04.2","6.17.0-1007.7~24.04.1","6.17.0-1009.9~24.04.2","6.17.0-1010.10~24.04.1","6.17.0-1012.12~24.04.1","6.17.0-1013.13~24.04.1","6.17.0-1015.15~24.04.1","6.17.0-1017.17~24.04.1","6.17.0-1019.19~24.04.1","6.17.0-1020.20~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1008.8~24.04.1","6.11.0-1012.12~24.04.1","6.11.0-1013.13~24.04.1","6.11.0-1014.14~24.04.1","6.11.0-1015.15~24.04.1","6.11.0-1017.17~24.04.1","6.11.0-1018.18~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1010.10~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1008.8~24.04.1","6.17.0-1010.10~24.04.1","6.17.0-1011.11~24.04.2","6.17.0-1013.13~24.04.1","6.17.0-1015.15~24.04.1","6.17.0-1017.17~24.04.1","6.17.0-1018.18~24.04.1","6.17.0-1020.20~24.04.1","6.17.0-1021.21~24.04.1","6.17.0-1022.22"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-fde-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-nvidia-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1003.3","6.14.0-1006.6","6.14.0-1007.7"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1006.6~24.04.2","6.11.0-1011.11~24.04.1","6.11.0-1013.13~24.04.1","6.11.0-1014.14~24.04.1","6.11.0-1015.15~24.04.1","6.11.0-1016.16~24.04.1","6.11.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1014.15~24.04.1","6.14.0-1015.16~24.04.1","6.14.0-1016.17~24.04.1","6.14.0-1017.18~24.04.1","6.14.0-1018.19~24.04.1","6.14.0-1019.20~24.04.1","6.14.0-1020.21~24.04.1","6.14.0-1021.22~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1004.4~24.04.3","6.17.0-1008.8~24.04.1","6.17.0-1009.9~24.04.3","6.17.0-1010.10~24.04.1","6.17.0-1012.12~24.04.1","6.17.0-1013.13~24.04.1","6.17.0-1016.17~24.04.1","6.17.0-1018.19~24.04.1","6.17.0-1020.22~24.04.1","6.17.0-1021.24~24.04.1","6.17.0-1022.25"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-hwe-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-17.17~24.04.2","6.11.0-19.19~24.04.1","6.11.0-21.21~24.04.1","6.11.0-24.24~24.04.1","6.11.0-25.25~24.04.1","6.11.0-26.26~24.04.1","6.11.0-28.28~24.04.1","6.11.0-29.29~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-hwe-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-24.24~24.04.3","6.14.0-27.27~24.04.1","6.14.0-28.28~24.04.1","6.14.0-29.29~24.04.1","6.14.0-32.32~24.04.1","6.14.0-33.33~24.04.1","6.14.0-34.34~24.04.1","6.14.0-35.35~24.04.1","6.14.0-36.36~24.04.1","6.14.0-37.37~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-hwe-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-14.14~24.04.1","6.17.0-19.19~24.04.2","6.17.0-20.20~24.04.1","6.17.0-22.22~24.04.1","6.17.0-23.23~24.04.1","6.17.0-29.29~24.04.1","6.17.0-35.35~24.04.1","6.17.0-40.40~24.04.1","6.17.0-41.41~24.04.1","6.17.0-42.42"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency-hwe-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1009.10~24.04.1","6.11.0-1011.12~24.04.1","6.11.0-1012.13~24.04.1","6.11.0-1013.14~24.04.1","6.11.0-1014.15~24.04.1","6.11.0-1015.16~24.04.2","6.11.0-1016.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1002.2","6.11.0-1003.3","6.11.0-1007.7","6.11.0-1010.10","6.11.0-1011.11","6.11.0-1012.12","6.11.0-1013.13","6.11.0-1016.16"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-nvidia-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1004.4","6.17.0-1008.8","6.17.0-1014.14","6.17.0-1018.18","6.17.0-1021.21","6.17.0-1026.26","6.17.0-1029.29","6.17.0-1031.31","6.17.0-1032.32"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1007.7","6.11.0-1008.8","6.11.0-1009.9","6.11.0-1010.10","6.11.0-1011.11","6.11.0-1012.12","6.11.0-1013.13","6.11.0-1015.15","6.11.0-1016.16","6.11.0-1017.17","6.11.0-1018.18","6.11.0-1020.20","6.11.0-1021.21","6.11.0-1022.22","6.11.0-1023.23","6.11.0-1024.24","6.11.0-1025.25","6.11.0-1027.27"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1004.4","6.14.0-1005.5","6.14.0-1006.6","6.14.0-1007.7","6.14.0-1008.8","6.14.0-1010.10","6.14.0-1011.11","6.14.0-1012.12","6.14.0-1013.13","6.14.0-1014.14","6.14.0-1015.15","6.14.0-1016.16","6.14.0-1017.17","6.14.0-1018.18","6.14.0-1019.19","6.14.0-1020.20"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1005.5","6.17.0-1006.6","6.17.0-1007.7","6.17.0-1008.8","6.17.0-1009.9","6.17.0-1010.10","6.17.0-1011.11","6.17.0-1012.12","6.17.0-1017.17","6.17.0-1020.20","6.17.0-1023.23","6.17.0-1024.24","6.17.0-1025.25","6.17.0-1028.28","6.17.0-1030.30","6.17.0-1032.32","6.17.0-1033.33"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oem-6.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-1003.3","6.8.0-1004.4","6.8.0-1005.5","6.8.0-1006.6","6.8.0-1007.7","6.8.0-1008.8","6.8.0-1009.9","6.8.0-1010.10","6.8.0-1011.11","6.8.0-1012.12","6.8.0-1013.13","6.8.0-1014.14","6.8.0-1016.16","6.8.0-1017.17","6.8.0-1018.18","6.8.0-1019.19","6.8.0-1020.20","6.8.0-1024.24","6.8.0-1025.25","6.8.0-1026.26","6.8.0-1027.27","6.8.0-1028.28","6.8.0-1029.29","6.8.0-1030.30","6.8.0-1031.31","6.8.0-1032.32"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1007.7~24.04.1","6.14.0-1009.9~24.04.1","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1016.16~24.04.1","6.14.0-1017.17~24.04.1","6.14.0-1018.18~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-oracle-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1004.4~24.04.2","6.17.0-1007.7~24.04.1","6.17.0-1009.9~24.04.1","6.17.0-1010.10~24.04.1","6.17.0-1011.11~24.04.1","6.17.0-1014.14~24.04.1","6.17.0-1016.16~24.04.1","6.17.0-1018.18~24.04.1","6.17.0-1019.19~24.04.3","6.17.0-1020.20"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-2019.20"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.1-1015.16"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-9.9.1","6.8.0-20.20.1","6.8.0-28.28.1","6.8.0-31.31.1","6.8.0-35.35.1","6.8.0-36.36.1","6.8.0-38.38.1","6.8.0-39.39.1","6.8.0-40.40.1","6.8.0-41.41.1","6.8.0-44.44.1","6.8.0-47.47.1","6.8.0-48.48.1","6.8.0-49.49.1","6.8.0-50.51.1","6.8.0-51.52.1","6.8.0-52.53.1","6.8.0-53.55.1","6.8.0-55.57.1","6.8.0-56.58.1","6.8.0-57.59.1","6.8.0-58.60.1","6.8.0-59.61.1","6.8.0-60.63.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-22.22.1~24.04.1","6.14.0-23.23.1~24.04.1","6.14.0-24.24.1~24.04.1","6.14.0-27.27.1~24.04.1","6.14.0-28.28.1~24.04.1","6.14.0-29.29.1~24.04.1","6.14.0-32.32.1~24.04.1","6.14.0-33.33.1~24.04.1","6.14.0-34.34.1~24.04.1","6.14.0-35.35.1~24.04.1","6.14.0-36.36.1~24.04.1","6.14.0-37.37.1~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-14.14.1~24.04.1","6.17.0-19.19.1~24.04.1","6.17.0-20.20.1~24.04.1","6.17.0-22.22.1~24.04.1","6.17.0-23.23.1~24.04.1","6.17.0-29.29.1~24.04.1","6.17.0-35.35.1~24.04.1","6.17.0-38.38.1~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime-6.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1003.3~24.04.3","6.14.0-1010.10~24.04.1","6.14.0-1011.11~24.04.1","6.14.0-1012.12~24.04.1","6.14.0-1013.13~24.04.1","6.14.0-1014.14~24.04.1","6.14.0-1015.15~24.04.1","6.14.0-1016.16~24.04.1","6.14.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:Realtime:24.04:LTS","package":"linux-realtime-6.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1004.5~24.04.2","6.17.0-1006.7~24.04.1","6.17.0-1008.9~24.04.1","6.17.0-1009.10~24.04.1","6.17.0-1010.11~24.04.1","6.17.0-1011.12~24.04.1","6.17.0-1013.15~24.04.1","6.17.0-1014.16~24.04.1","6.17.0-1017.19~24.04.1","6.17.0-1018.20~24.04.1","6.17.0-1019.22"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-15.15","6.15.0-3.3","6.15.0-4.4","6.16.0-13.13","6.16.0-16.16","6.17.0-3.3","6.17.0-4.4","6.17.0-5.5","6.17.0-6.6","6.17.0-7.7","6.17.0-8.8","6.17.0-12.12","6.17.0-14.14","6.17.0-19.19","6.17.0-20.20","6.17.0-22.22","6.17.0-23.23","6.17.0-29.29","6.17.0-35.35","6.17.0-40.40"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1005.5","6.14.0-1007.7+25.10.2","6.16.0-1001.1","6.17.0-1001.1","6.17.0-1002.2","6.17.0-1003.3","6.17.0-1004.4","6.17.0-1005.5","6.17.0-1006.6","6.17.0-1007.7","6.17.0-1009.9","6.17.0-1010.10","6.17.0-1012.12","6.17.0-1013.13","6.17.0-1015.15","6.17.0-1017.17","6.17.0-1019.19"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1004.4","6.14.0-1007.7+25.10.1","6.16.0-1001.1","6.17.0-1002.2","6.17.0-1003.3","6.17.0-1004.4","6.17.0-1006.6","6.17.0-1007.7","6.17.0-1008.8","6.17.0-1010.10","6.17.0-1011.11","6.17.0-1013.13","6.17.0-1015.15","6.17.0-1017.17","6.17.0-1018.18","6.17.0-1020.20"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.17.0-1003.3","6.17.0-1004.4","6.17.0-1005.5","6.17.0-1007.7","6.17.0-1008.8","6.17.0-1010.10","6.17.0-1012.12","6.17.0-1014.14","6.17.0-1015.15","6.17.0-1017.17"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1006.6","6.14.0-1009.9+25.10.1","6.16.0-1001.1","6.17.0-1001.1","6.17.0-1002.2","6.17.0-1003.3","6.17.0-1004.4","6.17.0-1005.5","6.17.0-1006.6","6.17.0-1007.7","6.17.0-1009.9","6.17.0-1010.10","6.17.0-1012.12","6.17.0-1013.13","6.17.0-1016.17","6.17.0-1018.19","6.17.0-1020.22"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1005.5","6.14.0-1007.7+25.10.1","6.16.0-1001.1","6.17.0-1001.1","6.17.0-1002.2","6.17.0-1003.3","6.17.0-1005.5","6.17.0-1006.6","6.17.0-1007.7","6.17.0-1009.9","6.17.0-1010.10","6.17.0-1011.11","6.17.0-1012.12","6.17.0-1014.14","6.17.0-1016.16","6.17.0-1018.18"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-raspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1005.5","6.17.0-1003.3","6.17.0-1004.4","6.17.0-1005.5","6.17.0-1006.6","6.17.0-1007.7","6.17.0-1008.8","6.17.0-1010.10","6.17.0-1011.11","6.17.0-1013.13","6.17.0-1014.14","6.17.0-1017.17","6.17.0-1018.18","6.17.0-1021.21"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-1002.2","6.17.0-1001.2","6.17.0-1002.3","6.17.0-1003.4","6.17.0-1004.5","6.17.0-1005.6","6.17.0-1006.7","6.17.0-1008.9","6.17.0-1009.10","6.17.0-1010.11","6.17.0-1011.12","6.17.0-1013.15","6.17.0-1014.16","6.17.0-1017.19"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.14.0-13.13.2","6.17.0-4.4.1","6.17.0-5.5.1","6.17.0-6.6.1","6.17.0-7.7.1","6.17.0-8.8.1","6.17.0-12.12.1","6.17.0-14.14.1","6.17.0-19.19.1","6.17.0-20.20.1","6.17.0-22.22.1","6.17.0-23.23.1","6.17.0-29.29.1","6.17.0-35.35.1","6.17.0-40.40.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"linux-nvidia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.0-1006.6"}]}],"versions":["7.0.0-1005.5"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"linux-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.0-1006.6"]}],"products":[{"vendor":"linux","product":"linux"},{"vendor":"linux","product":"linux_kernel"}],"references":[{"url":"https://git.kernel.org/stable/c/0b832aad33e6f160fda310f0306a6483d85e9d6e","tags":["Patch","web"]},{"url":"https://git.kernel.org/stable/c/5dff799c677152dde963c3917bacd9127b03e145","tags":["Patch","web"]},{"url":"https://git.kernel.org/stable/c/7b2380f0a0e374010c1a4a13203511b9dee5b166","tags":["Patch","web"]},{"url":"https://git.kernel.org/stable/c/976ff48c2ac6e6b25b01428c9d7997bcd0fb2949","tags":["Patch","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31736","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-pp62-pwj6-ppp4"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-31736","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31736.json","tags":["advisory"]},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-31736","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622043-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1243603","tags":["report"]},{"url":"https://bugzilla.suse.com/1260539","tags":["report"]},{"url":"https://bugzilla.suse.com/1260584","tags":["report"]},{"url":"https://bugzilla.suse.com/1261590","tags":["report"]},{"url":"https://bugzilla.suse.com/1262634","tags":["report"]},{"url":"https://bugzilla.suse.com/1262656","tags":["report"]},{"url":"https://bugzilla.suse.com/1262668","tags":["report"]},{"url":"https://bugzilla.suse.com/1262754","tags":["report"]},{"url":"https://bugzilla.suse.com/1262755","tags":["report"]},{"url":"https://bugzilla.suse.com/1262771","tags":["report"]},{"url":"https://bugzilla.suse.com/1263067","tags":["report"]},{"url":"https://bugzilla.suse.com/1263068","tags":["report"]},{"url":"https://bugzilla.suse.com/1263102","tags":["report"]},{"url":"https://bugzilla.suse.com/1263169","tags":["report"]},{"url":"https://bugzilla.suse.com/1263769","tags":["report"]},{"url":"https://bugzilla.suse.com/1263774","tags":["report"]},{"url":"https://bugzilla.suse.com/1263908","tags":["report"]},{"url":"https://bugzilla.suse.com/1264011","tags":["report"]},{"url":"https://bugzilla.suse.com/1264014","tags":["report"]},{"url":"https://bugzilla.suse.com/1264016","tags":["report"]},{"url":"https://bugzilla.suse.com/1264063","tags":["report"]},{"url":"https://bugzilla.suse.com/1264112","tags":["report"]},{"url":"https://bugzilla.suse.com/1264300","tags":["report"]},{"url":"https://bugzilla.suse.com/1264409","tags":["report"]},{"url":"https://bugzilla.suse.com/1264437","tags":["report"]},{"url":"https://bugzilla.suse.com/1264669","tags":["report"]},{"url":"https://bugzilla.suse.com/1264716","tags":["report"]},{"url":"https://bugzilla.suse.com/1264719","tags":["report"]},{"url":"https://bugzilla.suse.com/1264720","tags":["report"]},{"url":"https://bugzilla.suse.com/1264722","tags":["report"]},{"url":"https://bugzilla.suse.com/1264726","tags":["report"]},{"url":"https://bugzilla.suse.com/1264832","tags":["report"]},{"url":"https://bugzilla.suse.com/1264989","tags":["report"]},{"url":"https://bugzilla.suse.com/1265044","tags":["report"]},{"url":"https://bugzilla.suse.com/1265110","tags":["report"]},{"url":"https://bugzilla.suse.com/1265925","tags":["report"]},{"url":"https://bugzilla.suse.com/1265928","tags":["report"]},{"url":"https://bugzilla.suse.com/1266001","tags":["report"]},{"url":"https://bugzilla.suse.com/1266238","tags":["report"]},{"url":"https://bugzilla.suse.com/1266307","tags":["report"]},{"url":"https://bugzilla.suse.com/1266395","tags":["report"]},{"url":"https://bugzilla.suse.com/1266402","tags":["report"]},{"url":"https://bugzilla.suse.com/1266414","tags":["report"]},{"url":"https://bugzilla.suse.com/1266759","tags":["report"]},{"url":"https://bugzilla.suse.com/1266765","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-20585","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23444","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31464","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31480","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31483","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31493","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31516","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31521","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31568","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31575","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43009","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43012","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43054","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43333","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43361","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43414","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45843","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46110","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46243","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622048-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3150","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622076-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622087-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-31736","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-31736","tags":["report"]},{"url":"https://git.kernel.org/linus/976ff48c2ac6e6b25b01428c9d7997bcd0fb2949","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-31736","title":"net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled\n\nIf the gmac0 is disabled, the precheck for a valid ingress device will\ncause a NULL pointer deref and crash the system. This happens because\neth-\u003enetdev[0] will be NULL but the code will directly try to access\nnetdev_ops.\n\nInstead of just checking for the first net_device, it must be checked if\nany of the mtk_eth net_devices is matching the netdev_ops of the ingress\ndevice.","status":"published","published":"2026-05-01T14:14:33.583Z","modified":"2026-05-11T22:14:45.998Z","updated_at":"2026-11-02T14:19:51.277563Z"}],"euvd":[{"id":"EUVD-2026-26549","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled\n\nIf the gmac0 is disabled, the precheck for a valid ingress device will\ncause a NULL pointer deref and crash the system. This happens because\neth-\u003enetdev[0] will be NULL but the code will directly try to access\nnetdev_ops.\n\nInstead of just checking for the first net_device, it must be checked if\nany of the mtk_eth net_devices is matching the netdev_ops of the ingress\ndevice.","status":"published","published":"2026-05-01T14:14:33Z","modified":"2026-05-11T22:14:45Z","updated_at":"2026-11-02T19:04:43.980793Z"}],"ghsa":[{"id":"GHSA-pp62-pwj6-ppp4","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: mtk_ppe:...","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled\n\nIf the gmac0 is disabled, the precheck for a valid ingress device will\ncause a NULL pointer deref and crash the system. This happens because\neth-\u003enetdev[0] will be NULL but the code will directly try to access\nnetdev_ops.\n\nInstead of just checking for the first net_device, it must be checked if\nany of the mtk_eth net_devices is matching the netdev_ops of the ingress\ndevice.","status":"published","published":"2026-05-01T15:30:34Z","modified":"2026-05-07T18:31:39Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:07:57.010667Z"}],"nvd":[{"id":"CVE-2026-31736","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled\n\nIf the gmac0 is disabled, the precheck for a valid ingress device will\ncause a NULL pointer deref and crash the system. This happens because\neth-\u003enetdev[0] will be NULL but the code will directly try to access\nnetdev_ops.\n\nInstead of just checking for the first net_device, it must be checked if\nany of the mtk_eth net_devices is matching the netdev_ops of the ingress\ndevice.","status":"published","published":"2026-05-01T15:16:36.24Z","modified":"2026-06-17T10:34:20.203Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:12:16.626888Z"}],"osv":[{"id":"BELL-CVE-2026-31736","status":"published","published":"2026-05-06T06:11:04.93106Z","modified":"2026-06-25T07:18:37.06527961Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:23.572955Z"},{"id":"DEBIAN-CVE-2026-31736","description":"In the Linux kernel, the following vulnerability has been resolved:  net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled  If the gmac0 is disabled, the precheck for a valid ingress device will cause a NULL pointer deref and crash the system. This happens because eth-\u003enetdev[0] will be NULL but the code will directly try to access netdev_ops.  Instead of just checking for the first net_device, it must be checked if any of the mtk_eth net_devices is matching the netdev_ops of the ingress device.","status":"published","published":"2026-05-01T15:16:36.24Z","modified":"2026-10-01T03:03:21.665917946Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:54.232518Z"},{"id":"UBUNTU-CVE-2026-31736","description":"In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled If the gmac0 is disabled, the precheck for a valid ingress device will cause a NULL pointer deref and crash the system. This happens because eth-\u003enetdev[0] will be NULL but the code will directly try to access netdev_ops. Instead of just checking for the first net_device, it must be checked if any of the mtk_eth net_devices is matching the netdev_ops of the ingress device.","status":"published","published":"2026-05-01T15:16:00Z","modified":"2026-11-11T09:37:17.767096818Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-11T10:01:35.424703Z"},{"id":"CVE-2026-31736","title":"net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled\n\nIf the gmac0 is disabled, the precheck for a valid ingress device will\ncause a NULL pointer deref and crash the system. This happens because\neth-\u003enetdev[0] will be NULL but the code will directly try to access\nnetdev_ops.\n\nInstead of just checking for the first net_device, it must be checked if\nany of the mtk_eth net_devices is matching the netdev_ops of the ingress\ndevice.","status":"published","published":"2026-05-01T14:14:33.583Z","modified":"2026-10-28T02:30:43.21997861Z","updated_at":"2026-11-02T15:45:01.218144Z"},{"id":"openSUSE-SU-2026:20912-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2023-20585: iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 (bsc#1243603).\n- CVE-2026-3150: bcache: fix cached_dev.sb_bio use-after-free and crash (bsc#1263169).\n- CVE-2026-23359: bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584).\n- CVE-2026-23380: tracing: Fix WARN_ON in tracing_buffers_mmap_close (bsc#1260539).\n- CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).\n- CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).\n- CVE-2026-31480: tracing: Fix potential deadlock in cpu hotplug with osnoise (bsc#1262634).\n- CVE-2026-31483: s390/barrier: Make array_index_mask_nospec() __always_inline (bsc#1261590 bsc#1262771).\n- CVE-2026-31493: RDMA/efa: Fix use of completion ctx after free (bsc#1262668).\n- CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).\n- CVE-2026-31521: module: Fix kernel panic when a symbol st_shndx is out of bounds (bsc#1263102).\n- CVE-2026-31568: s390/mm: Add missing secure storage access fixups for donated memory (bsc#1263068).\n- CVE-2026-31575: mm/userfaultfd: fix hugetlb fault mutex hash calculation (bsc#1263067).\n- CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).\n- CVE-2026-31614: smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774).\n- CVE-2026-31729: usb: typec: ucsi: validate connector number in ucsi_notify_common() (bsc#1264112).\n- CVE-2026-31736: net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled (bsc#1263908).\n- CVE-2026-43012: net/mlx5: Fix switchdev mode rollback in case of failure (bsc#1264016).\n- CVE-2026-43013: net/mlx5: lag: Check for LAG device before creating debugfs (bsc#1264011).\n- CVE-2026-43054: scsi: target: tcm_loop: Drain commands in target_reset handler (bsc#1264063).\n- CVE-2026-43112: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (bsc#1264437).\n- CVE-2026-43234: team: avoid NETDEV_CHANGEMTU event when unregistering slave (bsc#1264409).\n- CVE-2026-43252: mptcp: pm: in-kernel: always set ID as avail when rm endp (bsc#1264300).\n- CVE-2026-43325: wifi: iwlwifi: mvm: don't send a 6E related command when not supported (bsc#1265110).\n- CVE-2026-43328: cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path (bsc#1264832).\n- CVE-2026-43333: bpf: reject direct access to nullable PTR_TO_BUF pointers (bsc#1264726).\n- CVE-2026-43338: btrfs: reserve enough transaction items for qgroup ioctls (bsc#1264716).\n- CVE-2026-43341: net/ipv6: ioam6: prevent schema length wraparound in trace fill (bsc#1265044).\n- CVE-2026-43359: btrfs: fix transaction abort on set received ioctl due to item overflow (bsc#1264719).\n- CVE-2026-43360: btrfs: fix transaction abort on file creation due to name hash collision (bsc#1264720).\n- CVE-2026-43361: btrfs: fix transaction abort when snapshotting received subvolumes (bsc#1264722).\n- CVE-2026-43362: smb: client: fix in-place encryption corruption in SMB2_write() (bsc#1264989).\n- CVE-2026-43414: scsi: qla2xxx: Completely fix fcport double free (bsc#1264669).\n- CVE-2026-43499: rtmutex: Use waiter::task instead of current in remove_waiter() (bsc#1266001).\n- CVE-2026-45843: slip: bound decode() reads against the compressed packet length (bsc#1266395).\n- CVE-2026-46110: net: stmmac: rename STMMAC_GET_ENTRY() -\u003e STMMAC_NEXT_ENTRY() (bsc#1266759).\n\nThe following non security issues were fixed:\n\n- ACPI: x86: cmos_rtc: Clean up address space handler driver (stable-fixes).\n- ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver (git-fixes).\n- ALSA: asihpi: Fix potential OOB array access at reading cache (stable-fixes).\n- ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 (stable-fixes).\n- ALSA: pcm: Don't setup bogus iov_iter for silencing (git-fixes).\n- ALSA: pcm: oss: Fix setup list UAF on proc write error (git-fixes).\n- ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417 (git-fixes).\n- ALSA: seq: avoid past-the-end iterator in snd_seq_create_port() (git-fixes).\n- ALSA: seq: Serialize UMP output teardown with event_input (git-fixes).\n- ALSA: timer: avoid past-the-end iterator in snd_timer_dev_register() (git-fixes).\n- ALSA: ua101: Reject too-short USB descriptors (git-fixes).\n- arm64: tlb: Flush walk cache when unsharing PMD tables (git-fixes).\n- ASoC: codecs: simple-mux: Fix enum control bounds check (git-fixes).\n- ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() (git-fixes).\n- ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors (git-fixes).\n- ASoC: qcom: q6asm-dai: close stream only when running (git-fixes).\n- ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks (git-fixes).\n- ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params (git-fixes).\n- ASoC: SOF: ipc3: Use standard dev_dbg API (stable-fixes).\n- auxdisplay: line-display: fix OOB read on zero-length message_store() (git-fixes).\n- bcache: fix uninitialized closure object (git-fixes).\n- Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() (git-fixes).\n- Bluetooth: bnep: Fix UAF read of dev-\u003ename (git-fixes).\n- Bluetooth: btmtk: accept too short WMT FUNC_CTRL events (git-fixes).\n- Bluetooth: btmtk: fix urb-\u003esetup_packet leak in error paths (git-fixes).\n- Bluetooth: btusb: Allow firmware re-download when version matches (git-fixes).\n- Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (git-fixes).\n- Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (git-fixes).\n- Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (git-fixes).\n- Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (git-fixes).\n- Bluetooth: HIDP: fix missing length checks in hidp_input_report() (git-fixes).\n- Bluetooth: ISO: drop ISO_END frames received without prior ISO_START (git-fixes).\n- Bluetooth: ISO: fix UAF in iso_recv_frame (git-fixes).\n- Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (git-fixes).\n- Bluetooth: l2cap: clear chan-\u003eident on ECRED reconfiguration success (git-fixes).\n- Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer (git-fixes).\n- Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn (git-fixes).\n- Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (git-fixes).\n- Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (git-fixes).\n- Bluetooth: MGMT: validate Add Extended Advertising Data length (git-fixes).\n- Bluetooth: serialize accept_q access (git-fixes).\n- btrfs: do not mark inode incompressible after inline attempt fails (git-fixes).\n- comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() (git-fixes).\n- comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() (git-fixes).\n- device property: set fwnode-\u003esecondary to NULL in fwnode_init() (git-fixes).\n- dm: fix a buffer overflow in ioctl processing (git-fixes).\n- drm/amd/display: Fix integer overflow in bios_get_image() (stable-fixes).\n- drm/amd/display: Validate GPIO pin LUT table size before iterating (stable-fixes).\n- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (stable-fixes).\n- drm/amd/pm/si: Disregard vblank time when no displays are connected (git-fixes).\n- drm/amdgpu/uvd3.1: Don't validate the firmware when already validated (git-fixes).\n- drm/amdgpu/uvd4.2: Don't initialize UVD 4.2 when DPM is disabled (git-fixes).\n- drm/amdgpu/vce2: Fix VCE 2 firmware size and offsets (git-fixes).\n- drm/amdgpu/vce3: Fix VCE 3 firmware size and offsets (git-fixes).\n- drm/amdgpu/vpe: Force collaborate sync after TRAP (stable-fixes).\n- drm/amdgpu: add amdgpu_device reference in ip block (stable-fixes).\n- drm/amdgpu: fix spelling typos (stable-fixes).\n- drm/amdgpu: update the handle ptr in dump_ip_state (stable-fixes).\n- drm/amdgpu: update the handle ptr in early_init (stable-fixes).\n- drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe (git-fixes).\n- drm/bridge: it66121: acquire reset GPIO in probe (git-fixes).\n- drm/bridge: megachips: remove bridge when irq request fails (git-fixes).\n- drm/hyperv: validate resolution_count and fix WIN8 fallback (git-fixes).\n- drm/hyperv: validate VMBus packet size in receive callback (git-fixes).\n- drm/i915/dp: Fix readback for target_rr in Adaptive Sync SDP (git-fixes).\n- drm/i915: Fix potential UAF in TTM object purge (git-fixes).\n- drm/msm/dsi: don't dump registers past the mapped region (git-fixes).\n- drm/msm/snapshot: fix dumping of the unaligned regions (git-fixes).\n- drm/radeon/evergreen_cs: Add missing NULL prefix check in surface check (git-fixes).\n- drm/virtio: use uninterruptible resv lock for plane updates (git-fixes).\n- drm/xe/gsc: Fix double-free of managed BO in error path (git-fixes).\n- drm/xe/oa: Fix exec_queue leak on width check in stream open (git-fixes).\n- drm/xe/pf: Fix CFI failure in debugfs access (git-fixes).\n- drm/xe/vf: Fix signature of print functions (git-fixes).\n- drm/xe: Define CACHE_MODE_1 as MCR register (git-fixes).\n- efi: Allocate runtime workqueue before ACPI init (git-fixes).\n- firmware: arm_ffa: Align RxTx buffer size before mapping (git-fixes).\n- firmware: arm_ffa: Check for NULL FF-A ID table while driver registration (git-fixes).\n- firmware: arm_ffa: Fix per-vcpu self notifications handling in workqueue (git-fixes).\n- firmware: arm_ffa: Skip free_pages on RX buffer alloc failure (git-fixes).\n- gve: Add RSS cache for non RSS device option scenario (bsc#1265925).\n- gve: add XDP DROP and PASS support for DQ (bsc#1265925).\n- gve: Enable reading max ring size from the device in DQO-QPL mode (bsc#1265925).\n- gve: introduce config-based allocation for XDP (bsc#1265925).\n- gve: merge packet buffer size fields (bsc#1265925).\n- gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (bsc#1265925).\n- gve: update GQ RX to use buf_size (bsc#1265925).\n- gve: Update QPL page registration logic (bsc#1265925).\n- gve: update XDP allocation path support RX buffer posting (bsc#1265925).\n- HID: playstation: Clamp num_touch_reports (git-fixes).\n- HID: quirks: really enable the intended work around for appledisplay (git-fixes).\n- HID: uclogic: Fix regression of input name assignment (git-fixes).\n- hwmon: (lenovo-ec-sensors): Convert to devm_request_region() (git-fixes).\n- hwmon: (lenovo-ec-sensors): Fix EC \"MCHP\" signature validation logic (git-fixes).\n- hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer (git-fixes).\n- hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR (git-fixes).\n- hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple (git-fixes).\n- hwmon: (pmbus/adm1266) include adapter number in GPIO line label (git-fixes).\n- hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer (git-fixes).\n- hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() (git-fixes).\n- hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() (git-fixes).\n- hwmon: (pmbus/adm1266) reject implausible blackbox record_count (git-fixes).\n- hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors (git-fixes).\n- hwmon: (pmbus/adm1266) seed timestamp from the real-time clock (git-fixes).\n- hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX (git-fixes).\n- iio: adc: mt6359: fix unchecked return value in mt6358_read_imp (git-fixes).\n- iio: adc: npcm: fix unbalanced clk_disable_unprepare() (git-fixes).\n- iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw (git-fixes).\n- iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux (git-fixes).\n- iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (git-fixes).\n- iio: buffer: hw-consumer: fix use-after-free in error path (git-fixes).\n- iio: dac: ad5686: acquire lock when doing powerdown control (git-fixes).\n- iio: dac: ad5686: fix input raw value check (git-fixes).\n- iio: dac: max5821: fix return value check in powerdown sync (git-fixes).\n- iio: gyro: adis16260: fix division by zero in write_raw (git-fixes).\n- iio: gyro: itg3200: fix i2c read into the wrong stack location (git-fixes).\n- iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer (git-fixes).\n- iio: light: cm3323: fix reg_conf not being initialized correctly (git-fixes).\n- iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL (git-fixes).\n- iio: ssp_sensors: cancel delayed work_refresh on remove (git-fixes).\n- iio: temperature: tsys01: fix broken PROM checksum validation (git-fixes).\n- Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem (git-fixes).\n- Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() (git-fixes).\n- Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size (git-fixes).\n- Input: xpad - fix out-of-bounds access for Share button (git-fixes).\n- KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE (git-fixes).\n- KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation (git-fixes).\n- KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 (git-fixes).\n- KVM: x86: Fix Xen hypercall tracepoint argument assignment (git-fixes).\n- KVM: x86: Return the VM's configured APIC bus frequency when queried (git-fixes).\n- media: i2c: og01a1b: Fix V4L2 subdevice data initialization on probe (git-fixes).\n- media: i2c: og01a1b: Replace client-\u003edev usage (stable-fixes).\n- net: mana: Add NULL guards in teardown path to prevent panic on attach failure (git-fixes).\n- net: mana: Expose hardware diagnostic info via debugfs (bsc#1266414).\n- net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (bsc#1265928).\n- net: mana: hardening: Reject zero max_num_queues from GDMA_QUERY_MAX_RESOURCES (git-fixes).\n- net: mana: hardening: Reject zero max_num_queues from MANA_QUERY_VPORT_CONFIG (git-fixes).\n- net: mana: Skip redundant detach on already-detached port (git-fixes).\n- net: mana: Use kvmalloc for large RX queue and buffer allocations (bsc#1266765).\n- net: mana: Use per-queue allocation for tx_qp to reduce allocation size (bsc#1266765).\n- net: mana: validate rx_req_idx to prevent out-of-bounds array access (bsc#1266402).\n- parport: Fix race between port and client registration (git-fixes).\n- platform/surface: aggregator_registry: omit battery \u0026 AC nodes on Surface Laptop 7 (git-fixes).\n- platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL (git-fixes).\n- platform/x86: hp_accel: Check ACPI_COMPANION() against NULL (git-fixes).\n- platform/x86: intel-hid: Check ACPI_HANDLE() against NULL (git-fixes).\n- platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL (git-fixes).\n- RDMA/efa: Check stored completion CTX command ID with received one (git-fixes).\n- RDMA/efa: Extend admin timeout error print (git-fixes).\n- RDMA/efa: Fix possible deadlock (git-fixes).\n- RDMA/efa: Improve admin completion context state machine (git-fixes).\n- RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port (git-fixes).\n- Revert \"ACPI: CPPC: Adjust debug messages in amd_set_max_freq_ratio() to warn\" (git-fixes).\n- s390/pfault: Fix virtual vs physical address confusion (bsc#1262754).\n- scsi: devinfo: Add BLIST_SKIP_IO_HINTS for Iomega ZIP (git-fixes).\n- scsi: mpi3mr: Clear reset history on ready and recheck state after timeout (git-fixes).\n- scsi: ses: Handle positive SCSI error from ses_recv_diag() (git-fixes).\n- scsi: ufs: core: Fix shift out of bounds when MAXQ=32 (git-fixes).\n- security/keys: fix missed RCU read section on lookup (stable-fixes).\n- serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma (git-fixes).\n- serial: qcom-geni: fix UART_RX_PAR_EN bit position (git-fixes).\n- serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (git-fixes).\n- smb: client: reject userspace cifs.spnego descriptions (bsc#1266238).\n- spi: ep93xx: fix error pointer deref after DMA setup failure (git-fixes).\n- spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() (git-fixes).\n- spi: qup: fix error pointer deref after DMA setup failure (git-fixes).\n- spi: sprd: fix error pointer deref after DMA setup failure (git-fixes).\n- spi: ti-qspi: fix use-after-free after DMA setup failure (git-fixes).\n- thunderbolt: property: Reject dir_len \u003c 4 to prevent size_t underflow (git-fixes).\n- thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() (git-fixes).\n- tracing: Switch trace_osnoise.c code over to use guard() and __free() (bsc#1262634).\n- tty: serial: pch_uart: add check for dma_alloc_coherent() (git-fixes).\n- tty: serial: samsung: Remove redundant port lock acquisition in rx helpers (git-fixes).\n- USB: cdc-acm: Fix bit overlap and move quirk definitions to header (git-fixes).\n- usb: cdns3: gadget: fix request skipping after clearing halt (git-fixes).\n- usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure (git-fixes).\n- usb: chipidea: core: convert ci_role_switch to local variable (git-fixes).\n- usb: dwc2: Fix use after free in debug code (git-fixes).\n- usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling (git-fixes).\n- usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports (git-fixes).\n- usb: gadget: f_fs: copy only received bytes on short ep0 read (git-fixes).\n- usb: gadget: f_fs: serialize DMABUF cancel against request completion (git-fixes).\n- usb: gadget: f_hid: fix device reference leak in hidg_alloc() (git-fixes).\n- usb: gadget: net2280: Fix double free in probe error path (git-fixes).\n- usb: gadget: uvc: hold opts-\u003elock across XU walks in uvc_function_bind (git-fixes).\n- USB: serial: belkin_sa: validate interrupt status length (git-fixes).\n- USB: serial: cypress_m8: validate interrupt packet headers (git-fixes).\n- USB: serial: keyspan: fix missing indat transfer sanity check (git-fixes).\n- USB: serial: mct_u232: fix missing interrupt-in transfer sanity check (git-fixes).\n- USB: serial: mxuport: fix memory corruption with small endpoint (git-fixes).\n- USB: serial: omninet: fix memory corruption with small endpoint (git-fixes).\n- USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL (git-fixes).\n- USB: serial: safe_serial: fix memory corruption with small endpoint (git-fixes).\n- usb: typec: tcpm: improve handling of DISCOVER_MODES failures (git-fixes).\n- usb: typec: ucsi: Don't update power_supply on power role change if not connected (git-fixes).\n- usb: usbtmc: check URB actual_length for interrupt-IN notifications (git-fixes).\n- usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize (git-fixes).\n- usbip: vudc: Fix use after free bug in vudc_remove due to race condition (git-fixes).\n- virt: sev-guest: Explicitly leak pages in unknown state (git-fixes).\n- wifi: ath10k: skip WMI and beacon transmission when device is wedged (git-fixes).\n- wifi: ath11k: clear shared SRNG pointer state on restart (git-fixes).\n- wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() (git-fixes).\n- wifi: ath11k: fix error path leaks in some WMI calls (git-fixes).\n- wifi: ath11k: fix error path leaks in some WMI WOW calls (git-fixes).\n- wifi: ath11k: fix peer resolution on rx path when peer_id=0 (git-fixes).\n- wifi: ath11k: fix use after free in ath11k_dp_rx_msdu_coalesce() (git-fixes).\n- wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (git-fixes).\n- wifi: mac80211: consume only present negotiated TTLM maps (git-fixes).\n- wifi: mac80211: fix MLE defragmentation (git-fixes).\n- wifi: mac80211: fix multi-link element inheritance (git-fixes).\n","status":"published","published":"2026-06-05T18:24:53Z","modified":"2026-06-09T09:00:07.336575283Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22043-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2023-20585: iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 (bsc#1243603).\n- CVE-2026-3150: bcache: fix cached_dev.sb_bio use-after-free and crash (bsc#1263169).\n- CVE-2026-23359: bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584).\n- CVE-2026-23380: tracing: Fix WARN_ON in tracing_buffers_mmap_close (bsc#1260539).\n- CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).\n- CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).\n- CVE-2026-31480: tracing: Fix potential deadlock in cpu hotplug with osnoise (bsc#1262634).\n- CVE-2026-31483: s390/barrier: Make array_index_mask_nospec() __always_inline (bsc#1261590 bsc#1262771).\n- CVE-2026-31493: RDMA/efa: Fix use of completion ctx after free (bsc#1262668).\n- CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).\n- CVE-2026-31521: module: Fix kernel panic when a symbol st_shndx is out of bounds (bsc#1263102).\n- CVE-2026-31568: s390/mm: Add missing secure storage access fixups for donated memory (bsc#1263068).\n- CVE-2026-31575: mm/userfaultfd: fix hugetlb fault mutex hash calculation (bsc#1263067).\n- CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).\n- CVE-2026-31614: smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774).\n- CVE-2026-31729: usb: typec: ucsi: validate connector number in ucsi_notify_common() (bsc#1264112).\n- CVE-2026-31736: net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled (bsc#1263908).\n- CVE-2026-43012: net/mlx5: Fix switchdev mode rollback in case of failure (bsc#1264016).\n- CVE-2026-43013: net/mlx5: lag: Check for LAG device before creating debugfs (bsc#1264011).\n- CVE-2026-43054: scsi: target: tcm_loop: Drain commands in target_reset handler (bsc#1264063).\n- CVE-2026-43112: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (bsc#1264437).\n- CVE-2026-43234: team: avoid NETDEV_CHANGEMTU event when unregistering slave (bsc#1264409).\n- CVE-2026-43252: mptcp: pm: in-kernel: always set ID as avail when rm endp (bsc#1264300).\n- CVE-2026-43325: wifi: iwlwifi: mvm: don't send a 6E related command when not supported (bsc#1265110).\n- CVE-2026-43328: cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path (bsc#1264832).\n- CVE-2026-43333: bpf: reject direct access to nullable PTR_TO_BUF pointers (bsc#1264726).\n- CVE-2026-43338: btrfs: reserve enough transaction items for qgroup ioctls (bsc#1264716).\n- CVE-2026-43341: net/ipv6: ioam6: prevent schema length wraparound in trace fill (bsc#1265044).\n- CVE-2026-43359: btrfs: fix transaction abort on set received ioctl due to item overflow (bsc#1264719).\n- CVE-2026-43360: btrfs: fix transaction abort on file creation due to name hash collision (bsc#1264720).\n- CVE-2026-43361: btrfs: fix transaction abort when snapshotting received subvolumes (bsc#1264722).\n- CVE-2026-43362: smb: client: fix in-place encryption corruption in SMB2_write() (bsc#1264989).\n- CVE-2026-43414: scsi: qla2xxx: Completely fix fcport double free (bsc#1264669).\n- CVE-2026-43499: rtmutex: Use waiter::task instead of current in remove_waiter() (bsc#1266001).\n- CVE-2026-45843: slip: bound decode() reads against the compressed packet length (bsc#1266395).\n- CVE-2026-46110: net: stmmac: rename STMMAC_GET_ENTRY() -\u003e STMMAC_NEXT_ENTRY() (bsc#1266759).\n\nThe following non security issues were fixed:\n\n- ACPI: x86: cmos_rtc: Clean up address space handler driver (stable-fixes).\n- ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver (git-fixes).\n- ALSA: asihpi: Fix potential OOB array access at reading cache (stable-fixes).\n- ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 (stable-fixes).\n- ALSA: pcm: Don't setup bogus iov_iter for silencing (git-fixes).\n- ALSA: pcm: oss: Fix setup list UAF on proc write error (git-fixes).\n- ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417 (git-fixes).\n- ALSA: seq: avoid past-the-end iterator in snd_seq_create_port() (git-fixes).\n- ALSA: seq: Serialize UMP output teardown with event_input (git-fixes).\n- ALSA: timer: avoid past-the-end iterator in snd_timer_dev_register() (git-fixes).\n- ALSA: ua101: Reject too-short USB descriptors (git-fixes).\n- arm64: tlb: Flush walk cache when unsharing PMD tables (git-fixes).\n- ASoC: codecs: simple-mux: Fix enum control bounds check (git-fixes).\n- ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() (git-fixes).\n- ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors (git-fixes).\n- ASoC: qcom: q6asm-dai: close stream only when running (git-fixes).\n- ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks (git-fixes).\n- ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params (git-fixes).\n- ASoC: SOF: ipc3: Use standard dev_dbg API (stable-fixes).\n- auxdisplay: line-display: fix OOB read on zero-length message_store() (git-fixes).\n- bcache: fix uninitialized closure object (git-fixes).\n- Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() (git-fixes).\n- Bluetooth: bnep: Fix UAF read of dev-\u003ename (git-fixes).\n- Bluetooth: btmtk: accept too short WMT FUNC_CTRL events (git-fixes).\n- Bluetooth: btmtk: fix urb-\u003esetup_packet leak in error paths (git-fixes).\n- Bluetooth: btusb: Allow firmware re-download when version matches (git-fixes).\n- Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (git-fixes).\n- Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (git-fixes).\n- Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (git-fixes).\n- Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (git-fixes).\n- Bluetooth: HIDP: fix missing length checks in hidp_input_report() (git-fixes).\n- Bluetooth: ISO: drop ISO_END frames received without prior ISO_START (git-fixes).\n- Bluetooth: ISO: fix UAF in iso_recv_frame (git-fixes).\n- Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (git-fixes).\n- Bluetooth: l2cap: clear chan-\u003eident on ECRED reconfiguration success (git-fixes).\n- Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer (git-fixes).\n- Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn (git-fixes).\n- Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (git-fixes).\n- Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (git-fixes).\n- Bluetooth: MGMT: validate Add Extended Advertising Data length (git-fixes).\n- Bluetooth: serialize accept_q access (git-fixes).\n- btrfs: do not mark inode incompressible after inline attempt fails (git-fixes).\n- comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() (git-fixes).\n- comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() (git-fixes).\n- device property: set fwnode-\u003esecondary to NULL in fwnode_init() (git-fixes).\n- dm: fix a buffer overflow in ioctl processing (git-fixes).\n- drm/amd/display: Fix integer overflow in bios_get_image() (stable-fixes).\n- drm/amd/display: Validate GPIO pin LUT table size before iterating (stable-fixes).\n- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (stable-fixes).\n- drm/amd/pm/si: Disregard vblank time when no displays are connected (git-fixes).\n- drm/amdgpu/uvd3.1: Don't validate the firmware when already validated (git-fixes).\n- drm/amdgpu/uvd4.2: Don't initialize UVD 4.2 when DPM is disabled (git-fixes).\n- drm/amdgpu/vce2: Fix VCE 2 firmware size and offsets (git-fixes).\n- drm/amdgpu/vce3: Fix VCE 3 firmware size and offsets (git-fixes).\n- drm/amdgpu/vpe: Force collaborate sync after TRAP (stable-fixes).\n- drm/amdgpu: add amdgpu_device reference in ip block (stable-fixes).\n- drm/amdgpu: fix spelling typos (stable-fixes).\n- drm/amdgpu: update the handle ptr in dump_ip_state (stable-fixes).\n- drm/amdgpu: update the handle ptr in early_init (stable-fixes).\n- drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe (git-fixes).\n- drm/bridge: it66121: acquire reset GPIO in probe (git-fixes).\n- drm/bridge: megachips: remove bridge when irq request fails (git-fixes).\n- drm/hyperv: validate resolution_count and fix WIN8 fallback (git-fixes).\n- drm/hyperv: validate VMBus packet size in receive callback (git-fixes).\n- drm/i915/dp: Fix readback for target_rr in Adaptive Sync SDP (git-fixes).\n- drm/i915: Fix potential UAF in TTM object purge (git-fixes).\n- drm/msm/dsi: don't dump registers past the mapped region (git-fixes).\n- drm/msm/snapshot: fix dumping of the unaligned regions (git-fixes).\n- drm/radeon/evergreen_cs: Add missing NULL prefix check in surface check (git-fixes).\n- drm/virtio: use uninterruptible resv lock for plane updates (git-fixes).\n- drm/xe/gsc: Fix double-free of managed BO in error path (git-fixes).\n- drm/xe/oa: Fix exec_queue leak on width check in stream open (git-fixes).\n- drm/xe/pf: Fix CFI failure in debugfs access (git-fixes).\n- drm/xe/vf: Fix signature of print functions (git-fixes).\n- drm/xe: Define CACHE_MODE_1 as MCR register (git-fixes).\n- efi: Allocate runtime workqueue before ACPI init (git-fixes).\n- firmware: arm_ffa: Align RxTx buffer size before mapping (git-fixes).\n- firmware: arm_ffa: Check for NULL FF-A ID table while driver registration (git-fixes).\n- firmware: arm_ffa: Fix per-vcpu self notifications handling in workqueue (git-fixes).\n- firmware: arm_ffa: Skip free_pages on RX buffer alloc failure (git-fixes).\n- gve: Add RSS cache for non RSS device option scenario (bsc#1265925).\n- gve: add XDP DROP and PASS support for DQ (bsc#1265925).\n- gve: Enable reading max ring size from the device in DQO-QPL mode (bsc#1265925).\n- gve: introduce config-based allocation for XDP (bsc#1265925).\n- gve: merge packet buffer size fields (bsc#1265925).\n- gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (bsc#1265925).\n- gve: update GQ RX to use buf_size (bsc#1265925).\n- gve: Update QPL page registration logic (bsc#1265925).\n- gve: update XDP allocation path support RX buffer posting (bsc#1265925).\n- HID: playstation: Clamp num_touch_reports (git-fixes).\n- HID: quirks: really enable the intended work around for appledisplay (git-fixes).\n- HID: uclogic: Fix regression of input name assignment (git-fixes).\n- hwmon: (lenovo-ec-sensors): Convert to devm_request_region() (git-fixes).\n- hwmon: (lenovo-ec-sensors): Fix EC \"MCHP\" signature validation logic (git-fixes).\n- hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer (git-fixes).\n- hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR (git-fixes).\n- hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple (git-fixes).\n- hwmon: (pmbus/adm1266) include adapter number in GPIO line label (git-fixes).\n- hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer (git-fixes).\n- hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() (git-fixes).\n- hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() (git-fixes).\n- hwmon: (pmbus/adm1266) reject implausible blackbox record_count (git-fixes).\n- hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors (git-fixes).\n- hwmon: (pmbus/adm1266) seed timestamp from the real-time clock (git-fixes).\n- hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX (git-fixes).\n- iio: adc: mt6359: fix unchecked return value in mt6358_read_imp (git-fixes).\n- iio: adc: npcm: fix unbalanced clk_disable_unprepare() (git-fixes).\n- iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw (git-fixes).\n- iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux (git-fixes).\n- iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (git-fixes).\n- iio: buffer: hw-consumer: fix use-after-free in error path (git-fixes).\n- iio: dac: ad5686: acquire lock when doing powerdown control (git-fixes).\n- iio: dac: ad5686: fix input raw value check (git-fixes).\n- iio: dac: max5821: fix return value check in powerdown sync (git-fixes).\n- iio: gyro: adis16260: fix division by zero in write_raw (git-fixes).\n- iio: gyro: itg3200: fix i2c read into the wrong stack location (git-fixes).\n- iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer (git-fixes).\n- iio: light: cm3323: fix reg_conf not being initialized correctly (git-fixes).\n- iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL (git-fixes).\n- iio: ssp_sensors: cancel delayed work_refresh on remove (git-fixes).\n- iio: temperature: tsys01: fix broken PROM checksum validation (git-fixes).\n- Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem (git-fixes).\n- Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() (git-fixes).\n- Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size (git-fixes).\n- Input: xpad - fix out-of-bounds access for Share button (git-fixes).\n- KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE (git-fixes).\n- KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation (git-fixes).\n- KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 (git-fixes).\n- KVM: x86: Fix Xen hypercall tracepoint argument assignment (git-fixes).\n- KVM: x86: Return the VM's configured APIC bus frequency when queried (git-fixes).\n- media: i2c: og01a1b: Fix V4L2 subdevice data initialization on probe (git-fixes).\n- media: i2c: og01a1b: Replace client-\u003edev usage (stable-fixes).\n- net: mana: Add NULL guards in teardown path to prevent panic on attach failure (git-fixes).\n- net: mana: Expose hardware diagnostic info via debugfs (bsc#1266414).\n- net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (bsc#1265928).\n- net: mana: hardening: Reject zero max_num_queues from GDMA_QUERY_MAX_RESOURCES (git-fixes).\n- net: mana: hardening: Reject zero max_num_queues from MANA_QUERY_VPORT_CONFIG (git-fixes).\n- net: mana: Skip redundant detach on already-detached port (git-fixes).\n- net: mana: Use kvmalloc for large RX queue and buffer allocations (bsc#1266765).\n- net: mana: Use per-queue allocation for tx_qp to reduce allocation size (bsc#1266765).\n- net: mana: validate rx_req_idx to prevent out-of-bounds array access (bsc#1266402).\n- parport: Fix race between port and client registration (git-fixes).\n- platform/surface: aggregator_registry: omit battery \u0026 AC nodes on Surface Laptop 7 (git-fixes).\n- platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL (git-fixes).\n- platform/x86: hp_accel: Check ACPI_COMPANION() against NULL (git-fixes).\n- platform/x86: intel-hid: Check ACPI_HANDLE() against NULL (git-fixes).\n- platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL (git-fixes).\n- RDMA/efa: Check stored completion CTX command ID with received one (git-fixes).\n- RDMA/efa: Extend admin timeout error print (git-fixes).\n- RDMA/efa: Fix possible deadlock (git-fixes).\n- RDMA/efa: Improve admin completion context state machine (git-fixes).\n- RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port (git-fixes).\n- Revert \"ACPI: CPPC: Adjust debug messages in amd_set_max_freq_ratio() to warn\" (git-fixes).\n- s390/pfault: Fix virtual vs physical address confusion (bsc#1262754).\n- scsi: devinfo: Add BLIST_SKIP_IO_HINTS for Iomega ZIP (git-fixes).\n- scsi: mpi3mr: Clear reset history on ready and recheck state after timeout (git-fixes).\n- scsi: ses: Handle positive SCSI error from ses_recv_diag() (git-fixes).\n- scsi: ufs: core: Fix shift out of bounds when MAXQ=32 (git-fixes).\n- security/keys: fix missed RCU read section on lookup (stable-fixes).\n- serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma (git-fixes).\n- serial: qcom-geni: fix UART_RX_PAR_EN bit position (git-fixes).\n- serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (git-fixes).\n- smb: client: reject userspace cifs.spnego descriptions (bsc#1266238).\n- spi: ep93xx: fix error pointer deref after DMA setup failure (git-fixes).\n- spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() (git-fixes).\n- spi: qup: fix error pointer deref after DMA setup failure (git-fixes).\n- spi: sprd: fix error pointer deref after DMA setup failure (git-fixes).\n- spi: ti-qspi: fix use-after-free after DMA setup failure (git-fixes).\n- thunderbolt: property: Reject dir_len \u003c 4 to prevent size_t underflow (git-fixes).\n- thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() (git-fixes).\n- tracing: Switch trace_osnoise.c code over to use guard() and __free() (bsc#1262634).\n- tty: serial: pch_uart: add check for dma_alloc_coherent() (git-fixes).\n- tty: serial: samsung: Remove redundant port lock acquisition in rx helpers (git-fixes).\n- USB: cdc-acm: Fix bit overlap and move quirk definitions to header (git-fixes).\n- usb: cdns3: gadget: fix request skipping after clearing halt (git-fixes).\n- usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure (git-fixes).\n- usb: chipidea: core: convert ci_role_switch to local variable (git-fixes).\n- usb: dwc2: Fix use after free in debug code (git-fixes).\n- usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling (git-fixes).\n- usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports (git-fixes).\n- usb: gadget: f_fs: copy only received bytes on short ep0 read (git-fixes).\n- usb: gadget: f_fs: serialize DMABUF cancel against request completion (git-fixes).\n- usb: gadget: f_hid: fix device reference leak in hidg_alloc() (git-fixes).\n- usb: gadget: net2280: Fix double free in probe error path (git-fixes).\n- usb: gadget: uvc: hold opts-\u003elock across XU walks in uvc_function_bind (git-fixes).\n- USB: serial: belkin_sa: validate interrupt status length (git-fixes).\n- USB: serial: cypress_m8: validate interrupt packet headers (git-fixes).\n- USB: serial: keyspan: fix missing indat transfer sanity check (git-fixes).\n- USB: serial: mct_u232: fix missing interrupt-in transfer sanity check (git-fixes).\n- USB: serial: mxuport: fix memory corruption with small endpoint (git-fixes).\n- USB: serial: omninet: fix memory corruption with small endpoint (git-fixes).\n- USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL (git-fixes).\n- USB: serial: safe_serial: fix memory corruption with small endpoint (git-fixes).\n- usb: typec: tcpm: improve handling of DISCOVER_MODES failures (git-fixes).\n- usb: typec: ucsi: Don't update power_supply on power role change if not connected (git-fixes).\n- usb: usbtmc: check URB actual_length for interrupt-IN notifications (git-fixes).\n- usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize (git-fixes).\n- usbip: vudc: Fix use after free bug in vudc_remove due to race condition (git-fixes).\n- virt: sev-guest: Explicitly leak pages in unknown state (git-fixes).\n- wifi: ath10k: skip WMI and beacon transmission when device is wedged (git-fixes).\n- wifi: ath11k: clear shared SRNG pointer state on restart (git-fixes).\n- wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() (git-fixes).\n- wifi: ath11k: fix error path leaks in some WMI calls (git-fixes).\n- wifi: ath11k: fix error path leaks in some WMI WOW calls (git-fixes).\n- wifi: ath11k: fix peer resolution on rx path when peer_id=0 (git-fixes).\n- wifi: ath11k: fix use after free in ath11k_dp_rx_msdu_coalesce() (git-fixes).\n- wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (git-fixes).\n- wifi: mac80211: consume only present negotiated TTLM maps (git-fixes).\n- wifi: mac80211: fix MLE defragmentation (git-fixes).\n- wifi: mac80211: fix multi-link element inheritance (git-fixes).\n","status":"published","published":"2026-06-05T16:12:36Z","modified":"2026-07-09T18:24:07.960556357Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:22048-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2023-20585: iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 (bsc#1243603).\n- CVE-2026-3150: bcache: fix cached_dev.sb_bio use-after-free and crash (bsc#1263169).\n- CVE-2026-23359: bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584).\n- CVE-2026-23380: tracing: Fix WARN_ON in tracing_buffers_mmap_close (bsc#1260539).\n- CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).\n- CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).\n- CVE-2026-31480: tracing: Fix potential deadlock in cpu hotplug with osnoise (bsc#1262634).\n- CVE-2026-31483: s390/barrier: Make array_index_mask_nospec() __always_inline (bsc#1261590 bsc#1262771).\n- CVE-2026-31493: RDMA/efa: Fix use of completion ctx after free (bsc#1262668).\n- CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).\n- CVE-2026-31521: module: Fix kernel panic when a symbol st_shndx is out of bounds (bsc#1263102).\n- CVE-2026-31568: s390/mm: Add missing secure storage access fixups for donated memory (bsc#1263068).\n- CVE-2026-31575: mm/userfaultfd: fix hugetlb fault mutex hash calculation (bsc#1263067).\n- CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).\n- CVE-2026-31614: smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774).\n- CVE-2026-31729: usb: typec: ucsi: validate connector number in ucsi_notify_common() (bsc#1264112).\n- CVE-2026-31736: net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled (bsc#1263908).\n- CVE-2026-43012: net/mlx5: Fix switchdev mode rollback in case of failure (bsc#1264016).\n- CVE-2026-43013: net/mlx5: lag: Check for LAG device before creating debugfs (bsc#1264011).\n- CVE-2026-43054: scsi: target: tcm_loop: Drain commands in target_reset handler (bsc#1264063).\n- CVE-2026-43112: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (bsc#1264437).\n- CVE-2026-43234: team: avoid NETDEV_CHANGEMTU event when unregistering slave (bsc#1264409).\n- CVE-2026-43252: mptcp: pm: in-kernel: always set ID as avail when rm endp (bsc#1264300).\n- CVE-2026-43325: wifi: iwlwifi: mvm: don't send a 6E related command when not supported (bsc#1265110).\n- CVE-2026-43328: cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path (bsc#1264832).\n- CVE-2026-43333: bpf: reject direct access to nullable PTR_TO_BUF pointers (bsc#1264726).\n- CVE-2026-43338: btrfs: reserve enough transaction items for qgroup ioctls (bsc#1264716).\n- CVE-2026-43341: net/ipv6: ioam6: prevent schema length wraparound in trace fill (bsc#1265044).\n- CVE-2026-43359: btrfs: fix transaction abort on set received ioctl due to item overflow (bsc#1264719).\n- CVE-2026-43360: btrfs: fix transaction abort on file creation due to name hash collision (bsc#1264720).\n- CVE-2026-43361: btrfs: fix transaction abort when snapshotting received subvolumes (bsc#1264722).\n- CVE-2026-43362: smb: client: fix in-place encryption corruption in SMB2_write() (bsc#1264989).\n- CVE-2026-43414: scsi: qla2xxx: Completely fix fcport double free (bsc#1264669).\n- CVE-2026-43499: rtmutex: Use waiter::task instead of current in remove_waiter() (bsc#1266001).\n- CVE-2026-45843: slip: bound decode() reads against the compressed packet length (bsc#1266395).\n- CVE-2026-46110: net: stmmac: rename STMMAC_GET_ENTRY() -\u003e STMMAC_NEXT_ENTRY() (bsc#1266759).\n\nThe following non security issues were fixed:\n\n- ACPI: x86: cmos_rtc: Clean up address space handler driver (stable-fixes).\n- ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver (git-fixes).\n- ALSA: asihpi: Fix potential OOB array access at reading cache (stable-fixes).\n- ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 (stable-fixes).\n- ALSA: pcm: Don't setup bogus iov_iter for silencing (git-fixes).\n- ALSA: pcm: oss: Fix setup list UAF on proc write error (git-fixes).\n- ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417 (git-fixes).\n- ALSA: seq: avoid past-the-end iterator in snd_seq_create_port() (git-fixes).\n- ALSA: seq: Serialize UMP output teardown with event_input (git-fixes).\n- ALSA: timer: avoid past-the-end iterator in snd_timer_dev_register() (git-fixes).\n- ALSA: ua101: Reject too-short USB descriptors (git-fixes).\n- arm64: tlb: Flush walk cache when unsharing PMD tables (git-fixes).\n- ASoC: codecs: simple-mux: Fix enum control bounds check (git-fixes).\n- ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() (git-fixes).\n- ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors (git-fixes).\n- ASoC: qcom: q6asm-dai: close stream only when running (git-fixes).\n- ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks (git-fixes).\n- ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params (git-fixes).\n- ASoC: SOF: ipc3: Use standard dev_dbg API (stable-fixes).\n- auxdisplay: line-display: fix OOB read on zero-length message_store() (git-fixes).\n- bcache: fix uninitialized closure object (git-fixes).\n- Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() (git-fixes).\n- Bluetooth: bnep: Fix UAF read of dev-\u003ename (git-fixes).\n- Bluetooth: btmtk: accept too short WMT FUNC_CTRL events (git-fixes).\n- Bluetooth: btmtk: fix urb-\u003esetup_packet leak in error paths (git-fixes).\n- Bluetooth: btusb: Allow firmware re-download when version matches (git-fixes).\n- Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (git-fixes).\n- Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (git-fixes).\n- Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (git-fixes).\n- Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (git-fixes).\n- Bluetooth: HIDP: fix missing length checks in hidp_input_report() (git-fixes).\n- Bluetooth: ISO: drop ISO_END frames received without prior ISO_START (git-fixes).\n- Bluetooth: ISO: fix UAF in iso_recv_frame (git-fixes).\n- Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (git-fixes).\n- Bluetooth: l2cap: clear chan-\u003eident on ECRED reconfiguration success (git-fixes).\n- Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer (git-fixes).\n- Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn (git-fixes).\n- Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (git-fixes).\n- Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (git-fixes).\n- Bluetooth: MGMT: validate Add Extended Advertising Data length (git-fixes).\n- Bluetooth: serialize accept_q access (git-fixes).\n- btrfs: do not mark inode incompressible after inline attempt fails (git-fixes).\n- comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() (git-fixes).\n- comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() (git-fixes).\n- device property: set fwnode-\u003esecondary to NULL in fwnode_init() (git-fixes).\n- dm: fix a buffer overflow in ioctl processing (git-fixes).\n- drm/amd/display: Fix integer overflow in bios_get_image() (stable-fixes).\n- drm/amd/display: Validate GPIO pin LUT table size before iterating (stable-fixes).\n- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (stable-fixes).\n- drm/amd/pm/si: Disregard vblank time when no displays are connected (git-fixes).\n- drm/amdgpu/uvd3.1: Don't validate the firmware when already validated (git-fixes).\n- drm/amdgpu/uvd4.2: Don't initialize UVD 4.2 when DPM is disabled (git-fixes).\n- drm/amdgpu/vce2: Fix VCE 2 firmware size and offsets (git-fixes).\n- drm/amdgpu/vce3: Fix VCE 3 firmware size and offsets (git-fixes).\n- drm/amdgpu/vpe: Force collaborate sync after TRAP (stable-fixes).\n- drm/amdgpu: add amdgpu_device reference in ip block (stable-fixes).\n- drm/amdgpu: fix spelling typos (stable-fixes).\n- drm/amdgpu: update the handle ptr in dump_ip_state (stable-fixes).\n- drm/amdgpu: update the handle ptr in early_init (stable-fixes).\n- drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe (git-fixes).\n- drm/bridge: it66121: acquire reset GPIO in probe (git-fixes).\n- drm/bridge: megachips: remove bridge when irq request fails (git-fixes).\n- drm/hyperv: validate resolution_count and fix WIN8 fallback (git-fixes).\n- drm/hyperv: validate VMBus packet size in receive callback (git-fixes).\n- drm/i915/dp: Fix readback for target_rr in Adaptive Sync SDP (git-fixes).\n- drm/i915: Fix potential UAF in TTM object purge (git-fixes).\n- drm/msm/dsi: don't dump registers past the mapped region (git-fixes).\n- drm/msm/snapshot: fix dumping of the unaligned regions (git-fixes).\n- drm/radeon/evergreen_cs: Add missing NULL prefix check in surface check (git-fixes).\n- drm/virtio: use uninterruptible resv lock for plane updates (git-fixes).\n- drm/xe/gsc: Fix double-free of managed BO in error path (git-fixes).\n- drm/xe/oa: Fix exec_queue leak on width check in stream open (git-fixes).\n- drm/xe/pf: Fix CFI failure in debugfs access (git-fixes).\n- drm/xe/vf: Fix signature of print functions (git-fixes).\n- drm/xe: Define CACHE_MODE_1 as MCR register (git-fixes).\n- efi: Allocate runtime workqueue before ACPI init (git-fixes).\n- firmware: arm_ffa: Align RxTx buffer size before mapping (git-fixes).\n- firmware: arm_ffa: Check for NULL FF-A ID table while driver registration (git-fixes).\n- firmware: arm_ffa: Fix per-vcpu self notifications handling in workqueue (git-fixes).\n- firmware: arm_ffa: Skip free_pages on RX buffer alloc failure (git-fixes).\n- gve: Add RSS cache for non RSS device option scenario (bsc#1265925).\n- gve: add XDP DROP and PASS support for DQ (bsc#1265925).\n- gve: Enable reading max ring size from the device in DQO-QPL mode (bsc#1265925).\n- gve: introduce config-based allocation for XDP (bsc#1265925).\n- gve: merge packet buffer size fields (bsc#1265925).\n- gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (bsc#1265925).\n- gve: update GQ RX to use buf_size (bsc#1265925).\n- gve: Update QPL page registration logic (bsc#1265925).\n- gve: update XDP allocation path support RX buffer posting (bsc#1265925).\n- HID: playstation: Clamp num_touch_reports (git-fixes).\n- HID: quirks: really enable the intended work around for appledisplay (git-fixes).\n- HID: uclogic: Fix regression of input name assignment (git-fixes).\n- hwmon: (lenovo-ec-sensors): Convert to devm_request_region() (git-fixes).\n- hwmon: (lenovo-ec-sensors): Fix EC \"MCHP\" signature validation logic (git-fixes).\n- hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer (git-fixes).\n- hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR (git-fixes).\n- hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple (git-fixes).\n- hwmon: (pmbus/adm1266) include adapter number in GPIO line label (git-fixes).\n- hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer (git-fixes).\n- hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() (git-fixes).\n- hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() (git-fixes).\n- hwmon: (pmbus/adm1266) reject implausible blackbox record_count (git-fixes).\n- hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors (git-fixes).\n- hwmon: (pmbus/adm1266) seed timestamp from the real-time clock (git-fixes).\n- hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX (git-fixes).\n- iio: adc: mt6359: fix unchecked return value in mt6358_read_imp (git-fixes).\n- iio: adc: npcm: fix unbalanced clk_disable_unprepare() (git-fixes).\n- iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw (git-fixes).\n- iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux (git-fixes).\n- iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (git-fixes).\n- iio: buffer: hw-consumer: fix use-after-free in error path (git-fixes).\n- iio: dac: ad5686: acquire lock when doing powerdown control (git-fixes).\n- iio: dac: ad5686: fix input raw value check (git-fixes).\n- iio: dac: max5821: fix return value check in powerdown sync (git-fixes).\n- iio: gyro: adis16260: fix division by zero in write_raw (git-fixes).\n- iio: gyro: itg3200: fix i2c read into the wrong stack location (git-fixes).\n- iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer (git-fixes).\n- iio: light: cm3323: fix reg_conf not being initialized correctly (git-fixes).\n- iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL (git-fixes).\n- iio: ssp_sensors: cancel delayed work_refresh on remove (git-fixes).\n- iio: temperature: tsys01: fix broken PROM checksum validation (git-fixes).\n- Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem (git-fixes).\n- Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() (git-fixes).\n- Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size (git-fixes).\n- Input: xpad - fix out-of-bounds access for Share button (git-fixes).\n- KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE (git-fixes).\n- KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation (git-fixes).\n- KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 (git-fixes).\n- KVM: x86: Fix Xen hypercall tracepoint argument assignment (git-fixes).\n- KVM: x86: Return the VM's configured APIC bus frequency when queried (git-fixes).\n- media: i2c: og01a1b: Fix V4L2 subdevice data initialization on probe (git-fixes).\n- media: i2c: og01a1b: Replace client-\u003edev usage (stable-fixes).\n- net: mana: Add NULL guards in teardown path to prevent panic on attach failure (git-fixes).\n- net: mana: Expose hardware diagnostic info via debugfs (bsc#1266414).\n- net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (bsc#1265928).\n- net: mana: hardening: Reject zero max_num_queues from GDMA_QUERY_MAX_RESOURCES (git-fixes).\n- net: mana: hardening: Reject zero max_num_queues from MANA_QUERY_VPORT_CONFIG (git-fixes).\n- net: mana: Skip redundant detach on already-detached port (git-fixes).\n- net: mana: Use kvmalloc for large RX queue and buffer allocations (bsc#1266765).\n- net: mana: Use per-queue allocation for tx_qp to reduce allocation size (bsc#1266765).\n- net: mana: validate rx_req_idx to prevent out-of-bounds array access (bsc#1266402).\n- parport: Fix race between port and client registration (git-fixes).\n- platform/surface: aggregator_registry: omit battery \u0026 AC nodes on Surface Laptop 7 (git-fixes).\n- platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL (git-fixes).\n- platform/x86: hp_accel: Check ACPI_COMPANION() against NULL (git-fixes).\n- platform/x86: intel-hid: Check ACPI_HANDLE() against NULL (git-fixes).\n- platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL (git-fixes).\n- RDMA/efa: Check stored completion CTX command ID with received one (git-fixes).\n- RDMA/efa: Extend admin timeout error print (git-fixes).\n- RDMA/efa: Fix possible deadlock (git-fixes).\n- RDMA/efa: Improve admin completion context state machine (git-fixes).\n- RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port (git-fixes).\n- Revert \"ACPI: CPPC: Adjust debug messages in amd_set_max_freq_ratio() to warn\" (git-fixes).\n- s390/pfault: Fix virtual vs physical address confusion (bsc#1262754).\n- scsi: devinfo: Add BLIST_SKIP_IO_HINTS for Iomega ZIP (git-fixes).\n- scsi: mpi3mr: Clear reset history on ready and recheck state after timeout (git-fixes).\n- scsi: ses: Handle positive SCSI error from ses_recv_diag() (git-fixes).\n- scsi: ufs: core: Fix shift out of bounds when MAXQ=32 (git-fixes).\n- security/keys: fix missed RCU read section on lookup (stable-fixes).\n- serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma (git-fixes).\n- serial: qcom-geni: fix UART_RX_PAR_EN bit position (git-fixes).\n- serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (git-fixes).\n- smb: client: reject userspace cifs.spnego descriptions (bsc#1266238).\n- spi: ep93xx: fix error pointer deref after DMA setup failure (git-fixes).\n- spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() (git-fixes).\n- spi: qup: fix error pointer deref after DMA setup failure (git-fixes).\n- spi: sprd: fix error pointer deref after DMA setup failure (git-fixes).\n- spi: ti-qspi: fix use-after-free after DMA setup failure (git-fixes).\n- thunderbolt: property: Reject dir_len \u003c 4 to prevent size_t underflow (git-fixes).\n- thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() (git-fixes).\n- tracing: Switch trace_osnoise.c code over to use guard() and __free() (bsc#1262634).\n- tty: serial: pch_uart: add check for dma_alloc_coherent() (git-fixes).\n- tty: serial: samsung: Remove redundant port lock acquisition in rx helpers (git-fixes).\n- USB: cdc-acm: Fix bit overlap and move quirk definitions to header (git-fixes).\n- usb: cdns3: gadget: fix request skipping after clearing halt (git-fixes).\n- usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure (git-fixes).\n- usb: chipidea: core: convert ci_role_switch to local variable (git-fixes).\n- usb: dwc2: Fix use after free in debug code (git-fixes).\n- usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling (git-fixes).\n- usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports (git-fixes).\n- usb: gadget: f_fs: copy only received bytes on short ep0 read (git-fixes).\n- usb: gadget: f_fs: serialize DMABUF cancel against request completion (git-fixes).\n- usb: gadget: f_hid: fix device reference leak in hidg_alloc() (git-fixes).\n- usb: gadget: net2280: Fix double free in probe error path (git-fixes).\n- usb: gadget: uvc: hold opts-\u003elock across XU walks in uvc_function_bind (git-fixes).\n- USB: serial: belkin_sa: validate interrupt status length (git-fixes).\n- USB: serial: cypress_m8: validate interrupt packet headers (git-fixes).\n- USB: serial: keyspan: fix missing indat transfer sanity check (git-fixes).\n- USB: serial: mct_u232: fix missing interrupt-in transfer sanity check (git-fixes).\n- USB: serial: mxuport: fix memory corruption with small endpoint (git-fixes).\n- USB: serial: omninet: fix memory corruption with small endpoint (git-fixes).\n- USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL (git-fixes).\n- USB: serial: safe_serial: fix memory corruption with small endpoint (git-fixes).\n- usb: typec: tcpm: improve handling of DISCOVER_MODES failures (git-fixes).\n- usb: typec: ucsi: Don't update power_supply on power role change if not connected (git-fixes).\n- usb: usbtmc: check URB actual_length for interrupt-IN notifications (git-fixes).\n- usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize (git-fixes).\n- usbip: vudc: Fix use after free bug in vudc_remove due to race condition (git-fixes).\n- virt: sev-guest: Explicitly leak pages in unknown state (git-fixes).\n- wifi: ath10k: skip WMI and beacon transmission when device is wedged (git-fixes).\n- wifi: ath11k: clear shared SRNG pointer state on restart (git-fixes).\n- wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() (git-fixes).\n- wifi: ath11k: fix error path leaks in some WMI calls (git-fixes).\n- wifi: ath11k: fix error path leaks in some WMI WOW calls (git-fixes).\n- wifi: ath11k: fix peer resolution on rx path when peer_id=0 (git-fixes).\n- wifi: ath11k: fix use after free in ath11k_dp_rx_msdu_coalesce() (git-fixes).\n- wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (git-fixes).\n- wifi: mac80211: consume only present negotiated TTLM maps (git-fixes).\n- wifi: mac80211: fix MLE defragmentation (git-fixes).\n- wifi: mac80211: fix multi-link element inheritance (git-fixes).\n","status":"published","published":"2026-06-05T17:10:52Z","modified":"2026-06-10T18:24:10.930842247Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:22076-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2023-20585: iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 (bsc#1243603).\n- CVE-2026-3150: bcache: fix cached_dev.sb_bio use-after-free and crash (bsc#1263169).\n- CVE-2026-23359: bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584).\n- CVE-2026-23380: tracing: Fix WARN_ON in tracing_buffers_mmap_close (bsc#1260539).\n- CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).\n- CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).\n- CVE-2026-31480: tracing: Fix potential deadlock in cpu hotplug with osnoise (bsc#1262634).\n- CVE-2026-31483: s390/barrier: Make array_index_mask_nospec() __always_inline (bsc#1261590 bsc#1262771).\n- CVE-2026-31493: RDMA/efa: Fix use of completion ctx after free (bsc#1262668).\n- CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).\n- CVE-2026-31521: module: Fix kernel panic when a symbol st_shndx is out of bounds (bsc#1263102).\n- CVE-2026-31568: s390/mm: Add missing secure storage access fixups for donated memory (bsc#1263068).\n- CVE-2026-31575: mm/userfaultfd: fix hugetlb fault mutex hash calculation (bsc#1263067).\n- CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).\n- CVE-2026-31614: smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774).\n- CVE-2026-31729: usb: typec: ucsi: validate connector number in ucsi_notify_common() (bsc#1264112).\n- CVE-2026-31736: net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled (bsc#1263908).\n- CVE-2026-43012: net/mlx5: Fix switchdev mode rollback in case of failure (bsc#1264016).\n- CVE-2026-43013: net/mlx5: lag: Check for LAG device before creating debugfs (bsc#1264011).\n- CVE-2026-43054: scsi: target: tcm_loop: Drain commands in target_reset handler (bsc#1264063).\n- CVE-2026-43112: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (bsc#1264437).\n- CVE-2026-43234: team: avoid NETDEV_CHANGEMTU event when unregistering slave (bsc#1264409).\n- CVE-2026-43252: mptcp: pm: in-kernel: always set ID as avail when rm endp (bsc#1264300).\n- CVE-2026-43325: wifi: iwlwifi: mvm: don't send a 6E related command when not supported (bsc#1265110).\n- CVE-2026-43328: cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path (bsc#1264832).\n- CVE-2026-43333: bpf: reject direct access to nullable PTR_TO_BUF pointers (bsc#1264726).\n- CVE-2026-43338: btrfs: reserve enough transaction items for qgroup ioctls (bsc#1264716).\n- CVE-2026-43341: net/ipv6: ioam6: prevent schema length wraparound in trace fill (bsc#1265044).\n- CVE-2026-43359: btrfs: fix transaction abort on set received ioctl due to item overflow (bsc#1264719).\n- CVE-2026-43360: btrfs: fix transaction abort on file creation due to name hash collision (bsc#1264720).\n- CVE-2026-43361: btrfs: fix transaction abort when snapshotting received subvolumes (bsc#1264722).\n- CVE-2026-43362: smb: client: fix in-place encryption corruption in SMB2_write() (bsc#1264989).\n- CVE-2026-43414: scsi: qla2xxx: Completely fix fcport double free (bsc#1264669).\n- CVE-2026-43499: rtmutex: Use waiter::task instead of current in remove_waiter() (bsc#1266001).\n- CVE-2026-45843: slip: bound decode() reads against the compressed packet length (bsc#1266395).\n- CVE-2026-46110: net: stmmac: rename STMMAC_GET_ENTRY() -\u003e STMMAC_NEXT_ENTRY() (bsc#1266759).\n\nThe following non security issues were fixed:\n\n- ACPI: x86: cmos_rtc: Clean up address space handler driver (stable-fixes).\n- ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver (git-fixes).\n- ALSA: asihpi: Fix potential OOB array access at reading cache (stable-fixes).\n- ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 (stable-fixes).\n- ALSA: pcm: Don't setup bogus iov_iter for silencing (git-fixes).\n- ALSA: pcm: oss: Fix setup list UAF on proc write error (git-fixes).\n- ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417 (git-fixes).\n- ALSA: seq: avoid past-the-end iterator in snd_seq_create_port() (git-fixes).\n- ALSA: seq: Serialize UMP output teardown with event_input (git-fixes).\n- ALSA: timer: avoid past-the-end iterator in snd_timer_dev_register() (git-fixes).\n- ALSA: ua101: Reject too-short USB descriptors (git-fixes).\n- arm64: tlb: Flush walk cache when unsharing PMD tables (git-fixes).\n- ASoC: codecs: simple-mux: Fix enum control bounds check (git-fixes).\n- ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() (git-fixes).\n- ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors (git-fixes).\n- ASoC: qcom: q6asm-dai: close stream only when running (git-fixes).\n- ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks (git-fixes).\n- ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params (git-fixes).\n- ASoC: SOF: ipc3: Use standard dev_dbg API (stable-fixes).\n- auxdisplay: line-display: fix OOB read on zero-length message_store() (git-fixes).\n- bcache: fix uninitialized closure object (git-fixes).\n- Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() (git-fixes).\n- Bluetooth: bnep: Fix UAF read of dev-\u003ename (git-fixes).\n- Bluetooth: btmtk: accept too short WMT FUNC_CTRL events (git-fixes).\n- Bluetooth: btmtk: fix urb-\u003esetup_packet leak in error paths (git-fixes).\n- Bluetooth: btusb: Allow firmware re-download when version matches (git-fixes).\n- Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (git-fixes).\n- Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (git-fixes).\n- Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (git-fixes).\n- Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (git-fixes).\n- Bluetooth: HIDP: fix missing length checks in hidp_input_report() (git-fixes).\n- Bluetooth: ISO: drop ISO_END frames received without prior ISO_START (git-fixes).\n- Bluetooth: ISO: fix UAF in iso_recv_frame (git-fixes).\n- Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (git-fixes).\n- Bluetooth: l2cap: clear chan-\u003eident on ECRED reconfiguration success (git-fixes).\n- Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer (git-fixes).\n- Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn (git-fixes).\n- Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (git-fixes).\n- Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (git-fixes).\n- Bluetooth: MGMT: validate Add Extended Advertising Data length (git-fixes).\n- Bluetooth: serialize accept_q access (git-fixes).\n- btrfs: do not mark inode incompressible after inline attempt fails (git-fixes).\n- comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() (git-fixes).\n- comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() (git-fixes).\n- device property: set fwnode-\u003esecondary to NULL in fwnode_init() (git-fixes).\n- dm: fix a buffer overflow in ioctl processing (git-fixes).\n- drm/amd/display: Fix integer overflow in bios_get_image() (stable-fixes).\n- drm/amd/display: Validate GPIO pin LUT table size before iterating (stable-fixes).\n- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (stable-fixes).\n- drm/amd/pm/si: Disregard vblank time when no displays are connected (git-fixes).\n- drm/amdgpu/uvd3.1: Don't validate the firmware when already validated (git-fixes).\n- drm/amdgpu/uvd4.2: Don't initialize UVD 4.2 when DPM is disabled (git-fixes).\n- drm/amdgpu/vce2: Fix VCE 2 firmware size and offsets (git-fixes).\n- drm/amdgpu/vce3: Fix VCE 3 firmware size and offsets (git-fixes).\n- drm/amdgpu/vpe: Force collaborate sync after TRAP (stable-fixes).\n- drm/amdgpu: add amdgpu_device reference in ip block (stable-fixes).\n- drm/amdgpu: fix spelling typos (stable-fixes).\n- drm/amdgpu: update the handle ptr in dump_ip_state (stable-fixes).\n- drm/amdgpu: update the handle ptr in early_init (stable-fixes).\n- drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe (git-fixes).\n- drm/bridge: it66121: acquire reset GPIO in probe (git-fixes).\n- drm/bridge: megachips: remove bridge when irq request fails (git-fixes).\n- drm/hyperv: validate resolution_count and fix WIN8 fallback (git-fixes).\n- drm/hyperv: validate VMBus packet size in receive callback (git-fixes).\n- drm/i915/dp: Fix readback for target_rr in Adaptive Sync SDP (git-fixes).\n- drm/i915: Fix potential UAF in TTM object purge (git-fixes).\n- drm/msm/dsi: don't dump registers past the mapped region (git-fixes).\n- drm/msm/snapshot: fix dumping of the unaligned regions (git-fixes).\n- drm/radeon/evergreen_cs: Add missing NULL prefix check in surface check (git-fixes).\n- drm/virtio: use uninterruptible resv lock for plane updates (git-fixes).\n- drm/xe/gsc: Fix double-free of managed BO in error path (git-fixes).\n- drm/xe/oa: Fix exec_queue leak on width check in stream open (git-fixes).\n- drm/xe/pf: Fix CFI failure in debugfs access (git-fixes).\n- drm/xe/vf: Fix signature of print functions (git-fixes).\n- drm/xe: Define CACHE_MODE_1 as MCR register (git-fixes).\n- efi: Allocate runtime workqueue before ACPI init (git-fixes).\n- firmware: arm_ffa: Align RxTx buffer size before mapping (git-fixes).\n- firmware: arm_ffa: Check for NULL FF-A ID table while driver registration (git-fixes).\n- firmware: arm_ffa: Fix per-vcpu self notifications handling in workqueue (git-fixes).\n- firmware: arm_ffa: Skip free_pages on RX buffer alloc failure (git-fixes).\n- gve: Add RSS cache for non RSS device option scenario (bsc#1265925).\n- gve: add XDP DROP and PASS support for DQ (bsc#1265925).\n- gve: Enable reading max ring size from the device in DQO-QPL mode (bsc#1265925).\n- gve: introduce config-based allocation for XDP (bsc#1265925).\n- gve: merge packet buffer size fields (bsc#1265925).\n- gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (bsc#1265925).\n- gve: update GQ RX to use buf_size (bsc#1265925).\n- gve: Update QPL page registration logic (bsc#1265925).\n- gve: update XDP allocation path support RX buffer posting (bsc#1265925).\n- HID: playstation: Clamp num_touch_reports (git-fixes).\n- HID: quirks: really enable the intended work around for appledisplay (git-fixes).\n- HID: uclogic: Fix regression of input name assignment (git-fixes).\n- hwmon: (lenovo-ec-sensors): Convert to devm_request_region() (git-fixes).\n- hwmon: (lenovo-ec-sensors): Fix EC \"MCHP\" signature validation logic (git-fixes).\n- hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer (git-fixes).\n- hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR (git-fixes).\n- hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple (git-fixes).\n- hwmon: (pmbus/adm1266) include adapter number in GPIO line label (git-fixes).\n- hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer (git-fixes).\n- hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() (git-fixes).\n- hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() (git-fixes).\n- hwmon: (pmbus/adm1266) reject implausible blackbox record_count (git-fixes).\n- hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors (git-fixes).\n- hwmon: (pmbus/adm1266) seed timestamp from the real-time clock (git-fixes).\n- hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX (git-fixes).\n- iio: adc: mt6359: fix unchecked return value in mt6358_read_imp (git-fixes).\n- iio: adc: npcm: fix unbalanced clk_disable_unprepare() (git-fixes).\n- iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw (git-fixes).\n- iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux (git-fixes).\n- iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (git-fixes).\n- iio: buffer: hw-consumer: fix use-after-free in error path (git-fixes).\n- iio: dac: ad5686: acquire lock when doing powerdown control (git-fixes).\n- iio: dac: ad5686: fix input raw value check (git-fixes).\n- iio: dac: max5821: fix return value check in powerdown sync (git-fixes).\n- iio: gyro: adis16260: fix division by zero in write_raw (git-fixes).\n- iio: gyro: itg3200: fix i2c read into the wrong stack location (git-fixes).\n- iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer (git-fixes).\n- iio: light: cm3323: fix reg_conf not being initialized correctly (git-fixes).\n- iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL (git-fixes).\n- iio: ssp_sensors: cancel delayed work_refresh on remove (git-fixes).\n- iio: temperature: tsys01: fix broken PROM checksum validation (git-fixes).\n- Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem (git-fixes).\n- Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() (git-fixes).\n- Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size (git-fixes).\n- Input: xpad - fix out-of-bounds access for Share button (git-fixes).\n- KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE (git-fixes).\n- KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation (git-fixes).\n- KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 (git-fixes).\n- KVM: x86: Fix Xen hypercall tracepoint argument assignment (git-fixes).\n- KVM: x86: Return the VM's configured APIC bus frequency when queried (git-fixes).\n- media: i2c: og01a1b: Fix V4L2 subdevice data initialization on probe (git-fixes).\n- media: i2c: og01a1b: Replace client-\u003edev usage (stable-fixes).\n- net: mana: Add NULL guards in teardown path to prevent panic on attach failure (git-fixes).\n- net: mana: Expose hardware diagnostic info via debugfs (bsc#1266414).\n- net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (bsc#1265928).\n- net: mana: hardening: Reject zero max_num_queues from GDMA_QUERY_MAX_RESOURCES (git-fixes).\n- net: mana: hardening: Reject zero max_num_queues from MANA_QUERY_VPORT_CONFIG (git-fixes).\n- net: mana: Skip redundant detach on already-detached port (git-fixes).\n- net: mana: Use kvmalloc for large RX queue and buffer allocations (bsc#1266765).\n- net: mana: Use per-queue allocation for tx_qp to reduce allocation size (bsc#1266765).\n- net: mana: validate rx_req_idx to prevent out-of-bounds array access (bsc#1266402).\n- parport: Fix race between port and client registration (git-fixes).\n- platform/surface: aggregator_registry: omit battery \u0026 AC nodes on Surface Laptop 7 (git-fixes).\n- platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL (git-fixes).\n- platform/x86: hp_accel: Check ACPI_COMPANION() against NULL (git-fixes).\n- platform/x86: intel-hid: Check ACPI_HANDLE() against NULL (git-fixes).\n- platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL (git-fixes).\n- RDMA/efa: Check stored completion CTX command ID with received one (git-fixes).\n- RDMA/efa: Extend admin timeout error print (git-fixes).\n- RDMA/efa: Fix possible deadlock (git-fixes).\n- RDMA/efa: Improve admin completion context state machine (git-fixes).\n- RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port (git-fixes).\n- Revert \"ACPI: CPPC: Adjust debug messages in amd_set_max_freq_ratio() to warn\" (git-fixes).\n- s390/pfault: Fix virtual vs physical address confusion (bsc#1262754).\n- scsi: devinfo: Add BLIST_SKIP_IO_HINTS for Iomega ZIP (git-fixes).\n- scsi: mpi3mr: Clear reset history on ready and recheck state after timeout (git-fixes).\n- scsi: ses: Handle positive SCSI error from ses_recv_diag() (git-fixes).\n- scsi: ufs: core: Fix shift out of bounds when MAXQ=32 (git-fixes).\n- security/keys: fix missed RCU read section on lookup (stable-fixes).\n- serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma (git-fixes).\n- serial: qcom-geni: fix UART_RX_PAR_EN bit position (git-fixes).\n- serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (git-fixes).\n- smb: client: reject userspace cifs.spnego descriptions (bsc#1266238).\n- spi: ep93xx: fix error pointer deref after DMA setup failure (git-fixes).\n- spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() (git-fixes).\n- spi: qup: fix error pointer deref after DMA setup failure (git-fixes).\n- spi: sprd: fix error pointer deref after DMA setup failure (git-fixes).\n- spi: ti-qspi: fix use-after-free after DMA setup failure (git-fixes).\n- thunderbolt: property: Reject dir_len \u003c 4 to prevent size_t underflow (git-fixes).\n- thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() (git-fixes).\n- tracing: Switch trace_osnoise.c code over to use guard() and __free() (bsc#1262634).\n- tty: serial: pch_uart: add check for dma_alloc_coherent() (git-fixes).\n- tty: serial: samsung: Remove redundant port lock acquisition in rx helpers (git-fixes).\n- USB: cdc-acm: Fix bit overlap and move quirk definitions to header (git-fixes).\n- usb: cdns3: gadget: fix request skipping after clearing halt (git-fixes).\n- usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure (git-fixes).\n- usb: chipidea: core: convert ci_role_switch to local variable (git-fixes).\n- usb: dwc2: Fix use after free in debug code (git-fixes).\n- usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling (git-fixes).\n- usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports (git-fixes).\n- usb: gadget: f_fs: copy only received bytes on short ep0 read (git-fixes).\n- usb: gadget: f_fs: serialize DMABUF cancel against request completion (git-fixes).\n- usb: gadget: f_hid: fix device reference leak in hidg_alloc() (git-fixes).\n- usb: gadget: net2280: Fix double free in probe error path (git-fixes).\n- usb: gadget: uvc: hold opts-\u003elock across XU walks in uvc_function_bind (git-fixes).\n- USB: serial: belkin_sa: validate interrupt status length (git-fixes).\n- USB: serial: cypress_m8: validate interrupt packet headers (git-fixes).\n- USB: serial: keyspan: fix missing indat transfer sanity check (git-fixes).\n- USB: serial: mct_u232: fix missing interrupt-in transfer sanity check (git-fixes).\n- USB: serial: mxuport: fix memory corruption with small endpoint (git-fixes).\n- USB: serial: omninet: fix memory corruption with small endpoint (git-fixes).\n- USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL (git-fixes).\n- USB: serial: safe_serial: fix memory corruption with small endpoint (git-fixes).\n- usb: typec: tcpm: improve handling of DISCOVER_MODES failures (git-fixes).\n- usb: typec: ucsi: Don't update power_supply on power role change if not connected (git-fixes).\n- usb: usbtmc: check URB actual_length for interrupt-IN notifications (git-fixes).\n- usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize (git-fixes).\n- usbip: vudc: Fix use after free bug in vudc_remove due to race condition (git-fixes).\n- virt: sev-guest: Explicitly leak pages in unknown state (git-fixes).\n- wifi: ath10k: skip WMI and beacon transmission when device is wedged (git-fixes).\n- wifi: ath11k: clear shared SRNG pointer state on restart (git-fixes).\n- wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() (git-fixes).\n- wifi: ath11k: fix error path leaks in some WMI calls (git-fixes).\n- wifi: ath11k: fix error path leaks in some WMI WOW calls (git-fixes).\n- wifi: ath11k: fix peer resolution on rx path when peer_id=0 (git-fixes).\n- wifi: ath11k: fix use after free in ath11k_dp_rx_msdu_coalesce() (git-fixes).\n- wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (git-fixes).\n- wifi: mac80211: consume only present negotiated TTLM maps (git-fixes).\n- wifi: mac80211: fix MLE defragmentation (git-fixes).\n- wifi: mac80211: fix multi-link element inheritance (git-fixes).\n","status":"published","published":"2026-06-05T16:14:08Z","modified":"2026-06-16T18:24:27.834198043Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:22087-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues\n\nThe following security issues were fixed:\n\n- CVE-2023-20585: iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 (bsc#1243603).\n- CVE-2026-3150: bcache: fix cached_dev.sb_bio use-after-free and crash (bsc#1263169).\n- CVE-2026-23359: bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584).\n- CVE-2026-23380: tracing: Fix WARN_ON in tracing_buffers_mmap_close (bsc#1260539).\n- CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).\n- CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).\n- CVE-2026-31480: tracing: Fix potential deadlock in cpu hotplug with osnoise (bsc#1262634).\n- CVE-2026-31483: s390/barrier: Make array_index_mask_nospec() __always_inline (bsc#1261590 bsc#1262771).\n- CVE-2026-31493: RDMA/efa: Fix use of completion ctx after free (bsc#1262668).\n- CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).\n- CVE-2026-31521: module: Fix kernel panic when a symbol st_shndx is out of bounds (bsc#1263102).\n- CVE-2026-31568: s390/mm: Add missing secure storage access fixups for donated memory (bsc#1263068).\n- CVE-2026-31575: mm/userfaultfd: fix hugetlb fault mutex hash calculation (bsc#1263067).\n- CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).\n- CVE-2026-31614: smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774).\n- CVE-2026-31729: usb: typec: ucsi: validate connector number in ucsi_notify_common() (bsc#1264112).\n- CVE-2026-31736: net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled (bsc#1263908).\n- CVE-2026-43012: net/mlx5: Fix switchdev mode rollback in case of failure (bsc#1264016).\n- CVE-2026-43013: net/mlx5: lag: Check for LAG device before creating debugfs (bsc#1264011).\n- CVE-2026-43054: scsi: target: tcm_loop: Drain commands in target_reset handler (bsc#1264063).\n- CVE-2026-43112: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (bsc#1264437).\n- CVE-2026-43234: team: avoid NETDEV_CHANGEMTU event when unregistering slave (bsc#1264409).\n- CVE-2026-43252: mptcp: pm: in-kernel: always set ID as avail when rm endp (bsc#1264300).\n- CVE-2026-43325: wifi: iwlwifi: mvm: don't send a 6E related command when not supported (bsc#1265110).\n- CVE-2026-43328: cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path (bsc#1264832).\n- CVE-2026-43333: bpf: reject direct access to nullable PTR_TO_BUF pointers (bsc#1264726).\n- CVE-2026-43338: btrfs: reserve enough transaction items for qgroup ioctls (bsc#1264716).\n- CVE-2026-43341: net/ipv6: ioam6: prevent schema length wraparound in trace fill (bsc#1265044).\n- CVE-2026-43359: btrfs: fix transaction abort on set received ioctl due to item overflow (bsc#1264719).\n- CVE-2026-43360: btrfs: fix transaction abort on file creation due to name hash collision (bsc#1264720).\n- CVE-2026-43361: btrfs: fix transaction abort when snapshotting received subvolumes (bsc#1264722).\n- CVE-2026-43362: smb: client: fix in-place encryption corruption in SMB2_write() (bsc#1264989).\n- CVE-2026-43414: scsi: qla2xxx: Completely fix fcport double free (bsc#1264669).\n- CVE-2026-43499: rtmutex: Use waiter::task instead of current in remove_waiter() (bsc#1266001).\n- CVE-2026-45843: slip: bound decode() reads against the compressed packet length (bsc#1266395).\n- CVE-2026-46110: net: stmmac: rename STMMAC_GET_ENTRY() -\u003e STMMAC_NEXT_ENTRY() (bsc#1266759).\n\nThe following non security issues were fixed:\n\n- ACPI: x86: cmos_rtc: Clean up address space handler driver (stable-fixes).\n- ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver (git-fixes).\n- ALSA: asihpi: Fix potential OOB array access at reading cache (stable-fixes).\n- ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 (stable-fixes).\n- ALSA: pcm: Don't setup bogus iov_iter for silencing (git-fixes).\n- ALSA: pcm: oss: Fix setup list UAF on proc write error (git-fixes).\n- ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417 (git-fixes).\n- ALSA: seq: avoid past-the-end iterator in snd_seq_create_port() (git-fixes).\n- ALSA: seq: Serialize UMP output teardown with event_input (git-fixes).\n- ALSA: timer: avoid past-the-end iterator in snd_timer_dev_register() (git-fixes).\n- ALSA: ua101: Reject too-short USB descriptors (git-fixes).\n- arm64: tlb: Flush walk cache when unsharing PMD tables (git-fixes).\n- ASoC: codecs: simple-mux: Fix enum control bounds check (git-fixes).\n- ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove() (git-fixes).\n- ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors (git-fixes).\n- ASoC: qcom: q6asm-dai: close stream only when running (git-fixes).\n- ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks (git-fixes).\n- ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params (git-fixes).\n- ASoC: SOF: ipc3: Use standard dev_dbg API (stable-fixes).\n- auxdisplay: line-display: fix OOB read on zero-length message_store() (git-fixes).\n- bcache: fix uninitialized closure object (git-fixes).\n- Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() (git-fixes).\n- Bluetooth: bnep: Fix UAF read of dev-\u003ename (git-fixes).\n- Bluetooth: btmtk: accept too short WMT FUNC_CTRL events (git-fixes).\n- Bluetooth: btmtk: fix urb-\u003esetup_packet leak in error paths (git-fixes).\n- Bluetooth: btusb: Allow firmware re-download when version matches (git-fixes).\n- Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (git-fixes).\n- Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (git-fixes).\n- Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (git-fixes).\n- Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (git-fixes).\n- Bluetooth: HIDP: fix missing length checks in hidp_input_report() (git-fixes).\n- Bluetooth: ISO: drop ISO_END frames received without prior ISO_START (git-fixes).\n- Bluetooth: ISO: fix UAF in iso_recv_frame (git-fixes).\n- Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (git-fixes).\n- Bluetooth: l2cap: clear chan-\u003eident on ECRED reconfiguration success (git-fixes).\n- Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer (git-fixes).\n- Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn (git-fixes).\n- Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (git-fixes).\n- Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (git-fixes).\n- Bluetooth: MGMT: validate Add Extended Advertising Data length (git-fixes).\n- Bluetooth: serialize accept_q access (git-fixes).\n- btrfs: do not mark inode incompressible after inline attempt fails (git-fixes).\n- comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest() (git-fixes).\n- comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest() (git-fixes).\n- device property: set fwnode-\u003esecondary to NULL in fwnode_init() (git-fixes).\n- dm: fix a buffer overflow in ioctl processing (git-fixes).\n- drm/amd/display: Fix integer overflow in bios_get_image() (stable-fixes).\n- drm/amd/display: Validate GPIO pin LUT table size before iterating (stable-fixes).\n- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (stable-fixes).\n- drm/amd/pm/si: Disregard vblank time when no displays are connected (git-fixes).\n- drm/amdgpu/uvd3.1: Don't validate the firmware when already validated (git-fixes).\n- drm/amdgpu/uvd4.2: Don't initialize UVD 4.2 when DPM is disabled (git-fixes).\n- drm/amdgpu/vce2: Fix VCE 2 firmware size and offsets (git-fixes).\n- drm/amdgpu/vce3: Fix VCE 3 firmware size and offsets (git-fixes).\n- drm/amdgpu/vpe: Force collaborate sync after TRAP (stable-fixes).\n- drm/amdgpu: add amdgpu_device reference in ip block (stable-fixes).\n- drm/amdgpu: fix spelling typos (stable-fixes).\n- drm/amdgpu: update the handle ptr in dump_ip_state (stable-fixes).\n- drm/amdgpu: update the handle ptr in early_init (stable-fixes).\n- drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c probe (git-fixes).\n- drm/bridge: it66121: acquire reset GPIO in probe (git-fixes).\n- drm/bridge: megachips: remove bridge when irq request fails (git-fixes).\n- drm/hyperv: validate resolution_count and fix WIN8 fallback (git-fixes).\n- drm/hyperv: validate VMBus packet size in receive callback (git-fixes).\n- drm/i915/dp: Fix readback for target_rr in Adaptive Sync SDP (git-fixes).\n- drm/i915: Fix potential UAF in TTM object purge (git-fixes).\n- drm/msm/dsi: don't dump registers past the mapped region (git-fixes).\n- drm/msm/snapshot: fix dumping of the unaligned regions (git-fixes).\n- drm/radeon/evergreen_cs: Add missing NULL prefix check in surface check (git-fixes).\n- drm/virtio: use uninterruptible resv lock for plane updates (git-fixes).\n- drm/xe/gsc: Fix double-free of managed BO in error path (git-fixes).\n- drm/xe/oa: Fix exec_queue leak on width check in stream open (git-fixes).\n- drm/xe/pf: Fix CFI failure in debugfs access (git-fixes).\n- drm/xe/vf: Fix signature of print functions (git-fixes).\n- drm/xe: Define CACHE_MODE_1 as MCR register (git-fixes).\n- efi: Allocate runtime workqueue before ACPI init (git-fixes).\n- firmware: arm_ffa: Align RxTx buffer size before mapping (git-fixes).\n- firmware: arm_ffa: Check for NULL FF-A ID table while driver registration (git-fixes).\n- firmware: arm_ffa: Fix per-vcpu self notifications handling in workqueue (git-fixes).\n- firmware: arm_ffa: Skip free_pages on RX buffer alloc failure (git-fixes).\n- gve: Add RSS cache for non RSS device option scenario (bsc#1265925).\n- gve: add XDP DROP and PASS support for DQ (bsc#1265925).\n- gve: Enable reading max ring size from the device in DQO-QPL mode (bsc#1265925).\n- gve: introduce config-based allocation for XDP (bsc#1265925).\n- gve: merge packet buffer size fields (bsc#1265925).\n- gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (bsc#1265925).\n- gve: update GQ RX to use buf_size (bsc#1265925).\n- gve: Update QPL page registration logic (bsc#1265925).\n- gve: update XDP allocation path support RX buffer posting (bsc#1265925).\n- HID: playstation: Clamp num_touch_reports (git-fixes).\n- HID: quirks: really enable the intended work around for appledisplay (git-fixes).\n- HID: uclogic: Fix regression of input name assignment (git-fixes).\n- hwmon: (lenovo-ec-sensors): Convert to devm_request_region() (git-fixes).\n- hwmon: (lenovo-ec-sensors): Fix EC \"MCHP\" signature validation logic (git-fixes).\n- hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer (git-fixes).\n- hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR (git-fixes).\n- hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO read in get_multiple (git-fixes).\n- hwmon: (pmbus/adm1266) include adapter number in GPIO line label (git-fixes).\n- hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer (git-fixes).\n- hwmon: (pmbus/adm1266) register the gpio_chip after pmbus_do_probe() (git-fixes).\n- hwmon: (pmbus/adm1266) register the nvmem device after pmbus_do_probe() (git-fixes).\n- hwmon: (pmbus/adm1266) reject implausible blackbox record_count (git-fixes).\n- hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors (git-fixes).\n- hwmon: (pmbus/adm1266) seed timestamp from the real-time clock (git-fixes).\n- hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX (git-fixes).\n- iio: adc: mt6359: fix unchecked return value in mt6358_read_imp (git-fixes).\n- iio: adc: npcm: fix unbalanced clk_disable_unprepare() (git-fixes).\n- iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw (git-fixes).\n- iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux (git-fixes).\n- iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (git-fixes).\n- iio: buffer: hw-consumer: fix use-after-free in error path (git-fixes).\n- iio: dac: ad5686: acquire lock when doing powerdown control (git-fixes).\n- iio: dac: ad5686: fix input raw value check (git-fixes).\n- iio: dac: max5821: fix return value check in powerdown sync (git-fixes).\n- iio: gyro: adis16260: fix division by zero in write_raw (git-fixes).\n- iio: gyro: itg3200: fix i2c read into the wrong stack location (git-fixes).\n- iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer (git-fixes).\n- iio: light: cm3323: fix reg_conf not being initialized correctly (git-fixes).\n- iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL (git-fixes).\n- iio: ssp_sensors: cancel delayed work_refresh on remove (git-fixes).\n- iio: temperature: tsys01: fix broken PROM checksum validation (git-fixes).\n- Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem (git-fixes).\n- Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free() (git-fixes).\n- Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size (git-fixes).\n- Input: xpad - fix out-of-bounds access for Share button (git-fixes).\n- KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE (git-fixes).\n- KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation (git-fixes).\n- KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 (git-fixes).\n- KVM: x86: Fix Xen hypercall tracepoint argument assignment (git-fixes).\n- KVM: x86: Return the VM's configured APIC bus frequency when queried (git-fixes).\n- media: i2c: og01a1b: Fix V4L2 subdevice data initialization on probe (git-fixes).\n- media: i2c: og01a1b: Replace client-\u003edev usage (stable-fixes).\n- net: mana: Add NULL guards in teardown path to prevent panic on attach failure (git-fixes).\n- net: mana: Expose hardware diagnostic info via debugfs (bsc#1266414).\n- net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (bsc#1265928).\n- net: mana: hardening: Reject zero max_num_queues from GDMA_QUERY_MAX_RESOURCES (git-fixes).\n- net: mana: hardening: Reject zero max_num_queues from MANA_QUERY_VPORT_CONFIG (git-fixes).\n- net: mana: Skip redundant detach on already-detached port (git-fixes).\n- net: mana: Use kvmalloc for large RX queue and buffer allocations (bsc#1266765).\n- net: mana: Use per-queue allocation for tx_qp to reduce allocation size (bsc#1266765).\n- net: mana: validate rx_req_idx to prevent out-of-bounds array access (bsc#1266402).\n- parport: Fix race between port and client registration (git-fixes).\n- platform/surface: aggregator_registry: omit battery \u0026 AC nodes on Surface Laptop 7 (git-fixes).\n- platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL (git-fixes).\n- platform/x86: hp_accel: Check ACPI_COMPANION() against NULL (git-fixes).\n- platform/x86: intel-hid: Check ACPI_HANDLE() against NULL (git-fixes).\n- platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL (git-fixes).\n- RDMA/efa: Check stored completion CTX command ID with received one (git-fixes).\n- RDMA/efa: Extend admin timeout error print (git-fixes).\n- RDMA/efa: Fix possible deadlock (git-fixes).\n- RDMA/efa: Improve admin completion context state machine (git-fixes).\n- RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port (git-fixes).\n- Revert \"ACPI: CPPC: Adjust debug messages in amd_set_max_freq_ratio() to warn\" (git-fixes).\n- s390/pfault: Fix virtual vs physical address confusion (bsc#1262754).\n- scsi: devinfo: Add BLIST_SKIP_IO_HINTS for Iomega ZIP (git-fixes).\n- scsi: mpi3mr: Clear reset history on ready and recheck state after timeout (git-fixes).\n- scsi: ses: Handle positive SCSI error from ses_recv_diag() (git-fixes).\n- scsi: ufs: core: Fix shift out of bounds when MAXQ=32 (git-fixes).\n- security/keys: fix missed RCU read section on lookup (stable-fixes).\n- serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma (git-fixes).\n- serial: qcom-geni: fix UART_RX_PAR_EN bit position (git-fixes).\n- serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (git-fixes).\n- smb: client: reject userspace cifs.spnego descriptions (bsc#1266238).\n- spi: ep93xx: fix error pointer deref after DMA setup failure (git-fixes).\n- spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache() (git-fixes).\n- spi: qup: fix error pointer deref after DMA setup failure (git-fixes).\n- spi: sprd: fix error pointer deref after DMA setup failure (git-fixes).\n- spi: ti-qspi: fix use-after-free after DMA setup failure (git-fixes).\n- thunderbolt: property: Reject dir_len \u003c 4 to prevent size_t underflow (git-fixes).\n- thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() (git-fixes).\n- tracing: Switch trace_osnoise.c code over to use guard() and __free() (bsc#1262634).\n- tty: serial: pch_uart: add check for dma_alloc_coherent() (git-fixes).\n- tty: serial: samsung: Remove redundant port lock acquisition in rx helpers (git-fixes).\n- USB: cdc-acm: Fix bit overlap and move quirk definitions to header (git-fixes).\n- usb: cdns3: gadget: fix request skipping after clearing halt (git-fixes).\n- usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure (git-fixes).\n- usb: chipidea: core: convert ci_role_switch to local variable (git-fixes).\n- usb: dwc2: Fix use after free in debug code (git-fixes).\n- usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling (git-fixes).\n- usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports (git-fixes).\n- usb: gadget: f_fs: copy only received bytes on short ep0 read (git-fixes).\n- usb: gadget: f_fs: serialize DMABUF cancel against request completion (git-fixes).\n- usb: gadget: f_hid: fix device reference leak in hidg_alloc() (git-fixes).\n- usb: gadget: net2280: Fix double free in probe error path (git-fixes).\n- usb: gadget: uvc: hold opts-\u003elock across XU walks in uvc_function_bind (git-fixes).\n- USB: serial: belkin_sa: validate interrupt status length (git-fixes).\n- USB: serial: cypress_m8: validate interrupt packet headers (git-fixes).\n- USB: serial: keyspan: fix missing indat transfer sanity check (git-fixes).\n- USB: serial: mct_u232: fix missing interrupt-in transfer sanity check (git-fixes).\n- USB: serial: mxuport: fix memory corruption with small endpoint (git-fixes).\n- USB: serial: omninet: fix memory corruption with small endpoint (git-fixes).\n- USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL (git-fixes).\n- USB: serial: safe_serial: fix memory corruption with small endpoint (git-fixes).\n- usb: typec: tcpm: improve handling of DISCOVER_MODES failures (git-fixes).\n- usb: typec: ucsi: Don't update power_supply on power role change if not connected (git-fixes).\n- usb: usbtmc: check URB actual_length for interrupt-IN notifications (git-fixes).\n- usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize (git-fixes).\n- usbip: vudc: Fix use after free bug in vudc_remove due to race condition (git-fixes).\n- virt: sev-guest: Explicitly leak pages in unknown state (git-fixes).\n- wifi: ath10k: skip WMI and beacon transmission when device is wedged (git-fixes).\n- wifi: ath11k: clear shared SRNG pointer state on restart (git-fixes).\n- wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm() (git-fixes).\n- wifi: ath11k: fix error path leaks in some WMI calls (git-fixes).\n- wifi: ath11k: fix error path leaks in some WMI WOW calls (git-fixes).\n- wifi: ath11k: fix peer resolution on rx path when peer_id=0 (git-fixes).\n- wifi: ath11k: fix use after free in ath11k_dp_rx_msdu_coalesce() (git-fixes).\n- wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (git-fixes).\n- wifi: mac80211: consume only present negotiated TTLM maps (git-fixes).\n- wifi: mac80211: fix MLE defragmentation (git-fixes).\n- wifi: mac80211: fix multi-link element inheritance (git-fixes).\n","status":"published","published":"2026-06-05T17:10:52Z","modified":"2026-06-16T18:24:45.453161715Z","updated_at":"2026-11-02T15:54:02.654057Z"}]}}